@tollbooth-dpyc/web 0.1.0

package/dist/debugLog.js

@@ -0,0 +1,29 @@
+/**
+ * An in-memory activity log of MCP calls, for a site's debug panel.
+ *
+ * A ring buffer with subscribers, so the one `callTool` can push and any panel
+ * can listen. It survives route changes and is gone on reload. Arguments are
+ * logged only as the wrapper's own parameters — the npub/proof envelope is
+ * added after logging, so no proof ever lands here.
+ */
+const log = [];
+const listeners = new Set();
+const MAX = 60;
+export function debugPush(type, message) {
+    log.unshift({ ts: new Date().toLocaleTimeString(), type, message });
+    if (log.length > MAX)
+        log.length = MAX;
+    listeners.forEach((fn) => fn());
+}
+export function clearDebug() {
+    log.length = 0;
+    listeners.forEach((fn) => fn());
+}
+export function debugEntries() {
+    return log;
+}
+/** Subscribe to changes. Returns an unsubscribe function. */
+export function onDebug(fn) {
+    listeners.add(fn);
+    return () => listeners.delete(fn);
+}

package/dist/identity.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Who this browser says it is, and what backs the claim.
+ *
+ * Three stored things, kept apart on purpose:
+ *   - the **npub** the app acts as — written only once it is proven;
+ *   - the cached **DM proof** that backs it, when the patron signed in by DM;
+ *   - the **last typed** npub, remembered only to prefill the field. Writing a
+ *     name into the identity slot before it was proven is what once let an
+ *     unanswered challenge become a session.
+ */
+import { type Claim } from "./signedIn.ts";
+export declare function getStoredNpub(): string;
+export declare function setStoredNpub(npub: string): void;
+export declare function getStoredProof(): string;
+export declare function setStoredProof(proof: string): void;
+export declare function clearStoredProof(): void;
+export declare function getLastTypedNpub(): string;
+export declare function setLastTypedNpub(npub: string): void;
+export interface RecentLogin {
+    npub: string;
+    proof: string;
+    /** Unix ms. */
+    expiresAt: number;
+    /** Unix ms. */
+    lastUsed: number;
+}
+/** Unexpired recent logins, most recent first. Prunes the expired ones. */
+export declare function getValidRecentLogins(): RecentLogin[];
+/**
+ * Record or refresh a successful login. The TTL is derated by 30 seconds so a
+ * straggler never serves an already-expired token to the next paid call.
+ */
+export declare function recordRecentLogin(npub: string, proof: string, expiresInSec: number): void;
+export declare function forgetRecentLogin(npub: string): void;
+/** Read once and handed to the pure predicates in `signedIn.ts`. */
+export declare function currentClaim(): Claim;
+export declare function isLoggedIn(): boolean;
+export declare function canSign(): boolean;
+/**
+ * Everything that says who you are goes, including the session key — a
+ * sign-out that leaves a usable signing key behind is not one.
+ */
+export declare function logOut(): void;

package/dist/identity.js

@@ -0,0 +1,106 @@
+/**
+ * Who this browser says it is, and what backs the claim.
+ *
+ * Three stored things, kept apart on purpose:
+ *   - the **npub** the app acts as — written only once it is proven;
+ *   - the cached **DM proof** that backs it, when the patron signed in by DM;
+ *   - the **last typed** npub, remembered only to prefill the field. Writing a
+ *     name into the identity slot before it was proven is what once let an
+ *     unanswered challenge become a session.
+ */
+import { clearSessionNsec, hasSessionNsec, sessionNsecNpub } from "./sessionNsec.js";
+import { canSignFor, isProven } from "./signedIn.js";
+import { readStored, removeStored, writeStored } from "./storage.js";
+const NPUB = "patron_npub:v1";
+const PROOF = "proof_token:v1";
+const LAST_TYPED = "last_typed_npub:v1";
+const RECENT = "recent-logins:v1";
+const MAX_RECENT = 5;
+export function getStoredNpub() {
+    return readStored(NPUB);
+}
+export function setStoredNpub(npub) {
+    writeStored(NPUB, npub);
+}
+export function getStoredProof() {
+    return readStored(PROOF);
+}
+export function setStoredProof(proof) {
+    writeStored(PROOF, proof);
+}
+export function clearStoredProof() {
+    removeStored(PROOF);
+}
+export function getLastTypedNpub() {
+    return readStored(LAST_TYPED);
+}
+export function setLastTypedNpub(npub) {
+    writeStored(LAST_TYPED, npub);
+}
+function readRecent() {
+    try {
+        const parsed = JSON.parse(readStored(RECENT) || "[]");
+        if (!Array.isArray(parsed))
+            return [];
+        return parsed.filter((e) => typeof e === "object" && e !== null &&
+            typeof e.npub === "string" && typeof e.proof === "string" &&
+            typeof e.expiresAt === "number" && typeof e.lastUsed === "number");
+    }
+    catch {
+        return [];
+    }
+}
+function writeRecent(entries) {
+    writeStored(RECENT, JSON.stringify(entries));
+}
+/** Unexpired recent logins, most recent first. Prunes the expired ones. */
+export function getValidRecentLogins() {
+    const now = Date.now();
+    const entries = readRecent();
+    const valid = entries.filter((e) => e.expiresAt > now);
+    if (valid.length !== entries.length)
+        writeRecent(valid);
+    return valid.sort((a, b) => b.lastUsed - a.lastUsed);
+}
+/**
+ * Record or refresh a successful login. The TTL is derated by 30 seconds so a
+ * straggler never serves an already-expired token to the next paid call.
+ */
+export function recordRecentLogin(npub, proof, expiresInSec) {
+    const now = Date.now();
+    const next = {
+        npub,
+        proof,
+        expiresAt: now + Math.max(0, expiresInSec - 30) * 1000,
+        lastUsed: now,
+    };
+    const others = readRecent().filter((e) => e.npub !== npub);
+    writeRecent([next, ...others].slice(0, MAX_RECENT));
+}
+export function forgetRecentLogin(npub) {
+    writeRecent(readRecent().filter((e) => e.npub !== npub));
+}
+// ─── The claim ───────────────────────────────────────────────────────────
+/** Read once and handed to the pure predicates in `signedIn.ts`. */
+export function currentClaim() {
+    return {
+        npub: getStoredNpub(),
+        proof: getStoredProof(),
+        sessionNpub: hasSessionNsec() ? sessionNsecNpub() : null,
+    };
+}
+export function isLoggedIn() {
+    return isProven(currentClaim());
+}
+export function canSign() {
+    return canSignFor(currentClaim());
+}
+/**
+ * Everything that says who you are goes, including the session key — a
+ * sign-out that leaves a usable signing key behind is not one.
+ */
+export function logOut() {
+    removeStored(NPUB);
+    removeStored(PROOF);
+    clearSessionNsec();
+}

package/dist/index.d.ts

@@ -0,0 +1,12 @@
+export { configureTollbooth, tollboothConfig, toolName, type TollboothConfig } from "./config.ts";
+export { callTool, callToolWithContent, onProofExpired, ProofRequiredError, type CallOptions, type ToolAnswer, } from "./client.ts";
+export type { ImageBlock } from "./toolResult.ts";
+export * from "./identity.ts";
+export * from "./standardTools.ts";
+export { clearSessionNsec, getSessionNsec, hasSessionNsec, sessionNsecNpub, setSessionNsec, } from "./sessionNsec.ts";
+export { signInlineProof } from "./inlineProof.ts";
+export { canSignFor, isProven, type Claim } from "./signedIn.ts";
+export { readSignInFailure, type Situation } from "./signInSituation.ts";
+export { canSignProfile, fetchProfile, publishProfile } from "./nostrProfile.ts";
+export * from "./avatar.ts";
+export { clearDebug, debugEntries, debugPush, onDebug, type DebugEntry } from "./debugLog.ts";

package/dist/index.js

@@ -0,0 +1,11 @@
+export { configureTollbooth, tollboothConfig, toolName } from "./config.js";
+export { callTool, callToolWithContent, onProofExpired, ProofRequiredError, } from "./client.js";
+export * from "./identity.js";
+export * from "./standardTools.js";
+export { clearSessionNsec, getSessionNsec, hasSessionNsec, sessionNsecNpub, setSessionNsec, } from "./sessionNsec.js";
+export { signInlineProof } from "./inlineProof.js";
+export { canSignFor, isProven } from "./signedIn.js";
+export { readSignInFailure } from "./signInSituation.js";
+export { canSignProfile, fetchProfile, publishProfile } from "./nostrProfile.js";
+export * from "./avatar.js";
+export { clearDebug, debugEntries, debugPush, onDebug } from "./debugLog.js";

package/dist/inlineProof.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Inline kind-27235 identity proof — Tactic 2 in the wheel's
+ * `identity_proof.verify_proof`. A fresh signed event per paid call, bound to:
+ * the sender pubkey (must match the claimed npub), the `u` tag (must match the
+ * runtime tool name, e.g. "chart_snapshot_display"), and `created_at` (within
+ * about 60 seconds of server time). The wheel verifies the Schnorr signature
+ * inline — no relay round trip, no cached phrase.
+ */
+/** The JSON-stringified signed event, exactly what `verify_proof` expects. */
+export declare function signInlineProof(runtimeToolName: string, secretKey?: Uint8Array): string;

package/dist/inlineProof.js

@@ -0,0 +1,21 @@
+/**
+ * Inline kind-27235 identity proof — Tactic 2 in the wheel's
+ * `identity_proof.verify_proof`. A fresh signed event per paid call, bound to:
+ * the sender pubkey (must match the claimed npub), the `u` tag (must match the
+ * runtime tool name, e.g. "chart_snapshot_display"), and `created_at` (within
+ * about 60 seconds of server time). The wheel verifies the Schnorr signature
+ * inline — no relay round trip, no cached phrase.
+ */
+import { finalizeEvent } from "nostr-tools";
+import { getSessionNsecBytes } from "./sessionNsec.js";
+const PROOF_KIND = 27235;
+/** The JSON-stringified signed event, exactly what `verify_proof` expects. */
+export function signInlineProof(runtimeToolName, secretKey) {
+    const signed = finalizeEvent({
+        kind: PROOF_KIND,
+        created_at: Math.floor(Date.now() / 1000),
+        tags: [["u", runtimeToolName]],
+        content: "",
+    }, secretKey ?? getSessionNsecBytes());
+    return JSON.stringify(signed);
+}

package/dist/nostrProfile.d.ts

@@ -0,0 +1,13 @@
+/**
+ * The patron's Nostr kind-0 profile.
+ *
+ * Relay I/O lives in the wheel. The browser keeps only the part that must stay
+ * client side — SIGNING — with the session key or a NIP-07 extension, and
+ * hands the signed event over. No nsec ever goes to a server.
+ */
+import { type Kind0, type PublishNostrProfileResult } from "./standardTools.ts";
+/** A session key or a NIP-07 signer is present. */
+export declare function canSignProfile(): boolean;
+export declare function fetchProfile(npub: string): Promise<Kind0 | null>;
+/** Sign a kind-0 in the browser and have the wheel relay it. */
+export declare function publishProfile(content: Kind0): Promise<PublishNostrProfileResult>;

package/dist/nostrProfile.js

@@ -0,0 +1,54 @@
+/**
+ * The patron's Nostr kind-0 profile.
+ *
+ * Relay I/O lives in the wheel. The browser keeps only the part that must stay
+ * client side — SIGNING — with the session key or a NIP-07 extension, and
+ * hands the signed event over. No nsec ever goes to a server.
+ */
+import { finalizeEvent } from "nostr-tools";
+import { getStoredNpub } from "./identity.js";
+import { getSessionNsecBytes, hasSessionNsec } from "./sessionNsec.js";
+import { getNostrProfile, publishNostrProfile, } from "./standardTools.js";
+function nip07() {
+    return globalThis.nostr;
+}
+/** A session key or a NIP-07 signer is present. */
+export function canSignProfile() {
+    return hasSessionNsec() || !!nip07();
+}
+export async function fetchProfile(npub) {
+    try {
+        const r = await getNostrProfile(npub);
+        return r.profile && Object.keys(r.profile).length ? r.profile : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Sign a kind-0 in the browser and have the wheel relay it. */
+export async function publishProfile(content) {
+    const clean = {};
+    for (const [k, v] of Object.entries(content)) {
+        if (typeof v === "string" && v.trim())
+            clean[k] = v.trim();
+    }
+    const template = {
+        kind: 0,
+        created_at: Math.floor(Date.now() / 1000),
+        tags: [],
+        content: JSON.stringify(clean),
+    };
+    let signed;
+    const signer = nip07();
+    if (hasSessionNsec()) {
+        signed = finalizeEvent(template, getSessionNsecBytes());
+    }
+    else if (signer) {
+        const pubkey = await signer.getPublicKey();
+        signed = await signer.signEvent({ ...template, pubkey });
+    }
+    else {
+        throw new Error("No signer available — sign in with a session key or a NIP-07 extension to publish your Nostr profile.");
+    }
+    return publishNostrProfile(getStoredNpub(), JSON.stringify(signed));
+}

package/dist/pagesProxy.d.ts

@@ -0,0 +1,22 @@
+/**
+ * A Cloudflare Pages Function that proxies `/mcp` to an operator on Horizon.
+ *
+ * Keeping the browser → MCP transport same-origin avoids CORS preflight
+ * trouble and lets the page use a relative `mcpUrl` of "/mcp". POST (tool
+ * calls), GET (SSE), DELETE (session close) and OPTIONS (preflight).
+ *
+ *   // functions/mcp.js
+ *   import { makeMcpProxy } from "@tollbooth-dpyc/web/pages-proxy";
+ *   export const onRequest = makeMcpProxy("https://chartremotely-mcp.fastmcp.app/mcp");
+ *
+ * Only the headers MCP needs are forwarded upstream. Cookies and anything else
+ * the browser attached stay behind.
+ */
+export declare const CORS_HEADERS: Record<string, string>;
+type Fetch = (input: string, init: RequestInit & {
+    duplex?: string;
+}) => Promise<Response>;
+export declare function makeMcpProxy(upstream: string, fetchImpl?: Fetch): (context: {
+    request: Request;
+}) => Promise<Response>;
+export {};

package/dist/pagesProxy.js

@@ -0,0 +1,54 @@
+/**
+ * A Cloudflare Pages Function that proxies `/mcp` to an operator on Horizon.
+ *
+ * Keeping the browser → MCP transport same-origin avoids CORS preflight
+ * trouble and lets the page use a relative `mcpUrl` of "/mcp". POST (tool
+ * calls), GET (SSE), DELETE (session close) and OPTIONS (preflight).
+ *
+ *   // functions/mcp.js
+ *   import { makeMcpProxy } from "@tollbooth-dpyc/web/pages-proxy";
+ *   export const onRequest = makeMcpProxy("https://chartremotely-mcp.fastmcp.app/mcp");
+ *
+ * Only the headers MCP needs are forwarded upstream. Cookies and anything else
+ * the browser attached stay behind.
+ */
+export const CORS_HEADERS = {
+    "Access-Control-Allow-Origin": "*",
+    "Access-Control-Allow-Methods": "GET, POST, DELETE, OPTIONS",
+    "Access-Control-Allow-Headers": "content-type, mcp-session-id, accept, last-event-id",
+    "Access-Control-Expose-Headers": "mcp-session-id",
+};
+const FORWARDED = new Set(["content-type", "accept", "mcp-session-id", "last-event-id"]);
+export function makeMcpProxy(upstream, fetchImpl = fetch) {
+    const host = new URL(upstream).host;
+    return async function onRequest(context) {
+        const req = context.request;
+        if (req.method === "OPTIONS") {
+            return new Response(null, { status: 204, headers: CORS_HEADERS });
+        }
+        const headers = new Headers();
+        for (const [k, v] of req.headers) {
+            if (FORWARDED.has(k.toLowerCase()))
+                headers.set(k, v);
+        }
+        headers.set("Host", host);
+        const init = { method: req.method, headers };
+        if (req.method !== "GET" && req.method !== "HEAD" && req.method !== "DELETE") {
+            init.body = req.body;
+            init.duplex = "half";
+        }
+        try {
+            const resp = await fetchImpl(upstream, init);
+            const out = new Headers(resp.headers);
+            for (const [k, v] of Object.entries(CORS_HEADERS))
+                out.set(k, v);
+            return new Response(resp.body, { status: resp.status, headers: out });
+        }
+        catch (err) {
+            return new Response(JSON.stringify({ error: "Proxy error", detail: String(err) }), {
+                status: 502,
+                headers: { "Content-Type": "application/json", ...CORS_HEADERS },
+            });
+        }
+    };
+}

package/dist/profilePresentation.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Pure rules for the Nostr profile panel, testable under node:test.
+ */
+export type PublishControlMode = "publish" | "how-to-set";
+/** Without a session key or NIP-07 signer, explain instead of publishing. */
+export declare function publishControlMode(canSign: boolean): PublishControlMode;
+export declare function publishControlLabel(mode: PublishControlMode, publishing: boolean): string;
+/**
+ * "How to set…" must never be disabled: a disabled element fires no pointer
+ * events, so its handler never runs — and an iPad has no hover to fall back on.
+ */
+export declare function publishControlDisabled(mode: PublishControlMode, publishing: boolean): boolean;
+export declare function collapsedDisplayName(displayName: string): string;
+export declare function howToSetExplainer(appName: string): {
+    title: string;
+    paragraphs: string[];
+};

package/dist/profilePresentation.js

@@ -0,0 +1,32 @@
+/**
+ * Pure rules for the Nostr profile panel, testable under node:test.
+ */
+/** Without a session key or NIP-07 signer, explain instead of publishing. */
+export function publishControlMode(canSign) {
+    return canSign ? "publish" : "how-to-set";
+}
+export function publishControlLabel(mode, publishing) {
+    if (mode === "how-to-set")
+        return "How to set…";
+    return publishing ? "Publishing…" : "Publish to Nostr";
+}
+/**
+ * "How to set…" must never be disabled: a disabled element fires no pointer
+ * events, so its handler never runs — and an iPad has no hover to fall back on.
+ */
+export function publishControlDisabled(mode, publishing) {
+    return mode === "publish" && publishing;
+}
+export function collapsedDisplayName(displayName) {
+    return displayName.trim() || "Nostr profile";
+}
+export function howToSetExplainer(appName) {
+    return {
+        title: "How to set your Nostr profile",
+        paragraphs: [
+            `Nostr identity is a secure keypair. Your profile is owned by the key, not by ${appName}.`,
+            "To change it, use your preferred Nostr client — the one that already holds your key.",
+            `${appName} could accept your nsec directly, but deliberately does not ask for it. Handing a private key to a web front end is the thing the keypair model exists to avoid.`,
+        ],
+    };
+}

package/dist/react/Avatar.d.ts

@@ -0,0 +1,6 @@
+/** An emoji glyph or an image, in a circle. */
+export default function Avatar({ value, size, className, }: {
+    value?: string | null;
+    size?: number;
+    className?: string;
+}): import("react").JSX.Element;

package/dist/react/Avatar.js

@@ -0,0 +1,7 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+import { isAvatarUrl } from "../avatar.js";
+/** An emoji glyph or an image, in a circle. */
+export default function Avatar({ value, size = 40, className = "", }) {
+    const raw = value && value.trim() ? value : "🃏";
+    return (_jsx("span", { style: { width: size, height: size, minWidth: size, fontSize: Math.round(size * 0.55), lineHeight: 1 }, className: `inline-flex items-center justify-center overflow-hidden rounded-full select-none border border-[var(--tb-line)] bg-[var(--tb-surface-2)] ${className}`, children: isAvatarUrl(raw) ? (_jsx("img", { src: raw, alt: "", loading: "lazy", className: "block h-full w-full object-cover" })) : (raw) }));
+}

package/dist/react/AvatarPicker.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Avatar chooser: a paged Iconify catalog, the glyph palette, and a custom
+ * URL or glyph. Iconify (api.iconify.design) is a free public endpoint; each
+ * SVG loads lazily per tile and nothing is bundled.
+ */
+export default function AvatarPicker({ value, onChange }: {
+    value: string;
+    onChange: (next: string) => void;
+}): import("react").JSX.Element;

package/dist/react/AvatarPicker.js

@@ -0,0 +1,64 @@
+import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+/**
+ * Avatar chooser: a paged Iconify catalog, the glyph palette, and a custom
+ * URL or glyph. Iconify (api.iconify.design) is a free public endpoint; each
+ * SVG loads lazily per tile and nothing is bundled.
+ */
+import { useEffect, useState } from "react";
+import { Loader2 } from "lucide-react";
+import { AVATAR_CHOICES } from "../avatar.js";
+import Avatar from "./Avatar.js";
+import { errBox, input, muted } from "./ui.js";
+const COLLECTIONS = [
+    { prefix: "fluent-emoji-flat", label: "Fluent — Microsoft, flat" },
+    { prefix: "twemoji", label: "Twemoji — Twitter's set" },
+    { prefix: "noto", label: "Noto — Google" },
+    { prefix: "openmoji", label: "OpenMoji — CC-BY-SA" },
+    { prefix: "emojione-v1", label: "EmojiOne — classic" },
+];
+const PAGE_SIZE = 30;
+const iconUrl = (prefix, name) => `https://api.iconify.design/${prefix}/${name}.svg`;
+const tile = (selected) => `flex items-center justify-center aspect-square rounded-md p-1 border transition-colors ${selected
+    ? "border-[var(--tb-accent)] bg-[var(--tb-surface-2)]"
+    : "border-[var(--tb-line)] hover:border-[var(--tb-accent)]"}`;
+export default function AvatarPicker({ value, onChange }) {
+    const [tab, setTab] = useState("catalog");
+    const [collection, setCollection] = useState(COLLECTIONS[0].prefix);
+    const [names, setNames] = useState([]);
+    const [page, setPage] = useState(0);
+    const [loading, setLoading] = useState(false);
+    const [error, setError] = useState("");
+    useEffect(() => {
+        let alive = true;
+        setLoading(true);
+        setError("");
+        setNames([]);
+        setPage(0);
+        fetch(`https://api.iconify.design/collection?prefix=${collection}`)
+            .then((r) => {
+            if (!r.ok)
+                throw new Error(`Iconify returned ${r.status}`);
+            return r.json();
+        })
+            .then((data) => {
+            if (!alive)
+                return;
+            const out = [];
+            for (const list of Object.values(data.categories ?? {}))
+                out.push(...list);
+            out.push(...(data.uncategorized ?? []));
+            setNames(out);
+        })
+            .catch((e) => alive && setError(e.message))
+            .finally(() => alive && setLoading(false));
+        return () => {
+            alive = false;
+        };
+    }, [collection]);
+    const totalPages = Math.max(1, Math.ceil(names.length / PAGE_SIZE));
+    const visible = names.slice(page * PAGE_SIZE, (page + 1) * PAGE_SIZE);
+    return (_jsxs("div", { children: [_jsx("div", { className: "flex gap-2 mb-3 text-xs", children: ["catalog", "glyphs"].map((t) => (_jsx("button", { type: "button", onClick: () => setTab(t), className: `px-3 py-1.5 rounded-full transition-colors ${tab === t ? "bg-[var(--tb-accent)] text-[var(--tb-on-accent)]" : `${muted} hover:bg-[var(--tb-surface-2)]`}`, children: t === "catalog" ? "Catalog" : "Glyphs" }, t))) }), tab === "catalog" && (_jsxs(_Fragment, { children: [_jsxs("div", { className: "flex items-center gap-2 mb-3", children: [_jsx("select", { value: collection, onChange: (e) => setCollection(e.target.value), className: `${input} py-1.5 text-xs font-sans`, children: COLLECTIONS.map((c) => (_jsx("option", { value: c.prefix, children: c.label }, c.prefix))) }), !loading && !error && names.length > 0 && (_jsxs("span", { className: `text-xs whitespace-nowrap ${muted}`, children: [page + 1, "/", totalPages] }))] }), loading && (_jsxs("p", { className: `flex items-center justify-center gap-1.5 py-6 text-xs ${muted}`, children: [_jsx(Loader2, { className: "h-3.5 w-3.5 animate-spin" }), " Loading catalog\u2026"] })), error && _jsxs("div", { className: errBox, children: ["Couldn't reach Iconify: ", error] }), !loading && !error && (_jsxs(_Fragment, { children: [_jsx("div", { className: "grid grid-cols-10 gap-1.5", children: visible.map((name) => {
+                                    const url = iconUrl(collection, name);
+                                    return (_jsx("button", { type: "button", onClick: () => onChange(url), title: name.replace(/-/g, " "), className: tile(value === url), children: _jsx("img", { src: url, alt: name, loading: "lazy", className: "h-full w-full object-contain" }) }, name));
+                                }) }), _jsxs("div", { className: "flex items-center justify-center gap-3 mt-3 text-xs", children: [_jsx("button", { type: "button", onClick: () => setPage((p) => Math.max(0, p - 1)), disabled: page === 0, className: "px-3 py-1 rounded-full border border-[var(--tb-line)] disabled:opacity-30", children: "\u2190 Prev" }), _jsx("button", { type: "button", onClick: () => setPage((p) => Math.min(totalPages - 1, p + 1)), disabled: page >= totalPages - 1, className: "px-3 py-1 rounded-full border border-[var(--tb-line)] disabled:opacity-30", children: "Next \u2192" })] })] }))] })), tab === "glyphs" && (_jsx("div", { className: "grid grid-cols-10 gap-1.5", children: AVATAR_CHOICES.map((glyph) => (_jsx("button", { type: "button", onClick: () => onChange(glyph), className: `${tile(value === glyph)} text-lg`, children: glyph }, glyph))) })), _jsxs("details", { className: "mt-3", children: [_jsx("summary", { className: `text-xs uppercase tracking-wider cursor-pointer ${muted}`, children: "Custom (image URL or glyph)" }), _jsx("input", { type: "text", value: value, onChange: (e) => onChange(e.target.value), placeholder: "https://\u2026 or a single emoji", className: `mt-2 ${input} py-1.5 text-xs` })] }), value && (_jsxs("div", { className: "mt-4 flex items-center gap-3", children: [_jsx(Avatar, { value: value, size: 48 }), _jsx("span", { className: `text-xs ${muted}`, children: "Selected \u2014 applies immediately." })] }))] }));
+}

package/dist/react/NostrProfilePanel.d.ts

@@ -0,0 +1,8 @@
+/**
+ * The patron's Nostr kind-0 profile — the self-sovereign home of their name
+ * and avatar. Edits publish a new signed kind-0, visible in every Nostr client.
+ * Without a signer the fields are read-only and the action explains why.
+ */
+export default function NostrProfilePanel({ npub }: {
+    npub: string;
+}): import("react").JSX.Element;