@tollbooth-dpyc/web 1.1.0 → 1.2.0

package/dist/client.d.ts

@@ -28,6 +28,14 @@ export interface CallOptions {
      * patron out, whatever it gets back.
      */
     bestEffort?: boolean;
+    /**
+     * A background read — a badge, a poll — that must not send the patron to
+     * the sign-in gate. A proof bounce still throws `ProofRequiredError`, but
+     * the session is left as it is and `onProofExpired` is not told; the next
+     * call the patron makes themselves meets the lapse and re-arms sign-in.
+     * Opt-in: by default a bounce signs the patron out and re-arms the gate.
+     */
+    quietProof?: boolean;
     timeoutMs?: number;
 }
 export interface ToolAnswer<T> {

package/dist/client.js

@@ -31,6 +31,7 @@ const STANDARD_BOOTSTRAP = [
     "publish_nostr_profile",
     "get_operator_onboarding_status",
     "check_authority_balance",
+    "get_pricing_model",
     "list_canonical_identities",
     "check_proof_status",
     "get_patron_onboarding_status",
@@ -165,6 +166,8 @@ export async function callToolWithContent(tool, args = {}, opts = {}) {
     if (!opts.bestEffort) {
         const bounced = proofBounceMessage(payload);
         if (bounced !== null) {
+            if (opts.quietProof)
+                throw new ProofRequiredError(bounced);
             // The token just refused is the same one the recent-login shortcut
             // would replay, so it goes too, or a returning patron re-bounces.
             const npub = getStoredNpub();

package/dist/debugLog.js

@@ -28,9 +28,12 @@ const REDACTED = "[redacted]";
 const SECRET_FIELD = "(?:nsec|ncryptsec|dpop_token|proof|poison|password|passphrase|secret|token|authorization|api_?key|private_?key|client_secret|[a-z0-9_]*_(?:nsec|token|secret|password|passphrase|api_?key|private_?key))";
 // `"dpop_token":"…"`, `\"dpop_token\":\"…\"` (JSON inside a JSON string),
 // `dpop_token=…` (a query string) and `dpop_token: '…'` (a Python repr). A
-// quoted value is taken whole, spaces and all; a bare one up to a delimiter.
+// quoted value is taken whole — spaces, escaped quotes and the other kind of
+// quote included — up to its own closing quote or the end of a truncated line;
+// a bare one up to a delimiter. Stopping at the first quote of either kind let
+// the tail of a secret holding `'` or `\"` through.
 function fieldValue(names) {
-    return new RegExp(`((?:\\\\*["'])?\\b${names}(?:\\\\*["'])?\\s*[:=]\\s*)(?:(\\\\*["'])[^"'\\\\]*|[^"'\\\\,}\\]&\\s]+)`, "gi");
+    return new RegExp(`((?:\\\\*["'])?\\b${names}(?:\\\\*["'])?\\s*[:=]\\s*)(?:(\\\\*["'])(?:\\\\.|\\\\$|(?!\\2)[^\\\\])*?(?=\\2|$)|[^"'\\\\,}\\]&\\s]+)`, "gi");
 }
 const FIELD_VALUE = fieldValue(SECRET_FIELD);
 // update_patron_credential / update_operator_credential carry the secret as

package/dist/inlineProof.d.ts

@@ -5,6 +5,14 @@
  * runtime tool name, e.g. "chart_snapshot_display"), and `created_at` (within
  * about 60 seconds of server time). The wheel verifies the Schnorr signature
  * inline — no relay round trip, no cached phrase.
+ *
+ * Every proof also carries a random `nonce` tag, exactly as the wheel's own
+ * `create_proof` does. Without it, two calls to the same tool in the same
+ * wall-clock second sign byte-identical events, their ids collide, and the
+ * verifier's replay guard refuses the second. The nonce is signed but inert:
+ * `verify_proof` reads only the `u` tag.
  */
+/** 16 random bytes as 32 lowercase hex chars — Python's `secrets.token_hex(16)`. */
+export declare function proofNonce(): string;
 /** The JSON-stringified signed event, exactly what `verify_proof` expects. */
 export declare function signInlineProof(runtimeToolName: string, secretKey?: Uint8Array): string;

package/dist/inlineProof.js

@@ -5,16 +5,30 @@
  * runtime tool name, e.g. "chart_snapshot_display"), and `created_at` (within
  * about 60 seconds of server time). The wheel verifies the Schnorr signature
  * inline — no relay round trip, no cached phrase.
+ *
+ * Every proof also carries a random `nonce` tag, exactly as the wheel's own
+ * `create_proof` does. Without it, two calls to the same tool in the same
+ * wall-clock second sign byte-identical events, their ids collide, and the
+ * verifier's replay guard refuses the second. The nonce is signed but inert:
+ * `verify_proof` reads only the `u` tag.
  */
 import { finalizeEvent } from "nostr-tools";
 import { getSessionNsecBytes } from "./sessionNsec.js";
 const PROOF_KIND = 27235;
+/** 16 random bytes as 32 lowercase hex chars — Python's `secrets.token_hex(16)`. */
+export function proofNonce() {
+    const bytes = crypto.getRandomValues(new Uint8Array(16));
+    return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
 /** The JSON-stringified signed event, exactly what `verify_proof` expects. */
 export function signInlineProof(runtimeToolName, secretKey) {
     const signed = finalizeEvent({
         kind: PROOF_KIND,
         created_at: Math.floor(Date.now() / 1000),
-        tags: [["u", runtimeToolName]],
+        tags: [
+            ["u", runtimeToolName],
+            ["nonce", proofNonce()],
+        ],
         content: "",
     }, secretKey ?? getSessionNsecBytes());
     return JSON.stringify(signed);

package/dist/react/useSession.d.ts

@@ -12,6 +12,8 @@ export interface Session {
     canSign: boolean;
     /** Set when a cached proof lapses: a calm prompt to sign in again. */
     notice: string;
+    /** Clear the notice without signing in — the patron read it and moved on. */
+    dismissNotice: () => void;
     /** Call after a successful sign-in so the whole app notices. */
     refresh: () => void;
     signOut: () => void;

package/dist/react/useSession.js

@@ -28,6 +28,7 @@ export function useSession() {
         setState(read());
         setNotice("");
     }, []);
+    const dismissNotice = useCallback(() => setNotice(""), []);
     useEffect(() => onProofExpired(() => {
         // A tab that can sign for THIS npub lost nothing.
         if (canSignFor(currentClaim()))
@@ -35,5 +36,5 @@ export function useSession() {
         setNotice("Your session lapsed while you were away. Sign in again to carry on.");
         setState(read());
     }), []);
-    return { ...state, notice, refresh, signOut };
+    return { ...state, notice, dismissNotice, refresh, signOut };
 }

package/dist/standardTools.d.ts

@@ -2,14 +2,45 @@
  * Typed wrappers for the tools every operator gets from
  * `register_standard_tools` in the tollbooth-dpyc wheel.
  */
+/** What a patron must supply beyond the npub proof, per the wheel's `patron_auth_block`. */
+export interface PatronAuth {
+    mode: "oauth" | "secure_courier" | "none";
+    patron_credentials_required: boolean;
+    /** mode "oauth": the provider's credential service. */
+    oauth_service?: string;
+    /** mode "secure_courier": the service a patron delivers secrets to. */
+    credential_service?: string;
+}
+/** The wheel's `service_status`: health and build facts, free and unauthenticated. */
 export interface ServiceStatus {
+    success?: boolean;
+    service?: string;
+    slug?: string;
+    version?: string;
+    tollbooth_dpyc_version?: string;
+    vault_configured?: boolean;
+    courier_has_vault?: boolean;
     operator_npub_hash?: string;
+    process_id?: number;
+    /** Deploy metadata from the environment (commit, build time, …), lower-cased keys. */
+    build_info?: Record<string, string> | null;
+    patron_auth?: PatronAuth;
+    /** Only on a server that runs background jobs. */
+    async_jobs?: {
+        docket_url_set: boolean;
+        backend: string;
+        durable_across_recycles: boolean;
+    };
+    durable_jobs?: {
+        modal_app: string | null;
+        detached_executor_active: boolean;
+        detached_executor_resolved: boolean;
+        detached_executor_error: string | null;
+        last_dispatch_error: string | null;
+        dispatching: boolean;
+    };
     lifecycle?: string;
     message?: string;
-    version?: string;
-    tollbooth_dpyc_version?: string;
-    service?: string;
-    slug?: string;
 }
 export declare function serviceStatus(): Promise<ServiceStatus>;
 export interface NpubProofResult {
@@ -75,24 +106,49 @@ export interface CheckBalanceResult {
         calls: number;
         api_sats: number;
     }>;
+    invoice_summary?: {
+        total_invoices: number;
+        settled_count: number;
+        pending_count: number;
+        total_real_sats: number;
+        total_api_sats_credited: number;
+    };
     error?: string;
     error_code?: string;
 }
 export declare function checkBalance(): Promise<CheckBalanceResult>;
+export interface ConstraintEffect {
+    type: string;
+    message?: string;
+    [key: string]: unknown;
+}
+/** The wheel's `check_price` preview. */
 export interface CheckPriceResult {
     success: boolean;
     tool_id?: string;
-    base_cost_api_sats?: number;
-    effective_cost_api_sats?: number;
+    tool_name?: string;
+    /** "flat" | "flat+multipliers" | "percent" */
+    pricing_type?: string;
+    base_cost_api_sats?: number | null;
+    effective_cost_api_sats?: number | null;
+    rate_percent?: number;
+    rate_param?: string;
+    min_cost_sats?: number;
+    multipliers?: Record<string, unknown>;
+    constraints_enabled?: boolean;
+    constraint_effects?: ConstraintEffect[];
+    hint?: string;
     error?: string;
     error_code?: string;
 }
 /**
  * The fare for one tool in api_sats, as the live pricing model resolves it,
- * constraints included — keyed by the tool's frozen UUID. Null when unreadable:
- * show the answer without a price rather than invent one.
+ * constraints included — keyed by the tool's frozen UUID (or its capability
+ * name). `toolKwargs` are the call's own parameters, for a tool priced by
+ * them (ad valorem, or a multiplier on a categorical argument). Null when
+ * unreadable: show the answer without a price rather than invent one.
  */
-export declare function checkPrice(toolId: string): Promise<number | null>;
+export declare function checkPrice(toolId: string, toolKwargs?: Record<string, unknown>): Promise<number | null>;
 export interface PurchaseCreditsResult {
     success?: boolean;
     invoice_id?: string;
@@ -112,6 +168,10 @@ export interface CheckPaymentResult {
     invoice_id?: string;
     credits_granted?: number;
     balance_api_sats?: number;
+    amount_sats?: number;
+    /** false: the credit could not be written; nothing was granted. */
+    persisted?: boolean;
+    source?: string;
     error?: string;
     error_code?: string;
 }
@@ -235,3 +295,149 @@ export interface PublishNostrProfileResult {
 }
 /** Relay a kind-0 the BROWSER signed. The wheel verifies it and fans it out. */
 export declare function publishNostrProfile(npub: string, signedEvent: string): Promise<PublishNostrProfileResult>;
+/** Every lifecycle `session_status` reports. */
+export type SessionLifecycle = "ready" | "warming_up" | "misconfigured" | "quota_exceeded" | "not_registered" | "no_identity";
+/** The patron's stored upstream OAuth token, when the operator has a provider. */
+export interface UpstreamOAuth {
+    service: string;
+    has_access_token: boolean;
+    has_refresh_token: boolean;
+    refresh_enabled: boolean;
+    access_token_expires_at?: number;
+    access_token_expires_in_seconds?: number;
+}
+export interface SessionStatusResult {
+    success?: boolean;
+    lifecycle?: SessionLifecycle;
+    message?: string;
+    operator_npub?: string;
+    /** Why it is not ready, from the failing layer. */
+    detail?: string;
+    operator_credential_service?: string;
+    patron_credential_service?: string;
+    upstream_oauth?: UpstreamOAuth;
+    /** The vault could not answer — not the same as "never authorized". */
+    upstream_oauth_unreadable?: string;
+    error?: string;
+    error_code?: string;
+}
+/**
+ * Is the operator ready to serve? Free, no proof. With `patronNpub`, also the
+ * patron's upstream OAuth token expiry, so a page can refresh ahead of time.
+ */
+export declare function sessionStatus(patronNpub?: string): Promise<SessionStatusResult>;
+export interface OnboardingItem {
+    field: string;
+    /** "identity" | "authority" | "secret" */
+    category: string;
+    /** "configured" | "missing" | "unknown" */
+    status: string;
+    how?: string;
+    lifecycle?: string;
+    delivered_at?: string | null;
+}
+/** The wheel's `get_operator_onboarding_status`: what the operator still has to set up. */
+export interface OperatorOnboardingStatus {
+    ready?: boolean;
+    configured?: OnboardingItem[];
+    missing?: OnboardingItem[];
+    optional_missing?: OnboardingItem[];
+    summary?: string;
+    bootstrap_error?: string;
+    vault_ok?: boolean;
+    /** Set when the credential vault could not be read: nothing is known either way. */
+    vault_situation?: string;
+    credential_greeting?: string | null;
+    credential_service?: string | null;
+    operator_name?: string;
+    error?: string;
+    error_code?: string;
+}
+export declare function getOperatorOnboardingStatus(): Promise<OperatorOnboardingStatus>;
+/**
+ * The operator's own balance at its Authority — what certifies patron top-ups.
+ * The Authority's ledger, in the same shape as a patron's `check_balance`.
+ */
+export declare function checkAuthorityBalance(): Promise<CheckBalanceResult>;
+export interface PricingStep {
+    id: string;
+    type: string;
+    params?: Record<string, unknown>;
+    patron_npubs?: string[];
+}
+export interface ToolPrice {
+    tool_id: string;
+    tool_name: string;
+    price_sats: number;
+    category: string;
+    intent: string;
+    priced: boolean;
+    price_type?: string;
+    price_formula?: unknown;
+    min_cost?: number;
+    max_cost?: number;
+    multipliers?: Record<string, unknown>;
+    chain?: PricingStep[];
+}
+/** The wheel's `get_pricing_model`. `status` is "ok" or "error". */
+export interface PricingModelResult {
+    status?: string;
+    model_id?: string | null;
+    name?: string | null;
+    is_active?: boolean | null;
+    tools?: ToolPrice[] | null;
+    tranche_lifetime?: {
+        target_usage_pct: number;
+        ttl_days?: number;
+        min_days?: number;
+        max_days?: number;
+    };
+    error?: string;
+}
+/** The operator's active pricing model. Free, no proof. */
+export declare function getPricingModel(): Promise<PricingModelResult>;
+export interface CanonicalIdentity {
+    tool_id: string;
+    mcp_name: string;
+    category: string;
+    intent: string;
+    capability: string;
+    registered: boolean;
+    reason?: string;
+}
+/** The wheel's `list_canonical_identities`: every tool's frozen UUID and wire name. */
+export interface CanonicalIdentitiesResult {
+    success?: boolean;
+    operator_npub?: string;
+    count?: number;
+    unregistered_count?: number;
+    tools?: CanonicalIdentity[];
+    unregistered?: Array<{
+        mcp_name: string;
+        reason: string;
+        [key: string]: unknown;
+    }>;
+    error?: string;
+}
+export declare function listCanonicalIdentities(): Promise<CanonicalIdentitiesResult>;
+export interface PatronCredentialFieldsResult {
+    success?: boolean;
+    fields?: string[];
+    /** Per field, when it was delivered; null for secrets vaulted before stamps. */
+    delivered_at?: Record<string, string | null>;
+    count?: number;
+    error?: string;
+    error_code?: string;
+}
+export interface PatronCredentialWriteResult {
+    success?: boolean;
+    message?: string;
+    error?: string;
+    error_code?: string;
+}
+/** The names of the patron's stored credential fields — never their values. */
+export declare function getPatronCredentialFields(): Promise<PatronCredentialFieldsResult>;
+/** Set one credential field, leaving the others as they are. */
+export declare function updatePatronCredential(field: string, value: string): Promise<PatronCredentialWriteResult>;
+/** Remove one credential field, leaving the others as they are. */
+export declare function deletePatronCredential(field: string): Promise<PatronCredentialWriteResult>;

package/dist/standardTools.js

@@ -39,11 +39,16 @@ export function checkBalance() {
 }
 /**
  * The fare for one tool in api_sats, as the live pricing model resolves it,
- * constraints included — keyed by the tool's frozen UUID. Null when unreadable:
- * show the answer without a price rather than invent one.
+ * constraints included — keyed by the tool's frozen UUID (or its capability
+ * name). `toolKwargs` are the call's own parameters, for a tool priced by
+ * them (ad valorem, or a multiplier on a categorical argument). Null when
+ * unreadable: show the answer without a price rather than invent one.
  */
-export async function checkPrice(toolId) {
-    const r = await callTool("check_price", { tool_id: toolId });
+export async function checkPrice(toolId, toolKwargs) {
+    const r = await callTool("check_price", {
+        tool_id: toolId,
+        ...(toolKwargs ? { tool_kwargs: JSON.stringify(toolKwargs) } : {}),
+    });
     const v = r.effective_cost_api_sats ?? r.base_cost_api_sats;
     return typeof v === "number" ? v : null;
 }
@@ -78,3 +83,40 @@ export function publishNostrProfile(npub, signedEvent) {
         signed_event: signedEvent,
     });
 }
+/**
+ * Is the operator ready to serve? Free, no proof. With `patronNpub`, also the
+ * patron's upstream OAuth token expiry, so a page can refresh ahead of time.
+ */
+export function sessionStatus(patronNpub) {
+    return callTool("session_status", patronNpub ? { patron_npub: patronNpub } : {}, { bestEffort: true });
+}
+export function getOperatorOnboardingStatus() {
+    return callTool("get_operator_onboarding_status", {}, { bestEffort: true });
+}
+/**
+ * The operator's own balance at its Authority — what certifies patron top-ups.
+ * The Authority's ledger, in the same shape as a patron's `check_balance`.
+ */
+export function checkAuthorityBalance() {
+    return callTool("check_authority_balance", {}, { bestEffort: true });
+}
+/** The operator's active pricing model. Free, no proof. */
+export function getPricingModel() {
+    return callTool("get_pricing_model", {});
+}
+export function listCanonicalIdentities() {
+    return callTool("list_canonical_identities", {});
+}
+/** The names of the patron's stored credential fields — never their values. */
+export function getPatronCredentialFields() {
+    return callTool("get_patron_credential_fields", {});
+}
+/** Set one credential field, leaving the others as they are. */
+export function updatePatronCredential(field, value) {
+    // `field` first: the log's scrubber keys on it to hide `value`.
+    return callTool("update_patron_credential", { field, value });
+}
+/** Remove one credential field, leaving the others as they are. */
+export function deletePatronCredential(field) {
+    return callTool("delete_patron_credential", { field });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tollbooth-dpyc/web",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "Shared browser SDK for Tollbooth DPYC operator front ends: npub sign-in, proofs, MCP client, profile and wallet",
   "license": "Apache-2.0",
   "author": "Lonnie VanZandt",