@tollbooth-dpyc/web 1.8.2 → 2.0.0

package/README.md

@@ -5,8 +5,9 @@ the shared code every operator front end needs, so a site holds only its own
 features. It is the peer of the `tollbooth-dpyc` Python wheel.
 
 - **npub sign-in** — a Nostr DM challenge, or an in-browser session key
-- **proofs** — the npub/`dpop_token` envelope on every paid call, a fresh
-  kind-27235 inline proof when the tab holds a session key
+- **identity on the connection** — every request signed with the tab's session
+  key (NIP-98), or carried by the tab's holder connection, whose npubs a DM
+  proved; a call names only the npub
 - **MCP client** — one shared connection to the operator, typed wrappers for
   the standard tools (balance, top-up, statement, price, profile)
 - **React components** — `AppShell` / `useAppShell`, `SiteNav`, `AccountPage`,

package/dist/client.d.ts

@@ -3,11 +3,11 @@
  *
  * 1. One @modelcontextprotocol/sdk Client over StreamableHTTP, shared by the
  *    whole page. The SDK handles the initialize handshake and the session.
- * 2. Auth is the uniform npub proof, by one of two tactics, invisible to
- *    callers: a session nsec signs a fresh kind-27235 proof per call, bound to
- *    the runtime tool name; otherwise the DM proof token cached at
- *    `receive_npub_proof` is sent as is.
- * 3. Bootstrap tools take no envelope and are safe before sign-in.
+ * 2. Identity rides on the connection, invisible to callers: while this tab
+ *    holds the signed-in npub's key, every request is signed with it (NIP-98);
+ *    otherwise the request carries this tab's holder bearer, and the operator
+ *    holds the DM proof. A call names only the npub.
+ * 3. Bootstrap tools take no npub and are safe before sign-in.
  */
 import { type ImageBlock } from "./toolResult.ts";
 export { isNetworkError, NetworkError } from "./networkError.ts";
@@ -18,7 +18,7 @@ export declare class ProofRequiredError extends Error {
 type ProofExpiredListener = (message: string) => void;
 /**
  * Subscribe to proof bounces from anywhere in the app. Without this the tree
- * never learns the token was cleared, and the patron is stranded on a page
+ * never learns the sign-in was dropped, and the patron is stranded on a page
  * whose data will not load. Returns an unsubscribe function.
  */
 export declare function onProofExpired(cb: ProofExpiredListener): () => void;

package/dist/client.js

@@ -3,24 +3,24 @@
  *
  * 1. One @modelcontextprotocol/sdk Client over StreamableHTTP, shared by the
  *    whole page. The SDK handles the initialize handshake and the session.
- * 2. Auth is the uniform npub proof, by one of two tactics, invisible to
- *    callers: a session nsec signs a fresh kind-27235 proof per call, bound to
- *    the runtime tool name; otherwise the DM proof token cached at
- *    `receive_npub_proof` is sent as is.
- * 3. Bootstrap tools take no envelope and are safe before sign-in.
+ * 2. Identity rides on the connection, invisible to callers: while this tab
+ *    holds the signed-in npub's key, every request is signed with it (NIP-98);
+ *    otherwise the request carries this tab's holder bearer, and the operator
+ *    holds the DM proof. A call names only the npub.
+ * 3. Bootstrap tools take no npub and are safe before sign-in.
  */
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 import { tollboothConfig, toolName } from "./config.js";
 import { debugPush, redact } from "./debugLog.js";
-import { clearStoredProof, forgetRecentLogin, getStoredNpub, getStoredProof, } from "./identity.js";
-import { signInlineProof } from "./inlineProof.js";
+import { isHolder } from "./holder.js";
+import { forgetRecentLogin, getStoredNpub } from "./identity.js";
 import { isTransportFailure, NetworkError } from "./networkError.js";
-import { clearSessionNsec, hasSessionNsec, sessionNsecNpub } from "./sessionNsec.js";
+import { signingFetch, signsForSignedInNpub } from "./requestSigning.js";
 import { errorText, deadGrantMessage, looksFailed, proofBounceMessage, readToolResult, } from "./toolResult.js";
 /**
- * Standard tools whose wheel signature takes no npub/proof envelope. Pydantic
- * strict mode rejects unexpected kwargs, so they must not get one.
+ * Standard tools whose wheel signature takes no `npub`. Pydantic strict mode
+ * rejects unexpected kwargs, so they must not get one.
  */
 const STANDARD_BOOTSTRAP = [
     "request_npub_proof",
@@ -56,7 +56,7 @@ async function getClient() {
         // call, and nothing reached the server until the page was reloaded.
         connecting = (async () => {
             const c = new Client({ name: `${tollboothConfig().slug}-frontend`, version: "1" });
-            await c.connect(new StreamableHTTPClientTransport(new URL(mcpUrl())));
+            await c.connect(new StreamableHTTPClientTransport(new URL(mcpUrl()), { fetch: signingFetch }));
             client = c;
         })().finally(() => {
             connecting = null;
@@ -67,25 +67,6 @@ async function getClient() {
         throw new Error("Could not connect to the service.");
     return client;
 }
-/**
- * The proof for one call: a fresh inline proof when this tab's session key
- * derives to the signed-in npub, else the cached DM token. A session key left
- * from a previous identity is evicted rather than allowed to sign.
- */
-function proofFor(tool) {
-    try {
-        const npub = getStoredNpub();
-        const sessionNpub = hasSessionNsec() ? sessionNsecNpub() : null;
-        if (sessionNpub && sessionNpub === npub)
-            return { token: signInlineProof(toolName(tool)), inline: true };
-        if (sessionNpub)
-            clearSessionNsec();
-    }
-    catch {
-        /* fall through to the cached token */
-    }
-    return { token: getStoredProof(), inline: false };
-}
 export { isNetworkError, NetworkError } from "./networkError.js";
 /** A paid call bounced for a lapsed or missing proof. The gate re-arms sign-in. */
 export class ProofRequiredError extends Error {
@@ -97,7 +78,7 @@ export class ProofRequiredError extends Error {
 const proofExpiredListeners = new Set();
 /**
  * Subscribe to proof bounces from anywhere in the app. Without this the tree
- * never learns the token was cleared, and the patron is stranded on a page
+ * never learns the sign-in was dropped, and the patron is stranded on a page
  * whose data will not load. Returns an unsubscribe function.
  */
 export function onProofExpired(cb) {
@@ -126,15 +107,15 @@ export async function callToolWithContent(tool, args = {}, opts = {}) {
     const cfg = tollboothConfig();
     const name = toolName(tool);
     const quiet = STANDARD_QUIET.includes(tool) || cfg.quietTools.includes(tool);
-    // `args` holds only the caller's own parameters — the envelope is added
-    // below — so it is safe to log.
+    // `args` holds only the caller's own parameters — the npub is added below —
+    // so it is safe to log.
     if (!quiet)
         debugPush("call", `${name}(${redact(JSON.stringify(args)).slice(0, 140)})`);
     const bootstrap = STANDARD_BOOTSTRAP.includes(tool) || cfg.extraBootstrapTools.includes(tool);
-    const proof = bootstrap ? null : proofFor(tool);
-    const merged = proof
-        ? { npub: getStoredNpub(), dpop_token: proof.token, ...args }
-        : { ...args };
+    const merged = bootstrap ? { ...args } : { npub: getStoredNpub(), ...args };
+    // A call this tab's holder proves rides a grant the operator keeps; a signed
+    // call proves itself afresh and has none to lose.
+    const rodeHolder = !bootstrap && isHolder() && !signsForSignedInNpub();
     let result;
     try {
         const c = await getClient();
@@ -164,16 +145,15 @@ export async function callToolWithContent(tool, args = {}, opts = {}) {
         const tail = images.length ? ` +${images.length} image` : "";
         debugPush(looksFailed(payload) ? "error" : "result", `${name} → ${redact(String(preview)).slice(0, 220)}${tail}`);
     }
-    // A stored grant the service refused for good signs the patron out even
-    // from a best-effort call: that is not a blip, and staying "signed in" on a
-    // dead grant leaves every page failing with nothing to tell them why.
+    // A held grant the service refused for good signs the patron out even from
+    // a best-effort call: that is not a blip, and staying "signed in" on a dead
+    // grant leaves every page failing with nothing to tell them why.
     const bounced = (opts.bestEffort ? null : proofBounceMessage(payload)) ??
-        (proof && !proof.inline && proof.token ? deadGrantMessage(payload) : null);
+        (rodeHolder ? deadGrantMessage(payload) : null);
     if (bounced !== null) {
-        // The token just refused is the same one the recent-login shortcut
-        // would replay, so it goes too, or a returning patron re-bounces.
+        // The recent-login shortcut would re-enter on the same refused hold, so it
+        // goes too, or a returning patron re-bounces.
         const npub = getStoredNpub();
-        clearStoredProof();
         if (npub)
             forgetRecentLogin(npub);
         emitProofExpired(bounced);

package/dist/config.d.ts

@@ -19,6 +19,12 @@ export interface TollboothConfig {
      * origin, which is how every site reaches its Pages proxy.
      */
     mcpUrl: string;
+    /**
+     * The operator's own origin, e.g. "https://goodearth-mcp.fastmcp.app". When
+     * set, a patron who signs in by DM connects as a holder there: the grant
+     * stays with the operator and the page names only the npub.
+     */
+    operatorUrl?: string;
     /**
      * Free tools this operator adds that take no npub/proof envelope, on top of
      * the standard ones. Pydantic rejects unexpected kwargs, so a tool listed
@@ -32,7 +38,8 @@ export interface TollboothConfig {
     /** How long a page sits untouched before its guided tour is offered, in ms. Defaults to 10 s. */
     tourIdleMs?: number;
 }
-interface Resolved extends Required<Omit<TollboothConfig, "extraBootstrapTools" | "quietTools" | "avatarChoices" | "tourIdleMs">> {
+interface Resolved extends Required<Omit<TollboothConfig, "extraBootstrapTools" | "quietTools" | "avatarChoices" | "tourIdleMs" | "operatorUrl">> {
+    operatorUrl?: string;
     extraBootstrapTools: string[];
     quietTools: string[];
     avatarChoices?: string[];

package/dist/config.js

@@ -17,6 +17,7 @@ export function configureTollbooth(config) {
         appName: config.appName,
         storagePrefix: config.storagePrefix ?? config.slug,
         mcpUrl: config.mcpUrl,
+        operatorUrl: config.operatorUrl,
         extraBootstrapTools: config.extraBootstrapTools ?? [],
         quietTools: config.quietTools ?? [],
         avatarChoices: config.avatarChoices,

package/dist/debugLog.d.ts

@@ -7,7 +7,7 @@
  * that flips the view can still be read and copied afterward.
  *
  * Every message is scrubbed on the way in: an nsec, a 64-hex key, a bearer
- * token, the value of any secret-named field (dpop_token, proof, poison,
+ * token, the value of any secret-named field (nonce, proof, poison,
  * password, api_key, …), and a secret inside a URL (a query token, a
  * bearer-like path segment, userinfo) never reach the buffer, the clipboard
  * or storage.

package/dist/debugLog.js

@@ -7,7 +7,7 @@
  * that flips the view can still be read and copied afterward.
  *
  * Every message is scrubbed on the way in: an nsec, a 64-hex key, a bearer
- * token, the value of any secret-named field (dpop_token, proof, poison,
+ * token, the value of any secret-named field (nonce, proof, poison,
  * password, api_key, …), and a secret inside a URL (a query token, a
  * bearer-like path segment, userinfo) never reach the buffer, the clipboard
  * or storage.
@@ -28,9 +28,9 @@ const listeners = new Set();
 // ── Redaction ──────────────────────────────────────────────────────────────
 const REDACTED = "[redacted]";
 /** Field names whose value is a secret wherever it appears. */
-const SECRET_FIELD = "(?:nsec|ncryptsec|dpop_token|proof|poison|password|passphrase|secret|token|authorization|api_?key|private_?key|client_secret|[a-z0-9_]*_(?:nsec|token|secret|password|passphrase|api_?key|private_?key))";
-// `"dpop_token":"…"`, `\"dpop_token\":\"…\"` (JSON inside a JSON string),
-// `dpop_token=…` (a query string) and `dpop_token: '…'` (a Python repr). A
+const SECRET_FIELD = "(?:nsec|ncryptsec|nonce|proof|poison|password|passphrase|secret|token|authorization|api_?key|private_?key|client_secret|[a-z0-9_]*_(?:nsec|token|secret|password|passphrase|api_?key|private_?key))";
+// `"nonce":"…"`, `\"nonce\":\"…\"` (JSON inside a JSON string),
+// `nonce=…` (a query string) and `nonce: '…'` (a Python repr). A
 // quoted value is taken whole — spaces, escaped quotes and the other kind of
 // quote included — up to its own closing quote or the end of a truncated line;
 // a bare one up to a delimiter. Stopping at the first quote of either kind let
@@ -56,7 +56,7 @@ function scrubbed(_match, head, quote) {
 // back in a tool result is logged whole. Three places a URL hides a secret:
 // the userinfo, a query or fragment parameter, and a bearer-like path segment.
 /** Query/fragment parameter names whose value is a secret (matched whole). */
-const URL_SECRET_PARAM = /([?&#;](?:token|access_token|refresh_token|id_token|auth|authorization|key|api_key|apikey|secret|client_secret|password|pass|sig|signature|code|proof|dpop_token|session|sessionid|nsec)=)[^&#;\s"'\\<>]*/gi;
+const URL_SECRET_PARAM = /([?&#;](?:token|access_token|refresh_token|id_token|auth|authorization|key|api_key|apikey|secret|client_secret|password|pass|sig|signature|code|proof|nonce|session|sessionid|nsec)=)[^&#;\s"'\\<>]*/gi;
 // A URL up to whitespace, a quote, an escape or an angle bracket — so one
 // inside JSON (or JSON inside JSON) ends at its own closing quote.
 const URL_IN_TEXT = /\b(?:https?|webcal|wss?):\/\/[^\s"'\\<>]+/gi;
@@ -211,7 +211,7 @@ export function debugLogText() {
 // Auth and funding outcomes are situations, not faults: the service answered
 // correctly and the patron has a step to take (sign in, top up). These SDK
 // error codes read as a notice and stay out of the failure count.
-const NOTICE_CODE = /error_code\\?"\s*:\s*\\?"(npub_missing|proof_missing|proof_required|proof_refresh_needed|dpop_token_missing|oauth_not_yet_authorized|oauth_token_expired|upstream_auth_refresh_needed|insufficient_balance|authority_insufficient_balance|upstream_subscription_required|operator_llm_unfunded)\\?"/i;
+const NOTICE_CODE = /error_code\\?"\s*:\s*\\?"(npub_missing|proof_required|nonce_missing|oauth_not_yet_authorized|oauth_token_expired|upstream_auth_refresh_needed|insufficient_balance|authority_insufficient_balance|upstream_subscription_required|operator_llm_unfunded)\\?"/i;
 function isFailure(entry) {
     if (entry.type === "error")
         return true;

package/dist/funding.d.ts

@@ -37,9 +37,11 @@ export interface BalanceThresholds {
 /** How this tab proves who it is. */
 export type ProofKind = {
     kind: "session_nsec";
-} | {
-    kind: "dm_proof";
-    status: "valid" | "expired" | "unknown";
+}
+/** The operator holds a DM proof for this tab's holder connection. */
+ | {
+    kind: "held";
+    status: "valid" | "lapsed" | "not_held" | "unknown";
     expiresInSec?: number | null;
 } | {
     kind: "none";

package/dist/funding.js

@@ -45,10 +45,12 @@ export function composeProofRow(proof, checkedAt) {
         return r("ok", "This tab's session key signs a fresh proof on every call — no expiry.");
     if (proof.kind === "none")
         return r("blocked", "No proof on hand — sign in again.");
-    if (proof.status === "expired")
+    if (proof.status === "lapsed")
         return r("blocked", "Proof has expired — sign in again to resume paid calls.");
+    if (proof.status === "not_held")
+        return r("blocked", "The service no longer holds your proof — sign in again.");
     if (proof.status === "unknown")
-        return r("warning", "No server-side proof record — the next paid call may ask you to sign in again.");
+        return r("warning", "Could not read the proof's status — the next paid call may ask you to sign in again.");
     const sec = proof.expiresInSec;
     if (sec != null && sec * 1000 < WARNING_WITHIN_MS)
         return r("warning", `Proof valid — expires in about ${durationText(sec)}.`);

package/dist/holder.d.ts

@@ -0,0 +1,31 @@
+/**
+ * This tab as a *holder*: a connection the operator knows, into whose wallet
+ * npubs are proven by DM. A patron who signs in by DM — holding no key — is
+ * proven this way, and the grant stays with the operator; the page holds only
+ * the connection's OAuth tokens and names the npub on each call.
+ *
+ * Becoming a holder is the OAuth Authorization Code flow every MCP client
+ * runs: register, send the browser to the operator's `/authorize` (it approves
+ * at once, since a holder holds nothing until a DM proves an npub into it),
+ * and exchange the code it hands back. Tokens refresh on their own; a refresh
+ * token is single-use, so each refresh stores the pair it returns.
+ */
+/** True when this site connects as a holder (its operator supports it). */
+export declare function holderEnabled(): boolean;
+/** True when this tab already is a holder. */
+export declare function isHolder(): boolean;
+/**
+ * Become a holder: register and send the browser to the operator, which
+ * sends it straight back. `resume` comes back from `completeHolderConnect`.
+ */
+export declare function connectAsHolder(resume: string): Promise<void>;
+/**
+ * On return from the operator: exchange the code, store the tokens, tidy the
+ * address bar, and hand back what the sign-in was doing. Null when this page
+ * load is not a return.
+ */
+export declare function completeHolderConnect(): Promise<string | null>;
+/** The bearer for the next request, refreshed when it is about to lapse; null when not a holder. */
+export declare function holderBearer(): Promise<string | null>;
+/** Disconnect: the operator forgets this holder and every npub it held. */
+export declare function forgetHolder(): Promise<void>;

package/dist/holder.js

@@ -0,0 +1,162 @@
+/**
+ * This tab as a *holder*: a connection the operator knows, into whose wallet
+ * npubs are proven by DM. A patron who signs in by DM — holding no key — is
+ * proven this way, and the grant stays with the operator; the page holds only
+ * the connection's OAuth tokens and names the npub on each call.
+ *
+ * Becoming a holder is the OAuth Authorization Code flow every MCP client
+ * runs: register, send the browser to the operator's `/authorize` (it approves
+ * at once, since a holder holds nothing until a DM proves an npub into it),
+ * and exchange the code it hands back. Tokens refresh on their own; a refresh
+ * token is single-use, so each refresh stores the pair it returns.
+ */
+import { tollboothConfig } from "./config.js";
+import { readStored, removeStored, writeStored } from "./storage.js";
+const TOKENS = "holder:v1";
+const PENDING = "holder_pending:v1";
+/** Refresh this long before the access token lapses. */
+const REFRESH_EARLY_MS = 60_000;
+function operator() {
+    const url = tollboothConfig().operatorUrl;
+    if (!url)
+        throw new Error("operatorUrl is not configured.");
+    return url.replace(/\/+$/, "");
+}
+/** True when this site connects as a holder (its operator supports it). */
+export function holderEnabled() {
+    return Boolean(tollboothConfig().operatorUrl);
+}
+function redirectUri() {
+    return `${globalThis.location.origin}/`;
+}
+function readTokens() {
+    try {
+        const t = JSON.parse(readStored(TOKENS) || "null");
+        return t && typeof t.accessToken === "string" && typeof t.refreshToken === "string" ? t : null;
+    }
+    catch {
+        return null;
+    }
+}
+function writeTokens(t) {
+    writeStored(TOKENS, JSON.stringify(t));
+}
+function randomUrlSafe(bytes) {
+    const raw = crypto.getRandomValues(new Uint8Array(bytes));
+    return btoa(String.fromCharCode(...raw)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+async function challengeFor(verifier) {
+    const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier)));
+    return btoa(String.fromCharCode(...digest)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+async function register() {
+    const r = await fetch(`${operator()}/register`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+            client_name: tollboothConfig().appName,
+            redirect_uris: [redirectUri()],
+            grant_types: ["authorization_code", "refresh_token"],
+            response_types: ["code"],
+            token_endpoint_auth_method: "none",
+        }),
+    });
+    if (!r.ok)
+        throw new Error(`Could not register with the service (${r.status}).`);
+    return (await r.json()).client_id;
+}
+async function token(form, clientId) {
+    const r = await fetch(`${operator()}/token`, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({ ...form, client_id: clientId, resource: `${operator()}/mcp` }),
+    });
+    if (!r.ok)
+        throw new Error(`The service refused the connection (${r.status}).`);
+    const t = await r.json();
+    return {
+        clientId,
+        accessToken: t.access_token,
+        refreshToken: t.refresh_token,
+        expiresAt: Date.now() + Number(t.expires_in ?? 3600) * 1000,
+    };
+}
+/** True when this tab already is a holder. */
+export function isHolder() {
+    return readTokens() !== null;
+}
+/**
+ * Become a holder: register and send the browser to the operator, which
+ * sends it straight back. `resume` comes back from `completeHolderConnect`.
+ */
+export async function connectAsHolder(resume) {
+    const clientId = readTokens()?.clientId || (await register());
+    const verifier = randomUrlSafe(48);
+    const state = randomUrlSafe(16);
+    const pending = { clientId, verifier, state, resume };
+    globalThis.sessionStorage.setItem(PENDING, JSON.stringify(pending));
+    const url = new URL(`${operator()}/authorize`);
+    url.search = new URLSearchParams({
+        response_type: "code",
+        client_id: clientId,
+        redirect_uri: redirectUri(),
+        state,
+        code_challenge: await challengeFor(verifier),
+        code_challenge_method: "S256",
+        resource: `${operator()}/mcp`,
+    }).toString();
+    globalThis.location.assign(url.toString());
+}
+/**
+ * On return from the operator: exchange the code, store the tokens, tidy the
+ * address bar, and hand back what the sign-in was doing. Null when this page
+ * load is not a return.
+ */
+export async function completeHolderConnect() {
+    const params = new URLSearchParams(globalThis.location.search);
+    const code = params.get("code");
+    const raw = globalThis.sessionStorage.getItem(PENDING);
+    if (!code || !raw)
+        return null;
+    globalThis.sessionStorage.removeItem(PENDING);
+    const pending = JSON.parse(raw);
+    globalThis.history.replaceState(null, "", globalThis.location.pathname);
+    if (params.get("state") !== pending.state)
+        throw new Error("The service's reply did not match this sign-in.");
+    writeTokens(await token({ grant_type: "authorization_code", code, redirect_uri: redirectUri(), code_verifier: pending.verifier }, pending.clientId));
+    return pending.resume;
+}
+/** The bearer for the next request, refreshed when it is about to lapse; null when not a holder. */
+export async function holderBearer() {
+    const t = readTokens();
+    if (!t)
+        return null;
+    if (t.expiresAt - REFRESH_EARLY_MS > Date.now())
+        return t.accessToken;
+    try {
+        const fresh = await token({ grant_type: "refresh_token", refresh_token: t.refreshToken }, t.clientId);
+        writeTokens(fresh);
+        return fresh.accessToken;
+    }
+    catch {
+        removeStored(TOKENS);
+        return null;
+    }
+}
+/** Disconnect: the operator forgets this holder and every npub it held. */
+export async function forgetHolder() {
+    const t = readTokens();
+    removeStored(TOKENS);
+    if (!t)
+        return;
+    try {
+        await fetch(`${operator()}/revoke`, {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: new URLSearchParams({ token: t.refreshToken, token_type_hint: "refresh_token", client_id: t.clientId }),
+        });
+    }
+    catch {
+        /* the tokens are gone from this tab; the operator lets them lapse */
+    }
+}

package/dist/identity.d.ts

@@ -1,36 +1,40 @@
 /**
  * Who this browser says it is, and what backs the claim.
  *
- * Three stored things, kept apart on purpose:
+ * Two stored things, kept apart on purpose:
  *   - the **npub** the app acts as — written only once it is proven;
- *   - the cached **DM proof** that backs it, when the patron signed in by DM;
  *   - the **last typed** npub, remembered only to prefill the field. Writing a
  *     name into the identity slot before it was proven is what once let an
  *     unanswered challenge become a session.
+ *
+ * What backs the npub lives on the connection: this tab's session key signs
+ * every request, or the operator holds the DM proof for this tab's holder
+ * connection. The page itself keeps no proof.
  */
 import { type Claim } from "./signedIn.ts";
 export declare function getStoredNpub(): string;
 export declare function setStoredNpub(npub: string): void;
-export declare function getStoredProof(): string;
-export declare function setStoredProof(proof: string): void;
-export declare function clearStoredProof(): void;
 export declare function getLastTypedNpub(): string;
 export declare function setLastTypedNpub(npub: string): void;
+/** An npub this tab's holder connection holds, until its DM proof lapses. */
 export interface RecentLogin {
     npub: string;
-    proof: string;
     /** Unix ms. */
     expiresAt: number;
     /** Unix ms. */
     lastUsed: number;
 }
-/** Unexpired recent logins, most recent first. Prunes the expired ones. */
+/**
+ * Unexpired recent logins, most recent first; none unless this tab is a
+ * holder, since the holder is what holds them. Prunes the expired ones.
+ */
 export declare function getValidRecentLogins(): RecentLogin[];
 /**
- * Record or refresh a successful login. The TTL is derated by 30 seconds so a
- * straggler never serves an already-expired token to the next paid call.
+ * Record or refresh a DM sign-in this tab's holder now holds. The TTL is
+ * derated by 30 seconds so a straggler never re-enters on a proof that lapses
+ * before the next paid call.
  */
-export declare function recordRecentLogin(npub: string, proof: string, expiresInSec: number): void;
+export declare function recordRecentLogin(npub: string, expiresInSec: number): void;
 export declare function forgetRecentLogin(npub: string): void;
 /** Read once and handed to the pure predicates in `signedIn.ts`. */
 export declare function currentClaim(): Claim;

package/dist/identity.js

@@ -1,18 +1,21 @@
 /**
  * Who this browser says it is, and what backs the claim.
  *
- * Three stored things, kept apart on purpose:
+ * Two stored things, kept apart on purpose:
  *   - the **npub** the app acts as — written only once it is proven;
- *   - the cached **DM proof** that backs it, when the patron signed in by DM;
  *   - the **last typed** npub, remembered only to prefill the field. Writing a
  *     name into the identity slot before it was proven is what once let an
  *     unanswered challenge become a session.
+ *
+ * What backs the npub lives on the connection: this tab's session key signs
+ * every request, or the operator holds the DM proof for this tab's holder
+ * connection. The page itself keeps no proof.
  */
+import { forgetHolder, isHolder } from "./holder.js";
 import { clearSessionNsec, hasSessionNsec, sessionNsecNpub } from "./sessionNsec.js";
 import { canSignFor, isProven } from "./signedIn.js";
 import { readStored, removeStored, writeStored } from "./storage.js";
 const NPUB = "patron_npub:v1";
-const PROOF = "proof_token:v1";
 const LAST_TYPED = "last_typed_npub:v1";
 const RECENT = "recent-logins:v1";
 const MAX_RECENT = 5;
@@ -22,15 +25,6 @@ export function getStoredNpub() {
 export function setStoredNpub(npub) {
     writeStored(NPUB, npub);
 }
-export function getStoredProof() {
-    return readStored(PROOF);
-}
-export function setStoredProof(proof) {
-    writeStored(PROOF, proof);
-}
-export function clearStoredProof() {
-    removeStored(PROOF);
-}
 export function getLastTypedNpub() {
     return readStored(LAST_TYPED);
 }
@@ -43,7 +37,7 @@ function readRecent() {
         if (!Array.isArray(parsed))
             return [];
         return parsed.filter((e) => typeof e === "object" && e !== null &&
-            typeof e.npub === "string" && typeof e.proof === "string" &&
+            typeof e.npub === "string" &&
             typeof e.expiresAt === "number" && typeof e.lastUsed === "number");
     }
     catch {
@@ -53,8 +47,13 @@ function readRecent() {
 function writeRecent(entries) {
     writeStored(RECENT, JSON.stringify(entries));
 }
-/** Unexpired recent logins, most recent first. Prunes the expired ones. */
+/**
+ * Unexpired recent logins, most recent first; none unless this tab is a
+ * holder, since the holder is what holds them. Prunes the expired ones.
+ */
 export function getValidRecentLogins() {
+    if (!isHolder())
+        return [];
     const now = Date.now();
     const entries = readRecent();
     const valid = entries.filter((e) => e.expiresAt > now);
@@ -63,14 +62,14 @@ export function getValidRecentLogins() {
     return valid.sort((a, b) => b.lastUsed - a.lastUsed);
 }
 /**
- * Record or refresh a successful login. The TTL is derated by 30 seconds so a
- * straggler never serves an already-expired token to the next paid call.
+ * Record or refresh a DM sign-in this tab's holder now holds. The TTL is
+ * derated by 30 seconds so a straggler never re-enters on a proof that lapses
+ * before the next paid call.
  */
-export function recordRecentLogin(npub, proof, expiresInSec) {
+export function recordRecentLogin(npub, expiresInSec) {
     const now = Date.now();
     const next = {
         npub,
-        proof,
         expiresAt: now + Math.max(0, expiresInSec - 30) * 1000,
         lastUsed: now,
     };
@@ -83,12 +82,17 @@ export function forgetRecentLogin(npub) {
 // ─── The claim ───────────────────────────────────────────────────────────
 /** Read once and handed to the pure predicates in `signedIn.ts`. */
 export function currentClaim() {
+    const npub = getStoredNpub();
     return {
-        npub: getStoredNpub(),
-        proof: getStoredProof(),
+        npub,
+        held: heldByThisTab(npub),
         sessionNpub: hasSessionNsec() ? sessionNsecNpub() : null,
     };
 }
+/** True when this tab's holder connection holds `npub`: a DM sign-in recorded here. */
+function heldByThisTab(npub) {
+    return Boolean(npub) && getValidRecentLogins().some((e) => e.npub === npub);
+}
 export function isLoggedIn() {
     return isProven(currentClaim());
 }
@@ -101,6 +105,6 @@ export function canSign() {
  */
 export function logOut() {
     removeStored(NPUB);
-    removeStored(PROOF);
     clearSessionNsec();
+    void forgetHolder();
 }

package/dist/index.d.ts

@@ -4,7 +4,7 @@ export type { ImageBlock } from "./toolResult.ts";
 export * from "./identity.ts";
 export * from "./standardTools.ts";
 export { clearSessionNsec, getSessionNsec, getSessionNsecBytes, hasSessionNsec, sessionNsecNpub, setSessionNsec, } from "./sessionNsec.ts";
-export { signInlineProof } from "./inlineProof.ts";
+export { signRequest } from "./requestSigning.ts";
 export { sessionKeyClaimVisible } from "./sessionKeyClaim.ts";
 export { handOffMode, shareOrDownload, type ShareOutcome } from "./shareFile.ts";
 export { canSignFor, isProven, type Claim } from "./signedIn.ts";