@tollbooth-dpyc/web 1.8.2 → 2.0.0

package/dist/index.js

@@ -3,7 +3,7 @@ export { callTool, callToolWithContent, isNetworkError, NetworkError, onProofExp
 export * from "./identity.js";
 export * from "./standardTools.js";
 export { clearSessionNsec, getSessionNsec, getSessionNsecBytes, hasSessionNsec, sessionNsecNpub, setSessionNsec, } from "./sessionNsec.js";
-export { signInlineProof } from "./inlineProof.js";
+export { signRequest } from "./requestSigning.js";
 export { sessionKeyClaimVisible } from "./sessionKeyClaim.js";
 export { handOffMode, shareOrDownload } from "./shareFile.js";
 export { canSignFor, isProven } from "./signedIn.js";

package/dist/pagesProxy.d.ts

@@ -12,11 +12,10 @@
  * Only the headers MCP needs are forwarded upstream. Cookies and anything else
  * the browser attached stay behind.
  *
- * Every request upstream carries a bearer. An operator with holder bearer on
- * refuses a request without one; a page that holds no holder token is an
- * anonymous caller, so the proxy says so with `Bearer anonymous` and the page
- * proves itself with `dpop_token` as before. A page that does hold a token
- * sends it, and it is forwarded untouched.
+ * Every request upstream carries who it may act as. An operator refuses a
+ * request with no `Authorization`, so a page that neither signs (`Nostr`)
+ * nor holds a holder token is an anonymous caller, and the proxy says so with
+ * `Bearer anonymous`. A request that carries either is forwarded untouched.
  */
 export declare const CORS_HEADERS: Record<string, string>;
 export declare const ANONYMOUS_BEARER = "Bearer anonymous";

package/dist/pagesProxy.js

@@ -12,11 +12,10 @@
  * Only the headers MCP needs are forwarded upstream. Cookies and anything else
  * the browser attached stay behind.
  *
- * Every request upstream carries a bearer. An operator with holder bearer on
- * refuses a request without one; a page that holds no holder token is an
- * anonymous caller, so the proxy says so with `Bearer anonymous` and the page
- * proves itself with `dpop_token` as before. A page that does hold a token
- * sends it, and it is forwarded untouched.
+ * Every request upstream carries who it may act as. An operator refuses a
+ * request with no `Authorization`, so a page that neither signs (`Nostr`)
+ * nor holds a holder token is an anonymous caller, and the proxy says so with
+ * `Bearer anonymous`. A request that carries either is forwarded untouched.
  */
 export const CORS_HEADERS = {
     "Access-Control-Allow-Origin": "*",

package/dist/react/FundingStatus.js

@@ -69,11 +69,17 @@ async function proofKind() {
     const claim = currentClaim();
     if (canSignFor(claim))
         return { kind: "session_nsec" };
-    if (!claim.proof)
+    if (!claim.held)
         return { kind: "none" };
-    const s = await checkProofStatus(claim.npub, claim.proof).catch(() => null);
-    const status = s?.status === "valid" || s?.status === "expired" ? s.status : "unknown";
-    return { kind: "dm_proof", status, expiresInSec: s?.expires_in_seconds ?? null };
+    const s = await checkProofStatus(claim.npub).catch(() => null);
+    return { kind: "held", status: heldStatus(s?.status), expiresInSec: s?.expires_in_seconds ?? null };
+}
+function heldStatus(status) {
+    if (status === "valid" || status === "not_held")
+        return status;
+    if (status === "expired" || status === "revoked" || status === "invalid")
+        return "lapsed";
+    return "unknown";
 }
 /** The patron's own health: sign-in proof and credit balance. */
 export function PatronFundingStatus({ thresholds, siteRows, heading = "Account health", ...rest }) {

package/dist/react/NpubGate.d.ts

@@ -3,7 +3,10 @@
  *
  *   begin → request_npub_proof → awaiting reply → receive_npub_proof → app
  *
- * Success is not a `verified` flag but "no `error` and a token came back".
+ * Success is not a `verified` flag but the operator saying it now holds the
+ * npub for this tab's connection (`held_by_connection`). A DM sign-in therefore
+ * needs a holder connection first; a site without `operatorUrl` offers the
+ * session key only.
  *
  * Around the card: the site's `welcome` (its own words about what this place
  * is for), the network's register line, and — below — `SignInSteps`, which

package/dist/react/NpubGate.js

@@ -4,7 +4,10 @@ import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-run
  *
  *   begin → request_npub_proof → awaiting reply → receive_npub_proof → app
  *
- * Success is not a `verified` flag but "no `error` and a token came back".
+ * Success is not a `verified` flag but the operator saying it now holds the
+ * npub for this tab's connection (`held_by_connection`). A DM sign-in therefore
+ * needs a holder connection first; a site without `operatorUrl` offers the
+ * session key only.
  *
  * Around the card: the site's `welcome` (its own words about what this place
  * is for), the network's register line, and — below — `SignInSteps`, which
@@ -15,7 +18,8 @@ import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-run
 import { useEffect, useRef, useState } from "react";
 import { generateSecretKey, getPublicKey, nip19 } from "nostr-tools";
 import { tollboothConfig } from "../config.js";
-import { forgetRecentLogin, getLastTypedNpub, getValidRecentLogins, recordRecentLogin, setLastTypedNpub, setStoredNpub, setStoredProof, } from "../identity.js";
+import { forgetRecentLogin, getLastTypedNpub, getValidRecentLogins, recordRecentLogin, setLastTypedNpub, setStoredNpub, } from "../identity.js";
+import { completeHolderConnect, connectAsHolder, holderEnabled, isHolder } from "../holder.js";
 import { setSessionNsec } from "../sessionNsec.js";
 import { readSignInFailure } from "../signInSituation.js";
 import { receiveNpubProof, requestNpubProof } from "../standardTools.js";
@@ -53,7 +57,7 @@ export default function NpubGate({ onLogin, startFresh = false, operatorHash, no
     // Prefilled from what was typed last, NOT from the stored identity.
     const [value, setValue] = useState(getLastTypedNpub());
     const [stage, setStage] = useState("begin");
-    const [pendingProof, setPendingProof] = useState("");
+    const [nonce, setNonce] = useState("");
     const [busy, setBusy] = useState(false);
     const [error, setError] = useState("");
     const [note, setNote] = useState("");
@@ -75,8 +79,7 @@ export default function NpubGate({ onLogin, startFresh = false, operatorHash, no
     const valid = isNsec || isNpub;
     function reuseRecent(entry) {
         setStoredNpub(entry.npub);
-        setStoredProof(entry.proof);
-        recordRecentLogin(entry.npub, entry.proof, Math.floor((entry.expiresAt - Date.now()) / 1000));
+        recordRecentLogin(entry.npub, Math.floor((entry.expiresAt - Date.now()) / 1000));
         onLogin();
     }
     function forget(npub) {
@@ -106,23 +109,50 @@ export default function NpubGate({ onLogin, startFresh = false, operatorHash, no
             setError(`Couldn't read that nsec: ${e.message}`);
         }
     }
-    async function begin() {
-        if (!isNpub) {
+    // Back from connecting to the operator: carry on with the DM it was for.
+    const resumed = useRef(false);
+    useEffect(() => {
+        if (resumed.current)
+            return;
+        resumed.current = true;
+        completeHolderConnect()
+            .then((npub) => {
+            if (npub) {
+                setValue(npub);
+                void begin(npub);
+            }
+        })
+            .catch((e) => setError(e.message));
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, []);
+    async function begin(npubArg) {
+        const npubToProve = npubArg ?? trimmed;
+        if (!(npubToProve.startsWith("npub1") && npubToProve.length >= 60)) {
             setError("Enter a valid npub1… key.");
             return;
         }
         setBusy(true);
         setError("");
         try {
-            const r = await requestNpubProof(trimmed, globalThis.location.origin, `You requested to sign in to ${appName} (${globalThis.location.host}).`);
+            // The proof will stay with the operator, so this tab connects to it
+            // first; the browser comes straight back here and the DM goes out.
+            if (!holderEnabled()) {
+                setError("This site signs in with a key only — paste an nsec, or make one.");
+                return;
+            }
+            if (!isHolder()) {
+                await connectAsHolder(npubToProve);
+                return;
+            }
+            const r = await requestNpubProof(npubToProve, globalThis.location.origin, `You requested to sign in to ${appName} (${globalThis.location.host}).`);
             if (r.error)
                 return setError(r.error);
-            if (!r.dpop_token)
+            if (!r.nonce)
                 return setError("The service did not return a session phrase. Try again.");
             // Remembered for the field only. The identity is written by `finish()`,
             // once the human has answered the DM.
-            setLastTypedNpub(trimmed);
-            setPendingProof(r.dpop_token);
+            setLastTypedNpub(npubToProve);
+            setNonce(r.nonce);
             setStage("awaiting");
         }
         catch (e) {
@@ -137,20 +167,18 @@ export default function NpubGate({ onLogin, startFresh = false, operatorHash, no
         setError("");
         setStage("checking");
         try {
-            const r = await receiveNpubProof(trimmed, pendingProof);
-            if (r.error) {
-                setError(r.error);
+            const r = await receiveNpubProof(trimmed, nonce);
+            if (r.error || !r.held_by_connection) {
+                setError(r.error || "The service did not keep the proof for this page. Try again.");
                 setStage("awaiting");
                 return;
             }
-            const token = r.dpop_token || pendingProof;
             const npub = r.proven_npub || trimmed;
             setStoredNpub(npub);
-            setStoredProof(token);
             if (r.expires_in_seconds && r.expires_in_seconds > 0) {
-                recordRecentLogin(npub, token, r.expires_in_seconds);
+                recordRecentLogin(npub, r.expires_in_seconds);
                 const h = Math.floor(r.expires_in_seconds / 3600);
-                setNote(`Proof cached for ~${h > 0 ? `${h}h` : `${Math.round(r.expires_in_seconds / 60)}m`}.`);
+                setNote(`Proof held for ~${h > 0 ? `${h}h` : `${Math.round(r.expires_in_seconds / 60)}m`}.`);
             }
             onLogin();
         }
@@ -164,10 +192,10 @@ export default function NpubGate({ onLogin, startFresh = false, operatorHash, no
     }
     function reset() {
         setStage("begin");
-        setPendingProof("");
+        setNonce("");
         setError("");
     }
-    return (_jsxs("div", { className: cx("max-w-md mx-auto mt-12 px-4", c.root), children: [_jsxs("h1", { className: "text-xl font-semibold mb-1", children: ["Sign in to ", appName] }), welcome && _jsx("div", { className: cx("text-sm mb-3", c.welcome), children: welcome }), _jsxs("p", { className: cx(`text-sm mb-5 ${muted}`, c.register), children: [appName, " is an operator on the Tollbooth DPYC\u2122 network. DPYC\u2122 \u2014 Don't Pester Your Customer\u2122: no email, no password, no KYC. Your Nostr key is your identity."] }), notice && _jsx("div", { className: `mb-5 ${warnBox}`, children: notice }), stage === "begin" && recents.length > 0 && (_jsxs("div", { className: "mb-5", children: [_jsx("div", { className: `text-xs uppercase tracking-wider mb-2 ${muted}`, children: "Recent identities" }), _jsx("div", { className: "space-y-1.5", children: recents.map((e) => (_jsxs("div", { className: "flex gap-1.5", children: [_jsxs("button", { type: "button", onClick: () => reuseRecent(e), disabled: busy, title: `Re-enter as ${e.npub} on the cached proof`, className: `${card} flex-1 flex items-center justify-between px-3 py-2.5 text-left hover:border-[var(--tb-accent)]`, children: [_jsxs("span", { className: "font-mono text-xs truncate", children: [e.npub.slice(0, 12), "\u2026", e.npub.slice(-6)] }), _jsxs("span", { className: `text-xs shrink-0 ml-2 ${muted}`, children: [ttl(e.expiresAt), " left"] })] }), _jsx("button", { type: "button", onClick: () => forget(e.npub), disabled: busy, title: "Forget this identity", "aria-label": "Forget this identity", className: `w-9 rounded-lg border border-[var(--tb-line)] ${muted}`, children: "\u00D7" })] }, e.npub))) })] })), _jsxs("div", { className: `${card} p-4 space-y-3`, children: [stage === "begin" ? (_jsxs(_Fragment, { children: [_jsx("label", { className: `block text-xs uppercase tracking-wider ${muted}`, htmlFor: "tb-npub-field", children: "Enter npub (secure) or nsec (convenient)" }), _jsx("input", { id: "tb-npub-field", "data-tour": "tb.gate.npub", type: isNsec ? "password" : "text", value: value, onChange: (e) => {
+    return (_jsxs("div", { className: cx("max-w-md mx-auto mt-12 px-4", c.root), children: [_jsxs("h1", { className: "text-xl font-semibold mb-1", children: ["Sign in to ", appName] }), welcome && _jsx("div", { className: cx("text-sm mb-3", c.welcome), children: welcome }), _jsxs("p", { className: cx(`text-sm mb-5 ${muted}`, c.register), children: [appName, " is an operator on the Tollbooth DPYC\u2122 network. DPYC\u2122 \u2014 Don't Pester Your Customer\u2122: no email, no password, no KYC. Your Nostr key is your identity."] }), notice && _jsx("div", { className: `mb-5 ${warnBox}`, children: notice }), stage === "begin" && recents.length > 0 && (_jsxs("div", { className: "mb-5", children: [_jsx("div", { className: `text-xs uppercase tracking-wider mb-2 ${muted}`, children: "Recent identities" }), _jsx("div", { className: "space-y-1.5", children: recents.map((e) => (_jsxs("div", { className: "flex gap-1.5", children: [_jsxs("button", { type: "button", onClick: () => reuseRecent(e), disabled: busy, title: `Re-enter as ${e.npub} on the proof the service holds`, className: `${card} flex-1 flex items-center justify-between px-3 py-2.5 text-left hover:border-[var(--tb-accent)]`, children: [_jsxs("span", { className: "font-mono text-xs truncate", children: [e.npub.slice(0, 12), "\u2026", e.npub.slice(-6)] }), _jsxs("span", { className: `text-xs shrink-0 ml-2 ${muted}`, children: [ttl(e.expiresAt), " left"] })] }), _jsx("button", { type: "button", onClick: () => forget(e.npub), disabled: busy, title: "Forget this identity", "aria-label": "Forget this identity", className: `w-9 rounded-lg border border-[var(--tb-line)] ${muted}`, children: "\u00D7" })] }, e.npub))) })] })), _jsxs("div", { className: `${card} p-4 space-y-3`, children: [stage === "begin" ? (_jsxs(_Fragment, { children: [_jsx("label", { className: `block text-xs uppercase tracking-wider ${muted}`, htmlFor: "tb-npub-field", children: "Enter npub (secure) or nsec (convenient)" }), _jsx("input", { id: "tb-npub-field", "data-tour": "tb.gate.npub", type: isNsec ? "password" : "text", value: value, onChange: (e) => {
                                     setValue(e.target.value);
                                     setGeneratedHint(false);
                                 }, onKeyDown: (e) => {
@@ -177,7 +205,7 @@ export default function NpubGate({ onLogin, startFresh = false, operatorHash, no
                                         signInWithNsec();
                                     else
                                         void begin();
-                                }, placeholder: "npub1\u2026", spellCheck: false, autoCapitalize: "off", autoCorrect: "off", className: input }), generatedHint && (_jsxs("div", { className: warnBox, children: ["New key generated. ", _jsx("b", { children: "Save this nsec" }), " somewhere safe \u2014 it's the only copy and it lives only in this browser."] })), _jsx("button", { type: "button", onClick: () => (isNsec ? signInWithNsec() : void begin()), disabled: !valid || busy, className: primary, "data-tour": "tb.gate.send", children: busy ? "Sending…" : isNpub ? "Send message" : "Sign in" }), isNsec && _jsx("p", { className: `text-xs ${muted}`, children: "Your nsec stays in this browser and signs each call." }), isNpub && (_jsx("p", { className: `text-xs ${muted}`, children: "We send a message to your npub. Approve it from your Nostr client \u2014 your signature is the proof." })), _jsx("p", { className: `text-xs pt-1 ${muted}`, children: "Need a new identity?" }), _jsx("button", { type: "button", onClick: generateKey, className: ghost, children: "Generate a new key" })] })) : (_jsxs(_Fragment, { children: [_jsxs("div", { className: `${warnBox} space-y-1.5`, children: [_jsx("div", { className: "font-medium", children: "Message sent \u2014 open your Nostr client." }), _jsx("div", { children: "Reply with any text. Your signature on that reply is the proof." }), operatorHash && (_jsxs("div", { children: ["Sender fingerprint: ", _jsxs("span", { className: "font-mono", children: ["\uD83D\uDD12 ", operatorHash] })] }))] }), pendingProof && (_jsxs("div", { className: "rounded-lg p-3 text-xs border border-[var(--tb-accent)] space-y-2", children: [_jsx("div", { className: `uppercase tracking-wider text-[10px] ${muted}`, children: "Confirmation code" }), _jsx("div", { className: "font-mono text-base select-all", children: pendingProof }), _jsxs("div", { className: `leading-relaxed ${muted}`, children: ["The same code appears in the message. ", _jsx("b", { children: "Approve it only if the codes match." }), " If they differ \u2014 or the message points you somewhere other than this site \u2014 do not reply."] })] })), _jsx("button", { type: "button", onClick: () => void finish(), disabled: busy, className: primary, "data-tour": "tb.gate.verify", children: busy ? "Checking…" : "I've replied — verify" }), _jsx("button", { type: "button", onClick: () => void begin(), disabled: busy, className: ghost, children: "Resend" }), _jsx("button", { type: "button", onClick: reset, disabled: busy, className: `w-full text-xs py-1.5 ${muted}`, children: "Use a different npub" })] })), error && _jsx(Trouble, { raw: error, appName: appName }), note && _jsx("div", { className: `text-xs text-center italic ${muted}`, children: note })] }), steps && _jsx(SignInSteps, { stage: gateStage(stage, busy), classNames: { ...STEPS_LOOK, ...c.steps } }), links && _jsx(SignInLinks, { credit: linksCredit, classNames: { ...LINKS_LOOK, ...c.links } })] }));
+                                }, placeholder: "npub1\u2026", spellCheck: false, autoCapitalize: "off", autoCorrect: "off", className: input }), generatedHint && (_jsxs("div", { className: warnBox, children: ["New key generated. ", _jsx("b", { children: "Save this nsec" }), " somewhere safe \u2014 it's the only copy and it lives only in this browser."] })), _jsx("button", { type: "button", onClick: () => (isNsec ? signInWithNsec() : void begin()), disabled: !valid || busy, className: primary, "data-tour": "tb.gate.send", children: busy ? "Sending…" : isNpub ? "Send message" : "Sign in" }), isNsec && _jsx("p", { className: `text-xs ${muted}`, children: "Your nsec stays in this browser and signs each call." }), isNpub && (_jsx("p", { className: `text-xs ${muted}`, children: "We send a message to your npub. Approve it from your Nostr client \u2014 your signature is the proof." })), _jsx("p", { className: `text-xs pt-1 ${muted}`, children: "Need a new identity?" }), _jsx("button", { type: "button", onClick: generateKey, className: ghost, children: "Generate a new key" })] })) : (_jsxs(_Fragment, { children: [_jsxs("div", { className: `${warnBox} space-y-1.5`, children: [_jsx("div", { className: "font-medium", children: "Message sent \u2014 open your Nostr client." }), _jsx("div", { children: "Reply with any text. Your signature on that reply is the proof." }), operatorHash && (_jsxs("div", { children: ["Sender fingerprint: ", _jsxs("span", { className: "font-mono", children: ["\uD83D\uDD12 ", operatorHash] })] }))] }), nonce && (_jsxs("div", { className: "rounded-lg p-3 text-xs border border-[var(--tb-accent)] space-y-2", children: [_jsx("div", { className: `uppercase tracking-wider text-[10px] ${muted}`, children: "Confirmation code" }), _jsx("div", { className: "font-mono text-base select-all", children: nonce }), _jsxs("div", { className: `leading-relaxed ${muted}`, children: ["The same code appears in the message. ", _jsx("b", { children: "Approve it only if the codes match." }), " If they differ \u2014 or the message points you somewhere other than this site \u2014 do not reply."] })] })), _jsx("button", { type: "button", onClick: () => void finish(), disabled: busy, className: primary, "data-tour": "tb.gate.verify", children: busy ? "Checking…" : "I've replied — verify" }), _jsx("button", { type: "button", onClick: () => void begin(), disabled: busy, className: ghost, children: "Resend" }), _jsx("button", { type: "button", onClick: reset, disabled: busy, className: `w-full text-xs py-1.5 ${muted}`, children: "Use a different npub" })] })), error && _jsx(Trouble, { raw: error, appName: appName }), note && _jsx("div", { className: `text-xs text-center italic ${muted}`, children: note })] }), steps && _jsx(SignInSteps, { stage: gateStage(stage, busy), classNames: { ...STEPS_LOOK, ...c.steps } }), links && _jsx(SignInLinks, { credit: linksCredit, classNames: { ...LINKS_LOOK, ...c.links } })] }));
 }
 /** A failure, read to the person: the lead first, the service's own words underneath. */
 function Trouble({ raw, appName }) {

package/dist/requestSigning.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Every request a page sends while it holds the signed-in npub's key is signed
+ * with that key (NIP-98): an `Authorization: Nostr` event bound to the method,
+ * the URL and the sha256 of the body. Whoever holds the key needs no grant, and
+ * no tool call carries a proof in its arguments.
+ */
+/**
+ * 16 random bytes as 32 lowercase hex chars. Without it two requests signed in
+ * the same wall-clock second could be byte-identical, their ids would collide,
+ * and the server's replay guard would refuse the second.
+ */
+export declare function proofNonce(): string;
+/** The `Authorization` value for one request, signed by `secretKey`. */
+export declare function signRequest(method: string, url: string, body: string, secretKey: Uint8Array): Promise<string>;
+/**
+ * True when this tab holds the key of the npub that is signed in. A key left
+ * from a previous identity is evicted rather than allowed to sign.
+ */
+export declare function signsForSignedInNpub(): boolean;
+/**
+ * `fetch` for the MCP transport: the request carries who it may act as — this
+ * tab's key when it holds one, else this tab's holder connection, else nobody
+ * (the site's proxy then marks it anonymous).
+ */
+export declare const signingFetch: typeof fetch;

package/dist/requestSigning.js

@@ -0,0 +1,71 @@
+/**
+ * Every request a page sends while it holds the signed-in npub's key is signed
+ * with that key (NIP-98): an `Authorization: Nostr` event bound to the method,
+ * the URL and the sha256 of the body. Whoever holds the key needs no grant, and
+ * no tool call carries a proof in its arguments.
+ */
+import { finalizeEvent } from "nostr-tools";
+import { holderBearer } from "./holder.js";
+import { getStoredNpub } from "./identity.js";
+import { clearSessionNsec, getSessionNsecBytes, hasSessionNsec, sessionNsecNpub } from "./sessionNsec.js";
+const PROOF_KIND = 27235;
+/**
+ * 16 random bytes as 32 lowercase hex chars. Without it two requests signed in
+ * the same wall-clock second could be byte-identical, their ids would collide,
+ * and the server's replay guard would refuse the second.
+ */
+export function proofNonce() {
+    const bytes = crypto.getRandomValues(new Uint8Array(16));
+    return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+async function sha256Hex(body) {
+    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(body));
+    return Array.from(new Uint8Array(digest), (b) => b.toString(16).padStart(2, "0")).join("");
+}
+/** The `Authorization` value for one request, signed by `secretKey`. */
+export async function signRequest(method, url, body, secretKey) {
+    const event = finalizeEvent({
+        kind: PROOF_KIND,
+        created_at: Math.floor(Date.now() / 1000),
+        tags: [
+            ["u", url],
+            ["method", method.toUpperCase()],
+            ["payload", await sha256Hex(body)],
+            ["nonce", proofNonce()],
+        ],
+        content: "",
+    }, secretKey);
+    return `Nostr ${btoa(JSON.stringify(event))}`;
+}
+/**
+ * True when this tab holds the key of the npub that is signed in. A key left
+ * from a previous identity is evicted rather than allowed to sign.
+ */
+export function signsForSignedInNpub() {
+    const sessionNpub = hasSessionNsec() ? sessionNsecNpub() : null;
+    if (!sessionNpub)
+        return false;
+    if (sessionNpub === getStoredNpub())
+        return true;
+    clearSessionNsec();
+    return false;
+}
+/**
+ * `fetch` for the MCP transport: the request carries who it may act as — this
+ * tab's key when it holds one, else this tab's holder connection, else nobody
+ * (the site's proxy then marks it anonymous).
+ */
+export const signingFetch = async (input, init) => {
+    const headers = new Headers(init?.headers);
+    if (signsForSignedInNpub()) {
+        const request = new Request(input, init);
+        const body = typeof init?.body === "string" ? init.body : "";
+        headers.set("Authorization", await signRequest(request.method, request.url, body, getSessionNsecBytes()));
+    }
+    else {
+        const bearer = await holderBearer();
+        if (bearer)
+            headers.set("Authorization", `Bearer ${bearer}`);
+    }
+    return fetch(input, { ...init, headers });
+};

package/dist/signedIn.d.ts

@@ -4,23 +4,24 @@
  * An npub is public — it is on every note its owner ever wrote — so the npub
  * alone is a claim, never a credential. A shell that read "we know an npub" as
  * "signed in" let anyone who asked for a DM and never answered it in, as
- * themselves, unproven. Two things can back the claim:
+ * themselves, unproven. Two things can back the claim, both on the connection:
  *
- *   - a **cached DM proof**, won by answering a Nostr challenge, or
- *   - a **session nsec** in this tab, which signs a fresh proof per call — and
- *     only counts for the npub it actually derives to.
+ *   - a **DM proof**, won by answering a Nostr challenge — held by the operator
+ *     for this tab's holder connection, or
+ *   - a **session nsec** in this tab, which signs every request — and only
+ *     counts for the npub it actually derives to.
  *
  * Pure, so it is testable without a browser.
  */
 export interface Claim {
     /** The npub the interface is showing, proven or not. */
     npub: string;
-    /** A cached DM proof token, if one was won and has not lapsed. */
-    proof: string;
+    /** True when this tab's holder connection holds the npub, proven by DM. */
+    held: boolean;
     /** The npub this tab's session key derives to, if it holds one. */
     sessionNpub: string | null;
 }
 /** True only when the claimed npub is backed by something. */
-export declare function isProven({ npub, proof, sessionNpub }: Claim): boolean;
+export declare function isProven({ npub, held, sessionNpub }: Claim): boolean;
 /** True when this tab can sign a fresh proof for the npub it is claiming. */
 export declare function canSignFor({ npub, sessionNpub }: Claim): boolean;

package/dist/signedIn.js

@@ -4,21 +4,18 @@
  * An npub is public — it is on every note its owner ever wrote — so the npub
  * alone is a claim, never a credential. A shell that read "we know an npub" as
  * "signed in" let anyone who asked for a DM and never answered it in, as
- * themselves, unproven. Two things can back the claim:
+ * themselves, unproven. Two things can back the claim, both on the connection:
  *
- *   - a **cached DM proof**, won by answering a Nostr challenge, or
- *   - a **session nsec** in this tab, which signs a fresh proof per call — and
- *     only counts for the npub it actually derives to.
+ *   - a **DM proof**, won by answering a Nostr challenge — held by the operator
+ *     for this tab's holder connection, or
+ *   - a **session nsec** in this tab, which signs every request — and only
+ *     counts for the npub it actually derives to.
  *
  * Pure, so it is testable without a browser.
  */
 /** True only when the claimed npub is backed by something. */
-export function isProven({ npub, proof, sessionNpub }) {
-    if (!npub)
-        return false;
-    if (proof)
-        return true;
-    return sessionNpub === npub;
+export function isProven({ npub, held, sessionNpub }) {
+    return Boolean(npub) && (held || sessionNpub === npub);
 }
 /** True when this tab can sign a fresh proof for the npub it is claiming. */
 export function canSignFor({ npub, sessionNpub }) {

package/dist/standardTools.d.ts

@@ -53,7 +53,10 @@ export interface NpubProofResult {
     proven_npub?: string;
     status?: string;
     message?: string;
-    dpop_token?: string;
+    /** From `request_npub_proof`: the phrase the DM shows; it names the reply. */
+    nonce?: string;
+    /** From `receive_npub_proof`: the operator now holds the npub for this tab's connection. */
+    held_by_connection?: boolean;
     expires_in_seconds?: number;
     expires_at?: string;
     error?: string;
@@ -69,18 +72,21 @@ export interface NpubProofResult {
  */
 export declare function requestNpubProof(patronNpub: string, verifyAt?: string, reason?: string, opts?: CallOptions): Promise<NpubProofResult>;
 /**
- * Step 2: drain DMs for the signed reply to step 1. Call only after the human
- * says they replied — it is destructive, so never poll it.
+ * Step 2: drain DMs for the signed reply to step 1, naming it by the `nonce`
+ * step 1 returned. The operator keeps the proof for this tab's holder
+ * connection. Call only after the human says they replied — it is
+ * destructive, so never poll it.
  */
-export declare function receiveNpubProof(patronNpub: string, dpopToken: string, opts?: CallOptions): Promise<NpubProofResult>;
+export declare function receiveNpubProof(patronNpub: string, nonce: string, opts?: CallOptions): Promise<NpubProofResult>;
 export interface ProofStatusResult {
     success?: boolean;
-    status?: "valid" | "expired" | "unknown" | string;
+    status?: "valid" | "expired" | "invalid" | "revoked" | "not_held" | string;
     expires_in_seconds?: number | null;
     error?: string;
     error_code?: string;
 }
-export declare function checkProofStatus(patronNpub: string, dpopToken: string, opts?: CallOptions): Promise<ProofStatusResult>;
+/** Whether this tab's connection proves `patronNpub`, and until when. */
+export declare function checkProofStatus(patronNpub: string, opts?: CallOptions): Promise<ProofStatusResult>;
 /** One credit tranche: a purchase (or grant) and what is left of it. */
 export interface CreditTranche {
     id: string;

package/dist/standardTools.js

@@ -26,14 +26,17 @@ export function requestNpubProof(patronNpub, verifyAt, reason, opts) {
     }, opts);
 }
 /**
- * Step 2: drain DMs for the signed reply to step 1. Call only after the human
- * says they replied — it is destructive, so never poll it.
+ * Step 2: drain DMs for the signed reply to step 1, naming it by the `nonce`
+ * step 1 returned. The operator keeps the proof for this tab's holder
+ * connection. Call only after the human says they replied — it is
+ * destructive, so never poll it.
  */
-export function receiveNpubProof(patronNpub, dpopToken, opts) {
-    return callTool("receive_npub_proof", { patron_npub: patronNpub, dpop_token: dpopToken }, opts);
+export function receiveNpubProof(patronNpub, nonce, opts) {
+    return callTool("receive_npub_proof", { patron_npub: patronNpub, nonce }, opts);
 }
-export function checkProofStatus(patronNpub, dpopToken, opts) {
-    return callTool("check_proof_status", { patron_npub: patronNpub, dpop_token: dpopToken }, { bestEffort: true, ...opts });
+/** Whether this tab's connection proves `patronNpub`, and until when. */
+export function checkProofStatus(patronNpub, opts) {
+    return callTool("check_proof_status", { patron_npub: patronNpub }, { bestEffort: true, ...opts });
 }
 export function checkBalance(opts) {
     return callTool("check_balance", {}, opts);

package/dist/toolResult.d.ts

@@ -27,21 +27,21 @@ export interface ReadResult {
 export declare function errorText(result: RawToolResult): string;
 export declare function readToolResult(result: RawToolResult): ReadResult;
 /**
- * A soft proof failure: `{success: false, error_code: proof_required |
- * proof_refresh_needed}` with no isError flag. The wheel's codes are lowercase
- * snake_case; an earlier uppercase comparison never matched, so the bounce
- * silently never fired. Normalised here, once.
+ * A soft proof failure: `{success: false, error_code: proof_required}` with no
+ * isError flag — the connection does not prove the npub. The wheel's codes are
+ * lowercase snake_case; an earlier uppercase comparison never matched, so the
+ * bounce silently never fired. Normalised here, once.
  */
 export declare function proofBounceMessage(payload: unknown): string | null;
 /**
- * A stored proof grant the service refused for good: `{success: false,
+ * A held proof grant the service refused for good: `{success: false,
  * error_code: proof_invalid, reason}` where the reason is about the grant —
  * expired, revoked, issued for another npub or operator, malformed. Retrying
- * with it can never succeed, so the patron is signed out.
+ * on it can never succeed, so the patron is signed out.
  *
- * Only meaningful when the call carried the stored grant. A session key's
- * inline proof shares the code and even the word `expired` (outside its
- * window), but it is signed afresh for the next call and loses nothing.
+ * Only meaningful when the call rode this tab's holder. A signed request
+ * shares the code and even the word `expired` (outside its window), but it is
+ * signed afresh for the next call and loses nothing.
  */
 export declare function deadGrantMessage(payload: unknown): string | null;
 /** Whether a payload reports failure, for the debug log's colouring. */

package/dist/toolResult.js

@@ -36,17 +36,17 @@ export function readToolResult(result) {
     return { payload, images };
 }
 /**
- * A soft proof failure: `{success: false, error_code: proof_required |
- * proof_refresh_needed}` with no isError flag. The wheel's codes are lowercase
- * snake_case; an earlier uppercase comparison never matched, so the bounce
- * silently never fired. Normalised here, once.
+ * A soft proof failure: `{success: false, error_code: proof_required}` with no
+ * isError flag — the connection does not prove the npub. The wheel's codes are
+ * lowercase snake_case; an earlier uppercase comparison never matched, so the
+ * bounce silently never fired. Normalised here, once.
  */
 export function proofBounceMessage(payload) {
     if (!payload || typeof payload !== "object")
         return null;
     const p = payload;
     const code = String(p.error_code ?? "").toLowerCase();
-    if (p.success === false && (code === "proof_required" || code === "proof_refresh_needed")) {
+    if (p.success === false && code === "proof_required") {
         return String(p.error ?? "Sign-in required.");
     }
     return null;
@@ -58,14 +58,14 @@ export function proofBounceMessage(payload) {
  */
 const GRANT_STILL_GOOD = new Set(["operator_unknown", "revocations_unavailable"]);
 /**
- * A stored proof grant the service refused for good: `{success: false,
+ * A held proof grant the service refused for good: `{success: false,
  * error_code: proof_invalid, reason}` where the reason is about the grant —
  * expired, revoked, issued for another npub or operator, malformed. Retrying
- * with it can never succeed, so the patron is signed out.
+ * on it can never succeed, so the patron is signed out.
  *
- * Only meaningful when the call carried the stored grant. A session key's
- * inline proof shares the code and even the word `expired` (outside its
- * window), but it is signed afresh for the next call and loses nothing.
+ * Only meaningful when the call rode this tab's holder. A signed request
+ * shares the code and even the word `expired` (outside its window), but it is
+ * signed afresh for the next call and loses nothing.
  */
 export function deadGrantMessage(payload) {
     if (!payload || typeof payload !== "object")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tollbooth-dpyc/web",
-  "version": "1.8.2",
+  "version": "2.0.0",
   "description": "Shared browser SDK for Tollbooth DPYC operator front ends: npub sign-in, proofs, MCP client, profile and wallet",
   "license": "Apache-2.0",
   "author": "Lonnie VanZandt",

package/dist/inlineProof.d.ts

@@ -1,18 +0,0 @@
-/**
- * Inline kind-27235 identity proof — Tactic 2 in the wheel's
- * `identity_proof.verify_proof`. A fresh signed event per paid call, bound to:
- * the sender pubkey (must match the claimed npub), the `u` tag (must match the
- * runtime tool name, e.g. "chart_snapshot_display"), and `created_at` (within
- * about 60 seconds of server time). The wheel verifies the Schnorr signature
- * inline — no relay round trip, no cached phrase.
- *
- * Every proof also carries a random `nonce` tag, exactly as the wheel's own
- * `create_proof` does. Without it, two calls to the same tool in the same
- * wall-clock second sign byte-identical events, their ids collide, and the
- * verifier's replay guard refuses the second. The nonce is signed but inert:
- * `verify_proof` reads only the `u` tag.
- */
-/** 16 random bytes as 32 lowercase hex chars — Python's `secrets.token_hex(16)`. */
-export declare function proofNonce(): string;
-/** The JSON-stringified signed event, exactly what `verify_proof` expects. */
-export declare function signInlineProof(runtimeToolName: string, secretKey?: Uint8Array): string;

package/dist/inlineProof.js

@@ -1,35 +0,0 @@
-/**
- * Inline kind-27235 identity proof — Tactic 2 in the wheel's
- * `identity_proof.verify_proof`. A fresh signed event per paid call, bound to:
- * the sender pubkey (must match the claimed npub), the `u` tag (must match the
- * runtime tool name, e.g. "chart_snapshot_display"), and `created_at` (within
- * about 60 seconds of server time). The wheel verifies the Schnorr signature
- * inline — no relay round trip, no cached phrase.
- *
- * Every proof also carries a random `nonce` tag, exactly as the wheel's own
- * `create_proof` does. Without it, two calls to the same tool in the same
- * wall-clock second sign byte-identical events, their ids collide, and the
- * verifier's replay guard refuses the second. The nonce is signed but inert:
- * `verify_proof` reads only the `u` tag.
- */
-import { finalizeEvent } from "nostr-tools";
-import { getSessionNsecBytes } from "./sessionNsec.js";
-const PROOF_KIND = 27235;
-/** 16 random bytes as 32 lowercase hex chars — Python's `secrets.token_hex(16)`. */
-export function proofNonce() {
-    const bytes = crypto.getRandomValues(new Uint8Array(16));
-    return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
-}
-/** The JSON-stringified signed event, exactly what `verify_proof` expects. */
-export function signInlineProof(runtimeToolName, secretKey) {
-    const signed = finalizeEvent({
-        kind: PROOF_KIND,
-        created_at: Math.floor(Date.now() / 1000),
-        tags: [
-            ["u", runtimeToolName],
-            ["nonce", proofNonce()],
-        ],
-        content: "",
-    }, secretKey ?? getSessionNsecBytes());
-    return JSON.stringify(signed);
-}