Vendors Archipelago's NIP-07 provider shim (neode-ui/public/
nostr-provider.js) and loads it in index.html's <head>. It's a no-op
outside an Archipelago iframe (the shim's own window === window.top
guard), so this is always safe to include.
When podsteadr is opened from the Archipelago dashboard (registered
there as an external identity-aware app — see the companion archy
change on branch feat/podsteadr-external-nostr-identity), the parent
frame lets the user pick one of their node's stored nostr identities
and posts window.nostr signing requests through to it. The shim then
runs the existing NIP-98 flow against our own auth (nip07.ts, auth.ts,
routes/auth.ts) exactly as if a browser extension had signed it —
nothing on the server needed to change.
Configured for our actual auth shape via data-* attrs the shim reads
from its own <script> tag: data-session-url="/api/auth/login" (ours,
not indeedhub's /api/auth/nostr/session), data-session-mode="cookie"
(we set a session cookie via @fastify/cookie rather than returning a
bearer token in JSON — the shim previously only knew the token shape),
data-me-url="/api/auth/me" (skip re-running the handshake if already
signed in), data-health-url="/api/health" (our actual health route).
Not wired through an Archipelago app manifest/hook — podsteadr isn't
an orchestrator-managed package, so this copy of nostr-provider.js
won't auto-update with archy OTA releases. Re-sync by hand from
archy/neode-ui/public/nostr-provider.js if that file changes upstream.
Verified: `npm run build` (vue-tsc + vite) clean, dist/index.html
includes the script tag with all four data-* attrs, dist/
nostr-provider.js present and syntactically valid.
ssmithx
133558d923