Collapsed-by-default 'paste an nsec (unsafe)' option on the login screen,
signs the NIP-98 login event client-side with nostr-tools and never
persists the key (used once in memory, discarded) — for testing/kiosk
use without a NIP-07 extension. Clearly labeled as unsafe in the UI.
Dedicated nginx server block on :8543 (not proxied under the dashboard's
80/443) because the dashboard sets Permissions-Policy: geolocation=()
server-wide, which would silently break Regress's core claim/link
mechanic. Also documents a found-but-not-fixed gap: the dashboard's
app iframe has no allow="geolocation", so the in-dashboard launch path
won't get location access either until that shared component is patched.
A new link can no longer cross any existing link from either team —
segmentsIntersect() does a standard orientation-based segment test,
and routes/links.ts excludes shared-endpoint pairs (fanning multiple
links out of the same portal is fine, that's not a crossing). 6 new
tests; 37 total passing.
- Server: NIP-98 nostr auth (session cookies), BTC Map sync, claim/link/field
routes, physical-presence checks via geolocation distance. 31 tests passing.
- Frontend: Leaflet map, team pick, claim/link UI, Archipelago identity
bridge vendored (nostr-provider.js) for dashboard launch support.
- Verified end-to-end against the live BTC Map API (167 real Madeira places)
and via genuine NIP-98-signed HTTP requests against the built app.
ssmithx