The throwaway guest identity was disposable by design — lost the
session, lost the account, no way to recover it, not even shown the key
to write down. Replaced with a real onboarding flow:
- generateNewAccount() (lib/nsec.ts) creates a fresh keypair client-side
and returns both nsec and npub for display, reusing the exact same
login mechanism as the existing 'paste an nsec' path (loginWithNsec) —
no new backend surface.
- LoginView.vue now has a backup step between 'Create New Account' and
actually being signed in: shows the npub (safe to share) and nsec
(never share), a copy-to-clipboard button, and an explicit 'this will
not be shown again' warning before the player confirms and logs in.
- Removed lib/guest.ts and the loginAsGuest store action entirely —
fully superseded, not kept alongside.
Verified the nip19 encode/decode round-trip (nsec -> decode -> same
pubkey) and the full generate-then-login flow work correctly before
deploying.
ssmithx
d64c316240