fix: support Bitkit local wallet tests by ben-kaufman · Pull Request #11 · pubky/locks

ben-kaufman · 2026-08-04T17:09:10Z

Summary

make the Paykit Compose demo work with a Bitkit-authenticated creator instead of importing or generating the creator wallet identity in the demo
add a loopback-only Homegate bridge and expose Fulcrum so iOS and Android local test builds can sign up and use the regtest wallet backend
build the Locks WASM package into the demo images so a host-generated package is no longer required
render guarded text, JSON, images, and binary downloads safely without persisting private response bytes in browser storage

This is intentionally stacked on #10 because it hardens and completes that demo's app-wallet test path.

Contract and risk impact

Public API or SDK contract
Persisted data or migration
Authentication, authorization, identity, or secret handling
Payment or entitlement behavior
Runtime, deployment, or observability
No contract/risk impact

Verification

npm --prefix examples/js-sdk run check
npm --prefix examples/js-sdk run validate:paykit-compose
node examples/js-sdk/scripts/smoke-paykit-compose.mjs
clean docker compose -f compose.paykit-local-demo.yaml build creator-demo
Linux image checks: Paykit reader worker, Paykit Compose smoke, and JS SDK examples smoke
clean Compose startup with the creator host port remapped from occupied 8080 to 18080
verified every long-running service stayed healthy, reader state was waiting, Homegate returned a valid signup response, creator preflight passed, and Fulcrum answered an Electrum version request

Documentation

Updated examples/js-sdk/README.md for the external-wallet flow, local service endpoints, and runtime reset.

Checklist

The change is focused and self-reviewed.
Regression tests were added where practical.
No credentials, identities, private content, payment material, or generated local state are included.
Formatting and relevant tests/lints pass.

ovitrif

One blocking issue and one non-blocking issue remain:

Creator-demo boots with --external-wallet and publishes the creator profile only after wallet approval, but reader-demo still binds once from .local/creator-public/profile.json and can run against a stale prior identity or terminal-fail while the profile is missing.
/api/demo-auth/start still returns a recovery-file authenticate command under --external-wallet, so the creator page can steer operators onto a local recovery identity instead of the Bitkit wallet.

ben-kaufman · 2026-08-06T19:22:09Z

@jvsena42 could you please review the current head? The external-wallet identity/profile fixes have been exercised in the clean iOS and Android Locks → Paykit → Bitkit E2E flow, and all prior review threads are resolved.

ben-kaufman · 2026-08-06T19:50:56Z

@jvsena42 follow-up: the current signed head is 1a5f97c and now includes the aligned JS example smoke assertions discovered by CI; the exact smoke suite passes in the Linux demo image.

ovitrif

Thanks for addressing the recovery-auth command. One blocking issue remains: the waiting_for_creator gate still waits on the private content-creator profile path, so Compose external-wallet never observes the published creator-public profile and the reader never prepares.

ovitrif

The waiting_for_creator gate now reads PAYKIT_READER_CREATOR_PROFILE_PATH, matching the Compose creator-public profile publish path, so the earlier external-wallet reader setup blocker is fixed.

LGTM

dzdidi

LGTM, looks like it still working with the non-bitkit tests. May you please confirm? Once confirmed it is merge

Signed-off-by: dzdidi <dzdidi@users.noreply.github.com>

* feat(js-sdk): expose authenticated session metadata * fix(auth): harden iframe callback delivery * feat(demo): add Paykit payment lock workflow * feat(compose): add isolated Paykit payment demo * docs: document Paykit payment demo workflow * fix: support Bitkit local wallet tests (#11) * fix: support Bitkit local wallet tests * fix: complete external wallet Paykit demo * chore: use fast Paykit handshake retries * fix: make local wallet E2E startup reliable * fix: hide recovery auth in external wallet mode * fix: use external creator profile for reader setup * examples: validate work locally Signed-off-by: dzdidi <dzdidi@users.noreply.github.com> * docs|examples: improve texts Signed-off-by: dzdidi <dzdidi@users.noreply.github.com> --------- Signed-off-by: dzdidi <dzdidi@users.noreply.github.com> Co-authored-by: dzdidi <dzdidi@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * match loopback localhost Signed-off-by: dzdidi <dzdidi@users.noreply.github.com> * allign docs, fix outputs Signed-off-by: dzdidi <dzdidi@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * feat(paykit): expose authenticated setup readiness (#28) Signed-off-by: dzdidi <dzdidi@users.noreply.github.com> * fix(examples): update js-sdk demo for @synonymdev/pubky 0.10 (#30) The 0.10 bump (#13) renamed two APIs the demo still called, breaking the creator auth flow at its first step: - Pubky.startAuthFlow -> startCookieAuthFlow (same signature) - Signer.signinBlocking() now requires a clientId. Its no-arg equivalent is signinCookieBlocking(); the new signin/signinBlocking both panic ("unreachable") against the pinned pubky-core homeserver (75eb1324). --------- Signed-off-by: dzdidi <dzdidi@users.noreply.github.com> Co-authored-by: benk10 <ben.kaufman10@gmail.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Taehwa Kim <hadeath03@gmail.com>

fix: support Bitkit local wallet tests

459d0d5

This was referenced Aug 4, 2026

fix: prepare Paykit local auth and private links synonymdev/bitkit-ios#653

Merged

fix: require private Paykit auth scope synonymdev/bitkit-android#1131

Merged

ben-kaufman marked this pull request as ready for review August 4, 2026 18:49

ben-kaufman requested a review from dzdidi as a code owner August 4, 2026 18:49

ben-kaufman requested a review from ovitrif August 4, 2026 19:15

ben-kaufman marked this pull request as draft August 4, 2026 19:21

ben-kaufman removed the request for review from ovitrif August 5, 2026 11:44

ben-kaufman marked this pull request as ready for review August 5, 2026 11:44

ben-kaufman requested a review from ovitrif August 5, 2026 22:24

ovitrif requested changes Aug 5, 2026

View reviewed changes

Comment thread compose.paykit-local-demo.yaml

Comment thread examples/js-sdk/scripts/start-demo-server.mjs

ben-kaufman added 3 commits August 6, 2026 08:20

fix: complete external wallet Paykit demo

c6fcbde

chore: use fast Paykit handshake retries

87ad534

fix: make local wallet E2E startup reliable

b889550

ben-kaufman force-pushed the codex/bitkit-local-e2e-fixes branch from 3bb5cb9 to 8c5dd3f Compare August 6, 2026 18:44

ben-kaufman requested a review from ovitrif August 6, 2026 18:46

ben-kaufman closed this Aug 6, 2026

ben-kaufman reopened this Aug 6, 2026

ben-kaufman force-pushed the codex/bitkit-local-e2e-fixes branch from 8c5dd3f to be5d31e Compare August 6, 2026 19:45

fix: hide recovery auth in external wallet mode

1a5f97c

ben-kaufman force-pushed the codex/bitkit-local-e2e-fixes branch from be5d31e to 1a5f97c Compare August 6, 2026 19:50

ovitrif requested changes Aug 6, 2026

View reviewed changes

fix: use external creator profile for reader setup

ba2cfc5

ovitrif approved these changes Aug 10, 2026

View reviewed changes

dzdidi approved these changes Aug 18, 2026

View reviewed changes

dzdidi added 2 commits August 21, 2026 10:42

examples: validate work locally

80aca52

Signed-off-by: dzdidi <dzdidi@users.noreply.github.com>

docs|examples: improve texts

81a3617

Signed-off-by: dzdidi <dzdidi@users.noreply.github.com>

dzdidi merged commit 71ae933 into feat/paykit-payment-lock-demo Aug 24, 2026
2 checks passed

dzdidi deleted the codex/bitkit-local-e2e-fixes branch August 24, 2026 08:22

Navigation Menu

Uh oh!

fix: support Bitkit local wallet tests - #11

fix: support Bitkit local wallet tests#11
dzdidi merged 8 commits into
feat/paykit-payment-lock-demofrom
codex/bitkit-local-e2e-fixes

ben-kaufman commented Aug 4, 2026

Uh oh!

ovitrif left a comment

Uh oh!

Uh oh!

Uh oh!

ben-kaufman commented Aug 6, 2026

Uh oh!

ben-kaufman commented Aug 6, 2026

Uh oh!

ovitrif left a comment

Uh oh!

ovitrif left a comment •

edited

Loading

Uh oh!

dzdidi left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

ben-kaufman commented Aug 4, 2026

Summary

Contract and risk impact

Verification

Documentation

Checklist

Uh oh!

ovitrif left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

ben-kaufman commented Aug 6, 2026

Uh oh!

ben-kaufman commented Aug 6, 2026

Uh oh!

ovitrif left a comment

Choose a reason for hiding this comment

Uh oh!

ovitrif left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dzdidi left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

ovitrif left a comment •

edited

Loading