From 1b671bf4075735ff8430e1ea24d561fb91f542f5 Mon Sep 17 00:00:00 2001 From: Padreug Date: Sun, 6 Sep 2026 19:24:15 +0200 Subject: [PATCH 1/3] build(machine): add a web-only build:web target MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The machine app's `build` script runs vue-tsc, the Vite build, two electron tsc passes and an esbuild bundle. Serving the kiosk as a plain SPA needs only the middle one, and the electron passes drag in native-addon typings that a web build has no use for. Add `build:web` (just `vite build`) with a turbo task that still builds the workspace packages first via `dependsOn: ["^build"]`, so a consumer can run `pnpm build:web` at the repo root and get `apps/machine/dist`. `env: ["VITE_*"]` is declared on the task because the Vite vars are baked into the bundle at build time — without it turbo would happily serve a cached build produced under different env. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_013A6683cCHnQxFUosx1krY4 --- apps/machine/package.json | 1 + package.json | 1 + turbo.json | 5 +++++ 3 files changed, 7 insertions(+) diff --git a/apps/machine/package.json b/apps/machine/package.json index 7f68db8..cefc699 100644 --- a/apps/machine/package.json +++ b/apps/machine/package.json @@ -15,6 +15,7 @@ "dev:vite": "vite", "electron:dev": "tsc -p electron/tsconfig.json && tsc -p electron/tsconfig.preload.json && electron dist-electron/main.js", "build": "vue-tsc --noEmit && vite build && tsc -p electron/tsconfig.json && tsc -p electron/tsconfig.preload.json && npx esbuild electron/fund-atm.ts --bundle --platform=node --format=cjs --external:better-sqlite3 --outfile=dist-electron/fund-atm.bundle.cjs", + "build:web": "vite build", "build:electron": "pnpm build && electron-builder", "preview": "vite preview", "typecheck": "vue-tsc --noEmit", diff --git a/package.json b/package.json index 1cf98b1..6499319 100644 --- a/package.json +++ b/package.json @@ -7,6 +7,7 @@ "scripts": { "dev": "turbo dev", "build": "turbo build", + "build:web": "turbo build:web", "test": "turbo test", "lint": "turbo lint", "format": "prettier --write .", diff --git a/turbo.json b/turbo.json index d6d2fb5..a5a9376 100644 --- a/turbo.json +++ b/turbo.json @@ -5,6 +5,11 @@ "dependsOn": ["^build"], "outputs": ["dist/**", ".next/**", "!.next/cache/**"] }, + "build:web": { + "dependsOn": ["^build"], + "outputs": ["dist/**"], + "env": ["VITE_*"] + }, "dev": { "cache": false, "persistent": true From ac40ea9bb6e6244934990e4f941a74d0f0dd17e3 Mon Sep 17 00:00:00 2001 From: Padreug Date: Sun, 6 Sep 2026 19:24:15 +0200 Subject: [PATCH 2/3] feat(lnbits): wrap the create_wallet RPC MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The transport has exposed `create_wallet` (AUTH_ACCOUNT) since the RPC registry was written, but LnbitsClient never wrapped it — the ATM only ever needed the auto-created default wallet from `list_wallets`. Add `createWallet(name)` plus its `CreatedWallet` reply type. Account-scoped, so the envelope deliberately carries no `wallet_id`: that absence is what makes the server resolve auth to the Account rather than a Wallet. Not wrapped in `idempotent()` — a retry would mint a duplicate wallet, same reasoning as create_invoice. The reply carries the new wallet's adminkey/inkey, hence the type-level note not to log it verbatim. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_013A6683cCHnQxFUosx1krY4 --- packages/lnbits/src/client.ts | 12 ++++++++++++ packages/lnbits/src/index.ts | 1 + packages/lnbits/src/types.ts | 9 +++++++++ 3 files changed, 22 insertions(+) diff --git a/packages/lnbits/src/client.ts b/packages/lnbits/src/client.ts index cb3645d..ad212a8 100644 --- a/packages/lnbits/src/client.ts +++ b/packages/lnbits/src/client.ts @@ -37,6 +37,7 @@ import type { CreateInvoiceBody, PayInvoiceBody, WalletInfo, + CreatedWallet, MachineConfigResponse, SubscribePaymentsBody, SubscribeAck, @@ -211,6 +212,17 @@ export class LnbitsClient { return data ?? [] } + /** + * Create an additional wallet on the calling account (`create_wallet`). + * + * Account-scoped (AUTH_ACCOUNT): the envelope carries no `wallet_id`, which + * is what makes the server resolve auth to the Account rather than a Wallet. + * NOT wrapped in `idempotent()` — a retry would mint a duplicate wallet. + */ + async createWallet(name: string): Promise { + return this.sendRpc('create_wallet', { body: { name } }) + } + /** Pull server-delivered machine config (operator pubkey + fee config) over * the authenticated transport — spirekeeper's `get_machine_config` RPC * (bitspire#70 P1). Lets a seed-only ATM configure itself with no per-machine diff --git a/packages/lnbits/src/index.ts b/packages/lnbits/src/index.ts index 9618a2f..e1e87c1 100644 --- a/packages/lnbits/src/index.ts +++ b/packages/lnbits/src/index.ts @@ -66,6 +66,7 @@ export type { CreateInvoiceBody, PayInvoiceBody, WalletInfo, + CreatedWallet, SubscribePaymentsBody, SubscribeAck, SubscribePush, diff --git a/packages/lnbits/src/types.ts b/packages/lnbits/src/types.ts index dd5e7a9..fdebb95 100644 --- a/packages/lnbits/src/types.ts +++ b/packages/lnbits/src/types.ts @@ -112,6 +112,15 @@ export interface WalletInfo { balance: number } +/** Reply shape of the `create_wallet` RPC — unlike WalletInfo it carries the + * fresh wallet's keys, so never log it verbatim. */ +export interface CreatedWallet { + id: string + name: string + adminkey: string + inkey: string +} + // ============================================================================ // Subscriptions // ============================================================================ From 8264dd7472886efb05069c30fc2335457016b2a8 Mon Sep 17 00:00:00 2001 From: Padreug Date: Sun, 6 Sep 2026 19:24:15 +0200 Subject: [PATCH 3/3] feat(machine): VITE_DEMO_TAG for the public web demo MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The browser path (no electronAPI) is already a first-class code path: initializeWithLightning() resolves an EPHEMERAL LocalSigner, allows mock fallback and leaves debugMode on, so the bill simulator stands in for the validator. That is what makes a hosted kiosk demo possible at all. Two things still needed fixing for it. 1. Cursor. `cursor: none` was applied globally for the touchscreen, which in an ordinary browser reads as a broken page. Scope it to `.kiosk`, set on by main.ts unless VITE_DEMO_TAG is present — so every real machine keeps today's behavior and only the demo build shows a pointer. 2. Cleanup. An ephemeral identity per page load is the right call (it isolates concurrent visitors, and each fresh account gets its own auto-credit under LNBITS_DEMO_MODE, whereas a single baked-in key would be credited once and then drain). The cost is a throwaway LNbits account per visit, and nothing in an auto-created row distinguishes one: pubkey-set/prvkey-NULL equally describes a real ATM. A nostr pubkey can't carry a marker — grinding a vanity prefix is far too slow to do on page load — and the account/wallet the server auto-creates isn't nameable by the client. So when VITE_DEMO_TAG is set the ATM mints one extra, never-used wallet whose NAME is the tag, turning the sweep into an exact string match instead of a heuristic about what looks disposable. Both are inert on a real machine: the var is unset outside the demo build. The marker call is fire-and-forget — losing it degrades cleanup, not the demo. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_013A6683cCHnQxFUosx1krY4 --- apps/machine/.env.example | 12 ++++++++++++ apps/machine/src/main.ts | 7 +++++++ apps/machine/src/services/lightning.ts | 25 +++++++++++++++++++++++++ apps/machine/src/style.css | 11 +++++++---- 4 files changed, 51 insertions(+), 4 deletions(-) diff --git a/apps/machine/.env.example b/apps/machine/.env.example index 66541dc..ec66f81 100644 --- a/apps/machine/.env.example +++ b/apps/machine/.env.example @@ -73,6 +73,18 @@ VITE_SPIRE_SEED= # Show "Under Service" screen and block all transactions # VITE_MAINTENANCE_MODE=true +# ============================================================================= +# Public Web Demo +# ============================================================================= + +# Set ONLY for the browser demo build (atm.demo.aiolabs.dev). Leave blank on +# every real machine. When set it: +# - keeps the mouse cursor visible (kiosk builds hide it) +# - mints one extra, never-used LNbits wallet named with this exact string, +# so the throwaway accounts the demo creates (one per page load, each with +# its own ephemeral identity) can be swept by name instead of guessed at. +# VITE_DEMO_TAG=bitspire-web-demo + # ============================================================================= # Mock Fallback (Production Safety) # ============================================================================= diff --git a/apps/machine/src/main.ts b/apps/machine/src/main.ts index 5f39e0a..8679c87 100644 --- a/apps/machine/src/main.ts +++ b/apps/machine/src/main.ts @@ -24,6 +24,13 @@ const router = createRouter({ ], }) +// Kiosk chrome (hidden cursor) is the default — every real machine is a +// touchscreen. The public web demo (VITE_DEMO_TAG) runs in a normal browser, +// where an invisible pointer just reads as broken. +if (!import.meta.env.VITE_DEMO_TAG) { + document.documentElement.classList.add('kiosk') +} + // Create Pinia store const pinia = createPinia() diff --git a/apps/machine/src/services/lightning.ts b/apps/machine/src/services/lightning.ts index eb2e1c7..aa6b52c 100644 --- a/apps/machine/src/services/lightning.ts +++ b/apps/machine/src/services/lightning.ts @@ -505,6 +505,31 @@ export async function initializeLightningServices(options?: { } console.log('[Lightning] LNbits wallet:', lnbitsWalletId) + // ── Public web demo: stamp the throwaway account so it can be swept ────── + // The browser demo (atm.demo.aiolabs.dev) runs with an EPHEMERAL identity — + // a fresh keypair per page load — so LNbits mints a new account + a fresh + // auto-credited wallet for every visitor. That isolation is the point (a + // single baked-in key would be credited exactly once and then drain), but it + // leaves throwaway accounts behind, and nothing in an auto-created row says + // "demo": pubkey-set/prvkey-NULL also describes a real ATM. + // + // A nostr pubkey can't carry a marker (you'd have to grind a vanity prefix, + // far too slow to do on page load), and the account/wallet the server + // auto-creates isn't nameable by the client. So we mint one extra, + // never-used wallet whose NAME is the tag: sweeping is then an exact string + // match on wallet name rather than a heuristic about what looks disposable. + // + // Unset on every real machine, so this is inert outside the demo build. The + // call is fire-and-forget: losing the marker degrades cleanup, not the demo. + const demoTag = (import.meta.env.VITE_DEMO_TAG as string | undefined)?.trim() + if (demoTag) { + void lnbits + .createWallet(demoTag) + // Never log the reply — create_wallet returns adminkey/inkey. + .then(() => console.log('[Lightning] Demo marker wallet created:', demoTag)) + .catch((e) => console.warn('[Lightning] Demo marker wallet failed:', e)) + } + // #70 P1: pull operator pubkey + fee config from LNbits over the authenticated // transport (spirekeeper#41 `get_machine_config`). A seed-only machine has no // VITE_OPERATOR_PUBKEYS, so without this it can't trust its fee config and sits diff --git a/apps/machine/src/style.css b/apps/machine/src/style.css index 621cf82..288f0dc 100644 --- a/apps/machine/src/style.css +++ b/apps/machine/src/style.css @@ -1,10 +1,13 @@ @import 'tailwindcss'; @import 'tw-animate-css'; -/* Hide cursor completely on touchscreen kiosk */ -*, -*::before, -*::after { +/* Hide cursor completely on touchscreen kiosk. + Scoped to .kiosk (set on by main.ts) so the public web demo, which + runs in an ordinary browser with a mouse, keeps a visible pointer. */ +.kiosk, +.kiosk *, +.kiosk *::before, +.kiosk *::after { cursor: none !important; }