The dev SPA-fallback plugin used `!req.url.includes('.')` to skip asset
requests, which also matched JWT-shaped `?token=hdr.body.sig` query
strings — so `localhost:5185/?token=...` fell through to the hub
`index.html` instead of `market.html`, breaking the hub→standalone
auth-relay link. Strip the query before the extension check.
Applied to all 7 standalone vite configs.
The nostrmarket LNbits extension was refactored to NIP-17 messaging
(refactor/nip17-messaging branch, PR #2). Customers must send orders
as kind 1059 gift wraps so the merchant's _handle_gift_wrap() handler
can process them; kind 4 NIP-04 events are now ignored by the backend.
Changes:
- nostrmarketService.publishOrder(): replace nip04.encrypt + finalizeEvent
(kind 4) with nip59.wrapEvent producing kind 1059. The order JSON sits
in an unsigned kind 14 rumor, sealed (kind 13) with the customer's key,
wrapped (kind 1059) with an ephemeral key.
- useMarket.handleOrderDM(): unwrap incoming kind 1059 via nip59.unwrapEvent
instead of nip04.decrypt. Read sender pubkey from rumor.pubkey (the gift
wrap's pubkey is ephemeral).
- useMarket.registerMarketMessageHandler(): bypass chat-service and
subscribe directly to {kinds: [1059], '#p': [userPubkey]}. The chat
service still uses NIP-04 - when it migrates to NIP-17 it can take
over routing again via setMarketMessageHandler.
nostr-tools v2.10.4 (already a dep) provides the NIP-44/NIP-59 APIs.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
