Replit Agent 99ede5792e fix(#26): tighten token handling and verify API contract
- resolveNostrPubkey() now returns { pubkey, rejected } instead of string|null
  so invalid/expired tokens return 401 instead of silently falling to anonymous
- POST /sessions and POST /jobs: return 401 if nostr_token header/body is
  present but invalid or expired
- POST /identity/verify: now accepts optional top-level 'pubkey' field alongside
  'event'; asserts pubkey matches event.pubkey if both are provided — aligns
  API contract with { pubkey, event } spec shape and hardens against mismatch
2026-03-19 16:15:55 +00:00
2026-03-13 23:21:55 +00:00
2026-03-13 23:21:55 +00:00
2026-03-13 23:21:55 +00:00
2026-03-13 23:21:55 +00:00
Description
Timmy Tower World — sovereign AI agent economy
226 MiB
Languages
TypeScript 68.9%
JavaScript 15.5%
Shell 10.6%
HTML 4.5%
CSS 0.4%