99ede5792e11c2f0a4f1f671879eb296e7b89e54
- resolveNostrPubkey() now returns { pubkey, rejected } instead of string|null
so invalid/expired tokens return 401 instead of silently falling to anonymous
- POST /sessions and POST /jobs: return 401 if nostr_token header/body is
present but invalid or expired
- POST /identity/verify: now accepts optional top-level 'pubkey' field alongside
'event'; asserts pubkey matches event.pubkey if both are provided — aligns
API contract with { pubkey, event } spec shape and hardens against mismatch
Description
Timmy Tower World — sovereign AI agent economy
Languages
TypeScript
68.9%
JavaScript
15.5%
Shell
10.6%
HTML
4.5%
CSS
0.4%