Files
hanzo.ai/pnpm-workspace.yaml
zeekay ac2da21e5f sign-in: wallet and phone, and a person claims a wallet's account
/login and /signup draw "Continue with wallet" and "Continue with phone"
after Google and GitHub, each only where IAM's methods say it is on.

Wallet: where IAM signs a wallet in (@hanzo/iam 0.21.37 `wallet`) and the
browser injects an EIP-1193 wallet; the press is loginWithWallet (IAM's
challenge, personal_sign of its EIP-4361 text, IAM's verify) and ends as a
password's sign-in ends. A wallet IAM has not seen is made an account in an
org of its own, with no email.

Phone: where IAM says it sends codes (`code`) and has answered. The number
is read in its country with the SMS consent ticked, then IAM's code flow.
IAM's address lookup answers an email address only, so a number is texted as
any is and the account that holds it is signed in by the code.

Settings -> General -> Sign in another way adds an email or a phone to the
signed-in account through IAM's own proof (addAddress, PUT /v1/iam/address),
drawn only where IAM's methods say `address`. Same account, org, keys and
balance; nothing is created, so nothing earns twice.

Gates: wallet.spec (a throwaway secp256k1 key behind an injected provider),
phone.spec, address.spec. login.spec expects the phone after the providers.
2026-10-26 16:47:32 -07:00

71 lines
2.7 KiB
YAML

# What may run its own install script. pnpm 11 renamed this from
# onlyBuiltDependencies and asks about each package once; a placeholder here is
# an install that stops to ask.
allowBuilds:
esbuild: true
sharp: true
unrs-resolver: true
# One version of a package in the tree, whatever asked for it. Two copies of a
# React runtime are two contexts, and a component then looks for the one it was
# not rendered under.
overrides:
# Gui, and only one of it. Two copies are two configurations, and the one a
# component is rendered under is not the one it then looks in. The catalog
# below decides which version; this decides there is a single one.
'@hanzo/gui': 8.3.5
# UI, and only one of it: rooms and build each ask for it, and two copies are
# two Consent stores and two sets of component registrations.
'@hanzo/ui': 8.29.24
# Event, and only one of it, because each copy carries its own ORG_KEY
# keyring. 0.3.39 and 0.3.40 hold keys that resolve to no project — the
# endpoint answers 403 ingest_key_unknown — so a second copy is a dead key in
# the bundle whatever the app itself declares. @hanzo/observe depends on
# 0.3.39 exactly, which the catalog alone cannot move.
'@hanzo/event': 0.3.63
# Design, and only one of it: @hanzo/ui and @hanzo/appearance pin 0.5.24
# exactly, and a second copy is a second set of tokens and base defaults.
'@hanzo/design': 0.5.35
# IAM, and only one of it: @hanzo/build pins 0.21.28 exactly, and the sign-in
# pages tell a held sign-in by its class (SecondFactor, EmailRequired,
# Refused), so a second copy is a second class no instanceof matches.
'@hanzo/iam': 0.21.37
'@react-native/normalize-colors': 0.87.1
react-is: 19.2.8
# Latest of everything, first-party or not: the age gate would hold this app
# behind its own release train, which publishes hours before it is consumed.
minimumReleaseAge: 0
catalog:
'@hanzo/ai': 0.6.24
'@hanzo/appearance': 0.2.12
'@hanzo/brand': 1.4.8
'@hanzo/build': https://registry.npmjs.org/@hanzo/build/-/build-0.2.85.tgz
'@hanzo/composer': 0.2.0
'@hanzo/design': 0.5.35
'@hanzo/event': 0.3.63
'@hanzo/pay': 0.1.2
'@hanzogui/next-theme': 8.3.5
'@hanzo/gui': 8.3.5
'@hanzo/i18n': 0.5.3
'@hanzo/iam': 0.21.37
'@hanzo/logo': 1.0.26
'@hanzo/observe': 0.1.11
'@hanzo/plans': 1.8.15
'@hanzo/ui': 8.29.24
'@hanzo/app': https://registry.npmjs.org/@hanzo/app/-/app-0.2.46.tgz
'@hanzo/glass': 0.1.0
'@hanzo/mod': 0.1.0
'@hanzo/tabs': github:hanzo-inc/tabs
'@hanzo/studio': 0.1.8
'@hanzo/tokens': 1.1.0
'@hanzo/usage': 0.1.18
'@hanzo/voice': 0.1.19
'@types/node': 26.5.0
'@types/react': 19.2.18
'@types/react-dom': 19.2.7
next: 16.3.4
'react': 19.2.8
'react-dom': 19.2.8
'typescript': 7.0.2