Changeset 4a08bfc in Klonkt

Timestamp:

07/21/2026 12:26:02 AM (7 weeks ago)

Author:

Robin <roboburr@…>

Branches:

main

Children:

61e3daf

Parents:

562e1b0

git-author:

Robin <roboburr@…> (07/21/2026 12:26:01 AM)

git-committer:

Robin <roboburr@…> (07/21/2026 12:26:02 AM)

Message:

Docs: paid-posts design (slice 0 spike)

The build reference for the paid-posts feature (klonkt-demo-aki),
grounded in verified facts: Patreon API v2 (authorize/token endpoints,
identity?include=memberships.campaign for the patron path, creator
token direct on client registration, patron_status +
currently_entitled_amount_cents, rate limits), the WebAuthn dependency
(@simplewebauthn/server 13.3.2, MIT, node>=20, attestation none), the
cookie-less trick (HMAC-signed short-lived blob reused for both the
OAuth state and the WebAuthn challenge, so no session is needed), the
additive data model (paid_patreon per owner, paid_entitlements per
passkey with no patron identity, posts.paid + paid_min_cents), the new
aes-256-gcm helper for the creator token, the three flows and the
federation teaser rule. Confirms the design keeps the privacy
statement's promises. Slices 1 to 5 filed under the epic.

New file:
docs/paid-posts-design.md

-robo
Co-Authored-By: Claude Opus 4.8 <noreply@…>

File:

• docs/paid-posts-design.md (added)