Packages

@paramira/web-session

Browser sessions signed in with the Paramira phone app: a session key and the phone's delegation, never the identity key; ends on sign-out, expiry or revocation.

License: AGPL-3.0-or-later

Source: packages/web-session

What it does

Browser sessions signed in with the Paramira phone app (docs/plans/app-roles.md Phase 4). The browser makes a session key and shows a QR code; the phone answers with a delegation to that key (from @paramira/identity) and the family and community keys the app needs. The identity's own key never reaches the browser.

Used by

Apps: abantu, isoko-web, iwacu-nuxt

Uses

trust-graph

A local peer trust ledger — score peers in [0,1] by direct connection, relay/intermediary reliability, and transitive endorsement. No dependencies, no networking, no assumption about what a 'peer' or 'relay' means in your app.

webauthn-lock

Keeps a secret on the device locked behind a platform authenticator (Touch ID, Windows Hello, a hardware key) with WebAuthn's PRF extension; the authenticator never sees the secret.