Vendor nfc server

Author: tupui

.github/dependabot.yml

@@ -19,15 +19,6 @@ updates:
         update-types:
           - minor
           - patch
-  - package-ecosystem: "bun"
-    directory: "/nfc-server"
-    schedule:
-      interval: "monthly"
-    groups:
-      npm-minor:
-        update-types:
-          - minor
-          - patch
   - package-ecosystem: "cargo"
     directory: "/"
     schedule:

README.md

@@ -27,9 +27,15 @@ under a chip's public key and pays them out only to the current NFT owner.
 | [`contracts/collection/`](contracts/collection) | Factory that deploys NFC-NFT contracts and indexes ownership across them.           |
 | [`contracts/prize/`](contracts/prize)           | Reference downstream application: per-chip token vault redeemable by the NFT owner. |
 | [`dapp/`](dapp)                                 | TypeScript desktop administration interface (Vite + React + Stellar SDK).           |
-| [`nfc-server/`](nfc-server)                     | Node.js PC/SC bridge between the dApp and a USB NFC reader.                         |
 | [`Makefile`](Makefile)                          | Build, test, deploy targets.                                                        |
 
+The NFC hardware bridge lives in **[chimpdao-nfc-bridge](https://radicle.network/nodes/radicle.consulting-manao.com/rad%3Az2CDTfvUguLG3UboK46HyYxoxg1og)**; the merchant POS in **[chimpdao-terminal](https://radicle.network/nodes/radicle.consulting-manao.com/rad%3Az4Y793TkQB4X4Uz4CRdEMUHxakZKt)** (Radicle repos under consulting-manao).
+
+```bash
+git clone https://radicle.consulting-manao.com/z2CDTfvUguLG3UboK46HyYxoxg1og.git chimpdao-nfc-bridge
+git clone https://radicle.consulting-manao.com/z4Y793TkQB4X4Uz4CRdEMUHxakZKt.git chimpdao-terminal
+```
+
 The full chip-integration guide is in [`README_NFC.md`](README_NFC.md). The
 mobile tap-to-claim flow lives in a companion iOS application.
 

README_NFC.md

@@ -1,119 +1,74 @@
 # NFC Chip Integration Guide
 
-Complete guide for using Infineon SECORA Blockchain NFC chips with the Stellar dapp and the XRPL POC to mint/claim/transfer NFTs or sign XRPL testnet transactions from a physical chip.
+Complete guide for using Infineon SECORA Blockchain NFC chips with the Stellar dapp. Mint, claim, and transfer NFTs with hardware-secured signatures.
 
-## Overview
+## Related repositories
 
-This application integrates Infineon NFC chips for desktop crypto operations:
+| Repo | Radicle | Purpose |
+|------|---------|---------|
+| **chimpdao-nfc-bridge** | [z2CDTfv…](https://radicle.network/nodes/radicle.consulting-manao.com/rad%3Az2CDTfvUguLG3UboK46HyYxoxg1og) | Node.js PC/SC WebSocket bridge + `@chimpdao/nfc-client` |
+| **chimpdao-terminal** | [z4Y793T…](https://radicle.network/nodes/radicle.consulting-manao.com/rad%3Az4Y793TkQB4X4Uz4CRdEMUHxakZKt) | Merchant tap-to-pay (XRPL + Stellar UI) |
+| **chimpdao-contracts** | this repo | Soroban contracts + admin dapp |
 
-- **Desktop**: USB NFC reader (uTrust 4701F) via a Node.js WebSocket server
-- **Chains**: Stellar Soroban (SEP-53 contract auth) + XRPL testnet (single-sign chip demo)
-- **Security**: Hardware-secured ECDSA signatures over secp256k1
+```bash
+git clone https://radicle.consulting-manao.com/z2CDTfvUguLG3UboK46HyYxoxg1og.git chimpdao-nfc-bridge
+```
 
 ## Prerequisites
 
-- **Hardware**: Infineon SECORA Blockchain NFC chip + uTrust 4701F reader (Desktop)
-- **Software**: Node.js >= 22 for the NFC server; Bun for the dapp/XRPL script
-- **Wallet**: Freighter or compatible Stellar wallet (Stellar only)
+- **Hardware**: Infineon SECORA chip + Identiv/uTrust USB reader
+- **Software**: Node.js ≥ 22 for the bridge; Bun for the dapp
+- **Wallet**: Freighter or compatible Stellar wallet
 
 ## Running
 
 ```bash
-# Terminal 1: NFC Server (must run with Node, not Bun)
-cd nfc-server
-node index.js
+# Terminal 1: NFC bridge (Node only — not Bun)
+cd chimpdao-nfc-bridge
+npm install && npm start
 
-# Terminal 2: Stellar dev server
+# Terminal 2: Stellar dapp
 cd dapp
-bun run dev
+bun install && bun run dev
 
-# Or start everything together:
+# Or from dapp (bridge must be cloned as sibling):
 bun run dev:with-nfc
 ```
 
-### Chi//mp POS (XRPL tap-to-pay)
-
-Standalone POS UI at [`pos/`](pos/): amount → tap chip → chip-signed XRPL Payment.
+If the chip was already on the reader when the bridge started, **lift and retap**.
 
-```bash
-# Terminal 1: NFC server
-cd nfc-server && node index.js
+## Architecture
 
-# Terminal 2: POS
-cd pos && bun install && bun run dev
-# → http://localhost:5174
 ```
-
-Wallet tab: create/fund merchant + fund chip (testnet faucet). Pay tab never auto-funds.
-
-### XRPL one-shot script
-
-```bash
-cd dapp
-bun run xrpl-nfc-sign
+Browser ← WebSocket → chimpdao-nfc-bridge ← nfc-pcsc → USB Reader ← NFC → Chip
 ```
 
-(Script lives at `nfc-server/scripts/xrpl-nfc-sign.ts`.)
-
-## How It Works
-
-### Architecture
+Protocol: `status` | `read-pubkey` | `sign` | `read-ndef` | `write-ndef` | `generate-key` | `fetch-key`
 
-```
-Browser ← WebSocket → NFC Server ← nfc-pcsc → USB Reader ← NFC → Chip
-        ↑
-        └── XRPL script
-```
-
-The NFC server is a small `nfc-pcsc` bridge over WebSocket. It exposes APDU operations (`read-pubkey`, `sign`, `read-ndef`, `write-ndef`, `generate-key`, `fetch-key`) and is used by both the Stellar dapp and the XRPL POC.
+Full spec: [chimpdao-nfc-bridge/docs/PROTOCOL.md](https://radicle.consulting-manao.com/z2CDTfvUguLG3UboK46HyYxoxg1og.git) (clone the bridge repo).
 
 ### Stellar flow
 
-1. **Read chip**: get the 65-byte secp256k1 public key
-2. **Fetch nonce**: current chip nonce for SEP-53 expiry
-3. **Create message**: build SEP-53 auth message (`network_hash + contract_id + function_name + args + nonce`)
-4. **Hash**: SHA-256 hash of the message
-5. **Sign**: chip signs the 32-byte hash
-6. **Detect recovery ID**: client-side (`@noble/secp256k1`) recovers the recovery ID from the signature
-7. **Contract call**: send message + `r||s` signature + recovery ID to the Soroban contract
-8. **Verify**: contract hashes the message and recovers the public key via `secp256k1_recover`
-
-### XRPL flow
-
-1. **Read chip**: get the 65-byte public key
-2. **Compress**: 65-byte SEC1 → 33-byte compressed pubkey
-3. **Derive address**: `encodeAccountID(RIPEMD160(SHA256(compressed)))`
-4. **Fund chip**: faucet wallet sends testnet XRP to the chip address
-5. **Build Payment**: chip address as sender, `SigningPubKey` set
-6. **Hash**: `encodeForSigning` + SHA-512Half (first 32 bytes of SHA-512)
-7. **Sign**: chip signs the 32-byte hash
-8. **Re-DER**: raw 64-byte `r||s` → DER → `TxnSignature`
-9. **Submit**: `encode(...)` + `submitAndWait`
-
-## Technical Details
+1. Read chip public key (65-byte SEC1)
+2. Fetch nonce for SEP-53
+3. Build SEP-53 auth message
+4. Hash with SHA-256
+5. Chip signs the 32-byte digest
+6. Client recovers recovery ID (`@noble/secp256k1`)
+7. Submit to Soroban contract with `r||s` + recovery ID
 
-### Signature format
-
-- **From chip**: DER-encoded ECDSA signature
-- **From server**: `r` (32 bytes) + `s` (32 bytes) as hex strings, low-S normalized
-- **Stellar consumer**: client recomputes recovery ID; signature is `r||s` + recovery ID
-- **XRPL consumer**: `r||s` is re-encoded into DER for `TxnSignature`
-
-### blocksec2go diagnostic commands (optional)
-
-These are only used for regenerating contract test signatures, not the server runtime:
+### Merchant terminal (XRPL)
 
 ```bash
-# Get card info
-blocksec2go get_card_info
+git clone https://radicle.consulting-manao.com/z4Y793TkQB4X4Uz4CRdEMUHxakZKt.git chimpdao-terminal
+```
 
-# Get public key (key index 1)
-blocksec2go get_key_info 1
+## Signature format
 
-# Sign 32-byte hash (key index 1)
-blocksec2go generate_signature 1 <32-byte-hex>
-```
+- **From chip**: DER-encoded ECDSA
+- **From bridge**: `r` + `s` as 32-byte hex (low-S)
+- **Stellar dapp**: `formatSignatureForSoroban()` in `dapp/src/util/crypto.ts`
 
-### Regenerating NFC test signatures
+## Regenerating NFC test signatures
 
-To update the 5 test signatures and chip public keys in `contracts/nfc-nft` (e.g. after changing the message hash or rotating chips), follow the one-shot instructions in **[dapp/scripts/REGENERATE_NFC_TEST_SIGS.md](dapp/scripts/REGENERATE_NFC_TEST_SIGS.md)**.
+See [dapp/scripts/REGENERATE_NFC_TEST_SIGS.md](dapp/scripts/REGENERATE_NFC_TEST_SIGS.md).

dapp/bun.lock

@@ -6,19 +6,20 @@
   "scripts": {
     "dev": "bun run start",
     "start": "concurrently --kill-others-on-fail --names stellar,vite -c gray,green --pad-prefix \"stellar scaffold watch --build-clients\" \"vite\"",
-    "nfc-server": "cd ../nfc-server && node index.js",
+    "nfc-server": "cd node_modules/chimpdao-nfc-bridge && npm start",
     "dev:with-nfc": "concurrently --kill-others-on-fail --names nfc,stellar,vite -c blue,gray,green \"bun run nfc-server\" \"stellar scaffold watch --build-clients\" \"vite\"",
+    "postinstall": "node scripts/vendor-nfc-client.js",
     "build": "tsc -b && vite build",
     "install:contracts": "bun install --workspace=packages && bun run build --workspace=packages",
     "preview": "vite preview",
     "lint": "eslint .",
-    "format": "prettier . --write",
-    "xrpl-nfc-sign": "cd ../nfc-server && bun run scripts/xrpl-nfc-sign.ts"
+    "format": "prettier . --write"
   },
   "workspaces": [
     "packages/*"
   ],
   "dependencies": {
+    "chimpdao-nfc-bridge": "git+https://radicle.consulting-manao.com/z2CDTfvUguLG3UboK46HyYxoxg1og.git",
     "@creit.tech/stellar-wallets-kit": "^2.5.0",
     "@noble/secp256k1": "^3.1.0",
     "@stellar/design-system": "^4.0.1",