From d631a0043fc049c8c45f9ab16a7c750c64549d8b Mon Sep 17 00:00:00 2001
From: k8ie <k8ie@mcld.eu>
Date: Sun, 8 Mar 2026 21:56:21 +0100
Subject: [PATCH 1/2] Initial vibe-coded rewrite

---
 android/app/src/main/AndroidManifest.xml |   3 +-
 lib/main.dart                            | 456 ++++++++++++++++-------
 pubspec.lock                             | 230 ++++++++----
 pubspec.yaml                             |   9 +-
 4 files changed, 487 insertions(+), 211 deletions(-)

diff --git a/android/app/src/main/AndroidManifest.xml b/android/app/src/main/AndroidManifest.xml
index 5548385..37dee09 100644
--- a/android/app/src/main/AndroidManifest.xml
+++ b/android/app/src/main/AndroidManifest.xml
@@ -29,8 +29,7 @@
                 <action android:name="android.intent.action.VIEW" />
                 <category android:name="android.intent.category.DEFAULT" />
                 <category android:name="android.intent.category.BROWSABLE" />
-                <data android:scheme="quorra+http" />
-                <data android:scheme="quorra+https" />
+                <data android:scheme="lightning" />
             </intent-filter>
         </activity>
         <!-- Don't delete the meta-data below.
diff --git a/lib/main.dart b/lib/main.dart
index 127b703..22d5b36 100644
--- a/lib/main.dart
+++ b/lib/main.dart
@@ -1,38 +1,59 @@
-import 'package:flutter/material.dart';
-import 'package:app_links/app_links.dart';
 import 'dart:convert';
-import 'package:cryptography/cryptography.dart';
+import 'dart:math';
+import 'dart:typed_data';
+
+import 'package:app_links/app_links.dart';
+import 'package:bip32_plus/bip32_plus.dart' as bip32;
+import 'package:convert/convert.dart';
+import 'package:crypto/crypto.dart';
+import 'package:flutter/material.dart';
 import 'package:flutter_secure_storage/flutter_secure_storage.dart';
 import 'package:http/http.dart' as http;
-import 'package:uuid/uuid.dart';
+import 'package:sec/sec.dart';
+import 'package:bitcoin_bech32_ng/bitcoin_bech32_ng.dart';
 
 void main() {
   runApp(const MyApp());
 }
 
 class ConfirmLoginPage extends StatelessWidget {
-  final String message;
-  const ConfirmLoginPage({super.key, required this.message});
+  final String domain;
+  final String action;
+
+  const ConfirmLoginPage({
+    super.key,
+    required this.domain,
+    required this.action,
+  });
 
   @override
   Widget build(BuildContext context) {
+    final actionText = switch (action) {
+      'register' => 'register an account at',
+      'link' => 'link your account at',
+      'auth' => 'authenticate with',
+      _ => 'sign in to',
+    };
+
     return Scaffold(
-      appBar: AppBar(title: const Text("Confirm Login")),
+      appBar: AppBar(title: const Text('Confirm LNURL-auth')),
       body: Padding(
-        padding: const EdgeInsets.all(16.0),
+        padding: const EdgeInsets.all(16),
         child: Column(
           children: [
-            Text("You're about to sign in to $message"),
+            Text("You're about to $actionText $domain"),
             const Spacer(),
             Row(
               mainAxisAlignment: MainAxisAlignment.spaceEvenly,
               children: [
                 ElevatedButton(
-                    onPressed: () => Navigator.pop(context, false),
-                    child: const Text("Cancel")),
+                  onPressed: () => Navigator.pop(context, false),
+                  child: const Text('Cancel'),
+                ),
                 ElevatedButton(
-                    onPressed: () => Navigator.pop(context, true),
-                    child: const Text("Confirm")),
+                  onPressed: () => Navigator.pop(context, true),
+                  child: const Text('Confirm'),
+                ),
               ],
             ),
           ],
@@ -42,208 +63,369 @@ class ConfirmLoginPage extends StatelessWidget {
   }
 }
 
+class LnurlAuthRequest {
+  final Uri callback;
+  final String k1;
+  final String action;
+  final String domain;
+
+  LnurlAuthRequest({
+    required this.callback,
+    required this.k1,
+    required this.action,
+    required this.domain,
+  });
+}
+
+class DerivedLinkingKey {
+  final BigInt privateKey;
+  final Uint8List compressedPublicKey;
+
+  DerivedLinkingKey({
+    required this.privateKey,
+    required this.compressedPublicKey,
+  });
+}
+
 class MyApp extends StatelessWidget {
   const MyApp({super.key});
+
   @override
   Widget build(BuildContext context) {
     return const MaterialApp(
       title: 'Flare',
-      home: MyHomePage(title: 'Quorra Flutter client'),
+      home: MyHomePage(title: 'LNURL-auth client'),
     );
   }
 }
 
 class MyHomePage extends StatefulWidget {
   final String title;
+
   const MyHomePage({super.key, required this.title});
+
   @override
   State<MyHomePage> createState() => _MyHomePageState();
 }
 
 class _MyHomePageState extends State<MyHomePage> {
+  static const _seedStorageKey = 'lnurl_auth_master_seed';
+
   final _secureStorage = const FlutterSecureStorage();
+  final _appLinks = AppLinks();
+  final _secp256k1 = EC.secp256k1;
+  final _codec = Bech32Codec();
+
   String _deepLinkText = 'Waiting for deep link...';
-  String _activationStatus = "Checking...";
-  final AppLinks _appLinks = AppLinks();
-  static const _keyStorageKey = 'ed25519_private_key';
-  var uuid = Uuid();
+  String _seedStatus = 'Checking...';
 
   @override
   void initState() {
     super.initState();
-
-    _checkRegistrationStatus();
-
+    _ensureSeedExists();
     _appLinks.uriLinkStream.listen(_handleUri);
   }
 
-  void _checkRegistrationStatus() async {
-    final existingKey = await _secureStorage.read(key: _keyStorageKey);
+  Future<void> _ensureSeedExists() async {
+    var seedHex = await _secureStorage.read(key: _seedStorageKey);
+
+    if (seedHex == null) {
+      final seed = _secureRandomBytes(32);
+      seedHex = hex.encode(seed);
+      await _secureStorage.write(key: _seedStorageKey, value: seedHex);
+    }
+
+    if (!mounted) return;
     setState(() {
-      _activationStatus = existingKey != null ? 'Device is registered' : 'Device is not registered';
+      _seedStatus = 'LNURL-auth seed is ready';
     });
   }
 
-  Future<String> signMessage(String message, KeyPair keyPair) async {
-    final algorithm = Ed25519();
-    final signature = await algorithm.sign(
-      utf8.encode(message),
-      keyPair: keyPair,
+  Uint8List _secureRandomBytes(int length) {
+    final random = Random.secure();
+    return Uint8List.fromList(
+      List<int>.generate(length, (_) => random.nextInt(256)),
     );
+  }
 
-    return base64Encode(signature.bytes);
+  Future<Uint8List> _getMasterSeed() async {
+    final seedHex = await _secureStorage.read(key: _seedStorageKey);
+    if (seedHex == null) {
+      throw Exception('No seed found');
+    }
+    return Uint8List.fromList(hex.decode(seedHex));
   }
 
-  Future<String> getPublicKeyBase64(SimplePublicKey publicKey) async {
-    return base64.encode(publicKey.bytes);
+  LnurlAuthRequest _parseLnurlAuth(Uri uri) {
+    Uri callback;
+
+    if (uri.queryParameters['tag'] == 'login' && uri.queryParameters['k1'] != null) {
+      callback = uri;
+    } else {
+      throw Exception('Unsupported LNURL-auth link format');
+    }
+
+    final tag = callback.queryParameters['tag'];
+    final k1 = callback.queryParameters['k1'];
+    final action = callback.queryParameters['action'] ?? 'login';
+
+    if (tag != 'login') {
+      throw Exception('Not an LNURL-auth request');
+    }
+
+    if (k1 == null || !RegExp(r'^[0-9a-fA-F]{64}$').hasMatch(k1)) {
+      throw Exception('Invalid or missing k1');
+    }
+
+    if (callback.host.isEmpty) {
+      throw Exception('Missing callback host');
+    }
+
+    return LnurlAuthRequest(
+      callback: callback,
+      k1: k1.toLowerCase(),
+      action: action,
+      domain: callback.host.toLowerCase(),
+    );
   }
 
-  String extractServerAddress(Uri uri) {
-    String scheme = "http";
-    if (uri.scheme == "quorra+https") {
-      scheme = "https";
+  List<int> _lnurlAuthDerivationPath(String domain) {
+    final digest = sha256.convert(utf8.encode(domain)).bytes;
+
+    int toUInt31(List<int> bytes, int offset) {
+      return ((bytes[offset] << 24) |
+      (bytes[offset + 1] << 16) |
+      (bytes[offset + 2] << 8) |
+      bytes[offset + 3]) &
+      0x7fffffff;
     }
-    final address = "$scheme://${uri.host}:${uri.port}";
-    return address;
+
+    return [
+      138,
+      toUInt31(digest, 0),
+      toUInt31(digest, 4),
+      toUInt31(digest, 8),
+      toUInt31(digest, 12),
+    ];
   }
 
-  Future<void> sendRegistrationRequest(Uri uri, SimplePublicKey publicKey) async {
-    final token = uri.queryParameters["t"];
-    final address = extractServerAddress(uri);
-    if (token == null) {
-      _showMessage('No token found in URI');
-      return;
+  Future<DerivedLinkingKey> _deriveLinkingKey(String domain) async {
+    final seed = await _getMasterSeed();
+    bip32.BIP32 node = bip32.BIP32.fromSeed(seed);
+
+    final path = _lnurlAuthDerivationPath(domain);
+    for (final index in path) {
+      node = node.deriveHardened(index);
+    }
+
+    final privateKeyBytes = node.privateKey;
+    if (privateKeyBytes == null || privateKeyBytes.length != 32) {
+      throw Exception('Failed to derive LNURL-auth private key');
     }
 
-    final keyB64 = await getPublicKeyBase64(publicKey);
+    final privateKey = _bytesToBigInt(privateKeyBytes);
+    if (privateKey == BigInt.zero) {
+      throw Exception('Derived invalid private key');
+    }
 
-    final response = await http.post(
-      Uri.parse("$address/mobile/register"),
-      headers: {
-        'Content-Type': 'application/json',
-        'x-registration-token': token,
-      },
-      body: jsonEncode({
-        'pubkey': keyB64,
-        'name': "Flare"
-      }),
+    final compressedPublicKey = _secp256k1.createPublicKey(privateKey, true);
+
+    return DerivedLinkingKey(
+      privateKey: privateKey,
+      compressedPublicKey: compressedPublicKey,
     );
+  }
 
-    if (response.statusCode != 201) {
-      _showMessage(
-          'Registration failed: ${response.statusCode}, ${response.body}');
+  Future<String> _signK1Hex(String k1Hex, BigInt privateKey) async {
+    final message = Uint8List.fromList(hex.decode(k1Hex));
+    if (message.length != 32) {
+      throw Exception('k1 must decode to 32 bytes');
     }
+
+    final signature = _secp256k1.generateSignature(privateKey, message, true);
+    final der = _encodeDerSignature(signature.r, signature.s);
+    return hex.encode(der);
   }
 
-  Future<void> sendIdentifyRequest(Uri uri, String message, String signature) async {
-    final address = extractServerAddress(uri);
-    final session = uri.queryParameters["s"];
+  Uint8List _encodeDerSignature(BigInt r, BigInt s) {
+    final rBytes = _encodeDerInteger(r);
+    final sBytes = _encodeDerInteger(s);
 
-    final response = await http.post(
-      Uri.parse("$address/mobile/aqr/identify?session=$session"),
-      headers: {
-        'Content-Type': 'application/json',
-      },
-      body: jsonEncode({
-        'signature': signature,
-        'message': message
-      }),
-    );
+    final sequence = <int>[
+      0x30,
+      rBytes.length + sBytes.length,
+      ...rBytes,
+      ...sBytes,
+    ];
 
-    if (response.statusCode != 200) {
-      _showMessage(
-          'Request failed: ${response.statusCode}, ${response.body}');
+    return Uint8List.fromList(sequence);
+  }
+
+  List<int> _encodeDerInteger(BigInt value) {
+    if (value < BigInt.zero) {
+      throw Exception('DER integer must be non-negative');
+    }
+
+    var bytes = _bigIntToBytes(value);
+
+    while (bytes.length > 1 && bytes[0] == 0x00 && (bytes[1] & 0x80) == 0) {
+      bytes = bytes.sublist(1);
+    }
+
+    if (bytes.isEmpty) {
+      bytes = [0x00];
+    }
+
+    if ((bytes[0] & 0x80) != 0) {
+      bytes = [0x00, ...bytes];
+    }
+
+    return [
+      0x02,
+      bytes.length,
+      ...bytes,
+    ];
+  }
+
+  BigInt _bytesToBigInt(Uint8List bytes) {
+    return BigInt.parse(hex.encode(bytes), radix: 16);
+  }
+
+  List<int> _bigIntToBytes(BigInt value) {
+    if (value == BigInt.zero) {
+      return [0];
     }
+
+    var hexStr = value.toRadixString(16);
+    if (hexStr.length.isOdd) {
+      hexStr = '0$hexStr';
+    }
+    return hex.decode(hexStr);
   }
 
-  Future<void> sendAuthenticateRequest(Uri uri, String message, String signature, String state) async {
-    final address = extractServerAddress(uri);
-    final session = uri.queryParameters["s"];
+  Future<void> _sendLnurlAuth(LnurlAuthRequest request) async {
+    final linkingKey = await _deriveLinkingKey(request.domain);
+    final sigHex = await _signK1Hex(request.k1, linkingKey.privateKey);
+    final keyHex = hex.encode(linkingKey.compressedPublicKey);
 
-    final response = await http.post(
-      Uri.parse("$address/mobile/aqr/authenticate?session=$session"),
-      headers: {
-        'Content-Type': 'application/json',
+    final callbackUri = request.callback.replace(
+      queryParameters: {
+        ...request.callback.queryParameters,
+        'sig': sigHex,
+        'key': keyHex,
       },
-      body: jsonEncode({
-        'signature': signature,
-        'message': message,
-        'state': state
-      }),
     );
 
+    final response = await http.get(callbackUri);
+
     if (response.statusCode != 200) {
-      _showMessage(
-          'Request failed: ${response.statusCode}, ${response.body}');
+      throw Exception('LNURL-auth failed: ${response.statusCode} ${response.body}');
     }
-  }
 
-  void _handleUri(Uri uri) async {
-    setState(() {
-      _deepLinkText = uri.toString();
-    });
+    final decoded = jsonDecode(response.body);
+    if (decoded is! Map || decoded['status'] != 'OK') {
+      throw Exception('LNURL-auth rejected: ${response.body}');
+    }
+  }
 
-    if (uri.path == '/mobile/register') {
-      final existingKey = await _secureStorage.read(key: _keyStorageKey);
-      if (existingKey != null) {
-        _showMessage('A key already exists. Registration is only allowed once.');
-        return;
-      }
+  String decodeLnurlToUrl(String lnurl) {
+    final bech32Data = bech32.decode(lnurl, lnurl.length);
 
-      final algorithm = Ed25519();
-      final keyPair = await algorithm.newKeyPair();
-      final privateKey = await keyPair.extractPrivateKeyBytes();
-      final publicKey = await keyPair.extractPublicKey();
-      final base64Seed = base64Encode(privateKey);
+    final bytes = _convertBits(bech32Data.data, 5, 8, false);
+    return utf8.decode(bytes);
+  }
 
-      await sendRegistrationRequest(uri, publicKey);
+  Uri decodeLnurlToUri(String lnurl) {
+    final url = decodeLnurlToUrl(lnurl);
+    return Uri.parse(url);
+  }
 
-      await _secureStorage.write(key: _keyStorageKey, value: base64Seed);
+  List<int> _convertBits(
+      List<int> data,
+      int fromBits,
+      int toBits,
+      bool pad,
+      ) {
+    int acc = 0;
+    int bits = 0;
+    final result = <int>[];
+    final maxv = (1 << toBits) - 1;
+    final maxAcc = (1 << (fromBits + toBits - 1)) - 1;
+
+    for (final value in data) {
+      if (value < 0 || (value >> fromBits) != 0) {
+        throw FormatException('Invalid value: $value');
+      }
 
-      setState(() {
-        _activationStatus = 'Device is registered';
-      });
+      acc = ((acc << fromBits) | value) & maxAcc;
+      bits += fromBits;
 
-      _showMessage('Key pair generated and stored!\nPublic key: ${publicKey.bytes}');
+      while (bits >= toBits) {
+        bits -= toBits;
+        result.add((acc >> bits) & maxv);
+      }
     }
-    else if (uri.path == '/mobile/login') {
-      final base64Seed = await _secureStorage.read(key: _keyStorageKey);
-      if (base64Seed == null) {
-        _showMessage('App not activated! Scan an activation code first!');
-        return;
+
+    if (pad) {
+      if (bits > 0) {
+        result.add((acc << (toBits - bits)) & maxv);
+      }
+    } else {
+      if (bits >= fromBits) {
+        throw const FormatException('Excess padding');
+      }
+      if (((acc << (toBits - bits)) & maxv) != 0) {
+        throw const FormatException('Non-zero padding');
       }
-      final seed = base64Decode(base64Seed);
-      final keyPair = await Ed25519().newKeyPairFromSeed(seed);
+    }
+
+    return result;
+  }
 
-      final message = "identify"; // ${uuid.v4()}
-      final signature = await signMessage(message, keyPair);
-      await sendIdentifyRequest(uri, message, signature);
+  Future<void> _handleUri(Uri uri) async {
+    if (!mounted) return;
+    final decoded = decodeLnurlToUrl(uri.path);
+
+    setState(() {
+      _deepLinkText = decoded;
+    });
+
+    try {
+      final request = _parseLnurlAuth(Uri.parse(decoded));
 
       final confirmed = await Navigator.push<bool>(
         context,
         MaterialPageRoute(
-          builder: (_) => ConfirmLoginPage(message: "whatever"),
+          builder: (_) => ConfirmLoginPage(
+            domain: request.domain,
+            action: request.action,
+          ),
         ),
       );
-      if (confirmed == true) {
-        await sendAuthenticateRequest(uri, message, signature, "accepted");
-      } else {
-        await sendAuthenticateRequest(uri, message, signature, "rejected");
+
+      if (confirmed != true) {
+        _showMessage('Login cancelled');
+        return;
       }
+
+      await _sendLnurlAuth(request);
+      _showMessage('LNURL-auth successful for ${request.domain}');
+    } catch (e) {
+      _showMessage('Failed to handle LNURL-auth: $e');
     }
   }
 
   void _showMessage(String message) {
-    showDialog(
+    showDialog<void>(
       context: context,
       builder: (_) => AlertDialog(
         title: const Text('Info'),
         content: Text(message),
         actions: [
           TextButton(
-            child: const Text('OK'),
             onPressed: () => Navigator.of(context).pop(),
-          )
+            child: const Text('OK'),
+          ),
         ],
       ),
     );
@@ -254,14 +436,18 @@ class _MyHomePageState extends State<MyHomePage> {
     return Scaffold(
       appBar: AppBar(title: Text(widget.title)),
       body: Center(
-        child: Column(
-          mainAxisAlignment: MainAxisAlignment.center,
-          children: <Widget>[
-            Text(_activationStatus),
-            Text(_deepLinkText, textAlign: TextAlign.center),
-          ],
+        child: Padding(
+          padding: const EdgeInsets.all(16),
+          child: Column(
+            mainAxisAlignment: MainAxisAlignment.center,
+            children: [
+              Text(_seedStatus),
+              const SizedBox(height: 12),
+              Text(_deepLinkText, textAlign: TextAlign.center),
+            ],
+          ),
         ),
       ),
     );
   }
-}
+}
\ No newline at end of file
diff --git a/pubspec.lock b/pubspec.lock
index ce79e30..3e2f177 100644
--- a/pubspec.lock
+++ b/pubspec.lock
@@ -5,10 +5,10 @@ packages:
     dependency: "direct main"
     description:
       name: app_links
-      sha256: "85ed8fc1d25a76475914fff28cc994653bd900bc2c26e4b57a49e097febb54ba"
+      sha256: "5f88447519add627fe1cbcab4fd1da3d4fed15b9baf29f28b22535c95ecee3e8"
       url: "https://pub.dev"
     source: hosted
-    version: "6.4.0"
+    version: "6.4.1"
   app_links_linux:
     dependency: transitive
     description:
@@ -41,6 +41,22 @@ packages:
       url: "https://pub.dev"
     source: hosted
     version: "2.13.0"
+  bip32_plus:
+    dependency: "direct main"
+    description:
+      name: bip32_plus
+      sha256: e5ff21f3bd2f4fa063db1f851f0d7a736d46d2e81617f0613ab3f6d17b26608e
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.0.0"
+  bitcoin_bech32_ng:
+    dependency: "direct main"
+    description:
+      name: bitcoin_bech32_ng
+      sha256: "729d52d3ee876d0c2d6a1196e4c00819e98cb8944b8c9146404ce8bdb8487f6e"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.3.0"
   boolean_selector:
     dependency: transitive
     description:
@@ -49,6 +65,14 @@ packages:
       url: "https://pub.dev"
     source: hosted
     version: "2.1.2"
+  bs58check:
+    dependency: transitive
+    description:
+      name: bs58check
+      sha256: c4a164d42b25c2f6bc88a8beccb9fc7d01440f3c60ba23663a20a70faf484ea9
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.0.2"
   characters:
     dependency: transitive
     description:
@@ -65,6 +89,14 @@ packages:
       url: "https://pub.dev"
     source: hosted
     version: "1.1.2"
+  code_assets:
+    dependency: transitive
+    description:
+      name: code_assets
+      sha256: "83ccdaa064c980b5596c35dd64a8d3ecc68620174ab9b90b6343b753aa721687"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.0.0"
   collection:
     dependency: transitive
     description:
@@ -73,22 +105,22 @@ packages:
       url: "https://pub.dev"
     source: hosted
     version: "1.19.1"
-  crypto:
-    dependency: transitive
+  convert:
+    dependency: "direct main"
     description:
-      name: crypto
-      sha256: "1e445881f28f22d6140f181e07737b22f1e099a5e1ff94b0af2f9e4a463f4855"
+      name: convert
+      sha256: b30acd5944035672bc15c6b7a8b47d773e41e2f17de064350988c5d02adb1c68
       url: "https://pub.dev"
     source: hosted
-    version: "3.0.6"
-  cryptography:
+    version: "3.1.2"
+  crypto:
     dependency: "direct main"
     description:
-      name: cryptography
-      sha256: d146b76d33d94548cf035233fbc2f4338c1242fa119013bead807d033fc4ae05
+      name: crypto
+      sha256: c8ea0233063ba03258fbcf2ca4d6dadfefe14f02fab57702265467a19f27fadf
       url: "https://pub.dev"
     source: hosted
-    version: "2.7.0"
+    version: "3.0.7"
   cupertino_icons:
     dependency: "direct main"
     description:
@@ -109,18 +141,18 @@ packages:
     dependency: transitive
     description:
       name: ffi
-      sha256: "289279317b4b16eb2bb7e271abccd4bf84ec9bdcbe999e278a94b804f5630418"
+      sha256: "6d7fd89431262d8f3125e81b50d3847a091d846eafcd4fdb88dd06f36d705a45"
       url: "https://pub.dev"
     source: hosted
-    version: "2.1.4"
-  fixnum:
+    version: "2.2.0"
+  file:
     dependency: transitive
     description:
-      name: fixnum
-      sha256: b6dc7065e46c974bc7c5f143080a6764ec7a4be6da1285ececdc37be96de53be
+      name: file
+      sha256: a3b4f84adafef897088c160faf7dfffb7696046cb13ae90b508c2cbc95d3b8d4
       url: "https://pub.dev"
     source: hosted
-    version: "1.1.1"
+    version: "7.0.1"
   flutter:
     dependency: "direct main"
     description: flutter
@@ -138,10 +170,18 @@ packages:
     dependency: "direct main"
     description:
       name: flutter_secure_storage
-      sha256: "9cad52d75ebc511adfae3d447d5d13da15a55a92c9410e50f67335b6d21d16ea"
+      sha256: da922f2aab2d733db7e011a6bcc4a825b844892d4edd6df83ff156b09a9b2e40
+      url: "https://pub.dev"
+    source: hosted
+    version: "10.0.0"
+  flutter_secure_storage_darwin:
+    dependency: transitive
+    description:
+      name: flutter_secure_storage_darwin
+      sha256: "8878c25136a79def1668c75985e8e193d9d7d095453ec28730da0315dc69aee3"
       url: "https://pub.dev"
     source: hosted
-    version: "9.2.4"
+    version: "0.2.0"
   flutter_secure_storage_linux:
     dependency: "direct overridden"
     description:
@@ -151,14 +191,6 @@ packages:
       url: "https://github.com/m-berto/flutter_secure_storage.git"
     source: git
     version: "2.0.1"
-  flutter_secure_storage_macos:
-    dependency: transitive
-    description:
-      name: flutter_secure_storage_macos
-      sha256: "6c0a2795a2d1de26ae202a0d78527d163f4acbb11cde4c75c670f3a0fc064247"
-      url: "https://pub.dev"
-    source: hosted
-    version: "3.1.3"
   flutter_secure_storage_platform_interface:
     dependency: "direct overridden"
     description:
@@ -171,18 +203,18 @@ packages:
     dependency: transitive
     description:
       name: flutter_secure_storage_web
-      sha256: f4ebff989b4f07b2656fb16b47852c0aab9fed9b4ec1c70103368337bc1886a9
+      sha256: "6a1137df62b84b54261dca582c1c09ea72f4f9a4b2fcee21b025964132d5d0c3"
       url: "https://pub.dev"
     source: hosted
-    version: "1.2.1"
+    version: "2.1.0"
   flutter_secure_storage_windows:
     dependency: transitive
     description:
       name: flutter_secure_storage_windows
-      sha256: b20b07cb5ed4ed74fc567b78a72936203f587eba460af1df11281c9326cd3709
+      sha256: "3b7c8e068875dfd46719ff57c90d8c459c87f2302ed6b00ff006b3c9fcad1613"
       url: "https://pub.dev"
     source: hosted
-    version: "3.1.2"
+    version: "4.1.0"
   flutter_test:
     dependency: "direct dev"
     description: flutter
@@ -193,6 +225,14 @@ packages:
     description: flutter
     source: sdk
     version: "0.0.0"
+  glob:
+    dependency: transitive
+    description:
+      name: glob
+      sha256: c3f1ee72c96f8f78935e18aa8cecced9ab132419e8625dc187e1c2408efc20de
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.1.3"
   gtk:
     dependency: transitive
     description:
@@ -201,14 +241,30 @@ packages:
       url: "https://pub.dev"
     source: hosted
     version: "2.1.0"
+  hex:
+    dependency: transitive
+    description:
+      name: hex
+      sha256: "4e7cd54e4b59ba026432a6be2dd9d96e4c5205725194997193bf871703b82c4a"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.2.0"
+  hooks:
+    dependency: transitive
+    description:
+      name: hooks
+      sha256: e79ed1e8e1929bc6ecb6ec85f0cb519c887aa5b423705ded0d0f2d9226def388
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.0.2"
   http:
     dependency: "direct main"
     description:
       name: http
-      sha256: "2c11f3f94c687ee9bad77c171151672986360b2b001d109814ee7140b2cf261b"
+      sha256: "87721a4a50b19c7f1d49001e51409bddc46303966ce89a65af4f4e6004896412"
       url: "https://pub.dev"
     source: hosted
-    version: "1.4.0"
+    version: "1.6.0"
   http_parser:
     dependency: transitive
     description:
@@ -217,14 +273,6 @@ packages:
       url: "https://pub.dev"
     source: hosted
     version: "4.1.2"
-  js:
-    dependency: transitive
-    description:
-      name: js
-      sha256: f2c445dce49627136094980615a031419f7f3eb393237e4ecd97ac15dea343f3
-      url: "https://pub.dev"
-    source: hosted
-    version: "0.6.7"
   leak_tracker:
     dependency: transitive
     description:
@@ -253,10 +301,18 @@ packages:
     dependency: transitive
     description:
       name: lints
-      sha256: a5e2b223cb7c9c8efdc663ef484fdd95bb243bff242ef5b13e26883547fce9a0
+      sha256: "12f842a479589fea194fe5c5a3095abc7be0c1f2ddfa9a0e76aed1dbd26a87df"
       url: "https://pub.dev"
     source: hosted
-    version: "6.0.0"
+    version: "6.1.0"
+  logging:
+    dependency: transitive
+    description:
+      name: logging
+      sha256: c8245ada5f1717ed44271ed1c26b8ce85ca3228fd2ffdb75468ab01979309d61
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.3.0"
   matcher:
     dependency: transitive
     description:
@@ -281,6 +337,22 @@ packages:
       url: "https://pub.dev"
     source: hosted
     version: "1.17.0"
+  native_toolchain_c:
+    dependency: transitive
+    description:
+      name: native_toolchain_c
+      sha256: "92b2ca62c8bd2b8d2f267cdfccf9bfbdb7322f778f8f91b3ce5b5cda23a3899f"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.17.5"
+  objective_c:
+    dependency: transitive
+    description:
+      name: objective_c
+      sha256: "100a1c87616ab6ed41ec263b083c0ef3261ee6cd1dc3b0f35f8ddfa4f996fe52"
+      url: "https://pub.dev"
+    source: hosted
+    version: "9.3.0"
   path:
     dependency: transitive
     description:
@@ -301,18 +373,18 @@ packages:
     dependency: transitive
     description:
       name: path_provider_android
-      sha256: d0d310befe2c8ab9e7f393288ccbb11b60c019c6b5afc21973eeee4dda2b35e9
+      sha256: f2c65e21139ce2c3dad46922be8272bb5963516045659e71bb16e151c93b580e
       url: "https://pub.dev"
     source: hosted
-    version: "2.2.17"
+    version: "2.2.22"
   path_provider_foundation:
     dependency: transitive
     description:
       name: path_provider_foundation
-      sha256: "4843174df4d288f5e29185bd6e72a6fbdf5a4a4602717eed565497429f179942"
+      sha256: "2a376b7d6392d80cd3705782d2caa734ca4727776db0b6ec36ef3f1855197699"
       url: "https://pub.dev"
     source: hosted
-    version: "2.4.1"
+    version: "2.6.0"
   path_provider_linux:
     dependency: transitive
     description:
@@ -353,6 +425,30 @@ packages:
       url: "https://pub.dev"
     source: hosted
     version: "2.1.8"
+  pointycastle:
+    dependency: transitive
+    description:
+      name: pointycastle
+      sha256: "92aa3841d083cc4b0f4709b5c74fd6409a3e6ba833ffc7dc6a8fee096366acf5"
+      url: "https://pub.dev"
+    source: hosted
+    version: "4.0.0"
+  pub_semver:
+    dependency: transitive
+    description:
+      name: pub_semver
+      sha256: "5bfcf68ca79ef689f8990d1160781b4bad40a3bd5e5218ad4076ddb7f4081585"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.2.0"
+  sec:
+    dependency: "direct main"
+    description:
+      name: sec
+      sha256: "52a93800943642e0b5225408d0973a1837e2452b9aa8a501fdfbc8e76b6ac135"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.1.1"
   sky_engine:
     dependency: transitive
     description: flutter
@@ -362,18 +458,10 @@ packages:
     dependency: transitive
     description:
       name: source_span
-      sha256: "254ee5351d6cb365c859e20ee823c3bb479bf4a293c22d17a9f1bf144ce86f7c"
+      sha256: "56a02f1f4cd1a2d96303c0144c93bd6d909eea6bee6bf5a0e0b685edbd4c47ab"
       url: "https://pub.dev"
     source: hosted
-    version: "1.10.1"
-  sprintf:
-    dependency: transitive
-    description:
-      name: sprintf
-      sha256: "1fc9ffe69d4df602376b52949af107d8f5703b77cda567c4d7d86a0693120f23"
-      url: "https://pub.dev"
-    source: hosted
-    version: "7.0.0"
+    version: "1.10.2"
   stack_trace:
     dependency: transitive
     description:
@@ -422,14 +510,6 @@ packages:
       url: "https://pub.dev"
     source: hosted
     version: "1.4.0"
-  uuid:
-    dependency: "direct main"
-    description:
-      name: uuid
-      sha256: a5be9ef6618a7ac1e964353ef476418026db906c4facdedaa299b7a2e71690ff
-      url: "https://pub.dev"
-    source: hosted
-    version: "4.5.1"
   vector_math:
     dependency: transitive
     description:
@@ -442,10 +522,10 @@ packages:
     dependency: transitive
     description:
       name: vm_service
-      sha256: ddfa8d30d89985b96407efce8acbdd124701f96741f2d981ca860662f1c0dc02
+      sha256: "45caa6c5917fa127b5dbcfbd1fa60b14e583afdc08bfc96dda38886ca252eb60"
       url: "https://pub.dev"
     source: hosted
-    version: "15.0.0"
+    version: "15.0.2"
   web:
     dependency: transitive
     description:
@@ -458,10 +538,10 @@ packages:
     dependency: transitive
     description:
       name: win32
-      sha256: "66814138c3562338d05613a6e368ed8cfb237ad6d64a9e9334be3f309acfca03"
+      sha256: d7cb55e04cd34096cd3a79b3330245f54cb96a370a1c27adb3c84b917de8b08e
       url: "https://pub.dev"
     source: hosted
-    version: "5.14.0"
+    version: "5.15.0"
   xdg_directories:
     dependency: transitive
     description:
@@ -470,6 +550,14 @@ packages:
       url: "https://pub.dev"
     source: hosted
     version: "1.1.0"
+  yaml:
+    dependency: transitive
+    description:
+      name: yaml
+      sha256: b9da305ac7c39faa3f030eccd175340f968459dae4af175130b3fc47e40d76ce
+      url: "https://pub.dev"
+    source: hosted
+    version: "3.1.3"
 sdks:
-  dart: ">=3.9.0-0 <4.0.0"
-  flutter: ">=3.27.0"
+  dart: ">=3.10.3 <4.0.0"
+  flutter: ">=3.38.4"
diff --git a/pubspec.yaml b/pubspec.yaml
index 0cbed1d..2b9185c 100644
--- a/pubspec.yaml
+++ b/pubspec.yaml
@@ -31,10 +31,13 @@ dependencies:
   flutter:
     sdk: flutter
   app_links: ^6.4.0
-  cryptography: ^2.7.0
-  flutter_secure_storage: ^9.2.4
+  crypto: ^3.0.7
+  convert: ^3.1.2
+  bip32_plus: ^1.0.0
+  flutter_secure_storage: ^10.0.0
   http: ^1.4.0
-  uuid: ^4.5.0
+  sec: ^1.1.1
+  bitcoin_bech32_ng: ^0.3.0
 
   # The following adds the Cupertino Icons font to your application.
   # Use with the CupertinoIcons class for iOS style icons.

From c52893f3482984d0cb3ee34d814a35bf71905c12 Mon Sep 17 00:00:00 2001
From: k8ie <k8ie@mcld.eu>
Date: Sun, 8 Mar 2026 22:20:37 +0100
Subject: [PATCH 2/2] Split into files

---
 lib/app.dart                        |  15 +
 lib/main.dart                       | 449 +---------------------------
 lib/models/derived_linking_key.dart |  11 +
 lib/models/lnurl_auth_request.dart  |  13 +
 lib/pages/confirmation.dart         |  48 +++
 lib/pages/home.dart                 | 125 ++++++++
 lib/services/auth.dart              | 103 +++++++
 lib/services/lnurl.dart             |  36 +++
 lib/services/seed.dart              |  30 ++
 lib/utils/bech32.dart               |  54 ++++
 lib/utils/crypto.dart               |  66 ++++
 11 files changed, 502 insertions(+), 448 deletions(-)
 create mode 100644 lib/app.dart
 create mode 100644 lib/models/derived_linking_key.dart
 create mode 100644 lib/models/lnurl_auth_request.dart
 create mode 100644 lib/pages/confirmation.dart
 create mode 100644 lib/pages/home.dart
 create mode 100644 lib/services/auth.dart
 create mode 100644 lib/services/lnurl.dart
 create mode 100644 lib/services/seed.dart
 create mode 100644 lib/utils/bech32.dart
 create mode 100644 lib/utils/crypto.dart

diff --git a/lib/app.dart b/lib/app.dart
new file mode 100644
index 0000000..7376952
--- /dev/null
+++ b/lib/app.dart
@@ -0,0 +1,15 @@
+import 'package:flutter/material.dart';
+import 'pages/home.dart';
+
+class MyApp extends StatelessWidget {
+  const MyApp({super.key});
+
+  @override
+  Widget build(BuildContext context) {
+    return const MaterialApp(
+      title: 'Flare',
+      home: MyHomePage(title: 'LNURL-auth client'),
+    );
+  }
+}
+
diff --git a/lib/main.dart b/lib/main.dart
index 22d5b36..b026be0 100644
--- a/lib/main.dart
+++ b/lib/main.dart
@@ -1,453 +1,6 @@
-import 'dart:convert';
-import 'dart:math';
-import 'dart:typed_data';
-
-import 'package:app_links/app_links.dart';
-import 'package:bip32_plus/bip32_plus.dart' as bip32;
-import 'package:convert/convert.dart';
-import 'package:crypto/crypto.dart';
 import 'package:flutter/material.dart';
-import 'package:flutter_secure_storage/flutter_secure_storage.dart';
-import 'package:http/http.dart' as http;
-import 'package:sec/sec.dart';
-import 'package:bitcoin_bech32_ng/bitcoin_bech32_ng.dart';
+import 'app.dart';
 
 void main() {
   runApp(const MyApp());
-}
-
-class ConfirmLoginPage extends StatelessWidget {
-  final String domain;
-  final String action;
-
-  const ConfirmLoginPage({
-    super.key,
-    required this.domain,
-    required this.action,
-  });
-
-  @override
-  Widget build(BuildContext context) {
-    final actionText = switch (action) {
-      'register' => 'register an account at',
-      'link' => 'link your account at',
-      'auth' => 'authenticate with',
-      _ => 'sign in to',
-    };
-
-    return Scaffold(
-      appBar: AppBar(title: const Text('Confirm LNURL-auth')),
-      body: Padding(
-        padding: const EdgeInsets.all(16),
-        child: Column(
-          children: [
-            Text("You're about to $actionText $domain"),
-            const Spacer(),
-            Row(
-              mainAxisAlignment: MainAxisAlignment.spaceEvenly,
-              children: [
-                ElevatedButton(
-                  onPressed: () => Navigator.pop(context, false),
-                  child: const Text('Cancel'),
-                ),
-                ElevatedButton(
-                  onPressed: () => Navigator.pop(context, true),
-                  child: const Text('Confirm'),
-                ),
-              ],
-            ),
-          ],
-        ),
-      ),
-    );
-  }
-}
-
-class LnurlAuthRequest {
-  final Uri callback;
-  final String k1;
-  final String action;
-  final String domain;
-
-  LnurlAuthRequest({
-    required this.callback,
-    required this.k1,
-    required this.action,
-    required this.domain,
-  });
-}
-
-class DerivedLinkingKey {
-  final BigInt privateKey;
-  final Uint8List compressedPublicKey;
-
-  DerivedLinkingKey({
-    required this.privateKey,
-    required this.compressedPublicKey,
-  });
-}
-
-class MyApp extends StatelessWidget {
-  const MyApp({super.key});
-
-  @override
-  Widget build(BuildContext context) {
-    return const MaterialApp(
-      title: 'Flare',
-      home: MyHomePage(title: 'LNURL-auth client'),
-    );
-  }
-}
-
-class MyHomePage extends StatefulWidget {
-  final String title;
-
-  const MyHomePage({super.key, required this.title});
-
-  @override
-  State<MyHomePage> createState() => _MyHomePageState();
-}
-
-class _MyHomePageState extends State<MyHomePage> {
-  static const _seedStorageKey = 'lnurl_auth_master_seed';
-
-  final _secureStorage = const FlutterSecureStorage();
-  final _appLinks = AppLinks();
-  final _secp256k1 = EC.secp256k1;
-  final _codec = Bech32Codec();
-
-  String _deepLinkText = 'Waiting for deep link...';
-  String _seedStatus = 'Checking...';
-
-  @override
-  void initState() {
-    super.initState();
-    _ensureSeedExists();
-    _appLinks.uriLinkStream.listen(_handleUri);
-  }
-
-  Future<void> _ensureSeedExists() async {
-    var seedHex = await _secureStorage.read(key: _seedStorageKey);
-
-    if (seedHex == null) {
-      final seed = _secureRandomBytes(32);
-      seedHex = hex.encode(seed);
-      await _secureStorage.write(key: _seedStorageKey, value: seedHex);
-    }
-
-    if (!mounted) return;
-    setState(() {
-      _seedStatus = 'LNURL-auth seed is ready';
-    });
-  }
-
-  Uint8List _secureRandomBytes(int length) {
-    final random = Random.secure();
-    return Uint8List.fromList(
-      List<int>.generate(length, (_) => random.nextInt(256)),
-    );
-  }
-
-  Future<Uint8List> _getMasterSeed() async {
-    final seedHex = await _secureStorage.read(key: _seedStorageKey);
-    if (seedHex == null) {
-      throw Exception('No seed found');
-    }
-    return Uint8List.fromList(hex.decode(seedHex));
-  }
-
-  LnurlAuthRequest _parseLnurlAuth(Uri uri) {
-    Uri callback;
-
-    if (uri.queryParameters['tag'] == 'login' && uri.queryParameters['k1'] != null) {
-      callback = uri;
-    } else {
-      throw Exception('Unsupported LNURL-auth link format');
-    }
-
-    final tag = callback.queryParameters['tag'];
-    final k1 = callback.queryParameters['k1'];
-    final action = callback.queryParameters['action'] ?? 'login';
-
-    if (tag != 'login') {
-      throw Exception('Not an LNURL-auth request');
-    }
-
-    if (k1 == null || !RegExp(r'^[0-9a-fA-F]{64}$').hasMatch(k1)) {
-      throw Exception('Invalid or missing k1');
-    }
-
-    if (callback.host.isEmpty) {
-      throw Exception('Missing callback host');
-    }
-
-    return LnurlAuthRequest(
-      callback: callback,
-      k1: k1.toLowerCase(),
-      action: action,
-      domain: callback.host.toLowerCase(),
-    );
-  }
-
-  List<int> _lnurlAuthDerivationPath(String domain) {
-    final digest = sha256.convert(utf8.encode(domain)).bytes;
-
-    int toUInt31(List<int> bytes, int offset) {
-      return ((bytes[offset] << 24) |
-      (bytes[offset + 1] << 16) |
-      (bytes[offset + 2] << 8) |
-      bytes[offset + 3]) &
-      0x7fffffff;
-    }
-
-    return [
-      138,
-      toUInt31(digest, 0),
-      toUInt31(digest, 4),
-      toUInt31(digest, 8),
-      toUInt31(digest, 12),
-    ];
-  }
-
-  Future<DerivedLinkingKey> _deriveLinkingKey(String domain) async {
-    final seed = await _getMasterSeed();
-    bip32.BIP32 node = bip32.BIP32.fromSeed(seed);
-
-    final path = _lnurlAuthDerivationPath(domain);
-    for (final index in path) {
-      node = node.deriveHardened(index);
-    }
-
-    final privateKeyBytes = node.privateKey;
-    if (privateKeyBytes == null || privateKeyBytes.length != 32) {
-      throw Exception('Failed to derive LNURL-auth private key');
-    }
-
-    final privateKey = _bytesToBigInt(privateKeyBytes);
-    if (privateKey == BigInt.zero) {
-      throw Exception('Derived invalid private key');
-    }
-
-    final compressedPublicKey = _secp256k1.createPublicKey(privateKey, true);
-
-    return DerivedLinkingKey(
-      privateKey: privateKey,
-      compressedPublicKey: compressedPublicKey,
-    );
-  }
-
-  Future<String> _signK1Hex(String k1Hex, BigInt privateKey) async {
-    final message = Uint8List.fromList(hex.decode(k1Hex));
-    if (message.length != 32) {
-      throw Exception('k1 must decode to 32 bytes');
-    }
-
-    final signature = _secp256k1.generateSignature(privateKey, message, true);
-    final der = _encodeDerSignature(signature.r, signature.s);
-    return hex.encode(der);
-  }
-
-  Uint8List _encodeDerSignature(BigInt r, BigInt s) {
-    final rBytes = _encodeDerInteger(r);
-    final sBytes = _encodeDerInteger(s);
-
-    final sequence = <int>[
-      0x30,
-      rBytes.length + sBytes.length,
-      ...rBytes,
-      ...sBytes,
-    ];
-
-    return Uint8List.fromList(sequence);
-  }
-
-  List<int> _encodeDerInteger(BigInt value) {
-    if (value < BigInt.zero) {
-      throw Exception('DER integer must be non-negative');
-    }
-
-    var bytes = _bigIntToBytes(value);
-
-    while (bytes.length > 1 && bytes[0] == 0x00 && (bytes[1] & 0x80) == 0) {
-      bytes = bytes.sublist(1);
-    }
-
-    if (bytes.isEmpty) {
-      bytes = [0x00];
-    }
-
-    if ((bytes[0] & 0x80) != 0) {
-      bytes = [0x00, ...bytes];
-    }
-
-    return [
-      0x02,
-      bytes.length,
-      ...bytes,
-    ];
-  }
-
-  BigInt _bytesToBigInt(Uint8List bytes) {
-    return BigInt.parse(hex.encode(bytes), radix: 16);
-  }
-
-  List<int> _bigIntToBytes(BigInt value) {
-    if (value == BigInt.zero) {
-      return [0];
-    }
-
-    var hexStr = value.toRadixString(16);
-    if (hexStr.length.isOdd) {
-      hexStr = '0$hexStr';
-    }
-    return hex.decode(hexStr);
-  }
-
-  Future<void> _sendLnurlAuth(LnurlAuthRequest request) async {
-    final linkingKey = await _deriveLinkingKey(request.domain);
-    final sigHex = await _signK1Hex(request.k1, linkingKey.privateKey);
-    final keyHex = hex.encode(linkingKey.compressedPublicKey);
-
-    final callbackUri = request.callback.replace(
-      queryParameters: {
-        ...request.callback.queryParameters,
-        'sig': sigHex,
-        'key': keyHex,
-      },
-    );
-
-    final response = await http.get(callbackUri);
-
-    if (response.statusCode != 200) {
-      throw Exception('LNURL-auth failed: ${response.statusCode} ${response.body}');
-    }
-
-    final decoded = jsonDecode(response.body);
-    if (decoded is! Map || decoded['status'] != 'OK') {
-      throw Exception('LNURL-auth rejected: ${response.body}');
-    }
-  }
-
-  String decodeLnurlToUrl(String lnurl) {
-    final bech32Data = bech32.decode(lnurl, lnurl.length);
-
-    final bytes = _convertBits(bech32Data.data, 5, 8, false);
-    return utf8.decode(bytes);
-  }
-
-  Uri decodeLnurlToUri(String lnurl) {
-    final url = decodeLnurlToUrl(lnurl);
-    return Uri.parse(url);
-  }
-
-  List<int> _convertBits(
-      List<int> data,
-      int fromBits,
-      int toBits,
-      bool pad,
-      ) {
-    int acc = 0;
-    int bits = 0;
-    final result = <int>[];
-    final maxv = (1 << toBits) - 1;
-    final maxAcc = (1 << (fromBits + toBits - 1)) - 1;
-
-    for (final value in data) {
-      if (value < 0 || (value >> fromBits) != 0) {
-        throw FormatException('Invalid value: $value');
-      }
-
-      acc = ((acc << fromBits) | value) & maxAcc;
-      bits += fromBits;
-
-      while (bits >= toBits) {
-        bits -= toBits;
-        result.add((acc >> bits) & maxv);
-      }
-    }
-
-    if (pad) {
-      if (bits > 0) {
-        result.add((acc << (toBits - bits)) & maxv);
-      }
-    } else {
-      if (bits >= fromBits) {
-        throw const FormatException('Excess padding');
-      }
-      if (((acc << (toBits - bits)) & maxv) != 0) {
-        throw const FormatException('Non-zero padding');
-      }
-    }
-
-    return result;
-  }
-
-  Future<void> _handleUri(Uri uri) async {
-    if (!mounted) return;
-    final decoded = decodeLnurlToUrl(uri.path);
-
-    setState(() {
-      _deepLinkText = decoded;
-    });
-
-    try {
-      final request = _parseLnurlAuth(Uri.parse(decoded));
-
-      final confirmed = await Navigator.push<bool>(
-        context,
-        MaterialPageRoute(
-          builder: (_) => ConfirmLoginPage(
-            domain: request.domain,
-            action: request.action,
-          ),
-        ),
-      );
-
-      if (confirmed != true) {
-        _showMessage('Login cancelled');
-        return;
-      }
-
-      await _sendLnurlAuth(request);
-      _showMessage('LNURL-auth successful for ${request.domain}');
-    } catch (e) {
-      _showMessage('Failed to handle LNURL-auth: $e');
-    }
-  }
-
-  void _showMessage(String message) {
-    showDialog<void>(
-      context: context,
-      builder: (_) => AlertDialog(
-        title: const Text('Info'),
-        content: Text(message),
-        actions: [
-          TextButton(
-            onPressed: () => Navigator.of(context).pop(),
-            child: const Text('OK'),
-          ),
-        ],
-      ),
-    );
-  }
-
-  @override
-  Widget build(BuildContext context) {
-    return Scaffold(
-      appBar: AppBar(title: Text(widget.title)),
-      body: Center(
-        child: Padding(
-          padding: const EdgeInsets.all(16),
-          child: Column(
-            mainAxisAlignment: MainAxisAlignment.center,
-            children: [
-              Text(_seedStatus),
-              const SizedBox(height: 12),
-              Text(_deepLinkText, textAlign: TextAlign.center),
-            ],
-          ),
-        ),
-      ),
-    );
-  }
 }
\ No newline at end of file
diff --git a/lib/models/derived_linking_key.dart b/lib/models/derived_linking_key.dart
new file mode 100644
index 0000000..5748afd
--- /dev/null
+++ b/lib/models/derived_linking_key.dart
@@ -0,0 +1,11 @@
+import 'dart:typed_data';
+
+class DerivedLinkingKey {
+  final BigInt privateKey;
+  final Uint8List compressedPublicKey;
+
+  DerivedLinkingKey({
+    required this.privateKey,
+    required this.compressedPublicKey,
+  });
+}
\ No newline at end of file
diff --git a/lib/models/lnurl_auth_request.dart b/lib/models/lnurl_auth_request.dart
new file mode 100644
index 0000000..112489d
--- /dev/null
+++ b/lib/models/lnurl_auth_request.dart
@@ -0,0 +1,13 @@
+class LnurlAuthRequest {
+  final Uri callback;
+  final String k1;
+  final String action;
+  final String domain;
+
+  LnurlAuthRequest({
+    required this.callback,
+    required this.k1,
+    required this.action,
+    required this.domain,
+  });
+}
\ No newline at end of file
diff --git a/lib/pages/confirmation.dart b/lib/pages/confirmation.dart
new file mode 100644
index 0000000..fb96d0b
--- /dev/null
+++ b/lib/pages/confirmation.dart
@@ -0,0 +1,48 @@
+import 'package:flutter/material.dart';
+
+class ConfirmLoginPage extends StatelessWidget {
+  final String domain;
+  final String action;
+
+  const ConfirmLoginPage({
+    super.key,
+    required this.domain,
+    required this.action,
+  });
+
+  @override
+  Widget build(BuildContext context) {
+    final actionText = switch (action) {
+      'register' => 'register an account at',
+      'link' => 'link your account at',
+      'auth' => 'authenticate with',
+      _ => 'sign in to',
+    };
+
+    return Scaffold(
+      appBar: AppBar(title: const Text('Confirm LNURL-auth')),
+      body: Padding(
+        padding: const EdgeInsets.all(16),
+        child: Column(
+          children: [
+            Text("You're about to $actionText $domain"),
+            const Spacer(),
+            Row(
+              mainAxisAlignment: MainAxisAlignment.spaceEvenly,
+              children: [
+                ElevatedButton(
+                  onPressed: () => Navigator.pop(context, false),
+                  child: const Text('Cancel'),
+                ),
+                ElevatedButton(
+                  onPressed: () => Navigator.pop(context, true),
+                  child: const Text('Confirm'),
+                ),
+              ],
+            ),
+          ],
+        ),
+      ),
+    );
+  }
+}
\ No newline at end of file
diff --git a/lib/pages/home.dart b/lib/pages/home.dart
new file mode 100644
index 0000000..e50db67
--- /dev/null
+++ b/lib/pages/home.dart
@@ -0,0 +1,125 @@
+import 'package:app_links/app_links.dart';
+import 'package:flutter/material.dart';
+import 'package:flutter_secure_storage/flutter_secure_storage.dart';
+
+import '../pages/confirmation.dart';
+import '../services/auth.dart';
+import '../services/lnurl.dart';
+import '../services/seed.dart';
+import '../utils/bech32.dart';
+
+class MyHomePage extends StatefulWidget {
+  final String title;
+
+  const MyHomePage({super.key, required this.title});
+
+  @override
+  State<MyHomePage> createState() => _MyHomePageState();
+}
+
+class _MyHomePageState extends State<MyHomePage> {
+  final _secureStorage = const FlutterSecureStorage();
+  final _appLinks = AppLinks();
+
+  late final SeedService _seedService;
+  late final LnurlService _lnurlService;
+  late final AuthService _authService;
+
+  String _deepLinkText = 'Waiting for deep link...';
+  String _seedStatus = 'Checking...';
+
+  @override
+  void initState() {
+    super.initState();
+
+    _seedService = SeedService(_secureStorage);
+    _lnurlService = LnurlService();
+    _authService = AuthService(_seedService);
+
+    _initialize();
+  }
+
+  Future<void> _initialize() async {
+    await _ensureSeedExists();
+    _appLinks.uriLinkStream.listen(_handleUri);
+  }
+
+  Future<void> _ensureSeedExists() async {
+    await _seedService.ensureSeedExists();
+
+    if (!mounted) return;
+    setState(() {
+      _seedStatus = 'LNURL-auth seed is ready';
+    });
+  }
+
+  Future<void> _handleUri(Uri uri) async {
+    if (!mounted) return;
+
+    try {
+      final decoded = decodeLnurlToUrl(uri.path);
+
+      setState(() {
+        _deepLinkText = decoded;
+      });
+
+      final request = _lnurlService.parseLnurlAuth(Uri.parse(decoded));
+
+      final confirmed = await Navigator.push<bool>(
+        context,
+        MaterialPageRoute(
+          builder: (_) => ConfirmLoginPage(
+            domain: request.domain,
+            action: request.action,
+          ),
+        ),
+      );
+
+      if (confirmed != true) {
+        _showMessage('Login cancelled');
+        return;
+      }
+
+      await _authService.sendLnurlAuth(request);
+      _showMessage('LNURL-auth successful for ${request.domain}');
+    } catch (e) {
+      _showMessage('Failed to handle LNURL-auth: $e');
+    }
+  }
+
+  void _showMessage(String message) {
+    showDialog<void>(
+      context: context,
+      builder: (_) => AlertDialog(
+        title: const Text('Info'),
+        content: Text(message),
+        actions: [
+          TextButton(
+            onPressed: () => Navigator.of(context).pop(),
+            child: const Text('OK'),
+          ),
+        ],
+      ),
+    );
+  }
+
+  @override
+  Widget build(BuildContext context) {
+    return Scaffold(
+      appBar: AppBar(title: Text(widget.title)),
+      body: Center(
+        child: Padding(
+          padding: const EdgeInsets.all(16),
+          child: Column(
+            mainAxisAlignment: MainAxisAlignment.center,
+            children: [
+              Text(_seedStatus),
+              const SizedBox(height: 12),
+              Text(_deepLinkText, textAlign: TextAlign.center),
+            ],
+          ),
+        ),
+      ),
+    );
+  }
+}
\ No newline at end of file
diff --git a/lib/services/auth.dart b/lib/services/auth.dart
new file mode 100644
index 0000000..96c54bd
--- /dev/null
+++ b/lib/services/auth.dart
@@ -0,0 +1,103 @@
+import 'dart:convert';
+import 'dart:typed_data';
+
+import 'package:bip32_plus/bip32_plus.dart' as bip32;
+import 'package:convert/convert.dart';
+import 'package:crypto/crypto.dart';
+import 'package:http/http.dart' as http;
+import 'package:sec/sec.dart';
+
+import '../models/derived_linking_key.dart';
+import '../models/lnurl_auth_request.dart';
+import '../utils/crypto.dart';
+import 'seed.dart';
+
+class AuthService {
+  final SeedService seedService;
+  final _secp256k1 = EC.secp256k1;
+
+  AuthService(this.seedService);
+
+  List<int> lnurlAuthDerivationPath(String domain) {
+    final digest = sha256.convert(utf8.encode(domain)).bytes;
+
+    int toUInt31(List<int> bytes, int offset) {
+      return ((bytes[offset] << 24) |
+      (bytes[offset + 1] << 16) |
+      (bytes[offset + 2] << 8) |
+      bytes[offset + 3]) &
+      0x7fffffff;
+    }
+
+    return [
+      138,
+      toUInt31(digest, 0),
+      toUInt31(digest, 4),
+      toUInt31(digest, 8),
+      toUInt31(digest, 12),
+    ];
+  }
+
+  Future<DerivedLinkingKey> deriveLinkingKey(String domain) async {
+    final seed = await seedService.getMasterSeed();
+    bip32.BIP32 node = bip32.BIP32.fromSeed(seed);
+
+    final path = lnurlAuthDerivationPath(domain);
+    for (final index in path) {
+      node = node.deriveHardened(index);
+    }
+
+    final privateKeyBytes = node.privateKey;
+    if (privateKeyBytes == null || privateKeyBytes.length != 32) {
+      throw Exception('Failed to derive LNURL-auth private key');
+    }
+
+    final privateKey = bytesToBigInt(privateKeyBytes);
+    if (privateKey == BigInt.zero) {
+      throw Exception('Derived invalid private key');
+    }
+
+    final compressedPublicKey = _secp256k1.createPublicKey(privateKey, true);
+
+    return DerivedLinkingKey(
+      privateKey: privateKey,
+      compressedPublicKey: compressedPublicKey,
+    );
+  }
+
+  Future<String> signK1Hex(String k1Hex, BigInt privateKey) async {
+    final message = Uint8List.fromList(hex.decode(k1Hex));
+    if (message.length != 32) {
+      throw Exception('k1 must decode to 32 bytes');
+    }
+
+    final signature = _secp256k1.generateSignature(privateKey, message, true);
+    final der = encodeDerSignature(signature.r, signature.s);
+    return hex.encode(der);
+  }
+
+  Future<void> sendLnurlAuth(LnurlAuthRequest request) async {
+    final linkingKey = await deriveLinkingKey(request.domain);
+    final sigHex = await signK1Hex(request.k1, linkingKey.privateKey);
+    final keyHex = hex.encode(linkingKey.compressedPublicKey);
+
+    final callbackUri = request.callback.replace(
+      queryParameters: {
+        ...request.callback.queryParameters,
+        'sig': sigHex,
+        'key': keyHex,
+      },
+    );
+
+    final response = await http.get(callbackUri);
+
+    if (response.statusCode != 200) {
+      throw Exception('LNURL-auth failed: ${response.statusCode} ${response.body}');
+    }
+
+    final decoded = jsonDecode(response.body);
+    if (decoded is! Map || decoded['status'] != 'OK') {
+      throw Exception('LNURL-auth rejected: ${response.body}');
+    }
+  }
+}
\ No newline at end of file
diff --git a/lib/services/lnurl.dart b/lib/services/lnurl.dart
new file mode 100644
index 0000000..0b8986b
--- /dev/null
+++ b/lib/services/lnurl.dart
@@ -0,0 +1,36 @@
+import '../models/lnurl_auth_request.dart';
+
+class LnurlService {
+  LnurlAuthRequest parseLnurlAuth(Uri uri) {
+    Uri callback;
+
+    if (uri.queryParameters['tag'] == 'login' && uri.queryParameters['k1'] != null) {
+      callback = uri;
+    } else {
+      throw Exception('Unsupported LNURL-auth link format');
+    }
+
+    final tag = callback.queryParameters['tag'];
+    final k1 = callback.queryParameters['k1'];
+    final action = callback.queryParameters['action'] ?? 'login';
+
+    if (tag != 'login') {
+      throw Exception('Not an LNURL-auth request');
+    }
+
+    if (k1 == null || !RegExp(r'^[0-9a-fA-F]{64}$').hasMatch(k1)) {
+      throw Exception('Invalid or missing k1');
+    }
+
+    if (callback.host.isEmpty) {
+      throw Exception('Missing callback host');
+    }
+
+    return LnurlAuthRequest(
+      callback: callback,
+      k1: k1.toLowerCase(),
+      action: action,
+      domain: callback.host.toLowerCase(),
+    );
+  }
+}
\ No newline at end of file
diff --git a/lib/services/seed.dart b/lib/services/seed.dart
new file mode 100644
index 0000000..b3804cb
--- /dev/null
+++ b/lib/services/seed.dart
@@ -0,0 +1,30 @@
+import 'dart:typed_data';
+import 'package:convert/convert.dart';
+import 'package:flutter_secure_storage/flutter_secure_storage.dart';
+import '../utils/crypto.dart';
+
+class SeedService {
+  static const seedStorageKey = 'lnurl_auth_master_seed';
+
+  final FlutterSecureStorage secureStorage;
+
+  const SeedService(this.secureStorage);
+
+  Future<void> ensureSeedExists() async {
+    var seedHex = await secureStorage.read(key: seedStorageKey);
+
+    if (seedHex == null) {
+      final seed = secureRandomBytes(32);
+      seedHex = hex.encode(seed);
+      await secureStorage.write(key: seedStorageKey, value: seedHex);
+    }
+  }
+
+  Future<Uint8List> getMasterSeed() async {
+    final seedHex = await secureStorage.read(key: seedStorageKey);
+    if (seedHex == null) {
+      throw Exception('No seed found');
+    }
+    return Uint8List.fromList(hex.decode(seedHex));
+  }
+}
\ No newline at end of file
diff --git a/lib/utils/bech32.dart b/lib/utils/bech32.dart
new file mode 100644
index 0000000..0ec4401
--- /dev/null
+++ b/lib/utils/bech32.dart
@@ -0,0 +1,54 @@
+import 'dart:convert';
+import 'package:bitcoin_bech32_ng/bitcoin_bech32_ng.dart';
+
+String decodeLnurlToUrl(String lnurl) {
+  final bech32Data = bech32.decode(lnurl, lnurl.length);
+  final bytes = convertBits(bech32Data.data, 5, 8, false);
+  return utf8.decode(bytes);
+}
+
+Uri decodeLnurlToUri(String lnurl) {
+  return Uri.parse(decodeLnurlToUrl(lnurl));
+}
+
+List<int> convertBits(
+    List<int> data,
+    int fromBits,
+    int toBits,
+    bool pad,
+    ) {
+  int acc = 0;
+  int bits = 0;
+  final result = <int>[];
+  final maxv = (1 << toBits) - 1;
+  final maxAcc = (1 << (fromBits + toBits - 1)) - 1;
+
+  for (final value in data) {
+    if (value < 0 || (value >> fromBits) != 0) {
+      throw FormatException('Invalid value: $value');
+    }
+
+    acc = ((acc << fromBits) | value) & maxAcc;
+    bits += fromBits;
+
+    while (bits >= toBits) {
+      bits -= toBits;
+      result.add((acc >> bits) & maxv);
+    }
+  }
+
+  if (pad) {
+    if (bits > 0) {
+      result.add((acc << (toBits - bits)) & maxv);
+    }
+  } else {
+    if (bits >= fromBits) {
+      throw const FormatException('Excess padding');
+    }
+    if (((acc << (toBits - bits)) & maxv) != 0) {
+      throw const FormatException('Non-zero padding');
+    }
+  }
+
+  return result;
+}
\ No newline at end of file
diff --git a/lib/utils/crypto.dart b/lib/utils/crypto.dart
new file mode 100644
index 0000000..6d01ed1
--- /dev/null
+++ b/lib/utils/crypto.dart
@@ -0,0 +1,66 @@
+import 'dart:math';
+import 'dart:typed_data';
+import 'package:convert/convert.dart';
+
+Uint8List secureRandomBytes(int length) {
+  final random = Random.secure();
+  return Uint8List.fromList(
+    List<int>.generate(length, (_) => random.nextInt(256)),
+  );
+}
+
+BigInt bytesToBigInt(Uint8List bytes) {
+  return BigInt.parse(hex.encode(bytes), radix: 16);
+}
+
+List<int> bigIntToBytes(BigInt value) {
+  if (value == BigInt.zero) {
+    return [0];
+  }
+
+  var hexStr = value.toRadixString(16);
+  if (hexStr.length.isOdd) {
+    hexStr = '0$hexStr';
+  }
+  return hex.decode(hexStr);
+}
+
+Uint8List encodeDerSignature(BigInt r, BigInt s) {
+  final rBytes = encodeDerInteger(r);
+  final sBytes = encodeDerInteger(s);
+
+  final sequence = <int>[
+    0x30,
+    rBytes.length + sBytes.length,
+    ...rBytes,
+    ...sBytes,
+  ];
+
+  return Uint8List.fromList(sequence);
+}
+
+List<int> encodeDerInteger(BigInt value) {
+  if (value < BigInt.zero) {
+    throw Exception('DER integer must be non-negative');
+  }
+
+  var bytes = bigIntToBytes(value);
+
+  while (bytes.length > 1 && bytes[0] == 0x00 && (bytes[1] & 0x80) == 0) {
+    bytes = bytes.sublist(1);
+  }
+
+  if (bytes.isEmpty) {
+    bytes = [0x00];
+  }
+
+  if ((bytes[0] & 0x80) != 0) {
+    bytes = [0x00, ...bytes];
+  }
+
+  return [
+    0x02,
+    bytes.length,
+    ...bytes,
+  ];
+}
\ No newline at end of file