[Taewa]

Summary

On touch devices, /connect shows only "Continue with Pubky Ring", so a creator whose identity is in Bitkit cannot approve the creator authority. The Bitkit link exists only on iPhone, inside the embedded page. Closes #103. Closes #35.

This PR changes the connect shell to the new design for pubky/pubky-app#2859:

1. Touch devices: grant-connect flows show two buttons, "Continue with Pubky Ring" and "Continue with Bitkit", on every touch device, in both delivery modes. Legacy connect still shows only the Pubky Ring button, because Bitkit accepts only grant auth.
2. Android: in grant-connect flows, each button links to an intent:// URL with its app's package, so Android opens the right app instead of a chooser or a saved default. Pubky Ring uses to.pubky.ring. Bitkit uses to.bitkit in production and to.bitkit.dev in staging and development. This is the same fix as fix: deeplink for pubky-ring and bitkit from sign in page on android pubky-app#2885. Firefox on Android keeps the plain pubkyauth:// link, and legacy connect keeps the plain pubkyauth://signin link.
3. iOS: the Bitkit button uses bitkit://pubky-auth/signin with the same query, as before. When the shell is embedded, both buttons open in the top frame.
4. Touch detection: the shell now uses (pointer: coarse), the same media query pubky.app uses to size its iframe. The old query, (hover: none) and (pointer: coarse), does not match touch devices that also report hover. On those devices the shell showed the 192px QR inside pubky.app's 132px button box, so the QR was cut off.
5. QR badge: the QR center shows the Pubky mark instead of a lock, the same mark as pubky.app's sign-in QR (Show the Pubky Ring logo in the center of the /connect QR code #35).
6. Standalone page: in grant-connect flows, the Pubky Ring and Bitkit logos show below the QR. The text says "Scan this QR with Pubky Ring or Bitkit…" with a pointer, or "Use Pubky Ring or Bitkit…" on touch. In legacy connect, the logo and the text name only Pubky Ring, because Bitkit accepts only grant auth. The embedded page draws no logos, because pubky.app draws them below the iframe.

The embedded touch layout is two 60px buttons with a 12px gap (132px). pubky.app's iframe box matches this height.

Contract and risk impact

• Public API or SDK contract
• Persisted data or migration
• Authentication, authorization, identity, or secret handling
• Payment or entitlement behavior
• Runtime, deployment, or observability
• No contract/risk impact

The authorization URL and the connect flow do not change. Only the shell's HTML and its links change.

Deploy order: ship pubky/pubky-app#2907 first, then this Lock Server change.

1. If pubky.app ships first: until this change ships, iOS shows the old page (two buttons with a 24px gap, 144px) in the new 132px box, so the Bitkit button loses 12px. Android shows one 60px button, which fits.
2. If this change ships first: the old pubky.app box on touch is 60px, so the Bitkit button is completely hidden on every touch device.

Verification

1. cargo fmt --check: passes.
2. cargo clippy --all-targets --all-features -- -D warnings: passes.
3. cargo test -p locks-server connect_shell: 16 passed. New tests cover the legacy shell (Ring link only, and no Bitkit text or logo), the grant shell (Ring and Bitkit links with Android and iOS variants, and the Bitkit package for each environment), and the intent:// builder.
4. The full locks-server test run fails only in the paykit_http_client oversized-response tests. Those tests also fail on master without this change.
5. Rendered the shell with Playwright in desktop, iPhone and Android emulation, in both the embedded and the standalone mode. Checked which elements are visible, the iframe content height (192px desktop, 132px touch), and the link targets. Also rendered the legacy standalone page: only the Pubky Ring logo on desktop and only the Pubky Ring button on touch.
6. Ran this build in the local demo stack behind pubky.app and recorded the Enable Locks step on desktop and on a 390px touch viewport, with legacy connect (Pubky Ring button only) and with grant connect (both buttons). The videos are at the end of this description.

Documentation

docs/API.md and docs/SDK.md now describe the Pubky Ring and Bitkit buttons and their platform links. docs/API.md also says that legacy connect keeps the plain link and names only Pubky Ring.

Checklist

• The change is focused and self-reviewed.
• Regression tests were added where practical.
• No credentials, identities, private content, payment material, or generated local state are included.
• Formatting and relevant tests/lints pass.

locks-signer-desktop-20261022-1344.mp4

locks-signer-mobile-grant-20261022-1533.mp4

locks-signer-mobile-ring-20261022-1414.mp4

[dzdidi]

Recommended human verdict: request changes.

One blocking staging correctness issue remains; see inline comment. Exact-head Checks completed successfully. The RustSec failure is inherited from unchanged Cargo.lock and is being handled separately in #104, so it is not the basis for this verdict.

[dzdidi]

Recommended human verdict: request changes.

The legacy standalone shell now advertises Bitkit even though legacy auth remains Ring-only; see blocking inline comment. Exact-head Checks succeeded. RustSec failed on three advisories in unchanged Cargo.lock (tracked separately in #104), so that inherited failure is not the basis for this verdict.

[dzdidi]

Internal exact-head review evidence. Recommended human verdict: approve.

Reviewed d1d5ff89a27b969e78b6baae2e5fe91062e407fb against base ac8e893b4cb9d21b7736a431b511acd3efdfb83a. No actionable correctness, security, persistence, API-contract, test, or documentation findings. Prior Bitkit environment selection and legacy Ring-only blockers are fixed.

Exact-head hosted CI: Checks and RustSec both completed successfully. Relevant grant/legacy shell and Android intent tests passed. Blockers: 0.

Residual risk: physical-device/browser custom-scheme and visual behavior were not independently reproduced. Deployment still requires merged pubky/pubky-app#2907 to reach production before Locks Server.

[dzdidi]

Re-reviewed exact head d1d5ff8 against ac8e893. Prior staging Bitkit package and legacy Ring-only copy/logo blockers are fixed; grant/legacy shell coverage is present. Exact-head Checks and RustSec both pass. No blocking findings. Physical-device deep-link/visual behavior not independently reproduced; deploy pubky.app #2907 before Locks Server.