Expand the chipnet Address Explorer from a hard-coded 7-wallet list to the full
15-wallet keystore, with an optional master-password gate for public deploys.
Two operating modes, chosen at boot by whether `addresses.enc.json` sits next
to the page:
1. Local / file:// — the inline WALLETS constant renders directly. Same
frictionless behaviour as before, but the list now includes all 15 wallets
plus per-wallet `cat` (category: operational | chipnet-test | bns | bns-infra)
for a category-chip filter above the table.
2. Deployed — ship index.html + addresses.enc.json (spec
chipnet-explorer-addresses/1: PBKDF2-SHA256/200k + AES-256-GCM, fresh
16-byte salt per build). On boot the page fetches the blob, wipes the
inline WALLETS to prevent pre-unlock leak, and shows a full-viewport lock
overlay. Master password decrypts in-browser via SubtleCrypto — never
transmitted, never persisted.
New signer: design/explorer/build-addresses-enc.mjs
- --master-pw prompts (or reads CHIPNET_KEYSTORE_PASSWORD env) and encrypts.
- Default source is the inline WALLETS parsed from index.html.
- --from-keystore pulls straight from Keys/chipnet-keystore.json via the
existing scripts/lib/chipnet-keystore.mjs loader.
Crypto envelope matches the Faucet's v:3 mode (Parameters/dApp/Faucet/) and
the chipnet-keystore/2-encrypted format — same PBKDF2 params, same AES-GCM
authentication, same "fresh salt per build" discipline. Fourth consumer of
the unified master-password integration (spec:
Parameters/dApp/MASTER-KEY-INTEGRATION.md §6.1).
Verified in browser preview (Parameters/dApp/Explorer/ on port 5185):
- Overlay shows on load when addresses.enc.json is present
- Inline WALLETS wiped correctly before unlock (Σ table shows 0)
- Correct password → 15 addresses render with live balances + category chips
- All four categories surface: operational · chipnet-test · bns-infra · bns
Also gitignores both plaintext (addresses.json) and encrypted
(addresses.enc.json) address lists — same discipline as the faucet seed.
Copies design/explorer/index.html into Parameters/dApp/Explorer/index.html so
both mirrors stay identical (the parallel session's convention: design/ is the
source of truth, Parameters/ is the published copy).
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
d6cb311066