@formstr/signer 0.1.0

package/dist/index.cjs

@@ -0,0 +1,726 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var src_exports = {};
+__export(src_exports, {
+  AndroidSigner: () => AndroidSigner,
+  BunkerSigner: () => BunkerSigner,
+  ExtensionSigner: () => ExtensionSigner,
+  LocalSigner: () => LocalSigner,
+  Signer: () => Signer,
+  bytesToHex: () => bytesToHex,
+  connectWithBunkerUri: () => connectWithBunkerUri,
+  createSigner: () => createSigner,
+  decryptNcryptsec: () => decryptNcryptsec,
+  encryptSecretKey: () => encryptSecretKey,
+  generateAccount: () => generateAccount,
+  getWindowNostr: () => getWindowNostr,
+  hexToBytes: () => hexToBytes,
+  initiateNostrConnect: () => initiateNostrConnect,
+  localStorageAdapter: () => localStorageAdapter,
+  loginWithAndroidSigner: () => loginWithAndroidSigner
+});
+module.exports = __toCommonJS(src_exports);
+
+// src/core/signer.ts
+var import_nostr_tools5 = require("nostr-tools");
+
+// src/core/storage.ts
+var DEFAULT_PREFIX = "@formstr/signer:";
+function localStorageAdapter(prefix = DEFAULT_PREFIX) {
+  const ls = () => {
+    try {
+      return typeof globalThis !== "undefined" && globalThis.localStorage ? globalThis.localStorage : null;
+    } catch {
+      return null;
+    }
+  };
+  return {
+    get(key) {
+      try {
+        return ls()?.getItem(prefix + key) ?? null;
+      } catch {
+        return null;
+      }
+    },
+    set(key, value) {
+      try {
+        ls()?.setItem(prefix + key, value);
+      } catch {
+      }
+    },
+    remove(key) {
+      try {
+        ls()?.removeItem(prefix + key);
+      } catch {
+      }
+    }
+  };
+}
+
+// src/core/localSigner.ts
+var import_nostr_tools = require("nostr-tools");
+var LocalSigner = class {
+  #secretKey;
+  constructor(secretKey) {
+    this.#secretKey = secretKey;
+  }
+  async getPublicKey() {
+    return (0, import_nostr_tools.getPublicKey)(this.#secretKey);
+  }
+  async signEvent(event) {
+    return (0, import_nostr_tools.finalizeEvent)(event, this.#secretKey);
+  }
+  async nip04Encrypt(peerPubkey, plaintext) {
+    return import_nostr_tools.nip04.encrypt(this.#secretKey, peerPubkey, plaintext);
+  }
+  async nip04Decrypt(peerPubkey, ciphertext) {
+    return import_nostr_tools.nip04.decrypt(this.#secretKey, peerPubkey, ciphertext);
+  }
+  async nip44Encrypt(peerPubkey, plaintext) {
+    const key = import_nostr_tools.nip44.v2.utils.getConversationKey(this.#secretKey, peerPubkey);
+    return import_nostr_tools.nip44.v2.encrypt(plaintext, key);
+  }
+  async nip44Decrypt(peerPubkey, ciphertext) {
+    const key = import_nostr_tools.nip44.v2.utils.getConversationKey(this.#secretKey, peerPubkey);
+    return import_nostr_tools.nip44.v2.decrypt(ciphertext, key);
+  }
+};
+
+// src/nip49.ts
+var import_nostr_tools2 = require("nostr-tools");
+var import_nip49 = require("nostr-tools/nip49");
+function encryptSecretKey(secretKey, passphrase) {
+  return (0, import_nip49.encrypt)(secretKey, passphrase);
+}
+function decryptNcryptsec(ncryptsec, passphrase) {
+  return (0, import_nip49.decrypt)(ncryptsec, passphrase);
+}
+function generateAccount(passphrase) {
+  const secretKey = (0, import_nostr_tools2.generateSecretKey)();
+  const pubkey = (0, import_nostr_tools2.getPublicKey)(secretKey);
+  const npub = import_nostr_tools2.nip19.npubEncode(pubkey);
+  const ncryptsec = (0, import_nip49.encrypt)(secretKey, passphrase);
+  return { secretKey, pubkey, npub, ncryptsec };
+}
+
+// src/nip07.ts
+function getWindowNostr() {
+  const nostr = globalThis.nostr;
+  if (!nostr) {
+    throw new Error(
+      "@formstr/signer: NIP-07 extension not found (globalThis.nostr is undefined)"
+    );
+  }
+  return nostr;
+}
+var ExtensionSigner = class {
+  async getPublicKey() {
+    return getWindowNostr().getPublicKey();
+  }
+  async signEvent(event) {
+    return getWindowNostr().signEvent(event);
+  }
+  async nip04Encrypt(peerPubkey, plaintext) {
+    const ext = getWindowNostr();
+    if (!ext.nip04) throw new Error("NIP-07 extension does not expose nip04");
+    return ext.nip04.encrypt(peerPubkey, plaintext);
+  }
+  async nip04Decrypt(peerPubkey, ciphertext) {
+    const ext = getWindowNostr();
+    if (!ext.nip04) throw new Error("NIP-07 extension does not expose nip04");
+    return ext.nip04.decrypt(peerPubkey, ciphertext);
+  }
+  async nip44Encrypt(peerPubkey, plaintext) {
+    const ext = getWindowNostr();
+    if (!ext.nip44) throw new Error("NIP-07 extension does not expose nip44");
+    return ext.nip44.encrypt(peerPubkey, plaintext);
+  }
+  async nip44Decrypt(peerPubkey, ciphertext) {
+    const ext = getWindowNostr();
+    if (!ext.nip44) throw new Error("NIP-07 extension does not expose nip44");
+    return ext.nip44.decrypt(peerPubkey, ciphertext);
+  }
+};
+
+// src/nip46.ts
+var import_nostr_tools3 = require("nostr-tools");
+var import_nip46 = require("nostr-tools/nip46");
+var BunkerSigner = class {
+  #delegate;
+  constructor(delegate) {
+    this.#delegate = delegate;
+  }
+  getPublicKey() {
+    return this.#delegate.getPublicKey();
+  }
+  signEvent(event) {
+    return this.#delegate.signEvent(event);
+  }
+  nip04Encrypt(peerPubkey, plaintext) {
+    return this.#delegate.nip04Encrypt(peerPubkey, plaintext);
+  }
+  nip04Decrypt(peerPubkey, ciphertext) {
+    return this.#delegate.nip04Decrypt(peerPubkey, ciphertext);
+  }
+  nip44Encrypt(peerPubkey, plaintext) {
+    return this.#delegate.nip44Encrypt(peerPubkey, plaintext);
+  }
+  nip44Decrypt(peerPubkey, ciphertext) {
+    return this.#delegate.nip44Decrypt(peerPubkey, ciphertext);
+  }
+  async close() {
+    return this.#delegate.close();
+  }
+};
+async function fetchBunkerRelays(tools) {
+  try {
+    const resp = await tools.sendRequest("get_relays", []);
+    const parsed = JSON.parse(resp);
+    if (Array.isArray(parsed)) {
+      return parsed.filter((r) => typeof r === "string");
+    }
+    if (typeof parsed === "object" && parsed !== null) {
+      return Object.keys(parsed);
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+function relayListsMatch(a, b) {
+  if (a.length !== b.length) return false;
+  const sa = [...a].sort();
+  const sb = [...b].sort();
+  for (let i = 0; i < sa.length; i++) if (sa[i] !== sb[i]) return false;
+  return true;
+}
+async function resolveRelayChoice(tools, userRelays, onRelayMismatch) {
+  if (!onRelayMismatch) return userRelays;
+  const bunkerRelays = await fetchBunkerRelays(tools);
+  if (!bunkerRelays || relayListsMatch(userRelays, bunkerRelays)) return userRelays;
+  const accept = await onRelayMismatch({ userRelays, bunkerRelays });
+  return accept ? bunkerRelays : userRelays;
+}
+async function connectWithBunkerUri(uri, options = {}) {
+  const pointer = await (0, import_nip46.parseBunkerInput)(uri);
+  if (!pointer) {
+    throw new Error("@formstr/signer: invalid bunker URI");
+  }
+  if (!pointer.relays?.length) {
+    throw new Error("@formstr/signer: bunker URI must include at least one relay");
+  }
+  const clientSecretKey = options.clientSecretKey ?? (0, import_nostr_tools3.generateSecretKey)();
+  const tools = import_nip46.BunkerSigner.fromBunker(clientSecretKey, pointer, {
+    pool: options.pool,
+    onauth: options.onAuth
+  });
+  await tools.sendRequest("connect", [
+    pointer.pubkey,
+    pointer.secret ?? "",
+    (options.perms ?? []).join(",")
+  ]);
+  const pubkey = await tools.getPublicKey();
+  const resolvedRelays = await resolveRelayChoice(
+    tools,
+    pointer.relays,
+    options.onRelayMismatch
+  );
+  return {
+    signer: new BunkerSigner(tools),
+    pubkey,
+    pointer: { ...pointer, relays: resolvedRelays },
+    clientSecretKey
+  };
+}
+function initiateNostrConnect(options) {
+  if (options.relays.length === 0) {
+    throw new Error("@formstr/signer: at least one relay is required for nostrconnect");
+  }
+  const clientSecretKey = options.clientSecretKey ?? (0, import_nostr_tools3.generateSecretKey)();
+  const clientPubkey = (0, import_nostr_tools3.getPublicKey)(clientSecretKey);
+  const secret = options.secret ?? Math.random().toString(36).slice(2);
+  const uri = (0, import_nip46.createNostrConnectURI)({
+    clientPubkey,
+    relays: options.relays,
+    secret,
+    perms: options.perms,
+    name: options.metadata?.name,
+    url: options.metadata?.url,
+    image: options.metadata?.image
+  });
+  const maxWaitOrAbort = options.signal ?? options.timeoutMs ?? 3e5;
+  const complete = import_nip46.BunkerSigner.fromURI(
+    clientSecretKey,
+    uri,
+    { pool: options.pool, onauth: options.onAuth, skipSwitchRelays: true },
+    maxWaitOrAbort
+  ).then(async (tools) => {
+    const pubkey = await tools.getPublicKey();
+    const resolvedRelays = await resolveRelayChoice(
+      tools,
+      options.relays,
+      options.onRelayMismatch
+    );
+    return {
+      signer: new BunkerSigner(tools),
+      pubkey,
+      pointer: { ...tools.bp, relays: resolvedRelays },
+      clientSecretKey
+    };
+  });
+  return { uri, clientPubkey, complete };
+}
+var hexAlphabet = "0123456789abcdef";
+function bytesToHex(bytes) {
+  let s = "";
+  for (const b of bytes) s += hexAlphabet[b >> 4] + hexAlphabet[b & 15];
+  return s;
+}
+function hexToBytes(hex) {
+  if (hex.length % 2 !== 0) throw new Error("hexToBytes: odd-length hex string");
+  const out = new Uint8Array(hex.length / 2);
+  for (let i = 0; i < out.length; i++) {
+    out[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+  }
+  return out;
+}
+
+// src/nip55.ts
+var import_nostr_tools4 = require("nostr-tools");
+var AndroidSigner = class {
+  #plugin;
+  #packageName;
+  #npub;
+  #pubkey;
+  constructor(plugin, packageName, npub, pubkey) {
+    this.#plugin = plugin;
+    this.#packageName = packageName;
+    this.#npub = npub;
+    this.#pubkey = pubkey;
+  }
+  async getPublicKey() {
+    return this.#pubkey;
+  }
+  async signEvent(event) {
+    const unsigned = { ...event, pubkey: this.#pubkey };
+    const eventId = (0, import_nostr_tools4.getEventHash)(unsigned);
+    const result = await this.#plugin.signEvent(
+      this.#packageName,
+      JSON.stringify(unsigned),
+      eventId,
+      this.#npub
+    );
+    return JSON.parse(result.event);
+  }
+  async nip04Encrypt(peerPubkey, plaintext) {
+    const { result } = await this.#plugin.nip04Encrypt(
+      this.#packageName,
+      plaintext,
+      "",
+      peerPubkey,
+      this.#npub
+    );
+    return result;
+  }
+  async nip04Decrypt(peerPubkey, ciphertext) {
+    const { result } = await this.#plugin.nip04Decrypt(
+      this.#packageName,
+      ciphertext,
+      "",
+      peerPubkey,
+      this.#npub
+    );
+    return result;
+  }
+  async nip44Encrypt(peerPubkey, plaintext) {
+    const { result } = await this.#plugin.nip44Encrypt(
+      this.#packageName,
+      plaintext,
+      "",
+      peerPubkey,
+      this.#npub
+    );
+    return result;
+  }
+  async nip44Decrypt(peerPubkey, ciphertext) {
+    const { result } = await this.#plugin.nip44Decrypt(
+      this.#packageName,
+      ciphertext,
+      "",
+      peerPubkey,
+      this.#npub
+    );
+    return result;
+  }
+};
+async function loginWithAndroidSigner(plugin, packageName) {
+  if (packageName) {
+    await plugin.setPackageName(packageName);
+  }
+  const { npub, package: pluginPackage } = await plugin.getPublicKey(packageName);
+  const resolvedPackage = pluginPackage || packageName;
+  if (!resolvedPackage) {
+    throw new Error(
+      "@formstr/signer: android signer did not return a package name and none was supplied"
+    );
+  }
+  const decoded = import_nostr_tools4.nip19.decode(npub);
+  if (decoded.type !== "npub") {
+    throw new Error("@formstr/signer: android signer returned a non-npub identifier");
+  }
+  return {
+    signer: new AndroidSigner(plugin, resolvedPackage, npub, decoded.data),
+    pubkey: decoded.data,
+    npub,
+    packageName: resolvedPackage
+  };
+}
+
+// src/core/signer.ts
+var ACCOUNTS_KEY = "accounts";
+var ACTIVE_KEY = "active-pubkey";
+var Signer = class {
+  #storage;
+  #defaultAndroidPlugin;
+  #appMetadata;
+  #accounts = [];
+  #activePubkey = null;
+  #activeSigner = null;
+  #listeners = /* @__PURE__ */ new Set();
+  constructor(config = {}) {
+    this.#storage = config.storage ?? localStorageAdapter(config.storageKeyPrefix);
+    this.#defaultAndroidPlugin = config.androidSignerPlugin;
+    this.#appMetadata = {
+      name: config.appName,
+      url: config.appUrl,
+      image: config.appImage
+    };
+    this.#hydrate();
+  }
+  #hydrate() {
+    try {
+      const raw = this.#storage.get(ACCOUNTS_KEY);
+      if (raw) {
+        const parsed = JSON.parse(raw);
+        if (Array.isArray(parsed)) this.#accounts = parsed;
+      }
+      this.#activePubkey = this.#storage.get(ACTIVE_KEY);
+    } catch {
+      this.#accounts = [];
+      this.#activePubkey = null;
+    }
+  }
+  #persistAccounts() {
+    this.#storage.set(ACCOUNTS_KEY, JSON.stringify(this.#accounts));
+  }
+  #persistActive() {
+    if (this.#activePubkey) this.#storage.set(ACTIVE_KEY, this.#activePubkey);
+    else this.#storage.remove(ACTIVE_KEY);
+  }
+  #upsertAccount(account) {
+    const idx = this.#accounts.findIndex((a) => a.pubkey === account.pubkey);
+    if (idx >= 0) this.#accounts[idx] = account;
+    else this.#accounts.push(account);
+    this.#persistAccounts();
+  }
+  #setActive(account, signer) {
+    const wasDifferent = this.#activePubkey !== null && this.#activePubkey !== account.pubkey;
+    this.#activePubkey = account.pubkey;
+    this.#activeSigner = signer;
+    this.#persistActive();
+    this.#emit({ type: wasDifferent ? "switch" : "login", account });
+  }
+  #emit(event) {
+    for (const cb of this.#listeners) {
+      try {
+        cb(event);
+      } catch {
+      }
+    }
+  }
+  /**
+   * Generate a brand-new nsec, encrypt it with `passphrase` (NIP-49),
+   * persist the resulting `ncryptsec` account, and activate it. Returns
+   * the new account's `npub` and `ncryptsec` — the caller must surface
+   * the `ncryptsec` to the user **immediately** since it is the only way
+   * back into the account on a fresh device.
+   *
+   * @throws if `passphrase` is empty.
+   */
+  async createAccount(passphrase) {
+    if (!passphrase) throw new Error("createAccount: passphrase required");
+    const { secretKey, pubkey, npub, ncryptsec } = generateAccount(passphrase);
+    const account = { npub, pubkey, method: "ncryptsec", ncryptsec };
+    this.#upsertAccount(account);
+    this.#setActive(account, new LocalSigner(secretKey));
+    return { npub, ncryptsec };
+  }
+  /**
+   * Decrypt an ncryptsec with the user's passphrase, persist the account
+   * (overwriting any previous entry for the same pubkey), and activate it.
+   *
+   * @throws if either argument is empty, or if the passphrase doesn't
+   * decrypt the ncryptsec.
+   */
+  async loginWithNcryptsec(ncryptsec, passphrase) {
+    if (!ncryptsec) throw new Error("loginWithNcryptsec: ncryptsec required");
+    if (!passphrase) throw new Error("loginWithNcryptsec: passphrase required");
+    const secretKey = decryptNcryptsec(ncryptsec, passphrase);
+    const pubkey = (0, import_nostr_tools5.getPublicKey)(secretKey);
+    const npub = import_nostr_tools5.nip19.npubEncode(pubkey);
+    const account = { npub, pubkey, method: "ncryptsec", ncryptsec };
+    this.#upsertAccount(account);
+    this.#setActive(account, new LocalSigner(secretKey));
+    return account;
+  }
+  /**
+   * Connect via the NIP-07 browser extension exposed at `window.nostr`.
+   * The extension prompts the user for permission on first use.
+   *
+   * @throws if no extension is installed or the user denies the request.
+   */
+  async loginWithExtension() {
+    const extension = new ExtensionSigner();
+    const pubkey = await extension.getPublicKey();
+    const npub = import_nostr_tools5.nip19.npubEncode(pubkey);
+    const account = { npub, pubkey, method: "extension" };
+    this.#upsertAccount(account);
+    this.#setActive(account, extension);
+    return account;
+  }
+  /**
+   * Connect to a NIP-46 remote signer via a `bunker://` URI. Relays are
+   * read from the URI itself — no hardcoded fallbacks. Pass a `pool`
+   * to reuse an existing relay connection; pass `clientSecretKey` to
+   * resume a previous session (the hex from `StoredAccount.nip46`).
+   *
+   * @throws if the URI is malformed, no relay is reachable, or the
+   * remote signer rejects pairing within the implementation's timeout.
+   */
+  async loginWithBunkerUri(uri, options = {}) {
+    const result = await connectWithBunkerUri(uri, options);
+    const npub = import_nostr_tools5.nip19.npubEncode(result.pubkey);
+    const account = {
+      npub,
+      pubkey: result.pubkey,
+      method: "nip46",
+      nip46: {
+        uri,
+        remoteSignerPubkey: result.pointer.pubkey,
+        relays: result.pointer.relays,
+        clientSecretKey: bytesToHex(result.clientSecretKey)
+      }
+    };
+    this.#upsertAccount(account);
+    this.#setActive(account, result.signer);
+    return account;
+  }
+  /**
+   * Initiate a NIP-46 `nostrconnect://` pairing. Generates a client
+   * keypair, publishes a connect request to the supplied `relays`, and
+   * waits for a remote signer to pair. Call `options.onUri(uri)` to
+   * render the URI as a QR code; the returned promise resolves once
+   * pairing completes. Cancel by aborting `options.signal`.
+   *
+   * @throws if `relays` is empty, the user aborts, the pairing times
+   * out, or no signer responds.
+   */
+  async loginWithNostrConnect(options) {
+    if (options.relays.length === 0) {
+      throw new Error("loginWithNostrConnect: at least one relay required");
+    }
+    const metadata = {
+      name: options.metadata?.name ?? this.#appMetadata.name,
+      url: options.metadata?.url ?? this.#appMetadata.url,
+      image: options.metadata?.image ?? this.#appMetadata.image
+    };
+    if (!metadata.name) {
+      throw new Error(
+        "@formstr/signer: loginWithNostrConnect requires an app name. Set `appName` in createSigner() or pass `metadata.name` to loginWithNostrConnect()."
+      );
+    }
+    const init = initiateNostrConnect({
+      relays: options.relays,
+      metadata,
+      perms: options.perms,
+      pool: options.pool,
+      onAuth: options.onAuth,
+      signal: options.signal,
+      timeoutMs: options.timeoutMs,
+      onRelayMismatch: options.onRelayMismatch
+    });
+    options.onUri(init.uri);
+    const result = await init.complete;
+    const npub = import_nostr_tools5.nip19.npubEncode(result.pubkey);
+    const account = {
+      npub,
+      pubkey: result.pubkey,
+      method: "nip46",
+      nip46: {
+        uri: init.uri,
+        remoteSignerPubkey: result.pointer.pubkey,
+        relays: result.pointer.relays,
+        clientSecretKey: bytesToHex(result.clientSecretKey)
+      }
+    };
+    this.#upsertAccount(account);
+    this.#setActive(account, result.signer);
+    return account;
+  }
+  /**
+   * Enumerate NIP-55 signer apps installed on the device, via the
+   * configured Android plugin (or `plugin` if supplied). Useful for
+   * rendering a "pick your signer" list — the built-in UI does this
+   * automatically when the Android tab is selected.
+   *
+   * Only meaningful inside a Capacitor Android shell. On web/iOS the
+   * configured plugin is typically absent and this throws.
+   *
+   * @throws if no plugin is configured and none is passed in.
+   */
+  async listAndroidSignerApps(plugin) {
+    const p = plugin ?? this.#defaultAndroidPlugin;
+    if (!p) {
+      throw new Error(
+        "@formstr/signer: no Android signer plugin configured (pass `androidSignerPlugin` to createSigner or `plugin` to listAndroidSignerApps)"
+      );
+    }
+    const { apps } = await p.getInstalledSignerApps();
+    return apps;
+  }
+  /**
+   * Sign in via a NIP-55 Android external signer (Amber, etc). If
+   * `options.packageName` is given, that specific signer app is invoked;
+   * otherwise the plugin picks a default (typically the only installed
+   * signer, or an OS chooser). Pass `options.plugin` to override the
+   * configured default for this call.
+   *
+   * @throws if no plugin is configured, the signer app cannot be
+   * resolved to a package name, or the user denies the request.
+   */
+  async loginWithAndroidSigner(options = {}) {
+    const plugin = options.plugin ?? this.#defaultAndroidPlugin;
+    if (!plugin) {
+      throw new Error(
+        "@formstr/signer: no Android signer plugin configured (pass `androidSignerPlugin` to createSigner or `plugin` to loginWithAndroidSigner)"
+      );
+    }
+    const result = await loginWithAndroidSigner(plugin, options.packageName);
+    const account = {
+      npub: result.npub,
+      pubkey: result.pubkey,
+      method: "android",
+      androidPackageName: result.packageName
+    };
+    this.#upsertAccount(account);
+    this.#setActive(account, result.signer);
+    return account;
+  }
+  /** Snapshot of every persisted account, in insertion order. */
+  listAccounts() {
+    return [...this.#accounts];
+  }
+  /**
+   * The currently selected account, or `null` if none. Present even when
+   * the account is locked (no active signer yet). Use this to render
+   * "logged in as @alice" — pair with {@link getActiveSigner} to decide
+   * whether signing is actually available.
+   */
+  getActiveAccount() {
+    if (!this.#activePubkey) return null;
+    return this.#accounts.find((a) => a.pubkey === this.#activePubkey) ?? null;
+  }
+  /**
+   * The unlocked signer for the active account, or `null` if locked.
+   * After a fresh page load this is `null` for every account type
+   * (passphrase / extension grant / signer-app handshake all need to
+   * be redone). Calling the matching `loginWith*` method unlocks it.
+   */
+  getActiveSigner() {
+    return this.#activeSigner;
+  }
+  /**
+   * Make `pubkey` the active account. Clears the in-memory signer —
+   * the new account starts **locked** even if it was previously
+   * unlocked in this session.
+   *
+   * @throws if `pubkey` does not match any persisted account.
+   */
+  async switchAccount(pubkey) {
+    const account = this.#accounts.find((a) => a.pubkey === pubkey);
+    if (!account) throw new Error(`switchAccount: no account for pubkey ${pubkey}`);
+    this.#activePubkey = pubkey;
+    this.#activeSigner = null;
+    this.#persistActive();
+    this.#emit({ type: "switch", account });
+  }
+  /**
+   * Remove an account from storage. `pubkey` defaults to the active
+   * account. If the active account is removed, the in-memory signer is
+   * cleared. No-op if there is nothing to remove.
+   */
+  async logout(pubkey) {
+    const target = pubkey ?? this.#activePubkey;
+    if (!target) return;
+    this.#accounts = this.#accounts.filter((a) => a.pubkey !== target);
+    this.#persistAccounts();
+    if (this.#activePubkey === target) {
+      this.#activePubkey = null;
+      this.#activeSigner = null;
+      this.#persistActive();
+    }
+    this.#emit({ type: "logout", pubkey: target });
+  }
+  /**
+   * Subscribe to account-state changes. Returns an unsubscribe function.
+   * Listener errors are swallowed so one bad listener can't break others.
+   * See {@link SignerEvent} for the variants.
+   */
+  onChange(cb) {
+    this.#listeners.add(cb);
+    return () => {
+      this.#listeners.delete(cb);
+    };
+  }
+};
+function createSigner(config = {}) {
+  return new Signer(config);
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  AndroidSigner,
+  BunkerSigner,
+  ExtensionSigner,
+  LocalSigner,
+  Signer,
+  bytesToHex,
+  connectWithBunkerUri,
+  createSigner,
+  decryptNcryptsec,
+  encryptSecretKey,
+  generateAccount,
+  getWindowNostr,
+  hexToBytes,
+  initiateNostrConnect,
+  localStorageAdapter,
+  loginWithAndroidSigner
+});
+//# sourceMappingURL=index.cjs.map