@formstr/signer 0.1.0

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/core/signer.ts","../src/core/storage.ts","../src/core/localSigner.ts","../src/nip49.ts","../src/nip07.ts","../src/nip46.ts","../src/nip55.ts"],"sourcesContent":["import { getPublicKey, nip19 } from 'nostr-tools';\nimport type {\n  ActiveSigner,\n  BunkerLoginOptions,\n  NostrConnectOptions,\n  SignerConfig,\n  SignerEvent,\n  StoredAccount,\n} from './types.js';\nimport { localStorageAdapter, type StorageAdapter } from './storage.js';\nimport { LocalSigner } from './localSigner.js';\nimport { decryptNcryptsec, generateAccount } from '../nip49.js';\nimport { ExtensionSigner } from '../nip07.js';\nimport { bytesToHex, connectWithBunkerUri, initiateNostrConnect } from '../nip46.js';\nimport {\n  loginWithAndroidSigner as connectWithAndroidSigner,\n  type AndroidLoginOptions,\n  type AndroidSignerAppInfo,\n  type AndroidSignerPlugin,\n} from '../nip55.js';\n\nconst ACCOUNTS_KEY = 'accounts';\nconst ACTIVE_KEY = 'active-pubkey';\n\n/**\n * Multi-account Nostr signer with persistence.\n *\n * **Hydration.** The constructor reads previously-saved accounts from\n * the configured storage adapter. Every hydrated account starts\n * **locked**: present in `listAccounts()` and (if it was the active one\n * before) reachable via `getActiveAccount()`, but `getActiveSigner()`\n * returns `null` until the user re-authenticates. The matching\n * `loginWith*` method unlocks the active account.\n *\n * **Locked vs unlocked.** Use `getActiveAccount()` to render UI (\"logged\n * in as @alice\") and `getActiveSigner()` to decide whether the user can\n * actually sign. The pattern is \"show the account always, gate signing\n * on the signer.\"\n *\n * **Events.** Subscribe via `onChange()` to re-render when an account\n * is added, switched, or removed. See {@link SignerEvent}.\n */\nexport class Signer {\n  readonly #storage: StorageAdapter;\n  readonly #defaultAndroidPlugin: AndroidSignerPlugin | undefined;\n  readonly #appMetadata: { name?: string; url?: string; image?: string };\n  #accounts: StoredAccount[] = [];\n  #activePubkey: string | null = null;\n  #activeSigner: ActiveSigner | null = null;\n  #listeners = new Set<(event: SignerEvent) => void>();\n\n  constructor(config: SignerConfig = {}) {\n    this.#storage = config.storage ?? localStorageAdapter(config.storageKeyPrefix);\n    this.#defaultAndroidPlugin = config.androidSignerPlugin;\n    this.#appMetadata = {\n      name: config.appName,\n      url: config.appUrl,\n      image: config.appImage,\n    };\n    this.#hydrate();\n  }\n\n  #hydrate(): void {\n    try {\n      const raw = this.#storage.get(ACCOUNTS_KEY);\n      if (raw) {\n        const parsed = JSON.parse(raw);\n        if (Array.isArray(parsed)) this.#accounts = parsed as StoredAccount[];\n      }\n      this.#activePubkey = this.#storage.get(ACTIVE_KEY);\n    } catch {\n      this.#accounts = [];\n      this.#activePubkey = null;\n    }\n  }\n\n  #persistAccounts(): void {\n    this.#storage.set(ACCOUNTS_KEY, JSON.stringify(this.#accounts));\n  }\n\n  #persistActive(): void {\n    if (this.#activePubkey) this.#storage.set(ACTIVE_KEY, this.#activePubkey);\n    else this.#storage.remove(ACTIVE_KEY);\n  }\n\n  #upsertAccount(account: StoredAccount): void {\n    const idx = this.#accounts.findIndex(a => a.pubkey === account.pubkey);\n    if (idx >= 0) this.#accounts[idx] = account;\n    else this.#accounts.push(account);\n    this.#persistAccounts();\n  }\n\n  #setActive(account: StoredAccount, signer: ActiveSigner): void {\n    const wasDifferent = this.#activePubkey !== null && this.#activePubkey !== account.pubkey;\n    this.#activePubkey = account.pubkey;\n    this.#activeSigner = signer;\n    this.#persistActive();\n    this.#emit({ type: wasDifferent ? 'switch' : 'login', account });\n  }\n\n  #emit(event: SignerEvent): void {\n    for (const cb of this.#listeners) {\n      try {\n        cb(event);\n      } catch {\n        // listener errors are swallowed so one bad listener can't break others\n      }\n    }\n  }\n\n  /**\n   * Generate a brand-new nsec, encrypt it with `passphrase` (NIP-49),\n   * persist the resulting `ncryptsec` account, and activate it. Returns\n   * the new account's `npub` and `ncryptsec` — the caller must surface\n   * the `ncryptsec` to the user **immediately** since it is the only way\n   * back into the account on a fresh device.\n   *\n   * @throws if `passphrase` is empty.\n   */\n  async createAccount(passphrase: string): Promise<{ npub: string; ncryptsec: string }> {\n    if (!passphrase) throw new Error('createAccount: passphrase required');\n    const { secretKey, pubkey, npub, ncryptsec } = generateAccount(passphrase);\n    const account: StoredAccount = { npub, pubkey, method: 'ncryptsec', ncryptsec };\n    this.#upsertAccount(account);\n    this.#setActive(account, new LocalSigner(secretKey));\n    return { npub, ncryptsec };\n  }\n\n  /**\n   * Decrypt an ncryptsec with the user's passphrase, persist the account\n   * (overwriting any previous entry for the same pubkey), and activate it.\n   *\n   * @throws if either argument is empty, or if the passphrase doesn't\n   * decrypt the ncryptsec.\n   */\n  async loginWithNcryptsec(ncryptsec: string, passphrase: string): Promise<StoredAccount> {\n    if (!ncryptsec) throw new Error('loginWithNcryptsec: ncryptsec required');\n    if (!passphrase) throw new Error('loginWithNcryptsec: passphrase required');\n    const secretKey = decryptNcryptsec(ncryptsec, passphrase);\n    const pubkey = getPublicKey(secretKey);\n    const npub = nip19.npubEncode(pubkey);\n    const account: StoredAccount = { npub, pubkey, method: 'ncryptsec', ncryptsec };\n    this.#upsertAccount(account);\n    this.#setActive(account, new LocalSigner(secretKey));\n    return account;\n  }\n\n  /**\n   * Connect via the NIP-07 browser extension exposed at `window.nostr`.\n   * The extension prompts the user for permission on first use.\n   *\n   * @throws if no extension is installed or the user denies the request.\n   */\n  async loginWithExtension(): Promise<StoredAccount> {\n    const extension = new ExtensionSigner();\n    const pubkey = await extension.getPublicKey();\n    const npub = nip19.npubEncode(pubkey);\n    const account: StoredAccount = { npub, pubkey, method: 'extension' };\n    this.#upsertAccount(account);\n    this.#setActive(account, extension);\n    return account;\n  }\n\n  /**\n   * Connect to a NIP-46 remote signer via a `bunker://` URI. Relays are\n   * read from the URI itself — no hardcoded fallbacks. Pass a `pool`\n   * to reuse an existing relay connection; pass `clientSecretKey` to\n   * resume a previous session (the hex from `StoredAccount.nip46`).\n   *\n   * @throws if the URI is malformed, no relay is reachable, or the\n   * remote signer rejects pairing within the implementation's timeout.\n   */\n  async loginWithBunkerUri(\n    uri: string,\n    options: BunkerLoginOptions = {},\n  ): Promise<StoredAccount> {\n    const result = await connectWithBunkerUri(uri, options);\n    const npub = nip19.npubEncode(result.pubkey);\n    const account: StoredAccount = {\n      npub,\n      pubkey: result.pubkey,\n      method: 'nip46',\n      nip46: {\n        uri,\n        remoteSignerPubkey: result.pointer.pubkey,\n        relays: result.pointer.relays,\n        clientSecretKey: bytesToHex(result.clientSecretKey),\n      },\n    };\n    this.#upsertAccount(account);\n    this.#setActive(account, result.signer);\n    return account;\n  }\n\n  /**\n   * Initiate a NIP-46 `nostrconnect://` pairing. Generates a client\n   * keypair, publishes a connect request to the supplied `relays`, and\n   * waits for a remote signer to pair. Call `options.onUri(uri)` to\n   * render the URI as a QR code; the returned promise resolves once\n   * pairing completes. Cancel by aborting `options.signal`.\n   *\n   * @throws if `relays` is empty, the user aborts, the pairing times\n   * out, or no signer responds.\n   */\n  async loginWithNostrConnect(options: NostrConnectOptions): Promise<StoredAccount> {\n    if (options.relays.length === 0) {\n      throw new Error('loginWithNostrConnect: at least one relay required');\n    }\n    // Merge per-call metadata over SignerConfig defaults (appName/url/image).\n    // `name` is required — Amber (and likely other NIP-55 signer apps) gate\n    // the consent UI on having a recognizable client identity in the URI.\n    // Without one they will receive the request but never surface\n    // approve/deny buttons, leaving the pairing silently stuck.\n    const metadata = {\n      name: options.metadata?.name ?? this.#appMetadata.name,\n      url: options.metadata?.url ?? this.#appMetadata.url,\n      image: options.metadata?.image ?? this.#appMetadata.image,\n    };\n    if (!metadata.name) {\n      throw new Error(\n        '@formstr/signer: loginWithNostrConnect requires an app name. Set `appName` in createSigner() or pass `metadata.name` to loginWithNostrConnect().',\n      );\n    }\n    const init = initiateNostrConnect({\n      relays: options.relays,\n      metadata,\n      perms: options.perms,\n      pool: options.pool,\n      onAuth: options.onAuth,\n      signal: options.signal,\n      timeoutMs: options.timeoutMs,\n      onRelayMismatch: options.onRelayMismatch,\n    });\n    options.onUri(init.uri);\n    const result = await init.complete;\n    const npub = nip19.npubEncode(result.pubkey);\n    const account: StoredAccount = {\n      npub,\n      pubkey: result.pubkey,\n      method: 'nip46',\n      nip46: {\n        uri: init.uri,\n        remoteSignerPubkey: result.pointer.pubkey,\n        relays: result.pointer.relays,\n        clientSecretKey: bytesToHex(result.clientSecretKey),\n      },\n    };\n    this.#upsertAccount(account);\n    this.#setActive(account, result.signer);\n    return account;\n  }\n\n  /**\n   * Enumerate NIP-55 signer apps installed on the device, via the\n   * configured Android plugin (or `plugin` if supplied). Useful for\n   * rendering a \"pick your signer\" list — the built-in UI does this\n   * automatically when the Android tab is selected.\n   *\n   * Only meaningful inside a Capacitor Android shell. On web/iOS the\n   * configured plugin is typically absent and this throws.\n   *\n   * @throws if no plugin is configured and none is passed in.\n   */\n  async listAndroidSignerApps(\n    plugin?: AndroidSignerPlugin,\n  ): Promise<AndroidSignerAppInfo[]> {\n    const p = plugin ?? this.#defaultAndroidPlugin;\n    if (!p) {\n      throw new Error(\n        '@formstr/signer: no Android signer plugin configured (pass `androidSignerPlugin` to createSigner or `plugin` to listAndroidSignerApps)',\n      );\n    }\n    const { apps } = await p.getInstalledSignerApps();\n    return apps;\n  }\n\n  /**\n   * Sign in via a NIP-55 Android external signer (Amber, etc). If\n   * `options.packageName` is given, that specific signer app is invoked;\n   * otherwise the plugin picks a default (typically the only installed\n   * signer, or an OS chooser). Pass `options.plugin` to override the\n   * configured default for this call.\n   *\n   * @throws if no plugin is configured, the signer app cannot be\n   * resolved to a package name, or the user denies the request.\n   */\n  async loginWithAndroidSigner(options: AndroidLoginOptions = {}): Promise<StoredAccount> {\n    const plugin = options.plugin ?? this.#defaultAndroidPlugin;\n    if (!plugin) {\n      throw new Error(\n        '@formstr/signer: no Android signer plugin configured (pass `androidSignerPlugin` to createSigner or `plugin` to loginWithAndroidSigner)',\n      );\n    }\n    const result = await connectWithAndroidSigner(plugin, options.packageName);\n    const account: StoredAccount = {\n      npub: result.npub,\n      pubkey: result.pubkey,\n      method: 'android',\n      androidPackageName: result.packageName,\n    };\n    this.#upsertAccount(account);\n    this.#setActive(account, result.signer);\n    return account;\n  }\n\n  /** Snapshot of every persisted account, in insertion order. */\n  listAccounts(): StoredAccount[] {\n    return [...this.#accounts];\n  }\n\n  /**\n   * The currently selected account, or `null` if none. Present even when\n   * the account is locked (no active signer yet). Use this to render\n   * \"logged in as @alice\" — pair with {@link getActiveSigner} to decide\n   * whether signing is actually available.\n   */\n  getActiveAccount(): StoredAccount | null {\n    if (!this.#activePubkey) return null;\n    return this.#accounts.find(a => a.pubkey === this.#activePubkey) ?? null;\n  }\n\n  /**\n   * The unlocked signer for the active account, or `null` if locked.\n   * After a fresh page load this is `null` for every account type\n   * (passphrase / extension grant / signer-app handshake all need to\n   * be redone). Calling the matching `loginWith*` method unlocks it.\n   */\n  getActiveSigner(): ActiveSigner | null {\n    return this.#activeSigner;\n  }\n\n  /**\n   * Make `pubkey` the active account. Clears the in-memory signer —\n   * the new account starts **locked** even if it was previously\n   * unlocked in this session.\n   *\n   * @throws if `pubkey` does not match any persisted account.\n   */\n  async switchAccount(pubkey: string): Promise<void> {\n    const account = this.#accounts.find(a => a.pubkey === pubkey);\n    if (!account) throw new Error(`switchAccount: no account for pubkey ${pubkey}`);\n    this.#activePubkey = pubkey;\n    this.#activeSigner = null;\n    this.#persistActive();\n    this.#emit({ type: 'switch', account });\n  }\n\n  /**\n   * Remove an account from storage. `pubkey` defaults to the active\n   * account. If the active account is removed, the in-memory signer is\n   * cleared. No-op if there is nothing to remove.\n   */\n  async logout(pubkey?: string): Promise<void> {\n    const target = pubkey ?? this.#activePubkey;\n    if (!target) return;\n    this.#accounts = this.#accounts.filter(a => a.pubkey !== target);\n    this.#persistAccounts();\n    if (this.#activePubkey === target) {\n      this.#activePubkey = null;\n      this.#activeSigner = null;\n      this.#persistActive();\n    }\n    this.#emit({ type: 'logout', pubkey: target });\n  }\n\n  /**\n   * Subscribe to account-state changes. Returns an unsubscribe function.\n   * Listener errors are swallowed so one bad listener can't break others.\n   * See {@link SignerEvent} for the variants.\n   */\n  onChange(cb: (event: SignerEvent) => void): () => void {\n    this.#listeners.add(cb);\n    return () => {\n      this.#listeners.delete(cb);\n    };\n  }\n}\n\n/** Convenience wrapper around `new Signer(config)`. */\nexport function createSigner(config: SignerConfig = {}): Signer {\n  return new Signer(config);\n}\n","export interface StorageAdapter {\n  get(key: string): string | null;\n  set(key: string, value: string): void;\n  remove(key: string): void;\n}\n\nconst DEFAULT_PREFIX = '@formstr/signer:';\n\nexport function localStorageAdapter(prefix: string = DEFAULT_PREFIX): StorageAdapter {\n  const ls = (): Storage | null => {\n    try {\n      return typeof globalThis !== 'undefined' && globalThis.localStorage\n        ? globalThis.localStorage\n        : null;\n    } catch {\n      return null;\n    }\n  };\n  return {\n    get(key) {\n      try {\n        return ls()?.getItem(prefix + key) ?? null;\n      } catch {\n        return null;\n      }\n    },\n    set(key, value) {\n      try {\n        ls()?.setItem(prefix + key, value);\n      } catch {\n        // swallow quota / privacy-mode errors\n      }\n    },\n    remove(key) {\n      try {\n        ls()?.removeItem(prefix + key);\n      } catch {\n        // swallow\n      }\n    },\n  };\n}\n","import {\n  finalizeEvent,\n  getPublicKey,\n  nip04,\n  nip44,\n  type Event as NostrEvent,\n  type EventTemplate,\n} from 'nostr-tools';\nimport type { ActiveSigner } from './types.js';\n\n/**\n * ActiveSigner backed by a raw secret key held in memory.\n * The secret key never leaves this object — there is no getter for it.\n */\nexport class LocalSigner implements ActiveSigner {\n  readonly #secretKey: Uint8Array;\n\n  constructor(secretKey: Uint8Array) {\n    this.#secretKey = secretKey;\n  }\n\n  async getPublicKey(): Promise<string> {\n    return getPublicKey(this.#secretKey);\n  }\n\n  async signEvent(event: EventTemplate): Promise<NostrEvent> {\n    return finalizeEvent(event, this.#secretKey);\n  }\n\n  async nip04Encrypt(peerPubkey: string, plaintext: string): Promise<string> {\n    return nip04.encrypt(this.#secretKey, peerPubkey, plaintext);\n  }\n\n  async nip04Decrypt(peerPubkey: string, ciphertext: string): Promise<string> {\n    return nip04.decrypt(this.#secretKey, peerPubkey, ciphertext);\n  }\n\n  async nip44Encrypt(peerPubkey: string, plaintext: string): Promise<string> {\n    const key = nip44.v2.utils.getConversationKey(this.#secretKey, peerPubkey);\n    return nip44.v2.encrypt(plaintext, key);\n  }\n\n  async nip44Decrypt(peerPubkey: string, ciphertext: string): Promise<string> {\n    const key = nip44.v2.utils.getConversationKey(this.#secretKey, peerPubkey);\n    return nip44.v2.decrypt(ciphertext, key);\n  }\n}\n","import { generateSecretKey, getPublicKey, nip19 } from 'nostr-tools';\nimport { encrypt as nip49Encrypt, decrypt as nip49Decrypt } from 'nostr-tools/nip49';\n\nexport function encryptSecretKey(secretKey: Uint8Array, passphrase: string): string {\n  return nip49Encrypt(secretKey, passphrase);\n}\n\nexport function decryptNcryptsec(ncryptsec: string, passphrase: string): Uint8Array {\n  return nip49Decrypt(ncryptsec, passphrase);\n}\n\nexport interface GeneratedAccount {\n  secretKey: Uint8Array;\n  pubkey: string;\n  npub: string;\n  ncryptsec: string;\n}\n\nexport function generateAccount(passphrase: string): GeneratedAccount {\n  const secretKey = generateSecretKey();\n  const pubkey = getPublicKey(secretKey);\n  const npub = nip19.npubEncode(pubkey);\n  const ncryptsec = nip49Encrypt(secretKey, passphrase);\n  return { secretKey, pubkey, npub, ncryptsec };\n}\n","import type { Event as NostrEvent, EventTemplate } from 'nostr-tools';\nimport type { ActiveSigner } from './core/types.js';\n\nexport interface WindowNostr {\n  getPublicKey(): Promise<string>;\n  signEvent(event: EventTemplate): Promise<NostrEvent>;\n  getRelays?(): Promise<Record<string, { read: boolean; write: boolean }>>;\n  nip04?: {\n    encrypt(peerPubkey: string, plaintext: string): Promise<string>;\n    decrypt(peerPubkey: string, ciphertext: string): Promise<string>;\n  };\n  nip44?: {\n    encrypt(peerPubkey: string, plaintext: string): Promise<string>;\n    decrypt(peerPubkey: string, ciphertext: string): Promise<string>;\n  };\n}\n\nexport function getWindowNostr(): WindowNostr {\n  const nostr = (globalThis as { nostr?: WindowNostr }).nostr;\n  if (!nostr) {\n    throw new Error(\n      '@formstr/signer: NIP-07 extension not found (globalThis.nostr is undefined)',\n    );\n  }\n  return nostr;\n}\n\nexport class ExtensionSigner implements ActiveSigner {\n  async getPublicKey(): Promise<string> {\n    return getWindowNostr().getPublicKey();\n  }\n\n  async signEvent(event: EventTemplate): Promise<NostrEvent> {\n    return getWindowNostr().signEvent(event);\n  }\n\n  async nip04Encrypt(peerPubkey: string, plaintext: string): Promise<string> {\n    const ext = getWindowNostr();\n    if (!ext.nip04) throw new Error('NIP-07 extension does not expose nip04');\n    return ext.nip04.encrypt(peerPubkey, plaintext);\n  }\n\n  async nip04Decrypt(peerPubkey: string, ciphertext: string): Promise<string> {\n    const ext = getWindowNostr();\n    if (!ext.nip04) throw new Error('NIP-07 extension does not expose nip04');\n    return ext.nip04.decrypt(peerPubkey, ciphertext);\n  }\n\n  async nip44Encrypt(peerPubkey: string, plaintext: string): Promise<string> {\n    const ext = getWindowNostr();\n    if (!ext.nip44) throw new Error('NIP-07 extension does not expose nip44');\n    return ext.nip44.encrypt(peerPubkey, plaintext);\n  }\n\n  async nip44Decrypt(peerPubkey: string, ciphertext: string): Promise<string> {\n    const ext = getWindowNostr();\n    if (!ext.nip44) throw new Error('NIP-07 extension does not expose nip44');\n    return ext.nip44.decrypt(peerPubkey, ciphertext);\n  }\n}\n","import { generateSecretKey, getPublicKey } from 'nostr-tools';\nimport {\n  BunkerSigner as ToolsBunkerSigner,\n  createNostrConnectURI,\n  parseBunkerInput,\n  type BunkerPointer,\n} from 'nostr-tools/nip46';\nimport type { AbstractSimplePool } from 'nostr-tools/abstract-pool';\nimport type { Event as NostrEvent, EventTemplate } from 'nostr-tools';\nimport type { ActiveSigner, RelayMismatchHandler } from './core/types.js';\n\nexport type { BunkerPointer };\n\n/**\n * Thin wrapper around nostr-tools' BunkerSigner that exposes only the\n * ActiveSigner surface. We keep this layer so callers depend on a stable\n * interface even if we ever swap the underlying implementation.\n */\nexport class BunkerSigner implements ActiveSigner {\n  readonly #delegate: ToolsBunkerSigner;\n\n  constructor(delegate: ToolsBunkerSigner) {\n    this.#delegate = delegate;\n  }\n\n  getPublicKey(): Promise<string> {\n    return this.#delegate.getPublicKey();\n  }\n  signEvent(event: EventTemplate): Promise<NostrEvent> {\n    return this.#delegate.signEvent(event);\n  }\n  nip04Encrypt(peerPubkey: string, plaintext: string): Promise<string> {\n    return this.#delegate.nip04Encrypt(peerPubkey, plaintext);\n  }\n  nip04Decrypt(peerPubkey: string, ciphertext: string): Promise<string> {\n    return this.#delegate.nip04Decrypt(peerPubkey, ciphertext);\n  }\n  nip44Encrypt(peerPubkey: string, plaintext: string): Promise<string> {\n    return this.#delegate.nip44Encrypt(peerPubkey, plaintext);\n  }\n  nip44Decrypt(peerPubkey: string, ciphertext: string): Promise<string> {\n    return this.#delegate.nip44Decrypt(peerPubkey, ciphertext);\n  }\n  async close(): Promise<void> {\n    return this.#delegate.close();\n  }\n}\n\nexport interface BunkerLoginOptions {\n  /** Custom pool, e.g. for tests. Defaults to a new SimplePool inside nostr-tools. */\n  pool?: AbstractSimplePool;\n  /** Called when the remote signer needs the user to visit an auth URL. */\n  onAuth?: (url: string) => void;\n  /** Optional client session keypair (hex bytes). Auto-generated if omitted. */\n  clientSecretKey?: Uint8Array;\n  /** Notified when the bunker's preferred relays differ from the URI's. */\n  onRelayMismatch?: RelayMismatchHandler;\n  /**\n   * NIP-46 permissions to request as the 3rd `connect` param\n   * (e.g. `['sign_event:1', 'nip44_encrypt']`). When omitted, the\n   * connect request carries no perms — bunker UIs may then skip the\n   * approval prompt entirely, leaving the user with nothing to tap.\n   */\n  perms?: string[];\n}\n\nasync function fetchBunkerRelays(tools: ToolsBunkerSigner): Promise<string[] | null> {\n  try {\n    const resp = await tools.sendRequest('get_relays', []);\n    const parsed = JSON.parse(resp) as unknown;\n    if (Array.isArray(parsed)) {\n      return parsed.filter((r): r is string => typeof r === 'string');\n    }\n    if (typeof parsed === 'object' && parsed !== null) {\n      return Object.keys(parsed as Record<string, unknown>);\n    }\n    return null;\n  } catch {\n    return null;\n  }\n}\n\nfunction relayListsMatch(a: string[], b: string[]): boolean {\n  if (a.length !== b.length) return false;\n  const sa = [...a].sort();\n  const sb = [...b].sort();\n  for (let i = 0; i < sa.length; i++) if (sa[i] !== sb[i]) return false;\n  return true;\n}\n\nasync function resolveRelayChoice(\n  tools: ToolsBunkerSigner,\n  userRelays: string[],\n  onRelayMismatch: RelayMismatchHandler | undefined,\n): Promise<string[]> {\n  if (!onRelayMismatch) return userRelays;\n  const bunkerRelays = await fetchBunkerRelays(tools);\n  if (!bunkerRelays || relayListsMatch(userRelays, bunkerRelays)) return userRelays;\n  const accept = await onRelayMismatch({ userRelays, bunkerRelays });\n  return accept ? bunkerRelays : userRelays;\n}\n\nexport interface BunkerConnectResult {\n  signer: BunkerSigner;\n  pubkey: string;\n  pointer: BunkerPointer;\n  clientSecretKey: Uint8Array;\n}\n\n/**\n * Connect to a remote signer via a bunker:// URI (or a NIP-05 identifier).\n * Relays come from the URI — there is no fallback default list.\n */\nexport async function connectWithBunkerUri(\n  uri: string,\n  options: BunkerLoginOptions = {},\n): Promise<BunkerConnectResult> {\n  const pointer = await parseBunkerInput(uri);\n  if (!pointer) {\n    throw new Error('@formstr/signer: invalid bunker URI');\n  }\n  if (!pointer.relays?.length) {\n    throw new Error('@formstr/signer: bunker URI must include at least one relay');\n  }\n  const clientSecretKey = options.clientSecretKey ?? generateSecretKey();\n  const tools = ToolsBunkerSigner.fromBunker(clientSecretKey, pointer, {\n    pool: options.pool,\n    onauth: options.onAuth,\n  });\n  // nostr-tools' BunkerSigner.connect() hardcodes only [pubkey, secret],\n  // dropping the optional 3rd `perms` arg defined by NIP-46. Without it\n  // bunker UIs (Amber, etc.) have no permissions to authorize and may\n  // skip the approval prompt entirely. We send the request directly.\n  await tools.sendRequest('connect', [\n    pointer.pubkey,\n    pointer.secret ?? '',\n    (options.perms ?? []).join(','),\n  ]);\n  const pubkey = await tools.getPublicKey();\n  const resolvedRelays = await resolveRelayChoice(\n    tools,\n    pointer.relays,\n    options.onRelayMismatch,\n  );\n  return {\n    signer: new BunkerSigner(tools),\n    pubkey,\n    pointer: { ...pointer, relays: resolvedRelays },\n    clientSecretKey,\n  };\n}\n\nexport interface NostrConnectInitOptions {\n  /** User-supplied relays. The whole point of the strict-relay rule. */\n  relays: string[];\n  metadata?: { name?: string; url?: string; image?: string };\n  /** Permissions to request (NIP-46 perms list, e.g. [\"sign_event:1\",\"nip44_encrypt\"]). */\n  perms?: string[];\n  pool?: AbstractSimplePool;\n  onAuth?: (url: string) => void;\n  /** Override the auto-generated client session keypair. */\n  clientSecretKey?: Uint8Array;\n  /** Override the auto-generated URI secret. */\n  secret?: string;\n  /** Abort the pairing wait. */\n  signal?: AbortSignal;\n  /** Max wait for pairing in ms (default 5 minutes). */\n  timeoutMs?: number;\n  /** Notified when the bunker's preferred relays differ from the user's. */\n  onRelayMismatch?: RelayMismatchHandler;\n}\n\nexport interface NostrConnectInitiation {\n  uri: string;\n  clientPubkey: string;\n  complete: Promise<BunkerConnectResult>;\n}\n\n/**\n * Generate a nostrconnect:// URI and wait for the remote signer to pair.\n * The caller displays the URI (typically as a QR code), and the returned\n * `complete` promise resolves once the signer connects back.\n */\nexport function initiateNostrConnect(options: NostrConnectInitOptions): NostrConnectInitiation {\n  if (options.relays.length === 0) {\n    throw new Error('@formstr/signer: at least one relay is required for nostrconnect');\n  }\n  const clientSecretKey = options.clientSecretKey ?? generateSecretKey();\n  const clientPubkey = getPublicKey(clientSecretKey);\n  const secret = options.secret ?? Math.random().toString(36).slice(2);\n  const uri = createNostrConnectURI({\n    clientPubkey,\n    relays: options.relays,\n    secret,\n    perms: options.perms,\n    name: options.metadata?.name,\n    url: options.metadata?.url,\n    image: options.metadata?.image,\n  });\n  const maxWaitOrAbort: number | AbortSignal =\n    options.signal ?? options.timeoutMs ?? 300_000;\n  // skipSwitchRelays:true — keep the caller-supplied relays authoritative,\n  // never silently swap to whatever the bunker prefers.\n  const complete = ToolsBunkerSigner.fromURI(\n    clientSecretKey,\n    uri,\n    { pool: options.pool, onauth: options.onAuth, skipSwitchRelays: true },\n    maxWaitOrAbort,\n  ).then(async (tools) => {\n    const pubkey = await tools.getPublicKey();\n    const resolvedRelays = await resolveRelayChoice(\n      tools,\n      options.relays,\n      options.onRelayMismatch,\n    );\n    return {\n      signer: new BunkerSigner(tools),\n      pubkey,\n      pointer: { ...tools.bp, relays: resolvedRelays },\n      clientSecretKey,\n    };\n  });\n  return { uri, clientPubkey, complete };\n}\n\nconst hexAlphabet = '0123456789abcdef';\n\nexport function bytesToHex(bytes: Uint8Array): string {\n  let s = '';\n  for (const b of bytes) s += hexAlphabet[b >> 4] + hexAlphabet[b & 0xf];\n  return s;\n}\n\nexport function hexToBytes(hex: string): Uint8Array {\n  if (hex.length % 2 !== 0) throw new Error('hexToBytes: odd-length hex string');\n  const out = new Uint8Array(hex.length / 2);\n  for (let i = 0; i < out.length; i++) {\n    out[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);\n  }\n  return out;\n}\n","import { getEventHash, nip19, type Event as NostrEvent, type EventTemplate } from 'nostr-tools';\nimport type { ActiveSigner } from './core/types.js';\n\n/**\n * Subset of `nostr-signer-capacitor-plugin`'s exported `NostrSignerPlugin`\n * that we depend on. Signatures intentionally mirror that library\n * (positional args, per-call `packageName`) so the real plugin is\n * structurally assignable here — and any mock written against this\n * interface is a faithful stand-in. The conformance is enforced by a\n * compile-time guard in `tests/helpers/mockAndroidPlugin.ts`.\n */\nexport interface AndroidSignerAppInfo {\n  name: string;\n  packageName: string;\n  iconUrl?: string;\n}\n\nexport interface AndroidSignerPlugin {\n  setPackageName(packageName: string): Promise<void>;\n  getInstalledSignerApps(): Promise<{ apps: AndroidSignerAppInfo[] }>;\n  getPublicKey(\n    packageName?: string,\n    permissions?: string,\n  ): Promise<{ npub: string; package: string }>;\n  signEvent(\n    packageName: string,\n    eventJson: string,\n    id: string,\n    npub: string,\n  ): Promise<{ signature: string; id: string; event: string }>;\n  nip04Encrypt(\n    packageName: string,\n    plainText: string,\n    id: string,\n    pubKey: string,\n    npub: string,\n  ): Promise<{ result: string; id: string }>;\n  nip04Decrypt(\n    packageName: string,\n    encryptedText: string,\n    id: string,\n    pubKey: string,\n    npub: string,\n  ): Promise<{ result: string; id: string }>;\n  nip44Encrypt(\n    packageName: string,\n    plainText: string,\n    id: string,\n    pubKey: string,\n    npub: string,\n  ): Promise<{ result: string; id: string }>;\n  nip44Decrypt(\n    packageName: string,\n    encryptedText: string,\n    id: string,\n    pubKey: string,\n    npub: string,\n  ): Promise<{ result: string; id: string }>;\n}\n\nexport interface AndroidLoginOptions {\n  /** The Android package name of the external signer app (e.g. com.greenart7c3.nostrsigner). */\n  packageName?: string;\n  /** Override the plugin for this call. Falls back to SignerConfig.androidSignerPlugin. */\n  plugin?: AndroidSignerPlugin;\n}\n\nexport class AndroidSigner implements ActiveSigner {\n  readonly #plugin: AndroidSignerPlugin;\n  readonly #packageName: string;\n  readonly #npub: string;\n  readonly #pubkey: string;\n\n  constructor(\n    plugin: AndroidSignerPlugin,\n    packageName: string,\n    npub: string,\n    pubkey: string,\n  ) {\n    this.#plugin = plugin;\n    this.#packageName = packageName;\n    this.#npub = npub;\n    this.#pubkey = pubkey;\n  }\n\n  async getPublicKey(): Promise<string> {\n    return this.#pubkey;\n  }\n\n  async signEvent(event: EventTemplate): Promise<NostrEvent> {\n    const unsigned = { ...event, pubkey: this.#pubkey };\n    const eventId = getEventHash(unsigned);\n    const result = await this.#plugin.signEvent(\n      this.#packageName,\n      JSON.stringify(unsigned),\n      eventId,\n      this.#npub,\n    );\n    return JSON.parse(result.event) as NostrEvent;\n  }\n\n  async nip04Encrypt(peerPubkey: string, plaintext: string): Promise<string> {\n    const { result } = await this.#plugin.nip04Encrypt(\n      this.#packageName,\n      plaintext,\n      '',\n      peerPubkey,\n      this.#npub,\n    );\n    return result;\n  }\n\n  async nip04Decrypt(peerPubkey: string, ciphertext: string): Promise<string> {\n    const { result } = await this.#plugin.nip04Decrypt(\n      this.#packageName,\n      ciphertext,\n      '',\n      peerPubkey,\n      this.#npub,\n    );\n    return result;\n  }\n\n  async nip44Encrypt(peerPubkey: string, plaintext: string): Promise<string> {\n    const { result } = await this.#plugin.nip44Encrypt(\n      this.#packageName,\n      plaintext,\n      '',\n      peerPubkey,\n      this.#npub,\n    );\n    return result;\n  }\n\n  async nip44Decrypt(peerPubkey: string, ciphertext: string): Promise<string> {\n    const { result } = await this.#plugin.nip44Decrypt(\n      this.#packageName,\n      ciphertext,\n      '',\n      peerPubkey,\n      this.#npub,\n    );\n    return result;\n  }\n}\n\nexport interface AndroidLoginResult {\n  signer: AndroidSigner;\n  pubkey: string;\n  npub: string;\n  packageName: string;\n}\n\nexport async function loginWithAndroidSigner(\n  plugin: AndroidSignerPlugin,\n  packageName?: string,\n): Promise<AndroidLoginResult> {\n  if (packageName) {\n    await plugin.setPackageName(packageName);\n  }\n  const { npub, package: pluginPackage } = await plugin.getPublicKey(packageName);\n  const resolvedPackage = pluginPackage || packageName;\n  if (!resolvedPackage) {\n    throw new Error(\n      '@formstr/signer: android signer did not return a package name and none was supplied',\n    );\n  }\n  const decoded = nip19.decode(npub);\n  if (decoded.type !== 'npub') {\n    throw new Error('@formstr/signer: android signer returned a non-npub identifier');\n  }\n  return {\n    signer: new AndroidSigner(plugin, resolvedPackage, npub, decoded.data),\n    pubkey: decoded.data,\n    npub,\n    packageName: resolvedPackage,\n  };\n}\n"],"mappings":";AAAA,SAAS,gBAAAA,eAAc,SAAAC,cAAa;;;ACMpC,IAAM,iBAAiB;AAEhB,SAAS,oBAAoB,SAAiB,gBAAgC;AACnF,QAAM,KAAK,MAAsB;AAC/B,QAAI;AACF,aAAO,OAAO,eAAe,eAAe,WAAW,eACnD,WAAW,eACX;AAAA,IACN,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AAAA,IACL,IAAI,KAAK;AACP,UAAI;AACF,eAAO,GAAG,GAAG,QAAQ,SAAS,GAAG,KAAK;AAAA,MACxC,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IACF;AAAA,IACA,IAAI,KAAK,OAAO;AACd,UAAI;AACF,WAAG,GAAG,QAAQ,SAAS,KAAK,KAAK;AAAA,MACnC,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,IACA,OAAO,KAAK;AACV,UAAI;AACF,WAAG,GAAG,WAAW,SAAS,GAAG;AAAA,MAC/B,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AACF;;;ACzCA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAGK;AAOA,IAAM,cAAN,MAA0C;AAAA,EACtC;AAAA,EAET,YAAY,WAAuB;AACjC,SAAK,aAAa;AAAA,EACpB;AAAA,EAEA,MAAM,eAAgC;AACpC,WAAO,aAAa,KAAK,UAAU;AAAA,EACrC;AAAA,EAEA,MAAM,UAAU,OAA2C;AACzD,WAAO,cAAc,OAAO,KAAK,UAAU;AAAA,EAC7C;AAAA,EAEA,MAAM,aAAa,YAAoB,WAAoC;AACzE,WAAO,MAAM,QAAQ,KAAK,YAAY,YAAY,SAAS;AAAA,EAC7D;AAAA,EAEA,MAAM,aAAa,YAAoB,YAAqC;AAC1E,WAAO,MAAM,QAAQ,KAAK,YAAY,YAAY,UAAU;AAAA,EAC9D;AAAA,EAEA,MAAM,aAAa,YAAoB,WAAoC;AACzE,UAAM,MAAM,MAAM,GAAG,MAAM,mBAAmB,KAAK,YAAY,UAAU;AACzE,WAAO,MAAM,GAAG,QAAQ,WAAW,GAAG;AAAA,EACxC;AAAA,EAEA,MAAM,aAAa,YAAoB,YAAqC;AAC1E,UAAM,MAAM,MAAM,GAAG,MAAM,mBAAmB,KAAK,YAAY,UAAU;AACzE,WAAO,MAAM,GAAG,QAAQ,YAAY,GAAG;AAAA,EACzC;AACF;;;AC9CA,SAAS,mBAAmB,gBAAAC,eAAc,aAAa;AACvD,SAAS,WAAW,cAAc,WAAW,oBAAoB;AAE1D,SAAS,iBAAiB,WAAuB,YAA4B;AAClF,SAAO,aAAa,WAAW,UAAU;AAC3C;AAEO,SAAS,iBAAiB,WAAmB,YAAgC;AAClF,SAAO,aAAa,WAAW,UAAU;AAC3C;AASO,SAAS,gBAAgB,YAAsC;AACpE,QAAM,YAAY,kBAAkB;AACpC,QAAM,SAASA,cAAa,SAAS;AACrC,QAAM,OAAO,MAAM,WAAW,MAAM;AACpC,QAAM,YAAY,aAAa,WAAW,UAAU;AACpD,SAAO,EAAE,WAAW,QAAQ,MAAM,UAAU;AAC9C;;;ACPO,SAAS,iBAA8B;AAC5C,QAAM,QAAS,WAAuC;AACtD,MAAI,CAAC,OAAO;AACV,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEO,IAAM,kBAAN,MAA8C;AAAA,EACnD,MAAM,eAAgC;AACpC,WAAO,eAAe,EAAE,aAAa;AAAA,EACvC;AAAA,EAEA,MAAM,UAAU,OAA2C;AACzD,WAAO,eAAe,EAAE,UAAU,KAAK;AAAA,EACzC;AAAA,EAEA,MAAM,aAAa,YAAoB,WAAoC;AACzE,UAAM,MAAM,eAAe;AAC3B,QAAI,CAAC,IAAI,MAAO,OAAM,IAAI,MAAM,wCAAwC;AACxE,WAAO,IAAI,MAAM,QAAQ,YAAY,SAAS;AAAA,EAChD;AAAA,EAEA,MAAM,aAAa,YAAoB,YAAqC;AAC1E,UAAM,MAAM,eAAe;AAC3B,QAAI,CAAC,IAAI,MAAO,OAAM,IAAI,MAAM,wCAAwC;AACxE,WAAO,IAAI,MAAM,QAAQ,YAAY,UAAU;AAAA,EACjD;AAAA,EAEA,MAAM,aAAa,YAAoB,WAAoC;AACzE,UAAM,MAAM,eAAe;AAC3B,QAAI,CAAC,IAAI,MAAO,OAAM,IAAI,MAAM,wCAAwC;AACxE,WAAO,IAAI,MAAM,QAAQ,YAAY,SAAS;AAAA,EAChD;AAAA,EAEA,MAAM,aAAa,YAAoB,YAAqC;AAC1E,UAAM,MAAM,eAAe;AAC3B,QAAI,CAAC,IAAI,MAAO,OAAM,IAAI,MAAM,wCAAwC;AACxE,WAAO,IAAI,MAAM,QAAQ,YAAY,UAAU;AAAA,EACjD;AACF;;;AC3DA,SAAS,qBAAAC,oBAAmB,gBAAAC,qBAAoB;AAChD;AAAA,EACE,gBAAgB;AAAA,EAChB;AAAA,EACA;AAAA,OAEK;AAYA,IAAM,eAAN,MAA2C;AAAA,EACvC;AAAA,EAET,YAAY,UAA6B;AACvC,SAAK,YAAY;AAAA,EACnB;AAAA,EAEA,eAAgC;AAC9B,WAAO,KAAK,UAAU,aAAa;AAAA,EACrC;AAAA,EACA,UAAU,OAA2C;AACnD,WAAO,KAAK,UAAU,UAAU,KAAK;AAAA,EACvC;AAAA,EACA,aAAa,YAAoB,WAAoC;AACnE,WAAO,KAAK,UAAU,aAAa,YAAY,SAAS;AAAA,EAC1D;AAAA,EACA,aAAa,YAAoB,YAAqC;AACpE,WAAO,KAAK,UAAU,aAAa,YAAY,UAAU;AAAA,EAC3D;AAAA,EACA,aAAa,YAAoB,WAAoC;AACnE,WAAO,KAAK,UAAU,aAAa,YAAY,SAAS;AAAA,EAC1D;AAAA,EACA,aAAa,YAAoB,YAAqC;AACpE,WAAO,KAAK,UAAU,aAAa,YAAY,UAAU;AAAA,EAC3D;AAAA,EACA,MAAM,QAAuB;AAC3B,WAAO,KAAK,UAAU,MAAM;AAAA,EAC9B;AACF;AAoBA,eAAe,kBAAkB,OAAoD;AACnF,MAAI;AACF,UAAM,OAAO,MAAM,MAAM,YAAY,cAAc,CAAC,CAAC;AACrD,UAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,QAAI,MAAM,QAAQ,MAAM,GAAG;AACzB,aAAO,OAAO,OAAO,CAAC,MAAmB,OAAO,MAAM,QAAQ;AAAA,IAChE;AACA,QAAI,OAAO,WAAW,YAAY,WAAW,MAAM;AACjD,aAAO,OAAO,KAAK,MAAiC;AAAA,IACtD;AACA,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,gBAAgB,GAAa,GAAsB;AAC1D,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,QAAM,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK;AACvB,QAAM,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK;AACvB,WAAS,IAAI,GAAG,IAAI,GAAG,QAAQ,IAAK,KAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAG,QAAO;AAChE,SAAO;AACT;AAEA,eAAe,mBACb,OACA,YACA,iBACmB;AACnB,MAAI,CAAC,gBAAiB,QAAO;AAC7B,QAAM,eAAe,MAAM,kBAAkB,KAAK;AAClD,MAAI,CAAC,gBAAgB,gBAAgB,YAAY,YAAY,EAAG,QAAO;AACvE,QAAM,SAAS,MAAM,gBAAgB,EAAE,YAAY,aAAa,CAAC;AACjE,SAAO,SAAS,eAAe;AACjC;AAaA,eAAsB,qBACpB,KACA,UAA8B,CAAC,GACD;AAC9B,QAAM,UAAU,MAAM,iBAAiB,GAAG;AAC1C,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,MAAM,qCAAqC;AAAA,EACvD;AACA,MAAI,CAAC,QAAQ,QAAQ,QAAQ;AAC3B,UAAM,IAAI,MAAM,6DAA6D;AAAA,EAC/E;AACA,QAAM,kBAAkB,QAAQ,mBAAmBD,mBAAkB;AACrE,QAAM,QAAQ,kBAAkB,WAAW,iBAAiB,SAAS;AAAA,IACnE,MAAM,QAAQ;AAAA,IACd,QAAQ,QAAQ;AAAA,EAClB,CAAC;AAKD,QAAM,MAAM,YAAY,WAAW;AAAA,IACjC,QAAQ;AAAA,IACR,QAAQ,UAAU;AAAA,KACjB,QAAQ,SAAS,CAAC,GAAG,KAAK,GAAG;AAAA,EAChC,CAAC;AACD,QAAM,SAAS,MAAM,MAAM,aAAa;AACxC,QAAM,iBAAiB,MAAM;AAAA,IAC3B;AAAA,IACA,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AACA,SAAO;AAAA,IACL,QAAQ,IAAI,aAAa,KAAK;AAAA,IAC9B;AAAA,IACA,SAAS,EAAE,GAAG,SAAS,QAAQ,eAAe;AAAA,IAC9C;AAAA,EACF;AACF;AAiCO,SAAS,qBAAqB,SAA0D;AAC7F,MAAI,QAAQ,OAAO,WAAW,GAAG;AAC/B,UAAM,IAAI,MAAM,kEAAkE;AAAA,EACpF;AACA,QAAM,kBAAkB,QAAQ,mBAAmBA,mBAAkB;AACrE,QAAM,eAAeC,cAAa,eAAe;AACjD,QAAM,SAAS,QAAQ,UAAU,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,CAAC;AACnE,QAAM,MAAM,sBAAsB;AAAA,IAChC;AAAA,IACA,QAAQ,QAAQ;AAAA,IAChB;AAAA,IACA,OAAO,QAAQ;AAAA,IACf,MAAM,QAAQ,UAAU;AAAA,IACxB,KAAK,QAAQ,UAAU;AAAA,IACvB,OAAO,QAAQ,UAAU;AAAA,EAC3B,CAAC;AACD,QAAM,iBACJ,QAAQ,UAAU,QAAQ,aAAa;AAGzC,QAAM,WAAW,kBAAkB;AAAA,IACjC;AAAA,IACA;AAAA,IACA,EAAE,MAAM,QAAQ,MAAM,QAAQ,QAAQ,QAAQ,kBAAkB,KAAK;AAAA,IACrE;AAAA,EACF,EAAE,KAAK,OAAO,UAAU;AACtB,UAAM,SAAS,MAAM,MAAM,aAAa;AACxC,UAAM,iBAAiB,MAAM;AAAA,MAC3B;AAAA,MACA,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AACA,WAAO;AAAA,MACL,QAAQ,IAAI,aAAa,KAAK;AAAA,MAC9B;AAAA,MACA,SAAS,EAAE,GAAG,MAAM,IAAI,QAAQ,eAAe;AAAA,MAC/C;AAAA,IACF;AAAA,EACF,CAAC;AACD,SAAO,EAAE,KAAK,cAAc,SAAS;AACvC;AAEA,IAAM,cAAc;AAEb,SAAS,WAAW,OAA2B;AACpD,MAAI,IAAI;AACR,aAAW,KAAK,MAAO,MAAK,YAAY,KAAK,CAAC,IAAI,YAAY,IAAI,EAAG;AACrE,SAAO;AACT;AAEO,SAAS,WAAW,KAAyB;AAClD,MAAI,IAAI,SAAS,MAAM,EAAG,OAAM,IAAI,MAAM,mCAAmC;AAC7E,QAAM,MAAM,IAAI,WAAW,IAAI,SAAS,CAAC;AACzC,WAAS,IAAI,GAAG,IAAI,IAAI,QAAQ,KAAK;AACnC,QAAI,CAAC,IAAI,SAAS,IAAI,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE;AAAA,EACnD;AACA,SAAO;AACT;;;AChPA,SAAS,cAAc,SAAAC,cAA2D;AAmE3E,IAAM,gBAAN,MAA4C;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,YACE,QACA,aACA,MACA,QACA;AACA,SAAK,UAAU;AACf,SAAK,eAAe;AACpB,SAAK,QAAQ;AACb,SAAK,UAAU;AAAA,EACjB;AAAA,EAEA,MAAM,eAAgC;AACpC,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,MAAM,UAAU,OAA2C;AACzD,UAAM,WAAW,EAAE,GAAG,OAAO,QAAQ,KAAK,QAAQ;AAClD,UAAM,UAAU,aAAa,QAAQ;AACrC,UAAM,SAAS,MAAM,KAAK,QAAQ;AAAA,MAChC,KAAK;AAAA,MACL,KAAK,UAAU,QAAQ;AAAA,MACvB;AAAA,MACA,KAAK;AAAA,IACP;AACA,WAAO,KAAK,MAAM,OAAO,KAAK;AAAA,EAChC;AAAA,EAEA,MAAM,aAAa,YAAoB,WAAoC;AACzE,UAAM,EAAE,OAAO,IAAI,MAAM,KAAK,QAAQ;AAAA,MACpC,KAAK;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA,KAAK;AAAA,IACP;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,aAAa,YAAoB,YAAqC;AAC1E,UAAM,EAAE,OAAO,IAAI,MAAM,KAAK,QAAQ;AAAA,MACpC,KAAK;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA,KAAK;AAAA,IACP;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,aAAa,YAAoB,WAAoC;AACzE,UAAM,EAAE,OAAO,IAAI,MAAM,KAAK,QAAQ;AAAA,MACpC,KAAK;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA,KAAK;AAAA,IACP;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,aAAa,YAAoB,YAAqC;AAC1E,UAAM,EAAE,OAAO,IAAI,MAAM,KAAK,QAAQ;AAAA,MACpC,KAAK;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA,KAAK;AAAA,IACP;AACA,WAAO;AAAA,EACT;AACF;AASA,eAAsB,uBACpB,QACA,aAC6B;AAC7B,MAAI,aAAa;AACf,UAAM,OAAO,eAAe,WAAW;AAAA,EACzC;AACA,QAAM,EAAE,MAAM,SAAS,cAAc,IAAI,MAAM,OAAO,aAAa,WAAW;AAC9E,QAAM,kBAAkB,iBAAiB;AACzC,MAAI,CAAC,iBAAiB;AACpB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,UAAUA,OAAM,OAAO,IAAI;AACjC,MAAI,QAAQ,SAAS,QAAQ;AAC3B,UAAM,IAAI,MAAM,gEAAgE;AAAA,EAClF;AACA,SAAO;AAAA,IACL,QAAQ,IAAI,cAAc,QAAQ,iBAAiB,MAAM,QAAQ,IAAI;AAAA,IACrE,QAAQ,QAAQ;AAAA,IAChB;AAAA,IACA,aAAa;AAAA,EACf;AACF;;;AN5JA,IAAM,eAAe;AACrB,IAAM,aAAa;AAoBZ,IAAM,SAAN,MAAa;AAAA,EACT;AAAA,EACA;AAAA,EACA;AAAA,EACT,YAA6B,CAAC;AAAA,EAC9B,gBAA+B;AAAA,EAC/B,gBAAqC;AAAA,EACrC,aAAa,oBAAI,IAAkC;AAAA,EAEnD,YAAY,SAAuB,CAAC,GAAG;AACrC,SAAK,WAAW,OAAO,WAAW,oBAAoB,OAAO,gBAAgB;AAC7E,SAAK,wBAAwB,OAAO;AACpC,SAAK,eAAe;AAAA,MAClB,MAAM,OAAO;AAAA,MACb,KAAK,OAAO;AAAA,MACZ,OAAO,OAAO;AAAA,IAChB;AACA,SAAK,SAAS;AAAA,EAChB;AAAA,EAEA,WAAiB;AACf,QAAI;AACF,YAAM,MAAM,KAAK,SAAS,IAAI,YAAY;AAC1C,UAAI,KAAK;AACP,cAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,YAAI,MAAM,QAAQ,MAAM,EAAG,MAAK,YAAY;AAAA,MAC9C;AACA,WAAK,gBAAgB,KAAK,SAAS,IAAI,UAAU;AAAA,IACnD,QAAQ;AACN,WAAK,YAAY,CAAC;AAClB,WAAK,gBAAgB;AAAA,IACvB;AAAA,EACF;AAAA,EAEA,mBAAyB;AACvB,SAAK,SAAS,IAAI,cAAc,KAAK,UAAU,KAAK,SAAS,CAAC;AAAA,EAChE;AAAA,EAEA,iBAAuB;AACrB,QAAI,KAAK,cAAe,MAAK,SAAS,IAAI,YAAY,KAAK,aAAa;AAAA,QACnE,MAAK,SAAS,OAAO,UAAU;AAAA,EACtC;AAAA,EAEA,eAAe,SAA8B;AAC3C,UAAM,MAAM,KAAK,UAAU,UAAU,OAAK,EAAE,WAAW,QAAQ,MAAM;AACrE,QAAI,OAAO,EAAG,MAAK,UAAU,GAAG,IAAI;AAAA,QAC/B,MAAK,UAAU,KAAK,OAAO;AAChC,SAAK,iBAAiB;AAAA,EACxB;AAAA,EAEA,WAAW,SAAwB,QAA4B;AAC7D,UAAM,eAAe,KAAK,kBAAkB,QAAQ,KAAK,kBAAkB,QAAQ;AACnF,SAAK,gBAAgB,QAAQ;AAC7B,SAAK,gBAAgB;AACrB,SAAK,eAAe;AACpB,SAAK,MAAM,EAAE,MAAM,eAAe,WAAW,SAAS,QAAQ,CAAC;AAAA,EACjE;AAAA,EAEA,MAAM,OAA0B;AAC9B,eAAW,MAAM,KAAK,YAAY;AAChC,UAAI;AACF,WAAG,KAAK;AAAA,MACV,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,cAAc,YAAkE;AACpF,QAAI,CAAC,WAAY,OAAM,IAAI,MAAM,oCAAoC;AACrE,UAAM,EAAE,WAAW,QAAQ,MAAM,UAAU,IAAI,gBAAgB,UAAU;AACzE,UAAM,UAAyB,EAAE,MAAM,QAAQ,QAAQ,aAAa,UAAU;AAC9E,SAAK,eAAe,OAAO;AAC3B,SAAK,WAAW,SAAS,IAAI,YAAY,SAAS,CAAC;AACnD,WAAO,EAAE,MAAM,UAAU;AAAA,EAC3B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,mBAAmB,WAAmB,YAA4C;AACtF,QAAI,CAAC,UAAW,OAAM,IAAI,MAAM,wCAAwC;AACxE,QAAI,CAAC,WAAY,OAAM,IAAI,MAAM,yCAAyC;AAC1E,UAAM,YAAY,iBAAiB,WAAW,UAAU;AACxD,UAAM,SAASC,cAAa,SAAS;AACrC,UAAM,OAAOC,OAAM,WAAW,MAAM;AACpC,UAAM,UAAyB,EAAE,MAAM,QAAQ,QAAQ,aAAa,UAAU;AAC9E,SAAK,eAAe,OAAO;AAC3B,SAAK,WAAW,SAAS,IAAI,YAAY,SAAS,CAAC;AACnD,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,qBAA6C;AACjD,UAAM,YAAY,IAAI,gBAAgB;AACtC,UAAM,SAAS,MAAM,UAAU,aAAa;AAC5C,UAAM,OAAOA,OAAM,WAAW,MAAM;AACpC,UAAM,UAAyB,EAAE,MAAM,QAAQ,QAAQ,YAAY;AACnE,SAAK,eAAe,OAAO;AAC3B,SAAK,WAAW,SAAS,SAAS;AAClC,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,mBACJ,KACA,UAA8B,CAAC,GACP;AACxB,UAAM,SAAS,MAAM,qBAAqB,KAAK,OAAO;AACtD,UAAM,OAAOA,OAAM,WAAW,OAAO,MAAM;AAC3C,UAAM,UAAyB;AAAA,MAC7B;AAAA,MACA,QAAQ,OAAO;AAAA,MACf,QAAQ;AAAA,MACR,OAAO;AAAA,QACL;AAAA,QACA,oBAAoB,OAAO,QAAQ;AAAA,QACnC,QAAQ,OAAO,QAAQ;AAAA,QACvB,iBAAiB,WAAW,OAAO,eAAe;AAAA,MACpD;AAAA,IACF;AACA,SAAK,eAAe,OAAO;AAC3B,SAAK,WAAW,SAAS,OAAO,MAAM;AACtC,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,sBAAsB,SAAsD;AAChF,QAAI,QAAQ,OAAO,WAAW,GAAG;AAC/B,YAAM,IAAI,MAAM,oDAAoD;AAAA,IACtE;AAMA,UAAM,WAAW;AAAA,MACf,MAAM,QAAQ,UAAU,QAAQ,KAAK,aAAa;AAAA,MAClD,KAAK,QAAQ,UAAU,OAAO,KAAK,aAAa;AAAA,MAChD,OAAO,QAAQ,UAAU,SAAS,KAAK,aAAa;AAAA,IACtD;AACA,QAAI,CAAC,SAAS,MAAM;AAClB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,OAAO,qBAAqB;AAAA,MAChC,QAAQ,QAAQ;AAAA,MAChB;AAAA,MACA,OAAO,QAAQ;AAAA,MACf,MAAM,QAAQ;AAAA,MACd,QAAQ,QAAQ;AAAA,MAChB,QAAQ,QAAQ;AAAA,MAChB,WAAW,QAAQ;AAAA,MACnB,iBAAiB,QAAQ;AAAA,IAC3B,CAAC;AACD,YAAQ,MAAM,KAAK,GAAG;AACtB,UAAM,SAAS,MAAM,KAAK;AAC1B,UAAM,OAAOA,OAAM,WAAW,OAAO,MAAM;AAC3C,UAAM,UAAyB;AAAA,MAC7B;AAAA,MACA,QAAQ,OAAO;AAAA,MACf,QAAQ;AAAA,MACR,OAAO;AAAA,QACL,KAAK,KAAK;AAAA,QACV,oBAAoB,OAAO,QAAQ;AAAA,QACnC,QAAQ,OAAO,QAAQ;AAAA,QACvB,iBAAiB,WAAW,OAAO,eAAe;AAAA,MACpD;AAAA,IACF;AACA,SAAK,eAAe,OAAO;AAC3B,SAAK,WAAW,SAAS,OAAO,MAAM;AACtC,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,sBACJ,QACiC;AACjC,UAAM,IAAI,UAAU,KAAK;AACzB,QAAI,CAAC,GAAG;AACN,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,EAAE,KAAK,IAAI,MAAM,EAAE,uBAAuB;AAChD,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,uBAAuB,UAA+B,CAAC,GAA2B;AACtF,UAAM,SAAS,QAAQ,UAAU,KAAK;AACtC,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,SAAS,MAAM,uBAAyB,QAAQ,QAAQ,WAAW;AACzE,UAAM,UAAyB;AAAA,MAC7B,MAAM,OAAO;AAAA,MACb,QAAQ,OAAO;AAAA,MACf,QAAQ;AAAA,MACR,oBAAoB,OAAO;AAAA,IAC7B;AACA,SAAK,eAAe,OAAO;AAC3B,SAAK,WAAW,SAAS,OAAO,MAAM;AACtC,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,eAAgC;AAC9B,WAAO,CAAC,GAAG,KAAK,SAAS;AAAA,EAC3B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,mBAAyC;AACvC,QAAI,CAAC,KAAK,cAAe,QAAO;AAChC,WAAO,KAAK,UAAU,KAAK,OAAK,EAAE,WAAW,KAAK,aAAa,KAAK;AAAA,EACtE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,kBAAuC;AACrC,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,cAAc,QAA+B;AACjD,UAAM,UAAU,KAAK,UAAU,KAAK,OAAK,EAAE,WAAW,MAAM;AAC5D,QAAI,CAAC,QAAS,OAAM,IAAI,MAAM,wCAAwC,MAAM,EAAE;AAC9E,SAAK,gBAAgB;AACrB,SAAK,gBAAgB;AACrB,SAAK,eAAe;AACpB,SAAK,MAAM,EAAE,MAAM,UAAU,QAAQ,CAAC;AAAA,EACxC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,OAAO,QAAgC;AAC3C,UAAM,SAAS,UAAU,KAAK;AAC9B,QAAI,CAAC,OAAQ;AACb,SAAK,YAAY,KAAK,UAAU,OAAO,OAAK,EAAE,WAAW,MAAM;AAC/D,SAAK,iBAAiB;AACtB,QAAI,KAAK,kBAAkB,QAAQ;AACjC,WAAK,gBAAgB;AACrB,WAAK,gBAAgB;AACrB,WAAK,eAAe;AAAA,IACtB;AACA,SAAK,MAAM,EAAE,MAAM,UAAU,QAAQ,OAAO,CAAC;AAAA,EAC/C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,SAAS,IAA8C;AACrD,SAAK,WAAW,IAAI,EAAE;AACtB,WAAO,MAAM;AACX,WAAK,WAAW,OAAO,EAAE;AAAA,IAC3B;AAAA,EACF;AACF;AAGO,SAAS,aAAa,SAAuB,CAAC,GAAW;AAC9D,SAAO,IAAI,OAAO,MAAM;AAC1B;","names":["getPublicKey","nip19","getPublicKey","generateSecretKey","getPublicKey","nip19","getPublicKey","nip19"]}

package/dist/signer-DiKj4PR7.d.cts

@@ -0,0 +1,377 @@
+import { EventTemplate, Event } from 'nostr-tools';
+import { AbstractSimplePool } from 'nostr-tools/abstract-pool';
+
+/**
+ * Subset of `nostr-signer-capacitor-plugin`'s exported `NostrSignerPlugin`
+ * that we depend on. Signatures intentionally mirror that library
+ * (positional args, per-call `packageName`) so the real plugin is
+ * structurally assignable here — and any mock written against this
+ * interface is a faithful stand-in. The conformance is enforced by a
+ * compile-time guard in `tests/helpers/mockAndroidPlugin.ts`.
+ */
+interface AndroidSignerAppInfo {
+    name: string;
+    packageName: string;
+    iconUrl?: string;
+}
+interface AndroidSignerPlugin {
+    setPackageName(packageName: string): Promise<void>;
+    getInstalledSignerApps(): Promise<{
+        apps: AndroidSignerAppInfo[];
+    }>;
+    getPublicKey(packageName?: string, permissions?: string): Promise<{
+        npub: string;
+        package: string;
+    }>;
+    signEvent(packageName: string, eventJson: string, id: string, npub: string): Promise<{
+        signature: string;
+        id: string;
+        event: string;
+    }>;
+    nip04Encrypt(packageName: string, plainText: string, id: string, pubKey: string, npub: string): Promise<{
+        result: string;
+        id: string;
+    }>;
+    nip04Decrypt(packageName: string, encryptedText: string, id: string, pubKey: string, npub: string): Promise<{
+        result: string;
+        id: string;
+    }>;
+    nip44Encrypt(packageName: string, plainText: string, id: string, pubKey: string, npub: string): Promise<{
+        result: string;
+        id: string;
+    }>;
+    nip44Decrypt(packageName: string, encryptedText: string, id: string, pubKey: string, npub: string): Promise<{
+        result: string;
+        id: string;
+    }>;
+}
+interface AndroidLoginOptions {
+    /** The Android package name of the external signer app (e.g. com.greenart7c3.nostrsigner). */
+    packageName?: string;
+    /** Override the plugin for this call. Falls back to SignerConfig.androidSignerPlugin. */
+    plugin?: AndroidSignerPlugin;
+}
+declare class AndroidSigner implements ActiveSigner {
+    #private;
+    constructor(plugin: AndroidSignerPlugin, packageName: string, npub: string, pubkey: string);
+    getPublicKey(): Promise<string>;
+    signEvent(event: EventTemplate): Promise<Event>;
+    nip04Encrypt(peerPubkey: string, plaintext: string): Promise<string>;
+    nip04Decrypt(peerPubkey: string, ciphertext: string): Promise<string>;
+    nip44Encrypt(peerPubkey: string, plaintext: string): Promise<string>;
+    nip44Decrypt(peerPubkey: string, ciphertext: string): Promise<string>;
+}
+interface AndroidLoginResult {
+    signer: AndroidSigner;
+    pubkey: string;
+    npub: string;
+    packageName: string;
+}
+declare function loginWithAndroidSigner(plugin: AndroidSignerPlugin, packageName?: string): Promise<AndroidLoginResult>;
+
+interface StorageAdapter {
+    get(key: string): string | null;
+    set(key: string, value: string): void;
+    remove(key: string): void;
+}
+declare function localStorageAdapter(prefix?: string): StorageAdapter;
+
+/**
+ * How the user's key material is held for an account:
+ *  - `extension`: NIP-07 browser extension (window.nostr).
+ *  - `nip46`: NIP-46 remote signer (bunker URI or nostrconnect QR).
+ *  - `ncryptsec`: NIP-49 encrypted nsec — decrypted into memory on unlock.
+ *  - `android`: NIP-55 Android external signer app via a Capacitor plugin.
+ */
+type LoginMethod = 'extension' | 'nip46' | 'ncryptsec' | 'android';
+/**
+ * Serialized account record persisted by the {@link StorageAdapter}.
+ *
+ * Survives reloads. Re-hydrates as **locked** — the account is present in
+ * `listAccounts()` and reachable via `getActiveAccount()`, but
+ * `getActiveSigner()` returns `null` until the user re-authenticates
+ * (passphrase for ncryptsec, page granted for extension, signer app for
+ * NIP-46/NIP-55).
+ *
+ * Method-specific fields:
+ *  - `ncryptsec` — present when `method === 'ncryptsec'`. The encrypted nsec.
+ *  - `nip46` — present when `method === 'nip46'`. URI, remote signer pubkey,
+ *     relays, and the per-account client session keypair (hex). The client
+ *     secret key is stored in plaintext on purpose — see the README's
+ *     threat-model note.
+ *  - `androidPackageName` — present when `method === 'android'`. Identifies
+ *     which installed signer app fulfilled the login (e.g. Amber).
+ */
+interface StoredAccount {
+    npub: string;
+    pubkey: string;
+    method: LoginMethod;
+    ncryptsec?: string;
+    nip46?: {
+        uri: string;
+        remoteSignerPubkey: string;
+        relays: string[];
+        clientSecretKey: string;
+    };
+    androidPackageName?: string;
+}
+/**
+ * The runtime signing surface exposed once an account is **unlocked**.
+ *
+ * Every concrete signer ({@link LocalSigner}, {@link ExtensionSigner},
+ * {@link BunkerSigner}, {@link AndroidSigner}) conforms to this. The
+ * abstraction has one deliberate omission: there is no `getPrivateKey()`.
+ * The raw secret key is never reachable through this interface — that is
+ * the package's central security invariant. Local signing holds the key
+ * in memory; the other methods sign remotely.
+ *
+ * `signEvent` accepts an unsigned {@link EventTemplate} (no `pubkey`,
+ * `id`, or `sig`) and returns a fully-signed {@link NostrEvent} —
+ * the implementation sets the `pubkey` to the active account's and fills
+ * in `id`/`sig`.
+ *
+ * `nip04Encrypt`/`nip44Encrypt` and their decrypt counterparts perform
+ * ECDH against `peerPubkey` (a 32-byte x-only hex pubkey). All four
+ * may throw if the remote signer (extension / bunker / Android) denies
+ * the operation.
+ */
+interface ActiveSigner {
+    getPublicKey(): Promise<string>;
+    signEvent(event: EventTemplate): Promise<Event>;
+    nip04Encrypt(peerPubkey: string, plaintext: string): Promise<string>;
+    nip04Decrypt(peerPubkey: string, ciphertext: string): Promise<string>;
+    nip44Encrypt(peerPubkey: string, plaintext: string): Promise<string>;
+    nip44Decrypt(peerPubkey: string, ciphertext: string): Promise<string>;
+}
+interface RelayMismatchInfo {
+    userRelays: string[];
+    bunkerRelays: string[];
+}
+/**
+ * Called after pairing if the bunker's preferred relays (via get_relays)
+ * differ from the user-supplied list. Return `true` to accept the bunker's
+ * list — it will be stored on the account for future sessions. Return
+ * `false` (or anything falsy) to keep the user's list. Either way, the
+ * current in-memory session keeps using the user's relays since those
+ * just worked for pairing.
+ */
+type RelayMismatchHandler = (info: RelayMismatchInfo) => boolean | Promise<boolean>;
+interface BunkerLoginOptions {
+    pool?: AbstractSimplePool;
+    onAuth?: (url: string) => void;
+    /** Reuse a stored client session keypair to resume a NIP-46 connection. */
+    clientSecretKey?: Uint8Array;
+    onRelayMismatch?: RelayMismatchHandler;
+    /**
+     * NIP-46 permissions to request as part of the `connect` call
+     * (e.g. `['sign_event:1', 'nip44_encrypt']`). Without this, many
+     * bunker UIs (e.g. Amber) show no approve/deny prompt because the
+     * connect request has nothing concrete to authorize.
+     */
+    perms?: string[];
+}
+interface NostrConnectOptions {
+    relays: string[];
+    metadata?: {
+        name?: string;
+        url?: string;
+        image?: string;
+    };
+    perms?: string[];
+    /** Called once with the generated nostrconnect URI so the caller can render it. */
+    onUri: (uri: string) => void;
+    pool?: AbstractSimplePool;
+    onAuth?: (url: string) => void;
+    signal?: AbortSignal;
+    timeoutMs?: number;
+    onRelayMismatch?: RelayMismatchHandler;
+}
+/**
+ * Emitted by {@link Signer.onChange}. Variants:
+ *  - `login` — a new account became active (no previous active account).
+ *  - `switch` — the active account changed (including unlocking an already
+ *     hydrated account, since unlock re-asserts the active signer).
+ *  - `logout` — `logout(pubkey)` removed an account; emitted with the
+ *     removed account's `pubkey` (the account itself is already gone from
+ *     `listAccounts()` by the time the event fires).
+ */
+type SignerEvent = {
+    type: 'login';
+    account: StoredAccount;
+} | {
+    type: 'logout';
+    pubkey: string;
+} | {
+    type: 'switch';
+    account: StoredAccount;
+};
+interface SignerConfig {
+    /**
+     * Persistence backend. Defaults to a `localStorage`-backed adapter.
+     * Provide a custom adapter to use sessionStorage, an in-memory map,
+     * IndexedDB, or any other key/value store. See {@link StorageAdapter}.
+     */
+    storage?: StorageAdapter;
+    /** Prefix applied to all keys written by the default localStorage adapter. */
+    storageKeyPrefix?: string;
+    /**
+     * Human-readable app name used as the default `name` metadata in
+     * the nostrconnect:// URI generated by `loginWithNostrConnect`.
+     * Remote signers (Amber, etc.) display this on the consent screen.
+     * Overridden by a per-call `metadata.name`.
+     */
+    appName?: string;
+    /**
+     * Canonical app URL used as the default `url` metadata in the
+     * nostrconnect:// URI. Overridden by a per-call `metadata.url`.
+     */
+    appUrl?: string;
+    /**
+     * Icon URL used as the default `image` metadata in the
+     * nostrconnect:// URI. Overridden by a per-call `metadata.image`.
+     */
+    appImage?: string;
+    /**
+     * Default Android signer plugin (NIP-55). Provide the host app's
+     * `nostr-signer-capacitor-plugin` instance or an equivalent stub that
+     * satisfies {@link import('../nip55.js').AndroidSignerPlugin}.
+     * Can be overridden per-call via `loginWithAndroidSigner({ plugin })`
+     * or `listAndroidSignerApps(plugin)`.
+     */
+    androidSignerPlugin?: AndroidSignerPlugin;
+}
+
+/**
+ * Multi-account Nostr signer with persistence.
+ *
+ * **Hydration.** The constructor reads previously-saved accounts from
+ * the configured storage adapter. Every hydrated account starts
+ * **locked**: present in `listAccounts()` and (if it was the active one
+ * before) reachable via `getActiveAccount()`, but `getActiveSigner()`
+ * returns `null` until the user re-authenticates. The matching
+ * `loginWith*` method unlocks the active account.
+ *
+ * **Locked vs unlocked.** Use `getActiveAccount()` to render UI ("logged
+ * in as @alice") and `getActiveSigner()` to decide whether the user can
+ * actually sign. The pattern is "show the account always, gate signing
+ * on the signer."
+ *
+ * **Events.** Subscribe via `onChange()` to re-render when an account
+ * is added, switched, or removed. See {@link SignerEvent}.
+ */
+declare class Signer {
+    #private;
+    constructor(config?: SignerConfig);
+    /**
+     * Generate a brand-new nsec, encrypt it with `passphrase` (NIP-49),
+     * persist the resulting `ncryptsec` account, and activate it. Returns
+     * the new account's `npub` and `ncryptsec` — the caller must surface
+     * the `ncryptsec` to the user **immediately** since it is the only way
+     * back into the account on a fresh device.
+     *
+     * @throws if `passphrase` is empty.
+     */
+    createAccount(passphrase: string): Promise<{
+        npub: string;
+        ncryptsec: string;
+    }>;
+    /**
+     * Decrypt an ncryptsec with the user's passphrase, persist the account
+     * (overwriting any previous entry for the same pubkey), and activate it.
+     *
+     * @throws if either argument is empty, or if the passphrase doesn't
+     * decrypt the ncryptsec.
+     */
+    loginWithNcryptsec(ncryptsec: string, passphrase: string): Promise<StoredAccount>;
+    /**
+     * Connect via the NIP-07 browser extension exposed at `window.nostr`.
+     * The extension prompts the user for permission on first use.
+     *
+     * @throws if no extension is installed or the user denies the request.
+     */
+    loginWithExtension(): Promise<StoredAccount>;
+    /**
+     * Connect to a NIP-46 remote signer via a `bunker://` URI. Relays are
+     * read from the URI itself — no hardcoded fallbacks. Pass a `pool`
+     * to reuse an existing relay connection; pass `clientSecretKey` to
+     * resume a previous session (the hex from `StoredAccount.nip46`).
+     *
+     * @throws if the URI is malformed, no relay is reachable, or the
+     * remote signer rejects pairing within the implementation's timeout.
+     */
+    loginWithBunkerUri(uri: string, options?: BunkerLoginOptions): Promise<StoredAccount>;
+    /**
+     * Initiate a NIP-46 `nostrconnect://` pairing. Generates a client
+     * keypair, publishes a connect request to the supplied `relays`, and
+     * waits for a remote signer to pair. Call `options.onUri(uri)` to
+     * render the URI as a QR code; the returned promise resolves once
+     * pairing completes. Cancel by aborting `options.signal`.
+     *
+     * @throws if `relays` is empty, the user aborts, the pairing times
+     * out, or no signer responds.
+     */
+    loginWithNostrConnect(options: NostrConnectOptions): Promise<StoredAccount>;
+    /**
+     * Enumerate NIP-55 signer apps installed on the device, via the
+     * configured Android plugin (or `plugin` if supplied). Useful for
+     * rendering a "pick your signer" list — the built-in UI does this
+     * automatically when the Android tab is selected.
+     *
+     * Only meaningful inside a Capacitor Android shell. On web/iOS the
+     * configured plugin is typically absent and this throws.
+     *
+     * @throws if no plugin is configured and none is passed in.
+     */
+    listAndroidSignerApps(plugin?: AndroidSignerPlugin): Promise<AndroidSignerAppInfo[]>;
+    /**
+     * Sign in via a NIP-55 Android external signer (Amber, etc). If
+     * `options.packageName` is given, that specific signer app is invoked;
+     * otherwise the plugin picks a default (typically the only installed
+     * signer, or an OS chooser). Pass `options.plugin` to override the
+     * configured default for this call.
+     *
+     * @throws if no plugin is configured, the signer app cannot be
+     * resolved to a package name, or the user denies the request.
+     */
+    loginWithAndroidSigner(options?: AndroidLoginOptions): Promise<StoredAccount>;
+    /** Snapshot of every persisted account, in insertion order. */
+    listAccounts(): StoredAccount[];
+    /**
+     * The currently selected account, or `null` if none. Present even when
+     * the account is locked (no active signer yet). Use this to render
+     * "logged in as @alice" — pair with {@link getActiveSigner} to decide
+     * whether signing is actually available.
+     */
+    getActiveAccount(): StoredAccount | null;
+    /**
+     * The unlocked signer for the active account, or `null` if locked.
+     * After a fresh page load this is `null` for every account type
+     * (passphrase / extension grant / signer-app handshake all need to
+     * be redone). Calling the matching `loginWith*` method unlocks it.
+     */
+    getActiveSigner(): ActiveSigner | null;
+    /**
+     * Make `pubkey` the active account. Clears the in-memory signer —
+     * the new account starts **locked** even if it was previously
+     * unlocked in this session.
+     *
+     * @throws if `pubkey` does not match any persisted account.
+     */
+    switchAccount(pubkey: string): Promise<void>;
+    /**
+     * Remove an account from storage. `pubkey` defaults to the active
+     * account. If the active account is removed, the in-memory signer is
+     * cleared. No-op if there is nothing to remove.
+     */
+    logout(pubkey?: string): Promise<void>;
+    /**
+     * Subscribe to account-state changes. Returns an unsubscribe function.
+     * Listener errors are swallowed so one bad listener can't break others.
+     * See {@link SignerEvent} for the variants.
+     */
+    onChange(cb: (event: SignerEvent) => void): () => void;
+}
+/** Convenience wrapper around `new Signer(config)`. */
+declare function createSigner(config?: SignerConfig): Signer;
+
+export { type ActiveSigner as A, type BunkerLoginOptions as B, type LoginMethod as L, type NostrConnectOptions as N, type RelayMismatchHandler as R, Signer as S, type AndroidLoginOptions as a, type AndroidLoginResult as b, AndroidSigner as c, type AndroidSignerAppInfo as d, type AndroidSignerPlugin as e, type RelayMismatchInfo as f, type SignerConfig as g, type SignerEvent as h, type StorageAdapter as i, type StoredAccount as j, createSigner as k, localStorageAdapter as l, loginWithAndroidSigner as m };