@formstr/signer 0.2.1 → 0.3.0

package/dist/index.js

@@ -356,37 +356,297 @@ function describeIdentifier(value) {
   const suffix = value.length > 12 ? "\u2026" : "";
   return `"${prefix}${suffix}" (length=${value.length})`;
 }
+var HEX_PUBKEY_RE = /^[0-9a-f]{64}$/i;
 async function loginWithAndroidSigner(plugin, packageName) {
   if (packageName) {
     await plugin.setPackageName(packageName);
   }
-  const { npub, package: pluginPackage } = await plugin.getPublicKey(packageName);
+  const { npub: rawIdentifier, package: pluginPackage } = await plugin.getPublicKey(packageName);
   const resolvedPackage = pluginPackage || packageName;
   if (!resolvedPackage) {
     throw new Error(
       "@formstr/signer: android signer did not return a package name and none was supplied"
     );
   }
+  const { pubkey, npub } = normalizeNip55Identifier(rawIdentifier);
+  return {
+    signer: new AndroidSigner(plugin, resolvedPackage, npub, pubkey),
+    pubkey,
+    npub,
+    packageName: resolvedPackage
+  };
+}
+function normalizeNip55Identifier(rawIdentifier) {
+  if (typeof rawIdentifier === "string" && HEX_PUBKEY_RE.test(rawIdentifier)) {
+    const pubkey = rawIdentifier.toLowerCase();
+    return { pubkey, npub: nip192.npubEncode(pubkey) };
+  }
   let decoded;
   try {
-    decoded = nip192.decode(npub);
+    decoded = nip192.decode(rawIdentifier);
   } catch (e) {
     throw new Error(
-      `@formstr/signer: android signer returned an undecodable identifier (got ${describeIdentifier(npub)}): ${e.message}`
+      `@formstr/signer: signer returned an undecodable identifier (got ${describeIdentifier(rawIdentifier)}): ${e.message}`
     );
   }
-  if (decoded.type !== "npub") {
-    throw new Error(
-      `@formstr/signer: android signer returned a non-npub identifier (type=${decoded.type}, got ${describeIdentifier(npub)})`
-    );
+  if (decoded.type === "npub") {
+    return { pubkey: decoded.data, npub: rawIdentifier };
   }
+  if (decoded.type === "nprofile") {
+    const pubkey = decoded.data.pubkey;
+    return { pubkey, npub: nip192.npubEncode(pubkey) };
+  }
+  throw new Error(
+    `@formstr/signer: signer returned a non-pubkey identifier (type=${decoded.type}, got ${describeIdentifier(rawIdentifier)})`
+  );
+}
+
+// src/nip55Web.ts
+import {
+  getEventHash as getEventHash2,
+  verifyEvent
+} from "nostr-tools";
+var DEFAULT_POLL_INTERVAL_MS = 500;
+var DEFAULT_TIMEOUT_MS = 12e4;
+var sentinelCounter = 0;
+function makeSentinel() {
+  sentinelCounter += 1;
+  return `__formstr_nip55_sentinel_${Date.now()}_${sentinelCounter}__`;
+}
+function abortError() {
+  const error = new Error("@formstr/signer: NIP-55 request aborted");
+  error.name = "AbortError";
+  return error;
+}
+function isNativeShell() {
+  const cap = globalThis.Capacitor;
+  return typeof cap?.isNativePlatform === "function" && cap.isNativePlatform();
+}
+function browserNip55Transport() {
   return {
-    signer: new AndroidSigner(plugin, resolvedPackage, npub, decoded.data),
-    pubkey: decoded.data,
-    npub,
-    packageName: resolvedPackage
+    isSupported() {
+      return typeof navigator !== "undefined" && !isNativeShell() && /Android/i.test(navigator.userAgent) && typeof navigator.clipboard?.readText === "function";
+    },
+    open(intent) {
+      window.open(intent, "_blank");
+    },
+    readClipboard() {
+      return navigator.clipboard.readText();
+    },
+    writeClipboard(text) {
+      return navigator.clipboard.writeText(text);
+    }
   };
 }
+var Nip55WebSigner = class _Nip55WebSigner {
+  #transport;
+  #pollIntervalMs;
+  #timeoutMs;
+  #signal;
+  #debug;
+  #pending = null;
+  #pubkey = null;
+  constructor(options = {}) {
+    this.#transport = options.transport ?? browserNip55Transport();
+    this.#pollIntervalMs = options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
+    this.#timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    this.#signal = options.signal;
+    this.#debug = options.debug;
+    this.#pubkey = options.pubkey ?? null;
+  }
+  #log(message) {
+    this.#debug?.(message);
+  }
+  /** True when the configured transport can actually open a signer app. */
+  isSupported() {
+    return this.#transport.isSupported();
+  }
+  async getPublicKey() {
+    if (this.#pubkey !== null) return this.#pubkey;
+    this.#checkSupport();
+    const raw = await this.#request(_Nip55WebSigner.getPublicKeyIntent());
+    const { pubkey } = normalizeNip55Identifier(raw);
+    this.#pubkey = pubkey;
+    return pubkey;
+  }
+  async signEvent(event) {
+    this.#checkSupport();
+    const pubkey = this.#pubkey ?? await this.getPublicKey();
+    const unsigned = { ...event, pubkey };
+    const draftWithId = { ...unsigned, id: getEventHash2(unsigned) };
+    const sig = (await this.#request(_Nip55WebSigner.signEventIntent(draftWithId))).trim();
+    if (!/^[0-9a-f]{128}$/i.test(sig)) {
+      throw new Error(
+        "@formstr/signer: NIP-55 signer did not return a hex signature"
+      );
+    }
+    const signed = { ...draftWithId, sig: sig.toLowerCase() };
+    if (!verifyEvent(signed)) {
+      throw new Error("@formstr/signer: NIP-55 signer returned an invalid signature");
+    }
+    return signed;
+  }
+  async nip04Encrypt(peerPubkey, plaintext) {
+    this.#checkSupport();
+    return this.#request(_Nip55WebSigner.nip04EncryptIntent(peerPubkey, plaintext));
+  }
+  async nip04Decrypt(peerPubkey, ciphertext) {
+    this.#checkSupport();
+    return this.#request(_Nip55WebSigner.nip04DecryptIntent(peerPubkey, ciphertext));
+  }
+  async nip44Encrypt(peerPubkey, plaintext) {
+    this.#checkSupport();
+    return this.#request(_Nip55WebSigner.nip44EncryptIntent(peerPubkey, plaintext));
+  }
+  async nip44Decrypt(peerPubkey, ciphertext) {
+    this.#checkSupport();
+    return this.#request(_Nip55WebSigner.nip44DecryptIntent(peerPubkey, ciphertext));
+  }
+  /**
+   * Cancel any in-flight request and stop its clipboard poll. Subsequent
+   * operations still work — this is a teardown of live resources, not a
+   * permanent disable (the {@link Signer} calls it when replacing the
+   * active signer).
+   */
+  close() {
+    if (this.#pending) {
+      const pending = this.#pending;
+      this.#settle();
+      pending.reject(abortError());
+    }
+  }
+  #checkSupport() {
+    if (this.#transport.isSupported()) return;
+    if (isNativeShell()) {
+      throw new Error(
+        "@formstr/signer: the browser NIP-55 flow is not for native builds \u2014 use loginWithAndroidSigner() with the Capacitor plugin instead"
+      );
+    }
+    throw new Error(
+      "@formstr/signer: NIP-55 web signing requires an Android browser with clipboard access (a signer app registering the `nostrsigner` scheme must be installed)"
+    );
+  }
+  /** One poll tick: read the clipboard and settle if the signer answered. */
+  #poll = async (pending) => {
+    let text;
+    try {
+      text = await this.#transport.readClipboard();
+    } catch (error) {
+      this.#log(`clipboard read failed: ${error.message}`);
+      return;
+    }
+    if (this.#pending !== pending) return;
+    const trimmed = text.trim();
+    if (trimmed.length === 0) return;
+    if (pending.sentinel !== null && trimmed === pending.sentinel) return;
+    this.#log(`clipboard result (${trimmed.length} chars)`);
+    this.#settle();
+    pending.resolve(trimmed);
+  };
+  #request(intent) {
+    this.#checkAborted();
+    this.#cancelPending();
+    return new Promise((resolve, reject) => {
+      const pending = {
+        resolve,
+        reject,
+        sentinel: null,
+        poll: null,
+        timer: null,
+        onAbort: null
+      };
+      this.#pending = pending;
+      if (this.#signal) {
+        const onAbort = () => this.#fail(pending, abortError());
+        this.#signal.addEventListener("abort", onAbort);
+        pending.onAbort = onAbort;
+      }
+      if (this.#timeoutMs > 0) {
+        pending.timer = setTimeout(() => {
+          this.#fail(
+            pending,
+            new Error(
+              `@formstr/signer: NIP-55 request timed out after ${this.#timeoutMs}ms (the signer app never returned a result)`
+            )
+          );
+        }, this.#timeoutMs);
+      }
+      void (async () => {
+        try {
+          const sentinel = makeSentinel();
+          await this.#transport.writeClipboard(sentinel);
+          if (this.#pending === pending) pending.sentinel = sentinel;
+          this.#log("planted clipboard sentinel");
+        } catch (error) {
+          this.#log(`sentinel write failed: ${error.message}`);
+        }
+        if (this.#pending !== pending) return;
+        try {
+          this.#log(`opening signer app: ${intent.slice(0, 80)}\u2026`);
+          this.#transport.open(intent);
+        } catch (error) {
+          this.#fail(pending, error);
+          return;
+        }
+        pending.poll = setInterval(() => {
+          void this.#poll(pending);
+        }, this.#pollIntervalMs);
+      })();
+    });
+  }
+  /**
+   * Reject the current request. Every caller is cleared on settle — the
+   * timeout timer and abort listener are removed, and `open()` is
+   * synchronous — so `pending` is always the active request here.
+   */
+  #fail(pending, error) {
+    this.#settle();
+    pending.reject(error);
+  }
+  #settle() {
+    const pending = this.#pending;
+    this.#pending = null;
+    if (pending?.poll) clearInterval(pending.poll);
+    if (pending?.timer) clearTimeout(pending.timer);
+    if (pending?.onAbort && this.#signal) {
+      this.#signal.removeEventListener("abort", pending.onAbort);
+    }
+  }
+  #cancelPending() {
+    if (!this.#pending) return;
+    const pending = this.#pending;
+    this.#settle();
+    pending.reject(new Error("@formstr/signer: NIP-55 request superseded"));
+  }
+  #checkAborted() {
+    if (this.#signal?.aborted) throw abortError();
+  }
+  static getPublicKeyIntent() {
+    return "intent:#Intent;scheme=nostrsigner;S.compressionType=none;S.returnType=signature;S.type=get_public_key;end";
+  }
+  static signEventIntent(draft) {
+    return `intent:${encodeURIComponent(
+      JSON.stringify(draft)
+    )}#Intent;scheme=nostrsigner;S.compressionType=none;S.returnType=signature;S.type=sign_event;end`;
+  }
+  static nip04EncryptIntent(peerPubkey, plaintext) {
+    return _Nip55WebSigner.#cryptoIntent("nip04_encrypt", peerPubkey, plaintext);
+  }
+  static nip04DecryptIntent(peerPubkey, ciphertext) {
+    return _Nip55WebSigner.#cryptoIntent("nip04_decrypt", peerPubkey, ciphertext);
+  }
+  static nip44EncryptIntent(peerPubkey, plaintext) {
+    return _Nip55WebSigner.#cryptoIntent("nip44_encrypt", peerPubkey, plaintext);
+  }
+  static nip44DecryptIntent(peerPubkey, ciphertext) {
+    return _Nip55WebSigner.#cryptoIntent("nip44_decrypt", peerPubkey, ciphertext);
+  }
+  static #cryptoIntent(type, peerPubkey, payload) {
+    return `intent:${encodeURIComponent(
+      payload
+    )}#Intent;scheme=nostrsigner;S.pubKey=${peerPubkey};S.compressionType=none;S.returnType=signature;S.type=${type};end`;
+  }
+};
 
 // src/core/signer.ts
 var ACCOUNTS_KEY = "accounts";
@@ -394,6 +654,7 @@ var ACTIVE_KEY = "active-pubkey";
 var Signer = class {
   #storage;
   #defaultAndroidPlugin;
+  #nip55WebTransport;
   #appMetadata;
   #accounts = [];
   #activePubkey = null;
@@ -402,6 +663,7 @@ var Signer = class {
   constructor(config = {}) {
     this.#storage = config.storage ?? localStorageAdapter(config.storageKeyPrefix);
     this.#defaultAndroidPlugin = config.androidSignerPlugin;
+    this.#nip55WebTransport = config.nip55WebTransport;
     this.#appMetadata = {
       name: config.appName,
       url: config.appUrl,
@@ -435,8 +697,28 @@ var Signer = class {
     else this.#accounts.push(account);
     this.#persistAccounts();
   }
+  /**
+   * Release the currently-held signer, if it has a `close()`. Called
+   * whenever the active signer is replaced or cleared so live resources
+   * (bunker subscriptions, `visibilitychange` listeners, in-flight NIP-55
+   * requests) don't outlive the session. Errors are swallowed — teardown
+   * must never block a login/switch/logout.
+   */
+  #closeActiveSigner() {
+    const signer = this.#activeSigner;
+    if (!signer?.close) return;
+    try {
+      const result = signer.close();
+      if (result && typeof result.catch === "function") {
+        result.catch(() => {
+        });
+      }
+    } catch {
+    }
+  }
   #setActive(account, signer) {
     const wasDifferent = this.#activePubkey !== null && this.#activePubkey !== account.pubkey;
+    if (this.#activeSigner !== signer) this.#closeActiveSigner();
     this.#activePubkey = account.pubkey;
     this.#activeSigner = signer;
     this.#persistActive();
@@ -628,6 +910,69 @@ var Signer = class {
     this.#setActive(account, result.signer);
     return account;
   }
+  /**
+   * Whether `loginWithNip55Web` can run in this environment — a plain
+   * Android browser with async clipboard access. False in a Capacitor
+   * native shell (use {@link loginWithAndroidSigner} there), and on
+   * desktop/iOS/SSR.
+   *
+   * A **capability** check, not an availability one: there is no web API
+   * to detect an installed Android app, so this says nothing about
+   * whether a signer app is actually installed. Use it to hide the
+   * browser flow where it cannot work, not to promise that it will.
+   */
+  supportsNip55Web(transport) {
+    const t = transport ?? this.#nip55WebTransport ?? browserNip55Transport();
+    return t.isSupported();
+  }
+  /**
+   * Sign in via a NIP-55 Android external signer (Amber, etc) **from a
+   * plain browser**, with no Capacitor/native bridge. Opens the installed
+   * signer app through a `nostrsigner` intent and reads the result back
+   * from the clipboard once the user returns to the tab. Because the
+   * intent names no package, this works with any app that registered the
+   * `nostrsigner` scheme — one opens directly, several show the Android
+   * "Open with" chooser.
+   *
+   * Not for native builds — inside a Capacitor shell use
+   * {@link loginWithAndroidSigner}, which needs no clipboard and no
+   * per-operation approval.
+   *
+   * Every operation is a separate approval, and a rejection is
+   * indistinguishable from the user simply not returning, so callers must
+   * impose their own timeout. Prefer NIP-46 when a persistent session is
+   * acceptable — the NIP-55 spec recommends it for web clients.
+   *
+   * @throws if the environment cannot run the flow (not Android, no async
+   * clipboard) or the signer returns an unexpected value.
+   */
+  async loginWithNip55Web(options = {}) {
+    const transport = options.transport ?? this.#nip55WebTransport;
+    const pairing = new Nip55WebSigner({
+      transport,
+      pollIntervalMs: options.pollIntervalMs,
+      timeoutMs: options.timeoutMs,
+      signal: options.signal,
+      debug: options.debug
+    });
+    const pubkey = await pairing.getPublicKey();
+    const signer = new Nip55WebSigner({
+      transport,
+      pollIntervalMs: options.pollIntervalMs,
+      timeoutMs: options.timeoutMs,
+      pubkey,
+      debug: options.debug
+    });
+    const npub = nip193.npubEncode(pubkey);
+    const account = {
+      npub,
+      pubkey,
+      method: "nip55-web"
+    };
+    this.#upsertAccount(account);
+    this.#setActive(account, signer);
+    return account;
+  }
   /** Snapshot of every persisted account, in insertion order. */
   listAccounts() {
     return [...this.#accounts];
@@ -681,6 +1026,10 @@ var Signer = class {
    *    {@link loginWithAndroidSigner} performs and that — on Amber —
    *    surfaces as a permission prompt every cold start.
    *
+   *  - `nip55-web`: constructs a {@link Nip55WebSigner} with the stored
+   *    `pubkey` cached. Like `android`, this opens no signer app during
+   *    unlock; the first sign/encrypt call is what prompts.
+   *
    *  - `ncryptsec`: returns `null`. There is no silent path — the user's
    *    passphrase isn't (and shouldn't be) persisted. The caller must
    *    drive the passphrase prompt and call {@link loginWithNcryptsec}.
@@ -729,6 +1078,14 @@ var Signer = class {
         this.#setActive(account, signer);
         return signer;
       }
+      case "nip55-web": {
+        const signer = new Nip55WebSigner({
+          transport: this.#nip55WebTransport,
+          pubkey: account.pubkey
+        });
+        this.#setActive(account, signer);
+        return signer;
+      }
       case "ncryptsec":
         return null;
     }
@@ -743,6 +1100,7 @@ var Signer = class {
   async switchAccount(pubkey) {
     const account = this.#accounts.find((a) => a.pubkey === pubkey);
     if (!account) throw new Error(`switchAccount: no account for pubkey ${pubkey}`);
+    this.#closeActiveSigner();
     this.#activePubkey = pubkey;
     this.#activeSigner = null;
     this.#persistActive();
@@ -759,6 +1117,7 @@ var Signer = class {
     this.#accounts = this.#accounts.filter((a) => a.pubkey !== target);
     this.#persistAccounts();
     if (this.#activePubkey === target) {
+      this.#closeActiveSigner();
       this.#activePubkey = null;
       this.#activeSigner = null;
       this.#persistActive();
@@ -785,7 +1144,9 @@ export {
   BunkerSigner,
   ExtensionSigner,
   LocalSigner,
+  Nip55WebSigner,
   Signer,
+  browserNip55Transport,
   bytesToHex,
   connectWithBunkerUri,
   createSigner,
@@ -796,6 +1157,7 @@ export {
   hexToBytes,
   initiateNostrConnect,
   localStorageAdapter,
-  loginWithAndroidSigner
+  loginWithAndroidSigner,
+  normalizeNip55Identifier
 };
 //# sourceMappingURL=index.js.map