@formstr/signer 0.2.2 → 0.3.0

package/README.md

@@ -1,6 +1,6 @@
 # @formstr/signer
 
-A vanilla TypeScript Nostr signer with an optional unstyled login UI. Supports NIP-07 (browser extension), NIP-46 (bunker URI + nostrconnect QR), NIP-49 (ncryptsec at rest), and NIP-55 (Android external signer apps).
+A vanilla TypeScript Nostr signer with an optional unstyled login UI. Supports NIP-07 (browser extension), NIP-46 (bunker URI + nostrconnect QR), NIP-49 (ncryptsec at rest), NIP-55 (Android external signer apps, via a Capacitor plugin **or** a plain browser), and a pure-web signer-app flow.
 
 ## Install
 
@@ -28,6 +28,7 @@ await signer.loginWithExtension();
 await signer.loginWithBunkerUri('bunker://...');
 await signer.loginWithNostrConnect({ relays: ['wss://relay.example'], onUri: (uri) => /* show QR */ });
 await signer.loginWithAndroidSigner({ packageName: 'com.greenart7c3.nostrsigner' });
+await signer.loginWithNip55Web(); // Android browser, no Capacitor shell — see below
 
 // Sign events — the active signer never exposes the privkey
 const active = signer.getActiveSigner()!;
@@ -79,6 +80,7 @@ Per-method behavior:
 | `extension` | constructs `ExtensionSigner` (stateless wrapper around `window.nostr`) | no |
 | `nip46` | reuses persisted `clientSecretKey` + `remoteSignerPubkey` + `relays` to attach a `BunkerSigner` — **skips the `connect` request**, which is what triggers a fresh approval prompt every reload | no |
 | `android` | builds the `AndroidSigner` directly from cached `pubkey` + `npub` + `androidPackageName`, **bypassing the plugin's `getPublicKey` content-provider call** | no |
+| `nip55-web` | builds a `Nip55WebSigner` from the cached `pubkey`; it does not open the signer app until the next sign/encrypt call | no |
 | `ncryptsec` | returns `null` — the passphrase is not (and must not be) persisted; caller drives the prompt and calls `loginWithNcryptsec(account.ncryptsec, passphrase)` | n/a (by design) |
 
 `unlock()` returns `null` (without emitting an event) when there is no active account, when the account is missing fields it needs to resume, when method is `nip46` but no `pool` was supplied, or when method is `android` but no plugin is configured. On success it emits the same `login`/`switch` event the corresponding `loginWith*` would.
@@ -133,7 +135,77 @@ const myPlugin: AndroidSignerPlugin = {
 
 The interface signatures intentionally mirror `nostr-signer-capacitor-plugin`'s exported `NostrSignerPlugin` so the real wrapper is directly assignable. If you write a custom plugin, the package's test suite includes a compile-time conformance guard (`tests/helpers/mockAndroidPlugin.ts`) you can model your own check on — wire it up in your CI and you'll catch any drift the moment the upstream wrapper changes shape.
 
-**Identifier shape.** The `npub` field returned by `getPublicKey` is permissive: the package accepts either a bech32 `npub1…` string (the NIP-55 spec shape) or a 32-byte hex pubkey (what current Amber builds actually return). Whichever you hand back, the package normalizes internally — `StoredAccount.npub` is always bech32 and `StoredAccount.pubkey` is always lowercase hex. Anything else surfaces as a debuggable error including a preview of what was received.
+**Identifier shape.** The `npub` field returned by `getPublicKey` is permissive: the package accepts either a bech32 `npub1…` string (the NIP-55 spec shape) or a 32-byte hex pubkey (what current Amber builds actually return). Whichever you hand back, the package normalizes internally — `StoredAccount.npub` is always bech32 and `StoredAccount.pubkey` is always lowercase hex. Anything else surfaces as a debuggable error including a preview of what was received. The same normalization (plus `nprofile1…`) is shared with the browser flow below.
+
+## NIP-55 in a plain browser (`loginWithNip55Web`)
+
+The Capacitor plugin above only works inside a native Android shell. `loginWithNip55Web()` covers the other case: a **plain browser on Android** (mobile web, a PWA) talking to any installed NIP-55 signer app with no native bridge.
+
+```ts
+await signer.loginWithNip55Web();
+```
+
+The mechanism:
+
+1. **Plant a sentinel.** The package overwrites the clipboard with a random `__formstr_nip55_sentinel_…__` string. This is what makes the result identifiable — otherwise a clipboard left over from an earlier approval would look like a fresh answer and resolve immediately.
+2. **Open the intent.** It opens `intent:#Intent;scheme=nostrsigner;S.type=…;end` via `window.open`. No package is named, so Android resolves it against every app that registered the scheme — one signer opens directly, several show the standard "Open with" chooser. This is not Amber-specific.
+3. **Poll the clipboard.** The signer app signs and copies the result to the clipboard. The package polls `navigator.clipboard.readText()` every `pollIntervalMs` (default 500ms) until the value differs from the sentinel, then resolves.
+
+### Why polling, not `visibilitychange`
+
+The obvious design — read the clipboard when the user returns to the tab — **does not work on Android Chrome**, verified on a Pixel emulator running Amber 6.6.4:
+
+- Returning from the signer app fires **no** `visibilitychange` or `focus` event. `window.open` produces a brief hide/show blip *before* the signer is even open (a `blur`, two `visibilitychange`s and a `focus` within ~400ms), and then nothing on the actual return. An event-driven read therefore never runs.
+- Even when a read is attempted right after returning, Chrome rejects it with `NotAllowedError: Document is not focused` — the page is visible but not focused, and it does not regain focus on its own.
+- `setInterval`, by contrast, keeps ticking while the tab is backgrounded, so polling observes the result regardless.
+
+This is why the transport interface has `readClipboard`/`writeClipboard` but no foreground callback: the browser simply does not provide a reliable return signal.
+
+### Browser only — not for native builds
+
+This flow is for a plain browser. Inside a Capacitor native shell the same
+device already has the real NIP-55 plugin, which supports every method and
+needs neither the clipboard nor a per-operation approval — so this path is
+disabled there (Capacitor injects a `Capacitor.isNativePlatform()` global,
+which the package checks without depending on `@capacitor/core`).
+
+Gate your UI on `signer.supportsNip55Web()`:
+
+```ts
+container.innerHTML = renderLoginHtml({
+  includeNip55Web: signer.supportsNip55Web(),
+});
+```
+
+In a native build that omits the tab and `loginWithNip55Web()` throws a
+message pointing at `loginWithAndroidSigner()`.
+
+`supportsNip55Web()` is a **capability** check, not an availability one:
+there is no web API to detect an installed Android app, so it cannot tell
+you whether a signer app is actually present. It answers "could this flow
+possibly work here", not "will it succeed".
+
+### What to know
+
+- **Android + secure context only.** `supportsNip55Web()` requires an Android user agent, the async clipboard API, and not being in a native shell. `loginWithNip55Web()` throws before persisting anything when unsupported. `http://localhost` counts as a secure context, which is handy for local testing.
+- **Chrome will ask to read the clipboard** the first time; approve it, or every read fails.
+- **One approval per operation.** There is no background channel, so `getPublicKey`, every `signEvent`, and every `nip04`/`nip44` call re-opens the app. `unlock()` resumes the account from its cached pubkey without opening the app; the first real signing call prompts.
+- **No rejection signal, but there is a timeout.** NIP-55's reject path is an Android intent extra a browser never sees, so a denial is indistinguishable from the user never returning. The package therefore times requests out (`timeoutMs`, default 120s; `0` disables) and rejects with a clear message. Pass a `signal` to cancel yourself — aborting rejects with `name === 'AbortError'`, matching the NIP-46 flow.
+- **Signatures are verified.** `signEvent` computes the event id, sends the complete unsigned event, then checks the returned 128-char hex signature with `verifyEvent` before returning it.
+- **The clipboard is clobbered** by the sentinel write. This is inherent to the transport; warn users if your app cares about clipboard contents.
+- **Prefer NIP-46 when you can.** The NIP-55 spec itself recommends NIP-46 for web clients precisely because this flow can't run in the background. Keep the browser NIP-55 path for users who want their existing signer app without a pairing step.
+
+The environment bridge is pluggable for tests and unusual hosts:
+
+```ts
+import type { Nip55WebTransport } from '@formstr/signer';
+
+const s = createSigner({ nip55WebTransport: myTransport });
+// or per call:
+await s.loginWithNip55Web({ transport: myTransport });
+```
+
+`browserNip55Transport()` is exported as the default implementation. `pollIntervalMs` (default 500) trades latency against how often the clipboard is read. `Nip55WebSigner` also exposes a `close()` that cancels an in-flight request and stops its poll; `Signer` calls it automatically when the active signer is replaced (a new login/unlock, `switchAccount`, or `logout`), so a pending request never leaks past its session.
 
 ## NIP-46 app identity (required for nostrconnect)
 
@@ -191,7 +263,7 @@ const detach = attachLoginListeners(container, signer, {
 // later: detach();
 ```
 
-The login modal renders one tab per method (Create, Existing key, Extension, Bunker URI, Remote QR, Android). The Android tab is always rendered but its list of installed signers is fetched lazily on activation via `signer.listAndroidSignerApps()` — it errors clearly if no Android plugin is configured (e.g. when running on web).
+The login modal renders one tab per method (Create, Existing key, Extension, Bunker URI, Remote QR, Signer app, Android). The Android tab is always rendered but its list of installed signers is fetched lazily on activation via `signer.listAndroidSignerApps()` — it errors clearly if no Android plugin is configured (e.g. when running on web). The Signer app tab drives `loginWithNip55Web()` and needs no plugin; pass `renderLoginHtml({ includeNip55Web: signer.supportsNip55Web() })` to hide it in native builds.
 
 ## Errors
 
@@ -199,11 +271,12 @@ All `loginWith*` methods reject with bare `Error` instances. Categories you can
 
 - **Validation** — empty passphrase, empty relays, malformed bunker URI.
 - **Wrong credential** — `loginWithNcryptsec` with a bad passphrase throws synchronously after decrypt.
-- **External denial** — extension/bunker/Android signer rejects the request.
-- **Transport** — NIP-46 relay unreachable, pairing timeout, abort.
+- **External denial** — extension/bunker/Android signer rejects the request. The browser NIP-55 flow has no denial signal (see its section), so pair it with a timeout.
+- **Transport** — NIP-46 relay unreachable, pairing timeout, abort; browser NIP-55 empty/inaccessible clipboard, or an unverifiable signature.
 - **Configuration** —
   - `loginWithNostrConnect` throws if neither `appName` (in `createSigner`) nor `metadata.name` (per call) is set. See "NIP-46 app identity" above.
   - `loginWithAndroidSigner` / `listAndroidSignerApps` throws if no plugin is configured.
+  - `loginWithNip55Web` throws if the environment is not an Android browser with clipboard access.
 
 Error messages are prefixed with `@formstr/signer:` for messages the package generates itself. Errors from `nostr-tools` or the Capacitor plugin propagate unchanged. There is currently no typed `code` field — discriminate by string match or by which method threw.
 
@@ -246,6 +319,7 @@ The UI ships with these class names. Override in your own CSS.
 | `.nostr-signer__tab--extension` | NIP-07 tab |
 | `.nostr-signer__tab--bunker` | NIP-46 bunker URI tab |
 | `.nostr-signer__tab--nostrconnect` | NIP-46 nostrconnect (QR) tab |
+| `.nostr-signer__tab--nip55web` | NIP-55 browser/`nostrsigner` tab |
 | `.nostr-signer__tab--android` | NIP-55 Android tab |
 
 ### Panels
@@ -258,6 +332,7 @@ The UI ships with these class names. Override in your own CSS.
 | `.nostr-signer__panel--extension` | extension panel |
 | `.nostr-signer__panel--bunker` | bunker URI panel |
 | `.nostr-signer__panel--nostrconnect` | nostrconnect panel |
+| `.nostr-signer__panel--nip55web` | NIP-55 browser/`nostrsigner` panel |
 | `.nostr-signer__panel--android` | Android signer panel |
 | `.nostr-signer__panel--created` | post-creation backup-the-ncryptsec panel |
 

package/dist/index.cjs

@@ -24,7 +24,9 @@ __export(src_exports, {
   BunkerSigner: () => BunkerSigner,
   ExtensionSigner: () => ExtensionSigner,
   LocalSigner: () => LocalSigner,
+  Nip55WebSigner: () => Nip55WebSigner,
   Signer: () => Signer,
+  browserNip55Transport: () => browserNip55Transport,
   bytesToHex: () => bytesToHex,
   connectWithBunkerUri: () => connectWithBunkerUri,
   createSigner: () => createSigner,
@@ -35,12 +37,13 @@ __export(src_exports, {
   hexToBytes: () => hexToBytes,
   initiateNostrConnect: () => initiateNostrConnect,
   localStorageAdapter: () => localStorageAdapter,
-  loginWithAndroidSigner: () => loginWithAndroidSigner
+  loginWithAndroidSigner: () => loginWithAndroidSigner,
+  normalizeNip55Identifier: () => normalizeNip55Identifier
 });
 module.exports = __toCommonJS(src_exports);
 
 // src/core/signer.ts
-var import_nostr_tools5 = require("nostr-tools");
+var import_nostr_tools6 = require("nostr-tools");
 var import_nip462 = require("nostr-tools/nip46");
 
 // src/core/storage.ts
@@ -400,7 +403,7 @@ async function loginWithAndroidSigner(plugin, packageName) {
       "@formstr/signer: android signer did not return a package name and none was supplied"
     );
   }
-  const { pubkey, npub } = normalizeAndroidIdentifier(rawIdentifier);
+  const { pubkey, npub } = normalizeNip55Identifier(rawIdentifier);
   return {
     signer: new AndroidSigner(plugin, resolvedPackage, npub, pubkey),
     pubkey,
@@ -408,7 +411,7 @@ async function loginWithAndroidSigner(plugin, packageName) {
     packageName: resolvedPackage
   };
 }
-function normalizeAndroidIdentifier(rawIdentifier) {
+function normalizeNip55Identifier(rawIdentifier) {
   if (typeof rawIdentifier === "string" && HEX_PUBKEY_RE.test(rawIdentifier)) {
     const pubkey = rawIdentifier.toLowerCase();
     return { pubkey, npub: import_nostr_tools4.nip19.npubEncode(pubkey) };
@@ -418,16 +421,264 @@ function normalizeAndroidIdentifier(rawIdentifier) {
     decoded = import_nostr_tools4.nip19.decode(rawIdentifier);
   } catch (e) {
     throw new Error(
-      `@formstr/signer: android signer returned an undecodable identifier (got ${describeIdentifier(rawIdentifier)}): ${e.message}`
+      `@formstr/signer: signer returned an undecodable identifier (got ${describeIdentifier(rawIdentifier)}): ${e.message}`
     );
   }
-  if (decoded.type !== "npub") {
+  if (decoded.type === "npub") {
+    return { pubkey: decoded.data, npub: rawIdentifier };
+  }
+  if (decoded.type === "nprofile") {
+    const pubkey = decoded.data.pubkey;
+    return { pubkey, npub: import_nostr_tools4.nip19.npubEncode(pubkey) };
+  }
+  throw new Error(
+    `@formstr/signer: signer returned a non-pubkey identifier (type=${decoded.type}, got ${describeIdentifier(rawIdentifier)})`
+  );
+}
+
+// src/nip55Web.ts
+var import_nostr_tools5 = require("nostr-tools");
+var DEFAULT_POLL_INTERVAL_MS = 500;
+var DEFAULT_TIMEOUT_MS = 12e4;
+var sentinelCounter = 0;
+function makeSentinel() {
+  sentinelCounter += 1;
+  return `__formstr_nip55_sentinel_${Date.now()}_${sentinelCounter}__`;
+}
+function abortError() {
+  const error = new Error("@formstr/signer: NIP-55 request aborted");
+  error.name = "AbortError";
+  return error;
+}
+function isNativeShell() {
+  const cap = globalThis.Capacitor;
+  return typeof cap?.isNativePlatform === "function" && cap.isNativePlatform();
+}
+function browserNip55Transport() {
+  return {
+    isSupported() {
+      return typeof navigator !== "undefined" && !isNativeShell() && /Android/i.test(navigator.userAgent) && typeof navigator.clipboard?.readText === "function";
+    },
+    open(intent) {
+      window.open(intent, "_blank");
+    },
+    readClipboard() {
+      return navigator.clipboard.readText();
+    },
+    writeClipboard(text) {
+      return navigator.clipboard.writeText(text);
+    }
+  };
+}
+var Nip55WebSigner = class _Nip55WebSigner {
+  #transport;
+  #pollIntervalMs;
+  #timeoutMs;
+  #signal;
+  #debug;
+  #pending = null;
+  #pubkey = null;
+  constructor(options = {}) {
+    this.#transport = options.transport ?? browserNip55Transport();
+    this.#pollIntervalMs = options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
+    this.#timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    this.#signal = options.signal;
+    this.#debug = options.debug;
+    this.#pubkey = options.pubkey ?? null;
+  }
+  #log(message) {
+    this.#debug?.(message);
+  }
+  /** True when the configured transport can actually open a signer app. */
+  isSupported() {
+    return this.#transport.isSupported();
+  }
+  async getPublicKey() {
+    if (this.#pubkey !== null) return this.#pubkey;
+    this.#checkSupport();
+    const raw = await this.#request(_Nip55WebSigner.getPublicKeyIntent());
+    const { pubkey } = normalizeNip55Identifier(raw);
+    this.#pubkey = pubkey;
+    return pubkey;
+  }
+  async signEvent(event) {
+    this.#checkSupport();
+    const pubkey = this.#pubkey ?? await this.getPublicKey();
+    const unsigned = { ...event, pubkey };
+    const draftWithId = { ...unsigned, id: (0, import_nostr_tools5.getEventHash)(unsigned) };
+    const sig = (await this.#request(_Nip55WebSigner.signEventIntent(draftWithId))).trim();
+    if (!/^[0-9a-f]{128}$/i.test(sig)) {
+      throw new Error(
+        "@formstr/signer: NIP-55 signer did not return a hex signature"
+      );
+    }
+    const signed = { ...draftWithId, sig: sig.toLowerCase() };
+    if (!(0, import_nostr_tools5.verifyEvent)(signed)) {
+      throw new Error("@formstr/signer: NIP-55 signer returned an invalid signature");
+    }
+    return signed;
+  }
+  async nip04Encrypt(peerPubkey, plaintext) {
+    this.#checkSupport();
+    return this.#request(_Nip55WebSigner.nip04EncryptIntent(peerPubkey, plaintext));
+  }
+  async nip04Decrypt(peerPubkey, ciphertext) {
+    this.#checkSupport();
+    return this.#request(_Nip55WebSigner.nip04DecryptIntent(peerPubkey, ciphertext));
+  }
+  async nip44Encrypt(peerPubkey, plaintext) {
+    this.#checkSupport();
+    return this.#request(_Nip55WebSigner.nip44EncryptIntent(peerPubkey, plaintext));
+  }
+  async nip44Decrypt(peerPubkey, ciphertext) {
+    this.#checkSupport();
+    return this.#request(_Nip55WebSigner.nip44DecryptIntent(peerPubkey, ciphertext));
+  }
+  /**
+   * Cancel any in-flight request and stop its clipboard poll. Subsequent
+   * operations still work — this is a teardown of live resources, not a
+   * permanent disable (the {@link Signer} calls it when replacing the
+   * active signer).
+   */
+  close() {
+    if (this.#pending) {
+      const pending = this.#pending;
+      this.#settle();
+      pending.reject(abortError());
+    }
+  }
+  #checkSupport() {
+    if (this.#transport.isSupported()) return;
+    if (isNativeShell()) {
+      throw new Error(
+        "@formstr/signer: the browser NIP-55 flow is not for native builds \u2014 use loginWithAndroidSigner() with the Capacitor plugin instead"
+      );
+    }
     throw new Error(
-      `@formstr/signer: android signer returned a non-npub identifier (type=${decoded.type}, got ${describeIdentifier(rawIdentifier)})`
+      "@formstr/signer: NIP-55 web signing requires an Android browser with clipboard access (a signer app registering the `nostrsigner` scheme must be installed)"
     );
   }
-  return { pubkey: decoded.data, npub: rawIdentifier };
-}
+  /** One poll tick: read the clipboard and settle if the signer answered. */
+  #poll = async (pending) => {
+    let text;
+    try {
+      text = await this.#transport.readClipboard();
+    } catch (error) {
+      this.#log(`clipboard read failed: ${error.message}`);
+      return;
+    }
+    if (this.#pending !== pending) return;
+    const trimmed = text.trim();
+    if (trimmed.length === 0) return;
+    if (pending.sentinel !== null && trimmed === pending.sentinel) return;
+    this.#log(`clipboard result (${trimmed.length} chars)`);
+    this.#settle();
+    pending.resolve(trimmed);
+  };
+  #request(intent) {
+    this.#checkAborted();
+    this.#cancelPending();
+    return new Promise((resolve, reject) => {
+      const pending = {
+        resolve,
+        reject,
+        sentinel: null,
+        poll: null,
+        timer: null,
+        onAbort: null
+      };
+      this.#pending = pending;
+      if (this.#signal) {
+        const onAbort = () => this.#fail(pending, abortError());
+        this.#signal.addEventListener("abort", onAbort);
+        pending.onAbort = onAbort;
+      }
+      if (this.#timeoutMs > 0) {
+        pending.timer = setTimeout(() => {
+          this.#fail(
+            pending,
+            new Error(
+              `@formstr/signer: NIP-55 request timed out after ${this.#timeoutMs}ms (the signer app never returned a result)`
+            )
+          );
+        }, this.#timeoutMs);
+      }
+      void (async () => {
+        try {
+          const sentinel = makeSentinel();
+          await this.#transport.writeClipboard(sentinel);
+          if (this.#pending === pending) pending.sentinel = sentinel;
+          this.#log("planted clipboard sentinel");
+        } catch (error) {
+          this.#log(`sentinel write failed: ${error.message}`);
+        }
+        if (this.#pending !== pending) return;
+        try {
+          this.#log(`opening signer app: ${intent.slice(0, 80)}\u2026`);
+          this.#transport.open(intent);
+        } catch (error) {
+          this.#fail(pending, error);
+          return;
+        }
+        pending.poll = setInterval(() => {
+          void this.#poll(pending);
+        }, this.#pollIntervalMs);
+      })();
+    });
+  }
+  /**
+   * Reject the current request. Every caller is cleared on settle — the
+   * timeout timer and abort listener are removed, and `open()` is
+   * synchronous — so `pending` is always the active request here.
+   */
+  #fail(pending, error) {
+    this.#settle();
+    pending.reject(error);
+  }
+  #settle() {
+    const pending = this.#pending;
+    this.#pending = null;
+    if (pending?.poll) clearInterval(pending.poll);
+    if (pending?.timer) clearTimeout(pending.timer);
+    if (pending?.onAbort && this.#signal) {
+      this.#signal.removeEventListener("abort", pending.onAbort);
+    }
+  }
+  #cancelPending() {
+    if (!this.#pending) return;
+    const pending = this.#pending;
+    this.#settle();
+    pending.reject(new Error("@formstr/signer: NIP-55 request superseded"));
+  }
+  #checkAborted() {
+    if (this.#signal?.aborted) throw abortError();
+  }
+  static getPublicKeyIntent() {
+    return "intent:#Intent;scheme=nostrsigner;S.compressionType=none;S.returnType=signature;S.type=get_public_key;end";
+  }
+  static signEventIntent(draft) {
+    return `intent:${encodeURIComponent(
+      JSON.stringify(draft)
+    )}#Intent;scheme=nostrsigner;S.compressionType=none;S.returnType=signature;S.type=sign_event;end`;
+  }
+  static nip04EncryptIntent(peerPubkey, plaintext) {
+    return _Nip55WebSigner.#cryptoIntent("nip04_encrypt", peerPubkey, plaintext);
+  }
+  static nip04DecryptIntent(peerPubkey, ciphertext) {
+    return _Nip55WebSigner.#cryptoIntent("nip04_decrypt", peerPubkey, ciphertext);
+  }
+  static nip44EncryptIntent(peerPubkey, plaintext) {
+    return _Nip55WebSigner.#cryptoIntent("nip44_encrypt", peerPubkey, plaintext);
+  }
+  static nip44DecryptIntent(peerPubkey, ciphertext) {
+    return _Nip55WebSigner.#cryptoIntent("nip44_decrypt", peerPubkey, ciphertext);
+  }
+  static #cryptoIntent(type, peerPubkey, payload) {
+    return `intent:${encodeURIComponent(
+      payload
+    )}#Intent;scheme=nostrsigner;S.pubKey=${peerPubkey};S.compressionType=none;S.returnType=signature;S.type=${type};end`;
+  }
+};
 
 // src/core/signer.ts
 var ACCOUNTS_KEY = "accounts";
@@ -435,6 +686,7 @@ var ACTIVE_KEY = "active-pubkey";
 var Signer = class {
   #storage;
   #defaultAndroidPlugin;
+  #nip55WebTransport;
   #appMetadata;
   #accounts = [];
   #activePubkey = null;
@@ -443,6 +695,7 @@ var Signer = class {
   constructor(config = {}) {
     this.#storage = config.storage ?? localStorageAdapter(config.storageKeyPrefix);
     this.#defaultAndroidPlugin = config.androidSignerPlugin;
+    this.#nip55WebTransport = config.nip55WebTransport;
     this.#appMetadata = {
       name: config.appName,
       url: config.appUrl,
@@ -476,8 +729,28 @@ var Signer = class {
     else this.#accounts.push(account);
     this.#persistAccounts();
   }
+  /**
+   * Release the currently-held signer, if it has a `close()`. Called
+   * whenever the active signer is replaced or cleared so live resources
+   * (bunker subscriptions, `visibilitychange` listeners, in-flight NIP-55
+   * requests) don't outlive the session. Errors are swallowed — teardown
+   * must never block a login/switch/logout.
+   */
+  #closeActiveSigner() {
+    const signer = this.#activeSigner;
+    if (!signer?.close) return;
+    try {
+      const result = signer.close();
+      if (result && typeof result.catch === "function") {
+        result.catch(() => {
+        });
+      }
+    } catch {
+    }
+  }
   #setActive(account, signer) {
     const wasDifferent = this.#activePubkey !== null && this.#activePubkey !== account.pubkey;
+    if (this.#activeSigner !== signer) this.#closeActiveSigner();
     this.#activePubkey = account.pubkey;
     this.#activeSigner = signer;
     this.#persistActive();
@@ -519,8 +792,8 @@ var Signer = class {
     if (!ncryptsec) throw new Error("loginWithNcryptsec: ncryptsec required");
     if (!passphrase) throw new Error("loginWithNcryptsec: passphrase required");
     const secretKey = decryptNcryptsec(ncryptsec, passphrase);
-    const pubkey = (0, import_nostr_tools5.getPublicKey)(secretKey);
-    const npub = import_nostr_tools5.nip19.npubEncode(pubkey);
+    const pubkey = (0, import_nostr_tools6.getPublicKey)(secretKey);
+    const npub = import_nostr_tools6.nip19.npubEncode(pubkey);
     const account = { npub, pubkey, method: "ncryptsec", ncryptsec };
     this.#upsertAccount(account);
     this.#setActive(account, new LocalSigner(secretKey));
@@ -535,7 +808,7 @@ var Signer = class {
   async loginWithExtension() {
     const extension = new ExtensionSigner();
     const pubkey = await extension.getPublicKey();
-    const npub = import_nostr_tools5.nip19.npubEncode(pubkey);
+    const npub = import_nostr_tools6.nip19.npubEncode(pubkey);
     const account = { npub, pubkey, method: "extension" };
     this.#upsertAccount(account);
     this.#setActive(account, extension);
@@ -552,7 +825,7 @@ var Signer = class {
    */
   async loginWithBunkerUri(uri, options = {}) {
     const result = await connectWithBunkerUri(uri, options);
-    const npub = import_nostr_tools5.nip19.npubEncode(result.pubkey);
+    const npub = import_nostr_tools6.nip19.npubEncode(result.pubkey);
     const account = {
       npub,
       pubkey: result.pubkey,
@@ -604,7 +877,7 @@ var Signer = class {
     });
     options.onUri(init.uri);
     const result = await init.complete;
-    const npub = import_nostr_tools5.nip19.npubEncode(result.pubkey);
+    const npub = import_nostr_tools6.nip19.npubEncode(result.pubkey);
     const account = {
       npub,
       pubkey: result.pubkey,
@@ -669,6 +942,69 @@ var Signer = class {
     this.#setActive(account, result.signer);
     return account;
   }
+  /**
+   * Whether `loginWithNip55Web` can run in this environment — a plain
+   * Android browser with async clipboard access. False in a Capacitor
+   * native shell (use {@link loginWithAndroidSigner} there), and on
+   * desktop/iOS/SSR.
+   *
+   * A **capability** check, not an availability one: there is no web API
+   * to detect an installed Android app, so this says nothing about
+   * whether a signer app is actually installed. Use it to hide the
+   * browser flow where it cannot work, not to promise that it will.
+   */
+  supportsNip55Web(transport) {
+    const t = transport ?? this.#nip55WebTransport ?? browserNip55Transport();
+    return t.isSupported();
+  }
+  /**
+   * Sign in via a NIP-55 Android external signer (Amber, etc) **from a
+   * plain browser**, with no Capacitor/native bridge. Opens the installed
+   * signer app through a `nostrsigner` intent and reads the result back
+   * from the clipboard once the user returns to the tab. Because the
+   * intent names no package, this works with any app that registered the
+   * `nostrsigner` scheme — one opens directly, several show the Android
+   * "Open with" chooser.
+   *
+   * Not for native builds — inside a Capacitor shell use
+   * {@link loginWithAndroidSigner}, which needs no clipboard and no
+   * per-operation approval.
+   *
+   * Every operation is a separate approval, and a rejection is
+   * indistinguishable from the user simply not returning, so callers must
+   * impose their own timeout. Prefer NIP-46 when a persistent session is
+   * acceptable — the NIP-55 spec recommends it for web clients.
+   *
+   * @throws if the environment cannot run the flow (not Android, no async
+   * clipboard) or the signer returns an unexpected value.
+   */
+  async loginWithNip55Web(options = {}) {
+    const transport = options.transport ?? this.#nip55WebTransport;
+    const pairing = new Nip55WebSigner({
+      transport,
+      pollIntervalMs: options.pollIntervalMs,
+      timeoutMs: options.timeoutMs,
+      signal: options.signal,
+      debug: options.debug
+    });
+    const pubkey = await pairing.getPublicKey();
+    const signer = new Nip55WebSigner({
+      transport,
+      pollIntervalMs: options.pollIntervalMs,
+      timeoutMs: options.timeoutMs,
+      pubkey,
+      debug: options.debug
+    });
+    const npub = import_nostr_tools6.nip19.npubEncode(pubkey);
+    const account = {
+      npub,
+      pubkey,
+      method: "nip55-web"
+    };
+    this.#upsertAccount(account);
+    this.#setActive(account, signer);
+    return account;
+  }
   /** Snapshot of every persisted account, in insertion order. */
   listAccounts() {
     return [...this.#accounts];
@@ -722,6 +1058,10 @@ var Signer = class {
    *    {@link loginWithAndroidSigner} performs and that — on Amber —
    *    surfaces as a permission prompt every cold start.
    *
+   *  - `nip55-web`: constructs a {@link Nip55WebSigner} with the stored
+   *    `pubkey` cached. Like `android`, this opens no signer app during
+   *    unlock; the first sign/encrypt call is what prompts.
+   *
    *  - `ncryptsec`: returns `null`. There is no silent path — the user's
    *    passphrase isn't (and shouldn't be) persisted. The caller must
    *    drive the passphrase prompt and call {@link loginWithNcryptsec}.
@@ -770,6 +1110,14 @@ var Signer = class {
         this.#setActive(account, signer);
         return signer;
       }
+      case "nip55-web": {
+        const signer = new Nip55WebSigner({
+          transport: this.#nip55WebTransport,
+          pubkey: account.pubkey
+        });
+        this.#setActive(account, signer);
+        return signer;
+      }
       case "ncryptsec":
         return null;
     }
@@ -784,6 +1132,7 @@ var Signer = class {
   async switchAccount(pubkey) {
     const account = this.#accounts.find((a) => a.pubkey === pubkey);
     if (!account) throw new Error(`switchAccount: no account for pubkey ${pubkey}`);
+    this.#closeActiveSigner();
     this.#activePubkey = pubkey;
     this.#activeSigner = null;
     this.#persistActive();
@@ -800,6 +1149,7 @@ var Signer = class {
     this.#accounts = this.#accounts.filter((a) => a.pubkey !== target);
     this.#persistAccounts();
     if (this.#activePubkey === target) {
+      this.#closeActiveSigner();
       this.#activePubkey = null;
       this.#activeSigner = null;
       this.#persistActive();
@@ -827,7 +1177,9 @@ function createSigner(config = {}) {
   BunkerSigner,
   ExtensionSigner,
   LocalSigner,
+  Nip55WebSigner,
   Signer,
+  browserNip55Transport,
   bytesToHex,
   connectWithBunkerUri,
   createSigner,
@@ -838,6 +1190,7 @@ function createSigner(config = {}) {
   hexToBytes,
   initiateNostrConnect,
   localStorageAdapter,
-  loginWithAndroidSigner
+  loginWithAndroidSigner,
+  normalizeNip55Identifier
 });
 //# sourceMappingURL=index.cjs.map