@qntx/nostr 0.11.0 → 0.12.1

package/dist/{index-N7HUGgwo.d.mts → index-SwMknboJ.d.mts}

@@ -1,5 +1,5 @@
 import { n as EventTemplate, r as UnsignedEvent, t as Event } from "./event-j3BwI5dF.mjs";
-import { i as SecretKeyInput, t as Keys } from "./key-CyKN1RTi.mjs";
+import { i as SecretKeyInput, t as Keys } from "./key-CwMVo14x.mjs";
 import { t as Filter } from "./filter-PG7r79rt.mjs";
 import { a as NostrError } from "./error-BquXDmIN.mjs";
 import { t as NostrSigner } from "./types-BJ4wZ7JJ.mjs";
@@ -13,12 +13,57 @@ import { n as ClientMetadata, t as BunkerPointer } from "./nip46-BHaxC9TZ.mjs";
 declare class NoSignerError extends NostrError {
   name: string;
 }
+/** Thrown when a method is called on a signer after {@link NostrSigner dispose}. */
+declare class SignerDisposedError extends NostrError {
+  name: string;
+}
+//#endregion
+//#region src/signer/delegated.d.ts
+/**
+ * The three operations an external key holder (wallet keyring, NFC card, platform secure store)
+ * provides. The secret itself never enters this process.
+ */
+type NostrKeyOperations = {
+  /** Lowercase 64-char hex x-only public key. */
+  getPublicKey: () => Promise<string>;
+  /** 64-byte BIP-340 signature over the 32-byte event id. */
+  signEventId: (id: Uint8Array) => Promise<Uint8Array>;
+  /**
+   * Optional. 32-byte x-coordinate of `ECDH(secret, lift_x(peer))`, unhashed. Enables NIP-04 and
+   * NIP-44.
+   */
+  sharedSecret?: (peer: string) => Promise<Uint8Array>;
+};
+/**
+ * {@link NostrSigner} backed by a {@link NostrKeyOperations} key holder. The signer verifies
+ * everything the holder returns: the public key shape, the signature length, and the BIP-340
+ * signature itself — a misbehaving holder never produces an event relays would reject.
+ */
+declare class DelegatedSigner implements NostrSigner {
+  #private;
+  constructor(operations: NostrKeyOperations);
+  getPublicKey(): Promise<string>;
+  signEvent(unsigned: UnsignedEvent): Promise<Event>;
+  nip44Encrypt(peer: string, plaintext: string): Promise<string>;
+  nip44Decrypt(peer: string, payload: string): Promise<string>;
+  nip04Encrypt(peer: string, plaintext: string): Promise<string>;
+  nip04Decrypt(peer: string, ciphertext: string): Promise<string>;
+  /**
+   * Zero-fill and clear every cached NIP-44 conversation key. All later calls reject with
+   * {@link SignerDisposedError} and never reach the key holder. Idempotent.
+   */
+  dispose(): void;
+}
 //#endregion
 //#region src/signer/keys.d.ts
 /** Local secret-key signer with NIP-04 (legacy) and NIP-44 support. */
 declare class KeysSigner implements NostrSigner {
   #private;
   constructor(secretKey: SecretKeyInput | Keys);
+  /**
+   * The live {@link Keys} instance holding the secret material. {@link KeysSigner.dispose} zeroizes
+   * it, so a reference obtained earlier reports a zeroized secret afterwards.
+   */
   get keys(): Keys;
   getPublicKey(): Promise<string>;
   signEvent(unsigned: UnsignedEvent): Promise<Event>;
@@ -26,6 +71,11 @@ declare class KeysSigner implements NostrSigner {
   nip04Decrypt(peer: string, ciphertext: string): Promise<string>;
   nip44Encrypt(peer: string, plaintext: string): Promise<string>;
   nip44Decrypt(peer: string, payload: string): Promise<string>;
+  /**
+   * Zeroize the wrapped secret key and every cached NIP-44 conversation key. All later calls reject
+   * with {@link SignerDisposedError}. Idempotent.
+   */
+  dispose(): void;
 }
 //#endregion
 //#region src/signer/nip07.d.ts
@@ -173,5 +223,5 @@ declare class Nip46Signer implements NostrSigner {
   close(): Promise<void>;
 }
 //#endregion
-export { Nip07Signer as a, isNip07Available as c, Nip46Transport as i, KeysSigner as l, Nip46SignerOptions as n, WindowNostr as o, Nip46SubscribeOptions as r, getWindowNostr as s, Nip46Signer as t, NoSignerError as u };
-//# sourceMappingURL=index-N7HUGgwo.d.mts.map
+export { Nip07Signer as a, isNip07Available as c, NostrKeyOperations as d, NoSignerError as f, Nip46Transport as i, KeysSigner as l, Nip46SignerOptions as n, WindowNostr as o, SignerDisposedError as p, Nip46SubscribeOptions as r, getWindowNostr as s, Nip46Signer as t, DelegatedSigner as u };
+//# sourceMappingURL=index-SwMknboJ.d.mts.map

package/dist/{index-BP94lABY.d.mts → index-yq9xkONo.d.mts}

@@ -1,13 +1,13 @@
 import { t as Event } from "./event-j3BwI5dF.mjs";
-import { n as ProfileMetadata } from "./builder-GBddxj8i.mjs";
-import { t as RelayListItem } from "./nip65-BL79HI8N.mjs";
-import { t as Gossip } from "./gossip-BTMdlUI7.mjs";
+import { n as ProfileMetadata } from "./builder-BrmLOVj_.mjs";
+import { t as RelayListItem } from "./nip65-DaWMg943.mjs";
+import { t as Gossip } from "./gossip-u0iBlZ1U.mjs";
 import { a as NostrError } from "./error-BquXDmIN.mjs";
 import { _ as Closer, n as Pool } from "./pool-DUuYJ0x4.mjs";
 import { r as OutboxBound, t as EventStore } from "./types-CqhnT-Mx.mjs";
 import { t as ReactiveEventStore } from "./reactive-jyKrA9ej.mjs";
 import { i as EventPointer, t as AddressPointer } from "./nip19-DpPN17bY.mjs";
-import { t as MuteItem } from "./nip51-O_vhOiK2.mjs";
+import { t as MuteItem } from "./nip51-D_bu8Hph.mjs";
 //#region src/loaders/event.d.ts
 type EventRef = string | EventPointer | AddressPointer;
 /**
@@ -186,4 +186,4 @@ type CreateLoadersOptions = {
 declare function createLoaders(opts: CreateLoadersOptions): Loaders;
 //#endregion
 export { EventRef as _, OutboxFeed as a, NostrUser as c, ListLoaders as d, ListResult as f, EventLoader as g, ReplaceableLoader as h, OutboxError as i, ProfileLoader as l, ReplaceableLoadResult as m, Loaders as n, OutboxFeedOptions as o, LoadStyle as p, createLoaders as r, groupAuthorsByOutboxRelay as s, CreateLoadersOptions as t, bareNostrUser as u };
-//# sourceMappingURL=index-BP94lABY.d.mts.map
+//# sourceMappingURL=index-yq9xkONo.d.mts.map

package/dist/index.d.mts

@@ -1,9 +1,9 @@
 import { C as tagName, S as parseEventAddress, _ as eventAddress, b as getDTag, c as serializeEvent, d as sortedEvents, f as validateEvent, g as TagInput, h as Tag, i as getEventHash, l as signedMatchesUnsigned, m as EventAddress, n as EventTemplate, o as isReplaceableWinner, p as validateSignedEvent, r as UnsignedEvent, s as itemCompare, t as Event, u as sortEvents, w as tagValue, x as isTag, y as formatEventAddress } from "./event-j3BwI5dF.mjs";
-import { a as SigningBackend, c as publicKeyFromHex, i as SecretKeyInput, l as signEvent, n as PublicKey, o as finalizeEvent, r as SecretKey, s as getPublicKey, t as Keys, u as toSecretKey } from "./key-CyKN1RTi.mjs";
-import { n as ProfileMetadata, t as EventBuilder } from "./builder-GBddxj8i.mjs";
+import { a as SigningBackend, c as publicKeyFromHex, i as SecretKeyInput, l as signEvent, n as PublicKey, o as finalizeEvent, r as SecretKey, s as getPublicKey, t as Keys, u as toSecretKey } from "./key-CwMVo14x.mjs";
+import { n as ProfileMetadata, t as EventBuilder } from "./builder-BrmLOVj_.mjs";
 import { a as getFilterLimit, i as filterFingerprint, n as canonicalizeFilter, o as matchFilter, r as canonicalizeFilters, s as matchFilters, t as Filter } from "./filter-PG7r79rt.mjs";
-import { a as relayListEventBuilder, i as readRelays, n as RelayMarker, o as relayListToTags, r as parseRelayList, s as writeRelays, t as RelayListItem } from "./nip65-BL79HI8N.mjs";
-import { i as RoutedFilter, r as PubkeyRoutes, t as Gossip } from "./gossip-BTMdlUI7.mjs";
+import { a as relayListEventBuilder, i as readRelays, n as RelayMarker, o as relayListToTags, r as parseRelayList, s as writeRelays, t as RelayListItem } from "./nip65-DaWMg943.mjs";
+import { i as RoutedFilter, r as PubkeyRoutes, t as Gossip } from "./gossip-u0iBlZ1U.mjs";
 import { a as ClientMessage, c as SubscriptionId, d as encodeClientMessage, f as encodeRelayMessage, h as parseRelayMessage, i as verifyEvent, l as assertSubscriptionId, m as parseClientMessage, n as SerializedEventVerifier, o as CountResult, p as mergeCountHll, r as createEventVerifier, s as RelayMessage, t as EventVerifier, u as createSubscriptionId } from "./verifier-Cl24c9ph.mjs";
 import { a as NostrError, i as MessageError, n as EventValidationError, o as UrlError, r as HexError, s as WasmPoisonedError, t as CryptoError } from "./error-BquXDmIN.mjs";
 import { _ as Closer, a as PoolFetchResult, c as PoolSubscribeOptions, d as RelayOptions, f as RelayStatus, g as RelayFetchResult, h as RelayFetchEnd, i as PoolEventMap, l as Relay, m as PublishResult, n as Pool, o as PoolOptions, p as RelayStatusName, r as PoolCountResult, s as PoolPublishResult, t as InvalidEventPolicy, u as RelayEventMap, v as RelaySubscription, y as SubscribeOptions } from "./pool-DUuYJ0x4.mjs";
@@ -11,15 +11,15 @@ import { i as useWebSocketImplementation } from "./websocket-CmeqvAkp.mjs";
 import { i as PutResult, n as NegentropyItem, r as OutboxBound, t as EventStore } from "./types-CqhnT-Mx.mjs";
 import { i as Watch, n as ReactiveEventStoreEventMap, r as ReactiveEventStoreOptions, t as ReactiveEventStore } from "./reactive-jyKrA9ej.mjs";
 import { _ as noteEncode, a as NAddr, b as nsecEncode, c as NPub, d as Note, f as ProfilePointer, g as neventEncode, h as naddrEncode, i as EventPointer, l as NSec, n as Bech32MaxSize, o as NEvent, p as decode, r as DecodedResult, s as NProfile, t as AddressPointer, u as Nip19Error, v as nprofileEncode, y as npubEncode } from "./nip19-DpPN17bY.mjs";
-import { a as OutboxFeed, c as NostrUser, f as ListResult, h as ReplaceableLoader, i as OutboxError, m as ReplaceableLoadResult, n as Loaders, o as OutboxFeedOptions, p as LoadStyle, r as createLoaders, s as groupAuthorsByOutboxRelay, u as bareNostrUser } from "./index-BP94lABY.mjs";
+import { a as OutboxFeed, c as NostrUser, f as ListResult, h as ReplaceableLoader, i as OutboxError, m as ReplaceableLoadResult, n as Loaders, o as OutboxFeedOptions, p as LoadStyle, r as createLoaders, s as groupAuthorsByOutboxRelay, u as bareNostrUser } from "./index-yq9xkONo.mjs";
 import { t as NostrSigner } from "./types-BJ4wZ7JJ.mjs";
 import { t as StorageError } from "./error-BD_0QFKT.mjs";
-import { _ as SyncSummary, c as PrivateMessageSendResult, d as SendPrivateMessageOptions, g as SyncOptions, h as SyncDirectionName, i as ClientOptions, m as SyncDirection, n as ClientError, p as SubscribePrivateMessagesOptions, r as ClientEventMap, s as FetchPrivateMessagesOptions, t as Client, u as ReceivedPrivateMessage } from "./index-CSsnE32i.mjs";
+import { _ as SyncSummary, c as PrivateMessageSendResult, d as SendPrivateMessageOptions, g as SyncOptions, h as SyncDirectionName, i as ClientOptions, m as SyncDirection, n as ClientError, p as SubscribePrivateMessagesOptions, r as ClientEventMap, s as FetchPrivateMessagesOptions, t as Client, u as ReceivedPrivateMessage } from "./index-DxQO1eWA.mjs";
 import { S as SUBSCRIPTION_ID_MAX_CHARS, _ as normalizeURL, a as classifyKind, b as SECRET_KEY_BYTES, c as isRegularKind, f as bytesToHex, h as isHex64, i as KnownKind, l as isReplaceableKind, m as isHex32, n as KindClassification, o as isAddressableKind, p as hexToBytes, r as KindName, s as isEphemeralKind, t as Kind, v as EVENT_ID_BYTES, x as SIGNATURE_BYTES, y as PUBLIC_KEY_BYTES } from "./index-Hp26bgYG.mjs";
-import { a as Nip07Signer, c as isNip07Available, i as Nip46Transport, l as KeysSigner, n as Nip46SignerOptions, o as WindowNostr, r as Nip46SubscribeOptions, s as getWindowNostr, t as Nip46Signer, u as NoSignerError } from "./index-N7HUGgwo.mjs";
+import { a as Nip07Signer, c as isNip07Available, d as NostrKeyOperations, f as NoSignerError, i as Nip46Transport, l as KeysSigner, n as Nip46SignerOptions, o as WindowNostr, p as SignerDisposedError, r as Nip46SubscribeOptions, s as getWindowNostr, t as Nip46Signer, u as DelegatedSigner } from "./index-SwMknboJ.mjs";
 import { Nip21Error, NostrURI, isNostrURI, parseNostrURI } from "./nips/nip21.mjs";
 import { ReplyTagsOptions, ThreadReferences, buildReplyTags, parseThreadTags, replyTo } from "./nips/nip10.mjs";
 import { isAuthRequired, makeAuthEvent } from "./nips/nip42.mjs";
 import { a as isInsecureRelayUrl, c as RelayError, d as RelayTimeoutError, l as RelayPublishError, o as RelayClosedError, s as RelayConnectionError, u as RelaySuspendedError } from "./index-DD0Ywpay.mjs";
 import { a as IndexedDbEventStoreOptions, i as IndexedDbEventStore, n as SqlValue, o as MemoryEventStore, r as SqliteEventStore, t as SqlDriver } from "./index-rKcmI6ex.mjs";
-export { type AddressPointer, Bech32MaxSize, Client, ClientError, type ClientEventMap, type ClientMessage, type ClientOptions, type Closer, type CountResult, CryptoError, type DecodedResult, EVENT_ID_BYTES, type Event, type EventAddress, EventBuilder, type EventPointer, type EventStore, type EventTemplate, EventValidationError, type EventVerifier, type FetchPrivateMessagesOptions, type Filter, Gossip, HexError, IndexedDbEventStore, type IndexedDbEventStoreOptions, type InvalidEventPolicy, Keys, KeysSigner, Kind, type KindClassification, type KindName, type KnownKind, type ListResult, type LoadStyle, type Loaders, MemoryEventStore, MessageError, type NAddr, type NEvent, type NProfile, type NPub, type NSec, type NegentropyItem, Nip07Signer, Nip19Error, Nip21Error, Nip46Signer, type Nip46SignerOptions, type Nip46SubscribeOptions, type Nip46Transport, NoSignerError, NostrError, type NostrSigner, type NostrURI, type NostrUser, type Note, type OutboxBound, OutboxError, OutboxFeed, type OutboxFeedOptions, PUBLIC_KEY_BYTES, Pool, type PoolCountResult, type PoolEventMap, type PoolFetchResult, type PoolOptions, type PoolPublishResult, type PoolSubscribeOptions, type PrivateMessageSendResult, type ProfileMetadata, type ProfilePointer, type PubkeyRoutes, type PublicKey, type PublishResult, type PutResult, ReactiveEventStore, type ReactiveEventStoreEventMap, type ReactiveEventStoreOptions, type ReceivedPrivateMessage, Relay, RelayClosedError, RelayConnectionError, RelayError, type RelayEventMap, type RelayFetchEnd, type RelayFetchResult, type RelayListItem, type RelayMarker, type RelayMessage, type RelayOptions, RelayPublishError, RelayStatus, type RelayStatusName, type RelaySubscription, RelaySuspendedError, RelayTimeoutError, type ReplaceableLoadResult, type ReplaceableLoader, type ReplyTagsOptions, type RoutedFilter, SECRET_KEY_BYTES, SIGNATURE_BYTES, SUBSCRIPTION_ID_MAX_CHARS, SecretKey, type SecretKeyInput, type SendPrivateMessageOptions, type SerializedEventVerifier, type SigningBackend, type SqlDriver, type SqlValue, SqliteEventStore, StorageError, type SubscribeOptions, type SubscribePrivateMessagesOptions, type SubscriptionId, SyncDirection, type SyncDirectionName, type SyncOptions, type SyncSummary, Tag, type TagInput, type ThreadReferences, type UnsignedEvent, UrlError, WasmPoisonedError, type Watch, type WindowNostr, assertSubscriptionId, bareNostrUser, buildReplyTags, bytesToHex, canonicalizeFilter, canonicalizeFilters, classifyKind, createEventVerifier, createLoaders, createSubscriptionId, encodeClientMessage, encodeRelayMessage, eventAddress, filterFingerprint, finalizeEvent, formatEventAddress, getDTag, getEventHash, getFilterLimit, getPublicKey, getWindowNostr, groupAuthorsByOutboxRelay, hexToBytes, isAddressableKind, isAuthRequired, isEphemeralKind, isHex32, isHex64, isInsecureRelayUrl, isNip07Available, isNostrURI, isRegularKind, isReplaceableKind, isReplaceableWinner, isTag, itemCompare, makeAuthEvent, matchFilter, matchFilters, mergeCountHll, naddrEncode, neventEncode, decode as nip19Decode, normalizeURL, noteEncode, nprofileEncode, npubEncode, nsecEncode, parseClientMessage, parseEventAddress, parseNostrURI, parseRelayList, parseRelayMessage, parseThreadTags, publicKeyFromHex, readRelays, relayListEventBuilder, relayListToTags, replyTo, serializeEvent, signEvent, signedMatchesUnsigned, sortEvents, sortedEvents, tagName, tagValue, toSecretKey, useWebSocketImplementation, validateEvent, validateSignedEvent, verifyEvent, writeRelays };
+export { type AddressPointer, Bech32MaxSize, Client, ClientError, type ClientEventMap, type ClientMessage, type ClientOptions, type Closer, type CountResult, CryptoError, type DecodedResult, DelegatedSigner, EVENT_ID_BYTES, type Event, type EventAddress, EventBuilder, type EventPointer, type EventStore, type EventTemplate, EventValidationError, type EventVerifier, type FetchPrivateMessagesOptions, type Filter, Gossip, HexError, IndexedDbEventStore, type IndexedDbEventStoreOptions, type InvalidEventPolicy, Keys, KeysSigner, Kind, type KindClassification, type KindName, type KnownKind, type ListResult, type LoadStyle, type Loaders, MemoryEventStore, MessageError, type NAddr, type NEvent, type NProfile, type NPub, type NSec, type NegentropyItem, Nip07Signer, Nip19Error, Nip21Error, Nip46Signer, type Nip46SignerOptions, type Nip46SubscribeOptions, type Nip46Transport, NoSignerError, NostrError, type NostrKeyOperations, type NostrSigner, type NostrURI, type NostrUser, type Note, type OutboxBound, OutboxError, OutboxFeed, type OutboxFeedOptions, PUBLIC_KEY_BYTES, Pool, type PoolCountResult, type PoolEventMap, type PoolFetchResult, type PoolOptions, type PoolPublishResult, type PoolSubscribeOptions, type PrivateMessageSendResult, type ProfileMetadata, type ProfilePointer, type PubkeyRoutes, type PublicKey, type PublishResult, type PutResult, ReactiveEventStore, type ReactiveEventStoreEventMap, type ReactiveEventStoreOptions, type ReceivedPrivateMessage, Relay, RelayClosedError, RelayConnectionError, RelayError, type RelayEventMap, type RelayFetchEnd, type RelayFetchResult, type RelayListItem, type RelayMarker, type RelayMessage, type RelayOptions, RelayPublishError, RelayStatus, type RelayStatusName, type RelaySubscription, RelaySuspendedError, RelayTimeoutError, type ReplaceableLoadResult, type ReplaceableLoader, type ReplyTagsOptions, type RoutedFilter, SECRET_KEY_BYTES, SIGNATURE_BYTES, SUBSCRIPTION_ID_MAX_CHARS, SecretKey, type SecretKeyInput, type SendPrivateMessageOptions, type SerializedEventVerifier, SignerDisposedError, type SigningBackend, type SqlDriver, type SqlValue, SqliteEventStore, StorageError, type SubscribeOptions, type SubscribePrivateMessagesOptions, type SubscriptionId, SyncDirection, type SyncDirectionName, type SyncOptions, type SyncSummary, Tag, type TagInput, type ThreadReferences, type UnsignedEvent, UrlError, WasmPoisonedError, type Watch, type WindowNostr, assertSubscriptionId, bareNostrUser, buildReplyTags, bytesToHex, canonicalizeFilter, canonicalizeFilters, classifyKind, createEventVerifier, createLoaders, createSubscriptionId, encodeClientMessage, encodeRelayMessage, eventAddress, filterFingerprint, finalizeEvent, formatEventAddress, getDTag, getEventHash, getFilterLimit, getPublicKey, getWindowNostr, groupAuthorsByOutboxRelay, hexToBytes, isAddressableKind, isAuthRequired, isEphemeralKind, isHex32, isHex64, isInsecureRelayUrl, isNip07Available, isNostrURI, isRegularKind, isReplaceableKind, isReplaceableWinner, isTag, itemCompare, makeAuthEvent, matchFilter, matchFilters, mergeCountHll, naddrEncode, neventEncode, decode as nip19Decode, normalizeURL, noteEncode, nprofileEncode, npubEncode, nsecEncode, parseClientMessage, parseEventAddress, parseNostrURI, parseRelayList, parseRelayMessage, parseThreadTags, publicKeyFromHex, readRelays, relayListEventBuilder, relayListToTags, replyTo, serializeEvent, signEvent, signedMatchesUnsigned, sortEvents, sortedEvents, tagName, tagValue, toSecretKey, useWebSocketImplementation, validateEvent, validateSignedEvent, verifyEvent, writeRelays };

package/dist/index.mjs

@@ -1,27 +1,27 @@
 import { D as SIGNATURE_BYTES, E as SECRET_KEY_BYTES, O as SUBSCRIPTION_ID_MAX_CHARS, T as PUBLIC_KEY_BYTES, _ as HexError, b as UrlError, c as isHex64, d as normalizeURL, g as EventValidationError, h as CryptoError, i as bytesToHex, o as hexToBytes, s as isHex32, v as MessageError, w as EVENT_ID_BYTES, x as WasmPoisonedError, y as NostrError } from "./util-DDpPkiED.mjs";
 import { a as isRegularKind, i as isEphemeralKind, n as classifyKind, o as isReplaceableKind, r as isAddressableKind, t as Kind } from "./kind-D8fENiiL.mjs";
 import { C as tagName, S as parseEventAddress, _ as eventAddress, a as isReplaceableWinner, b as getDTag, d as signedMatchesUnsigned, f as sortEvents, g as Tag, h as validateSignedEvent, l as serializeEvent, m as validateEvent, n as getEventHash, o as itemCompare, p as sortedEvents, w as tagValue, x as isTag, y as formatEventAddress } from "./event-B3ua2_oL.mjs";
-import { a as publicKeyFromHex, i as getPublicKey, n as SecretKey, o as signEvent, r as finalizeEvent, s as toSecretKey, t as Keys } from "./key-k8LDEPZh.mjs";
+import { a as publicKeyFromHex, i as getPublicKey, n as SecretKey, o as signEvent, r as finalizeEvent, s as toSecretKey, t as Keys } from "./key-B218_SoL.mjs";
 import { n as verifyEvent, t as createEventVerifier } from "./verifier-CjH1vnP2.mjs";
-import { t as EventBuilder } from "./builder-BQbFDO6S.mjs";
+import { t as EventBuilder } from "./builder-Cf2N12CG.mjs";
 import { a as matchFilter, i as getFilterLimit, n as canonicalizeFilters, o as matchFilters, r as filterFingerprint, t as canonicalizeFilter } from "./filter-B16P33dz.mjs";
 import { a as mergeCountHll, i as encodeRelayMessage, n as createSubscriptionId, o as parseClientMessage, r as encodeClientMessage, s as parseRelayMessage, t as assertSubscriptionId } from "./message-pYfVKxPn.mjs";
-import { t as NoSignerError } from "./error-UHkqzWL7.mjs";
-import { a as KeysSigner, i as isNip07Available, n as Nip07Signer, r as getWindowNostr, t as Nip46Signer } from "./signer-CWtxpOxc.mjs";
+import { n as SignerDisposedError, t as NoSignerError } from "./error-D3VNRVhL.mjs";
+import { a as KeysSigner, i as isNip07Available, n as Nip07Signer, o as DelegatedSigner, r as getWindowNostr, t as Nip46Signer } from "./signer-CNTIeYH4.mjs";
 import { Bech32MaxSize, Nip19Error, decode, naddrEncode, neventEncode, noteEncode, nprofileEncode, npubEncode, nsecEncode } from "./nips/nip19.mjs";
 import { Nip21Error, isNostrURI, parseNostrURI } from "./nips/nip21.mjs";
 import { buildReplyTags, parseThreadTags, replyTo } from "./nips/nip10.mjs";
 import { isAuthRequired, makeAuthEvent } from "./nips/nip42.mjs";
 import { parseRelayList, readRelays, relayListEventBuilder, relayListToTags, writeRelays } from "./nips/nip65.mjs";
-import { c as RelayConnectionError, d as RelaySuspendedError, f as RelayTimeoutError, l as RelayError, n as Relay, o as useWebSocketImplementation, r as RelayStatus, s as RelayClosedError, u as RelayPublishError } from "./relay-DXtwUEdX.mjs";
-import { i as isInsecureRelayUrl, t as Pool } from "./pool-BMUsw2un.mjs";
+import { c as RelayConnectionError, d as RelaySuspendedError, f as RelayTimeoutError, l as RelayError, n as Relay, o as useWebSocketImplementation, r as RelayStatus, s as RelayClosedError, u as RelayPublishError } from "./relay-BGPqiGKF.mjs";
+import { i as isInsecureRelayUrl, t as Pool } from "./pool-THuuOW4S.mjs";
 import "./relay.mjs";
 import { t as Gossip } from "./gossip-K_JIexQs.mjs";
-import { a as bareNostrUser, i as groupAuthorsByOutboxRelay, n as OutboxError, r as OutboxFeed, t as createLoaders } from "./loaders-Dp2nXEFk.mjs";
+import { a as bareNostrUser, i as groupAuthorsByOutboxRelay, n as OutboxError, r as OutboxFeed, t as createLoaders } from "./loaders-Xdbx-K61.mjs";
 import { t as StorageError } from "./error-DH4guike.mjs";
 import { t as MemoryEventStore } from "./memory-VyPnOBU3.mjs";
 import { t as ReactiveEventStore } from "./reactive--pDpLt2H.mjs";
-import { n as ClientError, r as SyncDirection, t as Client } from "./client-CTmp5w84.mjs";
+import { n as ClientError, r as SyncDirection, t as Client } from "./client-B3_vToDX.mjs";
 import { n as IndexedDbEventStore, t as SqliteEventStore } from "./storage-B5Wdt_Mn.mjs";
 import "./store.mjs";
-export { Bech32MaxSize, Client, ClientError, CryptoError, EVENT_ID_BYTES, EventBuilder, EventValidationError, Gossip, HexError, IndexedDbEventStore, Keys, KeysSigner, Kind, MemoryEventStore, MessageError, Nip07Signer, Nip19Error, Nip21Error, Nip46Signer, NoSignerError, NostrError, OutboxError, OutboxFeed, PUBLIC_KEY_BYTES, Pool, ReactiveEventStore, Relay, RelayClosedError, RelayConnectionError, RelayError, RelayPublishError, RelayStatus, RelaySuspendedError, RelayTimeoutError, SECRET_KEY_BYTES, SIGNATURE_BYTES, SUBSCRIPTION_ID_MAX_CHARS, SecretKey, SqliteEventStore, StorageError, SyncDirection, Tag, UrlError, WasmPoisonedError, assertSubscriptionId, bareNostrUser, buildReplyTags, bytesToHex, canonicalizeFilter, canonicalizeFilters, classifyKind, createEventVerifier, createLoaders, createSubscriptionId, encodeClientMessage, encodeRelayMessage, eventAddress, filterFingerprint, finalizeEvent, formatEventAddress, getDTag, getEventHash, getFilterLimit, getPublicKey, getWindowNostr, groupAuthorsByOutboxRelay, hexToBytes, isAddressableKind, isAuthRequired, isEphemeralKind, isHex32, isHex64, isInsecureRelayUrl, isNip07Available, isNostrURI, isRegularKind, isReplaceableKind, isReplaceableWinner, isTag, itemCompare, makeAuthEvent, matchFilter, matchFilters, mergeCountHll, naddrEncode, neventEncode, decode as nip19Decode, normalizeURL, noteEncode, nprofileEncode, npubEncode, nsecEncode, parseClientMessage, parseEventAddress, parseNostrURI, parseRelayList, parseRelayMessage, parseThreadTags, publicKeyFromHex, readRelays, relayListEventBuilder, relayListToTags, replyTo, serializeEvent, signEvent, signedMatchesUnsigned, sortEvents, sortedEvents, tagName, tagValue, toSecretKey, useWebSocketImplementation, validateEvent, validateSignedEvent, verifyEvent, writeRelays };
+export { Bech32MaxSize, Client, ClientError, CryptoError, DelegatedSigner, EVENT_ID_BYTES, EventBuilder, EventValidationError, Gossip, HexError, IndexedDbEventStore, Keys, KeysSigner, Kind, MemoryEventStore, MessageError, Nip07Signer, Nip19Error, Nip21Error, Nip46Signer, NoSignerError, NostrError, OutboxError, OutboxFeed, PUBLIC_KEY_BYTES, Pool, ReactiveEventStore, Relay, RelayClosedError, RelayConnectionError, RelayError, RelayPublishError, RelayStatus, RelaySuspendedError, RelayTimeoutError, SECRET_KEY_BYTES, SIGNATURE_BYTES, SUBSCRIPTION_ID_MAX_CHARS, SecretKey, SignerDisposedError, SqliteEventStore, StorageError, SyncDirection, Tag, UrlError, WasmPoisonedError, assertSubscriptionId, bareNostrUser, buildReplyTags, bytesToHex, canonicalizeFilter, canonicalizeFilters, classifyKind, createEventVerifier, createLoaders, createSubscriptionId, encodeClientMessage, encodeRelayMessage, eventAddress, filterFingerprint, finalizeEvent, formatEventAddress, getDTag, getEventHash, getFilterLimit, getPublicKey, getWindowNostr, groupAuthorsByOutboxRelay, hexToBytes, isAddressableKind, isAuthRequired, isEphemeralKind, isHex32, isHex64, isInsecureRelayUrl, isNip07Available, isNostrURI, isRegularKind, isReplaceableKind, isReplaceableWinner, isTag, itemCompare, makeAuthEvent, matchFilter, matchFilters, mergeCountHll, naddrEncode, neventEncode, decode as nip19Decode, normalizeURL, noteEncode, nprofileEncode, npubEncode, nsecEncode, parseClientMessage, parseEventAddress, parseNostrURI, parseRelayList, parseRelayMessage, parseThreadTags, publicKeyFromHex, readRelays, relayListEventBuilder, relayListToTags, replyTo, serializeEvent, signEvent, signedMatchesUnsigned, sortEvents, sortedEvents, tagName, tagValue, toSecretKey, useWebSocketImplementation, validateEvent, validateSignedEvent, verifyEvent, writeRelays };

package/dist/{key-k8LDEPZh.mjs → key-B218_SoL.mjs}

@@ -66,7 +66,13 @@ var Keys = class Keys {
 	constructor(secretKey, backend) {
 		this.secretKey = secretKey;
 		this.backend = backend;
-		const pubkey = backend.publicKey(secretKey.bytes);
+		const secretBytes = secretKey.bytes;
+		let pubkey;
+		try {
+			pubkey = backend.publicKey(secretBytes);
+		} finally {
+			secretBytes.fill(0);
+		}
 		if (pubkey.length !== 32) throw new CryptoError("signing backend returned an invalid public key");
 		this.publicKey = bytesToHex$1(pubkey);
 	}
@@ -80,8 +86,15 @@ var Keys = class Keys {
 function resolveKeys(secretKey) {
 	return secretKey instanceof Keys ? secretKey : Keys.fromSecretKey(secretKey);
 }
-/** Fill pubkey/id/sig on a template and return a signed event. */
-function finalizeEvent(template, secretKey) {
+/**
+* Fill pubkey/id/sig on a template and return a signed event.
+*
+* `auxRand` is the 32-byte BIP-340 auxiliary randomness. It defaults to a fresh `randomBytes(32)`
+* draw; an explicit value makes the signature reproducible, which is required for vectors and
+* tests. This is the counterpart of nk-core `Keys::sign_event_with_aux`. Never reuse aux randomness
+* in production.
+*/
+function finalizeEvent(template, secretKey, auxRand) {
 	const keys = resolveKeys(secretKey);
 	return signEvent({
 		kind: template.kind,
@@ -89,14 +102,20 @@ function finalizeEvent(template, secretKey) {
 		content: template.content,
 		created_at: template.created_at,
 		pubkey: keys.publicKey
-	}, keys);
+	}, keys, auxRand);
 }
 /**
 * Sign an already-assembled unsigned event. Rejects when `unsigned.pubkey` does not match the
 * secret key.
+*
+* `auxRand` is the 32-byte BIP-340 auxiliary randomness. It defaults to a fresh `randomBytes(32)`
+* draw; an explicit value makes the signature reproducible, which is required for vectors and
+* tests. This is the counterpart of nk-core `Keys::sign_event_with_aux`. Never reuse aux randomness
+* in production.
 */
-function signEvent(unsigned, secretKey) {
+function signEvent(unsigned, secretKey, auxRand) {
 	const keys = resolveKeys(secretKey);
+	if (auxRand !== void 0 && auxRand.length !== 32) throw new CryptoError("auxRand must be 32 bytes");
 	if (!validateEvent(unsigned)) throw new EventValidationError("cannot sign invalid unsigned event");
 	if (unsigned.pubkey !== keys.publicKey) throw new CryptoError("unsigned event pubkey does not match secret key");
 	const normalized = {
@@ -107,7 +126,13 @@ function signEvent(unsigned, secretKey) {
 		pubkey: keys.publicKey
 	};
 	const id = bytesToHex$1(sha256(utf8Encoder.encode(serializeValidatedEvent(normalized))));
-	const sig = keys.backend.sign(hexToBytes$1(id), keys.secretKey.bytes, randomBytes(32));
+	const secretBytes = keys.secretKey.bytes;
+	let sig;
+	try {
+		sig = keys.backend.sign(hexToBytes$1(id), secretBytes, auxRand ?? randomBytes(32));
+	} finally {
+		secretBytes.fill(0);
+	}
 	if (sig.length !== 64) throw new CryptoError("signing backend returned an invalid signature");
 	const event = {
 		...normalized,
@@ -120,4 +145,4 @@ function signEvent(unsigned, secretKey) {
 //#endregion
 export { publicKeyFromHex as a, getPublicKey as i, SecretKey as n, signEvent as o, finalizeEvent as r, toSecretKey as s, Keys as t };
 
-//# sourceMappingURL=key-k8LDEPZh.mjs.map
+//# sourceMappingURL=key-B218_SoL.mjs.map

package/dist/key-B218_SoL.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-B218_SoL.mjs","names":["hexToBytes","bytesToHex"],"sources":["../src/core/key.ts"],"sourcesContent":["import { schnorr } from \"@noble/curves/secp256k1.js\";\nimport { sha256 } from \"@noble/hashes/sha2.js\";\nimport { randomBytes } from \"@noble/hashes/utils.js\";\n\nimport { CryptoError, EventValidationError } from \"./error.ts\";\nimport { markVerified, serializeValidatedEvent, validateEvent } from \"./event.ts\";\nimport type { Event, EventTemplate, UnsignedEvent } from \"./event.ts\";\nimport { assertHex32, assertSecretKeyBytes, bytesToHex, hexToBytes, utf8Encoder } from \"./util.ts\";\n\n/** 32-byte secret key held as bytes; prefer zeroize when done. */\nexport class SecretKey {\n  #bytes: Uint8Array | undefined;\n\n  private constructor(bytes: Uint8Array) {\n    assertSecretKeyBytes(bytes);\n    this.#bytes = new Uint8Array(bytes);\n  }\n\n  static generate(): SecretKey {\n    return new SecretKey(schnorr.utils.randomSecretKey());\n  }\n\n  static fromBytes(bytes: Uint8Array): SecretKey {\n    return new SecretKey(bytes);\n  }\n\n  static fromHex(hex: string): SecretKey {\n    return new SecretKey(hexToBytes(assertHex32(hex, \"secret key\")));\n  }\n\n  get bytes(): Uint8Array {\n    if (!this.#bytes) {\n      throw new CryptoError(\"secret key has been zeroized\");\n    }\n    return new Uint8Array(this.#bytes);\n  }\n\n  toHex(): string {\n    return bytesToHex(this.bytes);\n  }\n\n  /** Best-effort wipe of the internal buffer. */\n  zeroize(): void {\n    if (this.#bytes) {\n      this.#bytes.fill(0);\n      this.#bytes = undefined;\n    }\n  }\n}\n\n/** Anything a secret key can be given as: instance, raw bytes, or hex. */\nexport type SecretKeyInput = SecretKey | Uint8Array | string;\n\n/** Coerce a {@link SecretKeyInput} to {@link SecretKey}. */\nexport function toSecretKey(input: SecretKeyInput): SecretKey {\n  if (input instanceof SecretKey) {\n    return input;\n  }\n  if (typeof input === \"string\") {\n    return SecretKey.fromHex(input);\n  }\n  return SecretKey.fromBytes(input);\n}\n\n/** Lowercase hex-encoded secp256k1 public key (x-only, 64 chars). */\nexport type PublicKey = string;\n\n/** Validate and normalize a hex public key; throws {@link HexError} on bad input. */\nexport function publicKeyFromHex(hex: string): PublicKey {\n  return assertHex32(hex, \"public key\");\n}\n\n/**\n * BIP-340 signing backend. `publicKey` returns the 32-byte x-only public key of a 32-byte secret\n * key; `sign` returns the 64-byte BIP-340 signature of a 32-byte `id` using 32 bytes of auxiliary\n * randomness. Both throw on invalid input (for example an out-of-range secret key).\n */\nexport type SigningBackend = {\n  publicKey: (secretKey: Uint8Array) => Uint8Array;\n  sign: (id: Uint8Array, secretKey: Uint8Array, auxRand: Uint8Array) => Uint8Array;\n};\n\nconst nobleSigning: SigningBackend = {\n  publicKey: (secretKey) => schnorr.getPublicKey(secretKey),\n  sign: (id, secretKey, auxRand) => schnorr.sign(id, secretKey, auxRand),\n};\n\n/** Derive the public key for a secret key given as SecretKey, bytes, or hex. */\nexport function getPublicKey(secretKey: SecretKeyInput): PublicKey {\n  return bytesToHex(schnorr.getPublicKey(toSecretKey(secretKey).bytes));\n}\n\n/** Keypair convenience wrapper. */\nexport class Keys {\n  readonly secretKey: SecretKey;\n  readonly publicKey: PublicKey;\n  /**\n   * BIP-340 backend that derived {@link publicKey} and signs in {@link finalizeEvent}/\n   * {@link signEvent}. Defaults to noble; pass a loaded `NostrWasm` module or a native backend to\n   * delegate signing.\n   */\n  readonly backend: SigningBackend;\n\n  private constructor(secretKey: SecretKey, backend: SigningBackend) {\n    this.secretKey = secretKey;\n    this.backend = backend;\n    const secretBytes = secretKey.bytes;\n    let pubkey: Uint8Array;\n    try {\n      pubkey = backend.publicKey(secretBytes);\n    } finally {\n      secretBytes.fill(0);\n    }\n    if (pubkey.length !== 32) {\n      throw new CryptoError(\"signing backend returned an invalid public key\");\n    }\n    this.publicKey = bytesToHex(pubkey);\n  }\n\n  static generate(backend: SigningBackend = nobleSigning): Keys {\n    return new Keys(SecretKey.generate(), backend);\n  }\n\n  static fromSecretKey(secretKey: SecretKeyInput, backend: SigningBackend = nobleSigning): Keys {\n    return new Keys(toSecretKey(secretKey), backend);\n  }\n}\n\nfunction resolveKeys(secretKey: SecretKeyInput | Keys): Keys {\n  return secretKey instanceof Keys ? secretKey : Keys.fromSecretKey(secretKey);\n}\n\n/**\n * Fill pubkey/id/sig on a template and return a signed event.\n *\n * `auxRand` is the 32-byte BIP-340 auxiliary randomness. It defaults to a fresh `randomBytes(32)`\n * draw; an explicit value makes the signature reproducible, which is required for vectors and\n * tests. This is the counterpart of nk-core `Keys::sign_event_with_aux`. Never reuse aux randomness\n * in production.\n */\nexport function finalizeEvent(\n  template: EventTemplate,\n  secretKey: SecretKeyInput | Keys,\n  auxRand?: Uint8Array,\n): Event {\n  const keys = resolveKeys(secretKey);\n  const unsigned: UnsignedEvent = {\n    kind: template.kind,\n    tags: template.tags,\n    content: template.content,\n    created_at: template.created_at,\n    pubkey: keys.publicKey,\n  };\n  return signEvent(unsigned, keys, auxRand);\n}\n\n/**\n * Sign an already-assembled unsigned event. Rejects when `unsigned.pubkey` does not match the\n * secret key.\n *\n * `auxRand` is the 32-byte BIP-340 auxiliary randomness. It defaults to a fresh `randomBytes(32)`\n * draw; an explicit value makes the signature reproducible, which is required for vectors and\n * tests. This is the counterpart of nk-core `Keys::sign_event_with_aux`. Never reuse aux randomness\n * in production.\n */\nexport function signEvent(\n  unsigned: UnsignedEvent,\n  secretKey: SecretKeyInput | Keys,\n  auxRand?: Uint8Array,\n): Event {\n  const keys = resolveKeys(secretKey);\n  if (auxRand !== undefined && auxRand.length !== 32) {\n    throw new CryptoError(\"auxRand must be 32 bytes\");\n  }\n  if (!validateEvent(unsigned)) {\n    throw new EventValidationError(\"cannot sign invalid unsigned event\");\n  }\n\n  if (unsigned.pubkey !== keys.publicKey) {\n    throw new CryptoError(\"unsigned event pubkey does not match secret key\");\n  }\n\n  const normalized: UnsignedEvent = {\n    kind: unsigned.kind,\n    tags: unsigned.tags,\n    content: unsigned.content,\n    created_at: unsigned.created_at,\n    pubkey: keys.publicKey,\n  };\n\n  const id = bytesToHex(sha256(utf8Encoder.encode(serializeValidatedEvent(normalized))));\n  const secretBytes = keys.secretKey.bytes;\n  let sig: Uint8Array;\n  try {\n    sig = keys.backend.sign(hexToBytes(id), secretBytes, auxRand ?? randomBytes(32));\n  } finally {\n    secretBytes.fill(0);\n  }\n  if (sig.length !== 64) {\n    throw new CryptoError(\"signing backend returned an invalid signature\");\n  }\n  const event: Event = { ...normalized, id, sig: bytesToHex(sig) };\n  markVerified(event);\n  return event;\n}\n"],"mappings":";;;;;;;AAUA,IAAa,YAAb,MAAa,UAAU;CACrB;CAEA,YAAoB,OAAmB;EACrC,qBAAqB,KAAK;EAC1B,KAAK,SAAS,IAAI,WAAW,KAAK;CACpC;CAEA,OAAO,WAAsB;EAC3B,OAAO,IAAI,UAAU,QAAQ,MAAM,gBAAgB,CAAC;CACtD;CAEA,OAAO,UAAU,OAA8B;EAC7C,OAAO,IAAI,UAAU,KAAK;CAC5B;CAEA,OAAO,QAAQ,KAAwB;EACrC,OAAO,IAAI,UAAUA,aAAW,YAAY,KAAK,YAAY,CAAC,CAAC;CACjE;CAEA,IAAI,QAAoB;EACtB,IAAI,CAAC,KAAK,QACR,MAAM,IAAI,YAAY,8BAA8B;EAEtD,OAAO,IAAI,WAAW,KAAK,MAAM;CACnC;CAEA,QAAgB;EACd,OAAOC,aAAW,KAAK,KAAK;CAC9B;;CAGA,UAAgB;EACd,IAAI,KAAK,QAAQ;GACf,KAAK,OAAO,KAAK,CAAC;GAClB,KAAK,SAAS,KAAA;EAChB;CACF;AACF;;AAMA,SAAgB,YAAY,OAAkC;CAC5D,IAAI,iBAAiB,WACnB,OAAO;CAET,IAAI,OAAO,UAAU,UACnB,OAAO,UAAU,QAAQ,KAAK;CAEhC,OAAO,UAAU,UAAU,KAAK;AAClC;;AAMA,SAAgB,iBAAiB,KAAwB;CACvD,OAAO,YAAY,KAAK,YAAY;AACtC;AAYA,MAAM,eAA+B;CACnC,YAAY,cAAc,QAAQ,aAAa,SAAS;CACxD,OAAO,IAAI,WAAW,YAAY,QAAQ,KAAK,IAAI,WAAW,OAAO;AACvE;;AAGA,SAAgB,aAAa,WAAsC;CACjE,OAAOA,aAAW,QAAQ,aAAa,YAAY,SAAS,CAAC,CAAC,KAAK,CAAC;AACtE;;AAGA,IAAa,OAAb,MAAa,KAAK;CAChB;CACA;;;;;;CAMA;CAEA,YAAoB,WAAsB,SAAyB;EACjE,KAAK,YAAY;EACjB,KAAK,UAAU;EACf,MAAM,cAAc,UAAU;EAC9B,IAAI;EACJ,IAAI;GACF,SAAS,QAAQ,UAAU,WAAW;EACxC,UAAU;GACR,YAAY,KAAK,CAAC;EACpB;EACA,IAAI,OAAO,WAAW,IACpB,MAAM,IAAI,YAAY,gDAAgD;EAExE,KAAK,YAAYA,aAAW,MAAM;CACpC;CAEA,OAAO,SAAS,UAA0B,cAAoB;EAC5D,OAAO,IAAI,KAAK,UAAU,SAAS,GAAG,OAAO;CAC/C;CAEA,OAAO,cAAc,WAA2B,UAA0B,cAAoB;EAC5F,OAAO,IAAI,KAAK,YAAY,SAAS,GAAG,OAAO;CACjD;AACF;AAEA,SAAS,YAAY,WAAwC;CAC3D,OAAO,qBAAqB,OAAO,YAAY,KAAK,cAAc,SAAS;AAC7E;;;;;;;;;AAUA,SAAgB,cACd,UACA,WACA,SACO;CACP,MAAM,OAAO,YAAY,SAAS;CAQlC,OAAO,UAAU;EANf,MAAM,SAAS;EACf,MAAM,SAAS;EACf,SAAS,SAAS;EAClB,YAAY,SAAS;EACrB,QAAQ,KAAK;CAES,GAAG,MAAM,OAAO;AAC1C;;;;;;;;;;AAWA,SAAgB,UACd,UACA,WACA,SACO;CACP,MAAM,OAAO,YAAY,SAAS;CAClC,IAAI,YAAY,KAAA,KAAa,QAAQ,WAAW,IAC9C,MAAM,IAAI,YAAY,0BAA0B;CAElD,IAAI,CAAC,cAAc,QAAQ,GACzB,MAAM,IAAI,qBAAqB,oCAAoC;CAGrE,IAAI,SAAS,WAAW,KAAK,WAC3B,MAAM,IAAI,YAAY,iDAAiD;CAGzE,MAAM,aAA4B;EAChC,MAAM,SAAS;EACf,MAAM,SAAS;EACf,SAAS,SAAS;EAClB,YAAY,SAAS;EACrB,QAAQ,KAAK;CACf;CAEA,MAAM,KAAKA,aAAW,OAAO,YAAY,OAAO,wBAAwB,UAAU,CAAC,CAAC,CAAC;CACrF,MAAM,cAAc,KAAK,UAAU;CACnC,IAAI;CACJ,IAAI;EACF,MAAM,KAAK,QAAQ,KAAKD,aAAW,EAAE,GAAG,aAAa,WAAW,YAAY,EAAE,CAAC;CACjF,UAAU;EACR,YAAY,KAAK,CAAC;CACpB;CACA,IAAI,IAAI,WAAW,IACjB,MAAM,IAAI,YAAY,+CAA+C;CAEvE,MAAM,QAAe;EAAE,GAAG;EAAY;EAAI,KAAKC,aAAW,GAAG;CAAE;CAC/D,aAAa,KAAK;CAClB,OAAO;AACT"}

package/dist/{key-CyKN1RTi.d.mts → key-CwMVo14x.d.mts}

@@ -45,13 +45,25 @@ declare class Keys {
   static generate(backend?: SigningBackend): Keys;
   static fromSecretKey(secretKey: SecretKeyInput, backend?: SigningBackend): Keys;
 }
-/** Fill pubkey/id/sig on a template and return a signed event. */
-declare function finalizeEvent(template: EventTemplate, secretKey: SecretKeyInput | Keys): Event;
+/**
+ * Fill pubkey/id/sig on a template and return a signed event.
+ *
+ * `auxRand` is the 32-byte BIP-340 auxiliary randomness. It defaults to a fresh `randomBytes(32)`
+ * draw; an explicit value makes the signature reproducible, which is required for vectors and
+ * tests. This is the counterpart of nk-core `Keys::sign_event_with_aux`. Never reuse aux randomness
+ * in production.
+ */
+declare function finalizeEvent(template: EventTemplate, secretKey: SecretKeyInput | Keys, auxRand?: Uint8Array): Event;
 /**
  * Sign an already-assembled unsigned event. Rejects when `unsigned.pubkey` does not match the
  * secret key.
+ *
+ * `auxRand` is the 32-byte BIP-340 auxiliary randomness. It defaults to a fresh `randomBytes(32)`
+ * draw; an explicit value makes the signature reproducible, which is required for vectors and
+ * tests. This is the counterpart of nk-core `Keys::sign_event_with_aux`. Never reuse aux randomness
+ * in production.
  */
-declare function signEvent(unsigned: UnsignedEvent, secretKey: SecretKeyInput | Keys): Event;
+declare function signEvent(unsigned: UnsignedEvent, secretKey: SecretKeyInput | Keys, auxRand?: Uint8Array): Event;
 //#endregion
 export { SigningBackend as a, publicKeyFromHex as c, SecretKeyInput as i, signEvent as l, PublicKey as n, finalizeEvent as o, SecretKey as r, getPublicKey as s, Keys as t, toSecretKey as u };
-//# sourceMappingURL=key-CyKN1RTi.d.mts.map
+//# sourceMappingURL=key-CwMVo14x.d.mts.map

package/dist/{loaders-Dp2nXEFk.mjs → loaders-Xdbx-K61.mjs}

@@ -5,7 +5,7 @@ import { i as throwIfAborted } from "./abort-DBq2STPj.mjs";
 import { t as invokeSafely } from "./report-CHld4uWj.mjs";
 import { Nip19Error, decode, npubEncode } from "./nips/nip19.mjs";
 import { parseRelayList } from "./nips/nip65.mjs";
-import "./relay-DXtwUEdX.mjs";
+import "./relay-BGPqiGKF.mjs";
 import { i as trimOldest, r as touchKey } from "./collections-DtwMc1NU.mjs";
 import { parseDmRelayList } from "./nips/nip17.mjs";
 import { parseMuteList } from "./nips/nip51.mjs";
@@ -780,4 +780,4 @@ function createLoaders(opts) {
 //#endregion
 export { bareNostrUser as a, groupAuthorsByOutboxRelay as i, OutboxError as n, OutboxFeed as r, createLoaders as t };
 
-//# sourceMappingURL=loaders-Dp2nXEFk.mjs.map
+//# sourceMappingURL=loaders-Xdbx-K61.mjs.map