@qntx/nostr 0.11.0 → 0.13.0

package/dist/{index-N7HUGgwo.d.mts → index-YID-zPDF.d.mts}

@@ -1,9 +1,9 @@
 import { n as EventTemplate, r as UnsignedEvent, t as Event } from "./event-j3BwI5dF.mjs";
-import { i as SecretKeyInput, t as Keys } from "./key-CyKN1RTi.mjs";
-import { t as Filter } from "./filter-PG7r79rt.mjs";
-import { a as NostrError } from "./error-BquXDmIN.mjs";
+import { i as SecretKeyInput, t as Keys } from "./key-DojW2QZl.mjs";
+import { t as Filter } from "./filter-oYG2zjJ3.mjs";
+import { a as NostrError } from "./error-BPqAU5RB.mjs";
 import { t as NostrSigner } from "./types-BJ4wZ7JJ.mjs";
-import { n as ClientMetadata, t as BunkerPointer } from "./nip46-BHaxC9TZ.mjs";
+import { n as ClientMetadata, t as BunkerPointer } from "./nip46-i8L8_nIm.mjs";
 //#region src/signer/error.d.ts
 /**
  * Thrown by a lazy NIP-42 AUTH sign function when no signer is configured at challenge time.
@@ -13,12 +13,57 @@ import { n as ClientMetadata, t as BunkerPointer } from "./nip46-BHaxC9TZ.mjs";
 declare class NoSignerError extends NostrError {
   name: string;
 }
+/** Thrown when a method is called on a signer after {@link NostrSigner dispose}. */
+declare class SignerDisposedError extends NostrError {
+  name: string;
+}
+//#endregion
+//#region src/signer/delegated.d.ts
+/**
+ * The three operations an external key holder (wallet keyring, NFC card, platform secure store)
+ * provides. The secret itself never enters this process.
+ */
+type NostrKeyOperations = {
+  /** Lowercase 64-char hex x-only public key. */
+  getPublicKey: () => Promise<string>;
+  /** 64-byte BIP-340 signature over the 32-byte event id. */
+  signEventId: (id: Uint8Array) => Promise<Uint8Array>;
+  /**
+   * Optional. 32-byte x-coordinate of `ECDH(secret, lift_x(peer))`, unhashed. Enables NIP-04 and
+   * NIP-44.
+   */
+  sharedSecret?: (peer: string) => Promise<Uint8Array>;
+};
+/**
+ * {@link NostrSigner} backed by a {@link NostrKeyOperations} key holder. The signer verifies
+ * everything the holder returns: the public key shape, the signature length, and the BIP-340
+ * signature itself — a misbehaving holder never produces an event relays would reject.
+ */
+declare class DelegatedSigner implements NostrSigner {
+  #private;
+  constructor(operations: NostrKeyOperations);
+  getPublicKey(): Promise<string>;
+  signEvent(unsigned: UnsignedEvent): Promise<Event>;
+  nip44Encrypt(peer: string, plaintext: string): Promise<string>;
+  nip44Decrypt(peer: string, payload: string): Promise<string>;
+  nip04Encrypt(peer: string, plaintext: string): Promise<string>;
+  nip04Decrypt(peer: string, ciphertext: string): Promise<string>;
+  /**
+   * Zero-fill and clear every cached NIP-44 conversation key. All later calls reject with
+   * {@link SignerDisposedError} and never reach the key holder. Idempotent.
+   */
+  dispose(): void;
+}
 //#endregion
 //#region src/signer/keys.d.ts
 /** Local secret-key signer with NIP-04 (legacy) and NIP-44 support. */
 declare class KeysSigner implements NostrSigner {
   #private;
   constructor(secretKey: SecretKeyInput | Keys);
+  /**
+   * The live {@link Keys} instance holding the secret material. {@link KeysSigner.dispose} zeroizes
+   * it, so a reference obtained earlier reports a zeroized secret afterwards.
+   */
   get keys(): Keys;
   getPublicKey(): Promise<string>;
   signEvent(unsigned: UnsignedEvent): Promise<Event>;
@@ -26,6 +71,11 @@ declare class KeysSigner implements NostrSigner {
   nip04Decrypt(peer: string, ciphertext: string): Promise<string>;
   nip44Encrypt(peer: string, plaintext: string): Promise<string>;
   nip44Decrypt(peer: string, payload: string): Promise<string>;
+  /**
+   * Zeroize the wrapped secret key and every cached NIP-44 conversation key. All later calls reject
+   * with {@link SignerDisposedError}. Idempotent.
+   */
+  dispose(): void;
 }
 //#endregion
 //#region src/signer/nip07.d.ts
@@ -69,8 +119,8 @@ declare class Nip07Signer implements NostrSigner {
 /** Subscribe options used by NIP-46 transport (structural subset of Pool). */
 type Nip46SubscribeOptions = {
   signal?: AbortSignal | undefined;
-  onevent?: ((event: Event) => void) | undefined;
-  onclose?: ((reason: string) => void) | undefined;
+  onEvent?: ((event: Event) => void) | undefined;
+  onClose?: ((reason: string) => void) | undefined;
 };
 /**
  * Structural relay transport for NIP-46 RPC. Satisfied by {@link import("../relay/pool.ts").Pool};
@@ -173,5 +223,5 @@ declare class Nip46Signer implements NostrSigner {
   close(): Promise<void>;
 }
 //#endregion
-export { Nip07Signer as a, isNip07Available as c, Nip46Transport as i, KeysSigner as l, Nip46SignerOptions as n, WindowNostr as o, Nip46SubscribeOptions as r, getWindowNostr as s, Nip46Signer as t, NoSignerError as u };
-//# sourceMappingURL=index-N7HUGgwo.d.mts.map
+export { Nip07Signer as a, isNip07Available as c, NostrKeyOperations as d, NoSignerError as f, Nip46Transport as i, KeysSigner as l, Nip46SignerOptions as n, WindowNostr as o, SignerDisposedError as p, Nip46SubscribeOptions as r, getWindowNostr as s, Nip46Signer as t, DelegatedSigner as u };
+//# sourceMappingURL=index-YID-zPDF.d.mts.map

package/dist/{index-CSsnE32i.d.mts → index-muydfuYD.d.mts}

@@ -1,16 +1,16 @@
 import { n as EventTemplate, r as UnsignedEvent, t as Event } from "./event-j3BwI5dF.mjs";
-import { t as EventBuilder } from "./builder-GBddxj8i.mjs";
-import { t as Filter } from "./filter-PG7r79rt.mjs";
-import { t as Gossip } from "./gossip-BTMdlUI7.mjs";
-import { a as NostrError } from "./error-BquXDmIN.mjs";
-import { _ as Closer, a as PoolFetchResult, n as Pool, o as PoolOptions, s as PoolPublishResult } from "./pool-DUuYJ0x4.mjs";
-import { t as EventStore } from "./types-CqhnT-Mx.mjs";
-import { t as ReactiveEventStore } from "./reactive-jyKrA9ej.mjs";
-import { a as OutboxFeed, n as Loaders } from "./index-BP94lABY.mjs";
-import { a as Rumor } from "./nip59-CdDoJptA.mjs";
-import { i as ReplyTo, r as Recipient } from "./nip17-B7MI82Iq.mjs";
+import { t as EventBuilder } from "./builder-C72nJITG.mjs";
+import { t as Filter } from "./filter-oYG2zjJ3.mjs";
+import { t as Gossip } from "./gossip-BvCItMVZ.mjs";
+import { a as NostrError } from "./error-BPqAU5RB.mjs";
+import { _ as Closer, a as PoolFetchResult, n as Pool, o as PoolOptions, s as PoolPublishResult } from "./pool-MehgIIzm.mjs";
+import { t as EventStore } from "./types-DiVVyf1e.mjs";
+import { t as ReactiveEventStore } from "./reactive-B7lPFgTS.mjs";
+import { a as OutboxFeed, n as Loaders } from "./index-DCobP2Jj.mjs";
+import { a as Rumor } from "./nip59-DfJ6Moeu.mjs";
+import { i as ReplyTo, r as Recipient } from "./nip17-BZvFQLcs.mjs";
 import { t as NostrSigner } from "./types-BJ4wZ7JJ.mjs";
-import { t as StorageError } from "./error-BD_0QFKT.mjs";
+import { t as StorageError } from "./error-BjSUsx6M.mjs";
 //#region src/client/types.d.ts
 /** Direction of a {@link Client.sync} run: upload, download, or both. */
 declare const SyncDirection: {
@@ -97,7 +97,7 @@ type FetchEventsOptions = {
    * Every event of every relay batch, including duplicates across relays. `relayUrl` is the
    * normalized URL of the relay that delivered it.
    */
-  onevent?: ((event: Event, relayUrl: string) => void) | undefined;
+  onEvent?: ((event: Event, relayUrl: string) => void) | undefined;
 };
 /** Options for {@link Client.fetchEach}: one-shot per-relay fetch, no gossip routing. */
 type FetchEachOptions = {
@@ -113,15 +113,15 @@ type SubscribeOptions = {
    * First receipt of each event only (deduped across relays). `relayUrl` is the normalized URL of
    * the relay that delivered it first.
    */
-  onevent?: ((event: Event, relayUrl: string) => void) | undefined;
+  onEvent?: ((event: Event, relayUrl: string) => void) | undefined;
   /** Every receipt from every relay, including duplicates skipped by dedupe. */
-  receivedEvent?: ((id: string, relayUrl: string) => void) | undefined;
-  oneose?: (() => void) | undefined;
-  onclose?: ((reason: string) => void) | undefined;
+  onEventSeen?: ((id: string, relayUrl: string) => void) | undefined;
+  onEose?: (() => void) | undefined;
+  onClose?: ((reason: string) => void) | undefined;
   signal?: AbortSignal | undefined;
   id?: string | undefined;
   /**
-   * If set, fire `oneose` once after this many ms if not all relays have EOSEd. Does not close the
+   * If set, fire `onEose` once after this many ms if not all relays have EOSEd. Does not close the
    * subscription.
    */
   eoseTimeoutMs?: number | undefined;
@@ -176,9 +176,9 @@ type FetchPrivateMessagesOptions = {
 /** Options for a live NIP-17 private-message subscription. */
 type SubscribePrivateMessagesOptions = {
   readonly since?: number | undefined;
-  readonly onevent?: ((msg: ReceivedPrivateMessage) => void) | undefined;
-  readonly oneose?: (() => void) | undefined;
-  readonly onclose?: ((reason: string) => void) | undefined;
+  readonly onEvent?: ((msg: ReceivedPrivateMessage) => void) | undefined;
+  readonly onEose?: (() => void) | undefined;
+  readonly onClose?: ((reason: string) => void) | undefined;
   readonly signal?: AbortSignal | undefined;
   readonly eoseTimeoutMs?: number | undefined;
   readonly observe?: boolean | undefined;
@@ -290,4 +290,4 @@ declare class Client {
 }
 //#endregion
 export { SyncSummary as _, FetchEachOptions as a, PrivateMessageSendResult as c, SendPrivateMessageOptions as d, SubscribeOptions as f, SyncOptions as g, SyncDirectionName as h, ClientOptions as i, PublishOptions as l, SyncDirection as m, ClientError as n, FetchEventsOptions as o, SubscribePrivateMessagesOptions as p, ClientEventMap as r, FetchPrivateMessagesOptions as s, Client as t, ReceivedPrivateMessage as u };
-//# sourceMappingURL=index-CSsnE32i.d.mts.map
+//# sourceMappingURL=index-muydfuYD.d.mts.map

package/dist/index.d.mts

@@ -1,25 +1,24 @@
 import { C as tagName, S as parseEventAddress, _ as eventAddress, b as getDTag, c as serializeEvent, d as sortedEvents, f as validateEvent, g as TagInput, h as Tag, i as getEventHash, l as signedMatchesUnsigned, m as EventAddress, n as EventTemplate, o as isReplaceableWinner, p as validateSignedEvent, r as UnsignedEvent, s as itemCompare, t as Event, u as sortEvents, w as tagValue, x as isTag, y as formatEventAddress } from "./event-j3BwI5dF.mjs";
-import { a as SigningBackend, c as publicKeyFromHex, i as SecretKeyInput, l as signEvent, n as PublicKey, o as finalizeEvent, r as SecretKey, s as getPublicKey, t as Keys, u as toSecretKey } from "./key-CyKN1RTi.mjs";
-import { n as ProfileMetadata, t as EventBuilder } from "./builder-GBddxj8i.mjs";
-import { a as getFilterLimit, i as filterFingerprint, n as canonicalizeFilter, o as matchFilter, r as canonicalizeFilters, s as matchFilters, t as Filter } from "./filter-PG7r79rt.mjs";
-import { a as relayListEventBuilder, i as readRelays, n as RelayMarker, o as relayListToTags, r as parseRelayList, s as writeRelays, t as RelayListItem } from "./nip65-BL79HI8N.mjs";
-import { i as RoutedFilter, r as PubkeyRoutes, t as Gossip } from "./gossip-BTMdlUI7.mjs";
-import { a as ClientMessage, c as SubscriptionId, d as encodeClientMessage, f as encodeRelayMessage, h as parseRelayMessage, i as verifyEvent, l as assertSubscriptionId, m as parseClientMessage, n as SerializedEventVerifier, o as CountResult, p as mergeCountHll, r as createEventVerifier, s as RelayMessage, t as EventVerifier, u as createSubscriptionId } from "./verifier-Cl24c9ph.mjs";
-import { a as NostrError, i as MessageError, n as EventValidationError, o as UrlError, r as HexError, s as WasmPoisonedError, t as CryptoError } from "./error-BquXDmIN.mjs";
-import { _ as Closer, a as PoolFetchResult, c as PoolSubscribeOptions, d as RelayOptions, f as RelayStatus, g as RelayFetchResult, h as RelayFetchEnd, i as PoolEventMap, l as Relay, m as PublishResult, n as Pool, o as PoolOptions, p as RelayStatusName, r as PoolCountResult, s as PoolPublishResult, t as InvalidEventPolicy, u as RelayEventMap, v as RelaySubscription, y as SubscribeOptions } from "./pool-DUuYJ0x4.mjs";
-import { i as useWebSocketImplementation } from "./websocket-CmeqvAkp.mjs";
-import { i as PutResult, n as NegentropyItem, r as OutboxBound, t as EventStore } from "./types-CqhnT-Mx.mjs";
-import { i as Watch, n as ReactiveEventStoreEventMap, r as ReactiveEventStoreOptions, t as ReactiveEventStore } from "./reactive-jyKrA9ej.mjs";
-import { _ as noteEncode, a as NAddr, b as nsecEncode, c as NPub, d as Note, f as ProfilePointer, g as neventEncode, h as naddrEncode, i as EventPointer, l as NSec, n as Bech32MaxSize, o as NEvent, p as decode, r as DecodedResult, s as NProfile, t as AddressPointer, u as Nip19Error, v as nprofileEncode, y as npubEncode } from "./nip19-DpPN17bY.mjs";
-import { a as OutboxFeed, c as NostrUser, f as ListResult, h as ReplaceableLoader, i as OutboxError, m as ReplaceableLoadResult, n as Loaders, o as OutboxFeedOptions, p as LoadStyle, r as createLoaders, s as groupAuthorsByOutboxRelay, u as bareNostrUser } from "./index-BP94lABY.mjs";
+import { a as SigningBackend, c as publicKeyFromHex, i as SecretKeyInput, l as signEvent, n as PublicKey, o as finalizeEvent, r as SecretKey, s as getPublicKey, t as Keys, u as toSecretKey } from "./key-DojW2QZl.mjs";
+import { n as ProfileMetadata, t as EventBuilder } from "./builder-C72nJITG.mjs";
+import { a as getFilterLimit, i as filterFingerprint, n as canonicalizeFilter, o as matchFilter, r as canonicalizeFilters, s as matchFilters, t as Filter } from "./filter-oYG2zjJ3.mjs";
+import { a as relayListEventBuilder, i as readRelays, n as RelayMarker, o as relayListToTags, r as parseRelayList, s as writeRelays, t as RelayListItem } from "./nip65-CPNE0SV0.mjs";
+import { i as RoutedFilter, r as PubkeyRoutes, t as Gossip } from "./gossip-BvCItMVZ.mjs";
+import { a as ClientMessage, c as SubscriptionId, d as encodeClientMessage, f as encodeRelayMessage, h as parseRelayMessage, i as verifyEvent, l as assertSubscriptionId, m as parseClientMessage, n as SerializedEventVerifier, o as CountResult, p as mergeCountHll, r as createEventVerifier, s as RelayMessage, t as EventVerifier, u as createSubscriptionId } from "./verifier-DhAbqVJF.mjs";
+import { a as NostrError, i as MessageError, n as EventValidationError, o as UrlError, r as HexError, t as CryptoError } from "./error-BPqAU5RB.mjs";
+import { _ as Closer, a as PoolFetchResult, c as PoolSubscribeOptions, d as RelayOptions, f as RelayStatus, g as RelayFetchResult, h as RelayFetchEnd, i as PoolEventMap, l as Relay, m as PublishResult, n as Pool, o as PoolOptions, p as RelayStatusName, r as PoolCountResult, s as PoolPublishResult, t as InvalidEventPolicy, u as RelayEventMap, v as RelaySubscription, y as SubscribeOptions } from "./pool-MehgIIzm.mjs";
+import { i as PutResult, n as NegentropyItem, r as OutboxBound, t as EventStore } from "./types-DiVVyf1e.mjs";
+import { i as Watch, n as ReactiveEventStoreEventMap, r as ReactiveEventStoreOptions, t as ReactiveEventStore } from "./reactive-B7lPFgTS.mjs";
+import { _ as noteEncode, a as NAddr, b as nsecEncode, c as NPub, d as Note, f as ProfilePointer, g as neventEncode, h as naddrEncode, i as EventPointer, l as NSec, n as Bech32MaxSize, o as NEvent, p as decode, r as DecodedResult, s as NProfile, t as AddressPointer, u as Nip19Error, v as nprofileEncode, y as npubEncode } from "./nip19-D4RKn6GC.mjs";
+import { a as OutboxFeed, c as NostrUser, f as ListResult, h as ReplaceableLoader, i as OutboxError, m as ReplaceableLoadResult, n as Loaders, o as OutboxFeedOptions, p as LoadStyle, r as createLoaders, s as groupAuthorsByOutboxRelay, u as bareNostrUser } from "./index-DCobP2Jj.mjs";
 import { t as NostrSigner } from "./types-BJ4wZ7JJ.mjs";
-import { t as StorageError } from "./error-BD_0QFKT.mjs";
-import { _ as SyncSummary, c as PrivateMessageSendResult, d as SendPrivateMessageOptions, g as SyncOptions, h as SyncDirectionName, i as ClientOptions, m as SyncDirection, n as ClientError, p as SubscribePrivateMessagesOptions, r as ClientEventMap, s as FetchPrivateMessagesOptions, t as Client, u as ReceivedPrivateMessage } from "./index-CSsnE32i.mjs";
-import { S as SUBSCRIPTION_ID_MAX_CHARS, _ as normalizeURL, a as classifyKind, b as SECRET_KEY_BYTES, c as isRegularKind, f as bytesToHex, h as isHex64, i as KnownKind, l as isReplaceableKind, m as isHex32, n as KindClassification, o as isAddressableKind, p as hexToBytes, r as KindName, s as isEphemeralKind, t as Kind, v as EVENT_ID_BYTES, x as SIGNATURE_BYTES, y as PUBLIC_KEY_BYTES } from "./index-Hp26bgYG.mjs";
-import { a as Nip07Signer, c as isNip07Available, i as Nip46Transport, l as KeysSigner, n as Nip46SignerOptions, o as WindowNostr, r as Nip46SubscribeOptions, s as getWindowNostr, t as Nip46Signer, u as NoSignerError } from "./index-N7HUGgwo.mjs";
+import { t as StorageError } from "./error-BjSUsx6M.mjs";
+import { _ as SyncSummary, c as PrivateMessageSendResult, d as SendPrivateMessageOptions, g as SyncOptions, h as SyncDirectionName, i as ClientOptions, m as SyncDirection, n as ClientError, p as SubscribePrivateMessagesOptions, r as ClientEventMap, s as FetchPrivateMessagesOptions, t as Client, u as ReceivedPrivateMessage } from "./index-muydfuYD.mjs";
+import { C as SUBSCRIPTION_ID_MAX_CHARS, S as SIGNATURE_BYTES, _ as normalizeURL, a as classifyKind, b as PUBLIC_KEY_BYTES, c as isRegularKind, f as bytesToHex, h as isHex64, i as KnownKind, l as isReplaceableKind, m as isHex32, n as KindClassification, o as isAddressableKind, p as hexToBytes, r as KindName, s as isEphemeralKind, t as Kind, x as SECRET_KEY_BYTES, y as EVENT_ID_BYTES } from "./index-Dpj_MUxb.mjs";
+import { a as Nip07Signer, c as isNip07Available, d as NostrKeyOperations, f as NoSignerError, i as Nip46Transport, l as KeysSigner, n as Nip46SignerOptions, o as WindowNostr, p as SignerDisposedError, r as Nip46SubscribeOptions, s as getWindowNostr, t as Nip46Signer, u as DelegatedSigner } from "./index-YID-zPDF.mjs";
 import { Nip21Error, NostrURI, isNostrURI, parseNostrURI } from "./nips/nip21.mjs";
 import { ReplyTagsOptions, ThreadReferences, buildReplyTags, parseThreadTags, replyTo } from "./nips/nip10.mjs";
 import { isAuthRequired, makeAuthEvent } from "./nips/nip42.mjs";
-import { a as isInsecureRelayUrl, c as RelayError, d as RelayTimeoutError, l as RelayPublishError, o as RelayClosedError, s as RelayConnectionError, u as RelaySuspendedError } from "./index-DD0Ywpay.mjs";
-import { a as IndexedDbEventStoreOptions, i as IndexedDbEventStore, n as SqlValue, o as MemoryEventStore, r as SqliteEventStore, t as SqlDriver } from "./index-rKcmI6ex.mjs";
-export { type AddressPointer, Bech32MaxSize, Client, ClientError, type ClientEventMap, type ClientMessage, type ClientOptions, type Closer, type CountResult, CryptoError, type DecodedResult, EVENT_ID_BYTES, type Event, type EventAddress, EventBuilder, type EventPointer, type EventStore, type EventTemplate, EventValidationError, type EventVerifier, type FetchPrivateMessagesOptions, type Filter, Gossip, HexError, IndexedDbEventStore, type IndexedDbEventStoreOptions, type InvalidEventPolicy, Keys, KeysSigner, Kind, type KindClassification, type KindName, type KnownKind, type ListResult, type LoadStyle, type Loaders, MemoryEventStore, MessageError, type NAddr, type NEvent, type NProfile, type NPub, type NSec, type NegentropyItem, Nip07Signer, Nip19Error, Nip21Error, Nip46Signer, type Nip46SignerOptions, type Nip46SubscribeOptions, type Nip46Transport, NoSignerError, NostrError, type NostrSigner, type NostrURI, type NostrUser, type Note, type OutboxBound, OutboxError, OutboxFeed, type OutboxFeedOptions, PUBLIC_KEY_BYTES, Pool, type PoolCountResult, type PoolEventMap, type PoolFetchResult, type PoolOptions, type PoolPublishResult, type PoolSubscribeOptions, type PrivateMessageSendResult, type ProfileMetadata, type ProfilePointer, type PubkeyRoutes, type PublicKey, type PublishResult, type PutResult, ReactiveEventStore, type ReactiveEventStoreEventMap, type ReactiveEventStoreOptions, type ReceivedPrivateMessage, Relay, RelayClosedError, RelayConnectionError, RelayError, type RelayEventMap, type RelayFetchEnd, type RelayFetchResult, type RelayListItem, type RelayMarker, type RelayMessage, type RelayOptions, RelayPublishError, RelayStatus, type RelayStatusName, type RelaySubscription, RelaySuspendedError, RelayTimeoutError, type ReplaceableLoadResult, type ReplaceableLoader, type ReplyTagsOptions, type RoutedFilter, SECRET_KEY_BYTES, SIGNATURE_BYTES, SUBSCRIPTION_ID_MAX_CHARS, SecretKey, type SecretKeyInput, type SendPrivateMessageOptions, type SerializedEventVerifier, type SigningBackend, type SqlDriver, type SqlValue, SqliteEventStore, StorageError, type SubscribeOptions, type SubscribePrivateMessagesOptions, type SubscriptionId, SyncDirection, type SyncDirectionName, type SyncOptions, type SyncSummary, Tag, type TagInput, type ThreadReferences, type UnsignedEvent, UrlError, WasmPoisonedError, type Watch, type WindowNostr, assertSubscriptionId, bareNostrUser, buildReplyTags, bytesToHex, canonicalizeFilter, canonicalizeFilters, classifyKind, createEventVerifier, createLoaders, createSubscriptionId, encodeClientMessage, encodeRelayMessage, eventAddress, filterFingerprint, finalizeEvent, formatEventAddress, getDTag, getEventHash, getFilterLimit, getPublicKey, getWindowNostr, groupAuthorsByOutboxRelay, hexToBytes, isAddressableKind, isAuthRequired, isEphemeralKind, isHex32, isHex64, isInsecureRelayUrl, isNip07Available, isNostrURI, isRegularKind, isReplaceableKind, isReplaceableWinner, isTag, itemCompare, makeAuthEvent, matchFilter, matchFilters, mergeCountHll, naddrEncode, neventEncode, decode as nip19Decode, normalizeURL, noteEncode, nprofileEncode, npubEncode, nsecEncode, parseClientMessage, parseEventAddress, parseNostrURI, parseRelayList, parseRelayMessage, parseThreadTags, publicKeyFromHex, readRelays, relayListEventBuilder, relayListToTags, replyTo, serializeEvent, signEvent, signedMatchesUnsigned, sortEvents, sortedEvents, tagName, tagValue, toSecretKey, useWebSocketImplementation, validateEvent, validateSignedEvent, verifyEvent, writeRelays };
+import { a as isInsecureRelayUrl, c as RelayError, d as RelayTimeoutError, l as RelayPublishError, o as RelayClosedError, s as RelayConnectionError, u as RelaySuspendedError } from "./index-B2JlP2Jf.mjs";
+import { a as IndexedDbEventStoreOptions, i as IndexedDbEventStore, n as SqlValue, o as MemoryEventStore, r as SqliteEventStore, t as SqlDriver } from "./index-DzHmhHqD.mjs";
+export { type AddressPointer, Bech32MaxSize, Client, ClientError, type ClientEventMap, type ClientMessage, type ClientOptions, type Closer, type CountResult, CryptoError, type DecodedResult, DelegatedSigner, EVENT_ID_BYTES, type Event, type EventAddress, EventBuilder, type EventPointer, type EventStore, type EventTemplate, EventValidationError, type EventVerifier, type FetchPrivateMessagesOptions, type Filter, Gossip, HexError, IndexedDbEventStore, type IndexedDbEventStoreOptions, type InvalidEventPolicy, Keys, KeysSigner, Kind, type KindClassification, type KindName, type KnownKind, type ListResult, type LoadStyle, type Loaders, MemoryEventStore, MessageError, type NAddr, type NEvent, type NProfile, type NPub, type NSec, type NegentropyItem, Nip07Signer, Nip19Error, Nip21Error, Nip46Signer, type Nip46SignerOptions, type Nip46SubscribeOptions, type Nip46Transport, NoSignerError, NostrError, type NostrKeyOperations, type NostrSigner, type NostrURI, type NostrUser, type Note, type OutboxBound, OutboxError, OutboxFeed, type OutboxFeedOptions, PUBLIC_KEY_BYTES, Pool, type PoolCountResult, type PoolEventMap, type PoolFetchResult, type PoolOptions, type PoolPublishResult, type PoolSubscribeOptions, type PrivateMessageSendResult, type ProfileMetadata, type ProfilePointer, type PubkeyRoutes, type PublicKey, type PublishResult, type PutResult, ReactiveEventStore, type ReactiveEventStoreEventMap, type ReactiveEventStoreOptions, type ReceivedPrivateMessage, Relay, RelayClosedError, RelayConnectionError, RelayError, type RelayEventMap, type RelayFetchEnd, type RelayFetchResult, type RelayListItem, type RelayMarker, type RelayMessage, type RelayOptions, RelayPublishError, RelayStatus, type RelayStatusName, type RelaySubscription, RelaySuspendedError, RelayTimeoutError, type ReplaceableLoadResult, type ReplaceableLoader, type ReplyTagsOptions, type RoutedFilter, SECRET_KEY_BYTES, SIGNATURE_BYTES, SUBSCRIPTION_ID_MAX_CHARS, SecretKey, type SecretKeyInput, type SendPrivateMessageOptions, type SerializedEventVerifier, SignerDisposedError, type SigningBackend, type SqlDriver, type SqlValue, SqliteEventStore, StorageError, type SubscribeOptions, type SubscribePrivateMessagesOptions, type SubscriptionId, SyncDirection, type SyncDirectionName, type SyncOptions, type SyncSummary, Tag, type TagInput, type ThreadReferences, type UnsignedEvent, UrlError, type Watch, type WindowNostr, assertSubscriptionId, bareNostrUser, buildReplyTags, bytesToHex, canonicalizeFilter, canonicalizeFilters, classifyKind, createEventVerifier, createLoaders, createSubscriptionId, encodeClientMessage, encodeRelayMessage, eventAddress, filterFingerprint, finalizeEvent, formatEventAddress, getDTag, getEventHash, getFilterLimit, getPublicKey, getWindowNostr, groupAuthorsByOutboxRelay, hexToBytes, isAddressableKind, isAuthRequired, isEphemeralKind, isHex32, isHex64, isInsecureRelayUrl, isNip07Available, isNostrURI, isRegularKind, isReplaceableKind, isReplaceableWinner, isTag, itemCompare, makeAuthEvent, matchFilter, matchFilters, mergeCountHll, naddrEncode, neventEncode, decode as nip19Decode, normalizeURL, noteEncode, nprofileEncode, npubEncode, nsecEncode, parseClientMessage, parseEventAddress, parseNostrURI, parseRelayList, parseRelayMessage, parseThreadTags, publicKeyFromHex, readRelays, relayListEventBuilder, relayListToTags, replyTo, serializeEvent, signEvent, signedMatchesUnsigned, sortEvents, sortedEvents, tagName, tagValue, toSecretKey, validateEvent, validateSignedEvent, verifyEvent, writeRelays };

package/dist/index.mjs

@@ -1,27 +1,27 @@
-import { D as SIGNATURE_BYTES, E as SECRET_KEY_BYTES, O as SUBSCRIPTION_ID_MAX_CHARS, T as PUBLIC_KEY_BYTES, _ as HexError, b as UrlError, c as isHex64, d as normalizeURL, g as EventValidationError, h as CryptoError, i as bytesToHex, o as hexToBytes, s as isHex32, v as MessageError, w as EVENT_ID_BYTES, x as WasmPoisonedError, y as NostrError } from "./util-DDpPkiED.mjs";
-import { a as isRegularKind, i as isEphemeralKind, n as classifyKind, o as isReplaceableKind, r as isAddressableKind, t as Kind } from "./kind-D8fENiiL.mjs";
-import { C as tagName, S as parseEventAddress, _ as eventAddress, a as isReplaceableWinner, b as getDTag, d as signedMatchesUnsigned, f as sortEvents, g as Tag, h as validateSignedEvent, l as serializeEvent, m as validateEvent, n as getEventHash, o as itemCompare, p as sortedEvents, w as tagValue, x as isTag, y as formatEventAddress } from "./event-B3ua2_oL.mjs";
-import { a as publicKeyFromHex, i as getPublicKey, n as SecretKey, o as signEvent, r as finalizeEvent, s as toSecretKey, t as Keys } from "./key-k8LDEPZh.mjs";
-import { n as verifyEvent, t as createEventVerifier } from "./verifier-CjH1vnP2.mjs";
-import { t as EventBuilder } from "./builder-BQbFDO6S.mjs";
-import { a as matchFilter, i as getFilterLimit, n as canonicalizeFilters, o as matchFilters, r as filterFingerprint, t as canonicalizeFilter } from "./filter-B16P33dz.mjs";
-import { a as mergeCountHll, i as encodeRelayMessage, n as createSubscriptionId, o as parseClientMessage, r as encodeClientMessage, s as parseRelayMessage, t as assertSubscriptionId } from "./message-pYfVKxPn.mjs";
-import { t as NoSignerError } from "./error-UHkqzWL7.mjs";
-import { a as KeysSigner, i as isNip07Available, n as Nip07Signer, r as getWindowNostr, t as Nip46Signer } from "./signer-CWtxpOxc.mjs";
+import { D as SECRET_KEY_BYTES, E as PUBLIC_KEY_BYTES, O as SIGNATURE_BYTES, S as UrlError, T as EVENT_ID_BYTES, _ as CryptoError, b as MessageError, c as isHex32, f as normalizeURL, i as bytesToHex, k as SUBSCRIPTION_ID_MAX_CHARS, l as isHex64, s as hexToBytes, v as EventValidationError, x as NostrError, y as HexError } from "./util-DfsyJ9nz.mjs";
+import { a as isRegularKind, i as isEphemeralKind, n as classifyKind, o as isReplaceableKind, r as isAddressableKind, t as Kind } from "./kind-I2Tvbe82.mjs";
+import { C as tagName, S as parseEventAddress, _ as eventAddress, a as isReplaceableWinner, b as getDTag, d as signedMatchesUnsigned, f as sortEvents, g as Tag, h as validateSignedEvent, l as serializeEvent, m as validateEvent, n as getEventHash, o as itemCompare, p as sortedEvents, w as tagValue, x as isTag, y as formatEventAddress } from "./event-DvM1f03b.mjs";
+import { a as publicKeyFromHex, i as getPublicKey, n as SecretKey, o as signEvent, r as finalizeEvent, s as toSecretKey, t as Keys } from "./key-D_oEutQ6.mjs";
+import { n as verifyEvent, t as createEventVerifier } from "./verifier-DEHUy4AD.mjs";
+import { t as EventBuilder } from "./builder-CGgM_QHT.mjs";
+import { a as getFilterLimit, n as canonicalizeFilters, o as matchFilter, r as filterFingerprint, s as matchFilters, t as canonicalizeFilter } from "./filter-3jOh4uLN.mjs";
+import { a as mergeCountHll, i as encodeRelayMessage, n as createSubscriptionId, o as parseClientMessage, r as encodeClientMessage, s as parseRelayMessage, t as assertSubscriptionId } from "./message-BMfreCQc.mjs";
+import { n as SignerDisposedError, t as NoSignerError } from "./error-Dyb89ahb.mjs";
+import { a as KeysSigner, i as isNip07Available, n as Nip07Signer, o as DelegatedSigner, r as getWindowNostr, t as Nip46Signer } from "./signer-DJcmC4nA.mjs";
 import { Bech32MaxSize, Nip19Error, decode, naddrEncode, neventEncode, noteEncode, nprofileEncode, npubEncode, nsecEncode } from "./nips/nip19.mjs";
 import { Nip21Error, isNostrURI, parseNostrURI } from "./nips/nip21.mjs";
 import { buildReplyTags, parseThreadTags, replyTo } from "./nips/nip10.mjs";
 import { isAuthRequired, makeAuthEvent } from "./nips/nip42.mjs";
 import { parseRelayList, readRelays, relayListEventBuilder, relayListToTags, writeRelays } from "./nips/nip65.mjs";
-import { c as RelayConnectionError, d as RelaySuspendedError, f as RelayTimeoutError, l as RelayError, n as Relay, o as useWebSocketImplementation, r as RelayStatus, s as RelayClosedError, u as RelayPublishError } from "./relay-DXtwUEdX.mjs";
-import { i as isInsecureRelayUrl, t as Pool } from "./pool-BMUsw2un.mjs";
+import { a as RelayClosedError, c as RelayPublishError, l as RelaySuspendedError, n as Relay, o as RelayConnectionError, r as RelayStatus, s as RelayError, u as RelayTimeoutError } from "./relay-DIR77xQ2.mjs";
+import { i as isInsecureRelayUrl, t as Pool } from "./pool-lMT_mvzn.mjs";
 import "./relay.mjs";
-import { t as Gossip } from "./gossip-K_JIexQs.mjs";
-import { a as bareNostrUser, i as groupAuthorsByOutboxRelay, n as OutboxError, r as OutboxFeed, t as createLoaders } from "./loaders-Dp2nXEFk.mjs";
-import { t as StorageError } from "./error-DH4guike.mjs";
-import { t as MemoryEventStore } from "./memory-VyPnOBU3.mjs";
-import { t as ReactiveEventStore } from "./reactive--pDpLt2H.mjs";
-import { n as ClientError, r as SyncDirection, t as Client } from "./client-CTmp5w84.mjs";
-import { n as IndexedDbEventStore, t as SqliteEventStore } from "./storage-B5Wdt_Mn.mjs";
+import { t as Gossip } from "./gossip-CRyhK6E6.mjs";
+import { a as bareNostrUser, i as groupAuthorsByOutboxRelay, n as OutboxError, r as OutboxFeed, t as createLoaders } from "./loaders-BRh2riV9.mjs";
+import { t as StorageError } from "./error-QyECUDIp.mjs";
+import { t as MemoryEventStore } from "./memory-D_GdEQYG.mjs";
+import { t as ReactiveEventStore } from "./reactive-DFHY-f00.mjs";
+import { n as ClientError, r as SyncDirection, t as Client } from "./client-COkEihj_.mjs";
+import { n as IndexedDbEventStore, t as SqliteEventStore } from "./storage-n2BE1bdY.mjs";
 import "./store.mjs";
-export { Bech32MaxSize, Client, ClientError, CryptoError, EVENT_ID_BYTES, EventBuilder, EventValidationError, Gossip, HexError, IndexedDbEventStore, Keys, KeysSigner, Kind, MemoryEventStore, MessageError, Nip07Signer, Nip19Error, Nip21Error, Nip46Signer, NoSignerError, NostrError, OutboxError, OutboxFeed, PUBLIC_KEY_BYTES, Pool, ReactiveEventStore, Relay, RelayClosedError, RelayConnectionError, RelayError, RelayPublishError, RelayStatus, RelaySuspendedError, RelayTimeoutError, SECRET_KEY_BYTES, SIGNATURE_BYTES, SUBSCRIPTION_ID_MAX_CHARS, SecretKey, SqliteEventStore, StorageError, SyncDirection, Tag, UrlError, WasmPoisonedError, assertSubscriptionId, bareNostrUser, buildReplyTags, bytesToHex, canonicalizeFilter, canonicalizeFilters, classifyKind, createEventVerifier, createLoaders, createSubscriptionId, encodeClientMessage, encodeRelayMessage, eventAddress, filterFingerprint, finalizeEvent, formatEventAddress, getDTag, getEventHash, getFilterLimit, getPublicKey, getWindowNostr, groupAuthorsByOutboxRelay, hexToBytes, isAddressableKind, isAuthRequired, isEphemeralKind, isHex32, isHex64, isInsecureRelayUrl, isNip07Available, isNostrURI, isRegularKind, isReplaceableKind, isReplaceableWinner, isTag, itemCompare, makeAuthEvent, matchFilter, matchFilters, mergeCountHll, naddrEncode, neventEncode, decode as nip19Decode, normalizeURL, noteEncode, nprofileEncode, npubEncode, nsecEncode, parseClientMessage, parseEventAddress, parseNostrURI, parseRelayList, parseRelayMessage, parseThreadTags, publicKeyFromHex, readRelays, relayListEventBuilder, relayListToTags, replyTo, serializeEvent, signEvent, signedMatchesUnsigned, sortEvents, sortedEvents, tagName, tagValue, toSecretKey, useWebSocketImplementation, validateEvent, validateSignedEvent, verifyEvent, writeRelays };
+export { Bech32MaxSize, Client, ClientError, CryptoError, DelegatedSigner, EVENT_ID_BYTES, EventBuilder, EventValidationError, Gossip, HexError, IndexedDbEventStore, Keys, KeysSigner, Kind, MemoryEventStore, MessageError, Nip07Signer, Nip19Error, Nip21Error, Nip46Signer, NoSignerError, NostrError, OutboxError, OutboxFeed, PUBLIC_KEY_BYTES, Pool, ReactiveEventStore, Relay, RelayClosedError, RelayConnectionError, RelayError, RelayPublishError, RelayStatus, RelaySuspendedError, RelayTimeoutError, SECRET_KEY_BYTES, SIGNATURE_BYTES, SUBSCRIPTION_ID_MAX_CHARS, SecretKey, SignerDisposedError, SqliteEventStore, StorageError, SyncDirection, Tag, UrlError, assertSubscriptionId, bareNostrUser, buildReplyTags, bytesToHex, canonicalizeFilter, canonicalizeFilters, classifyKind, createEventVerifier, createLoaders, createSubscriptionId, encodeClientMessage, encodeRelayMessage, eventAddress, filterFingerprint, finalizeEvent, formatEventAddress, getDTag, getEventHash, getFilterLimit, getPublicKey, getWindowNostr, groupAuthorsByOutboxRelay, hexToBytes, isAddressableKind, isAuthRequired, isEphemeralKind, isHex32, isHex64, isInsecureRelayUrl, isNip07Available, isNostrURI, isRegularKind, isReplaceableKind, isReplaceableWinner, isTag, itemCompare, makeAuthEvent, matchFilter, matchFilters, mergeCountHll, naddrEncode, neventEncode, decode as nip19Decode, normalizeURL, noteEncode, nprofileEncode, npubEncode, nsecEncode, parseClientMessage, parseEventAddress, parseNostrURI, parseRelayList, parseRelayMessage, parseThreadTags, publicKeyFromHex, readRelays, relayListEventBuilder, relayListToTags, replyTo, serializeEvent, signEvent, signedMatchesUnsigned, sortEvents, sortedEvents, tagName, tagValue, toSecretKey, validateEvent, validateSignedEvent, verifyEvent, writeRelays };

package/dist/{key-k8LDEPZh.mjs → key-D_oEutQ6.mjs}

@@ -1,5 +1,5 @@
-import { g as EventValidationError, h as CryptoError, i as bytesToHex$1, m as utf8Encoder, n as assertHex32, o as hexToBytes$1, r as assertSecretKeyBytes } from "./util-DDpPkiED.mjs";
-import { c as markVerified, m as validateEvent, u as serializeValidatedEvent } from "./event-B3ua2_oL.mjs";
+import { _ as CryptoError, g as utf8Encoder, i as bytesToHex$1, n as assertHex32, r as assertSecretKeyBytes, s as hexToBytes$1, v as EventValidationError } from "./util-DfsyJ9nz.mjs";
+import { c as markVerified, m as validateEvent, u as serializeValidatedEvent } from "./event-DvM1f03b.mjs";
 import { randomBytes } from "@noble/hashes/utils.js";
 import { sha256 } from "@noble/hashes/sha2.js";
 import { schnorr } from "@noble/curves/secp256k1.js";
@@ -66,7 +66,13 @@ var Keys = class Keys {
 	constructor(secretKey, backend) {
 		this.secretKey = secretKey;
 		this.backend = backend;
-		const pubkey = backend.publicKey(secretKey.bytes);
+		const secretBytes = secretKey.bytes;
+		let pubkey;
+		try {
+			pubkey = backend.publicKey(secretBytes);
+		} finally {
+			secretBytes.fill(0);
+		}
 		if (pubkey.length !== 32) throw new CryptoError("signing backend returned an invalid public key");
 		this.publicKey = bytesToHex$1(pubkey);
 	}
@@ -80,8 +86,14 @@ var Keys = class Keys {
 function resolveKeys(secretKey) {
 	return secretKey instanceof Keys ? secretKey : Keys.fromSecretKey(secretKey);
 }
-/** Fill pubkey/id/sig on a template and return a signed event. */
-function finalizeEvent(template, secretKey) {
+/**
+* Fill pubkey/id/sig on a template and return a signed event.
+*
+* `auxRand` is the 32-byte BIP-340 auxiliary randomness. It defaults to a fresh `randomBytes(32)`
+* draw; an explicit value makes the signature reproducible, which is required for vectors and
+* tests. Never reuse aux randomness in production.
+*/
+function finalizeEvent(template, secretKey, auxRand) {
 	const keys = resolveKeys(secretKey);
 	return signEvent({
 		kind: template.kind,
@@ -89,14 +101,19 @@ function finalizeEvent(template, secretKey) {
 		content: template.content,
 		created_at: template.created_at,
 		pubkey: keys.publicKey
-	}, keys);
+	}, keys, auxRand);
 }
 /**
 * Sign an already-assembled unsigned event. Rejects when `unsigned.pubkey` does not match the
 * secret key.
+*
+* `auxRand` is the 32-byte BIP-340 auxiliary randomness. It defaults to a fresh `randomBytes(32)`
+* draw; an explicit value makes the signature reproducible, which is required for vectors and
+* tests. Never reuse aux randomness in production.
 */
-function signEvent(unsigned, secretKey) {
+function signEvent(unsigned, secretKey, auxRand) {
 	const keys = resolveKeys(secretKey);
+	if (auxRand !== void 0 && auxRand.length !== 32) throw new CryptoError("auxRand must be 32 bytes");
 	if (!validateEvent(unsigned)) throw new EventValidationError("cannot sign invalid unsigned event");
 	if (unsigned.pubkey !== keys.publicKey) throw new CryptoError("unsigned event pubkey does not match secret key");
 	const normalized = {
@@ -107,7 +124,13 @@ function signEvent(unsigned, secretKey) {
 		pubkey: keys.publicKey
 	};
 	const id = bytesToHex$1(sha256(utf8Encoder.encode(serializeValidatedEvent(normalized))));
-	const sig = keys.backend.sign(hexToBytes$1(id), keys.secretKey.bytes, randomBytes(32));
+	const secretBytes = keys.secretKey.bytes;
+	let sig;
+	try {
+		sig = keys.backend.sign(hexToBytes$1(id), secretBytes, auxRand ?? randomBytes(32));
+	} finally {
+		secretBytes.fill(0);
+	}
 	if (sig.length !== 64) throw new CryptoError("signing backend returned an invalid signature");
 	const event = {
 		...normalized,
@@ -120,4 +143,4 @@ function signEvent(unsigned, secretKey) {
 //#endregion
 export { publicKeyFromHex as a, getPublicKey as i, SecretKey as n, signEvent as o, finalizeEvent as r, toSecretKey as s, Keys as t };
 
-//# sourceMappingURL=key-k8LDEPZh.mjs.map
+//# sourceMappingURL=key-D_oEutQ6.mjs.map

package/dist/key-D_oEutQ6.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-D_oEutQ6.mjs","names":["hexToBytes","bytesToHex"],"sources":["../src/core/key.ts"],"sourcesContent":["import { schnorr } from \"@noble/curves/secp256k1.js\";\nimport { sha256 } from \"@noble/hashes/sha2.js\";\nimport { randomBytes } from \"@noble/hashes/utils.js\";\n\nimport { CryptoError, EventValidationError } from \"./error.ts\";\nimport { markVerified, serializeValidatedEvent, validateEvent } from \"./event.ts\";\nimport type { Event, EventTemplate, UnsignedEvent } from \"./event.ts\";\nimport { assertHex32, assertSecretKeyBytes, bytesToHex, hexToBytes, utf8Encoder } from \"./util.ts\";\n\n/** 32-byte secret key held as bytes; prefer zeroize when done. */\nexport class SecretKey {\n  #bytes: Uint8Array | undefined;\n\n  private constructor(bytes: Uint8Array) {\n    assertSecretKeyBytes(bytes);\n    this.#bytes = new Uint8Array(bytes);\n  }\n\n  static generate(): SecretKey {\n    return new SecretKey(schnorr.utils.randomSecretKey());\n  }\n\n  static fromBytes(bytes: Uint8Array): SecretKey {\n    return new SecretKey(bytes);\n  }\n\n  static fromHex(hex: string): SecretKey {\n    return new SecretKey(hexToBytes(assertHex32(hex, \"secret key\")));\n  }\n\n  get bytes(): Uint8Array {\n    if (!this.#bytes) {\n      throw new CryptoError(\"secret key has been zeroized\");\n    }\n    return new Uint8Array(this.#bytes);\n  }\n\n  toHex(): string {\n    return bytesToHex(this.bytes);\n  }\n\n  /** Best-effort wipe of the internal buffer. */\n  zeroize(): void {\n    if (this.#bytes) {\n      this.#bytes.fill(0);\n      this.#bytes = undefined;\n    }\n  }\n}\n\n/** Anything a secret key can be given as: instance, raw bytes, or hex. */\nexport type SecretKeyInput = SecretKey | Uint8Array | string;\n\n/** Coerce a {@link SecretKeyInput} to {@link SecretKey}. */\nexport function toSecretKey(input: SecretKeyInput): SecretKey {\n  if (input instanceof SecretKey) {\n    return input;\n  }\n  if (typeof input === \"string\") {\n    return SecretKey.fromHex(input);\n  }\n  return SecretKey.fromBytes(input);\n}\n\n/** Lowercase hex-encoded secp256k1 public key (x-only, 64 chars). */\nexport type PublicKey = string;\n\n/** Validate and normalize a hex public key; throws {@link HexError} on bad input. */\nexport function publicKeyFromHex(hex: string): PublicKey {\n  return assertHex32(hex, \"public key\");\n}\n\n/**\n * BIP-340 signing backend. `publicKey` returns the 32-byte x-only public key of a 32-byte secret\n * key; `sign` returns the 64-byte BIP-340 signature of a 32-byte `id` using 32 bytes of auxiliary\n * randomness. Both throw on invalid input (for example an out-of-range secret key).\n */\nexport type SigningBackend = {\n  publicKey: (secretKey: Uint8Array) => Uint8Array;\n  sign: (id: Uint8Array, secretKey: Uint8Array, auxRand: Uint8Array) => Uint8Array;\n};\n\nconst nobleSigning: SigningBackend = {\n  publicKey: (secretKey) => schnorr.getPublicKey(secretKey),\n  sign: (id, secretKey, auxRand) => schnorr.sign(id, secretKey, auxRand),\n};\n\n/** Derive the public key for a secret key given as SecretKey, bytes, or hex. */\nexport function getPublicKey(secretKey: SecretKeyInput): PublicKey {\n  return bytesToHex(schnorr.getPublicKey(toSecretKey(secretKey).bytes));\n}\n\n/** Keypair convenience wrapper. */\nexport class Keys {\n  readonly secretKey: SecretKey;\n  readonly publicKey: PublicKey;\n  /**\n   * BIP-340 backend that derived {@link publicKey} and signs in {@link finalizeEvent}/\n   * {@link signEvent}. Defaults to noble; pass a loaded `NostrWasm` module or a native backend to\n   * delegate signing.\n   */\n  readonly backend: SigningBackend;\n\n  private constructor(secretKey: SecretKey, backend: SigningBackend) {\n    this.secretKey = secretKey;\n    this.backend = backend;\n    const secretBytes = secretKey.bytes;\n    let pubkey: Uint8Array;\n    try {\n      pubkey = backend.publicKey(secretBytes);\n    } finally {\n      secretBytes.fill(0);\n    }\n    if (pubkey.length !== 32) {\n      throw new CryptoError(\"signing backend returned an invalid public key\");\n    }\n    this.publicKey = bytesToHex(pubkey);\n  }\n\n  static generate(backend: SigningBackend = nobleSigning): Keys {\n    return new Keys(SecretKey.generate(), backend);\n  }\n\n  static fromSecretKey(secretKey: SecretKeyInput, backend: SigningBackend = nobleSigning): Keys {\n    return new Keys(toSecretKey(secretKey), backend);\n  }\n}\n\nfunction resolveKeys(secretKey: SecretKeyInput | Keys): Keys {\n  return secretKey instanceof Keys ? secretKey : Keys.fromSecretKey(secretKey);\n}\n\n/**\n * Fill pubkey/id/sig on a template and return a signed event.\n *\n * `auxRand` is the 32-byte BIP-340 auxiliary randomness. It defaults to a fresh `randomBytes(32)`\n * draw; an explicit value makes the signature reproducible, which is required for vectors and\n * tests. Never reuse aux randomness in production.\n */\nexport function finalizeEvent(\n  template: EventTemplate,\n  secretKey: SecretKeyInput | Keys,\n  auxRand?: Uint8Array,\n): Event {\n  const keys = resolveKeys(secretKey);\n  const unsigned: UnsignedEvent = {\n    kind: template.kind,\n    tags: template.tags,\n    content: template.content,\n    created_at: template.created_at,\n    pubkey: keys.publicKey,\n  };\n  return signEvent(unsigned, keys, auxRand);\n}\n\n/**\n * Sign an already-assembled unsigned event. Rejects when `unsigned.pubkey` does not match the\n * secret key.\n *\n * `auxRand` is the 32-byte BIP-340 auxiliary randomness. It defaults to a fresh `randomBytes(32)`\n * draw; an explicit value makes the signature reproducible, which is required for vectors and\n * tests. Never reuse aux randomness in production.\n */\nexport function signEvent(\n  unsigned: UnsignedEvent,\n  secretKey: SecretKeyInput | Keys,\n  auxRand?: Uint8Array,\n): Event {\n  const keys = resolveKeys(secretKey);\n  if (auxRand !== undefined && auxRand.length !== 32) {\n    throw new CryptoError(\"auxRand must be 32 bytes\");\n  }\n  if (!validateEvent(unsigned)) {\n    throw new EventValidationError(\"cannot sign invalid unsigned event\");\n  }\n\n  if (unsigned.pubkey !== keys.publicKey) {\n    throw new CryptoError(\"unsigned event pubkey does not match secret key\");\n  }\n\n  const normalized: UnsignedEvent = {\n    kind: unsigned.kind,\n    tags: unsigned.tags,\n    content: unsigned.content,\n    created_at: unsigned.created_at,\n    pubkey: keys.publicKey,\n  };\n\n  const id = bytesToHex(sha256(utf8Encoder.encode(serializeValidatedEvent(normalized))));\n  const secretBytes = keys.secretKey.bytes;\n  let sig: Uint8Array;\n  try {\n    sig = keys.backend.sign(hexToBytes(id), secretBytes, auxRand ?? randomBytes(32));\n  } finally {\n    secretBytes.fill(0);\n  }\n  if (sig.length !== 64) {\n    throw new CryptoError(\"signing backend returned an invalid signature\");\n  }\n  const event: Event = { ...normalized, id, sig: bytesToHex(sig) };\n  markVerified(event);\n  return event;\n}\n"],"mappings":";;;;;;;AAUA,IAAa,YAAb,MAAa,UAAU;CACrB;CAEA,YAAoB,OAAmB;EACrC,qBAAqB,KAAK;EAC1B,KAAK,SAAS,IAAI,WAAW,KAAK;CACpC;CAEA,OAAO,WAAsB;EAC3B,OAAO,IAAI,UAAU,QAAQ,MAAM,gBAAgB,CAAC;CACtD;CAEA,OAAO,UAAU,OAA8B;EAC7C,OAAO,IAAI,UAAU,KAAK;CAC5B;CAEA,OAAO,QAAQ,KAAwB;EACrC,OAAO,IAAI,UAAUA,aAAW,YAAY,KAAK,YAAY,CAAC,CAAC;CACjE;CAEA,IAAI,QAAoB;EACtB,IAAI,CAAC,KAAK,QACR,MAAM,IAAI,YAAY,8BAA8B;EAEtD,OAAO,IAAI,WAAW,KAAK,MAAM;CACnC;CAEA,QAAgB;EACd,OAAOC,aAAW,KAAK,KAAK;CAC9B;;CAGA,UAAgB;EACd,IAAI,KAAK,QAAQ;GACf,KAAK,OAAO,KAAK,CAAC;GAClB,KAAK,SAAS,KAAA;EAChB;CACF;AACF;;AAMA,SAAgB,YAAY,OAAkC;CAC5D,IAAI,iBAAiB,WACnB,OAAO;CAET,IAAI,OAAO,UAAU,UACnB,OAAO,UAAU,QAAQ,KAAK;CAEhC,OAAO,UAAU,UAAU,KAAK;AAClC;;AAMA,SAAgB,iBAAiB,KAAwB;CACvD,OAAO,YAAY,KAAK,YAAY;AACtC;AAYA,MAAM,eAA+B;CACnC,YAAY,cAAc,QAAQ,aAAa,SAAS;CACxD,OAAO,IAAI,WAAW,YAAY,QAAQ,KAAK,IAAI,WAAW,OAAO;AACvE;;AAGA,SAAgB,aAAa,WAAsC;CACjE,OAAOA,aAAW,QAAQ,aAAa,YAAY,SAAS,CAAC,CAAC,KAAK,CAAC;AACtE;;AAGA,IAAa,OAAb,MAAa,KAAK;CAChB;CACA;;;;;;CAMA;CAEA,YAAoB,WAAsB,SAAyB;EACjE,KAAK,YAAY;EACjB,KAAK,UAAU;EACf,MAAM,cAAc,UAAU;EAC9B,IAAI;EACJ,IAAI;GACF,SAAS,QAAQ,UAAU,WAAW;EACxC,UAAU;GACR,YAAY,KAAK,CAAC;EACpB;EACA,IAAI,OAAO,WAAW,IACpB,MAAM,IAAI,YAAY,gDAAgD;EAExE,KAAK,YAAYA,aAAW,MAAM;CACpC;CAEA,OAAO,SAAS,UAA0B,cAAoB;EAC5D,OAAO,IAAI,KAAK,UAAU,SAAS,GAAG,OAAO;CAC/C;CAEA,OAAO,cAAc,WAA2B,UAA0B,cAAoB;EAC5F,OAAO,IAAI,KAAK,YAAY,SAAS,GAAG,OAAO;CACjD;AACF;AAEA,SAAS,YAAY,WAAwC;CAC3D,OAAO,qBAAqB,OAAO,YAAY,KAAK,cAAc,SAAS;AAC7E;;;;;;;;AASA,SAAgB,cACd,UACA,WACA,SACO;CACP,MAAM,OAAO,YAAY,SAAS;CAQlC,OAAO,UAAU;EANf,MAAM,SAAS;EACf,MAAM,SAAS;EACf,SAAS,SAAS;EAClB,YAAY,SAAS;EACrB,QAAQ,KAAK;CAES,GAAG,MAAM,OAAO;AAC1C;;;;;;;;;AAUA,SAAgB,UACd,UACA,WACA,SACO;CACP,MAAM,OAAO,YAAY,SAAS;CAClC,IAAI,YAAY,KAAA,KAAa,QAAQ,WAAW,IAC9C,MAAM,IAAI,YAAY,0BAA0B;CAElD,IAAI,CAAC,cAAc,QAAQ,GACzB,MAAM,IAAI,qBAAqB,oCAAoC;CAGrE,IAAI,SAAS,WAAW,KAAK,WAC3B,MAAM,IAAI,YAAY,iDAAiD;CAGzE,MAAM,aAA4B;EAChC,MAAM,SAAS;EACf,MAAM,SAAS;EACf,SAAS,SAAS;EAClB,YAAY,SAAS;EACrB,QAAQ,KAAK;CACf;CAEA,MAAM,KAAKA,aAAW,OAAO,YAAY,OAAO,wBAAwB,UAAU,CAAC,CAAC,CAAC;CACrF,MAAM,cAAc,KAAK,UAAU;CACnC,IAAI;CACJ,IAAI;EACF,MAAM,KAAK,QAAQ,KAAKD,aAAW,EAAE,GAAG,aAAa,WAAW,YAAY,EAAE,CAAC;CACjF,UAAU;EACR,YAAY,KAAK,CAAC;CACpB;CACA,IAAI,IAAI,WAAW,IACjB,MAAM,IAAI,YAAY,+CAA+C;CAEvE,MAAM,QAAe;EAAE,GAAG;EAAY;EAAI,KAAKC,aAAW,GAAG;CAAE;CAC/D,aAAa,KAAK;CAClB,OAAO;AACT"}

package/dist/{key-CyKN1RTi.d.mts → key-DojW2QZl.d.mts}

@@ -45,13 +45,23 @@ declare class Keys {
   static generate(backend?: SigningBackend): Keys;
   static fromSecretKey(secretKey: SecretKeyInput, backend?: SigningBackend): Keys;
 }
-/** Fill pubkey/id/sig on a template and return a signed event. */
-declare function finalizeEvent(template: EventTemplate, secretKey: SecretKeyInput | Keys): Event;
+/**
+ * Fill pubkey/id/sig on a template and return a signed event.
+ *
+ * `auxRand` is the 32-byte BIP-340 auxiliary randomness. It defaults to a fresh `randomBytes(32)`
+ * draw; an explicit value makes the signature reproducible, which is required for vectors and
+ * tests. Never reuse aux randomness in production.
+ */
+declare function finalizeEvent(template: EventTemplate, secretKey: SecretKeyInput | Keys, auxRand?: Uint8Array): Event;
 /**
  * Sign an already-assembled unsigned event. Rejects when `unsigned.pubkey` does not match the
  * secret key.
+ *
+ * `auxRand` is the 32-byte BIP-340 auxiliary randomness. It defaults to a fresh `randomBytes(32)`
+ * draw; an explicit value makes the signature reproducible, which is required for vectors and
+ * tests. Never reuse aux randomness in production.
  */
-declare function signEvent(unsigned: UnsignedEvent, secretKey: SecretKeyInput | Keys): Event;
+declare function signEvent(unsigned: UnsignedEvent, secretKey: SecretKeyInput | Keys, auxRand?: Uint8Array): Event;
 //#endregion
 export { SigningBackend as a, publicKeyFromHex as c, SecretKeyInput as i, signEvent as l, PublicKey as n, finalizeEvent as o, SecretKey as r, getPublicKey as s, Keys as t, toSecretKey as u };
-//# sourceMappingURL=key-CyKN1RTi.d.mts.map
+//# sourceMappingURL=key-DojW2QZl.d.mts.map

package/dist/{kind-D8fENiiL.mjs → kind-I2Tvbe82.mjs}

@@ -1,10 +1,11 @@
 //#region src/core/kind.ts
 /**
-* NIP-01 regular ranges verbatim; kinds outside every defined range are still stored like regular
-* events (see {@link classifyKind}).
+* Regular means relays store the event: every kind below 10000 except the replaceable kinds 0 and 3.
+* The NIP-01 enumerated regular ranges are a subset; kinds 45–999 are stored like regular events in
+* practice (nostr-tools and rust-nostr agree).
 */
 function isRegularKind(kind) {
-	return kind === 1 || kind === 2 || kind >= 4 && kind < 45 || kind >= 1e3 && kind < 1e4;
+	return kind < 1e4 && kind !== 0 && kind !== 3;
 }
 /** Replaceable: latest per (pubkey, kind) wins. */
 function isReplaceableKind(kind) {
@@ -21,7 +22,7 @@ function isAddressableKind(kind) {
 /**
 * Classify a kind number into its NIP-01 storage class. NIP-01 leaves kinds 45–999 and 40000+
 * undefined (rather than forbidden); relays store them like regular events, so they classify
-* `"regular"` here even though {@link isRegularKind} returns false for them.
+* `"regular"` here even though {@link isRegularKind} returns false for kinds 40000+.
 */
 function classifyKind(kind) {
 	if (isReplaceableKind(kind)) return "replaceable";
@@ -63,4 +64,4 @@ const Kind = {
 //#endregion
 export { isRegularKind as a, isEphemeralKind as i, classifyKind as n, isReplaceableKind as o, isAddressableKind as r, Kind as t };
 
-//# sourceMappingURL=kind-D8fENiiL.mjs.map
+//# sourceMappingURL=kind-I2Tvbe82.mjs.map

package/dist/kind-I2Tvbe82.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"kind-I2Tvbe82.mjs","names":[],"sources":["../src/core/kind.ts"],"sourcesContent":["/**\n * Regular means relays store the event: every kind below 10000 except the replaceable kinds 0 and 3.\n * The NIP-01 enumerated regular ranges are a subset; kinds 45–999 are stored like regular events in\n * practice (nostr-tools and rust-nostr agree).\n */\nexport function isRegularKind(kind: number): boolean {\n  return kind < 10000 && kind !== 0 && kind !== 3;\n}\n\n/** Replaceable: latest per (pubkey, kind) wins. */\nexport function isReplaceableKind(kind: number): boolean {\n  return kind === 0 || kind === 3 || (kind >= 10000 && kind < 20000);\n}\n\n/** Ephemeral: not expected to be stored. */\nexport function isEphemeralKind(kind: number): boolean {\n  return kind >= 20000 && kind < 30000;\n}\n\n/** Addressable (parameterized replaceable): latest per (pubkey, kind, d-tag) wins. */\nexport function isAddressableKind(kind: number): boolean {\n  return kind >= 30000 && kind < 40000;\n}\n\n/** NIP-01 kind classes: regular / replaceable / ephemeral / addressable. */\nexport type KindClassification = \"regular\" | \"replaceable\" | \"ephemeral\" | \"addressable\";\n\n/**\n * Classify a kind number into its NIP-01 storage class. NIP-01 leaves kinds 45–999 and 40000+\n * undefined (rather than forbidden); relays store them like regular events, so they classify\n * `\"regular\"` here even though {@link isRegularKind} returns false for kinds 40000+.\n */\nexport function classifyKind(kind: number): KindClassification {\n  if (isReplaceableKind(kind)) {\n    return \"replaceable\";\n  }\n  if (isEphemeralKind(kind)) {\n    return \"ephemeral\";\n  }\n  if (isAddressableKind(kind)) {\n    return \"addressable\";\n  }\n  return \"regular\";\n}\n\n/** Kind numbers used by this package. */\nexport const Kind = {\n  Metadata: 0,\n  TextNote: 1,\n  Contacts: 3,\n  EventDeletion: 5,\n  Repost: 6,\n  Reaction: 7,\n  Seal: 13,\n  PrivateDirectMessage: 14,\n  GenericRepost: 16,\n  GiftWrap: 1059,\n  ZapRequest: 9734,\n  Zap: 9735,\n  MuteList: 10000,\n  PinList: 10001,\n  RelayList: 10002,\n  BookmarkList: 10003,\n  FavoriteRelays: 10012,\n  UserEmojiList: 10030,\n  DirectMessageRelaysList: 10050,\n  BlossomServerList: 10063,\n  GiftWrapEphemeral: 21059,\n  ClientAuth: 22242,\n  NostrConnect: 24133,\n  BlobsAuth: 24242,\n  HttpAuth: 27235,\n  RelaySets: 30002,\n  EmojiSet: 30030,\n  StarterPack: 39089,\n} as const;\n\n/** Name of a kind constant on {@link Kind}. */\nexport type KindName = keyof typeof Kind;\n/** Union of the numeric kind values on {@link Kind}. */\nexport type KnownKind = (typeof Kind)[KindName];\n"],"mappings":";;;;;;AAKA,SAAgB,cAAc,MAAuB;CACnD,OAAO,OAAO,OAAS,SAAS,KAAK,SAAS;AAChD;;AAGA,SAAgB,kBAAkB,MAAuB;CACvD,OAAO,SAAS,KAAK,SAAS,KAAM,QAAQ,OAAS,OAAO;AAC9D;;AAGA,SAAgB,gBAAgB,MAAuB;CACrD,OAAO,QAAQ,OAAS,OAAO;AACjC;;AAGA,SAAgB,kBAAkB,MAAuB;CACvD,OAAO,QAAQ,OAAS,OAAO;AACjC;;;;;;AAUA,SAAgB,aAAa,MAAkC;CAC7D,IAAI,kBAAkB,IAAI,GACxB,OAAO;CAET,IAAI,gBAAgB,IAAI,GACtB,OAAO;CAET,IAAI,kBAAkB,IAAI,GACxB,OAAO;CAET,OAAO;AACT;;AAGA,MAAa,OAAO;CAClB,UAAU;CACV,UAAU;CACV,UAAU;CACV,eAAe;CACf,QAAQ;CACR,UAAU;CACV,MAAM;CACN,sBAAsB;CACtB,eAAe;CACf,UAAU;CACV,YAAY;CACZ,KAAK;CACL,UAAU;CACV,SAAS;CACT,WAAW;CACX,cAAc;CACd,gBAAgB;CAChB,eAAe;CACf,yBAAyB;CACzB,mBAAmB;CACnB,mBAAmB;CACnB,YAAY;CACZ,cAAc;CACd,WAAW;CACX,UAAU;CACV,WAAW;CACX,UAAU;CACV,aAAa;AACf"}

package/dist/{loaders-Dp2nXEFk.mjs → loaders-BRh2riV9.mjs}

@@ -1,16 +1,16 @@
-import { f as nowSeconds, l as isRecord, s as isHex32, u as normalizeRelayUrls, y as NostrError } from "./util-DDpPkiED.mjs";
-import { r as isAddressableKind, t as Kind } from "./kind-D8fENiiL.mjs";
-import { p as sortedEvents, y as formatEventAddress } from "./event-B3ua2_oL.mjs";
+import { c as isHex32, d as normalizeRelayUrls, p as nowSeconds, u as isRecord, x as NostrError } from "./util-DfsyJ9nz.mjs";
+import { r as isAddressableKind, t as Kind } from "./kind-I2Tvbe82.mjs";
+import { p as sortedEvents, y as formatEventAddress } from "./event-DvM1f03b.mjs";
 import { i as throwIfAborted } from "./abort-DBq2STPj.mjs";
-import { t as invokeSafely } from "./report-CHld4uWj.mjs";
+import { t as invokeSafely } from "./report-D2BM5dgn.mjs";
 import { Nip19Error, decode, npubEncode } from "./nips/nip19.mjs";
 import { parseRelayList } from "./nips/nip65.mjs";
-import "./relay-DXtwUEdX.mjs";
+import "./relay-DIR77xQ2.mjs";
 import { i as trimOldest, r as touchKey } from "./collections-DtwMc1NU.mjs";
 import { parseDmRelayList } from "./nips/nip17.mjs";
 import { parseMuteList } from "./nips/nip51.mjs";
-import { n as toStorageError } from "./error-DH4guike.mjs";
-import { r as outboxBoundKey } from "./put-DRmV1wHD.mjs";
+import { n as toStorageError } from "./error-QyECUDIp.mjs";
+import { r as outboxBoundKey } from "./put-BEM5j8xK.mjs";
 //#region src/loaders/context.ts
 /** Internal dependency bag for loaders — never a module-level singleton. */
 var LoaderContext = class {
@@ -130,7 +130,7 @@ function createEventLoader(ctx) {
 				if (relays.length === 0) return;
 				await ctx.pool.fetch(relays, [parsed.filter], {
 					timeoutMs: ctx.fetchTimeoutMs,
-					onevent: (event, relayUrl) => ctx.ingest(event, relayUrl)
+					onEvent: (event, relayUrl) => ctx.ingest(event, relayUrl)
 				});
 				return parsed.lookup(ctx);
 			} finally {
@@ -321,13 +321,14 @@ var DataLoader = class {
 				queueMicrotask(() => this.#dispatch());
 			}
 		});
-		const promise = (async () => {
+		const cleanup = async () => {
 			try {
 				return await pending;
 			} finally {
-				this.#inflight.delete(cacheKey);
+				if (this.#inflight.get(cacheKey) === promise) this.#inflight.delete(cacheKey);
 			}
-		})();
+		};
+		const promise = cleanup();
 		this.#inflight.set(cacheKey, promise);
 		if (this.#useCache) this.#cache.set(cacheKey, promise);
 		return promise;
@@ -377,7 +378,7 @@ var DataLoader = class {
 const MAX_FETCHED_AT = 1e4;
 /**
 * Batch-fetch replaceable events (kind + authors) via the pool. Fetched events are written into the
-* reactive index (`onevent` records `seenOn`) and the winner is read back from it; the index — not
+* reactive index (`onEvent` records `seenOn`) and the winner is read back from it; the index — not
 * the loader — owns the stored value and winner selection. The loader only tracks per-address
 * `fetchedAt` timestamps so a recent fetch (including a miss) is not repeated within
 * `staleAfterSec`.
@@ -401,7 +402,7 @@ function createReplaceableLoader(ctx, kind) {
 			};
 			await ctx.pool.fetch(relays, [filter], {
 				timeoutMs: ctx.fetchTimeoutMs,
-				onevent: (event, relayUrl) => ctx.ingest(event, relayUrl)
+				onEvent: (event, relayUrl) => ctx.ingest(event, relayUrl)
 			});
 		}
 		const now = nowSeconds();
@@ -550,7 +551,7 @@ var OutboxFeed = class {
 				const batch = await this.#pool.fetch([url], filters, {
 					timeoutMs: this.#timeoutMs,
 					signal: opts?.signal,
-					onevent: (event, relayUrl) => invokeSafely(() => this.#seen?.(event, relayUrl))
+					onEvent: (event, relayUrl) => invokeSafely(() => this.#seen?.(event, relayUrl))
 				});
 				for (const event of batch) byId.set(event.id, event);
 			} catch (error) {
@@ -593,7 +594,7 @@ var OutboxFeed = class {
 			};
 			closers.push(this.#pool.subscribe([url], [filter], {
 				signal: opts?.signal,
-				onevent: (event, relayUrl) => {
+				onEvent: (event, relayUrl) => {
 					invokeSafely(() => this.#seen?.(event, relayUrl));
 					if (seen.has(event.id)) return;
 					seen.add(event.id);
@@ -780,4 +781,4 @@ function createLoaders(opts) {
 //#endregion
 export { bareNostrUser as a, groupAuthorsByOutboxRelay as i, OutboxError as n, OutboxFeed as r, createLoaders as t };
 
-//# sourceMappingURL=loaders-Dp2nXEFk.mjs.map
+//# sourceMappingURL=loaders-BRh2riV9.mjs.map