@qntx/nostr 0.2.2 → 0.3.0

package/dist/{signer-BGSpLC7e.mjs → signer-CYQutDzD.mjs}

@@ -1,7 +1,7 @@
 import { f as CryptoError, i as bytesToHex$1, n as assertHex32, o as isHex32 } from "./util-LfQirgDk.mjs";
 import { t as Kind } from "./kind-Cxwhhkx8.mjs";
 import { h as Tag, m as validateSignedEvent, u as signedMatchesUnsigned } from "./event-D8Nfoh4K.mjs";
-import { i as getPublicKey, n as SecretKey, o as signEvent, r as finalizeEvent, t as Keys } from "./key-BZBap2p-.mjs";
+import { i as getPublicKey, n as SecretKey, o as signEvent, r as finalizeEvent, t as Keys } from "./key-Bps-LqX7.mjs";
 import { n as verifyEvent } from "./verifier-t5WoWbtY.mjs";
 import { decrypt, encrypt } from "./nips/nip04.mjs";
 import { decrypt as decrypt$1, encrypt as encrypt$1, getConversationKey } from "./nips/nip44.mjs";
@@ -506,4 +506,4 @@ var Nip46Signer = class Nip46Signer {
 //#endregion
 export { KeysSigner as a, isNip07Available as i, Nip07Signer as n, getWindowNostr as r, Nip46Signer as t };
 
-//# sourceMappingURL=signer-BGSpLC7e.mjs.map
+//# sourceMappingURL=signer-CYQutDzD.mjs.map

package/dist/{signer-BGSpLC7e.mjs.map → signer-CYQutDzD.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"signer-BGSpLC7e.mjs","names":["nip04.encrypt","nip04.decrypt","nip44.getConversationKey","nip44.encrypt","nip44.decrypt","decrypt","bytesToHex","encrypt"],"sources":["../src/signer/keys.ts","../src/signer/nip07.ts","../src/signer/nip46.ts"],"sourcesContent":["import type { Event, UnsignedEvent } from \"../core/event.ts\";\nimport type { SecretKey } from \"../core/key.ts\";\nimport { Keys, signEvent } from \"../core/key.ts\";\nimport * as nip04 from \"../nips/nip04.ts\";\nimport * as nip44 from \"../nips/nip44.ts\";\nimport type { NostrSigner } from \"./types.ts\";\n\n/** Local secret-key signer with NIP-04 (legacy) and NIP-44 support. */\nexport class KeysSigner implements NostrSigner {\n  readonly #keys: Keys;\n  readonly #convKeys = new Map<string, Uint8Array>();\n\n  constructor(secretKey: SecretKey | Uint8Array | string | Keys) {\n    this.#keys = secretKey instanceof Keys ? secretKey : Keys.fromSecretKey(secretKey);\n  }\n\n  get keys(): Keys {\n    return this.#keys;\n  }\n\n  // oxlint-disable-next-line typescript/require-await -- NostrSigner is async; KeysSigner signs synchronously\n  async getPublicKey(): Promise<string> {\n    return this.#keys.publicKey;\n  }\n\n  // oxlint-disable-next-line typescript/require-await -- NostrSigner is async; KeysSigner signs synchronously\n  async signEvent(unsigned: UnsignedEvent): Promise<Event> {\n    return signEvent(unsigned, this.#keys);\n  }\n\n  // oxlint-disable-next-line typescript/require-await -- NostrSigner is async; KeysSigner signs synchronously\n  async nip04Encrypt(peer: string, plaintext: string): Promise<string> {\n    return nip04.encrypt(this.#keys.secretKey.bytes, peer, plaintext);\n  }\n\n  // oxlint-disable-next-line typescript/require-await -- NostrSigner is async; KeysSigner signs synchronously\n  async nip04Decrypt(peer: string, ciphertext: string): Promise<string> {\n    return nip04.decrypt(this.#keys.secretKey.bytes, peer, ciphertext);\n  }\n\n  #conversationKey(peer: string): Uint8Array {\n    const pk = peer.toLowerCase();\n    let key = this.#convKeys.get(pk);\n    if (!key) {\n      key = nip44.getConversationKey(this.#keys.secretKey.bytes, pk);\n      this.#convKeys.set(pk, key);\n    }\n    return key;\n  }\n\n  // oxlint-disable-next-line typescript/require-await -- NostrSigner is async; KeysSigner signs synchronously\n  async nip44Encrypt(peer: string, plaintext: string): Promise<string> {\n    return nip44.encrypt(plaintext, this.#conversationKey(peer));\n  }\n\n  // oxlint-disable-next-line typescript/require-await -- NostrSigner is async; KeysSigner signs synchronously\n  async nip44Decrypt(peer: string, payload: string): Promise<string> {\n    return nip44.decrypt(payload, this.#conversationKey(peer));\n  }\n}\n","import { CryptoError } from \"../core/error.ts\";\nimport type { Event, EventTemplate, UnsignedEvent } from \"../core/event.ts\";\nimport { signedMatchesUnsigned, validateSignedEvent } from \"../core/event.ts\";\nimport { assertHex32 } from \"../core/util.ts\";\nimport { verifyEvent } from \"../core/verifier.ts\";\nimport type { NostrSigner } from \"./types.ts\";\n\n/**\n * Minimal NIP-07 provider surface (browser extension `window.nostr`).\n *\n * @see https://github.com/nostr-protocol/nips/blob/master/07.md\n */\nexport type WindowNostr = {\n  getPublicKey: () => Promise<string>;\n  signEvent: (event: EventTemplate) => Promise<Event>;\n  nip04?: {\n    encrypt: (pubkey: string, plaintext: string) => Promise<string>;\n    decrypt: (pubkey: string, ciphertext: string) => Promise<string>;\n  };\n  nip44?: {\n    encrypt: (pubkey: string, plaintext: string) => Promise<string>;\n    decrypt: (pubkey: string, ciphertext: string) => Promise<string>;\n  };\n};\n\ntype GlobalWithNostr = typeof globalThis & {\n  nostr?: WindowNostr;\n  window?: { nostr?: WindowNostr };\n};\n\n/** Resolve `window.nostr` / `globalThis.nostr` when present. */\nexport function getWindowNostr(): WindowNostr | undefined {\n  const g = globalThis as GlobalWithNostr;\n  return g.nostr ?? g.window?.nostr;\n}\n\n/** True when a NIP-07 provider is injected in the current environment. */\nexport function isNip07Available(): boolean {\n  const n = getWindowNostr();\n  return Boolean(n && typeof n.getPublicKey === \"function\" && typeof n.signEvent === \"function\");\n}\n\n/**\n * Signer backed by a NIP-07 browser extension (or any injected provider). Never holds secret keys\n * in-process.\n */\nexport class Nip07Signer implements NostrSigner {\n  readonly #provider: WindowNostr | undefined;\n\n  constructor(provider?: WindowNostr) {\n    this.#provider = provider;\n  }\n\n  #resolve(): WindowNostr {\n    const provider = this.#provider ?? getWindowNostr();\n    if (!provider) {\n      throw new CryptoError(\"NIP-07 provider not available (window.nostr missing)\");\n    }\n    return provider;\n  }\n\n  async getPublicKey(): Promise<string> {\n    const pk = await this.#resolve().getPublicKey();\n    try {\n      return assertHex32(pk, \"pubkey\");\n    } catch (error) {\n      throw new CryptoError(\"NIP-07 getPublicKey returned an invalid pubkey\", {\n        cause: error instanceof Error ? error : undefined,\n      });\n    }\n  }\n\n  async signEvent(unsigned: UnsignedEvent): Promise<Event> {\n    const provider = this.#resolve();\n    const template: EventTemplate = {\n      kind: unsigned.kind,\n      tags: unsigned.tags.map((t) => {\n        const [name, ...rest] = t;\n        if (name === undefined) {\n          throw new CryptoError(\"unsigned event has an empty tag\");\n        }\n        return [name, ...rest];\n      }),\n      content: unsigned.content,\n      created_at: unsigned.created_at,\n    };\n\n    const signed = await provider.signEvent(template);\n    if (!validateSignedEvent(signed)) {\n      throw new CryptoError(\"NIP-07 signEvent returned an invalid event\");\n    }\n    if (!verifyEvent(signed)) {\n      throw new CryptoError(\"NIP-07 signed event failed signature verification\");\n    }\n    if (!signedMatchesUnsigned(signed, unsigned)) {\n      throw new CryptoError(\"NIP-07 signed event does not match unsigned template\");\n    }\n    return signed;\n  }\n\n  async nip04Encrypt(peer: string, plaintext: string): Promise<string> {\n    const { nip04 } = this.#resolve();\n    if (!nip04?.encrypt) {\n      throw new CryptoError(\"NIP-07 provider does not support nip04.encrypt\");\n    }\n    return nip04.encrypt(peer, plaintext);\n  }\n\n  async nip04Decrypt(peer: string, ciphertext: string): Promise<string> {\n    const { nip04 } = this.#resolve();\n    if (!nip04?.decrypt) {\n      throw new CryptoError(\"NIP-07 provider does not support nip04.decrypt\");\n    }\n    return nip04.decrypt(peer, ciphertext);\n  }\n\n  async nip44Encrypt(peer: string, plaintext: string): Promise<string> {\n    const { nip44 } = this.#resolve();\n    if (!nip44?.encrypt) {\n      throw new CryptoError(\"NIP-07 provider does not support nip44.encrypt\");\n    }\n    return nip44.encrypt(peer, plaintext);\n  }\n\n  async nip44Decrypt(peer: string, payload: string): Promise<string> {\n    const { nip44 } = this.#resolve();\n    if (!nip44?.decrypt) {\n      throw new CryptoError(\"NIP-07 provider does not support nip44.decrypt\");\n    }\n    return nip44.decrypt(peer, payload);\n  }\n}\n","import { randomBytes } from \"@noble/hashes/utils.js\";\n\nimport type { Event, EventTemplate, UnsignedEvent } from \"../core/event.ts\";\nimport { signedMatchesUnsigned, validateSignedEvent } from \"../core/event.ts\";\nimport type { Filter } from \"../core/filter.ts\";\nimport { SecretKey, finalizeEvent, getPublicKey } from \"../core/key.ts\";\nimport { Kind } from \"../core/kind.ts\";\nimport { invokeSafely } from \"../core/report.ts\";\nimport { Tag } from \"../core/tag.ts\";\nimport { bytesToHex, isHex32 } from \"../core/util.ts\";\nimport { verifyEvent } from \"../core/verifier.ts\";\nimport { decrypt, encrypt, getConversationKey } from \"../nips/nip44.ts\";\nimport {\n  Nip46Error,\n  decodeNip46Response,\n  encodeNip46Request,\n  parseBunkerURL,\n  parseNostrConnectURI,\n} from \"../nips/nip46.ts\";\nimport type { BunkerPointer, ClientMetadata, Nip46Request } from \"../nips/nip46.ts\";\nimport type { NostrSigner } from \"./types.ts\";\n\n/** Subscribe options used by NIP-46 transport (structural subset of Pool). */\nexport type Nip46SubscribeOptions = {\n  signal?: AbortSignal | undefined;\n  onevent?: ((event: Event) => void) | undefined;\n  onclose?: ((reason: string) => void) | undefined;\n};\n\n/**\n * Structural relay transport for NIP-46 RPC. Satisfied by {@link import(\"../relay/pool.ts\").Pool};\n * constructed above the signer layer so `signer` never imports `relay` (ADR-0001).\n */\nexport type Nip46Transport = {\n  subscribe: (\n    relays: string[],\n    filters: Filter[],\n    opts?: Nip46SubscribeOptions,\n  ) => { close: (reason?: string) => void };\n  publish: (\n    relays: string[],\n    event: Event,\n  ) => Promise<ReadonlyArray<{ result?: { ok: boolean; message: string }; error?: string }>>;\n  close: (urls?: string[]) => void;\n};\n\n/** Options for {@link Nip46Signer}: transport, timeouts, and relay hints. */\nexport type Nip46SignerOptions = {\n  /** Shared transport. When set, the signer does not close it on {@link Nip46Signer.close}. */\n  pool?: Nip46Transport;\n  /**\n   * Factory for a private transport when `pool` is omitted. Typical: `() => new Pool({\n   * websocketImplementation, enableReconnect: true })`.\n   */\n  createPool?: () => Nip46Transport;\n  /**\n   * Relays used when the bunker pointer has none, and merged uniquely onto a nonempty pointer\n   * (pointer first).\n   */\n  relays?: string[];\n  /** Bunker connection secret when the pointer or bunker:// URL has none. */\n  secret?: string | undefined;\n  /** Local client key used to encrypt RPC (not the remote user key). */\n  clientSecretKey?: SecretKey | Uint8Array | string;\n  /** Called when bunker returns `auth_url` for a pending request. */\n  onAuthUrl?: (url: string) => void;\n  /** Per-request timeout in ms. Default 30s. */\n  timeoutMs?: number;\n  /**\n   * Timeout in ms applied after the bunker replies `auth_url`: the request keeps waiting for the\n   * real response until this elapses. Default 300s.\n   */\n  authTimeoutMs?: number;\n  /** Requested permissions sent with `connect` (`method[:kind]` list). */\n  perms?: string[];\n  /** Client metadata sent with bunker-initiated `connect`. */\n  metadata?: ClientMetadata;\n};\n\nfunction resolveClientSecret(key?: SecretKey | Uint8Array | string): SecretKey {\n  if (key === undefined) {\n    return SecretKey.generate();\n  }\n  if (key instanceof SecretKey) {\n    return key;\n  }\n  if (typeof key === \"string\") {\n    return SecretKey.fromHex(key);\n  }\n  return SecretKey.fromBytes(key);\n}\n\nfunction resolveTransport(opts: Nip46SignerOptions): { pool: Nip46Transport; ownsPool: boolean } {\n  if (opts.pool) {\n    return { pool: opts.pool, ownsPool: false };\n  }\n  if (opts.createPool) {\n    return { pool: opts.createPool(), ownsPool: true };\n  }\n  throw new Nip46Error(\n    \"Nip46Signer requires pool or createPool (inject Pool from @qntx/nostr/relay)\",\n  );\n}\n\nfunction applyPointerOpts(pointer: BunkerPointer, opts: Nip46SignerOptions): BunkerPointer {\n  let next: BunkerPointer = {\n    pubkey: pointer.pubkey.toLowerCase(),\n    relays: [...pointer.relays],\n    secret: pointer.secret,\n  };\n  if (opts.secret !== undefined && next.secret === undefined) {\n    next = { ...next, secret: opts.secret };\n  }\n\n  const relays = next.relays.length > 0 ? next.relays : [...(opts.relays ?? [])];\n  if (relays.length === 0) {\n    throw new Nip46Error(\"no relays for bunker connection\");\n  }\n  if (next.relays.length > 0 && opts.relays !== undefined && opts.relays.length > 0) {\n    const merged = [...next.relays];\n    for (const r of opts.relays) {\n      if (!merged.includes(r)) {\n        merged.push(r);\n      }\n    }\n    return { ...next, relays: merged };\n  }\n  return { ...next, relays };\n}\n\nfunction resolveBunkerPointer(input: string | BunkerPointer): BunkerPointer {\n  if (typeof input !== \"string\") {\n    return {\n      pubkey: input.pubkey.toLowerCase(),\n      relays: [...input.relays],\n      secret: input.secret,\n    };\n  }\n\n  const bunker = parseBunkerURL(input);\n  if (bunker) {\n    return bunker;\n  }\n\n  throw new Nip46Error(\"invalid bunker input (expected bunker:// URL or BunkerPointer)\");\n}\n\ntype PendingRequest = {\n  resolve: (v: string) => void;\n  reject: (e: Error) => void;\n  method: string;\n  timer?: ReturnType<typeof setTimeout>;\n};\n\n/**\n * NIP-46 remote signer (bunker / nostrconnect). Implements {@link NostrSigner}; never holds the\n * remote user's secret key. Network I/O is injected via {@link Nip46Transport} (no relay import).\n */\nexport class Nip46Signer implements NostrSigner {\n  readonly #pool: Nip46Transport;\n  readonly #ownsPool: boolean;\n  readonly #clientSecret: SecretKey;\n  readonly #clientPubkey: string;\n  readonly #pointer: BunkerPointer;\n  readonly #conversationKey: Uint8Array;\n  readonly #onAuthUrl: ((url: string) => void) | undefined;\n  readonly #timeoutMs: number;\n  readonly #authTimeoutMs: number;\n  readonly #perms: string[] | undefined;\n  readonly #metadata: ClientMetadata | undefined;\n  #relays: string[];\n  readonly #listeners = new Map<string, PendingRequest>();\n  #sub: { close: (reason?: string) => void } | undefined;\n  #open = false;\n  #cachedRemotePubkey: string | undefined;\n\n  private constructor(\n    clientSecret: SecretKey,\n    pointer: BunkerPointer,\n    pool: Nip46Transport,\n    ownsPool: boolean,\n    opts: Nip46SignerOptions,\n  ) {\n    if (pointer.relays.length === 0) {\n      throw new Nip46Error(\"bunker pointer has no relays\");\n    }\n    this.#clientSecret = clientSecret;\n    this.#clientPubkey = getPublicKey(clientSecret);\n    this.#pointer = {\n      pubkey: pointer.pubkey.toLowerCase(),\n      relays: [...pointer.relays],\n      secret: pointer.secret,\n    };\n    this.#relays = [...pointer.relays];\n    this.#pool = pool;\n    this.#ownsPool = ownsPool;\n    this.#conversationKey = getConversationKey(clientSecret.bytes, this.#pointer.pubkey);\n    this.#onAuthUrl = opts.onAuthUrl;\n    this.#timeoutMs = opts.timeoutMs ?? 30_000;\n    this.#authTimeoutMs = opts.authTimeoutMs ?? 300_000;\n    this.#perms = opts.perms;\n    this.#metadata = opts.metadata;\n  }\n\n  get bunker(): Readonly<BunkerPointer> {\n    return {\n      pubkey: this.#pointer.pubkey,\n      relays: [...this.#relays],\n      secret: this.#pointer.secret,\n    };\n  }\n\n  get clientPublicKey(): string {\n    return this.#clientPubkey;\n  }\n\n  /**\n   * Subscribe to an already-known bunker pointer. Does not send the `connect` RPC (reconnect\n   * without a new handshake). Requires `clientSecretKey` — reconnect must reuse the original client\n   * identity.\n   */\n  static fromBunker(\n    pointer: BunkerPointer,\n    opts: Nip46SignerOptions & { clientSecretKey: SecretKey | Uint8Array | string },\n  ): Nip46Signer {\n    if (opts.clientSecretKey === undefined) {\n      throw new Nip46Error(\"fromBunker requires clientSecretKey\");\n    }\n    const resolved = applyPointerOpts(pointer, opts);\n    const sk = resolveClientSecret(opts.clientSecretKey);\n    const { pool, ownsPool } = resolveTransport(opts);\n    const signer = new Nip46Signer(sk, resolved, pool, ownsPool, opts);\n    signer.#startSubscription();\n    return signer;\n  }\n\n  /**\n   * Connect using a `bunker://` URL or pre-parsed pointer. Invalid strings throw. A NIP-05\n   * identifier is not a bunker pointer. When both pointer and `opts.relays` are nonempty, unique\n   * `opts.relays` are appended.\n   */\n  static async connect(\n    input: string | BunkerPointer,\n    opts: Nip46SignerOptions = {},\n  ): Promise<Nip46Signer> {\n    const pointer = resolveBunkerPointer(input);\n    const signer = Nip46Signer.fromBunker(pointer, {\n      ...opts,\n      clientSecretKey: resolveClientSecret(opts.clientSecretKey),\n    });\n    try {\n      await signer.connectRemote();\n      try {\n        await signer.switchRelays();\n      } catch {\n        // Bunker may not implement switch_relays.\n      }\n      await signer.getPublicKey();\n      return signer;\n    } catch (error) {\n      await signer.close();\n      throw error;\n    }\n  }\n\n  /**\n   * Wait for a bunker to complete a client-initiated `nostrconnect://` handshake. Requires\n   * `clientSecretKey` whose pubkey matches the URI client pubkey (build the URI with\n   * {@link createNostrConnectURI} after generating keys).\n   */\n  static async fromNostrConnectURI(\n    connectionURI: string,\n    opts: Nip46SignerOptions & {\n      clientSecretKey: SecretKey | Uint8Array | string;\n      signal?: AbortSignal;\n      handshakeTimeoutMs?: number;\n    },\n  ): Promise<Nip46Signer> {\n    const params = parseNostrConnectURI(connectionURI);\n    const sk = resolveClientSecret(opts.clientSecretKey);\n    const clientPubkey = getPublicKey(sk);\n\n    if (clientPubkey !== params.clientPubkey) {\n      throw new Nip46Error(\"client secret key does not match nostrconnect client pubkey\");\n    }\n\n    const { pool, ownsPool } = resolveTransport(opts);\n    const handshakeTimeoutMs = opts.handshakeTimeoutMs ?? 300_000;\n\n    return new Promise((resolve, reject) => {\n      let settled = false;\n      const finish = (err?: Error, signer?: Nip46Signer) => {\n        if (settled) {\n          return;\n        }\n        settled = true;\n        clearTimeout(timer);\n        sub.close(err ? \"failed\" : \"connected\");\n        if (err) {\n          if (ownsPool) {\n            pool.close();\n          }\n          reject(err);\n        } else if (signer) {\n          resolve(signer);\n        }\n      };\n\n      const timer = setTimeout(() => {\n        finish(new Nip46Error(\"nostrconnect handshake timed out\"));\n      }, handshakeTimeoutMs);\n\n      const sub = pool.subscribe(\n        params.relays,\n        [{ kinds: [Kind.NostrConnect], \"#p\": [clientPubkey], limit: 0 }],\n        {\n          signal: opts.signal,\n          onevent: (event) => {\n            try {\n              const convKey = getConversationKey(sk.bytes, event.pubkey);\n              const payload = decrypt(event.content, convKey);\n              const response = decodeNip46Response(payload);\n              if (response.result !== params.secret) {\n                return;\n              }\n\n              const pointer: BunkerPointer = {\n                pubkey: event.pubkey.toLowerCase(),\n                relays: params.relays,\n                secret: params.secret,\n              };\n              const signer = new Nip46Signer(sk, pointer, pool, ownsPool, opts);\n              signer.#startSubscription();\n              void (async () => {\n                try {\n                  await signer.switchRelays();\n                } catch {\n                  // Relay switch at connect time is best-effort.\n                }\n                try {\n                  await signer.getPublicKey();\n                  finish(undefined, signer);\n                } catch (error: unknown) {\n                  finish(error instanceof Error ? error : new Nip46Error(String(error)));\n                }\n              })();\n            } catch {\n              // ignore non-matching events\n            }\n          },\n          onclose: (reason) => {\n            if (reason !== \"connected\" && reason !== \"failed\") {\n              finish(new Nip46Error(`nostrconnect subscription closed: ${reason}`));\n            }\n          },\n        },\n      );\n    });\n  }\n\n  #startSubscription(): void {\n    this.#sub?.close();\n    this.#sub = this.#pool.subscribe(\n      this.#relays,\n      [\n        {\n          kinds: [Kind.NostrConnect],\n          authors: [this.#pointer.pubkey],\n          \"#p\": [this.#clientPubkey],\n          limit: 0,\n        },\n      ],\n      {\n        onevent: (event) => {\n          try {\n            const payload = decrypt(event.content, this.#conversationKey);\n            const { id, result, error } = decodeNip46Response(payload);\n\n            if (result === \"auth_url\" && this.#listeners.has(id)) {\n              const listener = this.#listeners.get(id);\n              if (!listener) {\n                return;\n              }\n              if (error !== undefined && error !== \"\") {\n                invokeSafely(() => this.#onAuthUrl?.(error));\n              }\n              clearTimeout(listener.timer);\n              listener.timer = this.#requestTimer(id, listener, this.#authTimeoutMs);\n              return;\n            }\n\n            const listener = this.#dropRequest(id);\n            if (!listener) {\n              return;\n            }\n            if (error !== undefined && error !== \"\") {\n              listener.reject(new Nip46Error(error));\n            } else if (result === undefined) {\n              listener.reject(new Nip46Error(\"empty NIP-46 response\"));\n            } else {\n              listener.resolve(result);\n            }\n          } catch {\n            // ignore decrypt failures from unrelated events\n          }\n        },\n        onclose: () => {\n          this.#sub = undefined;\n        },\n      },\n    );\n    this.#open = true;\n  }\n\n  async connectRemote(overrides?: { metadata?: ClientMetadata; perms?: string[] }): Promise<void> {\n    const metadata = overrides?.metadata ?? this.#metadata;\n    const perms = overrides?.perms ?? this.#perms;\n    const params = [this.#pointer.pubkey, this.#pointer.secret ?? \"\"];\n    const hasPerms = perms !== undefined && perms.length > 0;\n    if (hasPerms || metadata !== undefined) {\n      params.push(hasPerms ? perms.join(\",\") : \"\");\n    }\n    if (metadata !== undefined) {\n      params.push(JSON.stringify(metadata));\n    }\n    const result = await this.#sendRequest(\"connect\", params);\n    if (result === \"ack\") {\n      return;\n    }\n    const { secret } = this.#pointer;\n    if (secret !== undefined && secret !== \"\" && result === secret) {\n      return;\n    }\n    throw new Nip46Error(`connect result is not ack or secret: ${result}`);\n  }\n\n  /**\n   * Ask the bunker for its preferred relay list and resubscribe when it changes. Spec result is a\n   * JSON array of URLs, or `null` when nothing changes.\n   */\n  async switchRelays(): Promise<string[] | undefined> {\n    const resp = await this.#sendRequest(\"switch_relays\", []);\n    if (resp === \"null\") {\n      return undefined;\n    }\n    let parsed: unknown;\n    try {\n      parsed = JSON.parse(resp);\n    } catch (error) {\n      throw new Nip46Error(\"invalid switch_relays JSON\", {\n        cause: error instanceof Error ? error : undefined,\n      });\n    }\n    if (\n      !Array.isArray(parsed) ||\n      parsed.length === 0 ||\n      !parsed.every((x) => typeof x === \"string\")\n    ) {\n      throw new Nip46Error(\"invalid switch_relays result\");\n    }\n    this.#relays = parsed;\n    this.#startSubscription();\n    return parsed;\n  }\n\n  /** Courtesy session teardown. Always closes the local signer afterwards. */\n  async logout(): Promise<void> {\n    try {\n      const resp = await this.#sendRequest(\"logout\", []);\n      if (resp !== \"ack\") {\n        throw new Nip46Error(`logout result is not ack: ${resp}`);\n      }\n    } finally {\n      await this.close();\n    }\n  }\n\n  async ping(): Promise<void> {\n    const resp = await this.#sendRequest(\"ping\", []);\n    if (resp !== \"pong\") {\n      throw new Nip46Error(`ping result is not pong: ${resp}`);\n    }\n  }\n\n  async getPublicKey(): Promise<string> {\n    if (this.#cachedRemotePubkey === undefined) {\n      const pk = await this.#sendRequest(\"get_public_key\", []);\n      if (!isHex32(pk.toLowerCase())) {\n        throw new Nip46Error(\"bunker returned invalid pubkey\");\n      }\n      this.#cachedRemotePubkey = pk.toLowerCase();\n    }\n    return this.#cachedRemotePubkey;\n  }\n\n  async signEvent(unsigned: UnsignedEvent): Promise<Event> {\n    const template: EventTemplate = {\n      kind: unsigned.kind,\n      tags: unsigned.tags,\n      content: unsigned.content,\n      created_at: unsigned.created_at,\n    };\n    const resp = await this.#sendRequest(\"sign_event\", [JSON.stringify(template)]);\n    let signed: unknown;\n    try {\n      signed = JSON.parse(resp);\n    } catch (error) {\n      throw new Nip46Error(\"bunker returned invalid sign_event JSON\", {\n        cause: error instanceof Error ? error : undefined,\n      });\n    }\n    if (!validateSignedEvent(signed) || !verifyEvent(signed)) {\n      throw new Nip46Error(\"bunker returned improperly signed event\");\n    }\n    if (!signedMatchesUnsigned(signed, unsigned)) {\n      throw new Nip46Error(\"signed event does not match unsigned template\");\n    }\n    return signed;\n  }\n\n  async nip04Encrypt(peer: string, plaintext: string): Promise<string> {\n    return this.#sendRequest(\"nip04_encrypt\", [peer, plaintext]);\n  }\n\n  async nip04Decrypt(peer: string, ciphertext: string): Promise<string> {\n    return this.#sendRequest(\"nip04_decrypt\", [peer, ciphertext]);\n  }\n\n  async nip44Encrypt(peer: string, plaintext: string): Promise<string> {\n    return this.#sendRequest(\"nip44_encrypt\", [peer, plaintext]);\n  }\n\n  async nip44Decrypt(peer: string, payload: string): Promise<string> {\n    return this.#sendRequest(\"nip44_decrypt\", [peer, payload]);\n  }\n\n  // oxlint-disable-next-line typescript/require-await -- NostrSigner is async; teardown is synchronous\n  async close(): Promise<void> {\n    this.#open = false;\n    for (const [, listener] of this.#listeners) {\n      clearTimeout(listener.timer);\n      listener.reject(new Nip46Error(\"signer closed\"));\n    }\n    this.#listeners.clear();\n    this.#sub?.close(\"signer closed\");\n    this.#sub = undefined;\n    if (this.#ownsPool) {\n      this.#pool.close();\n    }\n  }\n\n  async #sendRequest(method: string, params: string[]): Promise<string> {\n    if (!this.#open) {\n      throw new Nip46Error(\"signer is closed\");\n    }\n    if (!this.#sub) {\n      this.#startSubscription();\n    }\n\n    const id = bytesToHex(randomBytes(16));\n    const req: Nip46Request = { id, method, params };\n    const encrypted = encrypt(encodeNip46Request(req), this.#conversationKey);\n\n    const event = finalizeEvent(\n      {\n        kind: Kind.NostrConnect,\n        tags: [Tag.p(this.#pointer.pubkey)],\n        content: encrypted,\n        created_at: Math.floor(Date.now() / 1000),\n      },\n      this.#clientSecret,\n    );\n\n    const resultPromise = new Promise<string>((resolve, reject) => {\n      const listener: PendingRequest = { resolve, reject, method };\n      listener.timer = this.#requestTimer(id, listener, this.#timeoutMs);\n      this.#listeners.set(id, listener);\n    });\n\n    let replies;\n    try {\n      replies = await this.#pool.publish(this.#relays, event);\n    } catch (error) {\n      this.#dropRequest(id);\n      throw error;\n    }\n    if (!replies.some((reply) => reply.result?.ok === true)) {\n      const listener = this.#dropRequest(id);\n      const detail = replies\n        .map((reply) => reply.error ?? reply.result?.message)\n        .filter((message): message is string => Boolean(message))\n        .join(\"; \");\n      listener?.reject(new Nip46Error(`request not accepted by any relay: ${detail}`));\n    }\n    return resultPromise;\n  }\n\n  #dropRequest(id: string): PendingRequest | undefined {\n    const listener = this.#listeners.get(id);\n    if (!listener) {\n      return undefined;\n    }\n    clearTimeout(listener.timer);\n    this.#listeners.delete(id);\n    return listener;\n  }\n\n  #requestTimer(id: string, listener: PendingRequest, ms: number): ReturnType<typeof setTimeout> {\n    return setTimeout(() => {\n      this.#dropRequest(id);\n      listener.reject(new Nip46Error(`NIP-46 request timed out: ${listener.method}`));\n    }, ms);\n  }\n}\n"],"mappings":";;;;;;;;;;;;AAQA,IAAa,aAAb,MAA+C;CAC7C;CACA,4BAAqB,IAAI,IAAwB;CAEjD,YAAY,WAAmD;EAC7D,KAAK,QAAQ,qBAAqB,OAAO,YAAY,KAAK,cAAc,SAAS;CACnF;CAEA,IAAI,OAAa;EACf,OAAO,KAAK;CACd;CAGA,MAAM,eAAgC;EACpC,OAAO,KAAK,MAAM;CACpB;CAGA,MAAM,UAAU,UAAyC;EACvD,OAAO,UAAU,UAAU,KAAK,KAAK;CACvC;CAGA,MAAM,aAAa,MAAc,WAAoC;EACnE,OAAOA,QAAc,KAAK,MAAM,UAAU,OAAO,MAAM,SAAS;CAClE;CAGA,MAAM,aAAa,MAAc,YAAqC;EACpE,OAAOC,QAAc,KAAK,MAAM,UAAU,OAAO,MAAM,UAAU;CACnE;CAEA,iBAAiB,MAA0B;EACzC,MAAM,KAAK,KAAK,YAAY;EAC5B,IAAI,MAAM,KAAK,UAAU,IAAI,EAAE;EAC/B,IAAI,CAAC,KAAK;GACR,MAAMC,mBAAyB,KAAK,MAAM,UAAU,OAAO,EAAE;GAC7D,KAAK,UAAU,IAAI,IAAI,GAAG;EAC5B;EACA,OAAO;CACT;CAGA,MAAM,aAAa,MAAc,WAAoC;EACnE,OAAOC,UAAc,WAAW,KAAK,iBAAiB,IAAI,CAAC;CAC7D;CAGA,MAAM,aAAa,MAAc,SAAkC;EACjE,OAAOC,UAAc,SAAS,KAAK,iBAAiB,IAAI,CAAC;CAC3D;AACF;;;;AC5BA,SAAgB,iBAA0C;CACxD,MAAM,IAAI;CACV,OAAO,EAAE,SAAS,EAAE,QAAQ;AAC9B;;AAGA,SAAgB,mBAA4B;CAC1C,MAAM,IAAI,eAAe;CACzB,OAAO,QAAQ,KAAK,OAAO,EAAE,iBAAiB,cAAc,OAAO,EAAE,cAAc,UAAU;AAC/F;;;;;AAMA,IAAa,cAAb,MAAgD;CAC9C;CAEA,YAAY,UAAwB;EAClC,KAAK,YAAY;CACnB;CAEA,WAAwB;EACtB,MAAM,WAAW,KAAK,aAAa,eAAe;EAClD,IAAI,CAAC,UACH,MAAM,IAAI,YAAY,sDAAsD;EAE9E,OAAO;CACT;CAEA,MAAM,eAAgC;EACpC,MAAM,KAAK,MAAM,KAAK,SAAS,CAAC,CAAC,aAAa;EAC9C,IAAI;GACF,OAAO,YAAY,IAAI,QAAQ;EACjC,SAAS,OAAO;GACd,MAAM,IAAI,YAAY,kDAAkD,EACtE,OAAO,iBAAiB,QAAQ,QAAQ,KAAA,EAC1C,CAAC;EACH;CACF;CAEA,MAAM,UAAU,UAAyC;EACvD,MAAM,WAAW,KAAK,SAAS;EAC/B,MAAM,WAA0B;GAC9B,MAAM,SAAS;GACf,MAAM,SAAS,KAAK,KAAK,MAAM;IAC7B,MAAM,CAAC,MAAM,GAAG,QAAQ;IACxB,IAAI,SAAS,KAAA,GACX,MAAM,IAAI,YAAY,iCAAiC;IAEzD,OAAO,CAAC,MAAM,GAAG,IAAI;GACvB,CAAC;GACD,SAAS,SAAS;GAClB,YAAY,SAAS;EACvB;EAEA,MAAM,SAAS,MAAM,SAAS,UAAU,QAAQ;EAChD,IAAI,CAAC,oBAAoB,MAAM,GAC7B,MAAM,IAAI,YAAY,4CAA4C;EAEpE,IAAI,CAAC,YAAY,MAAM,GACrB,MAAM,IAAI,YAAY,mDAAmD;EAE3E,IAAI,CAAC,sBAAsB,QAAQ,QAAQ,GACzC,MAAM,IAAI,YAAY,sDAAsD;EAE9E,OAAO;CACT;CAEA,MAAM,aAAa,MAAc,WAAoC;EACnE,MAAM,EAAE,UAAU,KAAK,SAAS;EAChC,IAAI,CAAC,OAAO,SACV,MAAM,IAAI,YAAY,gDAAgD;EAExE,OAAO,MAAM,QAAQ,MAAM,SAAS;CACtC;CAEA,MAAM,aAAa,MAAc,YAAqC;EACpE,MAAM,EAAE,UAAU,KAAK,SAAS;EAChC,IAAI,CAAC,OAAO,SACV,MAAM,IAAI,YAAY,gDAAgD;EAExE,OAAO,MAAM,QAAQ,MAAM,UAAU;CACvC;CAEA,MAAM,aAAa,MAAc,WAAoC;EACnE,MAAM,EAAE,UAAU,KAAK,SAAS;EAChC,IAAI,CAAC,OAAO,SACV,MAAM,IAAI,YAAY,gDAAgD;EAExE,OAAO,MAAM,QAAQ,MAAM,SAAS;CACtC;CAEA,MAAM,aAAa,MAAc,SAAkC;EACjE,MAAM,EAAE,UAAU,KAAK,SAAS;EAChC,IAAI,CAAC,OAAO,SACV,MAAM,IAAI,YAAY,gDAAgD;EAExE,OAAO,MAAM,QAAQ,MAAM,OAAO;CACpC;AACF;;;ACpDA,SAAS,oBAAoB,KAAkD;CAC7E,IAAI,QAAQ,KAAA,GACV,OAAO,UAAU,SAAS;CAE5B,IAAI,eAAe,WACjB,OAAO;CAET,IAAI,OAAO,QAAQ,UACjB,OAAO,UAAU,QAAQ,GAAG;CAE9B,OAAO,UAAU,UAAU,GAAG;AAChC;AAEA,SAAS,iBAAiB,MAAuE;CAC/F,IAAI,KAAK,MACP,OAAO;EAAE,MAAM,KAAK;EAAM,UAAU;CAAM;CAE5C,IAAI,KAAK,YACP,OAAO;EAAE,MAAM,KAAK,WAAW;EAAG,UAAU;CAAK;CAEnD,MAAM,IAAI,WACR,8EACF;AACF;AAEA,SAAS,iBAAiB,SAAwB,MAAyC;CACzF,IAAI,OAAsB;EACxB,QAAQ,QAAQ,OAAO,YAAY;EACnC,QAAQ,CAAC,GAAG,QAAQ,MAAM;EAC1B,QAAQ,QAAQ;CAClB;CACA,IAAI,KAAK,WAAW,KAAA,KAAa,KAAK,WAAW,KAAA,GAC/C,OAAO;EAAE,GAAG;EAAM,QAAQ,KAAK;CAAO;CAGxC,MAAM,SAAS,KAAK,OAAO,SAAS,IAAI,KAAK,SAAS,CAAC,GAAI,KAAK,UAAU,CAAC,CAAE;CAC7E,IAAI,OAAO,WAAW,GACpB,MAAM,IAAI,WAAW,iCAAiC;CAExD,IAAI,KAAK,OAAO,SAAS,KAAK,KAAK,WAAW,KAAA,KAAa,KAAK,OAAO,SAAS,GAAG;EACjF,MAAM,SAAS,CAAC,GAAG,KAAK,MAAM;EAC9B,KAAK,MAAM,KAAK,KAAK,QACnB,IAAI,CAAC,OAAO,SAAS,CAAC,GACpB,OAAO,KAAK,CAAC;EAGjB,OAAO;GAAE,GAAG;GAAM,QAAQ;EAAO;CACnC;CACA,OAAO;EAAE,GAAG;EAAM;CAAO;AAC3B;AAEA,SAAS,qBAAqB,OAA8C;CAC1E,IAAI,OAAO,UAAU,UACnB,OAAO;EACL,QAAQ,MAAM,OAAO,YAAY;EACjC,QAAQ,CAAC,GAAG,MAAM,MAAM;EACxB,QAAQ,MAAM;CAChB;CAGF,MAAM,SAAS,eAAe,KAAK;CACnC,IAAI,QACF,OAAO;CAGT,MAAM,IAAI,WAAW,gEAAgE;AACvF;;;;;AAaA,IAAa,cAAb,MAAa,YAAmC;CAC9C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA,6BAAsB,IAAI,IAA4B;CACtD;CACA,QAAQ;CACR;CAEA,YACE,cACA,SACA,MACA,UACA,MACA;EACA,IAAI,QAAQ,OAAO,WAAW,GAC5B,MAAM,IAAI,WAAW,8BAA8B;EAErD,KAAK,gBAAgB;EACrB,KAAK,gBAAgB,aAAa,YAAY;EAC9C,KAAK,WAAW;GACd,QAAQ,QAAQ,OAAO,YAAY;GACnC,QAAQ,CAAC,GAAG,QAAQ,MAAM;GAC1B,QAAQ,QAAQ;EAClB;EACA,KAAK,UAAU,CAAC,GAAG,QAAQ,MAAM;EACjC,KAAK,QAAQ;EACb,KAAK,YAAY;EACjB,KAAK,mBAAmB,mBAAmB,aAAa,OAAO,KAAK,SAAS,MAAM;EACnF,KAAK,aAAa,KAAK;EACvB,KAAK,aAAa,KAAK,aAAa;EACpC,KAAK,iBAAiB,KAAK,iBAAiB;EAC5C,KAAK,SAAS,KAAK;EACnB,KAAK,YAAY,KAAK;CACxB;CAEA,IAAI,SAAkC;EACpC,OAAO;GACL,QAAQ,KAAK,SAAS;GACtB,QAAQ,CAAC,GAAG,KAAK,OAAO;GACxB,QAAQ,KAAK,SAAS;EACxB;CACF;CAEA,IAAI,kBAA0B;EAC5B,OAAO,KAAK;CACd;;;;;;CAOA,OAAO,WACL,SACA,MACa;EACb,IAAI,KAAK,oBAAoB,KAAA,GAC3B,MAAM,IAAI,WAAW,qCAAqC;EAE5D,MAAM,WAAW,iBAAiB,SAAS,IAAI;EAC/C,MAAM,KAAK,oBAAoB,KAAK,eAAe;EACnD,MAAM,EAAE,MAAM,aAAa,iBAAiB,IAAI;EAChD,MAAM,SAAS,IAAI,YAAY,IAAI,UAAU,MAAM,UAAU,IAAI;EACjE,OAAO,mBAAmB;EAC1B,OAAO;CACT;;;;;;CAOA,aAAa,QACX,OACA,OAA2B,CAAC,GACN;EACtB,MAAM,UAAU,qBAAqB,KAAK;EAC1C,MAAM,SAAS,YAAY,WAAW,SAAS;GAC7C,GAAG;GACH,iBAAiB,oBAAoB,KAAK,eAAe;EAC3D,CAAC;EACD,IAAI;GACF,MAAM,OAAO,cAAc;GAC3B,IAAI;IACF,MAAM,OAAO,aAAa;GAC5B,QAAQ,CAER;GACA,MAAM,OAAO,aAAa;GAC1B,OAAO;EACT,SAAS,OAAO;GACd,MAAM,OAAO,MAAM;GACnB,MAAM;EACR;CACF;;;;;;CAOA,aAAa,oBACX,eACA,MAKsB;EACtB,MAAM,SAAS,qBAAqB,aAAa;EACjD,MAAM,KAAK,oBAAoB,KAAK,eAAe;EACnD,MAAM,eAAe,aAAa,EAAE;EAEpC,IAAI,iBAAiB,OAAO,cAC1B,MAAM,IAAI,WAAW,6DAA6D;EAGpF,MAAM,EAAE,MAAM,aAAa,iBAAiB,IAAI;EAChD,MAAM,qBAAqB,KAAK,sBAAsB;EAEtD,OAAO,IAAI,SAAS,SAAS,WAAW;GACtC,IAAI,UAAU;GACd,MAAM,UAAU,KAAa,WAAyB;IACpD,IAAI,SACF;IAEF,UAAU;IACV,aAAa,KAAK;IAClB,IAAI,MAAM,MAAM,WAAW,WAAW;IACtC,IAAI,KAAK;KACP,IAAI,UACF,KAAK,MAAM;KAEb,OAAO,GAAG;IACZ,OAAO,IAAI,QACT,QAAQ,MAAM;GAElB;GAEA,MAAM,QAAQ,iBAAiB;IAC7B,OAAO,IAAI,WAAW,kCAAkC,CAAC;GAC3D,GAAG,kBAAkB;GAErB,MAAM,MAAM,KAAK,UACf,OAAO,QACP,CAAC;IAAE,OAAO,CAAC,KAAK,YAAY;IAAG,MAAM,CAAC,YAAY;IAAG,OAAO;GAAE,CAAC,GAC/D;IACE,QAAQ,KAAK;IACb,UAAU,UAAU;KAClB,IAAI;MACF,MAAM,UAAU,mBAAmB,GAAG,OAAO,MAAM,MAAM;MACzD,MAAM,UAAUC,UAAQ,MAAM,SAAS,OAAO;MAE9C,IADiB,oBAAoB,OAC1B,CAAC,CAAC,WAAW,OAAO,QAC7B;MAGF,MAAM,UAAyB;OAC7B,QAAQ,MAAM,OAAO,YAAY;OACjC,QAAQ,OAAO;OACf,QAAQ,OAAO;MACjB;MACA,MAAM,SAAS,IAAI,YAAY,IAAI,SAAS,MAAM,UAAU,IAAI;MAChE,OAAO,mBAAmB;MAC1B,CAAM,YAAY;OAChB,IAAI;QACF,MAAM,OAAO,aAAa;OAC5B,QAAQ,CAER;OACA,IAAI;QACF,MAAM,OAAO,aAAa;QAC1B,OAAO,KAAA,GAAW,MAAM;OAC1B,SAAS,OAAgB;QACvB,OAAO,iBAAiB,QAAQ,QAAQ,IAAI,WAAW,OAAO,KAAK,CAAC,CAAC;OACvE;MACF,EAAA,CAAG;KACL,QAAQ,CAER;IACF;IACA,UAAU,WAAW;KACnB,IAAI,WAAW,eAAe,WAAW,UACvC,OAAO,IAAI,WAAW,qCAAqC,QAAQ,CAAC;IAExE;GACF,CACF;EACF,CAAC;CACH;CAEA,qBAA2B;EACzB,KAAK,MAAM,MAAM;EACjB,KAAK,OAAO,KAAK,MAAM,UACrB,KAAK,SACL,CACE;GACE,OAAO,CAAC,KAAK,YAAY;GACzB,SAAS,CAAC,KAAK,SAAS,MAAM;GAC9B,MAAM,CAAC,KAAK,aAAa;GACzB,OAAO;EACT,CACF,GACA;GACE,UAAU,UAAU;IAClB,IAAI;KACF,MAAM,UAAUA,UAAQ,MAAM,SAAS,KAAK,gBAAgB;KAC5D,MAAM,EAAE,IAAI,QAAQ,UAAU,oBAAoB,OAAO;KAEzD,IAAI,WAAW,cAAc,KAAK,WAAW,IAAI,EAAE,GAAG;MACpD,MAAM,WAAW,KAAK,WAAW,IAAI,EAAE;MACvC,IAAI,CAAC,UACH;MAEF,IAAI,UAAU,KAAA,KAAa,UAAU,IACnC,mBAAmB,KAAK,aAAa,KAAK,CAAC;MAE7C,aAAa,SAAS,KAAK;MAC3B,SAAS,QAAQ,KAAK,cAAc,IAAI,UAAU,KAAK,cAAc;MACrE;KACF;KAEA,MAAM,WAAW,KAAK,aAAa,EAAE;KACrC,IAAI,CAAC,UACH;KAEF,IAAI,UAAU,KAAA,KAAa,UAAU,IACnC,SAAS,OAAO,IAAI,WAAW,KAAK,CAAC;UAChC,IAAI,WAAW,KAAA,GACpB,SAAS,OAAO,IAAI,WAAW,uBAAuB,CAAC;UAEvD,SAAS,QAAQ,MAAM;IAE3B,QAAQ,CAER;GACF;GACA,eAAe;IACb,KAAK,OAAO,KAAA;GACd;EACF,CACF;EACA,KAAK,QAAQ;CACf;CAEA,MAAM,cAAc,WAA4E;EAC9F,MAAM,WAAW,WAAW,YAAY,KAAK;EAC7C,MAAM,QAAQ,WAAW,SAAS,KAAK;EACvC,MAAM,SAAS,CAAC,KAAK,SAAS,QAAQ,KAAK,SAAS,UAAU,EAAE;EAChE,MAAM,WAAW,UAAU,KAAA,KAAa,MAAM,SAAS;EACvD,IAAI,YAAY,aAAa,KAAA,GAC3B,OAAO,KAAK,WAAW,MAAM,KAAK,GAAG,IAAI,EAAE;EAE7C,IAAI,aAAa,KAAA,GACf,OAAO,KAAK,KAAK,UAAU,QAAQ,CAAC;EAEtC,MAAM,SAAS,MAAM,KAAK,aAAa,WAAW,MAAM;EACxD,IAAI,WAAW,OACb;EAEF,MAAM,EAAE,WAAW,KAAK;EACxB,IAAI,WAAW,KAAA,KAAa,WAAW,MAAM,WAAW,QACtD;EAEF,MAAM,IAAI,WAAW,wCAAwC,QAAQ;CACvE;;;;;CAMA,MAAM,eAA8C;EAClD,MAAM,OAAO,MAAM,KAAK,aAAa,iBAAiB,CAAC,CAAC;EACxD,IAAI,SAAS,QACX;EAEF,IAAI;EACJ,IAAI;GACF,SAAS,KAAK,MAAM,IAAI;EAC1B,SAAS,OAAO;GACd,MAAM,IAAI,WAAW,8BAA8B,EACjD,OAAO,iBAAiB,QAAQ,QAAQ,KAAA,EAC1C,CAAC;EACH;EACA,IACE,CAAC,MAAM,QAAQ,MAAM,KACrB,OAAO,WAAW,KAClB,CAAC,OAAO,OAAO,MAAM,OAAO,MAAM,QAAQ,GAE1C,MAAM,IAAI,WAAW,8BAA8B;EAErD,KAAK,UAAU;EACf,KAAK,mBAAmB;EACxB,OAAO;CACT;;CAGA,MAAM,SAAwB;EAC5B,IAAI;GACF,MAAM,OAAO,MAAM,KAAK,aAAa,UAAU,CAAC,CAAC;GACjD,IAAI,SAAS,OACX,MAAM,IAAI,WAAW,6BAA6B,MAAM;EAE5D,UAAU;GACR,MAAM,KAAK,MAAM;EACnB;CACF;CAEA,MAAM,OAAsB;EAC1B,MAAM,OAAO,MAAM,KAAK,aAAa,QAAQ,CAAC,CAAC;EAC/C,IAAI,SAAS,QACX,MAAM,IAAI,WAAW,4BAA4B,MAAM;CAE3D;CAEA,MAAM,eAAgC;EACpC,IAAI,KAAK,wBAAwB,KAAA,GAAW;GAC1C,MAAM,KAAK,MAAM,KAAK,aAAa,kBAAkB,CAAC,CAAC;GACvD,IAAI,CAAC,QAAQ,GAAG,YAAY,CAAC,GAC3B,MAAM,IAAI,WAAW,gCAAgC;GAEvD,KAAK,sBAAsB,GAAG,YAAY;EAC5C;EACA,OAAO,KAAK;CACd;CAEA,MAAM,UAAU,UAAyC;EACvD,MAAM,WAA0B;GAC9B,MAAM,SAAS;GACf,MAAM,SAAS;GACf,SAAS,SAAS;GAClB,YAAY,SAAS;EACvB;EACA,MAAM,OAAO,MAAM,KAAK,aAAa,cAAc,CAAC,KAAK,UAAU,QAAQ,CAAC,CAAC;EAC7E,IAAI;EACJ,IAAI;GACF,SAAS,KAAK,MAAM,IAAI;EAC1B,SAAS,OAAO;GACd,MAAM,IAAI,WAAW,2CAA2C,EAC9D,OAAO,iBAAiB,QAAQ,QAAQ,KAAA,EAC1C,CAAC;EACH;EACA,IAAI,CAAC,oBAAoB,MAAM,KAAK,CAAC,YAAY,MAAM,GACrD,MAAM,IAAI,WAAW,yCAAyC;EAEhE,IAAI,CAAC,sBAAsB,QAAQ,QAAQ,GACzC,MAAM,IAAI,WAAW,+CAA+C;EAEtE,OAAO;CACT;CAEA,MAAM,aAAa,MAAc,WAAoC;EACnE,OAAO,KAAK,aAAa,iBAAiB,CAAC,MAAM,SAAS,CAAC;CAC7D;CAEA,MAAM,aAAa,MAAc,YAAqC;EACpE,OAAO,KAAK,aAAa,iBAAiB,CAAC,MAAM,UAAU,CAAC;CAC9D;CAEA,MAAM,aAAa,MAAc,WAAoC;EACnE,OAAO,KAAK,aAAa,iBAAiB,CAAC,MAAM,SAAS,CAAC;CAC7D;CAEA,MAAM,aAAa,MAAc,SAAkC;EACjE,OAAO,KAAK,aAAa,iBAAiB,CAAC,MAAM,OAAO,CAAC;CAC3D;CAGA,MAAM,QAAuB;EAC3B,KAAK,QAAQ;EACb,KAAK,MAAM,GAAG,aAAa,KAAK,YAAY;GAC1C,aAAa,SAAS,KAAK;GAC3B,SAAS,OAAO,IAAI,WAAW,eAAe,CAAC;EACjD;EACA,KAAK,WAAW,MAAM;EACtB,KAAK,MAAM,MAAM,eAAe;EAChC,KAAK,OAAO,KAAA;EACZ,IAAI,KAAK,WACP,KAAK,MAAM,MAAM;CAErB;CAEA,MAAM,aAAa,QAAgB,QAAmC;EACpE,IAAI,CAAC,KAAK,OACR,MAAM,IAAI,WAAW,kBAAkB;EAEzC,IAAI,CAAC,KAAK,MACR,KAAK,mBAAmB;EAG1B,MAAM,KAAKC,aAAW,YAAY,EAAE,CAAC;EAErC,MAAM,YAAYC,UAAQ,mBAAmB;GADjB;GAAI;GAAQ;EACO,CAAC,GAAG,KAAK,gBAAgB;EAExE,MAAM,QAAQ,cACZ;GACE,MAAM,KAAK;GACX,MAAM,CAAC,IAAI,EAAE,KAAK,SAAS,MAAM,CAAC;GAClC,SAAS;GACT,YAAY,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;EAC1C,GACA,KAAK,aACP;EAEA,MAAM,gBAAgB,IAAI,SAAiB,SAAS,WAAW;GAC7D,MAAM,WAA2B;IAAE;IAAS;IAAQ;GAAO;GAC3D,SAAS,QAAQ,KAAK,cAAc,IAAI,UAAU,KAAK,UAAU;GACjE,KAAK,WAAW,IAAI,IAAI,QAAQ;EAClC,CAAC;EAED,IAAI;EACJ,IAAI;GACF,UAAU,MAAM,KAAK,MAAM,QAAQ,KAAK,SAAS,KAAK;EACxD,SAAS,OAAO;GACd,KAAK,aAAa,EAAE;GACpB,MAAM;EACR;EACA,IAAI,CAAC,QAAQ,MAAM,UAAU,MAAM,QAAQ,OAAO,IAAI,GAAG;GACvD,MAAM,WAAW,KAAK,aAAa,EAAE;GACrC,MAAM,SAAS,QACZ,KAAK,UAAU,MAAM,SAAS,MAAM,QAAQ,OAAO,CAAC,CACpD,QAAQ,YAA+B,QAAQ,OAAO,CAAC,CAAC,CACxD,KAAK,IAAI;GACZ,UAAU,OAAO,IAAI,WAAW,sCAAsC,QAAQ,CAAC;EACjF;EACA,OAAO;CACT;CAEA,aAAa,IAAwC;EACnD,MAAM,WAAW,KAAK,WAAW,IAAI,EAAE;EACvC,IAAI,CAAC,UACH;EAEF,aAAa,SAAS,KAAK;EAC3B,KAAK,WAAW,OAAO,EAAE;EACzB,OAAO;CACT;CAEA,cAAc,IAAY,UAA0B,IAA2C;EAC7F,OAAO,iBAAiB;GACtB,KAAK,aAAa,EAAE;GACpB,SAAS,OAAO,IAAI,WAAW,6BAA6B,SAAS,QAAQ,CAAC;EAChF,GAAG,EAAE;CACP;AACF"}
+{"version":3,"file":"signer-CYQutDzD.mjs","names":["nip04.encrypt","nip04.decrypt","nip44.getConversationKey","nip44.encrypt","nip44.decrypt","decrypt","bytesToHex","encrypt"],"sources":["../src/signer/keys.ts","../src/signer/nip07.ts","../src/signer/nip46.ts"],"sourcesContent":["import type { Event, UnsignedEvent } from \"../core/event.ts\";\nimport type { SecretKey } from \"../core/key.ts\";\nimport { Keys, signEvent } from \"../core/key.ts\";\nimport * as nip04 from \"../nips/nip04.ts\";\nimport * as nip44 from \"../nips/nip44.ts\";\nimport type { NostrSigner } from \"./types.ts\";\n\n/** Local secret-key signer with NIP-04 (legacy) and NIP-44 support. */\nexport class KeysSigner implements NostrSigner {\n  readonly #keys: Keys;\n  readonly #convKeys = new Map<string, Uint8Array>();\n\n  constructor(secretKey: SecretKey | Uint8Array | string | Keys) {\n    this.#keys = secretKey instanceof Keys ? secretKey : Keys.fromSecretKey(secretKey);\n  }\n\n  get keys(): Keys {\n    return this.#keys;\n  }\n\n  // oxlint-disable-next-line typescript/require-await -- NostrSigner is async; KeysSigner signs synchronously\n  async getPublicKey(): Promise<string> {\n    return this.#keys.publicKey;\n  }\n\n  // oxlint-disable-next-line typescript/require-await -- NostrSigner is async; KeysSigner signs synchronously\n  async signEvent(unsigned: UnsignedEvent): Promise<Event> {\n    return signEvent(unsigned, this.#keys);\n  }\n\n  // oxlint-disable-next-line typescript/require-await -- NostrSigner is async; KeysSigner signs synchronously\n  async nip04Encrypt(peer: string, plaintext: string): Promise<string> {\n    return nip04.encrypt(this.#keys.secretKey.bytes, peer, plaintext);\n  }\n\n  // oxlint-disable-next-line typescript/require-await -- NostrSigner is async; KeysSigner signs synchronously\n  async nip04Decrypt(peer: string, ciphertext: string): Promise<string> {\n    return nip04.decrypt(this.#keys.secretKey.bytes, peer, ciphertext);\n  }\n\n  #conversationKey(peer: string): Uint8Array {\n    const pk = peer.toLowerCase();\n    let key = this.#convKeys.get(pk);\n    if (!key) {\n      key = nip44.getConversationKey(this.#keys.secretKey.bytes, pk);\n      this.#convKeys.set(pk, key);\n    }\n    return key;\n  }\n\n  // oxlint-disable-next-line typescript/require-await -- NostrSigner is async; KeysSigner signs synchronously\n  async nip44Encrypt(peer: string, plaintext: string): Promise<string> {\n    return nip44.encrypt(plaintext, this.#conversationKey(peer));\n  }\n\n  // oxlint-disable-next-line typescript/require-await -- NostrSigner is async; KeysSigner signs synchronously\n  async nip44Decrypt(peer: string, payload: string): Promise<string> {\n    return nip44.decrypt(payload, this.#conversationKey(peer));\n  }\n}\n","import { CryptoError } from \"../core/error.ts\";\nimport type { Event, EventTemplate, UnsignedEvent } from \"../core/event.ts\";\nimport { signedMatchesUnsigned, validateSignedEvent } from \"../core/event.ts\";\nimport { assertHex32 } from \"../core/util.ts\";\nimport { verifyEvent } from \"../core/verifier.ts\";\nimport type { NostrSigner } from \"./types.ts\";\n\n/**\n * Minimal NIP-07 provider surface (browser extension `window.nostr`).\n *\n * @see https://github.com/nostr-protocol/nips/blob/master/07.md\n */\nexport type WindowNostr = {\n  getPublicKey: () => Promise<string>;\n  signEvent: (event: EventTemplate) => Promise<Event>;\n  nip04?: {\n    encrypt: (pubkey: string, plaintext: string) => Promise<string>;\n    decrypt: (pubkey: string, ciphertext: string) => Promise<string>;\n  };\n  nip44?: {\n    encrypt: (pubkey: string, plaintext: string) => Promise<string>;\n    decrypt: (pubkey: string, ciphertext: string) => Promise<string>;\n  };\n};\n\ntype GlobalWithNostr = typeof globalThis & {\n  nostr?: WindowNostr;\n  window?: { nostr?: WindowNostr };\n};\n\n/** Resolve `window.nostr` / `globalThis.nostr` when present. */\nexport function getWindowNostr(): WindowNostr | undefined {\n  const g = globalThis as GlobalWithNostr;\n  return g.nostr ?? g.window?.nostr;\n}\n\n/** True when a NIP-07 provider is injected in the current environment. */\nexport function isNip07Available(): boolean {\n  const n = getWindowNostr();\n  return Boolean(n && typeof n.getPublicKey === \"function\" && typeof n.signEvent === \"function\");\n}\n\n/**\n * Signer backed by a NIP-07 browser extension (or any injected provider). Never holds secret keys\n * in-process.\n */\nexport class Nip07Signer implements NostrSigner {\n  readonly #provider: WindowNostr | undefined;\n\n  constructor(provider?: WindowNostr) {\n    this.#provider = provider;\n  }\n\n  #resolve(): WindowNostr {\n    const provider = this.#provider ?? getWindowNostr();\n    if (!provider) {\n      throw new CryptoError(\"NIP-07 provider not available (window.nostr missing)\");\n    }\n    return provider;\n  }\n\n  async getPublicKey(): Promise<string> {\n    const pk = await this.#resolve().getPublicKey();\n    try {\n      return assertHex32(pk, \"pubkey\");\n    } catch (error) {\n      throw new CryptoError(\"NIP-07 getPublicKey returned an invalid pubkey\", {\n        cause: error instanceof Error ? error : undefined,\n      });\n    }\n  }\n\n  async signEvent(unsigned: UnsignedEvent): Promise<Event> {\n    const provider = this.#resolve();\n    const template: EventTemplate = {\n      kind: unsigned.kind,\n      tags: unsigned.tags.map((t) => {\n        const [name, ...rest] = t;\n        if (name === undefined) {\n          throw new CryptoError(\"unsigned event has an empty tag\");\n        }\n        return [name, ...rest];\n      }),\n      content: unsigned.content,\n      created_at: unsigned.created_at,\n    };\n\n    const signed = await provider.signEvent(template);\n    if (!validateSignedEvent(signed)) {\n      throw new CryptoError(\"NIP-07 signEvent returned an invalid event\");\n    }\n    if (!verifyEvent(signed)) {\n      throw new CryptoError(\"NIP-07 signed event failed signature verification\");\n    }\n    if (!signedMatchesUnsigned(signed, unsigned)) {\n      throw new CryptoError(\"NIP-07 signed event does not match unsigned template\");\n    }\n    return signed;\n  }\n\n  async nip04Encrypt(peer: string, plaintext: string): Promise<string> {\n    const { nip04 } = this.#resolve();\n    if (!nip04?.encrypt) {\n      throw new CryptoError(\"NIP-07 provider does not support nip04.encrypt\");\n    }\n    return nip04.encrypt(peer, plaintext);\n  }\n\n  async nip04Decrypt(peer: string, ciphertext: string): Promise<string> {\n    const { nip04 } = this.#resolve();\n    if (!nip04?.decrypt) {\n      throw new CryptoError(\"NIP-07 provider does not support nip04.decrypt\");\n    }\n    return nip04.decrypt(peer, ciphertext);\n  }\n\n  async nip44Encrypt(peer: string, plaintext: string): Promise<string> {\n    const { nip44 } = this.#resolve();\n    if (!nip44?.encrypt) {\n      throw new CryptoError(\"NIP-07 provider does not support nip44.encrypt\");\n    }\n    return nip44.encrypt(peer, plaintext);\n  }\n\n  async nip44Decrypt(peer: string, payload: string): Promise<string> {\n    const { nip44 } = this.#resolve();\n    if (!nip44?.decrypt) {\n      throw new CryptoError(\"NIP-07 provider does not support nip44.decrypt\");\n    }\n    return nip44.decrypt(peer, payload);\n  }\n}\n","import { randomBytes } from \"@noble/hashes/utils.js\";\n\nimport type { Event, EventTemplate, UnsignedEvent } from \"../core/event.ts\";\nimport { signedMatchesUnsigned, validateSignedEvent } from \"../core/event.ts\";\nimport type { Filter } from \"../core/filter.ts\";\nimport { SecretKey, finalizeEvent, getPublicKey } from \"../core/key.ts\";\nimport { Kind } from \"../core/kind.ts\";\nimport { invokeSafely } from \"../core/report.ts\";\nimport { Tag } from \"../core/tag.ts\";\nimport { bytesToHex, isHex32 } from \"../core/util.ts\";\nimport { verifyEvent } from \"../core/verifier.ts\";\nimport { decrypt, encrypt, getConversationKey } from \"../nips/nip44.ts\";\nimport {\n  Nip46Error,\n  decodeNip46Response,\n  encodeNip46Request,\n  parseBunkerURL,\n  parseNostrConnectURI,\n} from \"../nips/nip46.ts\";\nimport type { BunkerPointer, ClientMetadata, Nip46Request } from \"../nips/nip46.ts\";\nimport type { NostrSigner } from \"./types.ts\";\n\n/** Subscribe options used by NIP-46 transport (structural subset of Pool). */\nexport type Nip46SubscribeOptions = {\n  signal?: AbortSignal | undefined;\n  onevent?: ((event: Event) => void) | undefined;\n  onclose?: ((reason: string) => void) | undefined;\n};\n\n/**\n * Structural relay transport for NIP-46 RPC. Satisfied by {@link import(\"../relay/pool.ts\").Pool};\n * constructed above the signer layer so `signer` never imports `relay` (ADR-0001).\n */\nexport type Nip46Transport = {\n  subscribe: (\n    relays: string[],\n    filters: Filter[],\n    opts?: Nip46SubscribeOptions,\n  ) => { close: (reason?: string) => void };\n  publish: (\n    relays: string[],\n    event: Event,\n  ) => Promise<ReadonlyArray<{ result?: { ok: boolean; message: string }; error?: string }>>;\n  close: (urls?: string[]) => void;\n};\n\n/** Options for {@link Nip46Signer}: transport, timeouts, and relay hints. */\nexport type Nip46SignerOptions = {\n  /** Shared transport. When set, the signer does not close it on {@link Nip46Signer.close}. */\n  pool?: Nip46Transport;\n  /**\n   * Factory for a private transport when `pool` is omitted. Typical: `() => new Pool({\n   * websocketImplementation, enableReconnect: true })`.\n   */\n  createPool?: () => Nip46Transport;\n  /**\n   * Relays used when the bunker pointer has none, and merged uniquely onto a nonempty pointer\n   * (pointer first).\n   */\n  relays?: string[];\n  /** Bunker connection secret when the pointer or bunker:// URL has none. */\n  secret?: string | undefined;\n  /** Local client key used to encrypt RPC (not the remote user key). */\n  clientSecretKey?: SecretKey | Uint8Array | string;\n  /** Called when bunker returns `auth_url` for a pending request. */\n  onAuthUrl?: (url: string) => void;\n  /** Per-request timeout in ms. Default 30s. */\n  timeoutMs?: number;\n  /**\n   * Timeout in ms applied after the bunker replies `auth_url`: the request keeps waiting for the\n   * real response until this elapses. Default 300s.\n   */\n  authTimeoutMs?: number;\n  /** Requested permissions sent with `connect` (`method[:kind]` list). */\n  perms?: string[];\n  /** Client metadata sent with bunker-initiated `connect`. */\n  metadata?: ClientMetadata;\n};\n\nfunction resolveClientSecret(key?: SecretKey | Uint8Array | string): SecretKey {\n  if (key === undefined) {\n    return SecretKey.generate();\n  }\n  if (key instanceof SecretKey) {\n    return key;\n  }\n  if (typeof key === \"string\") {\n    return SecretKey.fromHex(key);\n  }\n  return SecretKey.fromBytes(key);\n}\n\nfunction resolveTransport(opts: Nip46SignerOptions): { pool: Nip46Transport; ownsPool: boolean } {\n  if (opts.pool) {\n    return { pool: opts.pool, ownsPool: false };\n  }\n  if (opts.createPool) {\n    return { pool: opts.createPool(), ownsPool: true };\n  }\n  throw new Nip46Error(\n    \"Nip46Signer requires pool or createPool (inject Pool from @qntx/nostr/relay)\",\n  );\n}\n\nfunction applyPointerOpts(pointer: BunkerPointer, opts: Nip46SignerOptions): BunkerPointer {\n  let next: BunkerPointer = {\n    pubkey: pointer.pubkey.toLowerCase(),\n    relays: [...pointer.relays],\n    secret: pointer.secret,\n  };\n  if (opts.secret !== undefined && next.secret === undefined) {\n    next = { ...next, secret: opts.secret };\n  }\n\n  const relays = next.relays.length > 0 ? next.relays : [...(opts.relays ?? [])];\n  if (relays.length === 0) {\n    throw new Nip46Error(\"no relays for bunker connection\");\n  }\n  if (next.relays.length > 0 && opts.relays !== undefined && opts.relays.length > 0) {\n    const merged = [...next.relays];\n    for (const r of opts.relays) {\n      if (!merged.includes(r)) {\n        merged.push(r);\n      }\n    }\n    return { ...next, relays: merged };\n  }\n  return { ...next, relays };\n}\n\nfunction resolveBunkerPointer(input: string | BunkerPointer): BunkerPointer {\n  if (typeof input !== \"string\") {\n    return {\n      pubkey: input.pubkey.toLowerCase(),\n      relays: [...input.relays],\n      secret: input.secret,\n    };\n  }\n\n  const bunker = parseBunkerURL(input);\n  if (bunker) {\n    return bunker;\n  }\n\n  throw new Nip46Error(\"invalid bunker input (expected bunker:// URL or BunkerPointer)\");\n}\n\ntype PendingRequest = {\n  resolve: (v: string) => void;\n  reject: (e: Error) => void;\n  method: string;\n  timer?: ReturnType<typeof setTimeout>;\n};\n\n/**\n * NIP-46 remote signer (bunker / nostrconnect). Implements {@link NostrSigner}; never holds the\n * remote user's secret key. Network I/O is injected via {@link Nip46Transport} (no relay import).\n */\nexport class Nip46Signer implements NostrSigner {\n  readonly #pool: Nip46Transport;\n  readonly #ownsPool: boolean;\n  readonly #clientSecret: SecretKey;\n  readonly #clientPubkey: string;\n  readonly #pointer: BunkerPointer;\n  readonly #conversationKey: Uint8Array;\n  readonly #onAuthUrl: ((url: string) => void) | undefined;\n  readonly #timeoutMs: number;\n  readonly #authTimeoutMs: number;\n  readonly #perms: string[] | undefined;\n  readonly #metadata: ClientMetadata | undefined;\n  #relays: string[];\n  readonly #listeners = new Map<string, PendingRequest>();\n  #sub: { close: (reason?: string) => void } | undefined;\n  #open = false;\n  #cachedRemotePubkey: string | undefined;\n\n  private constructor(\n    clientSecret: SecretKey,\n    pointer: BunkerPointer,\n    pool: Nip46Transport,\n    ownsPool: boolean,\n    opts: Nip46SignerOptions,\n  ) {\n    if (pointer.relays.length === 0) {\n      throw new Nip46Error(\"bunker pointer has no relays\");\n    }\n    this.#clientSecret = clientSecret;\n    this.#clientPubkey = getPublicKey(clientSecret);\n    this.#pointer = {\n      pubkey: pointer.pubkey.toLowerCase(),\n      relays: [...pointer.relays],\n      secret: pointer.secret,\n    };\n    this.#relays = [...pointer.relays];\n    this.#pool = pool;\n    this.#ownsPool = ownsPool;\n    this.#conversationKey = getConversationKey(clientSecret.bytes, this.#pointer.pubkey);\n    this.#onAuthUrl = opts.onAuthUrl;\n    this.#timeoutMs = opts.timeoutMs ?? 30_000;\n    this.#authTimeoutMs = opts.authTimeoutMs ?? 300_000;\n    this.#perms = opts.perms;\n    this.#metadata = opts.metadata;\n  }\n\n  get bunker(): Readonly<BunkerPointer> {\n    return {\n      pubkey: this.#pointer.pubkey,\n      relays: [...this.#relays],\n      secret: this.#pointer.secret,\n    };\n  }\n\n  get clientPublicKey(): string {\n    return this.#clientPubkey;\n  }\n\n  /**\n   * Subscribe to an already-known bunker pointer. Does not send the `connect` RPC (reconnect\n   * without a new handshake). Requires `clientSecretKey` — reconnect must reuse the original client\n   * identity.\n   */\n  static fromBunker(\n    pointer: BunkerPointer,\n    opts: Nip46SignerOptions & { clientSecretKey: SecretKey | Uint8Array | string },\n  ): Nip46Signer {\n    if (opts.clientSecretKey === undefined) {\n      throw new Nip46Error(\"fromBunker requires clientSecretKey\");\n    }\n    const resolved = applyPointerOpts(pointer, opts);\n    const sk = resolveClientSecret(opts.clientSecretKey);\n    const { pool, ownsPool } = resolveTransport(opts);\n    const signer = new Nip46Signer(sk, resolved, pool, ownsPool, opts);\n    signer.#startSubscription();\n    return signer;\n  }\n\n  /**\n   * Connect using a `bunker://` URL or pre-parsed pointer. Invalid strings throw. A NIP-05\n   * identifier is not a bunker pointer. When both pointer and `opts.relays` are nonempty, unique\n   * `opts.relays` are appended.\n   */\n  static async connect(\n    input: string | BunkerPointer,\n    opts: Nip46SignerOptions = {},\n  ): Promise<Nip46Signer> {\n    const pointer = resolveBunkerPointer(input);\n    const signer = Nip46Signer.fromBunker(pointer, {\n      ...opts,\n      clientSecretKey: resolveClientSecret(opts.clientSecretKey),\n    });\n    try {\n      await signer.connectRemote();\n      try {\n        await signer.switchRelays();\n      } catch {\n        // Bunker may not implement switch_relays.\n      }\n      await signer.getPublicKey();\n      return signer;\n    } catch (error) {\n      await signer.close();\n      throw error;\n    }\n  }\n\n  /**\n   * Wait for a bunker to complete a client-initiated `nostrconnect://` handshake. Requires\n   * `clientSecretKey` whose pubkey matches the URI client pubkey (build the URI with\n   * {@link createNostrConnectURI} after generating keys).\n   */\n  static async fromNostrConnectURI(\n    connectionURI: string,\n    opts: Nip46SignerOptions & {\n      clientSecretKey: SecretKey | Uint8Array | string;\n      signal?: AbortSignal;\n      handshakeTimeoutMs?: number;\n    },\n  ): Promise<Nip46Signer> {\n    const params = parseNostrConnectURI(connectionURI);\n    const sk = resolveClientSecret(opts.clientSecretKey);\n    const clientPubkey = getPublicKey(sk);\n\n    if (clientPubkey !== params.clientPubkey) {\n      throw new Nip46Error(\"client secret key does not match nostrconnect client pubkey\");\n    }\n\n    const { pool, ownsPool } = resolveTransport(opts);\n    const handshakeTimeoutMs = opts.handshakeTimeoutMs ?? 300_000;\n\n    return new Promise((resolve, reject) => {\n      let settled = false;\n      const finish = (err?: Error, signer?: Nip46Signer) => {\n        if (settled) {\n          return;\n        }\n        settled = true;\n        clearTimeout(timer);\n        sub.close(err ? \"failed\" : \"connected\");\n        if (err) {\n          if (ownsPool) {\n            pool.close();\n          }\n          reject(err);\n        } else if (signer) {\n          resolve(signer);\n        }\n      };\n\n      const timer = setTimeout(() => {\n        finish(new Nip46Error(\"nostrconnect handshake timed out\"));\n      }, handshakeTimeoutMs);\n\n      const sub = pool.subscribe(\n        params.relays,\n        [{ kinds: [Kind.NostrConnect], \"#p\": [clientPubkey], limit: 0 }],\n        {\n          signal: opts.signal,\n          onevent: (event) => {\n            try {\n              const convKey = getConversationKey(sk.bytes, event.pubkey);\n              const payload = decrypt(event.content, convKey);\n              const response = decodeNip46Response(payload);\n              if (response.result !== params.secret) {\n                return;\n              }\n\n              const pointer: BunkerPointer = {\n                pubkey: event.pubkey.toLowerCase(),\n                relays: params.relays,\n                secret: params.secret,\n              };\n              const signer = new Nip46Signer(sk, pointer, pool, ownsPool, opts);\n              signer.#startSubscription();\n              void (async () => {\n                try {\n                  await signer.switchRelays();\n                } catch {\n                  // Relay switch at connect time is best-effort.\n                }\n                try {\n                  await signer.getPublicKey();\n                  finish(undefined, signer);\n                } catch (error: unknown) {\n                  finish(error instanceof Error ? error : new Nip46Error(String(error)));\n                }\n              })();\n            } catch {\n              // ignore non-matching events\n            }\n          },\n          onclose: (reason) => {\n            if (reason !== \"connected\" && reason !== \"failed\") {\n              finish(new Nip46Error(`nostrconnect subscription closed: ${reason}`));\n            }\n          },\n        },\n      );\n    });\n  }\n\n  #startSubscription(): void {\n    this.#sub?.close();\n    this.#sub = this.#pool.subscribe(\n      this.#relays,\n      [\n        {\n          kinds: [Kind.NostrConnect],\n          authors: [this.#pointer.pubkey],\n          \"#p\": [this.#clientPubkey],\n          limit: 0,\n        },\n      ],\n      {\n        onevent: (event) => {\n          try {\n            const payload = decrypt(event.content, this.#conversationKey);\n            const { id, result, error } = decodeNip46Response(payload);\n\n            if (result === \"auth_url\" && this.#listeners.has(id)) {\n              const listener = this.#listeners.get(id);\n              if (!listener) {\n                return;\n              }\n              if (error !== undefined && error !== \"\") {\n                invokeSafely(() => this.#onAuthUrl?.(error));\n              }\n              clearTimeout(listener.timer);\n              listener.timer = this.#requestTimer(id, listener, this.#authTimeoutMs);\n              return;\n            }\n\n            const listener = this.#dropRequest(id);\n            if (!listener) {\n              return;\n            }\n            if (error !== undefined && error !== \"\") {\n              listener.reject(new Nip46Error(error));\n            } else if (result === undefined) {\n              listener.reject(new Nip46Error(\"empty NIP-46 response\"));\n            } else {\n              listener.resolve(result);\n            }\n          } catch {\n            // ignore decrypt failures from unrelated events\n          }\n        },\n        onclose: () => {\n          this.#sub = undefined;\n        },\n      },\n    );\n    this.#open = true;\n  }\n\n  async connectRemote(overrides?: { metadata?: ClientMetadata; perms?: string[] }): Promise<void> {\n    const metadata = overrides?.metadata ?? this.#metadata;\n    const perms = overrides?.perms ?? this.#perms;\n    const params = [this.#pointer.pubkey, this.#pointer.secret ?? \"\"];\n    const hasPerms = perms !== undefined && perms.length > 0;\n    if (hasPerms || metadata !== undefined) {\n      params.push(hasPerms ? perms.join(\",\") : \"\");\n    }\n    if (metadata !== undefined) {\n      params.push(JSON.stringify(metadata));\n    }\n    const result = await this.#sendRequest(\"connect\", params);\n    if (result === \"ack\") {\n      return;\n    }\n    const { secret } = this.#pointer;\n    if (secret !== undefined && secret !== \"\" && result === secret) {\n      return;\n    }\n    throw new Nip46Error(`connect result is not ack or secret: ${result}`);\n  }\n\n  /**\n   * Ask the bunker for its preferred relay list and resubscribe when it changes. Spec result is a\n   * JSON array of URLs, or `null` when nothing changes.\n   */\n  async switchRelays(): Promise<string[] | undefined> {\n    const resp = await this.#sendRequest(\"switch_relays\", []);\n    if (resp === \"null\") {\n      return undefined;\n    }\n    let parsed: unknown;\n    try {\n      parsed = JSON.parse(resp);\n    } catch (error) {\n      throw new Nip46Error(\"invalid switch_relays JSON\", {\n        cause: error instanceof Error ? error : undefined,\n      });\n    }\n    if (\n      !Array.isArray(parsed) ||\n      parsed.length === 0 ||\n      !parsed.every((x) => typeof x === \"string\")\n    ) {\n      throw new Nip46Error(\"invalid switch_relays result\");\n    }\n    this.#relays = parsed;\n    this.#startSubscription();\n    return parsed;\n  }\n\n  /** Courtesy session teardown. Always closes the local signer afterwards. */\n  async logout(): Promise<void> {\n    try {\n      const resp = await this.#sendRequest(\"logout\", []);\n      if (resp !== \"ack\") {\n        throw new Nip46Error(`logout result is not ack: ${resp}`);\n      }\n    } finally {\n      await this.close();\n    }\n  }\n\n  async ping(): Promise<void> {\n    const resp = await this.#sendRequest(\"ping\", []);\n    if (resp !== \"pong\") {\n      throw new Nip46Error(`ping result is not pong: ${resp}`);\n    }\n  }\n\n  async getPublicKey(): Promise<string> {\n    if (this.#cachedRemotePubkey === undefined) {\n      const pk = await this.#sendRequest(\"get_public_key\", []);\n      if (!isHex32(pk.toLowerCase())) {\n        throw new Nip46Error(\"bunker returned invalid pubkey\");\n      }\n      this.#cachedRemotePubkey = pk.toLowerCase();\n    }\n    return this.#cachedRemotePubkey;\n  }\n\n  async signEvent(unsigned: UnsignedEvent): Promise<Event> {\n    const template: EventTemplate = {\n      kind: unsigned.kind,\n      tags: unsigned.tags,\n      content: unsigned.content,\n      created_at: unsigned.created_at,\n    };\n    const resp = await this.#sendRequest(\"sign_event\", [JSON.stringify(template)]);\n    let signed: unknown;\n    try {\n      signed = JSON.parse(resp);\n    } catch (error) {\n      throw new Nip46Error(\"bunker returned invalid sign_event JSON\", {\n        cause: error instanceof Error ? error : undefined,\n      });\n    }\n    if (!validateSignedEvent(signed) || !verifyEvent(signed)) {\n      throw new Nip46Error(\"bunker returned improperly signed event\");\n    }\n    if (!signedMatchesUnsigned(signed, unsigned)) {\n      throw new Nip46Error(\"signed event does not match unsigned template\");\n    }\n    return signed;\n  }\n\n  async nip04Encrypt(peer: string, plaintext: string): Promise<string> {\n    return this.#sendRequest(\"nip04_encrypt\", [peer, plaintext]);\n  }\n\n  async nip04Decrypt(peer: string, ciphertext: string): Promise<string> {\n    return this.#sendRequest(\"nip04_decrypt\", [peer, ciphertext]);\n  }\n\n  async nip44Encrypt(peer: string, plaintext: string): Promise<string> {\n    return this.#sendRequest(\"nip44_encrypt\", [peer, plaintext]);\n  }\n\n  async nip44Decrypt(peer: string, payload: string): Promise<string> {\n    return this.#sendRequest(\"nip44_decrypt\", [peer, payload]);\n  }\n\n  // oxlint-disable-next-line typescript/require-await -- NostrSigner is async; teardown is synchronous\n  async close(): Promise<void> {\n    this.#open = false;\n    for (const [, listener] of this.#listeners) {\n      clearTimeout(listener.timer);\n      listener.reject(new Nip46Error(\"signer closed\"));\n    }\n    this.#listeners.clear();\n    this.#sub?.close(\"signer closed\");\n    this.#sub = undefined;\n    if (this.#ownsPool) {\n      this.#pool.close();\n    }\n  }\n\n  async #sendRequest(method: string, params: string[]): Promise<string> {\n    if (!this.#open) {\n      throw new Nip46Error(\"signer is closed\");\n    }\n    if (!this.#sub) {\n      this.#startSubscription();\n    }\n\n    const id = bytesToHex(randomBytes(16));\n    const req: Nip46Request = { id, method, params };\n    const encrypted = encrypt(encodeNip46Request(req), this.#conversationKey);\n\n    const event = finalizeEvent(\n      {\n        kind: Kind.NostrConnect,\n        tags: [Tag.p(this.#pointer.pubkey)],\n        content: encrypted,\n        created_at: Math.floor(Date.now() / 1000),\n      },\n      this.#clientSecret,\n    );\n\n    const resultPromise = new Promise<string>((resolve, reject) => {\n      const listener: PendingRequest = { resolve, reject, method };\n      listener.timer = this.#requestTimer(id, listener, this.#timeoutMs);\n      this.#listeners.set(id, listener);\n    });\n\n    let replies;\n    try {\n      replies = await this.#pool.publish(this.#relays, event);\n    } catch (error) {\n      this.#dropRequest(id);\n      throw error;\n    }\n    if (!replies.some((reply) => reply.result?.ok === true)) {\n      const listener = this.#dropRequest(id);\n      const detail = replies\n        .map((reply) => reply.error ?? reply.result?.message)\n        .filter((message): message is string => Boolean(message))\n        .join(\"; \");\n      listener?.reject(new Nip46Error(`request not accepted by any relay: ${detail}`));\n    }\n    return resultPromise;\n  }\n\n  #dropRequest(id: string): PendingRequest | undefined {\n    const listener = this.#listeners.get(id);\n    if (!listener) {\n      return undefined;\n    }\n    clearTimeout(listener.timer);\n    this.#listeners.delete(id);\n    return listener;\n  }\n\n  #requestTimer(id: string, listener: PendingRequest, ms: number): ReturnType<typeof setTimeout> {\n    return setTimeout(() => {\n      this.#dropRequest(id);\n      listener.reject(new Nip46Error(`NIP-46 request timed out: ${listener.method}`));\n    }, ms);\n  }\n}\n"],"mappings":";;;;;;;;;;;;AAQA,IAAa,aAAb,MAA+C;CAC7C;CACA,4BAAqB,IAAI,IAAwB;CAEjD,YAAY,WAAmD;EAC7D,KAAK,QAAQ,qBAAqB,OAAO,YAAY,KAAK,cAAc,SAAS;CACnF;CAEA,IAAI,OAAa;EACf,OAAO,KAAK;CACd;CAGA,MAAM,eAAgC;EACpC,OAAO,KAAK,MAAM;CACpB;CAGA,MAAM,UAAU,UAAyC;EACvD,OAAO,UAAU,UAAU,KAAK,KAAK;CACvC;CAGA,MAAM,aAAa,MAAc,WAAoC;EACnE,OAAOA,QAAc,KAAK,MAAM,UAAU,OAAO,MAAM,SAAS;CAClE;CAGA,MAAM,aAAa,MAAc,YAAqC;EACpE,OAAOC,QAAc,KAAK,MAAM,UAAU,OAAO,MAAM,UAAU;CACnE;CAEA,iBAAiB,MAA0B;EACzC,MAAM,KAAK,KAAK,YAAY;EAC5B,IAAI,MAAM,KAAK,UAAU,IAAI,EAAE;EAC/B,IAAI,CAAC,KAAK;GACR,MAAMC,mBAAyB,KAAK,MAAM,UAAU,OAAO,EAAE;GAC7D,KAAK,UAAU,IAAI,IAAI,GAAG;EAC5B;EACA,OAAO;CACT;CAGA,MAAM,aAAa,MAAc,WAAoC;EACnE,OAAOC,UAAc,WAAW,KAAK,iBAAiB,IAAI,CAAC;CAC7D;CAGA,MAAM,aAAa,MAAc,SAAkC;EACjE,OAAOC,UAAc,SAAS,KAAK,iBAAiB,IAAI,CAAC;CAC3D;AACF;;;;AC5BA,SAAgB,iBAA0C;CACxD,MAAM,IAAI;CACV,OAAO,EAAE,SAAS,EAAE,QAAQ;AAC9B;;AAGA,SAAgB,mBAA4B;CAC1C,MAAM,IAAI,eAAe;CACzB,OAAO,QAAQ,KAAK,OAAO,EAAE,iBAAiB,cAAc,OAAO,EAAE,cAAc,UAAU;AAC/F;;;;;AAMA,IAAa,cAAb,MAAgD;CAC9C;CAEA,YAAY,UAAwB;EAClC,KAAK,YAAY;CACnB;CAEA,WAAwB;EACtB,MAAM,WAAW,KAAK,aAAa,eAAe;EAClD,IAAI,CAAC,UACH,MAAM,IAAI,YAAY,sDAAsD;EAE9E,OAAO;CACT;CAEA,MAAM,eAAgC;EACpC,MAAM,KAAK,MAAM,KAAK,SAAS,CAAC,CAAC,aAAa;EAC9C,IAAI;GACF,OAAO,YAAY,IAAI,QAAQ;EACjC,SAAS,OAAO;GACd,MAAM,IAAI,YAAY,kDAAkD,EACtE,OAAO,iBAAiB,QAAQ,QAAQ,KAAA,EAC1C,CAAC;EACH;CACF;CAEA,MAAM,UAAU,UAAyC;EACvD,MAAM,WAAW,KAAK,SAAS;EAC/B,MAAM,WAA0B;GAC9B,MAAM,SAAS;GACf,MAAM,SAAS,KAAK,KAAK,MAAM;IAC7B,MAAM,CAAC,MAAM,GAAG,QAAQ;IACxB,IAAI,SAAS,KAAA,GACX,MAAM,IAAI,YAAY,iCAAiC;IAEzD,OAAO,CAAC,MAAM,GAAG,IAAI;GACvB,CAAC;GACD,SAAS,SAAS;GAClB,YAAY,SAAS;EACvB;EAEA,MAAM,SAAS,MAAM,SAAS,UAAU,QAAQ;EAChD,IAAI,CAAC,oBAAoB,MAAM,GAC7B,MAAM,IAAI,YAAY,4CAA4C;EAEpE,IAAI,CAAC,YAAY,MAAM,GACrB,MAAM,IAAI,YAAY,mDAAmD;EAE3E,IAAI,CAAC,sBAAsB,QAAQ,QAAQ,GACzC,MAAM,IAAI,YAAY,sDAAsD;EAE9E,OAAO;CACT;CAEA,MAAM,aAAa,MAAc,WAAoC;EACnE,MAAM,EAAE,UAAU,KAAK,SAAS;EAChC,IAAI,CAAC,OAAO,SACV,MAAM,IAAI,YAAY,gDAAgD;EAExE,OAAO,MAAM,QAAQ,MAAM,SAAS;CACtC;CAEA,MAAM,aAAa,MAAc,YAAqC;EACpE,MAAM,EAAE,UAAU,KAAK,SAAS;EAChC,IAAI,CAAC,OAAO,SACV,MAAM,IAAI,YAAY,gDAAgD;EAExE,OAAO,MAAM,QAAQ,MAAM,UAAU;CACvC;CAEA,MAAM,aAAa,MAAc,WAAoC;EACnE,MAAM,EAAE,UAAU,KAAK,SAAS;EAChC,IAAI,CAAC,OAAO,SACV,MAAM,IAAI,YAAY,gDAAgD;EAExE,OAAO,MAAM,QAAQ,MAAM,SAAS;CACtC;CAEA,MAAM,aAAa,MAAc,SAAkC;EACjE,MAAM,EAAE,UAAU,KAAK,SAAS;EAChC,IAAI,CAAC,OAAO,SACV,MAAM,IAAI,YAAY,gDAAgD;EAExE,OAAO,MAAM,QAAQ,MAAM,OAAO;CACpC;AACF;;;ACpDA,SAAS,oBAAoB,KAAkD;CAC7E,IAAI,QAAQ,KAAA,GACV,OAAO,UAAU,SAAS;CAE5B,IAAI,eAAe,WACjB,OAAO;CAET,IAAI,OAAO,QAAQ,UACjB,OAAO,UAAU,QAAQ,GAAG;CAE9B,OAAO,UAAU,UAAU,GAAG;AAChC;AAEA,SAAS,iBAAiB,MAAuE;CAC/F,IAAI,KAAK,MACP,OAAO;EAAE,MAAM,KAAK;EAAM,UAAU;CAAM;CAE5C,IAAI,KAAK,YACP,OAAO;EAAE,MAAM,KAAK,WAAW;EAAG,UAAU;CAAK;CAEnD,MAAM,IAAI,WACR,8EACF;AACF;AAEA,SAAS,iBAAiB,SAAwB,MAAyC;CACzF,IAAI,OAAsB;EACxB,QAAQ,QAAQ,OAAO,YAAY;EACnC,QAAQ,CAAC,GAAG,QAAQ,MAAM;EAC1B,QAAQ,QAAQ;CAClB;CACA,IAAI,KAAK,WAAW,KAAA,KAAa,KAAK,WAAW,KAAA,GAC/C,OAAO;EAAE,GAAG;EAAM,QAAQ,KAAK;CAAO;CAGxC,MAAM,SAAS,KAAK,OAAO,SAAS,IAAI,KAAK,SAAS,CAAC,GAAI,KAAK,UAAU,CAAC,CAAE;CAC7E,IAAI,OAAO,WAAW,GACpB,MAAM,IAAI,WAAW,iCAAiC;CAExD,IAAI,KAAK,OAAO,SAAS,KAAK,KAAK,WAAW,KAAA,KAAa,KAAK,OAAO,SAAS,GAAG;EACjF,MAAM,SAAS,CAAC,GAAG,KAAK,MAAM;EAC9B,KAAK,MAAM,KAAK,KAAK,QACnB,IAAI,CAAC,OAAO,SAAS,CAAC,GACpB,OAAO,KAAK,CAAC;EAGjB,OAAO;GAAE,GAAG;GAAM,QAAQ;EAAO;CACnC;CACA,OAAO;EAAE,GAAG;EAAM;CAAO;AAC3B;AAEA,SAAS,qBAAqB,OAA8C;CAC1E,IAAI,OAAO,UAAU,UACnB,OAAO;EACL,QAAQ,MAAM,OAAO,YAAY;EACjC,QAAQ,CAAC,GAAG,MAAM,MAAM;EACxB,QAAQ,MAAM;CAChB;CAGF,MAAM,SAAS,eAAe,KAAK;CACnC,IAAI,QACF,OAAO;CAGT,MAAM,IAAI,WAAW,gEAAgE;AACvF;;;;;AAaA,IAAa,cAAb,MAAa,YAAmC;CAC9C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA,6BAAsB,IAAI,IAA4B;CACtD;CACA,QAAQ;CACR;CAEA,YACE,cACA,SACA,MACA,UACA,MACA;EACA,IAAI,QAAQ,OAAO,WAAW,GAC5B,MAAM,IAAI,WAAW,8BAA8B;EAErD,KAAK,gBAAgB;EACrB,KAAK,gBAAgB,aAAa,YAAY;EAC9C,KAAK,WAAW;GACd,QAAQ,QAAQ,OAAO,YAAY;GACnC,QAAQ,CAAC,GAAG,QAAQ,MAAM;GAC1B,QAAQ,QAAQ;EAClB;EACA,KAAK,UAAU,CAAC,GAAG,QAAQ,MAAM;EACjC,KAAK,QAAQ;EACb,KAAK,YAAY;EACjB,KAAK,mBAAmB,mBAAmB,aAAa,OAAO,KAAK,SAAS,MAAM;EACnF,KAAK,aAAa,KAAK;EACvB,KAAK,aAAa,KAAK,aAAa;EACpC,KAAK,iBAAiB,KAAK,iBAAiB;EAC5C,KAAK,SAAS,KAAK;EACnB,KAAK,YAAY,KAAK;CACxB;CAEA,IAAI,SAAkC;EACpC,OAAO;GACL,QAAQ,KAAK,SAAS;GACtB,QAAQ,CAAC,GAAG,KAAK,OAAO;GACxB,QAAQ,KAAK,SAAS;EACxB;CACF;CAEA,IAAI,kBAA0B;EAC5B,OAAO,KAAK;CACd;;;;;;CAOA,OAAO,WACL,SACA,MACa;EACb,IAAI,KAAK,oBAAoB,KAAA,GAC3B,MAAM,IAAI,WAAW,qCAAqC;EAE5D,MAAM,WAAW,iBAAiB,SAAS,IAAI;EAC/C,MAAM,KAAK,oBAAoB,KAAK,eAAe;EACnD,MAAM,EAAE,MAAM,aAAa,iBAAiB,IAAI;EAChD,MAAM,SAAS,IAAI,YAAY,IAAI,UAAU,MAAM,UAAU,IAAI;EACjE,OAAO,mBAAmB;EAC1B,OAAO;CACT;;;;;;CAOA,aAAa,QACX,OACA,OAA2B,CAAC,GACN;EACtB,MAAM,UAAU,qBAAqB,KAAK;EAC1C,MAAM,SAAS,YAAY,WAAW,SAAS;GAC7C,GAAG;GACH,iBAAiB,oBAAoB,KAAK,eAAe;EAC3D,CAAC;EACD,IAAI;GACF,MAAM,OAAO,cAAc;GAC3B,IAAI;IACF,MAAM,OAAO,aAAa;GAC5B,QAAQ,CAER;GACA,MAAM,OAAO,aAAa;GAC1B,OAAO;EACT,SAAS,OAAO;GACd,MAAM,OAAO,MAAM;GACnB,MAAM;EACR;CACF;;;;;;CAOA,aAAa,oBACX,eACA,MAKsB;EACtB,MAAM,SAAS,qBAAqB,aAAa;EACjD,MAAM,KAAK,oBAAoB,KAAK,eAAe;EACnD,MAAM,eAAe,aAAa,EAAE;EAEpC,IAAI,iBAAiB,OAAO,cAC1B,MAAM,IAAI,WAAW,6DAA6D;EAGpF,MAAM,EAAE,MAAM,aAAa,iBAAiB,IAAI;EAChD,MAAM,qBAAqB,KAAK,sBAAsB;EAEtD,OAAO,IAAI,SAAS,SAAS,WAAW;GACtC,IAAI,UAAU;GACd,MAAM,UAAU,KAAa,WAAyB;IACpD,IAAI,SACF;IAEF,UAAU;IACV,aAAa,KAAK;IAClB,IAAI,MAAM,MAAM,WAAW,WAAW;IACtC,IAAI,KAAK;KACP,IAAI,UACF,KAAK,MAAM;KAEb,OAAO,GAAG;IACZ,OAAO,IAAI,QACT,QAAQ,MAAM;GAElB;GAEA,MAAM,QAAQ,iBAAiB;IAC7B,OAAO,IAAI,WAAW,kCAAkC,CAAC;GAC3D,GAAG,kBAAkB;GAErB,MAAM,MAAM,KAAK,UACf,OAAO,QACP,CAAC;IAAE,OAAO,CAAC,KAAK,YAAY;IAAG,MAAM,CAAC,YAAY;IAAG,OAAO;GAAE,CAAC,GAC/D;IACE,QAAQ,KAAK;IACb,UAAU,UAAU;KAClB,IAAI;MACF,MAAM,UAAU,mBAAmB,GAAG,OAAO,MAAM,MAAM;MACzD,MAAM,UAAUC,UAAQ,MAAM,SAAS,OAAO;MAE9C,IADiB,oBAAoB,OAC1B,CAAC,CAAC,WAAW,OAAO,QAC7B;MAGF,MAAM,UAAyB;OAC7B,QAAQ,MAAM,OAAO,YAAY;OACjC,QAAQ,OAAO;OACf,QAAQ,OAAO;MACjB;MACA,MAAM,SAAS,IAAI,YAAY,IAAI,SAAS,MAAM,UAAU,IAAI;MAChE,OAAO,mBAAmB;MAC1B,CAAM,YAAY;OAChB,IAAI;QACF,MAAM,OAAO,aAAa;OAC5B,QAAQ,CAER;OACA,IAAI;QACF,MAAM,OAAO,aAAa;QAC1B,OAAO,KAAA,GAAW,MAAM;OAC1B,SAAS,OAAgB;QACvB,OAAO,iBAAiB,QAAQ,QAAQ,IAAI,WAAW,OAAO,KAAK,CAAC,CAAC;OACvE;MACF,EAAA,CAAG;KACL,QAAQ,CAER;IACF;IACA,UAAU,WAAW;KACnB,IAAI,WAAW,eAAe,WAAW,UACvC,OAAO,IAAI,WAAW,qCAAqC,QAAQ,CAAC;IAExE;GACF,CACF;EACF,CAAC;CACH;CAEA,qBAA2B;EACzB,KAAK,MAAM,MAAM;EACjB,KAAK,OAAO,KAAK,MAAM,UACrB,KAAK,SACL,CACE;GACE,OAAO,CAAC,KAAK,YAAY;GACzB,SAAS,CAAC,KAAK,SAAS,MAAM;GAC9B,MAAM,CAAC,KAAK,aAAa;GACzB,OAAO;EACT,CACF,GACA;GACE,UAAU,UAAU;IAClB,IAAI;KACF,MAAM,UAAUA,UAAQ,MAAM,SAAS,KAAK,gBAAgB;KAC5D,MAAM,EAAE,IAAI,QAAQ,UAAU,oBAAoB,OAAO;KAEzD,IAAI,WAAW,cAAc,KAAK,WAAW,IAAI,EAAE,GAAG;MACpD,MAAM,WAAW,KAAK,WAAW,IAAI,EAAE;MACvC,IAAI,CAAC,UACH;MAEF,IAAI,UAAU,KAAA,KAAa,UAAU,IACnC,mBAAmB,KAAK,aAAa,KAAK,CAAC;MAE7C,aAAa,SAAS,KAAK;MAC3B,SAAS,QAAQ,KAAK,cAAc,IAAI,UAAU,KAAK,cAAc;MACrE;KACF;KAEA,MAAM,WAAW,KAAK,aAAa,EAAE;KACrC,IAAI,CAAC,UACH;KAEF,IAAI,UAAU,KAAA,KAAa,UAAU,IACnC,SAAS,OAAO,IAAI,WAAW,KAAK,CAAC;UAChC,IAAI,WAAW,KAAA,GACpB,SAAS,OAAO,IAAI,WAAW,uBAAuB,CAAC;UAEvD,SAAS,QAAQ,MAAM;IAE3B,QAAQ,CAER;GACF;GACA,eAAe;IACb,KAAK,OAAO,KAAA;GACd;EACF,CACF;EACA,KAAK,QAAQ;CACf;CAEA,MAAM,cAAc,WAA4E;EAC9F,MAAM,WAAW,WAAW,YAAY,KAAK;EAC7C,MAAM,QAAQ,WAAW,SAAS,KAAK;EACvC,MAAM,SAAS,CAAC,KAAK,SAAS,QAAQ,KAAK,SAAS,UAAU,EAAE;EAChE,MAAM,WAAW,UAAU,KAAA,KAAa,MAAM,SAAS;EACvD,IAAI,YAAY,aAAa,KAAA,GAC3B,OAAO,KAAK,WAAW,MAAM,KAAK,GAAG,IAAI,EAAE;EAE7C,IAAI,aAAa,KAAA,GACf,OAAO,KAAK,KAAK,UAAU,QAAQ,CAAC;EAEtC,MAAM,SAAS,MAAM,KAAK,aAAa,WAAW,MAAM;EACxD,IAAI,WAAW,OACb;EAEF,MAAM,EAAE,WAAW,KAAK;EACxB,IAAI,WAAW,KAAA,KAAa,WAAW,MAAM,WAAW,QACtD;EAEF,MAAM,IAAI,WAAW,wCAAwC,QAAQ;CACvE;;;;;CAMA,MAAM,eAA8C;EAClD,MAAM,OAAO,MAAM,KAAK,aAAa,iBAAiB,CAAC,CAAC;EACxD,IAAI,SAAS,QACX;EAEF,IAAI;EACJ,IAAI;GACF,SAAS,KAAK,MAAM,IAAI;EAC1B,SAAS,OAAO;GACd,MAAM,IAAI,WAAW,8BAA8B,EACjD,OAAO,iBAAiB,QAAQ,QAAQ,KAAA,EAC1C,CAAC;EACH;EACA,IACE,CAAC,MAAM,QAAQ,MAAM,KACrB,OAAO,WAAW,KAClB,CAAC,OAAO,OAAO,MAAM,OAAO,MAAM,QAAQ,GAE1C,MAAM,IAAI,WAAW,8BAA8B;EAErD,KAAK,UAAU;EACf,KAAK,mBAAmB;EACxB,OAAO;CACT;;CAGA,MAAM,SAAwB;EAC5B,IAAI;GACF,MAAM,OAAO,MAAM,KAAK,aAAa,UAAU,CAAC,CAAC;GACjD,IAAI,SAAS,OACX,MAAM,IAAI,WAAW,6BAA6B,MAAM;EAE5D,UAAU;GACR,MAAM,KAAK,MAAM;EACnB;CACF;CAEA,MAAM,OAAsB;EAC1B,MAAM,OAAO,MAAM,KAAK,aAAa,QAAQ,CAAC,CAAC;EAC/C,IAAI,SAAS,QACX,MAAM,IAAI,WAAW,4BAA4B,MAAM;CAE3D;CAEA,MAAM,eAAgC;EACpC,IAAI,KAAK,wBAAwB,KAAA,GAAW;GAC1C,MAAM,KAAK,MAAM,KAAK,aAAa,kBAAkB,CAAC,CAAC;GACvD,IAAI,CAAC,QAAQ,GAAG,YAAY,CAAC,GAC3B,MAAM,IAAI,WAAW,gCAAgC;GAEvD,KAAK,sBAAsB,GAAG,YAAY;EAC5C;EACA,OAAO,KAAK;CACd;CAEA,MAAM,UAAU,UAAyC;EACvD,MAAM,WAA0B;GAC9B,MAAM,SAAS;GACf,MAAM,SAAS;GACf,SAAS,SAAS;GAClB,YAAY,SAAS;EACvB;EACA,MAAM,OAAO,MAAM,KAAK,aAAa,cAAc,CAAC,KAAK,UAAU,QAAQ,CAAC,CAAC;EAC7E,IAAI;EACJ,IAAI;GACF,SAAS,KAAK,MAAM,IAAI;EAC1B,SAAS,OAAO;GACd,MAAM,IAAI,WAAW,2CAA2C,EAC9D,OAAO,iBAAiB,QAAQ,QAAQ,KAAA,EAC1C,CAAC;EACH;EACA,IAAI,CAAC,oBAAoB,MAAM,KAAK,CAAC,YAAY,MAAM,GACrD,MAAM,IAAI,WAAW,yCAAyC;EAEhE,IAAI,CAAC,sBAAsB,QAAQ,QAAQ,GACzC,MAAM,IAAI,WAAW,+CAA+C;EAEtE,OAAO;CACT;CAEA,MAAM,aAAa,MAAc,WAAoC;EACnE,OAAO,KAAK,aAAa,iBAAiB,CAAC,MAAM,SAAS,CAAC;CAC7D;CAEA,MAAM,aAAa,MAAc,YAAqC;EACpE,OAAO,KAAK,aAAa,iBAAiB,CAAC,MAAM,UAAU,CAAC;CAC9D;CAEA,MAAM,aAAa,MAAc,WAAoC;EACnE,OAAO,KAAK,aAAa,iBAAiB,CAAC,MAAM,SAAS,CAAC;CAC7D;CAEA,MAAM,aAAa,MAAc,SAAkC;EACjE,OAAO,KAAK,aAAa,iBAAiB,CAAC,MAAM,OAAO,CAAC;CAC3D;CAGA,MAAM,QAAuB;EAC3B,KAAK,QAAQ;EACb,KAAK,MAAM,GAAG,aAAa,KAAK,YAAY;GAC1C,aAAa,SAAS,KAAK;GAC3B,SAAS,OAAO,IAAI,WAAW,eAAe,CAAC;EACjD;EACA,KAAK,WAAW,MAAM;EACtB,KAAK,MAAM,MAAM,eAAe;EAChC,KAAK,OAAO,KAAA;EACZ,IAAI,KAAK,WACP,KAAK,MAAM,MAAM;CAErB;CAEA,MAAM,aAAa,QAAgB,QAAmC;EACpE,IAAI,CAAC,KAAK,OACR,MAAM,IAAI,WAAW,kBAAkB;EAEzC,IAAI,CAAC,KAAK,MACR,KAAK,mBAAmB;EAG1B,MAAM,KAAKC,aAAW,YAAY,EAAE,CAAC;EAErC,MAAM,YAAYC,UAAQ,mBAAmB;GADjB;GAAI;GAAQ;EACO,CAAC,GAAG,KAAK,gBAAgB;EAExE,MAAM,QAAQ,cACZ;GACE,MAAM,KAAK;GACX,MAAM,CAAC,IAAI,EAAE,KAAK,SAAS,MAAM,CAAC;GAClC,SAAS;GACT,YAAY,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;EAC1C,GACA,KAAK,aACP;EAEA,MAAM,gBAAgB,IAAI,SAAiB,SAAS,WAAW;GAC7D,MAAM,WAA2B;IAAE;IAAS;IAAQ;GAAO;GAC3D,SAAS,QAAQ,KAAK,cAAc,IAAI,UAAU,KAAK,UAAU;GACjE,KAAK,WAAW,IAAI,IAAI,QAAQ;EAClC,CAAC;EAED,IAAI;EACJ,IAAI;GACF,UAAU,MAAM,KAAK,MAAM,QAAQ,KAAK,SAAS,KAAK;EACxD,SAAS,OAAO;GACd,KAAK,aAAa,EAAE;GACpB,MAAM;EACR;EACA,IAAI,CAAC,QAAQ,MAAM,UAAU,MAAM,QAAQ,OAAO,IAAI,GAAG;GACvD,MAAM,WAAW,KAAK,aAAa,EAAE;GACrC,MAAM,SAAS,QACZ,KAAK,UAAU,MAAM,SAAS,MAAM,QAAQ,OAAO,CAAC,CACpD,QAAQ,YAA+B,QAAQ,OAAO,CAAC,CAAC,CACxD,KAAK,IAAI;GACZ,UAAU,OAAO,IAAI,WAAW,sCAAsC,QAAQ,CAAC;EACjF;EACA,OAAO;CACT;CAEA,aAAa,IAAwC;EACnD,MAAM,WAAW,KAAK,WAAW,IAAI,EAAE;EACvC,IAAI,CAAC,UACH;EAEF,aAAa,SAAS,KAAK;EAC3B,KAAK,WAAW,OAAO,EAAE;EACzB,OAAO;CACT;CAEA,cAAc,IAAY,UAA0B,IAA2C;EAC7F,OAAO,iBAAiB;GACtB,KAAK,aAAa,EAAE;GACpB,SAAS,OAAO,IAAI,WAAW,6BAA6B,SAAS,QAAQ,CAAC;EAChF,GAAG,EAAE;CACP;AACF"}

package/dist/signer.d.mts

@@ -1,3 +1,3 @@
 import { t as NostrSigner } from "./types-CRQEk0Oi.mjs";
-import { a as Nip07Signer, c as isNip07Available, i as Nip46Transport, l as KeysSigner, n as Nip46SignerOptions, o as WindowNostr, r as Nip46SubscribeOptions, s as getWindowNostr, t as Nip46Signer, u as NoSignerError } from "./index-23sRP0wl.mjs";
+import { a as Nip07Signer, c as isNip07Available, i as Nip46Transport, l as KeysSigner, n as Nip46SignerOptions, o as WindowNostr, r as Nip46SubscribeOptions, s as getWindowNostr, t as Nip46Signer, u as NoSignerError } from "./index-MxC28S4P.mjs";
 export { KeysSigner, Nip07Signer, Nip46Signer, type Nip46SignerOptions, type Nip46SubscribeOptions, type Nip46Transport, NoSignerError, type NostrSigner, type WindowNostr, getWindowNostr, isNip07Available };

package/dist/signer.mjs

@@ -1,3 +1,3 @@
 import { t as NoSignerError } from "./error-B__OMBRY.mjs";
-import { a as KeysSigner, i as isNip07Available, n as Nip07Signer, r as getWindowNostr, t as Nip46Signer } from "./signer-BGSpLC7e.mjs";
+import { a as KeysSigner, i as isNip07Available, n as Nip07Signer, r as getWindowNostr, t as Nip46Signer } from "./signer-CYQutDzD.mjs";
 export { KeysSigner, Nip07Signer, Nip46Signer, NoSignerError, getWindowNostr, isNip07Available };

package/dist/testing.mjs

@@ -1,9 +1,9 @@
 import { c as isRecord, i as bytesToHex, l as normalizeURL } from "./util-LfQirgDk.mjs";
 import { t as Kind } from "./kind-Cxwhhkx8.mjs";
 import { m as validateSignedEvent, t as compareEventsDesc, y as isTag } from "./event-D8Nfoh4K.mjs";
-import { r as finalizeEvent, t as Keys } from "./key-BZBap2p-.mjs";
+import { r as finalizeEvent, t as Keys } from "./key-Bps-LqX7.mjs";
 import { n as verifyEvent } from "./verifier-t5WoWbtY.mjs";
-import { t as EventBuilder } from "./builder-8VQ_Xr6X.mjs";
+import { t as EventBuilder } from "./builder-9tjI6WQ3.mjs";
 import { a as matchFilter } from "./filter-BQl3GlHt.mjs";
 import { decrypt, encrypt, getConversationKey } from "./nips/nip44.mjs";
 import { decodeNip46Request, encodeNip46Response } from "./nips/nip46.mjs";

package/dist/wasm.d.mts

@@ -1,16 +1,15 @@
 import { t as Event } from "./event-fU3Y01PR.mjs";
+import { i as SigningBackend } from "./key-Cv4_pN3x.mjs";
 import { s as WasmVerifyPoisonedError } from "./error-CR8Urc84.mjs";
 //#region src/wasm/load.d.ts
 type LoadNostrWasmOptions = {
   /** Bytes, or a URL whose bytes will be read (Node fs for file:; fetch otherwise). */
   module?: ArrayBuffer | ArrayBufferView | URL;
 };
-type NostrWasm = {
+type NostrWasm = SigningBackend & {
   verify: (id: Uint8Array, pubkey: Uint8Array, sig: Uint8Array) => boolean;
   verifySerialized: (serializedUtf8: Uint8Array, id: Uint8Array, pubkey: Uint8Array, sig: Uint8Array) => boolean;
   verifyEvent: (event: Event) => boolean;
-  sign: (id: Uint8Array, seckey: Uint8Array, aux: Uint8Array) => Uint8Array;
-  publicKey: (seckey: Uint8Array) => Uint8Array;
 };
 /** Instantiate once. Repeats reuse the same module. Failure throws; no noble fallback. */
 export declare function loadNostrWasm(opts?: LoadNostrWasmOptions): Promise<NostrWasm>;

package/dist/wasm.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"wasm.mjs","names":[],"sources":["../src/wasm/abi.ts","../src/wasm/adapter.ts","../src/wasm/load.ts"],"sourcesContent":["/** Wasm-bindgen 0.2.122 bundler-produced exports used by interned TS glue. */\nexport type CryptoWasmExports = {\n  memory: WebAssembly.Memory;\n  verify: (\n    idPtr: number,\n    idLen: number,\n    pkPtr: number,\n    pkLen: number,\n    sigPtr: number,\n    sigLen: number,\n  ) => number;\n  verify_serialized: (\n    serPtr: number,\n    serLen: number,\n    idPtr: number,\n    idLen: number,\n    pkPtr: number,\n    pkLen: number,\n    sigPtr: number,\n    sigLen: number,\n  ) => number;\n  sign: (\n    retptr: number,\n    idPtr: number,\n    idLen: number,\n    skPtr: number,\n    skLen: number,\n    auxPtr: number,\n    auxLen: number,\n  ) => void;\n  public_key: (retptr: number, skPtr: number, skLen: number) => void;\n  /** 0.2.122 name for `__wbindgen_malloc(size, align)`. */\n  __wbindgen_export: (size: number, align: number) => number;\n  /** 0.2.122 name for `__wbindgen_free(ptr, size, align)` after malloc claimed `__wbindgen_export`. */\n  __wbindgen_export2: (ptr: number, size: number, align: number) => void;\n  __wbindgen_add_to_stack_pointer: (delta: number) => number;\n  __wbindgen_start?: () => void;\n};\n\n/** Imports 0.2.122 may request. Instantiation fails if anything else appears. */\nexport const ALLOWED_WASM_IMPORTS: ReadonlyArray<{ module: string; name: string }> = [\n  { module: \"wbg\", name: \"__wbindgen_throw\" },\n  { module: \"./nostr_crypto_wasm_bg.js\", name: \"__wbindgen_throw\" },\n];\n\nconst utf8 = new TextDecoder();\n\nfunction decodeUtf8(memory: WebAssembly.Memory, ptr: number, len: number): string {\n  return utf8.decode(new Uint8Array(memory.buffer, ptr, len));\n}\n\nfunction makeWbgImports(holder: { exports?: CryptoWasmExports }): WebAssembly.Imports {\n  const throwRuntime = (ptr: number, len: number): never => {\n    const mem = holder.exports?.memory;\n    const msg = mem ? decodeUtf8(mem, ptr, len) : \"wasm panic\";\n    throw new WebAssembly.RuntimeError(msg);\n  };\n  const wbg = {\n    __wbindgen_throw: throwRuntime,\n  };\n  return {\n    wbg,\n    \"./nostr_crypto_wasm_bg.js\": wbg,\n  };\n}\n\n/** Fail if the module imports anything outside {@link ALLOWED_WASM_IMPORTS}. */\nexport function assertAllowedWasmImports(mod: WebAssembly.Module): void {\n  const allowed = new Set(ALLOWED_WASM_IMPORTS.map((item) => `${item.module}\\0${item.name}`));\n  for (const imp of WebAssembly.Module.imports(mod)) {\n    if (imp.kind !== \"function\") {\n      throw new TypeError(`unexpected wasm import kind ${imp.kind}: ${imp.module}.${imp.name}`);\n    }\n    if (!allowed.has(`${imp.module}\\0${imp.name}`)) {\n      throw new TypeError(`unexpected wasm import ${imp.module}.${imp.name}`);\n    }\n  }\n}\n\nfunction requireMemory(value: WebAssembly.ExportValue | undefined): WebAssembly.Memory {\n  if (!(value instanceof WebAssembly.Memory)) {\n    throw new TypeError(\"wasm missing memory export\");\n  }\n  return value;\n}\n\n// oxlint-disable-next-line no-unnecessary-type-parameters -- T binds the declared ABI signature at each call site\nfunction requireFn<T extends (...args: number[]) => unknown>(\n  value: WebAssembly.ExportValue | undefined,\n  name: string,\n): T {\n  if (typeof value !== \"function\") {\n    throw new TypeError(`wasm missing ${name} export`);\n  }\n  // oxlint-disable-next-line no-unsafe-type-assertion -- wasm exports are opaque; each name is bound to the signature the ABI contract requires\n  return value as T;\n}\n\nfunction asExports(raw: WebAssembly.Exports): CryptoWasmExports {\n  const exports: CryptoWasmExports = {\n    memory: requireMemory(raw[\"memory\"]),\n    verify: requireFn(raw[\"verify\"], \"verify\"),\n    verify_serialized: requireFn(raw[\"verify_serialized\"], \"verify_serialized\"),\n    sign: requireFn(raw[\"sign\"], \"sign\"),\n    public_key: requireFn(raw[\"public_key\"], \"public_key\"),\n    __wbindgen_export: requireFn(raw[\"__wbindgen_export\"], \"__wbindgen_export\"),\n    __wbindgen_export2: requireFn(raw[\"__wbindgen_export2\"], \"__wbindgen_export2\"),\n    __wbindgen_add_to_stack_pointer: requireFn(\n      raw[\"__wbindgen_add_to_stack_pointer\"],\n      \"__wbindgen_add_to_stack_pointer\",\n    ),\n  };\n  const start = raw[\"__wbindgen_start\"];\n  if (typeof start === \"function\") {\n    exports.__wbindgen_start = requireFn<() => void>(start, \"__wbindgen_start\");\n  }\n  return exports;\n}\n\nfunction passBytes(exports: CryptoWasmExports, bytes: Uint8Array): { ptr: number; len: number } {\n  const len = bytes.length;\n  const ptr = exports.__wbindgen_export(len, 1) >>> 0;\n  new Uint8Array(exports.memory.buffer, ptr, len).set(bytes);\n  return { ptr, len };\n}\n\nexport function wasmVerify(\n  exports: CryptoWasmExports,\n  id: Uint8Array,\n  pubkey: Uint8Array,\n  sig: Uint8Array,\n): boolean {\n  const idP = passBytes(exports, id);\n  const pkP = passBytes(exports, pubkey);\n  const sigP = passBytes(exports, sig);\n  return exports.verify(idP.ptr, idP.len, pkP.ptr, pkP.len, sigP.ptr, sigP.len) !== 0;\n}\n\nexport function wasmVerifySerialized(\n  exports: CryptoWasmExports,\n  serialized: Uint8Array,\n  id: Uint8Array,\n  pubkey: Uint8Array,\n  sig: Uint8Array,\n): boolean {\n  const serP = passBytes(exports, serialized);\n  const idP = passBytes(exports, id);\n  const pkP = passBytes(exports, pubkey);\n  const sigP = passBytes(exports, sig);\n  return (\n    exports.verify_serialized(\n      serP.ptr,\n      serP.len,\n      idP.ptr,\n      idP.len,\n      pkP.ptr,\n      pkP.len,\n      sigP.ptr,\n      sigP.len,\n    ) !== 0\n  );\n}\n\nfunction takeBytes(exports: CryptoWasmExports, ptr: number, len: number): Uint8Array {\n  const out = new Uint8Array(len);\n  if (len > 0) {\n    out.set(new Uint8Array(exports.memory.buffer, ptr, len));\n    exports.__wbindgen_export2(ptr, len, 1);\n  }\n  return out;\n}\n\nfunction callReturningBytes(\n  exports: CryptoWasmExports,\n  invoke: (retptr: number) => void,\n): Uint8Array {\n  const retptr = exports.__wbindgen_add_to_stack_pointer(-16);\n  try {\n    invoke(retptr);\n    const view = new DataView(exports.memory.buffer);\n    const ptr = view.getUint32(retptr, true);\n    const len = view.getUint32(retptr + 4, true);\n    return takeBytes(exports, ptr, len);\n  } finally {\n    exports.__wbindgen_add_to_stack_pointer(16);\n  }\n}\n\nexport function wasmSign(\n  exports: CryptoWasmExports,\n  id: Uint8Array,\n  seckey: Uint8Array,\n  aux: Uint8Array,\n): Uint8Array {\n  const idP = passBytes(exports, id);\n  const skP = passBytes(exports, seckey);\n  const auxP = passBytes(exports, aux);\n  return callReturningBytes(exports, (retptr) => {\n    exports.sign(retptr, idP.ptr, idP.len, skP.ptr, skP.len, auxP.ptr, auxP.len);\n  });\n}\n\nexport function wasmPublicKey(exports: CryptoWasmExports, seckey: Uint8Array): Uint8Array {\n  const skP = passBytes(exports, seckey);\n  return callReturningBytes(exports, (retptr) => {\n    exports.public_key(retptr, skP.ptr, skP.len);\n  });\n}\n\nexport async function instantiateCryptoWasm(\n  bytes: ArrayBuffer | ArrayBufferView,\n): Promise<CryptoWasmExports> {\n  const holder: { exports?: CryptoWasmExports } = {};\n  const { module, instance } = await WebAssembly.instantiate(bytes, makeWbgImports(holder));\n  assertAllowedWasmImports(module);\n  holder.exports = asExports(instance.exports);\n  holder.exports.__wbindgen_start?.();\n  return holder.exports;\n}\n","import { WasmVerifyPoisonedError } from \"../core/error.ts\";\nimport type { Event } from \"../core/event.ts\";\nimport { createEventVerifier } from \"../core/verifier.ts\";\nimport type { SerializedEventVerifier } from \"../core/verifier.ts\";\n\nexport { WasmVerifyPoisonedError } from \"../core/error.ts\";\n\n/**\n * Build the WASM event verifier on {@link createEventVerifier}. A `WebAssembly.RuntimeError` from\n * the module means the instance aborted — it poisons every later call with the same\n * `WasmVerifyPoisonedError`; any other backend error verifies `false` (the event is marked\n * failed).\n */\nexport function createWasmEventVerifier(\n  verifySerialized: SerializedEventVerifier,\n  poison: { error?: Error },\n): (event: Event) => boolean {\n  const backend: SerializedEventVerifier = (serializedUtf8, id, pubkey, sig) => {\n    if (poison.error !== undefined) {\n      throw poison.error;\n    }\n    try {\n      return verifySerialized(serializedUtf8, id, pubkey, sig);\n    } catch (error) {\n      if (error instanceof WebAssembly.RuntimeError) {\n        poison.error = new WasmVerifyPoisonedError(\"wasm verify aborted the instance\", {\n          cause: error,\n        });\n        throw poison.error;\n      }\n      return false;\n    }\n  };\n  return createEventVerifier(backend);\n}\n","import { CryptoError } from \"../core/error.ts\";\nimport type { Event } from \"../core/event.ts\";\nimport {\n  instantiateCryptoWasm,\n  wasmPublicKey,\n  wasmSign,\n  wasmVerify,\n  wasmVerifySerialized,\n} from \"./abi.ts\";\nimport type { CryptoWasmExports } from \"./abi.ts\";\nimport { createWasmEventVerifier, WasmVerifyPoisonedError } from \"./adapter.ts\";\n\nexport { WasmVerifyPoisonedError } from \"./adapter.ts\";\nexport type LoadNostrWasmOptions = {\n  /** Bytes, or a URL whose bytes will be read (Node fs for file:; fetch otherwise). */\n  module?: ArrayBuffer | ArrayBufferView | URL;\n};\n\nexport type NostrWasm = {\n  verify: (id: Uint8Array, pubkey: Uint8Array, sig: Uint8Array) => boolean;\n  verifySerialized: (\n    serializedUtf8: Uint8Array,\n    id: Uint8Array,\n    pubkey: Uint8Array,\n    sig: Uint8Array,\n  ) => boolean;\n  verifyEvent: (event: Event) => boolean;\n  sign: (id: Uint8Array, seckey: Uint8Array, aux: Uint8Array) => Uint8Array;\n  publicKey: (seckey: Uint8Array) => Uint8Array;\n};\n\nlet interned: Promise<NostrWasm> | undefined;\n\nfunction isNode(): boolean {\n  if (!(\"process\" in globalThis)) {\n    return false;\n  }\n  const proc: unknown = globalThis.process;\n  return (\n    typeof proc === \"object\" &&\n    proc !== null &&\n    \"versions\" in proc &&\n    typeof proc.versions === \"object\" &&\n    proc.versions !== null &&\n    \"node\" in proc.versions &&\n    typeof proc.versions.node === \"string\"\n  );\n}\n\nfunction isWasmBytes(value: unknown): value is ArrayBuffer | ArrayBufferView {\n  return value instanceof ArrayBuffer || ArrayBuffer.isView(value);\n}\n\nasync function defaultWasmHref(): Promise<string> {\n  const mod = await import(\"./nostr_crypto_wasm_bg.wasm?url\");\n  return mod.default;\n}\n\nasync function readWasmUrl(url: URL): Promise<Uint8Array> {\n  if (isNode() && url.protocol === \"file:\") {\n    const { readFile } = await import(\"node:fs/promises\");\n    const { fileURLToPath } = await import(\"node:url\");\n    return new Uint8Array(await readFile(fileURLToPath(url)));\n  }\n  const res = await fetch(url);\n  if (!res.ok) {\n    throw new CryptoError(`failed to fetch wasm: ${res.status} ${url.href}`);\n  }\n  return new Uint8Array(await res.arrayBuffer());\n}\n\nasync function wasmBytes(opts?: LoadNostrWasmOptions): Promise<ArrayBuffer | ArrayBufferView> {\n  const source = opts?.module;\n  if (source !== undefined && isWasmBytes(source)) {\n    return source;\n  }\n  const href = source instanceof URL ? source : new URL(await defaultWasmHref(), import.meta.url);\n  return readWasmUrl(href);\n}\n\nfunction requireByteLength(bytes: Uint8Array, expected: number, label: string): void {\n  if (bytes.length !== expected) {\n    throw new CryptoError(`invalid ${label} length: expected ${expected}, got ${bytes.length}`);\n  }\n}\n\nfunction wrapPoison<T>(poison: { error?: Error }, fn: () => T): T {\n  if (poison.error) {\n    throw poison.error;\n  }\n  try {\n    return fn();\n  } catch (error) {\n    if (error instanceof WebAssembly.RuntimeError) {\n      poison.error = new WasmVerifyPoisonedError(\"wasm verify aborted the instance\", {\n        cause: error,\n      });\n      throw poison.error;\n    }\n    throw error;\n  }\n}\n\nfunction bindExports(exports: CryptoWasmExports): NostrWasm {\n  const poison: { error?: Error } = {};\n  const rawSerialized = (\n    serializedUtf8: Uint8Array,\n    id: Uint8Array,\n    pubkey: Uint8Array,\n    sig: Uint8Array,\n  ): boolean => wasmVerifySerialized(exports, serializedUtf8, id, pubkey, sig);\n  return {\n    verify: (id, pubkey, sig) => wrapPoison(poison, () => wasmVerify(exports, id, pubkey, sig)),\n    verifySerialized: (serializedUtf8, id, pubkey, sig) =>\n      wrapPoison(poison, () => rawSerialized(serializedUtf8, id, pubkey, sig)),\n    verifyEvent: createWasmEventVerifier(rawSerialized, poison),\n    sign: (id, seckey, aux) =>\n      wrapPoison(poison, () => {\n        requireByteLength(id, 32, \"id\");\n        requireByteLength(seckey, 32, \"secret key\");\n        requireByteLength(aux, 32, \"aux\");\n        const sig = wasmSign(exports, id, seckey, aux);\n        if (sig.length !== 64) {\n          throw new CryptoError(\"wasm sign failed\");\n        }\n        return sig;\n      }),\n    publicKey: (seckey) =>\n      wrapPoison(poison, () => {\n        requireByteLength(seckey, 32, \"secret key\");\n        const pk = wasmPublicKey(exports, seckey);\n        if (pk.length !== 32) {\n          throw new CryptoError(\"wasm publicKey failed\");\n        }\n        return pk;\n      }),\n  };\n}\n\nasync function instantiateNostrWasm(opts?: LoadNostrWasmOptions): Promise<NostrWasm> {\n  const bytes = await wasmBytes(opts);\n  const exports = await instantiateCryptoWasm(bytes);\n  return bindExports(exports);\n}\n\n/** Instantiate once. Repeats reuse the same module. Failure throws; no noble fallback. */\nexport async function loadNostrWasm(opts?: LoadNostrWasmOptions): Promise<NostrWasm> {\n  if (interned) {\n    return interned;\n  }\n  const pending = instantiateNostrWasm(opts);\n  interned = pending;\n  try {\n    return await pending;\n  } catch (error) {\n    if (interned === pending) {\n      interned = undefined;\n    }\n    throw error;\n  }\n}\n\n/** Clears intern so tests can re-instantiate. Not exported from the wasm subpath. */\nexport function resetNostrWasmForTests(): void {\n  interned = undefined;\n}\n"],"mappings":";;;;AAwCA,MAAa,uBAAwE,CACnF;CAAE,QAAQ;CAAO,MAAM;AAAmB,GAC1C;CAAE,QAAQ;CAA6B,MAAM;AAAmB,CAClE;AAEA,MAAM,OAAO,IAAI,YAAY;AAE7B,SAAS,WAAW,QAA4B,KAAa,KAAqB;CAChF,OAAO,KAAK,OAAO,IAAI,WAAW,OAAO,QAAQ,KAAK,GAAG,CAAC;AAC5D;AAEA,SAAS,eAAe,QAA8D;CACpF,MAAM,gBAAgB,KAAa,QAAuB;EACxD,MAAM,MAAM,OAAO,SAAS;EAC5B,MAAM,MAAM,MAAM,WAAW,KAAK,KAAK,GAAG,IAAI;EAC9C,MAAM,IAAI,YAAY,aAAa,GAAG;CACxC;CACA,MAAM,MAAM,EACV,kBAAkB,aACpB;CACA,OAAO;EACL;EACA,6BAA6B;CAC/B;AACF;;AAGA,SAAgB,yBAAyB,KAA+B;CACtE,MAAM,UAAU,IAAI,IAAI,qBAAqB,KAAK,SAAS,GAAG,KAAK,OAAO,IAAI,KAAK,MAAM,CAAC;CAC1F,KAAK,MAAM,OAAO,YAAY,OAAO,QAAQ,GAAG,GAAG;EACjD,IAAI,IAAI,SAAS,YACf,MAAM,IAAI,UAAU,+BAA+B,IAAI,KAAK,IAAI,IAAI,OAAO,GAAG,IAAI,MAAM;EAE1F,IAAI,CAAC,QAAQ,IAAI,GAAG,IAAI,OAAO,IAAI,IAAI,MAAM,GAC3C,MAAM,IAAI,UAAU,0BAA0B,IAAI,OAAO,GAAG,IAAI,MAAM;CAE1E;AACF;AAEA,SAAS,cAAc,OAAgE;CACrF,IAAI,EAAE,iBAAiB,YAAY,SACjC,MAAM,IAAI,UAAU,4BAA4B;CAElD,OAAO;AACT;AAGA,SAAS,UACP,OACA,MACG;CACH,IAAI,OAAO,UAAU,YACnB,MAAM,IAAI,UAAU,gBAAgB,KAAK,QAAQ;CAGnD,OAAO;AACT;AAEA,SAAS,UAAU,KAA6C;CAC9D,MAAM,UAA6B;EACjC,QAAQ,cAAc,IAAI,SAAS;EACnC,QAAQ,UAAU,IAAI,WAAW,QAAQ;EACzC,mBAAmB,UAAU,IAAI,sBAAsB,mBAAmB;EAC1E,MAAM,UAAU,IAAI,SAAS,MAAM;EACnC,YAAY,UAAU,IAAI,eAAe,YAAY;EACrD,mBAAmB,UAAU,IAAI,sBAAsB,mBAAmB;EAC1E,oBAAoB,UAAU,IAAI,uBAAuB,oBAAoB;EAC7E,iCAAiC,UAC/B,IAAI,oCACJ,iCACF;CACF;CACA,MAAM,QAAQ,IAAI;CAClB,IAAI,OAAO,UAAU,YACnB,QAAQ,mBAAmB,UAAsB,OAAO,kBAAkB;CAE5E,OAAO;AACT;AAEA,SAAS,UAAU,SAA4B,OAAiD;CAC9F,MAAM,MAAM,MAAM;CAClB,MAAM,MAAM,QAAQ,kBAAkB,KAAK,CAAC,MAAM;CAClD,IAAI,WAAW,QAAQ,OAAO,QAAQ,KAAK,GAAG,CAAC,CAAC,IAAI,KAAK;CACzD,OAAO;EAAE;EAAK;CAAI;AACpB;AAEA,SAAgB,WACd,SACA,IACA,QACA,KACS;CACT,MAAM,MAAM,UAAU,SAAS,EAAE;CACjC,MAAM,MAAM,UAAU,SAAS,MAAM;CACrC,MAAM,OAAO,UAAU,SAAS,GAAG;CACnC,OAAO,QAAQ,OAAO,IAAI,KAAK,IAAI,KAAK,IAAI,KAAK,IAAI,KAAK,KAAK,KAAK,KAAK,GAAG,MAAM;AACpF;AAEA,SAAgB,qBACd,SACA,YACA,IACA,QACA,KACS;CACT,MAAM,OAAO,UAAU,SAAS,UAAU;CAC1C,MAAM,MAAM,UAAU,SAAS,EAAE;CACjC,MAAM,MAAM,UAAU,SAAS,MAAM;CACrC,MAAM,OAAO,UAAU,SAAS,GAAG;CACnC,OACE,QAAQ,kBACN,KAAK,KACL,KAAK,KACL,IAAI,KACJ,IAAI,KACJ,IAAI,KACJ,IAAI,KACJ,KAAK,KACL,KAAK,GACP,MAAM;AAEV;AAEA,SAAS,UAAU,SAA4B,KAAa,KAAyB;CACnF,MAAM,MAAM,IAAI,WAAW,GAAG;CAC9B,IAAI,MAAM,GAAG;EACX,IAAI,IAAI,IAAI,WAAW,QAAQ,OAAO,QAAQ,KAAK,GAAG,CAAC;EACvD,QAAQ,mBAAmB,KAAK,KAAK,CAAC;CACxC;CACA,OAAO;AACT;AAEA,SAAS,mBACP,SACA,QACY;CACZ,MAAM,SAAS,QAAQ,gCAAgC,GAAG;CAC1D,IAAI;EACF,OAAO,MAAM;EACb,MAAM,OAAO,IAAI,SAAS,QAAQ,OAAO,MAAM;EAG/C,OAAO,UAAU,SAFL,KAAK,UAAU,QAAQ,IAEP,GADhB,KAAK,UAAU,SAAS,GAAG,IACN,CAAC;CACpC,UAAU;EACR,QAAQ,gCAAgC,EAAE;CAC5C;AACF;AAEA,SAAgB,SACd,SACA,IACA,QACA,KACY;CACZ,MAAM,MAAM,UAAU,SAAS,EAAE;CACjC,MAAM,MAAM,UAAU,SAAS,MAAM;CACrC,MAAM,OAAO,UAAU,SAAS,GAAG;CACnC,OAAO,mBAAmB,UAAU,WAAW;EAC7C,QAAQ,KAAK,QAAQ,IAAI,KAAK,IAAI,KAAK,IAAI,KAAK,IAAI,KAAK,KAAK,KAAK,KAAK,GAAG;CAC7E,CAAC;AACH;AAEA,SAAgB,cAAc,SAA4B,QAAgC;CACxF,MAAM,MAAM,UAAU,SAAS,MAAM;CACrC,OAAO,mBAAmB,UAAU,WAAW;EAC7C,QAAQ,WAAW,QAAQ,IAAI,KAAK,IAAI,GAAG;CAC7C,CAAC;AACH;AAEA,eAAsB,sBACpB,OAC4B;CAC5B,MAAM,SAA0C,CAAC;CACjD,MAAM,EAAE,QAAQ,aAAa,MAAM,YAAY,YAAY,OAAO,eAAe,MAAM,CAAC;CACxF,yBAAyB,MAAM;CAC/B,OAAO,UAAU,UAAU,SAAS,OAAO;CAC3C,OAAO,QAAQ,mBAAmB;CAClC,OAAO,OAAO;AAChB;;;;;;;;;AC7MA,SAAgB,wBACd,kBACA,QAC2B;CAC3B,MAAM,WAAoC,gBAAgB,IAAI,QAAQ,QAAQ;EAC5E,IAAI,OAAO,UAAU,KAAA,GACnB,MAAM,OAAO;EAEf,IAAI;GACF,OAAO,iBAAiB,gBAAgB,IAAI,QAAQ,GAAG;EACzD,SAAS,OAAO;GACd,IAAI,iBAAiB,YAAY,cAAc;IAC7C,OAAO,QAAQ,IAAI,wBAAwB,oCAAoC,EAC7E,OAAO,MACT,CAAC;IACD,MAAM,OAAO;GACf;GACA,OAAO;EACT;CACF;CACA,OAAO,oBAAoB,OAAO;AACpC;;;ACHA,IAAI;AAEJ,SAAS,SAAkB;CACzB,IAAI,EAAE,aAAa,aACjB,OAAO;CAET,MAAM,OAAgB,WAAW;CACjC,OACE,OAAO,SAAS,YAChB,SAAS,QACT,cAAc,QACd,OAAO,KAAK,aAAa,YACzB,KAAK,aAAa,QAClB,UAAU,KAAK,YACf,OAAO,KAAK,SAAS,SAAS;AAElC;AAEA,SAAS,YAAY,OAAwD;CAC3E,OAAO,iBAAiB,eAAe,YAAY,OAAO,KAAK;AACjE;AAEA,eAAe,kBAAmC;CAEhD,QAAO,MADW,OAAO,uCAAA,CACd;AACb;AAEA,eAAe,YAAY,KAA+B;CACxD,IAAI,OAAO,KAAK,IAAI,aAAa,SAAS;EACxC,MAAM,EAAE,aAAa,MAAM,OAAO;EAClC,MAAM,EAAE,kBAAkB,MAAM,OAAO;EACvC,OAAO,IAAI,WAAW,MAAM,SAAS,cAAc,GAAG,CAAC,CAAC;CAC1D;CACA,MAAM,MAAM,MAAM,MAAM,GAAG;CAC3B,IAAI,CAAC,IAAI,IACP,MAAM,IAAI,YAAY,yBAAyB,IAAI,OAAO,GAAG,IAAI,MAAM;CAEzE,OAAO,IAAI,WAAW,MAAM,IAAI,YAAY,CAAC;AAC/C;AAEA,eAAe,UAAU,MAAqE;CAC5F,MAAM,SAAS,MAAM;CACrB,IAAI,WAAW,KAAA,KAAa,YAAY,MAAM,GAC5C,OAAO;CAGT,OAAO,YADM,kBAAkB,MAAM,SAAS,IAAI,IAAI,MAAM,gBAAgB,GAAG,YAAY,GAAG,CACvE;AACzB;AAEA,SAAS,kBAAkB,OAAmB,UAAkB,OAAqB;CACnF,IAAI,MAAM,WAAW,UACnB,MAAM,IAAI,YAAY,WAAW,MAAM,oBAAoB,SAAS,QAAQ,MAAM,QAAQ;AAE9F;AAEA,SAAS,WAAc,QAA2B,IAAgB;CAChE,IAAI,OAAO,OACT,MAAM,OAAO;CAEf,IAAI;EACF,OAAO,GAAG;CACZ,SAAS,OAAO;EACd,IAAI,iBAAiB,YAAY,cAAc;GAC7C,OAAO,QAAQ,IAAI,wBAAwB,oCAAoC,EAC7E,OAAO,MACT,CAAC;GACD,MAAM,OAAO;EACf;EACA,MAAM;CACR;AACF;AAEA,SAAS,YAAY,SAAuC;CAC1D,MAAM,SAA4B,CAAC;CACnC,MAAM,iBACJ,gBACA,IACA,QACA,QACY,qBAAqB,SAAS,gBAAgB,IAAI,QAAQ,GAAG;CAC3E,OAAO;EACL,SAAS,IAAI,QAAQ,QAAQ,WAAW,cAAc,WAAW,SAAS,IAAI,QAAQ,GAAG,CAAC;EAC1F,mBAAmB,gBAAgB,IAAI,QAAQ,QAC7C,WAAW,cAAc,cAAc,gBAAgB,IAAI,QAAQ,GAAG,CAAC;EACzE,aAAa,wBAAwB,eAAe,MAAM;EAC1D,OAAO,IAAI,QAAQ,QACjB,WAAW,cAAc;GACvB,kBAAkB,IAAI,IAAI,IAAI;GAC9B,kBAAkB,QAAQ,IAAI,YAAY;GAC1C,kBAAkB,KAAK,IAAI,KAAK;GAChC,MAAM,MAAM,SAAS,SAAS,IAAI,QAAQ,GAAG;GAC7C,IAAI,IAAI,WAAW,IACjB,MAAM,IAAI,YAAY,kBAAkB;GAE1C,OAAO;EACT,CAAC;EACH,YAAY,WACV,WAAW,cAAc;GACvB,kBAAkB,QAAQ,IAAI,YAAY;GAC1C,MAAM,KAAK,cAAc,SAAS,MAAM;GACxC,IAAI,GAAG,WAAW,IAChB,MAAM,IAAI,YAAY,uBAAuB;GAE/C,OAAO;EACT,CAAC;CACL;AACF;AAEA,eAAe,qBAAqB,MAAiD;CAGnF,OAAO,YAAY,MADG,sBAAsB,MADxB,UAAU,IAAI,CACe,CACvB;AAC5B;;AAGA,eAAsB,cAAc,MAAiD;CACnF,IAAI,UACF,OAAO;CAET,MAAM,UAAU,qBAAqB,IAAI;CACzC,WAAW;CACX,IAAI;EACF,OAAO,MAAM;CACf,SAAS,OAAO;EACd,IAAI,aAAa,SACf,WAAW,KAAA;EAEb,MAAM;CACR;AACF"}
+{"version":3,"file":"wasm.mjs","names":[],"sources":["../src/wasm/abi.ts","../src/wasm/adapter.ts","../src/wasm/load.ts"],"sourcesContent":["/** Wasm-bindgen 0.2.122 bundler-produced exports used by interned TS glue. */\nexport type CryptoWasmExports = {\n  memory: WebAssembly.Memory;\n  verify: (\n    idPtr: number,\n    idLen: number,\n    pkPtr: number,\n    pkLen: number,\n    sigPtr: number,\n    sigLen: number,\n  ) => number;\n  verify_serialized: (\n    serPtr: number,\n    serLen: number,\n    idPtr: number,\n    idLen: number,\n    pkPtr: number,\n    pkLen: number,\n    sigPtr: number,\n    sigLen: number,\n  ) => number;\n  sign: (\n    retptr: number,\n    idPtr: number,\n    idLen: number,\n    skPtr: number,\n    skLen: number,\n    auxPtr: number,\n    auxLen: number,\n  ) => void;\n  public_key: (retptr: number, skPtr: number, skLen: number) => void;\n  /** 0.2.122 name for `__wbindgen_malloc(size, align)`. */\n  __wbindgen_export: (size: number, align: number) => number;\n  /** 0.2.122 name for `__wbindgen_free(ptr, size, align)` after malloc claimed `__wbindgen_export`. */\n  __wbindgen_export2: (ptr: number, size: number, align: number) => void;\n  __wbindgen_add_to_stack_pointer: (delta: number) => number;\n  __wbindgen_start?: () => void;\n};\n\n/** Imports 0.2.122 may request. Instantiation fails if anything else appears. */\nexport const ALLOWED_WASM_IMPORTS: ReadonlyArray<{ module: string; name: string }> = [\n  { module: \"wbg\", name: \"__wbindgen_throw\" },\n  { module: \"./nostr_crypto_wasm_bg.js\", name: \"__wbindgen_throw\" },\n];\n\nconst utf8 = new TextDecoder();\n\nfunction decodeUtf8(memory: WebAssembly.Memory, ptr: number, len: number): string {\n  return utf8.decode(new Uint8Array(memory.buffer, ptr, len));\n}\n\nfunction makeWbgImports(holder: { exports?: CryptoWasmExports }): WebAssembly.Imports {\n  const throwRuntime = (ptr: number, len: number): never => {\n    const mem = holder.exports?.memory;\n    const msg = mem ? decodeUtf8(mem, ptr, len) : \"wasm panic\";\n    throw new WebAssembly.RuntimeError(msg);\n  };\n  const wbg = {\n    __wbindgen_throw: throwRuntime,\n  };\n  return {\n    wbg,\n    \"./nostr_crypto_wasm_bg.js\": wbg,\n  };\n}\n\n/** Fail if the module imports anything outside {@link ALLOWED_WASM_IMPORTS}. */\nexport function assertAllowedWasmImports(mod: WebAssembly.Module): void {\n  const allowed = new Set(ALLOWED_WASM_IMPORTS.map((item) => `${item.module}\\0${item.name}`));\n  for (const imp of WebAssembly.Module.imports(mod)) {\n    if (imp.kind !== \"function\") {\n      throw new TypeError(`unexpected wasm import kind ${imp.kind}: ${imp.module}.${imp.name}`);\n    }\n    if (!allowed.has(`${imp.module}\\0${imp.name}`)) {\n      throw new TypeError(`unexpected wasm import ${imp.module}.${imp.name}`);\n    }\n  }\n}\n\nfunction requireMemory(value: WebAssembly.ExportValue | undefined): WebAssembly.Memory {\n  if (!(value instanceof WebAssembly.Memory)) {\n    throw new TypeError(\"wasm missing memory export\");\n  }\n  return value;\n}\n\n// oxlint-disable-next-line no-unnecessary-type-parameters -- T binds the declared ABI signature at each call site\nfunction requireFn<T extends (...args: number[]) => unknown>(\n  value: WebAssembly.ExportValue | undefined,\n  name: string,\n): T {\n  if (typeof value !== \"function\") {\n    throw new TypeError(`wasm missing ${name} export`);\n  }\n  // oxlint-disable-next-line no-unsafe-type-assertion -- wasm exports are opaque; each name is bound to the signature the ABI contract requires\n  return value as T;\n}\n\nfunction asExports(raw: WebAssembly.Exports): CryptoWasmExports {\n  const exports: CryptoWasmExports = {\n    memory: requireMemory(raw[\"memory\"]),\n    verify: requireFn(raw[\"verify\"], \"verify\"),\n    verify_serialized: requireFn(raw[\"verify_serialized\"], \"verify_serialized\"),\n    sign: requireFn(raw[\"sign\"], \"sign\"),\n    public_key: requireFn(raw[\"public_key\"], \"public_key\"),\n    __wbindgen_export: requireFn(raw[\"__wbindgen_export\"], \"__wbindgen_export\"),\n    __wbindgen_export2: requireFn(raw[\"__wbindgen_export2\"], \"__wbindgen_export2\"),\n    __wbindgen_add_to_stack_pointer: requireFn(\n      raw[\"__wbindgen_add_to_stack_pointer\"],\n      \"__wbindgen_add_to_stack_pointer\",\n    ),\n  };\n  const start = raw[\"__wbindgen_start\"];\n  if (typeof start === \"function\") {\n    exports.__wbindgen_start = requireFn<() => void>(start, \"__wbindgen_start\");\n  }\n  return exports;\n}\n\nfunction passBytes(exports: CryptoWasmExports, bytes: Uint8Array): { ptr: number; len: number } {\n  const len = bytes.length;\n  const ptr = exports.__wbindgen_export(len, 1) >>> 0;\n  new Uint8Array(exports.memory.buffer, ptr, len).set(bytes);\n  return { ptr, len };\n}\n\nexport function wasmVerify(\n  exports: CryptoWasmExports,\n  id: Uint8Array,\n  pubkey: Uint8Array,\n  sig: Uint8Array,\n): boolean {\n  const idP = passBytes(exports, id);\n  const pkP = passBytes(exports, pubkey);\n  const sigP = passBytes(exports, sig);\n  return exports.verify(idP.ptr, idP.len, pkP.ptr, pkP.len, sigP.ptr, sigP.len) !== 0;\n}\n\nexport function wasmVerifySerialized(\n  exports: CryptoWasmExports,\n  serialized: Uint8Array,\n  id: Uint8Array,\n  pubkey: Uint8Array,\n  sig: Uint8Array,\n): boolean {\n  const serP = passBytes(exports, serialized);\n  const idP = passBytes(exports, id);\n  const pkP = passBytes(exports, pubkey);\n  const sigP = passBytes(exports, sig);\n  return (\n    exports.verify_serialized(\n      serP.ptr,\n      serP.len,\n      idP.ptr,\n      idP.len,\n      pkP.ptr,\n      pkP.len,\n      sigP.ptr,\n      sigP.len,\n    ) !== 0\n  );\n}\n\nfunction takeBytes(exports: CryptoWasmExports, ptr: number, len: number): Uint8Array {\n  const out = new Uint8Array(len);\n  if (len > 0) {\n    out.set(new Uint8Array(exports.memory.buffer, ptr, len));\n    exports.__wbindgen_export2(ptr, len, 1);\n  }\n  return out;\n}\n\nfunction callReturningBytes(\n  exports: CryptoWasmExports,\n  invoke: (retptr: number) => void,\n): Uint8Array {\n  const retptr = exports.__wbindgen_add_to_stack_pointer(-16);\n  try {\n    invoke(retptr);\n    const view = new DataView(exports.memory.buffer);\n    const ptr = view.getUint32(retptr, true);\n    const len = view.getUint32(retptr + 4, true);\n    return takeBytes(exports, ptr, len);\n  } finally {\n    exports.__wbindgen_add_to_stack_pointer(16);\n  }\n}\n\nexport function wasmSign(\n  exports: CryptoWasmExports,\n  id: Uint8Array,\n  seckey: Uint8Array,\n  aux: Uint8Array,\n): Uint8Array {\n  const idP = passBytes(exports, id);\n  const skP = passBytes(exports, seckey);\n  const auxP = passBytes(exports, aux);\n  return callReturningBytes(exports, (retptr) => {\n    exports.sign(retptr, idP.ptr, idP.len, skP.ptr, skP.len, auxP.ptr, auxP.len);\n  });\n}\n\nexport function wasmPublicKey(exports: CryptoWasmExports, seckey: Uint8Array): Uint8Array {\n  const skP = passBytes(exports, seckey);\n  return callReturningBytes(exports, (retptr) => {\n    exports.public_key(retptr, skP.ptr, skP.len);\n  });\n}\n\nexport async function instantiateCryptoWasm(\n  bytes: ArrayBuffer | ArrayBufferView,\n): Promise<CryptoWasmExports> {\n  const holder: { exports?: CryptoWasmExports } = {};\n  const { module, instance } = await WebAssembly.instantiate(bytes, makeWbgImports(holder));\n  assertAllowedWasmImports(module);\n  holder.exports = asExports(instance.exports);\n  holder.exports.__wbindgen_start?.();\n  return holder.exports;\n}\n","import { WasmVerifyPoisonedError } from \"../core/error.ts\";\nimport type { Event } from \"../core/event.ts\";\nimport { createEventVerifier } from \"../core/verifier.ts\";\nimport type { SerializedEventVerifier } from \"../core/verifier.ts\";\n\nexport { WasmVerifyPoisonedError } from \"../core/error.ts\";\n\n/**\n * Build the WASM event verifier on {@link createEventVerifier}. A `WebAssembly.RuntimeError` from\n * the module means the instance aborted — it poisons every later call with the same\n * `WasmVerifyPoisonedError`; any other backend error verifies `false` (the event is marked\n * failed).\n */\nexport function createWasmEventVerifier(\n  verifySerialized: SerializedEventVerifier,\n  poison: { error?: Error },\n): (event: Event) => boolean {\n  const backend: SerializedEventVerifier = (serializedUtf8, id, pubkey, sig) => {\n    if (poison.error !== undefined) {\n      throw poison.error;\n    }\n    try {\n      return verifySerialized(serializedUtf8, id, pubkey, sig);\n    } catch (error) {\n      if (error instanceof WebAssembly.RuntimeError) {\n        poison.error = new WasmVerifyPoisonedError(\"wasm verify aborted the instance\", {\n          cause: error,\n        });\n        throw poison.error;\n      }\n      return false;\n    }\n  };\n  return createEventVerifier(backend);\n}\n","import { CryptoError } from \"../core/error.ts\";\nimport type { Event } from \"../core/event.ts\";\nimport type { SigningBackend } from \"../core/key.ts\";\nimport {\n  instantiateCryptoWasm,\n  wasmPublicKey,\n  wasmSign,\n  wasmVerify,\n  wasmVerifySerialized,\n} from \"./abi.ts\";\nimport type { CryptoWasmExports } from \"./abi.ts\";\nimport { createWasmEventVerifier, WasmVerifyPoisonedError } from \"./adapter.ts\";\n\nexport { WasmVerifyPoisonedError } from \"./adapter.ts\";\nexport type LoadNostrWasmOptions = {\n  /** Bytes, or a URL whose bytes will be read (Node fs for file:; fetch otherwise). */\n  module?: ArrayBuffer | ArrayBufferView | URL;\n};\n\nexport type NostrWasm = SigningBackend & {\n  verify: (id: Uint8Array, pubkey: Uint8Array, sig: Uint8Array) => boolean;\n  verifySerialized: (\n    serializedUtf8: Uint8Array,\n    id: Uint8Array,\n    pubkey: Uint8Array,\n    sig: Uint8Array,\n  ) => boolean;\n  verifyEvent: (event: Event) => boolean;\n};\n\nlet interned: Promise<NostrWasm> | undefined;\n\nfunction isNode(): boolean {\n  if (!(\"process\" in globalThis)) {\n    return false;\n  }\n  const proc: unknown = globalThis.process;\n  return (\n    typeof proc === \"object\" &&\n    proc !== null &&\n    \"versions\" in proc &&\n    typeof proc.versions === \"object\" &&\n    proc.versions !== null &&\n    \"node\" in proc.versions &&\n    typeof proc.versions.node === \"string\"\n  );\n}\n\nfunction isWasmBytes(value: unknown): value is ArrayBuffer | ArrayBufferView {\n  return value instanceof ArrayBuffer || ArrayBuffer.isView(value);\n}\n\nasync function defaultWasmHref(): Promise<string> {\n  const mod = await import(\"./nostr_crypto_wasm_bg.wasm?url\");\n  return mod.default;\n}\n\nasync function readWasmUrl(url: URL): Promise<Uint8Array> {\n  if (isNode() && url.protocol === \"file:\") {\n    const { readFile } = await import(\"node:fs/promises\");\n    const { fileURLToPath } = await import(\"node:url\");\n    return new Uint8Array(await readFile(fileURLToPath(url)));\n  }\n  const res = await fetch(url);\n  if (!res.ok) {\n    throw new CryptoError(`failed to fetch wasm: ${res.status} ${url.href}`);\n  }\n  return new Uint8Array(await res.arrayBuffer());\n}\n\nasync function wasmBytes(opts?: LoadNostrWasmOptions): Promise<ArrayBuffer | ArrayBufferView> {\n  const source = opts?.module;\n  if (source !== undefined && isWasmBytes(source)) {\n    return source;\n  }\n  const href = source instanceof URL ? source : new URL(await defaultWasmHref(), import.meta.url);\n  return readWasmUrl(href);\n}\n\nfunction requireByteLength(bytes: Uint8Array, expected: number, label: string): void {\n  if (bytes.length !== expected) {\n    throw new CryptoError(`invalid ${label} length: expected ${expected}, got ${bytes.length}`);\n  }\n}\n\nfunction wrapPoison<T>(poison: { error?: Error }, fn: () => T): T {\n  if (poison.error) {\n    throw poison.error;\n  }\n  try {\n    return fn();\n  } catch (error) {\n    if (error instanceof WebAssembly.RuntimeError) {\n      poison.error = new WasmVerifyPoisonedError(\"wasm verify aborted the instance\", {\n        cause: error,\n      });\n      throw poison.error;\n    }\n    throw error;\n  }\n}\n\nfunction bindExports(exports: CryptoWasmExports): NostrWasm {\n  const poison: { error?: Error } = {};\n  const rawSerialized = (\n    serializedUtf8: Uint8Array,\n    id: Uint8Array,\n    pubkey: Uint8Array,\n    sig: Uint8Array,\n  ): boolean => wasmVerifySerialized(exports, serializedUtf8, id, pubkey, sig);\n  return {\n    verify: (id, pubkey, sig) => wrapPoison(poison, () => wasmVerify(exports, id, pubkey, sig)),\n    verifySerialized: (serializedUtf8, id, pubkey, sig) =>\n      wrapPoison(poison, () => rawSerialized(serializedUtf8, id, pubkey, sig)),\n    verifyEvent: createWasmEventVerifier(rawSerialized, poison),\n    sign: (id, seckey, aux) =>\n      wrapPoison(poison, () => {\n        requireByteLength(id, 32, \"id\");\n        requireByteLength(seckey, 32, \"secret key\");\n        requireByteLength(aux, 32, \"aux\");\n        const sig = wasmSign(exports, id, seckey, aux);\n        if (sig.length !== 64) {\n          throw new CryptoError(\"wasm sign failed\");\n        }\n        return sig;\n      }),\n    publicKey: (seckey) =>\n      wrapPoison(poison, () => {\n        requireByteLength(seckey, 32, \"secret key\");\n        const pk = wasmPublicKey(exports, seckey);\n        if (pk.length !== 32) {\n          throw new CryptoError(\"wasm publicKey failed\");\n        }\n        return pk;\n      }),\n  };\n}\n\nasync function instantiateNostrWasm(opts?: LoadNostrWasmOptions): Promise<NostrWasm> {\n  const bytes = await wasmBytes(opts);\n  const exports = await instantiateCryptoWasm(bytes);\n  return bindExports(exports);\n}\n\n/** Instantiate once. Repeats reuse the same module. Failure throws; no noble fallback. */\nexport async function loadNostrWasm(opts?: LoadNostrWasmOptions): Promise<NostrWasm> {\n  if (interned) {\n    return interned;\n  }\n  const pending = instantiateNostrWasm(opts);\n  interned = pending;\n  try {\n    return await pending;\n  } catch (error) {\n    if (interned === pending) {\n      interned = undefined;\n    }\n    throw error;\n  }\n}\n\n/** Clears intern so tests can re-instantiate. Not exported from the wasm subpath. */\nexport function resetNostrWasmForTests(): void {\n  interned = undefined;\n}\n"],"mappings":";;;;AAwCA,MAAa,uBAAwE,CACnF;CAAE,QAAQ;CAAO,MAAM;AAAmB,GAC1C;CAAE,QAAQ;CAA6B,MAAM;AAAmB,CAClE;AAEA,MAAM,OAAO,IAAI,YAAY;AAE7B,SAAS,WAAW,QAA4B,KAAa,KAAqB;CAChF,OAAO,KAAK,OAAO,IAAI,WAAW,OAAO,QAAQ,KAAK,GAAG,CAAC;AAC5D;AAEA,SAAS,eAAe,QAA8D;CACpF,MAAM,gBAAgB,KAAa,QAAuB;EACxD,MAAM,MAAM,OAAO,SAAS;EAC5B,MAAM,MAAM,MAAM,WAAW,KAAK,KAAK,GAAG,IAAI;EAC9C,MAAM,IAAI,YAAY,aAAa,GAAG;CACxC;CACA,MAAM,MAAM,EACV,kBAAkB,aACpB;CACA,OAAO;EACL;EACA,6BAA6B;CAC/B;AACF;;AAGA,SAAgB,yBAAyB,KAA+B;CACtE,MAAM,UAAU,IAAI,IAAI,qBAAqB,KAAK,SAAS,GAAG,KAAK,OAAO,IAAI,KAAK,MAAM,CAAC;CAC1F,KAAK,MAAM,OAAO,YAAY,OAAO,QAAQ,GAAG,GAAG;EACjD,IAAI,IAAI,SAAS,YACf,MAAM,IAAI,UAAU,+BAA+B,IAAI,KAAK,IAAI,IAAI,OAAO,GAAG,IAAI,MAAM;EAE1F,IAAI,CAAC,QAAQ,IAAI,GAAG,IAAI,OAAO,IAAI,IAAI,MAAM,GAC3C,MAAM,IAAI,UAAU,0BAA0B,IAAI,OAAO,GAAG,IAAI,MAAM;CAE1E;AACF;AAEA,SAAS,cAAc,OAAgE;CACrF,IAAI,EAAE,iBAAiB,YAAY,SACjC,MAAM,IAAI,UAAU,4BAA4B;CAElD,OAAO;AACT;AAGA,SAAS,UACP,OACA,MACG;CACH,IAAI,OAAO,UAAU,YACnB,MAAM,IAAI,UAAU,gBAAgB,KAAK,QAAQ;CAGnD,OAAO;AACT;AAEA,SAAS,UAAU,KAA6C;CAC9D,MAAM,UAA6B;EACjC,QAAQ,cAAc,IAAI,SAAS;EACnC,QAAQ,UAAU,IAAI,WAAW,QAAQ;EACzC,mBAAmB,UAAU,IAAI,sBAAsB,mBAAmB;EAC1E,MAAM,UAAU,IAAI,SAAS,MAAM;EACnC,YAAY,UAAU,IAAI,eAAe,YAAY;EACrD,mBAAmB,UAAU,IAAI,sBAAsB,mBAAmB;EAC1E,oBAAoB,UAAU,IAAI,uBAAuB,oBAAoB;EAC7E,iCAAiC,UAC/B,IAAI,oCACJ,iCACF;CACF;CACA,MAAM,QAAQ,IAAI;CAClB,IAAI,OAAO,UAAU,YACnB,QAAQ,mBAAmB,UAAsB,OAAO,kBAAkB;CAE5E,OAAO;AACT;AAEA,SAAS,UAAU,SAA4B,OAAiD;CAC9F,MAAM,MAAM,MAAM;CAClB,MAAM,MAAM,QAAQ,kBAAkB,KAAK,CAAC,MAAM;CAClD,IAAI,WAAW,QAAQ,OAAO,QAAQ,KAAK,GAAG,CAAC,CAAC,IAAI,KAAK;CACzD,OAAO;EAAE;EAAK;CAAI;AACpB;AAEA,SAAgB,WACd,SACA,IACA,QACA,KACS;CACT,MAAM,MAAM,UAAU,SAAS,EAAE;CACjC,MAAM,MAAM,UAAU,SAAS,MAAM;CACrC,MAAM,OAAO,UAAU,SAAS,GAAG;CACnC,OAAO,QAAQ,OAAO,IAAI,KAAK,IAAI,KAAK,IAAI,KAAK,IAAI,KAAK,KAAK,KAAK,KAAK,GAAG,MAAM;AACpF;AAEA,SAAgB,qBACd,SACA,YACA,IACA,QACA,KACS;CACT,MAAM,OAAO,UAAU,SAAS,UAAU;CAC1C,MAAM,MAAM,UAAU,SAAS,EAAE;CACjC,MAAM,MAAM,UAAU,SAAS,MAAM;CACrC,MAAM,OAAO,UAAU,SAAS,GAAG;CACnC,OACE,QAAQ,kBACN,KAAK,KACL,KAAK,KACL,IAAI,KACJ,IAAI,KACJ,IAAI,KACJ,IAAI,KACJ,KAAK,KACL,KAAK,GACP,MAAM;AAEV;AAEA,SAAS,UAAU,SAA4B,KAAa,KAAyB;CACnF,MAAM,MAAM,IAAI,WAAW,GAAG;CAC9B,IAAI,MAAM,GAAG;EACX,IAAI,IAAI,IAAI,WAAW,QAAQ,OAAO,QAAQ,KAAK,GAAG,CAAC;EACvD,QAAQ,mBAAmB,KAAK,KAAK,CAAC;CACxC;CACA,OAAO;AACT;AAEA,SAAS,mBACP,SACA,QACY;CACZ,MAAM,SAAS,QAAQ,gCAAgC,GAAG;CAC1D,IAAI;EACF,OAAO,MAAM;EACb,MAAM,OAAO,IAAI,SAAS,QAAQ,OAAO,MAAM;EAG/C,OAAO,UAAU,SAFL,KAAK,UAAU,QAAQ,IAEP,GADhB,KAAK,UAAU,SAAS,GAAG,IACN,CAAC;CACpC,UAAU;EACR,QAAQ,gCAAgC,EAAE;CAC5C;AACF;AAEA,SAAgB,SACd,SACA,IACA,QACA,KACY;CACZ,MAAM,MAAM,UAAU,SAAS,EAAE;CACjC,MAAM,MAAM,UAAU,SAAS,MAAM;CACrC,MAAM,OAAO,UAAU,SAAS,GAAG;CACnC,OAAO,mBAAmB,UAAU,WAAW;EAC7C,QAAQ,KAAK,QAAQ,IAAI,KAAK,IAAI,KAAK,IAAI,KAAK,IAAI,KAAK,KAAK,KAAK,KAAK,GAAG;CAC7E,CAAC;AACH;AAEA,SAAgB,cAAc,SAA4B,QAAgC;CACxF,MAAM,MAAM,UAAU,SAAS,MAAM;CACrC,OAAO,mBAAmB,UAAU,WAAW;EAC7C,QAAQ,WAAW,QAAQ,IAAI,KAAK,IAAI,GAAG;CAC7C,CAAC;AACH;AAEA,eAAsB,sBACpB,OAC4B;CAC5B,MAAM,SAA0C,CAAC;CACjD,MAAM,EAAE,QAAQ,aAAa,MAAM,YAAY,YAAY,OAAO,eAAe,MAAM,CAAC;CACxF,yBAAyB,MAAM;CAC/B,OAAO,UAAU,UAAU,SAAS,OAAO;CAC3C,OAAO,QAAQ,mBAAmB;CAClC,OAAO,OAAO;AAChB;;;;;;;;;AC7MA,SAAgB,wBACd,kBACA,QAC2B;CAC3B,MAAM,WAAoC,gBAAgB,IAAI,QAAQ,QAAQ;EAC5E,IAAI,OAAO,UAAU,KAAA,GACnB,MAAM,OAAO;EAEf,IAAI;GACF,OAAO,iBAAiB,gBAAgB,IAAI,QAAQ,GAAG;EACzD,SAAS,OAAO;GACd,IAAI,iBAAiB,YAAY,cAAc;IAC7C,OAAO,QAAQ,IAAI,wBAAwB,oCAAoC,EAC7E,OAAO,MACT,CAAC;IACD,MAAM,OAAO;GACf;GACA,OAAO;EACT;CACF;CACA,OAAO,oBAAoB,OAAO;AACpC;;;ACJA,IAAI;AAEJ,SAAS,SAAkB;CACzB,IAAI,EAAE,aAAa,aACjB,OAAO;CAET,MAAM,OAAgB,WAAW;CACjC,OACE,OAAO,SAAS,YAChB,SAAS,QACT,cAAc,QACd,OAAO,KAAK,aAAa,YACzB,KAAK,aAAa,QAClB,UAAU,KAAK,YACf,OAAO,KAAK,SAAS,SAAS;AAElC;AAEA,SAAS,YAAY,OAAwD;CAC3E,OAAO,iBAAiB,eAAe,YAAY,OAAO,KAAK;AACjE;AAEA,eAAe,kBAAmC;CAEhD,QAAO,MADW,OAAO,uCAAA,CACd;AACb;AAEA,eAAe,YAAY,KAA+B;CACxD,IAAI,OAAO,KAAK,IAAI,aAAa,SAAS;EACxC,MAAM,EAAE,aAAa,MAAM,OAAO;EAClC,MAAM,EAAE,kBAAkB,MAAM,OAAO;EACvC,OAAO,IAAI,WAAW,MAAM,SAAS,cAAc,GAAG,CAAC,CAAC;CAC1D;CACA,MAAM,MAAM,MAAM,MAAM,GAAG;CAC3B,IAAI,CAAC,IAAI,IACP,MAAM,IAAI,YAAY,yBAAyB,IAAI,OAAO,GAAG,IAAI,MAAM;CAEzE,OAAO,IAAI,WAAW,MAAM,IAAI,YAAY,CAAC;AAC/C;AAEA,eAAe,UAAU,MAAqE;CAC5F,MAAM,SAAS,MAAM;CACrB,IAAI,WAAW,KAAA,KAAa,YAAY,MAAM,GAC5C,OAAO;CAGT,OAAO,YADM,kBAAkB,MAAM,SAAS,IAAI,IAAI,MAAM,gBAAgB,GAAG,YAAY,GAAG,CACvE;AACzB;AAEA,SAAS,kBAAkB,OAAmB,UAAkB,OAAqB;CACnF,IAAI,MAAM,WAAW,UACnB,MAAM,IAAI,YAAY,WAAW,MAAM,oBAAoB,SAAS,QAAQ,MAAM,QAAQ;AAE9F;AAEA,SAAS,WAAc,QAA2B,IAAgB;CAChE,IAAI,OAAO,OACT,MAAM,OAAO;CAEf,IAAI;EACF,OAAO,GAAG;CACZ,SAAS,OAAO;EACd,IAAI,iBAAiB,YAAY,cAAc;GAC7C,OAAO,QAAQ,IAAI,wBAAwB,oCAAoC,EAC7E,OAAO,MACT,CAAC;GACD,MAAM,OAAO;EACf;EACA,MAAM;CACR;AACF;AAEA,SAAS,YAAY,SAAuC;CAC1D,MAAM,SAA4B,CAAC;CACnC,MAAM,iBACJ,gBACA,IACA,QACA,QACY,qBAAqB,SAAS,gBAAgB,IAAI,QAAQ,GAAG;CAC3E,OAAO;EACL,SAAS,IAAI,QAAQ,QAAQ,WAAW,cAAc,WAAW,SAAS,IAAI,QAAQ,GAAG,CAAC;EAC1F,mBAAmB,gBAAgB,IAAI,QAAQ,QAC7C,WAAW,cAAc,cAAc,gBAAgB,IAAI,QAAQ,GAAG,CAAC;EACzE,aAAa,wBAAwB,eAAe,MAAM;EAC1D,OAAO,IAAI,QAAQ,QACjB,WAAW,cAAc;GACvB,kBAAkB,IAAI,IAAI,IAAI;GAC9B,kBAAkB,QAAQ,IAAI,YAAY;GAC1C,kBAAkB,KAAK,IAAI,KAAK;GAChC,MAAM,MAAM,SAAS,SAAS,IAAI,QAAQ,GAAG;GAC7C,IAAI,IAAI,WAAW,IACjB,MAAM,IAAI,YAAY,kBAAkB;GAE1C,OAAO;EACT,CAAC;EACH,YAAY,WACV,WAAW,cAAc;GACvB,kBAAkB,QAAQ,IAAI,YAAY;GAC1C,MAAM,KAAK,cAAc,SAAS,MAAM;GACxC,IAAI,GAAG,WAAW,IAChB,MAAM,IAAI,YAAY,uBAAuB;GAE/C,OAAO;EACT,CAAC;CACL;AACF;AAEA,eAAe,qBAAqB,MAAiD;CAGnF,OAAO,YAAY,MADG,sBAAsB,MADxB,UAAU,IAAI,CACe,CACvB;AAC5B;;AAGA,eAAsB,cAAc,MAAiD;CACnF,IAAI,UACF,OAAO;CAET,MAAM,UAAU,qBAAqB,IAAI;CACzC,WAAW;CACX,IAAI;EACF,OAAO,MAAM;CACf,SAAS,OAAO;EACd,IAAI,aAAa,SACf,WAAW,KAAA;EAEb,MAAM;CACR;AACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@qntx/nostr",
-  "version": "0.2.2",
+  "version": "0.3.0",
   "description": "Nostr protocol implementation and SDK in TypeScript",
   "keywords": [
     "decentralized",

package/dist/key-BZBap2p-.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"key-BZBap2p-.mjs","names":[],"sources":["../src/core/key.ts"],"sourcesContent":["import { schnorr } from \"@noble/curves/secp256k1.js\";\n\nimport { CryptoError } from \"./error.ts\";\nimport { getEventHash, markVerified, validateEvent } from \"./event.ts\";\nimport type { Event, EventTemplate, UnsignedEvent } from \"./event.ts\";\nimport { assertHex32, assertSecretKeyBytes, bytesToHex, hexToBytes } from \"./util.ts\";\n\n/** 32-byte secret key held as bytes; prefer zeroize when done. */\nexport class SecretKey {\n  #bytes: Uint8Array | undefined;\n\n  private constructor(bytes: Uint8Array) {\n    assertSecretKeyBytes(bytes);\n    this.#bytes = new Uint8Array(bytes);\n  }\n\n  static generate(): SecretKey {\n    return new SecretKey(schnorr.utils.randomSecretKey());\n  }\n\n  static fromBytes(bytes: Uint8Array): SecretKey {\n    return new SecretKey(bytes);\n  }\n\n  static fromHex(hex: string): SecretKey {\n    return new SecretKey(hexToBytes(assertHex32(hex, \"secret key\")));\n  }\n\n  get bytes(): Uint8Array {\n    if (!this.#bytes) {\n      throw new CryptoError(\"secret key has been zeroized\");\n    }\n    return new Uint8Array(this.#bytes);\n  }\n\n  toHex(): string {\n    return bytesToHex(this.bytes);\n  }\n\n  /** Best-effort wipe of the internal buffer. */\n  zeroize(): void {\n    if (this.#bytes) {\n      this.#bytes.fill(0);\n      this.#bytes = undefined;\n    }\n  }\n}\n\n/** Lowercase hex-encoded secp256k1 public key (x-only, 64 chars). */\nexport type PublicKey = string;\n\n/** Validate and normalize a hex public key; throws {@link HexError} on bad input. */\nexport function publicKeyFromHex(hex: string): PublicKey {\n  return assertHex32(hex, \"public key\");\n}\n\n/** Derive the public key for a secret key given as SecretKey, bytes, or hex. */\nexport function getPublicKey(secretKey: SecretKey | Uint8Array | string): PublicKey {\n  const bytes =\n    secretKey instanceof SecretKey\n      ? secretKey.bytes\n      : typeof secretKey === \"string\"\n        ? hexToBytes(assertHex32(secretKey, \"secret key\"))\n        : (assertSecretKeyBytes(secretKey), secretKey);\n  return bytesToHex(schnorr.getPublicKey(bytes));\n}\n\n/** Keypair convenience wrapper. */\nexport class Keys {\n  readonly secretKey: SecretKey;\n  readonly publicKey: PublicKey;\n\n  private constructor(secretKey: SecretKey) {\n    this.secretKey = secretKey;\n    this.publicKey = getPublicKey(secretKey);\n  }\n\n  static generate(): Keys {\n    return new Keys(SecretKey.generate());\n  }\n\n  static fromSecretKey(secretKey: SecretKey | Uint8Array | string): Keys {\n    const sk =\n      secretKey instanceof SecretKey\n        ? secretKey\n        : typeof secretKey === \"string\"\n          ? SecretKey.fromHex(secretKey)\n          : SecretKey.fromBytes(secretKey);\n    return new Keys(sk);\n  }\n}\n\nfunction resolveSecretKeyBytes(secretKey: SecretKey | Uint8Array | string): Uint8Array {\n  if (secretKey instanceof SecretKey) {\n    return secretKey.bytes;\n  }\n  if (typeof secretKey === \"string\") {\n    return hexToBytes(assertHex32(secretKey, \"secret key\"));\n  }\n  assertSecretKeyBytes(secretKey);\n  return secretKey;\n}\n\nfunction resolveSigningKey(secretKey: SecretKey | Uint8Array | string | Keys): {\n  bytes: Uint8Array;\n  publicKey?: PublicKey;\n} {\n  if (secretKey instanceof Keys) {\n    return { bytes: secretKey.secretKey.bytes, publicKey: secretKey.publicKey };\n  }\n  return { bytes: resolveSecretKeyBytes(secretKey) };\n}\n\n/** Fill pubkey/id/sig on a template and return a signed event. */\nexport function finalizeEvent(\n  template: EventTemplate,\n  secretKey: SecretKey | Uint8Array | string | Keys,\n): Event {\n  const { bytes: sk, publicKey } = resolveSigningKey(secretKey);\n  const pubkey = publicKey ?? bytesToHex(schnorr.getPublicKey(sk));\n  const unsigned: UnsignedEvent = {\n    kind: template.kind,\n    tags: template.tags,\n    content: template.content,\n    created_at: template.created_at,\n    pubkey,\n  };\n  return signEvent(unsigned, sk);\n}\n\n/**\n * Sign an already-assembled unsigned event. Rejects when `unsigned.pubkey` does not match the\n * secret key.\n */\nexport function signEvent(\n  unsigned: UnsignedEvent,\n  secretKey: SecretKey | Uint8Array | string | Keys,\n): Event {\n  const { bytes: sk, publicKey } = resolveSigningKey(secretKey);\n  if (!validateEvent(unsigned)) {\n    throw new CryptoError(\"cannot sign invalid unsigned event\");\n  }\n\n  const expected = publicKey ?? bytesToHex(schnorr.getPublicKey(sk));\n  if (unsigned.pubkey !== expected) {\n    throw new CryptoError(\"unsigned event pubkey does not match secret key\");\n  }\n\n  const normalized: UnsignedEvent = {\n    kind: unsigned.kind,\n    tags: unsigned.tags,\n    content: unsigned.content,\n    created_at: unsigned.created_at,\n    pubkey: expected,\n  };\n\n  const id = getEventHash(normalized);\n  const sig = bytesToHex(schnorr.sign(hexToBytes(id), sk));\n  const event: Event = { ...normalized, id, sig };\n  markVerified(event);\n  return event;\n}\n"],"mappings":";;;;;AAQA,IAAa,YAAb,MAAa,UAAU;CACrB;CAEA,YAAoB,OAAmB;EACrC,qBAAqB,KAAK;EAC1B,KAAK,SAAS,IAAI,WAAW,KAAK;CACpC;CAEA,OAAO,WAAsB;EAC3B,OAAO,IAAI,UAAU,QAAQ,MAAM,gBAAgB,CAAC;CACtD;CAEA,OAAO,UAAU,OAA8B;EAC7C,OAAO,IAAI,UAAU,KAAK;CAC5B;CAEA,OAAO,QAAQ,KAAwB;EACrC,OAAO,IAAI,UAAU,WAAW,YAAY,KAAK,YAAY,CAAC,CAAC;CACjE;CAEA,IAAI,QAAoB;EACtB,IAAI,CAAC,KAAK,QACR,MAAM,IAAI,YAAY,8BAA8B;EAEtD,OAAO,IAAI,WAAW,KAAK,MAAM;CACnC;CAEA,QAAgB;EACd,OAAO,WAAW,KAAK,KAAK;CAC9B;;CAGA,UAAgB;EACd,IAAI,KAAK,QAAQ;GACf,KAAK,OAAO,KAAK,CAAC;GAClB,KAAK,SAAS,KAAA;EAChB;CACF;AACF;;AAMA,SAAgB,iBAAiB,KAAwB;CACvD,OAAO,YAAY,KAAK,YAAY;AACtC;;AAGA,SAAgB,aAAa,WAAuD;CAClF,MAAM,QACJ,qBAAqB,YACjB,UAAU,QACV,OAAO,cAAc,WACnB,WAAW,YAAY,WAAW,YAAY,CAAC,KAC9C,qBAAqB,SAAS,GAAG;CAC1C,OAAO,WAAW,QAAQ,aAAa,KAAK,CAAC;AAC/C;;AAGA,IAAa,OAAb,MAAa,KAAK;CAChB;CACA;CAEA,YAAoB,WAAsB;EACxC,KAAK,YAAY;EACjB,KAAK,YAAY,aAAa,SAAS;CACzC;CAEA,OAAO,WAAiB;EACtB,OAAO,IAAI,KAAK,UAAU,SAAS,CAAC;CACtC;CAEA,OAAO,cAAc,WAAkD;EACrE,MAAM,KACJ,qBAAqB,YACjB,YACA,OAAO,cAAc,WACnB,UAAU,QAAQ,SAAS,IAC3B,UAAU,UAAU,SAAS;EACrC,OAAO,IAAI,KAAK,EAAE;CACpB;AACF;AAEA,SAAS,sBAAsB,WAAwD;CACrF,IAAI,qBAAqB,WACvB,OAAO,UAAU;CAEnB,IAAI,OAAO,cAAc,UACvB,OAAO,WAAW,YAAY,WAAW,YAAY,CAAC;CAExD,qBAAqB,SAAS;CAC9B,OAAO;AACT;AAEA,SAAS,kBAAkB,WAGzB;CACA,IAAI,qBAAqB,MACvB,OAAO;EAAE,OAAO,UAAU,UAAU;EAAO,WAAW,UAAU;CAAU;CAE5E,OAAO,EAAE,OAAO,sBAAsB,SAAS,EAAE;AACnD;;AAGA,SAAgB,cACd,UACA,WACO;CACP,MAAM,EAAE,OAAO,IAAI,cAAc,kBAAkB,SAAS;CAC5D,MAAM,SAAS,aAAa,WAAW,QAAQ,aAAa,EAAE,CAAC;CAQ/D,OAAO,UAAU;EANf,MAAM,SAAS;EACf,MAAM,SAAS;EACf,SAAS,SAAS;EAClB,YAAY,SAAS;EACrB;CAEsB,GAAG,EAAE;AAC/B;;;;;AAMA,SAAgB,UACd,UACA,WACO;CACP,MAAM,EAAE,OAAO,IAAI,cAAc,kBAAkB,SAAS;CAC5D,IAAI,CAAC,cAAc,QAAQ,GACzB,MAAM,IAAI,YAAY,oCAAoC;CAG5D,MAAM,WAAW,aAAa,WAAW,QAAQ,aAAa,EAAE,CAAC;CACjE,IAAI,SAAS,WAAW,UACtB,MAAM,IAAI,YAAY,iDAAiD;CAGzE,MAAM,aAA4B;EAChC,MAAM,SAAS;EACf,MAAM,SAAS;EACf,SAAS,SAAS;EAClB,YAAY,SAAS;EACrB,QAAQ;CACV;CAEA,MAAM,KAAK,aAAa,UAAU;CAClC,MAAM,MAAM,WAAW,QAAQ,KAAK,WAAW,EAAE,GAAG,EAAE,CAAC;CACvD,MAAM,QAAe;EAAE,GAAG;EAAY;EAAI;CAAI;CAC9C,aAAa,KAAK;CAClB,OAAO;AACT"}