@qntx/nostr 0.5.0 → 0.7.0

package/dist/instance-BcKzxHIP.mjs

@@ -0,0 +1,220 @@
+import { b as WasmPoisonedError, m as CryptoError } from "./util-yFYzlbrm.mjs";
+import { t as createEventVerifier } from "./verifier-BTLOpo1n.mjs";
+//#region src/wasm/abi.ts
+/** Imports 0.2.122 may request. Instantiation fails if anything else appears. */
+const ALLOWED_WASM_IMPORTS = [{
+	module: "wbg",
+	name: "__wbindgen_throw"
+}, {
+	module: "./nostr_crypto_wasm_bg.js",
+	name: "__wbindgen_throw"
+}];
+const utf8 = new TextDecoder();
+function decodeUtf8(memory, ptr, len) {
+	return utf8.decode(new Uint8Array(memory.buffer, ptr, len));
+}
+function makeWbgImports(holder) {
+	const throwRuntime = (ptr, len) => {
+		const mem = holder.exports?.memory;
+		const msg = mem ? decodeUtf8(mem, ptr, len) : "wasm panic";
+		throw new WebAssembly.RuntimeError(msg);
+	};
+	const wbg = { __wbindgen_throw: throwRuntime };
+	return {
+		wbg,
+		"./nostr_crypto_wasm_bg.js": wbg
+	};
+}
+/** Fail if the module imports anything outside {@link ALLOWED_WASM_IMPORTS}. */
+function assertAllowedWasmImports(mod) {
+	const allowed = new Set(ALLOWED_WASM_IMPORTS.map((item) => `${item.module}\0${item.name}`));
+	for (const imp of WebAssembly.Module.imports(mod)) {
+		if (imp.kind !== "function") throw new TypeError(`unexpected wasm import kind ${imp.kind}: ${imp.module}.${imp.name}`);
+		if (!allowed.has(`${imp.module}\0${imp.name}`)) throw new TypeError(`unexpected wasm import ${imp.module}.${imp.name}`);
+	}
+}
+function requireMemory(value) {
+	if (!(value instanceof WebAssembly.Memory)) throw new TypeError("wasm missing memory export");
+	return value;
+}
+function requireFn(value, name) {
+	if (typeof value !== "function") throw new TypeError(`wasm missing ${name} export`);
+	return value;
+}
+function asExports(raw) {
+	const exports = {
+		memory: requireMemory(raw["memory"]),
+		verify: requireFn(raw["verify"], "verify"),
+		verify_serialized: requireFn(raw["verify_serialized"], "verify_serialized"),
+		sign: requireFn(raw["sign"], "sign"),
+		public_key: requireFn(raw["public_key"], "public_key"),
+		__wbindgen_export: requireFn(raw["__wbindgen_export"], "__wbindgen_export"),
+		__wbindgen_export2: requireFn(raw["__wbindgen_export2"], "__wbindgen_export2"),
+		__wbindgen_add_to_stack_pointer: requireFn(raw["__wbindgen_add_to_stack_pointer"], "__wbindgen_add_to_stack_pointer")
+	};
+	const start = raw["__wbindgen_start"];
+	if (typeof start === "function") exports.__wbindgen_start = requireFn(start, "__wbindgen_start");
+	return exports;
+}
+function passBytes(exports, bytes) {
+	const len = bytes.length;
+	const ptr = exports.__wbindgen_export(len, 1) >>> 0;
+	new Uint8Array(exports.memory.buffer, ptr, len).set(bytes);
+	return {
+		ptr,
+		len
+	};
+}
+function wasmVerify(exports, id, pubkey, sig) {
+	const idP = passBytes(exports, id);
+	const pkP = passBytes(exports, pubkey);
+	const sigP = passBytes(exports, sig);
+	return exports.verify(idP.ptr, idP.len, pkP.ptr, pkP.len, sigP.ptr, sigP.len) !== 0;
+}
+function wasmVerifySerialized(exports, serialized, id, pubkey, sig) {
+	const serP = passBytes(exports, serialized);
+	const idP = passBytes(exports, id);
+	const pkP = passBytes(exports, pubkey);
+	const sigP = passBytes(exports, sig);
+	return exports.verify_serialized(serP.ptr, serP.len, idP.ptr, idP.len, pkP.ptr, pkP.len, sigP.ptr, sigP.len) !== 0;
+}
+function takeBytes(exports, ptr, len) {
+	const out = new Uint8Array(len);
+	if (len > 0) {
+		out.set(new Uint8Array(exports.memory.buffer, ptr, len));
+		exports.__wbindgen_export2(ptr, len, 1);
+	}
+	return out;
+}
+function callReturningBytes(exports, invoke) {
+	const retptr = exports.__wbindgen_add_to_stack_pointer(-16);
+	try {
+		invoke(retptr);
+		const view = new DataView(exports.memory.buffer);
+		return takeBytes(exports, view.getUint32(retptr, true), view.getUint32(retptr + 4, true));
+	} finally {
+		exports.__wbindgen_add_to_stack_pointer(16);
+	}
+}
+function wasmSign(exports, id, seckey, aux) {
+	const idP = passBytes(exports, id);
+	const skP = passBytes(exports, seckey);
+	const auxP = passBytes(exports, aux);
+	return callReturningBytes(exports, (retptr) => {
+		exports.sign(retptr, idP.ptr, idP.len, skP.ptr, skP.len, auxP.ptr, auxP.len);
+	});
+}
+function wasmPublicKey(exports, seckey) {
+	const skP = passBytes(exports, seckey);
+	return callReturningBytes(exports, (retptr) => {
+		exports.public_key(retptr, skP.ptr, skP.len);
+	});
+}
+async function instantiateCryptoWasm(bytes) {
+	const holder = {};
+	const { module, instance } = await WebAssembly.instantiate(bytes, makeWbgImports(holder));
+	assertAllowedWasmImports(module);
+	holder.exports = asExports(instance.exports);
+	holder.exports.__wbindgen_start?.();
+	return holder.exports;
+}
+//#endregion
+//#region src/wasm/adapter.ts
+/**
+* Run `fn` unless the instance is already poisoned; a `WebAssembly.RuntimeError` aborts the
+* instance, so it is converted to {@link WasmPoisonedError} and rethrown on every later call.
+*/
+function runPoisoned(poison, fn) {
+	if (poison.error !== void 0) throw poison.error;
+	try {
+		return fn();
+	} catch (error) {
+		if (error instanceof WebAssembly.RuntimeError) {
+			poison.error = new WasmPoisonedError("wasm instance aborted", { cause: error });
+			throw poison.error;
+		}
+		throw error;
+	}
+}
+/**
+* Build the WASM event verifier on {@link createEventVerifier}. A `WebAssembly.RuntimeError` from
+* the module means the instance aborted — it poisons every later call with the same
+* `WasmPoisonedError`; any other backend error verifies `false` (the event is marked failed).
+*/
+function createWasmEventVerifier(verifySerialized, poison) {
+	const backend = (serializedUtf8, id, pubkey, sig) => {
+		try {
+			return runPoisoned(poison, () => verifySerialized(serializedUtf8, id, pubkey, sig));
+		} catch (error) {
+			if (error instanceof WasmPoisonedError) throw error;
+			return false;
+		}
+	};
+	return createEventVerifier(backend);
+}
+//#endregion
+//#region src/wasm/instance.ts
+function isWasmBytes(value) {
+	return value instanceof ArrayBuffer || ArrayBuffer.isView(value);
+}
+async function fetchWasmUrl(url) {
+	const res = await fetch(url);
+	if (!res.ok) throw new CryptoError(`failed to fetch wasm: ${res.status} ${url.href}`);
+	return new Uint8Array(await res.arrayBuffer());
+}
+function requireByteLength(bytes, expected, label) {
+	if (bytes.length !== expected) throw new CryptoError(`invalid ${label} length: expected ${expected}, got ${bytes.length}`);
+}
+function bindExports(exports) {
+	const poison = {};
+	const rawSerialized = (serializedUtf8, id, pubkey, sig) => wasmVerifySerialized(exports, serializedUtf8, id, pubkey, sig);
+	return {
+		verify: (id, pubkey, sig) => runPoisoned(poison, () => wasmVerify(exports, id, pubkey, sig)),
+		verifySerialized: (serializedUtf8, id, pubkey, sig) => runPoisoned(poison, () => rawSerialized(serializedUtf8, id, pubkey, sig)),
+		verifyEvent: createWasmEventVerifier(rawSerialized, poison),
+		sign: (id, seckey, aux) => runPoisoned(poison, () => {
+			requireByteLength(id, 32, "id");
+			requireByteLength(seckey, 32, "secret key");
+			requireByteLength(aux, 32, "aux");
+			const sig = wasmSign(exports, id, seckey, aux);
+			if (sig.length !== 64) throw new CryptoError("wasm sign failed");
+			return sig;
+		}),
+		publicKey: (seckey) => runPoisoned(poison, () => {
+			requireByteLength(seckey, 32, "secret key");
+			const pk = wasmPublicKey(exports, seckey);
+			if (pk.length !== 32) throw new CryptoError("wasm publicKey failed");
+			return pk;
+		})
+	};
+}
+/** Builds a loader that interns a single instance per module slot. */
+function createNostrWasmLoader(wasmBytes) {
+	let interned;
+	async function instantiate(opts) {
+		return bindExports(await instantiateCryptoWasm(await wasmBytes(opts)));
+	}
+	/** Instantiate once. Repeats reuse the same module. Failure throws; no noble fallback. */
+	async function loadNostrWasm(opts) {
+		if (interned) return interned;
+		const pending = instantiate(opts);
+		interned = pending;
+		try {
+			return await pending;
+		} catch (error) {
+			if (interned === pending) interned = void 0;
+			throw error;
+		}
+	}
+	function resetNostrWasm() {
+		interned = void 0;
+	}
+	return {
+		loadNostrWasm,
+		resetNostrWasm
+	};
+}
+//#endregion
+export { fetchWasmUrl as n, isWasmBytes as r, createNostrWasmLoader as t };
+
+//# sourceMappingURL=instance-BcKzxHIP.mjs.map

package/dist/instance-BcKzxHIP.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"instance-BcKzxHIP.mjs","names":[],"sources":["../src/wasm/abi.ts","../src/wasm/adapter.ts","../src/wasm/instance.ts"],"sourcesContent":["/** Wasm-bindgen 0.2.122 bundler-produced exports used by interned TS glue. */\nexport type CryptoWasmExports = {\n  memory: WebAssembly.Memory;\n  verify: (\n    idPtr: number,\n    idLen: number,\n    pkPtr: number,\n    pkLen: number,\n    sigPtr: number,\n    sigLen: number,\n  ) => number;\n  verify_serialized: (\n    serPtr: number,\n    serLen: number,\n    idPtr: number,\n    idLen: number,\n    pkPtr: number,\n    pkLen: number,\n    sigPtr: number,\n    sigLen: number,\n  ) => number;\n  sign: (\n    retptr: number,\n    idPtr: number,\n    idLen: number,\n    skPtr: number,\n    skLen: number,\n    auxPtr: number,\n    auxLen: number,\n  ) => void;\n  public_key: (retptr: number, skPtr: number, skLen: number) => void;\n  /** 0.2.122 name for `__wbindgen_malloc(size, align)`. */\n  __wbindgen_export: (size: number, align: number) => number;\n  /** 0.2.122 name for `__wbindgen_free(ptr, size, align)` after malloc claimed `__wbindgen_export`. */\n  __wbindgen_export2: (ptr: number, size: number, align: number) => void;\n  __wbindgen_add_to_stack_pointer: (delta: number) => number;\n  __wbindgen_start?: () => void;\n};\n\n/** Imports 0.2.122 may request. Instantiation fails if anything else appears. */\nexport const ALLOWED_WASM_IMPORTS: ReadonlyArray<{ module: string; name: string }> = [\n  { module: \"wbg\", name: \"__wbindgen_throw\" },\n  { module: \"./nostr_crypto_wasm_bg.js\", name: \"__wbindgen_throw\" },\n];\n\nconst utf8 = new TextDecoder();\n\nfunction decodeUtf8(memory: WebAssembly.Memory, ptr: number, len: number): string {\n  return utf8.decode(new Uint8Array(memory.buffer, ptr, len));\n}\n\nfunction makeWbgImports(holder: { exports?: CryptoWasmExports }): WebAssembly.Imports {\n  const throwRuntime = (ptr: number, len: number): never => {\n    const mem = holder.exports?.memory;\n    const msg = mem ? decodeUtf8(mem, ptr, len) : \"wasm panic\";\n    throw new WebAssembly.RuntimeError(msg);\n  };\n  const wbg = {\n    __wbindgen_throw: throwRuntime,\n  };\n  return {\n    wbg,\n    \"./nostr_crypto_wasm_bg.js\": wbg,\n  };\n}\n\n/** Fail if the module imports anything outside {@link ALLOWED_WASM_IMPORTS}. */\nexport function assertAllowedWasmImports(mod: WebAssembly.Module): void {\n  const allowed = new Set(ALLOWED_WASM_IMPORTS.map((item) => `${item.module}\\0${item.name}`));\n  for (const imp of WebAssembly.Module.imports(mod)) {\n    if (imp.kind !== \"function\") {\n      throw new TypeError(`unexpected wasm import kind ${imp.kind}: ${imp.module}.${imp.name}`);\n    }\n    if (!allowed.has(`${imp.module}\\0${imp.name}`)) {\n      throw new TypeError(`unexpected wasm import ${imp.module}.${imp.name}`);\n    }\n  }\n}\n\nfunction requireMemory(value: WebAssembly.ExportValue | undefined): WebAssembly.Memory {\n  if (!(value instanceof WebAssembly.Memory)) {\n    throw new TypeError(\"wasm missing memory export\");\n  }\n  return value;\n}\n\n// oxlint-disable-next-line no-unnecessary-type-parameters -- T binds the declared ABI signature at each call site\nfunction requireFn<T extends (...args: number[]) => unknown>(\n  value: WebAssembly.ExportValue | undefined,\n  name: string,\n): T {\n  if (typeof value !== \"function\") {\n    throw new TypeError(`wasm missing ${name} export`);\n  }\n  // oxlint-disable-next-line no-unsafe-type-assertion -- wasm exports are opaque; each name is bound to the signature the ABI contract requires\n  return value as T;\n}\n\nfunction asExports(raw: WebAssembly.Exports): CryptoWasmExports {\n  const exports: CryptoWasmExports = {\n    memory: requireMemory(raw[\"memory\"]),\n    verify: requireFn(raw[\"verify\"], \"verify\"),\n    verify_serialized: requireFn(raw[\"verify_serialized\"], \"verify_serialized\"),\n    sign: requireFn(raw[\"sign\"], \"sign\"),\n    public_key: requireFn(raw[\"public_key\"], \"public_key\"),\n    __wbindgen_export: requireFn(raw[\"__wbindgen_export\"], \"__wbindgen_export\"),\n    __wbindgen_export2: requireFn(raw[\"__wbindgen_export2\"], \"__wbindgen_export2\"),\n    __wbindgen_add_to_stack_pointer: requireFn(\n      raw[\"__wbindgen_add_to_stack_pointer\"],\n      \"__wbindgen_add_to_stack_pointer\",\n    ),\n  };\n  const start = raw[\"__wbindgen_start\"];\n  if (typeof start === \"function\") {\n    exports.__wbindgen_start = requireFn<() => void>(start, \"__wbindgen_start\");\n  }\n  return exports;\n}\n\nfunction passBytes(exports: CryptoWasmExports, bytes: Uint8Array): { ptr: number; len: number } {\n  const len = bytes.length;\n  const ptr = exports.__wbindgen_export(len, 1) >>> 0;\n  new Uint8Array(exports.memory.buffer, ptr, len).set(bytes);\n  return { ptr, len };\n}\n\nexport function wasmVerify(\n  exports: CryptoWasmExports,\n  id: Uint8Array,\n  pubkey: Uint8Array,\n  sig: Uint8Array,\n): boolean {\n  const idP = passBytes(exports, id);\n  const pkP = passBytes(exports, pubkey);\n  const sigP = passBytes(exports, sig);\n  return exports.verify(idP.ptr, idP.len, pkP.ptr, pkP.len, sigP.ptr, sigP.len) !== 0;\n}\n\nexport function wasmVerifySerialized(\n  exports: CryptoWasmExports,\n  serialized: Uint8Array,\n  id: Uint8Array,\n  pubkey: Uint8Array,\n  sig: Uint8Array,\n): boolean {\n  const serP = passBytes(exports, serialized);\n  const idP = passBytes(exports, id);\n  const pkP = passBytes(exports, pubkey);\n  const sigP = passBytes(exports, sig);\n  return (\n    exports.verify_serialized(\n      serP.ptr,\n      serP.len,\n      idP.ptr,\n      idP.len,\n      pkP.ptr,\n      pkP.len,\n      sigP.ptr,\n      sigP.len,\n    ) !== 0\n  );\n}\n\nfunction takeBytes(exports: CryptoWasmExports, ptr: number, len: number): Uint8Array {\n  const out = new Uint8Array(len);\n  if (len > 0) {\n    out.set(new Uint8Array(exports.memory.buffer, ptr, len));\n    exports.__wbindgen_export2(ptr, len, 1);\n  }\n  return out;\n}\n\nfunction callReturningBytes(\n  exports: CryptoWasmExports,\n  invoke: (retptr: number) => void,\n): Uint8Array {\n  const retptr = exports.__wbindgen_add_to_stack_pointer(-16);\n  try {\n    invoke(retptr);\n    const view = new DataView(exports.memory.buffer);\n    const ptr = view.getUint32(retptr, true);\n    const len = view.getUint32(retptr + 4, true);\n    return takeBytes(exports, ptr, len);\n  } finally {\n    exports.__wbindgen_add_to_stack_pointer(16);\n  }\n}\n\nexport function wasmSign(\n  exports: CryptoWasmExports,\n  id: Uint8Array,\n  seckey: Uint8Array,\n  aux: Uint8Array,\n): Uint8Array {\n  const idP = passBytes(exports, id);\n  const skP = passBytes(exports, seckey);\n  const auxP = passBytes(exports, aux);\n  return callReturningBytes(exports, (retptr) => {\n    exports.sign(retptr, idP.ptr, idP.len, skP.ptr, skP.len, auxP.ptr, auxP.len);\n  });\n}\n\nexport function wasmPublicKey(exports: CryptoWasmExports, seckey: Uint8Array): Uint8Array {\n  const skP = passBytes(exports, seckey);\n  return callReturningBytes(exports, (retptr) => {\n    exports.public_key(retptr, skP.ptr, skP.len);\n  });\n}\n\nexport async function instantiateCryptoWasm(\n  bytes: ArrayBuffer | ArrayBufferView,\n): Promise<CryptoWasmExports> {\n  const holder: { exports?: CryptoWasmExports } = {};\n  const { module, instance } = await WebAssembly.instantiate(bytes, makeWbgImports(holder));\n  assertAllowedWasmImports(module);\n  holder.exports = asExports(instance.exports);\n  holder.exports.__wbindgen_start?.();\n  return holder.exports;\n}\n","import { WasmPoisonedError } from \"../core/error.ts\";\nimport { createEventVerifier } from \"../core/verifier.ts\";\nimport type { EventVerifier, SerializedEventVerifier } from \"../core/verifier.ts\";\n\nexport { WasmPoisonedError } from \"../core/error.ts\";\n\n/**\n * Run `fn` unless the instance is already poisoned; a `WebAssembly.RuntimeError` aborts the\n * instance, so it is converted to {@link WasmPoisonedError} and rethrown on every later call.\n */\nexport function runPoisoned<T>(poison: { error?: Error }, fn: () => T): T {\n  if (poison.error !== undefined) {\n    throw poison.error;\n  }\n  try {\n    return fn();\n  } catch (error) {\n    if (error instanceof WebAssembly.RuntimeError) {\n      poison.error = new WasmPoisonedError(\"wasm instance aborted\", {\n        cause: error,\n      });\n      throw poison.error;\n    }\n    throw error;\n  }\n}\n\n/**\n * Build the WASM event verifier on {@link createEventVerifier}. A `WebAssembly.RuntimeError` from\n * the module means the instance aborted — it poisons every later call with the same\n * `WasmPoisonedError`; any other backend error verifies `false` (the event is marked failed).\n */\nexport function createWasmEventVerifier(\n  verifySerialized: SerializedEventVerifier,\n  poison: { error?: Error },\n): EventVerifier {\n  const backend: SerializedEventVerifier = (serializedUtf8, id, pubkey, sig) => {\n    try {\n      return runPoisoned(poison, () => verifySerialized(serializedUtf8, id, pubkey, sig));\n    } catch (error) {\n      if (error instanceof WasmPoisonedError) {\n        throw error;\n      }\n      return false;\n    }\n  };\n  return createEventVerifier(backend);\n}\n","import { CryptoError } from \"../core/error.ts\";\nimport type { SigningBackend } from \"../core/key.ts\";\nimport type { EventVerifier } from \"../core/verifier.ts\";\nimport {\n  instantiateCryptoWasm,\n  wasmPublicKey,\n  wasmSign,\n  wasmVerify,\n  wasmVerifySerialized,\n} from \"./abi.ts\";\nimport type { CryptoWasmExports } from \"./abi.ts\";\nimport { createWasmEventVerifier, runPoisoned } from \"./adapter.ts\";\n\nexport type LoadNostrWasmOptions = {\n  /** Bytes, or a URL whose bytes will be read by the platform loader. */\n  module?: ArrayBuffer | ArrayBufferView | URL | undefined;\n};\n\nexport type NostrWasm = SigningBackend & {\n  verify: (id: Uint8Array, pubkey: Uint8Array, sig: Uint8Array) => boolean;\n  verifySerialized: (\n    serializedUtf8: Uint8Array,\n    id: Uint8Array,\n    pubkey: Uint8Array,\n    sig: Uint8Array,\n  ) => boolean;\n  verifyEvent: EventVerifier;\n};\n\nexport function isWasmBytes(value: unknown): value is ArrayBuffer | ArrayBufferView {\n  return value instanceof ArrayBuffer || ArrayBuffer.isView(value);\n}\n\nexport async function fetchWasmUrl(url: URL): Promise<Uint8Array> {\n  const res = await fetch(url);\n  if (!res.ok) {\n    throw new CryptoError(`failed to fetch wasm: ${res.status} ${url.href}`);\n  }\n  return new Uint8Array(await res.arrayBuffer());\n}\n\nfunction requireByteLength(bytes: Uint8Array, expected: number, label: string): void {\n  if (bytes.length !== expected) {\n    throw new CryptoError(`invalid ${label} length: expected ${expected}, got ${bytes.length}`);\n  }\n}\n\nfunction bindExports(exports: CryptoWasmExports): NostrWasm {\n  const poison: { error?: Error } = {};\n  const rawSerialized = (\n    serializedUtf8: Uint8Array,\n    id: Uint8Array,\n    pubkey: Uint8Array,\n    sig: Uint8Array,\n  ): boolean => wasmVerifySerialized(exports, serializedUtf8, id, pubkey, sig);\n  return {\n    verify: (id, pubkey, sig) => runPoisoned(poison, () => wasmVerify(exports, id, pubkey, sig)),\n    verifySerialized: (serializedUtf8, id, pubkey, sig) =>\n      runPoisoned(poison, () => rawSerialized(serializedUtf8, id, pubkey, sig)),\n    verifyEvent: createWasmEventVerifier(rawSerialized, poison),\n    sign: (id, seckey, aux) =>\n      runPoisoned(poison, () => {\n        requireByteLength(id, 32, \"id\");\n        requireByteLength(seckey, 32, \"secret key\");\n        requireByteLength(aux, 32, \"aux\");\n        const sig = wasmSign(exports, id, seckey, aux);\n        if (sig.length !== 64) {\n          throw new CryptoError(\"wasm sign failed\");\n        }\n        return sig;\n      }),\n    publicKey: (seckey) =>\n      runPoisoned(poison, () => {\n        requireByteLength(seckey, 32, \"secret key\");\n        const pk = wasmPublicKey(exports, seckey);\n        if (pk.length !== 32) {\n          throw new CryptoError(\"wasm publicKey failed\");\n        }\n        return pk;\n      }),\n  };\n}\n\n/** Builds a loader that interns a single instance per module slot. */\nexport function createNostrWasmLoader(\n  wasmBytes: (opts?: LoadNostrWasmOptions) => Promise<ArrayBuffer | ArrayBufferView>,\n): {\n  loadNostrWasm: (opts?: LoadNostrWasmOptions) => Promise<NostrWasm>;\n  resetNostrWasm: () => void;\n} {\n  let interned: Promise<NostrWasm> | undefined;\n\n  async function instantiate(opts?: LoadNostrWasmOptions): Promise<NostrWasm> {\n    const bytes = await wasmBytes(opts);\n    const exports = await instantiateCryptoWasm(bytes);\n    return bindExports(exports);\n  }\n\n  /** Instantiate once. Repeats reuse the same module. Failure throws; no noble fallback. */\n  async function loadNostrWasm(opts?: LoadNostrWasmOptions): Promise<NostrWasm> {\n    if (interned) {\n      return interned;\n    }\n    const pending = instantiate(opts);\n    interned = pending;\n    try {\n      return await pending;\n    } catch (error) {\n      if (interned === pending) {\n        interned = undefined;\n      }\n      throw error;\n    }\n  }\n\n  function resetNostrWasm(): void {\n    interned = undefined;\n  }\n\n  return { loadNostrWasm, resetNostrWasm };\n}\n"],"mappings":";;;;AAwCA,MAAa,uBAAwE,CACnF;CAAE,QAAQ;CAAO,MAAM;AAAmB,GAC1C;CAAE,QAAQ;CAA6B,MAAM;AAAmB,CAClE;AAEA,MAAM,OAAO,IAAI,YAAY;AAE7B,SAAS,WAAW,QAA4B,KAAa,KAAqB;CAChF,OAAO,KAAK,OAAO,IAAI,WAAW,OAAO,QAAQ,KAAK,GAAG,CAAC;AAC5D;AAEA,SAAS,eAAe,QAA8D;CACpF,MAAM,gBAAgB,KAAa,QAAuB;EACxD,MAAM,MAAM,OAAO,SAAS;EAC5B,MAAM,MAAM,MAAM,WAAW,KAAK,KAAK,GAAG,IAAI;EAC9C,MAAM,IAAI,YAAY,aAAa,GAAG;CACxC;CACA,MAAM,MAAM,EACV,kBAAkB,aACpB;CACA,OAAO;EACL;EACA,6BAA6B;CAC/B;AACF;;AAGA,SAAgB,yBAAyB,KAA+B;CACtE,MAAM,UAAU,IAAI,IAAI,qBAAqB,KAAK,SAAS,GAAG,KAAK,OAAO,IAAI,KAAK,MAAM,CAAC;CAC1F,KAAK,MAAM,OAAO,YAAY,OAAO,QAAQ,GAAG,GAAG;EACjD,IAAI,IAAI,SAAS,YACf,MAAM,IAAI,UAAU,+BAA+B,IAAI,KAAK,IAAI,IAAI,OAAO,GAAG,IAAI,MAAM;EAE1F,IAAI,CAAC,QAAQ,IAAI,GAAG,IAAI,OAAO,IAAI,IAAI,MAAM,GAC3C,MAAM,IAAI,UAAU,0BAA0B,IAAI,OAAO,GAAG,IAAI,MAAM;CAE1E;AACF;AAEA,SAAS,cAAc,OAAgE;CACrF,IAAI,EAAE,iBAAiB,YAAY,SACjC,MAAM,IAAI,UAAU,4BAA4B;CAElD,OAAO;AACT;AAGA,SAAS,UACP,OACA,MACG;CACH,IAAI,OAAO,UAAU,YACnB,MAAM,IAAI,UAAU,gBAAgB,KAAK,QAAQ;CAGnD,OAAO;AACT;AAEA,SAAS,UAAU,KAA6C;CAC9D,MAAM,UAA6B;EACjC,QAAQ,cAAc,IAAI,SAAS;EACnC,QAAQ,UAAU,IAAI,WAAW,QAAQ;EACzC,mBAAmB,UAAU,IAAI,sBAAsB,mBAAmB;EAC1E,MAAM,UAAU,IAAI,SAAS,MAAM;EACnC,YAAY,UAAU,IAAI,eAAe,YAAY;EACrD,mBAAmB,UAAU,IAAI,sBAAsB,mBAAmB;EAC1E,oBAAoB,UAAU,IAAI,uBAAuB,oBAAoB;EAC7E,iCAAiC,UAC/B,IAAI,oCACJ,iCACF;CACF;CACA,MAAM,QAAQ,IAAI;CAClB,IAAI,OAAO,UAAU,YACnB,QAAQ,mBAAmB,UAAsB,OAAO,kBAAkB;CAE5E,OAAO;AACT;AAEA,SAAS,UAAU,SAA4B,OAAiD;CAC9F,MAAM,MAAM,MAAM;CAClB,MAAM,MAAM,QAAQ,kBAAkB,KAAK,CAAC,MAAM;CAClD,IAAI,WAAW,QAAQ,OAAO,QAAQ,KAAK,GAAG,CAAC,CAAC,IAAI,KAAK;CACzD,OAAO;EAAE;EAAK;CAAI;AACpB;AAEA,SAAgB,WACd,SACA,IACA,QACA,KACS;CACT,MAAM,MAAM,UAAU,SAAS,EAAE;CACjC,MAAM,MAAM,UAAU,SAAS,MAAM;CACrC,MAAM,OAAO,UAAU,SAAS,GAAG;CACnC,OAAO,QAAQ,OAAO,IAAI,KAAK,IAAI,KAAK,IAAI,KAAK,IAAI,KAAK,KAAK,KAAK,KAAK,GAAG,MAAM;AACpF;AAEA,SAAgB,qBACd,SACA,YACA,IACA,QACA,KACS;CACT,MAAM,OAAO,UAAU,SAAS,UAAU;CAC1C,MAAM,MAAM,UAAU,SAAS,EAAE;CACjC,MAAM,MAAM,UAAU,SAAS,MAAM;CACrC,MAAM,OAAO,UAAU,SAAS,GAAG;CACnC,OACE,QAAQ,kBACN,KAAK,KACL,KAAK,KACL,IAAI,KACJ,IAAI,KACJ,IAAI,KACJ,IAAI,KACJ,KAAK,KACL,KAAK,GACP,MAAM;AAEV;AAEA,SAAS,UAAU,SAA4B,KAAa,KAAyB;CACnF,MAAM,MAAM,IAAI,WAAW,GAAG;CAC9B,IAAI,MAAM,GAAG;EACX,IAAI,IAAI,IAAI,WAAW,QAAQ,OAAO,QAAQ,KAAK,GAAG,CAAC;EACvD,QAAQ,mBAAmB,KAAK,KAAK,CAAC;CACxC;CACA,OAAO;AACT;AAEA,SAAS,mBACP,SACA,QACY;CACZ,MAAM,SAAS,QAAQ,gCAAgC,GAAG;CAC1D,IAAI;EACF,OAAO,MAAM;EACb,MAAM,OAAO,IAAI,SAAS,QAAQ,OAAO,MAAM;EAG/C,OAAO,UAAU,SAFL,KAAK,UAAU,QAAQ,IAEP,GADhB,KAAK,UAAU,SAAS,GAAG,IACN,CAAC;CACpC,UAAU;EACR,QAAQ,gCAAgC,EAAE;CAC5C;AACF;AAEA,SAAgB,SACd,SACA,IACA,QACA,KACY;CACZ,MAAM,MAAM,UAAU,SAAS,EAAE;CACjC,MAAM,MAAM,UAAU,SAAS,MAAM;CACrC,MAAM,OAAO,UAAU,SAAS,GAAG;CACnC,OAAO,mBAAmB,UAAU,WAAW;EAC7C,QAAQ,KAAK,QAAQ,IAAI,KAAK,IAAI,KAAK,IAAI,KAAK,IAAI,KAAK,KAAK,KAAK,KAAK,GAAG;CAC7E,CAAC;AACH;AAEA,SAAgB,cAAc,SAA4B,QAAgC;CACxF,MAAM,MAAM,UAAU,SAAS,MAAM;CACrC,OAAO,mBAAmB,UAAU,WAAW;EAC7C,QAAQ,WAAW,QAAQ,IAAI,KAAK,IAAI,GAAG;CAC7C,CAAC;AACH;AAEA,eAAsB,sBACpB,OAC4B;CAC5B,MAAM,SAA0C,CAAC;CACjD,MAAM,EAAE,QAAQ,aAAa,MAAM,YAAY,YAAY,OAAO,eAAe,MAAM,CAAC;CACxF,yBAAyB,MAAM;CAC/B,OAAO,UAAU,UAAU,SAAS,OAAO;CAC3C,OAAO,QAAQ,mBAAmB;CAClC,OAAO,OAAO;AAChB;;;;;;;AChNA,SAAgB,YAAe,QAA2B,IAAgB;CACxE,IAAI,OAAO,UAAU,KAAA,GACnB,MAAM,OAAO;CAEf,IAAI;EACF,OAAO,GAAG;CACZ,SAAS,OAAO;EACd,IAAI,iBAAiB,YAAY,cAAc;GAC7C,OAAO,QAAQ,IAAI,kBAAkB,yBAAyB,EAC5D,OAAO,MACT,CAAC;GACD,MAAM,OAAO;EACf;EACA,MAAM;CACR;AACF;;;;;;AAOA,SAAgB,wBACd,kBACA,QACe;CACf,MAAM,WAAoC,gBAAgB,IAAI,QAAQ,QAAQ;EAC5E,IAAI;GACF,OAAO,YAAY,cAAc,iBAAiB,gBAAgB,IAAI,QAAQ,GAAG,CAAC;EACpF,SAAS,OAAO;GACd,IAAI,iBAAiB,mBACnB,MAAM;GAER,OAAO;EACT;CACF;CACA,OAAO,oBAAoB,OAAO;AACpC;;;AClBA,SAAgB,YAAY,OAAwD;CAClF,OAAO,iBAAiB,eAAe,YAAY,OAAO,KAAK;AACjE;AAEA,eAAsB,aAAa,KAA+B;CAChE,MAAM,MAAM,MAAM,MAAM,GAAG;CAC3B,IAAI,CAAC,IAAI,IACP,MAAM,IAAI,YAAY,yBAAyB,IAAI,OAAO,GAAG,IAAI,MAAM;CAEzE,OAAO,IAAI,WAAW,MAAM,IAAI,YAAY,CAAC;AAC/C;AAEA,SAAS,kBAAkB,OAAmB,UAAkB,OAAqB;CACnF,IAAI,MAAM,WAAW,UACnB,MAAM,IAAI,YAAY,WAAW,MAAM,oBAAoB,SAAS,QAAQ,MAAM,QAAQ;AAE9F;AAEA,SAAS,YAAY,SAAuC;CAC1D,MAAM,SAA4B,CAAC;CACnC,MAAM,iBACJ,gBACA,IACA,QACA,QACY,qBAAqB,SAAS,gBAAgB,IAAI,QAAQ,GAAG;CAC3E,OAAO;EACL,SAAS,IAAI,QAAQ,QAAQ,YAAY,cAAc,WAAW,SAAS,IAAI,QAAQ,GAAG,CAAC;EAC3F,mBAAmB,gBAAgB,IAAI,QAAQ,QAC7C,YAAY,cAAc,cAAc,gBAAgB,IAAI,QAAQ,GAAG,CAAC;EAC1E,aAAa,wBAAwB,eAAe,MAAM;EAC1D,OAAO,IAAI,QAAQ,QACjB,YAAY,cAAc;GACxB,kBAAkB,IAAI,IAAI,IAAI;GAC9B,kBAAkB,QAAQ,IAAI,YAAY;GAC1C,kBAAkB,KAAK,IAAI,KAAK;GAChC,MAAM,MAAM,SAAS,SAAS,IAAI,QAAQ,GAAG;GAC7C,IAAI,IAAI,WAAW,IACjB,MAAM,IAAI,YAAY,kBAAkB;GAE1C,OAAO;EACT,CAAC;EACH,YAAY,WACV,YAAY,cAAc;GACxB,kBAAkB,QAAQ,IAAI,YAAY;GAC1C,MAAM,KAAK,cAAc,SAAS,MAAM;GACxC,IAAI,GAAG,WAAW,IAChB,MAAM,IAAI,YAAY,uBAAuB;GAE/C,OAAO;EACT,CAAC;CACL;AACF;;AAGA,SAAgB,sBACd,WAIA;CACA,IAAI;CAEJ,eAAe,YAAY,MAAiD;EAG1E,OAAO,YAAY,MADG,sBAAsB,MADxB,UAAU,IAAI,CACe,CACvB;CAC5B;;CAGA,eAAe,cAAc,MAAiD;EAC5E,IAAI,UACF,OAAO;EAET,MAAM,UAAU,YAAY,IAAI;EAChC,WAAW;EACX,IAAI;GACF,OAAO,MAAM;EACf,SAAS,OAAO;GACd,IAAI,aAAa,SACf,WAAW,KAAA;GAEb,MAAM;EACR;CACF;CAEA,SAAS,iBAAuB;EAC9B,WAAW,KAAA;CACb;CAEA,OAAO;EAAE;EAAe;CAAe;AACzC"}

package/dist/instance-DjsL8h84.d.mts

@@ -0,0 +1,15 @@
+import { a as SigningBackend } from "./key-D_5OgGT7.mjs";
+import { t as EventVerifier } from "./verifier-CgTFpgsC.mjs";
+//#region src/wasm/instance.d.ts
+type LoadNostrWasmOptions = {
+  /** Bytes, or a URL whose bytes will be read by the platform loader. */
+  module?: ArrayBuffer | ArrayBufferView | URL | undefined;
+};
+type NostrWasm = SigningBackend & {
+  verify: (id: Uint8Array, pubkey: Uint8Array, sig: Uint8Array) => boolean;
+  verifySerialized: (serializedUtf8: Uint8Array, id: Uint8Array, pubkey: Uint8Array, sig: Uint8Array) => boolean;
+  verifyEvent: EventVerifier;
+};
+//#endregion
+export { NostrWasm as n, LoadNostrWasmOptions as t };
+//# sourceMappingURL=instance-DjsL8h84.d.mts.map

package/dist/{key-Cv4_pN3x.d.mts → key-D_5OgGT7.d.mts}

@@ -1,4 +1,4 @@
-import { n as EventTemplate, r as UnsignedEvent, t as Event } from "./event-fU3Y01PR.mjs";
+import { n as EventTemplate, r as UnsignedEvent, t as Event } from "./event-DJeb_DIL.mjs";
 //#region src/core/key.d.ts
 /** 32-byte secret key held as bytes; prefer zeroize when done. */
 declare class SecretKey {
@@ -12,6 +12,10 @@ declare class SecretKey {
   /** Best-effort wipe of the internal buffer. */
   zeroize(): void;
 }
+/** Anything a secret key can be given as: instance, raw bytes, or hex. */
+type SecretKeyInput = SecretKey | Uint8Array | string;
+/** Coerce a {@link SecretKeyInput} to {@link SecretKey}. */
+declare function toSecretKey(input: SecretKeyInput): SecretKey;
 /** Lowercase hex-encoded secp256k1 public key (x-only, 64 chars). */
 type PublicKey = string;
 /** Validate and normalize a hex public key; throws {@link HexError} on bad input. */
@@ -26,7 +30,7 @@ type SigningBackend = {
   sign: (id: Uint8Array, secretKey: Uint8Array, auxRand: Uint8Array) => Uint8Array;
 };
 /** Derive the public key for a secret key given as SecretKey, bytes, or hex. */
-declare function getPublicKey(secretKey: SecretKey | Uint8Array | string): PublicKey;
+declare function getPublicKey(secretKey: SecretKeyInput): PublicKey;
 /** Keypair convenience wrapper. */
 declare class Keys {
   readonly secretKey: SecretKey;
@@ -39,15 +43,15 @@ declare class Keys {
   readonly backend: SigningBackend;
   private constructor();
   static generate(backend?: SigningBackend): Keys;
-  static fromSecretKey(secretKey: SecretKey | Uint8Array | string, backend?: SigningBackend): Keys;
+  static fromSecretKey(secretKey: SecretKeyInput, backend?: SigningBackend): Keys;
 }
 /** Fill pubkey/id/sig on a template and return a signed event. */
-declare function finalizeEvent(template: EventTemplate, secretKey: SecretKey | Uint8Array | string | Keys): Event;
+declare function finalizeEvent(template: EventTemplate, secretKey: SecretKeyInput | Keys): Event;
 /**
  * Sign an already-assembled unsigned event. Rejects when `unsigned.pubkey` does not match the
  * secret key.
  */
-declare function signEvent(unsigned: UnsignedEvent, secretKey: SecretKey | Uint8Array | string | Keys): Event;
+declare function signEvent(unsigned: UnsignedEvent, secretKey: SecretKeyInput | Keys): Event;
 //#endregion
-export { finalizeEvent as a, signEvent as c, SigningBackend as i, PublicKey as n, getPublicKey as o, SecretKey as r, publicKeyFromHex as s, Keys as t };
-//# sourceMappingURL=key-Cv4_pN3x.d.mts.map
+export { SigningBackend as a, publicKeyFromHex as c, SecretKeyInput as i, signEvent as l, PublicKey as n, finalizeEvent as o, SecretKey as r, getPublicKey as s, Keys as t, toSecretKey as u };
+//# sourceMappingURL=key-D_5OgGT7.d.mts.map

package/dist/{key-Bps-LqX7.mjs → key-bshqfmZL.mjs}

@@ -1,5 +1,5 @@
-import { a as hexToBytes$1, f as CryptoError, i as bytesToHex$1, n as assertHex32, r as assertSecretKeyBytes } from "./util-LfQirgDk.mjs";
-import { c as markVerified, n as getEventHash, p as validateEvent } from "./event-D8Nfoh4K.mjs";
+import { a as hexToBytes$1, h as EventValidationError, i as bytesToHex$1, m as CryptoError, n as assertHex32, r as assertSecretKeyBytes } from "./util-yFYzlbrm.mjs";
+import { c as markVerified, n as getEventHash, p as validateEvent } from "./event-DinQMmJ1.mjs";
 import { randomBytes } from "@noble/hashes/utils.js";
 import { schnorr } from "@noble/curves/secp256k1.js";
 //#region src/core/key.ts
@@ -34,6 +34,12 @@ var SecretKey = class SecretKey {
 		}
 	}
 };
+/** Coerce a {@link SecretKeyInput} to {@link SecretKey}. */
+function toSecretKey(input) {
+	if (input instanceof SecretKey) return input;
+	if (typeof input === "string") return SecretKey.fromHex(input);
+	return SecretKey.fromBytes(input);
+}
 /** Validate and normalize a hex public key; throws {@link HexError} on bad input. */
 function publicKeyFromHex(hex) {
 	return assertHex32(hex, "public key");
@@ -44,8 +50,7 @@ const nobleSigning = {
 };
 /** Derive the public key for a secret key given as SecretKey, bytes, or hex. */
 function getPublicKey(secretKey) {
-	const bytes = secretKey instanceof SecretKey ? secretKey.bytes : typeof secretKey === "string" ? hexToBytes$1(assertHex32(secretKey, "secret key")) : (assertSecretKeyBytes(secretKey), secretKey);
-	return bytesToHex$1(schnorr.getPublicKey(bytes));
+	return bytesToHex$1(schnorr.getPublicKey(toSecretKey(secretKey).bytes));
 }
 /** Keypair convenience wrapper. */
 var Keys = class Keys {
@@ -68,8 +73,7 @@ var Keys = class Keys {
 		return new Keys(SecretKey.generate(), backend);
 	}
 	static fromSecretKey(secretKey, backend = nobleSigning) {
-		const sk = secretKey instanceof SecretKey ? secretKey : typeof secretKey === "string" ? SecretKey.fromHex(secretKey) : SecretKey.fromBytes(secretKey);
-		return new Keys(sk, backend);
+		return new Keys(toSecretKey(secretKey), backend);
 	}
 };
 function resolveKeys(secretKey) {
@@ -92,7 +96,7 @@ function finalizeEvent(template, secretKey) {
 */
 function signEvent(unsigned, secretKey) {
 	const keys = resolveKeys(secretKey);
-	if (!validateEvent(unsigned)) throw new CryptoError("cannot sign invalid unsigned event");
+	if (!validateEvent(unsigned)) throw new EventValidationError("cannot sign invalid unsigned event");
 	if (unsigned.pubkey !== keys.publicKey) throw new CryptoError("unsigned event pubkey does not match secret key");
 	const normalized = {
 		kind: unsigned.kind,
@@ -113,6 +117,6 @@ function signEvent(unsigned, secretKey) {
 	return event;
 }
 //#endregion
-export { publicKeyFromHex as a, getPublicKey as i, SecretKey as n, signEvent as o, finalizeEvent as r, Keys as t };
+export { publicKeyFromHex as a, getPublicKey as i, SecretKey as n, signEvent as o, finalizeEvent as r, toSecretKey as s, Keys as t };
 
-//# sourceMappingURL=key-Bps-LqX7.mjs.map
+//# sourceMappingURL=key-bshqfmZL.mjs.map

package/dist/key-bshqfmZL.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-bshqfmZL.mjs","names":["hexToBytes","bytesToHex"],"sources":["../src/core/key.ts"],"sourcesContent":["import { schnorr } from \"@noble/curves/secp256k1.js\";\nimport { randomBytes } from \"@noble/hashes/utils.js\";\n\nimport { CryptoError, EventValidationError } from \"./error.ts\";\nimport { getEventHash, markVerified, validateEvent } from \"./event.ts\";\nimport type { Event, EventTemplate, UnsignedEvent } from \"./event.ts\";\nimport { assertHex32, assertSecretKeyBytes, bytesToHex, hexToBytes } from \"./util.ts\";\n\n/** 32-byte secret key held as bytes; prefer zeroize when done. */\nexport class SecretKey {\n  #bytes: Uint8Array | undefined;\n\n  private constructor(bytes: Uint8Array) {\n    assertSecretKeyBytes(bytes);\n    this.#bytes = new Uint8Array(bytes);\n  }\n\n  static generate(): SecretKey {\n    return new SecretKey(schnorr.utils.randomSecretKey());\n  }\n\n  static fromBytes(bytes: Uint8Array): SecretKey {\n    return new SecretKey(bytes);\n  }\n\n  static fromHex(hex: string): SecretKey {\n    return new SecretKey(hexToBytes(assertHex32(hex, \"secret key\")));\n  }\n\n  get bytes(): Uint8Array {\n    if (!this.#bytes) {\n      throw new CryptoError(\"secret key has been zeroized\");\n    }\n    return new Uint8Array(this.#bytes);\n  }\n\n  toHex(): string {\n    return bytesToHex(this.bytes);\n  }\n\n  /** Best-effort wipe of the internal buffer. */\n  zeroize(): void {\n    if (this.#bytes) {\n      this.#bytes.fill(0);\n      this.#bytes = undefined;\n    }\n  }\n}\n\n/** Anything a secret key can be given as: instance, raw bytes, or hex. */\nexport type SecretKeyInput = SecretKey | Uint8Array | string;\n\n/** Coerce a {@link SecretKeyInput} to {@link SecretKey}. */\nexport function toSecretKey(input: SecretKeyInput): SecretKey {\n  if (input instanceof SecretKey) {\n    return input;\n  }\n  if (typeof input === \"string\") {\n    return SecretKey.fromHex(input);\n  }\n  return SecretKey.fromBytes(input);\n}\n\n/** Lowercase hex-encoded secp256k1 public key (x-only, 64 chars). */\nexport type PublicKey = string;\n\n/** Validate and normalize a hex public key; throws {@link HexError} on bad input. */\nexport function publicKeyFromHex(hex: string): PublicKey {\n  return assertHex32(hex, \"public key\");\n}\n\n/**\n * BIP-340 signing backend. `publicKey` returns the 32-byte x-only public key of a 32-byte secret\n * key; `sign` returns the 64-byte BIP-340 signature of a 32-byte `id` using 32 bytes of auxiliary\n * randomness. Both throw on invalid input (for example an out-of-range secret key).\n */\nexport type SigningBackend = {\n  publicKey: (secretKey: Uint8Array) => Uint8Array;\n  sign: (id: Uint8Array, secretKey: Uint8Array, auxRand: Uint8Array) => Uint8Array;\n};\n\nconst nobleSigning: SigningBackend = {\n  publicKey: (secretKey) => schnorr.getPublicKey(secretKey),\n  sign: (id, secretKey, auxRand) => schnorr.sign(id, secretKey, auxRand),\n};\n\n/** Derive the public key for a secret key given as SecretKey, bytes, or hex. */\nexport function getPublicKey(secretKey: SecretKeyInput): PublicKey {\n  return bytesToHex(schnorr.getPublicKey(toSecretKey(secretKey).bytes));\n}\n\n/** Keypair convenience wrapper. */\nexport class Keys {\n  readonly secretKey: SecretKey;\n  readonly publicKey: PublicKey;\n  /**\n   * BIP-340 backend that derived {@link publicKey} and signs in {@link finalizeEvent}/\n   * {@link signEvent}. Defaults to noble; pass a loaded `NostrWasm` module or a native backend to\n   * delegate signing.\n   */\n  readonly backend: SigningBackend;\n\n  private constructor(secretKey: SecretKey, backend: SigningBackend) {\n    this.secretKey = secretKey;\n    this.backend = backend;\n    const pubkey = backend.publicKey(secretKey.bytes);\n    if (pubkey.length !== 32) {\n      throw new CryptoError(\"signing backend returned an invalid public key\");\n    }\n    this.publicKey = bytesToHex(pubkey);\n  }\n\n  static generate(backend: SigningBackend = nobleSigning): Keys {\n    return new Keys(SecretKey.generate(), backend);\n  }\n\n  static fromSecretKey(secretKey: SecretKeyInput, backend: SigningBackend = nobleSigning): Keys {\n    return new Keys(toSecretKey(secretKey), backend);\n  }\n}\n\nfunction resolveKeys(secretKey: SecretKeyInput | Keys): Keys {\n  return secretKey instanceof Keys ? secretKey : Keys.fromSecretKey(secretKey);\n}\n\n/** Fill pubkey/id/sig on a template and return a signed event. */\nexport function finalizeEvent(template: EventTemplate, secretKey: SecretKeyInput | Keys): Event {\n  const keys = resolveKeys(secretKey);\n  const unsigned: UnsignedEvent = {\n    kind: template.kind,\n    tags: template.tags,\n    content: template.content,\n    created_at: template.created_at,\n    pubkey: keys.publicKey,\n  };\n  return signEvent(unsigned, keys);\n}\n\n/**\n * Sign an already-assembled unsigned event. Rejects when `unsigned.pubkey` does not match the\n * secret key.\n */\nexport function signEvent(unsigned: UnsignedEvent, secretKey: SecretKeyInput | Keys): Event {\n  const keys = resolveKeys(secretKey);\n  if (!validateEvent(unsigned)) {\n    throw new EventValidationError(\"cannot sign invalid unsigned event\");\n  }\n\n  if (unsigned.pubkey !== keys.publicKey) {\n    throw new CryptoError(\"unsigned event pubkey does not match secret key\");\n  }\n\n  const normalized: UnsignedEvent = {\n    kind: unsigned.kind,\n    tags: unsigned.tags,\n    content: unsigned.content,\n    created_at: unsigned.created_at,\n    pubkey: keys.publicKey,\n  };\n\n  const id = getEventHash(normalized);\n  const sig = keys.backend.sign(hexToBytes(id), keys.secretKey.bytes, randomBytes(32));\n  if (sig.length !== 64) {\n    throw new CryptoError(\"signing backend returned an invalid signature\");\n  }\n  const event: Event = { ...normalized, id, sig: bytesToHex(sig) };\n  markVerified(event);\n  return event;\n}\n"],"mappings":";;;;;;AASA,IAAa,YAAb,MAAa,UAAU;CACrB;CAEA,YAAoB,OAAmB;EACrC,qBAAqB,KAAK;EAC1B,KAAK,SAAS,IAAI,WAAW,KAAK;CACpC;CAEA,OAAO,WAAsB;EAC3B,OAAO,IAAI,UAAU,QAAQ,MAAM,gBAAgB,CAAC;CACtD;CAEA,OAAO,UAAU,OAA8B;EAC7C,OAAO,IAAI,UAAU,KAAK;CAC5B;CAEA,OAAO,QAAQ,KAAwB;EACrC,OAAO,IAAI,UAAUA,aAAW,YAAY,KAAK,YAAY,CAAC,CAAC;CACjE;CAEA,IAAI,QAAoB;EACtB,IAAI,CAAC,KAAK,QACR,MAAM,IAAI,YAAY,8BAA8B;EAEtD,OAAO,IAAI,WAAW,KAAK,MAAM;CACnC;CAEA,QAAgB;EACd,OAAOC,aAAW,KAAK,KAAK;CAC9B;;CAGA,UAAgB;EACd,IAAI,KAAK,QAAQ;GACf,KAAK,OAAO,KAAK,CAAC;GAClB,KAAK,SAAS,KAAA;EAChB;CACF;AACF;;AAMA,SAAgB,YAAY,OAAkC;CAC5D,IAAI,iBAAiB,WACnB,OAAO;CAET,IAAI,OAAO,UAAU,UACnB,OAAO,UAAU,QAAQ,KAAK;CAEhC,OAAO,UAAU,UAAU,KAAK;AAClC;;AAMA,SAAgB,iBAAiB,KAAwB;CACvD,OAAO,YAAY,KAAK,YAAY;AACtC;AAYA,MAAM,eAA+B;CACnC,YAAY,cAAc,QAAQ,aAAa,SAAS;CACxD,OAAO,IAAI,WAAW,YAAY,QAAQ,KAAK,IAAI,WAAW,OAAO;AACvE;;AAGA,SAAgB,aAAa,WAAsC;CACjE,OAAOA,aAAW,QAAQ,aAAa,YAAY,SAAS,CAAC,CAAC,KAAK,CAAC;AACtE;;AAGA,IAAa,OAAb,MAAa,KAAK;CAChB;CACA;;;;;;CAMA;CAEA,YAAoB,WAAsB,SAAyB;EACjE,KAAK,YAAY;EACjB,KAAK,UAAU;EACf,MAAM,SAAS,QAAQ,UAAU,UAAU,KAAK;EAChD,IAAI,OAAO,WAAW,IACpB,MAAM,IAAI,YAAY,gDAAgD;EAExE,KAAK,YAAYA,aAAW,MAAM;CACpC;CAEA,OAAO,SAAS,UAA0B,cAAoB;EAC5D,OAAO,IAAI,KAAK,UAAU,SAAS,GAAG,OAAO;CAC/C;CAEA,OAAO,cAAc,WAA2B,UAA0B,cAAoB;EAC5F,OAAO,IAAI,KAAK,YAAY,SAAS,GAAG,OAAO;CACjD;AACF;AAEA,SAAS,YAAY,WAAwC;CAC3D,OAAO,qBAAqB,OAAO,YAAY,KAAK,cAAc,SAAS;AAC7E;;AAGA,SAAgB,cAAc,UAAyB,WAAyC;CAC9F,MAAM,OAAO,YAAY,SAAS;CAQlC,OAAO,UAAU;EANf,MAAM,SAAS;EACf,MAAM,SAAS;EACf,SAAS,SAAS;EAClB,YAAY,SAAS;EACrB,QAAQ,KAAK;CAES,GAAG,IAAI;AACjC;;;;;AAMA,SAAgB,UAAU,UAAyB,WAAyC;CAC1F,MAAM,OAAO,YAAY,SAAS;CAClC,IAAI,CAAC,cAAc,QAAQ,GACzB,MAAM,IAAI,qBAAqB,oCAAoC;CAGrE,IAAI,SAAS,WAAW,KAAK,WAC3B,MAAM,IAAI,YAAY,iDAAiD;CAGzE,MAAM,aAA4B;EAChC,MAAM,SAAS;EACf,MAAM,SAAS;EACf,SAAS,SAAS;EAClB,YAAY,SAAS;EACrB,QAAQ,KAAK;CACf;CAEA,MAAM,KAAK,aAAa,UAAU;CAClC,MAAM,MAAM,KAAK,QAAQ,KAAKD,aAAW,EAAE,GAAG,KAAK,UAAU,OAAO,YAAY,EAAE,CAAC;CACnF,IAAI,IAAI,WAAW,IACjB,MAAM,IAAI,YAAY,+CAA+C;CAEvE,MAAM,QAAe;EAAE,GAAG;EAAY;EAAI,KAAKC,aAAW,GAAG;CAAE;CAC/D,aAAa,KAAK;CAClB,OAAO;AACT"}