applesauce-signers 6.0.1 → 6.2.0

package/README.md

@@ -93,8 +93,14 @@ const uri = signer.getNostrConnectURI({
 const bunkerSigner = await NostrConnectSigner.fromBunkerURI("bunker://...your-uri-here...", {
   permissions: NostrConnectSigner.buildSigningPermissions([0, 1, 3]),
 });
+
+// Import or export a complete NIP-46 client session
+const sessionSigner = await NostrConnectSigner.fromNbunksec("nbunksec1...");
+const encodedSession = sessionSigner.getNbunksec();
 ```
 
+`nbunksec` values include the local client private key and should be handled like secrets.
+
 ### Other Signers
 
 - **Serial Port Signer**: For hardware signing devices (Chrome browsers only)

package/dist/helpers/nostr-connect.d.ts

@@ -19,7 +19,8 @@ export declare enum NostrConnectMethod {
     Nip04Decrypt = "nip04_decrypt",
     Nip44Encrypt = "nip44_encrypt",
     Nip44Decrypt = "nip44_decrypt",
-    SwitchRelays = "switch_relays"
+    SwitchRelays = "switch_relays",
+    Logout = "logout"
 }
 export type ConnectRequestParams = {
     [NostrConnectMethod.Connect]: [string] | [string, string] | [string, string, string];
@@ -32,6 +33,7 @@ export type ConnectRequestParams = {
     [NostrConnectMethod.Nip44Encrypt]: [string, string];
     [NostrConnectMethod.Nip44Decrypt]: [string, string];
     [NostrConnectMethod.SwitchRelays]: [];
+    [NostrConnectMethod.Logout]: [];
 };
 export type ConnectResponseResults = {
     [NostrConnectMethod.Connect]: "ack" | string;
@@ -44,6 +46,7 @@ export type ConnectResponseResults = {
     [NostrConnectMethod.Nip44Encrypt]: string;
     [NostrConnectMethod.Nip44Decrypt]: string;
     [NostrConnectMethod.SwitchRelays]: string[] | null;
+    [NostrConnectMethod.Logout]: "ack";
 };
 export type NostrConnectRequest<N extends NostrConnectMethod> = {
     id: string;
@@ -64,12 +67,24 @@ export type NostrConnectErrorResponse = {
 export type BunkerURI = {
     remote: string;
     relays: string[];
+    /** @deprecated Use bunkerSecret instead */
     secret?: string;
+    /** The secret used to authorize the connection to the bunker (the `secret` in a bunker:// URI) */
+    bunkerSecret?: string;
+};
+/** An nbunksec-encoded NIP-46 signer session */
+export type Nbunksec = BunkerURI & {
+    /** The local client private key as hex */
+    clientKey: string;
 };
 /** Parse a bunker:// URI */
 export declare function parseBunkerURI(uri: string): BunkerURI;
 /** Creates a bunker:// URI from a {@link BunkerURI} object */
 export declare function createBunkerURI(data: BunkerURI): string;
+/** Parse an nbunksec encoded NIP-46 signer session */
+export declare function parseNbunksec(encoded: string): Nbunksec;
+/** Create an nbunksec encoded NIP-46 signer session */
+export declare function createNbunksec(data: Nbunksec): string;
 /** App metadata for a nostrconnect:// URI */
 export type NostrConnectAppMetadata = {
     /** The name of the client */
@@ -81,20 +96,30 @@ export type NostrConnectAppMetadata = {
     /** The permissions the client has */
     permissions?: string[];
 };
-/** A nostrconnect:// URI */
-export type NostrConnectURI = {
+type NostrConnectURIBase = {
     /** The pubkey of the client */
     client: string;
-    /** The secret used by the signer to connect to the client */
-    secret: string;
     /** The relays used to communicate with the remote signer */
     relays: string[];
     /** The metadata of the client */
     metadata?: NostrConnectAppMetadata;
 };
+/** A nostrconnect:// URI */
+export type NostrConnectURI = NostrConnectURIBase & ({
+    /** The secret used by the signer to connect to the client (the `secret` in a nostrconnect:// URI) */
+    connectSecret: string;
+    /** @deprecated Use connectSecret instead */
+    secret?: string;
+} | {
+    /** @deprecated Use connectSecret instead */
+    secret: string;
+    /** The secret used by the signer to connect to the client (the `secret` in a nostrconnect:// URI) */
+    connectSecret?: string;
+});
 /** Parse a nostrconnect:// URI */
 export declare function parseNostrConnectURI(uri: string): NostrConnectURI;
 /** Create a nostrconnect:// URI from a {@link NostrConnectURI} object */
 export declare function createNostrConnectURI(data: NostrConnectURI): string;
 /** Build an array of signing permissions for event kinds */
 export declare function buildSigningPermissions(kinds: number[]): string[];
+export {};

package/dist/helpers/nostr-connect.js

@@ -1,3 +1,4 @@
+import { encodeNbunksec, decodeNbunksec } from "@sandwichfarm/encoded-entities";
 import { setHiddenContentEncryptionMethod } from "applesauce-core/helpers/hidden-content";
 import { isHexKey } from "applesauce-core/helpers/string";
 import { kinds } from "applesauce-core/helpers/event";
@@ -29,6 +30,7 @@ export var NostrConnectMethod;
     NostrConnectMethod["Nip44Encrypt"] = "nip44_encrypt";
     NostrConnectMethod["Nip44Decrypt"] = "nip44_decrypt";
     NostrConnectMethod["SwitchRelays"] = "switch_relays";
+    NostrConnectMethod["Logout"] = "logout";
 })(NostrConnectMethod || (NostrConnectMethod = {}));
 /** Parse a bunker:// URI */
 export function parseBunkerURI(uri) {
@@ -40,26 +42,59 @@ export function parseBunkerURI(uri) {
     const relays = url.searchParams.getAll("relay");
     if (relays.length === 0)
         throw new Error("Invalid bunker URI: missing relays");
-    const secret = url.searchParams.get("secret") ?? undefined;
-    return { remote, relays, secret };
+    const bunkerSecret = url.searchParams.get("secret") ?? undefined;
+    return { remote, relays, secret: bunkerSecret, bunkerSecret };
 }
 /** Creates a bunker:// URI from a {@link BunkerURI} object */
 export function createBunkerURI(data) {
     const url = new URL(`bunker://${data.remote}`);
     data.relays.forEach((relay) => url.searchParams.append("relay", relay));
-    if (data.secret)
-        url.searchParams.set("secret", data.secret);
+    const bunkerSecret = data.bunkerSecret ?? data.secret;
+    if (bunkerSecret)
+        url.searchParams.set("secret", bunkerSecret);
     return url.toString();
 }
+/** Parse an nbunksec encoded NIP-46 signer session */
+export function parseNbunksec(encoded) {
+    const info = decodeNbunksec(encoded);
+    if (!isHexKey(info.pubkey))
+        throw new Error("Invalid nbunksec: remote is not a valid hex key");
+    if (!isHexKey(info.local_key))
+        throw new Error("Invalid nbunksec: clientKey is not a valid hex key");
+    if (info.relays.length === 0)
+        throw new Error("Invalid nbunksec: missing relays");
+    return {
+        remote: info.pubkey,
+        clientKey: info.local_key,
+        relays: info.relays,
+        secret: info.secret,
+        bunkerSecret: info.secret,
+    };
+}
+/** Create an nbunksec encoded NIP-46 signer session */
+export function createNbunksec(data) {
+    if (!isHexKey(data.remote))
+        throw new Error("Invalid nbunksec: remote is not a valid hex key");
+    if (!isHexKey(data.clientKey))
+        throw new Error("Invalid nbunksec: clientKey is not a valid hex key");
+    if (data.relays.length === 0)
+        throw new Error("Invalid nbunksec: missing relays");
+    return encodeNbunksec({
+        pubkey: data.remote,
+        local_key: data.clientKey,
+        relays: data.relays,
+        secret: data.bunkerSecret ?? data.secret,
+    });
+}
 /** Parse a nostrconnect:// URI */
 export function parseNostrConnectURI(uri) {
     const url = new URL(uri);
     const client = url.host || url.pathname.replace("//", "");
     if (!isHexKey(client))
         throw new Error("Invalid nostrconnect URI: client is not a valid hex key");
-    const secret = url.searchParams.get("secret");
+    const connectSecret = url.searchParams.get("secret");
     const relays = url.searchParams.getAll("relay");
-    if (!secret)
+    if (!connectSecret)
         throw new Error("Invalid nostrconnect URI: missing secret");
     if (relays.length === 0)
         throw new Error("Invalid nostrconnect URI: missing relays");
@@ -71,14 +106,17 @@ export function parseNostrConnectURI(uri) {
     };
     /** Omit metadata if all values are undefined */
     if (Object.values(metadata).every((v) => v === undefined))
-        return { client, secret, relays };
+        return { client, secret: connectSecret, connectSecret, relays };
     else
-        return { client, secret, relays, metadata };
+        return { client, secret: connectSecret, connectSecret, relays, metadata };
 }
 /** Create a nostrconnect:// URI from a {@link NostrConnectURI} object */
 export function createNostrConnectURI(data) {
     const params = new URLSearchParams();
-    params.set("secret", data.secret);
+    const connectSecret = data.connectSecret ?? data.secret;
+    if (!connectSecret)
+        throw new Error("Invalid nostrconnect URI: missing secret");
+    params.set("secret", connectSecret);
     if (data.metadata?.name)
         params.set("name", data.metadata.name);
     if (data.metadata?.url)

package/dist/signers/nostr-connect-provider.d.ts

@@ -2,6 +2,7 @@ import { EventTemplate, NostrEvent } from "applesauce-core/helpers/event";
 import { Subscription } from "rxjs";
 import { ConnectRequestParams, ConnectResponseResults, NostrConnectMethod, NostrConnectResponse, NostrConnectURI } from "../helpers/nostr-connect.js";
 import { ISigner, NostrConnectionMethodsOptions, NostrPool, NostrPublishMethod, NostrSubscriptionMethod } from "../interop.js";
+import { PrivateKeySigner } from "./private-key-signer.js";
 export interface ProviderAuthorization {
     /** A method used to accept or reject `connect` requests */
     onConnect?: (client: string, permissions: string[]) => boolean | Promise<boolean>;
@@ -17,6 +18,8 @@ export interface ProviderAuthorization {
     onNip44Decrypt?: (pubkey: string, ciphertext: string, client: string) => boolean | Promise<boolean>;
     /** A method called when a client requests relay switching. Return new relay list or null if no change */
     onSwitchRelays?: (client: string) => string[] | null | Promise<string[] | null>;
+    /** A method called when a client requests to logout (end the session) */
+    onLogout?: (client: string) => void | Promise<void>;
 }
 export type NostrConnectProviderOptions = ProviderAuthorization & NostrConnectionMethodsOptions & {
     /** The relays to communicate over */
@@ -25,8 +28,10 @@ export type NostrConnectProviderOptions = ProviderAuthorization & NostrConnectio
     upstream: ISigner;
     /** Optional signer for provider identity */
     signer?: ISigner;
-    /** A random secret used to authorize clients to connect */
+    /** @deprecated Use bunkerSecret instead */
     secret?: string;
+    /** A random secret used to authorize clients to connect (the `secret` in a bunker:// URI) */
+    bunkerSecret?: string;
     /** Callback for when a client connects (receives a `connect` request) */
     onClientConnect?: (client: string) => any;
     /** Callback for when a client disconnects (previously connected and the provider stops) */
@@ -55,8 +60,11 @@ export declare class NostrConnectProvider implements ProviderAuthorization {
     listening: boolean;
     /** The connected client's public key */
     client?: string;
-    /** The secret used to authorize clients to connect */
-    secret?: string;
+    /** The secret used to authorize clients to connect (the `secret` in a bunker:// URI) */
+    bunkerSecret?: string;
+    /** @deprecated Use bunkerSecret instead */
+    get secret(): string | undefined;
+    set secret(value: string | undefined);
     /** Relays to communicate over */
     readonly relays: string[];
     /** Whether a client is connected (received a `connect` request) */
@@ -78,6 +86,8 @@ export declare class NostrConnectProvider implements ProviderAuthorization {
     onNip44Decrypt?: (pubkey: string, ciphertext: string, client: string) => boolean | Promise<boolean>;
     /** A method called when a client requests relay switching. Return new relay list or null if no change */
     onSwitchRelays?: (client: string) => string[] | null | Promise<string[] | null>;
+    /** A method called when a client requests to logout (end the session) */
+    onLogout?: (client: string) => void | Promise<void>;
     constructor(options: NostrConnectProviderOptions);
     /** The currently active REQ subscription */
     protected req?: Subscription;
@@ -98,7 +108,7 @@ export declare class NostrConnectProvider implements ProviderAuthorization {
     /** Handle an initial NostrConnectURI */
     handleNostrConnectURI(uri: NostrConnectURI | string): Promise<void>;
     /** Handle connect request */
-    protected handleConnect(client: string, [target, secret, permissionsStr]: ConnectRequestParams[NostrConnectMethod.Connect]): Promise<ConnectResponseResults[NostrConnectMethod.Connect]>;
+    protected handleConnect(client: string, [target, bunkerSecret, permissionsStr]: ConnectRequestParams[NostrConnectMethod.Connect]): Promise<ConnectResponseResults[NostrConnectMethod.Connect]>;
     /** Handle sign event request */
     protected handleSignEvent([eventJson]: ConnectRequestParams[NostrConnectMethod.SignEvent]): Promise<ConnectResponseResults[NostrConnectMethod.SignEvent]>;
     /** Handle NIP-04 encryption */
@@ -111,6 +121,8 @@ export declare class NostrConnectProvider implements ProviderAuthorization {
     protected handleNip44Decrypt([pubkey, ciphertext,]: ConnectRequestParams[NostrConnectMethod.Nip44Decrypt]): Promise<ConnectResponseResults[NostrConnectMethod.Nip44Decrypt]>;
     /** Handle switch relays request */
     protected handleSwitchRelays(): Promise<ConnectResponseResults[NostrConnectMethod.SwitchRelays]>;
+    /** Handle a logout request by ending the session associated with the client */
+    protected handleLogout(client: string): Promise<void>;
     /**
      * Send a response to the client
      * @param clientOrRequest - The client pubkey or request event
@@ -124,4 +136,6 @@ export declare class NostrConnectProvider implements ProviderAuthorization {
     protected sendMessage(clientOrRequest: string | NostrEvent, message: NostrConnectResponse<any>): Promise<void>;
     /** Get the connection string that clients can use to connect */
     getBunkerURI(): Promise<string>;
+    /** Get an nbunksec encoded session that clients can import */
+    getNbunksec(clientSigner?: PrivateKeySigner): Promise<string>;
 }

package/dist/signers/nostr-connect-provider.js

@@ -1,11 +1,11 @@
 import { logger } from "applesauce-core";
 import { getEncryptedContentEncryptionMethods, getHiddenContent, isEvent, unixNow, unlockHiddenContent, } from "applesauce-core/helpers";
-import { kinds, verifyEvent } from "applesauce-core/helpers/event";
+import { bytesToHex, kinds, verifyEvent } from "applesauce-core/helpers/event";
 import { createDefer } from "applesauce-core/promise";
 import { nanoid } from "nanoid";
 import { filter, from, repeat, retry } from "rxjs";
 import { isNIP04 } from "../helpers/encryption.js";
-import { createBunkerURI, NostrConnectMethod, parseNostrConnectURI, } from "../helpers/nostr-connect.js";
+import { createBunkerURI, createNbunksec, NostrConnectMethod, parseNostrConnectURI, } from "../helpers/nostr-connect.js";
 import { getConnectionMethods, } from "../interop.js";
 import { PrivateKeySigner } from "./private-key-signer.js";
 export class NostrConnectProvider {
@@ -31,8 +31,15 @@ export class NostrConnectProvider {
     listening = false;
     /** The connected client's public key */
     client;
-    /** The secret used to authorize clients to connect */
-    secret;
+    /** The secret used to authorize clients to connect (the `secret` in a bunker:// URI) */
+    bunkerSecret;
+    /** @deprecated Use bunkerSecret instead */
+    get secret() {
+        return this.bunkerSecret;
+    }
+    set secret(value) {
+        this.bunkerSecret = value;
+    }
     /** Relays to communicate over */
     relays;
     /** Whether a client is connected (received a `connect` request) */
@@ -54,11 +61,13 @@ export class NostrConnectProvider {
     onNip44Decrypt;
     /** A method called when a client requests relay switching. Return new relay list or null if no change */
     onSwitchRelays;
+    /** A method called when a client requests to logout (end the session) */
+    onLogout;
     constructor(options) {
         this.relays = options.relays;
         this.upstream = options.upstream;
         this.signer = options.signer ?? new PrivateKeySigner();
-        this.secret = options.secret;
+        this.bunkerSecret = options.bunkerSecret ?? options.secret;
         // Get the subscription and publish methods
         const { subscriptionMethod, publishMethod } = getConnectionMethods(options, NostrConnectProvider);
         // Use arrow functions so "this" isn't bound to the signer
@@ -84,6 +93,8 @@ export class NostrConnectProvider {
             this.onNip44Decrypt = options.onNip44Decrypt;
         if (options.onSwitchRelays)
             this.onSwitchRelays = options.onSwitchRelays;
+        if (options.onLogout)
+            this.onLogout = options.onLogout;
     }
     /** The currently active REQ subscription */
     req;
@@ -223,11 +234,17 @@ export class NostrConnectProvider {
                     case NostrConnectMethod.SwitchRelays:
                         result = await this.handleSwitchRelays();
                         break;
+                    case NostrConnectMethod.Logout:
+                        result = "ack";
+                        break;
                     default:
                         throw new Error(`Unsupported method: ${request.method}`);
                 }
                 // Send success response
                 await this.sendResponse(event, request.id, result);
+                // Ack is sent before ending the session, so the client receives confirmation before we tear down
+                if (request.method === NostrConnectMethod.Logout)
+                    await this.handleLogout(event.pubkey);
             }
             catch (error) {
                 this.log(`Error processing ${request.method}:`, error);
@@ -248,14 +265,14 @@ export class NostrConnectProvider {
         // Get a response to a fake initial `connect` request
         const response = await this.handleConnect(uri.client, [
             await this.signer.getPublicKey(),
-            uri.secret,
+            uri.connectSecret ?? uri.secret ?? "",
             uri.metadata?.permissions?.join(",") ?? "",
         ]);
         // Send `connect` response with random id
         await this.sendResponse(uri.client, nanoid(8), response);
     }
     /** Handle connect request */
-    async handleConnect(client, [target, secret, permissionsStr]) {
+    async handleConnect(client, [target, bunkerSecret, permissionsStr]) {
         const permissions = permissionsStr ? permissionsStr.split(",") : [];
         // Check if this is a connection to our provider
         const providerPubkey = await this.signer.getPublicKey();
@@ -265,7 +282,7 @@ export class NostrConnectProvider {
         if (this.client && this.client !== client)
             throw new Error("Only one client can connect at a time");
         // If this is the first `connect` request, check that the secret matches
-        if (this.secret && !this.client && this.secret !== secret)
+        if (this.bunkerSecret && !this.client && this.bunkerSecret !== bunkerSecret)
             throw new Error("Invalid connection secret");
         // Handle authorization if callback is provided
         if (this.onConnect) {
@@ -278,8 +295,8 @@ export class NostrConnectProvider {
         // Establish connection
         this.client = client;
         this.connected = true;
-        if (!this.secret)
-            this.secret = secret;
+        if (!this.bunkerSecret)
+            this.bunkerSecret = bunkerSecret;
         // Update the subscription since we now know the client pubkey
         if (isFirstRequest)
             await this.updateSubscription();
@@ -292,7 +309,7 @@ export class NostrConnectProvider {
             this.waitingPromise = null;
         }
         // Return ack or the secret if provided
-        return secret || "ack";
+        return bunkerSecret || "ack";
     }
     /** Handle sign event request */
     async handleSignEvent([eventJson]) {
@@ -363,6 +380,23 @@ export class NostrConnectProvider {
         // Default: return current relays (no change)
         return null;
     }
+    /** Handle a logout request by ending the session associated with the client */
+    async handleLogout(client) {
+        this.log(`Client ${client} logged out`);
+        // Notify the logout callback
+        if (this.onLogout)
+            await this.onLogout(client);
+        // Notify client disconnect
+        if (this.connected && this.onClientDisconnect)
+            this.onClientDisconnect(client);
+        // Forget the client so a new `connect` is required to re-establish a session.
+        // NOTE: do not clear `seen` here, otherwise the relay will replay the old `connect`/`logout`
+        // events on the new subscription and the provider would reconnect then logout in a loop.
+        this.client = undefined;
+        this.connected = false;
+        // Reset the subscription to listen for new connections
+        await this.updateSubscription();
+    }
     /**
      * Send a response to the client
      * @param clientOrRequest - The client pubkey or request event
@@ -419,7 +453,16 @@ export class NostrConnectProvider {
         return createBunkerURI({
             remote: await this.signer.getPublicKey(),
             relays: this.relays,
-            secret: this.secret,
+            bunkerSecret: this.bunkerSecret,
+        });
+    }
+    /** Get an nbunksec encoded session that clients can import */
+    async getNbunksec(clientSigner = new PrivateKeySigner()) {
+        return createNbunksec({
+            remote: await this.signer.getPublicKey(),
+            clientKey: bytesToHex(clientSigner.key),
+            relays: this.relays,
+            bunkerSecret: this.bunkerSecret,
         });
     }
 }

package/dist/signers/nostr-connect-signer.d.ts

@@ -2,7 +2,7 @@ import { EventTemplate, NostrEvent, verifyEvent } from "applesauce-core/helpers/
 import { Deferred } from "applesauce-core/promise";
 import { ISigner, NostrConnectionMethodsOptions, NostrPool, NostrPublishMethod, NostrSubscriptionMethod, PrivateKeySigner } from "applesauce-signers";
 import { Subscription } from "rxjs";
-import { BunkerURI, NostrConnectAppMetadata } from "../helpers/nostr-connect.js";
+import { BunkerURI, NostrConnectAppMetadata, Nbunksec } from "../helpers/nostr-connect.js";
 export type NostrConnectSignerOptions = NostrConnectionMethodsOptions & {
     /** The relays to communicate over */
     relays: string[];
@@ -12,8 +12,12 @@ export type NostrConnectSignerOptions = NostrConnectionMethodsOptions & {
     remote?: string;
     /** Users pubkey */
     pubkey?: string;
-    /** A secret used when initalizing the connection from the client side */
+    /** @deprecated Use connectSecret instead */
     secret?: string;
+    /** A secret used when initiating the connection from the client side (the `secret` in a nostrconnect:// URI) */
+    connectSecret?: string;
+    /** A secret used when connecting to a remote bunker (the `secret` in a bunker:// URI) */
+    bunkerSecret?: string;
     /** A method for handling "auth" requests */
     onAuth?: (url: string) => Promise<void>;
 };
@@ -46,8 +50,13 @@ export declare class NostrConnectSigner implements ISigner {
     /** A method for handling "auth" requests */
     onAuth: (url: string) => Promise<void>;
     verifyEvent: typeof verifyEvent;
-    /** A secret used when initiating a connection from the client side */
-    secret: string;
+    /** A secret used when initiating a connection from the client side (the `secret` in a nostrconnect:// URI) */
+    connectSecret: string;
+    /** A secret used when connecting to a remote bunker (the `secret` in a bunker:// URI) */
+    bunkerSecret?: string;
+    /** @deprecated Use connectSecret instead */
+    get secret(): string;
+    set secret(value: string);
     nip04?: {
         encrypt: (pubkey: string, plaintext: string) => Promise<string>;
         decrypt: (pubkey: string, ciphertext: string) => Promise<string>;
@@ -69,8 +78,12 @@ export declare class NostrConnectSigner implements ISigner {
     handleEvent(event: NostrEvent): Promise<void>;
     protected createRequestEvent(content: string, target?: string | undefined, kind?: number): Promise<import("nostr-tools/core").VerifiedEvent>;
     private makeRequest;
-    /** Connect to remote signer */
-    connect(secret?: string | undefined, permissions?: string[]): Promise<string>;
+    /**
+     * Connect to a remote signer
+     * @param bunkerSecret - The `secret` from a `bunker://` URI used to authorize this client with the remote signer
+     * @param permissions - The signing permissions to request (see {@link NostrConnectSigner.buildSigningPermissions})
+     */
+    connect(bunkerSecret?: string | undefined, permissions?: string[]): Promise<string>;
     private waitingPromise;
     /** Wait for a remote signer to connect */
     waitForSigner(abort?: AbortSignal): Promise<void>;
@@ -95,10 +108,24 @@ export declare class NostrConnectSigner implements ISigner {
      * @returns An array of relay URLs if the signer wants to switch relays, or null if no change
      */
     switchRelays(): Promise<string[] | null>;
+    /**
+     * Notify the remote signer that the session is ending and close the connection
+     *
+     * The `logout` request is a courtesy hint, so the local connection is always closed even if the
+     * remote signer does not acknowledge it. The consumer is responsible for deleting any persisted
+     * client keypair.
+     */
+    logout(): Promise<void>;
     /** Returns the nostrconnect:// URI for this signer */
     getNostrConnectURI(metadata?: NostrConnectAppMetadata): string;
+    /** Returns the nbunksec encoded session for this signer */
+    getNbunksec(): string;
     /** Parses a bunker:// URI */
     static parseBunkerURI(uri: string): BunkerURI;
+    /** Parses an nbunksec encoded session */
+    static parseNbunksec(encoded: string): Nbunksec;
+    /** Creates an nbunksec encoded session */
+    static createNbunksec(data: Nbunksec): string;
     /** Builds an array of signing permissions for event kinds */
     static buildSigningPermissions(kinds: number[]): string[];
     /** Create a {@link NostrConnectSigner} from a bunker:// URI */
@@ -106,4 +133,8 @@ export declare class NostrConnectSigner implements ISigner {
         permissions?: string[];
         signer?: PrivateKeySigner;
     }): Promise<NostrConnectSigner>;
+    /** Create a {@link NostrConnectSigner} from an nbunksec encoded session */
+    static fromNbunksec(encoded: string, options?: Omit<NostrConnectSignerOptions, "relays" | "remote" | "signer" | "bunkerSecret"> & {
+        permissions?: string[];
+    }): Promise<NostrConnectSigner>;
 }

package/dist/signers/nostr-connect-signer.js

@@ -1,13 +1,13 @@
 import { logger } from "applesauce-core";
 import { getHiddenContent, isHexKey, unixNow } from "applesauce-core/helpers";
-import { kinds, verifyEvent } from "applesauce-core/helpers/event";
+import { bytesToHex, hexToBytes, kinds, verifyEvent } from "applesauce-core/helpers/event";
 import { getPublicKey } from "applesauce-core/helpers/keys";
 import { createDefer } from "applesauce-core/promise";
 import { PrivateKeySigner, getConnectionMethods, } from "applesauce-signers";
 import { nanoid } from "nanoid";
 import { filter, from, repeat, retry } from "rxjs";
 import { isNIP04 } from "../helpers/encryption.js";
-import { NostrConnectMethod, buildSigningPermissions, createNostrConnectURI, parseBunkerURI, } from "../helpers/nostr-connect.js";
+import { createNbunksec, NostrConnectMethod, buildSigningPermissions, createNostrConnectURI, parseBunkerURI, parseNbunksec, } from "../helpers/nostr-connect.js";
 async function defaultHandleAuth(url) {
     window.open(url, "auth", "width=400,height=600,resizable=no,status=no,location=no,toolbar=no,menubar=no");
 }
@@ -42,15 +42,25 @@ export class NostrConnectSigner {
     /** A method for handling "auth" requests */
     onAuth = defaultHandleAuth;
     verifyEvent = verifyEvent;
-    /** A secret used when initiating a connection from the client side */
-    secret;
+    /** A secret used when initiating a connection from the client side (the `secret` in a nostrconnect:// URI) */
+    connectSecret;
+    /** A secret used when connecting to a remote bunker (the `secret` in a bunker:// URI) */
+    bunkerSecret;
+    /** @deprecated Use connectSecret instead */
+    get secret() {
+        return this.connectSecret;
+    }
+    set secret(value) {
+        this.connectSecret = value;
+    }
     nip04;
     nip44;
     constructor(options) {
         this.relays = options.relays;
         this.pubkey = options.pubkey;
         this.remote = options.remote;
-        this.secret = options.secret || nanoid(12);
+        this.connectSecret = options.connectSecret || options.secret || nanoid(12);
+        this.bunkerSecret = options.bunkerSecret;
         // Get the subscription and publish methods
         const { subscriptionMethod, publishMethod } = getConnectionMethods(options, NostrConnectSigner);
         // Use arrow functions so "this" isn't bound to the signer
@@ -128,7 +138,8 @@ export class NostrConnectSigner {
                 return;
             const response = JSON.parse(responseStr);
             // handle remote signer connection
-            if (!this.remote && (response.result === "ack" || (this.secret && response.result === this.secret))) {
+            if (!this.remote &&
+                (response.result === "ack" || (this.connectSecret && response.result === this.connectSecret))) {
                 this.log("Got ack response from", event.pubkey, response.result);
                 this.isConnected = true;
                 this.remote = event.pubkey;
@@ -196,8 +207,12 @@ export class NostrConnectSigner {
         this.log(`Sent ${id} (${method})`);
         return p;
     }
-    /** Connect to remote signer */
-    async connect(secret, permissions) {
+    /**
+     * Connect to a remote signer
+     * @param bunkerSecret - The `secret` from a `bunker://` URI used to authorize this client with the remote signer
+     * @param permissions - The signing permissions to request (see {@link NostrConnectSigner.buildSigningPermissions})
+     */
+    async connect(bunkerSecret, permissions) {
         // Attempt to connect to the users pubkey if remote note set
         if (!this.remote && this.pubkey)
             this.remote = this.pubkey;
@@ -205,9 +220,11 @@ export class NostrConnectSigner {
             throw new Error("Missing remote signer pubkey");
         await this.open();
         try {
+            if (bunkerSecret !== undefined)
+                this.bunkerSecret = bunkerSecret;
             const result = await this.makeRequest(NostrConnectMethod.Connect, [
                 this.remote,
-                secret || "",
+                this.bunkerSecret || "",
                 permissions?.join(",") ?? "",
             ]);
             this.isConnected = true;
@@ -330,28 +347,80 @@ export class NostrConnectSigner {
         }
         return result;
     }
+    /**
+     * Notify the remote signer that the session is ending and close the connection
+     *
+     * The `logout` request is a courtesy hint, so the local connection is always closed even if the
+     * remote signer does not acknowledge it. The consumer is responsible for deleting any persisted
+     * client keypair.
+     */
+    async logout() {
+        try {
+            if (this.isConnected && this.remote)
+                await this.makeRequest(NostrConnectMethod.Logout, []);
+        }
+        catch (error) {
+            this.log("Failed to send logout request", error);
+        }
+        finally {
+            this.isConnected = false;
+            await this.close();
+        }
+    }
     /** Returns the nostrconnect:// URI for this signer */
     getNostrConnectURI(metadata) {
         return createNostrConnectURI({
             client: getPublicKey(this.signer.key),
-            secret: this.secret,
+            connectSecret: this.connectSecret,
             relays: this.relays,
             metadata,
         });
     }
+    /** Returns the nbunksec encoded session for this signer */
+    getNbunksec() {
+        if (!this.remote)
+            throw new Error("Cant create nbunksec when remote signer is not set");
+        return createNbunksec({
+            remote: this.remote,
+            clientKey: bytesToHex(this.signer.key),
+            relays: this.relays,
+            bunkerSecret: this.bunkerSecret,
+        });
+    }
     /** Parses a bunker:// URI */
     static parseBunkerURI(uri) {
         return parseBunkerURI(uri);
     }
+    /** Parses an nbunksec encoded session */
+    static parseNbunksec(encoded) {
+        return parseNbunksec(encoded);
+    }
+    /** Creates an nbunksec encoded session */
+    static createNbunksec(data) {
+        return createNbunksec(data);
+    }
     /** Builds an array of signing permissions for event kinds */
     static buildSigningPermissions(kinds) {
         return buildSigningPermissions(kinds);
     }
     /** Create a {@link NostrConnectSigner} from a bunker:// URI */
     static async fromBunkerURI(uri, options) {
-        const { remote, relays, secret } = NostrConnectSigner.parseBunkerURI(uri);
-        const client = new NostrConnectSigner({ relays, remote, ...options });
-        await client.connect(secret, options?.permissions);
+        const { remote, relays, bunkerSecret } = NostrConnectSigner.parseBunkerURI(uri);
+        const client = new NostrConnectSigner({ relays, remote, bunkerSecret, ...options });
+        await client.connect(bunkerSecret, options?.permissions);
+        return client;
+    }
+    /** Create a {@link NostrConnectSigner} from an nbunksec encoded session */
+    static async fromNbunksec(encoded, options) {
+        const { remote, clientKey, relays, bunkerSecret } = NostrConnectSigner.parseNbunksec(encoded);
+        const client = new NostrConnectSigner({
+            relays,
+            remote,
+            signer: new PrivateKeySigner(hexToBytes(clientKey)),
+            bunkerSecret,
+            ...options,
+        });
+        await client.connect(bunkerSecret, options?.permissions);
         return client;
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "applesauce-signers",
-  "version": "6.0.1",
+  "version": "6.2.0",
   "description": "Signer classes for applesauce",
   "type": "module",
   "main": "dist/index.js",
@@ -44,8 +44,9 @@
     }
   },
   "dependencies": {
-    "@noble/secp256k1": "^1.7.1",
-    "applesauce-core": "^6.0.0",
+    "@noble/secp256k1": "^3.1.0",
+    "@sandwichfarm/encoded-entities": "^0.1.1",
+    "applesauce-core": "^6.2.0",
     "debug": "^4.4.0",
     "nanoid": "^5.0.9",
     "rxjs": "^7.8.2"