libp2r2p 0.0.1

package/AGENTS.md

@@ -0,0 +1,20 @@
+# AGENTS.md
+
+## Project Shape
+
+libp2r2p is an ESM package with no build step. Public package exports should
+come from their own folders, each with an `index.js` entry point. Prefer
+singular public subpaths, such as `libp2r2p/key` and `libp2r2p/relay`.
+
+Public export folders may organize implementation details with `constants/`,
+`helpers/`, and `services/` subfolders. Additional custom public subfolders
+are fine when they are part of the API, such as `private-messenger/recovery`
+or `content-key/event`, and those should also expose an `index.js`.
+
+Root-level `constants/`, `helpers/`, and `services/` folders are reserved
+for shared internal code that is not itself a public export. Do not expose
+internal files directly through `package.json`; add or adjust an export-folder
+`index.js` instead.
+
+Keep the `exports` object in `package.json` sorted, with `.` first.
+Do not keep backwards-compatible alias exports unless explicitly requested.

package/README.md

@@ -0,0 +1,129 @@
+# libp2r2p
+
+Peer-to-relay-to-peer utilities for Nostr apps.
+
+libp2r2p focuses on flows where one peer talks to another peer with Nostr
+relays in the middle. It is not pure peer-to-peer networking; relays provide
+the transport and discovery surface. The package was born to distribute the
+private messenger reference implementation, and it also carries a few Nostr
+power-ups used by that messenger.
+
+## Private Messenger
+
+The main API is `createPrivateMessenger` from `libp2r2p/private-messenger`.
+It coordinates private-channel wrapping, relay watching, recovery state, and
+content-key lookup for direct or group-style private app messages.
+
+```js
+import { createPrivateMessenger } from 'libp2r2p/private-messenger'
+
+const messenger = await createPrivateMessenger({
+  userSigner,
+  contentKeySigner,
+  channels: [{
+    signer: privateChannelSigner,
+    relays: ['wss://relay.example'],
+    mode: 'leecher'
+  }],
+  onError: err => console.warn('private messenger failed', err)
+})
+
+async function logMessages () {
+  for await (const message of messenger.messages()) {
+    console.log(message.type, message.payload)
+  }
+}
+
+logMessages().catch(err => console.warn('private messenger messages failed', err))
+
+await messenger.tell({
+  receiverPubkey,
+  payload: { text: 'hello' }
+})
+```
+
+### Deleting Private Broadcasts
+
+High-level private-message sends create one deletion capability for the whole
+logical message. The returned object keeps its normal result fields and adds
+`deletionPubkey` plus, when the library generated the key, `deletionSeckey`.
+All outer kind `3560` chunks for that send carry the public
+`['s', deletionPubkey]` tag.
+
+Pass a pre-generated `deletionPubkey` when the application needs to own and
+persist the secret before sending. In that case the result deliberately omits a
+secret it was not given:
+
+```js
+import { generateKeypair } from 'libp2r2p/key'
+
+const deletionKey = generateKeypair()
+const sent = await messenger.tell({
+  receiverPubkey,
+  payload: { text: 'remove this later' },
+  deletionPubkey: deletionKey.pubkey
+})
+
+// Persist deletionKey.seckey with the application's copy of the message.
+console.log(sent.deletionPubkey)
+```
+
+The `s` tag is public metadata, so it makes the outer chunks for one message
+linkable. It is a deletion capability, not the channel key or the sender's
+identity. libp2r2p does not automatically delete anything: an application can
+later find candidate outer events with a filter such as
+`{ kinds: [3560], authors: [channelPubkey], '#s': [deletionPubkey] }`, then
+sign a kind `5` deletion event with the matching secret key. Relay support for
+this capability is not universal. A relay that supports it SHOULD recognize
+only the explicit `k=3560` deletion form; a regular NIP-09 kind `5` event
+signed by the outer event's private-channel key MUST NOT delete a kind `3560`
+event, whether or not that event carries an `s` tag.
+
+### Temporary Send Storage
+
+While an outgoing private message is being assembled, the messenger keeps
+encrypted envelope rows and router chunks in `sessionStorage`. They are
+removed when the send finishes, but an interrupted browser operation can leave
+them behind until cleanup runs.
+
+`PrivateMessenger.init()` performs cleanup automatically. Call
+`PrivateMessenger.cleanupTemporaryStorage()` once during app startup when
+messenger initialization may be delayed, such as while an account is locked:
+
+```js
+import { PrivateMessenger } from 'libp2r2p/private-messenger'
+
+PrivateMessenger.cleanupTemporaryStorage()
+```
+
+Call it before any private-message send using that storage area starts. It
+does not clear persisted messages, recovery material, or channel state. Pass
+`temporaryStorageArea: localStorage` when constructing a messenger to opt into
+a different Storage area.
+
+Signers are expected to expose the Nostr-style methods used by the messenger,
+including `getPublicKey()`, `signEvent(event)`, and the NIP-44 v3 methods
+needed by private channels. For double-DH content-key use, pass a
+`contentKeySigner` or a signer implementation that handles content keys
+internally.
+
+Messages are stored in a bounded, durable IndexedDB queue until consumed:
+
+```js
+async function handleMessages () {
+  for await (const message of messenger.messages()) {
+    if (message.type === 'message') {
+      console.log(message.payload)
+    }
+  }
+}
+
+handleMessages().catch(err => console.warn('private messenger messages failed', err))
+```
+
+For one-at-a-time consumption, use `await messenger.nextMessage()`. Queue
+clearing is asynchronous too: `await messenger.clearChannel(channelPubkey)`.
+
+Use explicit subpath imports for bundle size. The package root re-exports the
+main messenger API for convenience, but applications that only need one piece
+should import that subpath directly.

package/base16/index.js

@@ -0,0 +1,14 @@
+export function bytesToBase16 (bytes) {
+  let s = ''
+  for (const b of bytes) s += b.toString(16).padStart(2, '0')
+  return s
+}
+
+export function base16ToBytes (base16) {
+  const out = new Uint8Array(base16.length / 2)
+  for (let i = 0; i < out.length; i++) out[i] = parseInt(base16.slice(i * 2, i * 2 + 2), 16)
+  return out
+}
+
+export const bytesToHex = bytesToBase16
+export const hexToBytes = base16ToBytes

package/base64/index.js

@@ -0,0 +1,29 @@
+// Plain and URL-safe base64 codecs for binary <-> string conversion.
+// Plain base64 is used where a protocol expects standard base64. URL-safe
+// base64 is useful for WebAuthn credential IDs and URL/query-string material.
+
+export function bytesToBase64 (bytes) {
+  let s = ''
+  for (let i = 0; i < bytes.length; i++) s += String.fromCharCode(bytes[i])
+  return btoa(s)
+}
+
+export function base64ToBytes (b64) {
+  const bin = atob(b64)
+  const out = new Uint8Array(bin.length)
+  for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i)
+  return out
+}
+
+export function bytesToBase64Url (bytes) {
+  return bytesToBase64(bytes)
+    .replace(/\+/g, '-')
+    .replace(/\//g, '_')
+    .replace(/=+$/g, '')
+}
+
+export function base64UrlToBytes (base64url) {
+  const value = String(base64url)
+  const pad = value.length % 4 === 0 ? '' : '='.repeat(4 - (value.length % 4))
+  return base64ToBytes(value.replace(/-/g, '+').replace(/_/g, '/') + pad)
+}

package/content-key/event/index.js

@@ -0,0 +1,85 @@
+import { getEventHash, verifyEvent } from 'nostr-tools'
+
+export const CONTENT_KEY_KIND = 18716
+
+const HEX_PUBKEY = /^[0-9a-f]{64}$/i
+const HEX_SIG = /^[0-9a-f]{128}$/i
+
+function nowSeconds () {
+  return Math.floor(Date.now() / 1000)
+}
+
+export async function makeContentKeyEventForPubkey ({ userSigner, contentPubkey, createdAt = nowSeconds() }) {
+  if (!userSigner?.getPublicKey || !userSigner?.signEvent) throw new Error('USER_SIGNER_REQUIRED')
+  if (!HEX_PUBKEY.test(contentPubkey || '')) throw new Error('CONTENT_PUBKEY_REQUIRED')
+
+  return userSigner.signEvent({
+    kind: CONTENT_KEY_KIND,
+    created_at: createdAt,
+    tags: [['cp', contentPubkey]],
+    content: ''
+  })
+}
+
+export async function makeContentKeyEvent ({ userSigner, contentKeySigner, createdAt = nowSeconds() }) {
+  if (!contentKeySigner?.getPublicKey) throw new Error('CONTENT_KEY_SIGNER_REQUIRED')
+  return makeContentKeyEventForPubkey({
+    userSigner,
+    contentPubkey: await contentKeySigner.getPublicKey(),
+    createdAt
+  })
+}
+
+export function parseContentKeyEvent (event) {
+  if (!event || event.kind !== CONTENT_KEY_KIND || event.content !== '') return null
+  if (!HEX_PUBKEY.test(event.pubkey) || !Number.isSafeInteger(event.created_at)) return null
+  if (!Array.isArray(event.tags) || event.tags.length !== 1) return null
+  if (event.id !== getEventHash(event) || !verifyEvent(event)) return null
+
+  const [name, contentPubkey, ...rest] = event.tags[0] || []
+  if (name !== 'cp' || rest.length || !HEX_PUBKEY.test(contentPubkey || '')) return null
+  return { iykcPubkey: contentPubkey, iykcProof: makeContentKeyProof(event) }
+}
+
+export function makeContentKeyProof (contentKeyEvent) {
+  if (!Number.isSafeInteger(contentKeyEvent?.created_at) || !HEX_SIG.test(contentKeyEvent?.sig || '')) return ''
+  return `${contentKeyEvent.created_at}:${contentKeyEvent.sig}`
+}
+
+export const makeIykcProof = makeContentKeyProof
+
+function parseContentKeyProof (proof) {
+  if (typeof proof !== 'string') return null
+  const [createdAtString, sig, extra] = proof.split(':')
+  if (extra != null || !/^\d+$/.test(createdAtString || '') || !HEX_SIG.test(sig || '')) return null
+  // eslint-disable-next-line camelcase
+  const created_at = Number(createdAtString)
+  if (!Number.isSafeInteger(created_at)) return null
+  // eslint-disable-next-line camelcase
+  return { created_at, sig }
+}
+
+export function verifyContentKeyProof ({ ownerPubkey, contentPubkey, proof }) {
+  if (!HEX_PUBKEY.test(ownerPubkey || '') || !HEX_PUBKEY.test(contentPubkey || '')) return false
+  const parsed = parseContentKeyProof(proof)
+  if (!parsed) return false
+
+  const event = {
+    kind: CONTENT_KEY_KIND,
+    pubkey: ownerPubkey,
+    created_at: parsed.created_at,
+    tags: [['cp', contentPubkey]],
+    content: '',
+    sig: parsed.sig
+  }
+  event.id = getEventHash(event)
+  return verifyEvent(event)
+}
+
+export function verifyIykcProof ({ receiverPubkey, iykcPubkey, iykcProof }) {
+  return verifyContentKeyProof({
+    ownerPubkey: receiverPubkey,
+    contentPubkey: iykcPubkey,
+    proof: iykcProof
+  })
+}

package/content-key/index.js

@@ -0,0 +1 @@
+export { getIykcProofs } from './services/iykc-proof.js'

package/content-key/services/iykc-proof.js

@@ -0,0 +1,129 @@
+import { CONTENT_KEY_KIND, parseContentKeyEvent } from '../event/index.js'
+import { pickRelaysForPubkeys, getRelaysByPubkey, relayPool } from '../../relay/index.js'
+
+const QUERY_CACHE_MS = 40 * 60 * 1000
+const IYKC_CACHE_MAX_ITEMS = 10000
+const HEX_PUBKEY = /^[0-9a-f]{64}$/i
+const contentKeysByPubkey = Object.create(null)
+const iykcCacheTimersByPubkey = Object.create(null)
+const iykcCacheAddedAtByPubkey = Object.create(null)
+
+const getEvents = (...args) => relayPool.getEvents(...args)
+
+function hasCachedKey (cache, key) {
+  return Object.prototype.hasOwnProperty.call(cache, key)
+}
+
+function maybeUnref (timer) {
+  timer?.unref?.()
+  return timer
+}
+
+function uniquePubkeys (pubkeys, { requireHex = false } = {}) {
+  const values = [...new Set(pubkeys || [])].filter(Boolean)
+  return requireHex ? values.filter(pubkey => HEX_PUBKEY.test(pubkey)) : values
+}
+
+function cloneContentKey (contentKey) {
+  return contentKey
+    ? {
+        iykcPubkey: contentKey.iykcPubkey,
+        iykcProof: contentKey.iykcProof
+      }
+    : null
+}
+
+function deleteCachedValue (cache, timers, addedAt, key) {
+  clearTimeout(timers[key])
+  delete cache[key]
+  delete timers[key]
+  delete addedAt[key]
+}
+
+function pruneCache (cache, timers, addedAt, maxItems) {
+  const keys = Object.keys(cache)
+  if (keys.length <= maxItems) return
+
+  keys
+    .sort((a, b) => (addedAt[a] || 0) - (addedAt[b] || 0))
+    .slice(0, keys.length - maxItems)
+    .forEach(key => deleteCachedValue(cache, timers, addedAt, key))
+}
+
+function setCachedValue (cache, timers, addedAt, key, value, cacheMs) {
+  cache[key] = value
+  addedAt[key] = Date.now()
+  clearTimeout(timers[key])
+  if (cacheMs > 0) {
+    timers[key] = maybeUnref(setTimeout(() => {
+      deleteCachedValue(cache, timers, addedAt, key)
+    }, cacheMs))
+  } else {
+    delete timers[key]
+  }
+}
+
+export function clearContentKeyCache () {
+  for (const timer of Object.values(iykcCacheTimersByPubkey)) clearTimeout(timer)
+  for (const key of Object.keys(contentKeysByPubkey)) delete contentKeysByPubkey[key]
+  for (const key of Object.keys(iykcCacheTimersByPubkey)) delete iykcCacheTimersByPubkey[key]
+  for (const key of Object.keys(iykcCacheAddedAtByPubkey)) delete iykcCacheAddedAtByPubkey[key]
+}
+
+export async function getIykcProofs (pubkeys, {
+  _getEvents = getEvents,
+  _getRelaysByPubkey = getRelaysByPubkey,
+  cacheMs = QUERY_CACHE_MS
+} = {}) {
+  const pubkeyList = uniquePubkeys(pubkeys, { requireHex: _getEvents === getEvents })
+  if (!pubkeyList.length) return {}
+
+  const out = {}
+  const missingPubkeys = []
+  for (const pubkey of pubkeyList) {
+    if (!hasCachedKey(contentKeysByPubkey, pubkey)) {
+      missingPubkeys.push(pubkey)
+      continue
+    }
+    const cached = cloneContentKey(contentKeysByPubkey[pubkey])
+    if (cached) out[pubkey] = cached
+  }
+  if (!missingPubkeys.length) return out
+
+  const relaysByPubkey = await _getRelaysByPubkey(missingPubkeys, { _getEvents, cacheMs })
+  const relayToAuthors = pickRelaysForPubkeys(missingPubkeys, relaysByPubkey)
+  const eventGroups = await Promise.all(
+    [...relayToAuthors.entries()]
+      .map(async ([relay, authors]) => {
+        const { result } = await _getEvents({
+          kinds: [CONTENT_KEY_KIND],
+          authors,
+          limit: authors.length
+        }, [relay], {
+          timeout: 5000,
+          timeoutAfterFirstEose: null
+        })
+        return result
+      })
+  )
+
+  const latestByPubkey = {}
+  for (const event of eventGroups.flat()) {
+    const parsed = parseContentKeyEvent(event)
+    if (!parsed) continue
+    if (!latestByPubkey[event.pubkey] || event.created_at > latestByPubkey[event.pubkey].created_at) {
+      latestByPubkey[event.pubkey] = { created_at: event.created_at, ...parsed }
+    }
+  }
+
+  for (const pubkey of missingPubkeys) {
+    const entry = latestByPubkey[pubkey]
+    const proof = entry
+      ? { iykcPubkey: entry.iykcPubkey, iykcProof: entry.iykcProof }
+      : null
+    setCachedValue(contentKeysByPubkey, iykcCacheTimersByPubkey, iykcCacheAddedAtByPubkey, pubkey, cloneContentKey(proof), cacheMs)
+    if (proof) out[pubkey] = proof
+  }
+  pruneCache(contentKeysByPubkey, iykcCacheTimersByPubkey, iykcCacheAddedAtByPubkey, IYKC_CACHE_MAX_ITEMS)
+  return out
+}

package/double-dh/index.js

@@ -0,0 +1,166 @@
+import { extract, expand } from '@noble/hashes/hkdf.js'
+import { sha256 } from '@noble/hashes/sha2.js'
+import { concatBytes } from '@noble/hashes/utils.js'
+import { sharedXOnlySecret } from '../ecdh/index.js'
+
+const textEncoder = new TextEncoder()
+
+// HKDF extract salt naming this generic double-DH key schedule. It has no NUL
+// suffix because this fixed label is not concatenated with variable bytes
+// (unlike NIP-44 v3's "nip44-v3\x00" || nonce salt).
+const DOUBLE_DH_SALT = textEncoder.encode('nostr-double-dh-v1')
+
+/*
+Considering the following nomenclature, where a/b are lexicographically
+ordered identity pubkeys, not sender/receiver roles:
+  II = DH(aIdentitySecret, bIdentityPubkey)
+  IC = DH(aIdentitySecret, bContentPubkey)
+  CI = DH(aContentSecret,  bIdentityPubkey)
+  CC = DH(aContentSecret,  bContentPubkey)
+  Double-DH uses a minimal, fixed-order transcript of raw 32-byte DH outputs:
+  - identity mode uses no Double-DH transcript; callers fall back to identity NIP-44 v3.
+  - one content key uses identity/identity || identity/content, i.e. II || CI
+    when a has the content key, or II || IC when b has the content key.
+  - two content keys use identity/identity || content/content, i.e. II || CC.
+  Review of some DH combinations:
+  1) Four DHs (II || IC || CI || CC):
+  - useful when two participants have content keys
+  - requires both secrets from the same participant (a identity + a content,
+    or b identity + b content)
+  2) Three DHs (II || CC || IC or II || CC || CI):
+  - useful when two participants have content keys
+  - requires both secrets from one participant, or the cross-participant pair
+    matched by the mixed term (a identity + b content for IC, or
+    a content + b identity for CI)
+  3) Three DHs (CC || IC || CI):
+  - useful when two participants have content keys
+  - requires both content secrets, or both secrets from one participant
+  - prevents identity-only compromise, but both content keys are enough
+  - interesting that anyone can use two content keys and pretend that
+  any two participants are talking to each other.
+  4) [picked] Two DHs (II || CC):
+  - useful when two participants have content keys
+  - requires one identity secret and one content secret, from any participant pairing
+  - prevents identity-only and content-only compromise; weaker than 1) because
+    cross-participant identity+content leaks are enough
+  5) [picked] Two DHs (II || IC or II || CI):
+  - useful when exactly one participant has a content key
+  - requires either the identity-only participant's identity secret, or both
+    secrets from the content-key participant
+*/
+
+function u32be (n) {
+  const b = new Uint8Array(4)
+  new DataView(b.buffer).setUint32(0, n >>> 0, false)
+  return b
+}
+
+function normalizeKind (kind) {
+  const n = typeof kind === 'string' && kind.trim() !== '' ? Number(kind) : kind
+  if (!Number.isInteger(n) || n < 0 || n > 0xffffffff) throw new Error('INVALID_KIND')
+  return n
+}
+
+function sharedX (secretKey, pubkey) {
+  return sharedXOnlySecret(secretKey, pubkey)
+}
+
+function modeFor ({ senderContentPubkey, receiverContentPubkey }) {
+  if (senderContentPubkey && receiverContentPubkey) return 'both-content'
+  if (senderContentPubkey) return 'sender-content'
+  if (receiverContentPubkey) return 'receiver-content'
+  return 'identity'
+}
+
+function orderedPair ({ identityPubkey, contentPubkey, peerIdentityPubkey, peerContentPubkey }) {
+  const self = { identityPubkey, contentPubkey: contentPubkey || '', isSelf: true }
+  const peer = { identityPubkey: peerIdentityPubkey, contentPubkey: peerContentPubkey || '', isSelf: false }
+  return identityPubkey <= peerIdentityPubkey ? [self, peer] : [peer, self]
+}
+
+function hkdfInfo ({ kind, scope = '' }) {
+  const scopeBytes = textEncoder.encode(scope || '')
+  // By adding NIP-44 v3's public kind/scope context to the Double-DH conversation key
+  // derivation, we ensure that a leaked conversation key only decrypts messages with
+  // the same context.
+  return concatBytes(u32be(normalizeKind(kind)), u32be(scopeBytes.length), scopeBytes)
+}
+
+function identityIdentity ({ a, b, identitySecretKey }) {
+  return sharedX(identitySecretKey, b.isSelf ? a.identityPubkey : b.identityPubkey)
+}
+
+function aContentBIdentity ({ a, b, identitySecretKey, contentSecretKey }) {
+  return a.isSelf
+    ? sharedX(contentSecretKey, b.identityPubkey)
+    : sharedX(identitySecretKey, a.contentPubkey)
+}
+
+function aIdentityBContent ({ a, b, identitySecretKey, contentSecretKey }) {
+  return a.isSelf
+    ? sharedX(identitySecretKey, b.contentPubkey)
+    : sharedX(contentSecretKey, a.identityPubkey)
+}
+
+function contentContent ({ a, b, contentSecretKey }) {
+  return a.isSelf
+    ? sharedX(contentSecretKey, b.contentPubkey)
+    : sharedX(contentSecretKey, a.contentPubkey)
+}
+
+export function deriveDoubleDhConversationKey ({
+  role,
+  identitySecretKey,
+  identityPubkey,
+  contentSecretKey,
+  contentPubkey = '',
+  peerIdentityPubkey,
+  peerContentPubkey = '',
+  kind,
+  scope = ''
+}) {
+  if (role !== 'sender' && role !== 'receiver') throw new Error('INVALID_DOUBLE_DH_ROLE')
+  if (!identitySecretKey || !identityPubkey || !peerIdentityPubkey) throw new Error('DOUBLE_DH_IDENTITY_REQUIRED')
+
+  const isSender = role === 'sender'
+  const senderContentPubkey = isSender ? contentPubkey : peerContentPubkey
+  const receiverContentPubkey = isSender ? peerContentPubkey : contentPubkey
+  const mode = modeFor({ senderContentPubkey, receiverContentPubkey })
+
+  if (mode === 'identity') return { mode, conversationKey: null }
+  if (isSender && senderContentPubkey && !contentSecretKey) throw new Error('SENDER_CONTENT_KEY_REQUIRED')
+  if (!isSender && receiverContentPubkey && !contentSecretKey) throw new Error('RECEIVER_CONTENT_KEY_REQUIRED')
+
+  const [a, b] = orderedPair({ identityPubkey, contentPubkey, peerIdentityPubkey, peerContentPubkey })
+  const steps = []
+
+  if (identityPubkey === peerIdentityPubkey) {
+    const ownContentPubkey = contentPubkey || peerContentPubkey
+    if (ownContentPubkey && !contentSecretKey) {
+      throw new Error(isSender ? 'SENDER_CONTENT_KEY_REQUIRED' : 'RECEIVER_CONTENT_KEY_REQUIRED')
+    }
+    // In self-encryption, DH(identitySecret, contentPubkey) could be computed
+    // with either single secret plus the other public key. The two self-DH
+    // steps below are the minimal transcript that requires both secrets.
+    steps.push(sharedX(identitySecretKey, identityPubkey))
+    if (ownContentPubkey) {
+      steps.push(sharedX(contentSecretKey, ownContentPubkey))
+    }
+  } else {
+    steps.push(identityIdentity({ a, b, identitySecretKey }))
+    if (a.contentPubkey && b.contentPubkey) {
+      steps.push(contentContent({ a, b, contentSecretKey }))
+    } else if (a.contentPubkey) {
+      steps.push(aContentBIdentity({ a, b, identitySecretKey, contentSecretKey }))
+    } else if (b.contentPubkey) {
+      steps.push(aIdentityBContent({ a, b, identitySecretKey, contentSecretKey }))
+    }
+  }
+
+  const ikm = concatBytes(...steps)
+  const prk = extract(sha256, ikm, DOUBLE_DH_SALT)
+  return {
+    mode,
+    conversationKey: expand(sha256, prk, hkdfInfo({ kind, scope }), 32)
+  }
+}

package/ecdh/index.js

@@ -0,0 +1,8 @@
+import { secp256k1 } from '@noble/curves/secp256k1.js'
+import { hexToBytes } from '../base16/index.js'
+
+export function sharedXOnlySecret (seckey, pubkey) {
+  // Nostr pubkeys are x-only. secp256k1 ECDH expects a compressed point, so
+  // use the even-y prefix and drop the returned parity byte.
+  return secp256k1.getSharedSecret(seckey, hexToBytes(`02${pubkey}`)).subarray(1, 33)
+}

package/idb/index.js

@@ -0,0 +1,64 @@
+const READ_METHODS = new Set([
+  'count',
+  'get',
+  'getAll',
+  'getAllKeys',
+  'getKey',
+  'openCursor',
+  'openKeyCursor'
+])
+
+function deferred () {
+  let resolve
+  let reject
+  const promise = new Promise((nextResolve, nextReject) => {
+    resolve = nextResolve
+    reject = nextReject
+  })
+  return { promise, resolve, reject }
+}
+
+// A small wrapper around one IndexedDB request.
+// It leaves database creation and schema ownership to the caller.
+// Reuse `p` when advancing a cursor with `cursor.continue()`.
+export async function run (method, args = [], storeName, indexName, {
+  db,
+  p = deferred(),
+  tx,
+  txMode = tx?.mode,
+  storeOrIndex
+} = {}) {
+  if (!tx) {
+    if (!db) throw new Error('IDB_DATABASE_REQUIRED')
+    if (!storeName) throw new Error('IDB_STORE_REQUIRED')
+    // Caller may pre-select it if it wants to use many different methods in a row
+    txMode ??= READ_METHODS.has(method) ? 'readonly' : 'readwrite'
+    tx = db.transaction([storeName], txMode)
+  }
+
+  if (!storeOrIndex) {
+    if (!storeName) throw new Error('IDB_STORE_REQUIRED')
+    const store = tx.objectStore(storeName)
+    storeOrIndex = indexName ? store.index(indexName) : store
+  }
+
+  let request
+  try {
+    request = storeOrIndex[method](...args)
+  } catch (err) {
+    p.reject(err)
+    try { tx.abort() } catch {}
+    return p.promise
+  }
+
+  request.onsuccess = () => {
+    // don't add p to this object
+    p.resolve({ result: request.result, tx, storeOrIndex })
+  }
+  request.onerror = () => {
+    p.reject(request.error || new Error('IDB_REQUEST_FAILED'))
+    try { tx.abort() } catch {}
+  }
+
+  return p.promise
+}