libp2r2p 0.0.1

package/index.js

@@ -0,0 +1,21 @@
+export * from './private-messenger/index.js'
+
+export * as base16 from './base16/index.js'
+export * as base64 from './base64/index.js'
+export * as contentKey from './content-key/index.js'
+export * as contentKeyEvent from './content-key/event/index.js'
+export * as doubleDh from './double-dh/index.js'
+export * as ecdh from './ecdh/index.js'
+export * as idb from './idb/index.js'
+export * as idbQueue from './idb-queue/index.js'
+export * as key from './key/index.js'
+export * as network from './network/index.js'
+export * as nip44v3 from './nip44-v3/index.js'
+export * as nip46 from './nip46/index.js'
+export * as privateChannel from './private-channel/index.js'
+export * as privateMessage from './private-message/index.js'
+export * as privateMessenger from './private-messenger/index.js'
+export * as privateMessengerRecovery from './private-messenger/recovery/index.js'
+export * as relay from './relay/index.js'
+export * as temporaryStorage from './temporary-storage/index.js'
+export * as webStorageQueue from './web-storage-queue/index.js'

package/key/index.js

@@ -0,0 +1,139 @@
+import {
+  generateSecretKey,
+  getPublicKey,
+  finalizeEvent,
+  nip19
+} from 'nostr-tools'
+
+import { bytesToHex, hexToBytes } from '../base16/index.js'
+
+const HEX_SECKEY_REGEX = /^[0-9a-f]{64}$/i
+
+export function generateKeypair () {
+  const secretKey = generateSecretKey()
+  const pubkey = getPublicKey(secretKey)
+  return {
+    secretKey,
+    seckey: bytesToHex(secretKey),
+    pubkey,
+    nsec: nip19.nsecEncode(secretKey),
+    npub: nip19.npubEncode(pubkey)
+  }
+}
+
+// Accepts either an `nsec1...` bech32 string or a 64-char hex secret key.
+// Returns both encodings so callers can store the hex form and display the
+// nsec form without re-decoding.
+export function keypairFromSeckey (raw) {
+  let secretKey
+  if (HEX_SECKEY_REGEX.test(raw)) {
+    secretKey = hexToBytes(raw.toLowerCase())
+  } else {
+    const decoded = nip19.decode(raw)
+    if (decoded.type !== 'nsec') throw new Error('NOT_A_SECRET_KEY')
+    secretKey = decoded.data
+  }
+  const pubkey = getPublicKey(secretKey)
+  return {
+    secretKey,
+    seckey: bytesToHex(secretKey),
+    pubkey,
+    nsec: nip19.nsecEncode(secretKey),
+    npub: nip19.npubEncode(pubkey)
+  }
+}
+
+// npub-only: hex pubkeys are not accepted for read-only imports because
+// bech32 includes a checksum that protects against user-typo imports of a
+// pubkey they cannot sign for.
+export function pubkeyFromNpub (npub) {
+  const decoded = nip19.decode(npub)
+  if (decoded.type !== 'npub') throw new Error('NOT_AN_NPUB')
+  return decoded.data
+}
+
+export function nsecFromHex (hex) {
+  return nip19.nsecEncode(hexToBytes(hex))
+}
+
+export function npubFromPubkey (pubkey) {
+  return nip19.npubEncode(pubkey)
+}
+
+function cleanProfileValue (value) {
+  return String(value ?? '').trim()
+}
+
+function profileContentFromEvent (event) {
+  if (!event?.content) return {}
+  try {
+    const parsed = JSON.parse(event.content)
+    if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) return parsed
+  } catch {}
+  return {}
+}
+
+export function profileEventTemplate ({ name = '', picture = '', profileEvent = null } = {}) {
+  const cleanName = cleanProfileValue(name)
+  const cleanPicture = cleanProfileValue(picture)
+  const content = profileContentFromEvent(profileEvent)
+
+  if (cleanName) content.name = cleanName
+  else delete content.name
+  if (cleanPicture) content.picture = cleanPicture
+  else delete content.picture
+
+  const tags = Array.isArray(profileEvent?.tags)
+    ? profileEvent.tags
+      .filter(t => Array.isArray(t) && t[0] !== 'name' && t[0] !== 'picture')
+      .map(t => t.slice())
+    : []
+  if (cleanName) tags.push(['name', cleanName])
+  if (cleanPicture) tags.push(['picture', cleanPicture])
+
+  return {
+    kind: 0,
+    created_at: Math.floor(Date.now() / 1000),
+    tags,
+    content: JSON.stringify(content)
+  }
+}
+
+export function signProfileEvent ({ secretKey, name = '', picture, profileEvent = null }) {
+  return finalizeEvent(profileEventTemplate({ name, picture, profileEvent }), secretKey)
+}
+
+// Signs a NIP-65 kind:10002 relay-list event. Each URL present in both
+// `writeRelays` and `readRelays` is emitted as a bare `['r', url]` tag;
+// otherwise it gets the explicit `'read'` or `'write'` marker.
+export function signRelayListEvent ({ secretKey, writeRelays = [], readRelays = [] }) {
+  const write = new Set(writeRelays)
+  const read = new Set(readRelays)
+  const all = new Set([...write, ...read])
+  const tags = []
+  for (const url of all) {
+    const isWrite = write.has(url)
+    const isRead = read.has(url)
+    if (isWrite && isRead) tags.push(['r', url])
+    else if (isWrite) tags.push(['r', url, 'write'])
+    else tags.push(['r', url, 'read'])
+  }
+  return finalizeEvent({
+    kind: 10002,
+    created_at: Math.floor(Date.now() / 1000),
+    tags,
+    content: ''
+  }, secretKey)
+}
+
+export function parseProfileEvent (event) {
+  if (!event || event.kind !== 0) return { name: '', picture: '' }
+  let parsed = {}
+  try { parsed = JSON.parse(event.content) } catch { parsed = {} }
+  const fromTag = name => event.tags.find(t => t[0] === name)?.[1]
+  return {
+    name: (fromTag('name') || parsed.name || parsed.display_name || '').trim(),
+    about: (parsed.about || '').trim(),
+    picture: (fromTag('picture') || parsed.picture || '').trim()
+  }
+}

package/network/index.js

@@ -0,0 +1,68 @@
+export async function isOnline () {
+  if (typeof navigator !== 'undefined' && typeof navigator.onLine === 'boolean') {
+    if (!navigator.onLine) return false
+  }
+  return hasInternetConnectivity()
+}
+
+const CONNECTIVITY_PROBE_URLS = [
+  { url: 'https://www.gstatic.com/generate_204' },
+  { url: 'https://connectivitycheck.gstatic.com/generate_204' },
+  { url: 'https://captive.apple.com/hotspot-detect.html' },
+  { method: 'GET', url: 'https://connectivity-check.ubuntu.com' }
+]
+
+async function hasInternetConnectivity () {
+  const candidates = shuffle(CONNECTIVITY_PROBE_URLS)
+  for (const candidate of candidates) {
+    try {
+      await ping(candidate.url, { method: candidate.method })
+      return true
+    } catch (err) {
+      console.warn('connectivity probe failed', candidate.url, err?.message ?? err)
+    }
+  }
+  return false
+}
+
+function shuffle (list) {
+  const copy = list.slice()
+  for (let i = copy.length - 1; i > 0; i--) {
+    const j = Math.floor(Math.random() * (i + 1))
+    ;[copy[i], copy[j]] = [copy[j], copy[i]]
+  }
+  return copy
+}
+
+async function ping (url, { method = 'HEAD', timeout = 5000 } = {}) {
+  const abortController = typeof AbortController === 'function' ? new AbortController() : null
+  let timerId = null
+
+  const fetchPromise = fetch(url, {
+    method,
+    mode: 'no-cors',
+    cache: 'no-store',
+    redirect: 'follow',
+    signal: abortController?.signal
+  })
+
+  const completionPromise = fetchPromise.finally(() => {
+    if (timerId != null) clearTimeout(timerId)
+  })
+
+  const timeoutPromise = new Promise((_resolve, reject) => {
+    timerId = setTimeout(() => {
+      if (abortController) abortController.abort()
+      reject(new Error('PING_TIMEOUT'))
+    }, timeout)
+  })
+
+  await Promise.race([completionPromise, timeoutPromise])
+  return true
+}
+
+export function onOnline (handler) {
+  const listener = () => handler()
+  window.addEventListener('online', listener)
+  return () => window.removeEventListener('online', listener)
+}

package/nip44-v3/index.js

@@ -0,0 +1,175 @@
+import { extract as hkdfExtract, expand as hkdfExpand } from '@noble/hashes/hkdf.js'
+import { hmac } from '@noble/hashes/hmac.js'
+import { sha256 } from '@noble/hashes/sha2.js'
+import { concatBytes, utf8ToBytes } from '@noble/hashes/utils.js'
+import { chacha20 } from '@noble/ciphers/chacha.js'
+import { bytesToBase64, base64ToBytes } from '../base64/index.js'
+import { sharedXOnlySecret } from '../ecdh/index.js'
+
+// NIP-44 v3 — local implementation (spec.nostr.land/nip44v3)
+// Copied from the bunker testbench and verified against the vendored
+// upstream test-vectors.json, including non-standard zero-padding cases.
+
+const PAD = { minimum_size: 32, subdivs_small: 4, subdivs_large: 8, large_threshold: 32768 }
+const VERSION = 3
+const ZERO_NONCE = new Uint8Array(12)
+const textDecoder = new TextDecoder('utf-8', { ignoreBOM: true })
+const fatalTextDecoder = new TextDecoder('utf-8', { fatal: true })
+
+export function targetSize (len) {
+  if (len <= 0) return PAD.minimum_size
+  const nextPower = 2 ** Math.ceil(Math.log2(len))
+  const subdivs = nextPower >= PAD.large_threshold ? PAD.subdivs_large : PAD.subdivs_small
+  const chunkSize = Math.max(PAD.minimum_size, Math.floor(nextPower / subdivs))
+  return chunkSize * Math.ceil(len / chunkSize)
+}
+
+function u32be (n) {
+  const b = new Uint8Array(4)
+  new DataView(b.buffer).setUint32(0, n >>> 0, false)
+  return b
+}
+
+function readU32be (b, off) {
+  return new DataView(b.buffer, b.byteOffset, b.byteLength).getUint32(off, false)
+}
+
+function equalBytes (a, b) {
+  if (a.length !== b.length) return false
+  let diff = 0
+  for (let i = 0; i < a.length; i++) diff |= a[i] ^ b[i]
+  return diff === 0
+}
+
+function randomBytes32 () {
+  const bytes = new Uint8Array(32)
+  crypto.getRandomValues(bytes)
+  return bytes
+}
+
+export function deriveKeys (seckey, pubkey, nonce) {
+  const shared = sharedXOnlySecret(seckey, pubkey)
+  const salt = concatBytes(utf8ToBytes('nip44-v3\x00'), nonce)
+  const prk = hkdfExtract(sha256, shared, salt)
+  return {
+    prk,
+    encryption_key: hkdfExpand(sha256, prk, utf8ToBytes('encryption_key'), 32),
+    mac_key: hkdfExpand(sha256, prk, utf8ToBytes('mac_key'), 32)
+  }
+}
+
+function chacha (key, data) {
+  return chacha20(key, ZERO_NONCE, data)
+}
+
+function base64EncodedByteLength (byteLength) {
+  return Math.ceil(byteLength / 3) * 4
+}
+
+export function payloadByteLength (plaintextByteLength, scopeByteLength = 0) {
+  return base64EncodedByteLength(73 + scopeByteLength + targetSize(plaintextByteLength + 4))
+}
+
+export function deriveKeysFromConversationKey (conversationKey, nonce) {
+  const salt = concatBytes(utf8ToBytes('nip44-v3\x00'), nonce)
+  const prk = hkdfExtract(sha256, conversationKey, salt)
+  return {
+    prk,
+    encryption_key: hkdfExpand(sha256, prk, utf8ToBytes('encryption_key'), 32),
+    mac_key: hkdfExpand(sha256, prk, utf8ToBytes('mac_key'), 32)
+  }
+}
+
+// seckey: Uint8Array, pubkey: hex, scope/plaintext: Uint8Array. Returns base64 string.
+export function encryptBytes (seckey, pubkey, kind, scope, plaintext, nonce) {
+  return encryptWithConversationKeyBytes(deriveSharedConversationKey(seckey, pubkey), kind, scope, plaintext, nonce)
+}
+
+export function encryptWithConversationKeyBytes (conversationKey, kind, scope, plaintext, nonce) {
+  nonce ??= randomBytes32()
+  const { encryption_key: encryptionKey, mac_key: macKey } = deriveKeysFromConversationKey(conversationKey, nonce)
+  const prefixed = concatBytes(u32be(plaintext.length), plaintext)
+  const padded = new Uint8Array(targetSize(prefixed.length))
+  padded.set(prefixed)
+  const ct = chacha(encryptionKey, padded)
+  const stuffing = concatBytes(u32be(kind), u32be(scope.length), scope, ct)
+  const mac = hmac(sha256, macKey, concatBytes(nonce, stuffing))
+  return bytesToBase64(concatBytes(new Uint8Array([VERSION]), nonce, mac, stuffing))
+}
+
+export function decryptBytes (seckey, pubkey, expectedKind, expectedScope, ciphertext) {
+  return decryptWithConversationKeyBytes(deriveSharedConversationKey(seckey, pubkey), expectedKind, expectedScope, ciphertext)
+}
+
+export function decryptWithConversationKeyBytes (conversationKey, expectedKind, expectedScope, ciphertext) {
+  if (!ciphertext || ciphertext.length === 0) throw new Error('empty ciphertext')
+  if (ciphertext[0] === '#') throw new Error('unsupported future version')
+  let decoded
+  try { decoded = base64ToBytes(ciphertext) } catch { throw new Error('invalid base64') }
+  if (decoded.length < 77) throw new Error('ciphertext too short')
+  if (decoded[0] !== VERSION) throw new Error(`unsupported version ${decoded[0]}`)
+  const nonce = decoded.subarray(1, 33)
+  const mac = decoded.subarray(33, 65)
+  const kind = readU32be(decoded, 65)
+  const scopeLength = readU32be(decoded, 69)
+  if (scopeLength > decoded.length - 73) throw new Error('invalid scope length')
+  const scope = decoded.subarray(73, 73 + scopeLength)
+  try { fatalTextDecoder.decode(scope) } catch { throw new Error('scope is not valid UTF-8') }
+  const ct = decoded.subarray(73 + scopeLength)
+  if (ct.length < 4) throw new Error('ciphertext too short')
+  if (kind !== expectedKind) throw new Error(`kind mismatch: got ${kind}, expected ${expectedKind}`)
+  if (!equalBytes(scope, expectedScope)) throw new Error('scope mismatch')
+  const { encryption_key: encryptionKey, mac_key: macKey } = deriveKeysFromConversationKey(conversationKey, nonce)
+  const authData = concatBytes(nonce, u32be(kind), u32be(scope.length), scope, ct)
+  if (!equalBytes(mac, hmac(sha256, macKey, authData))) throw new Error('invalid MAC')
+  const padded = chacha(encryptionKey, ct)
+  const plaintextLength = readU32be(padded, 0)
+  if (plaintextLength + 4 > padded.length) throw new Error('invalid plaintext length')
+  if (plaintextLength > 2 ** 31 - 1) throw new Error('plaintext too long')
+  // Only verify the padding is all-zeroes. Per spec, implementations MUST NOT do any
+  // other check on the padding length — non-standard zero-padding must decrypt.
+  const padding = padded.subarray(4 + plaintextLength)
+  if (!equalBytes(padding, new Uint8Array(padding.length))) throw new Error('invalid padding')
+  return padded.subarray(4, 4 + plaintextLength)
+}
+
+function deriveSharedConversationKey (seckey, pubkey) {
+  return sharedXOnlySecret(seckey, pubkey)
+}
+
+export function normalizeKind (kind) {
+  const n = typeof kind === 'string' && kind.trim() !== '' ? Number(kind) : kind
+  if (!Number.isInteger(n) || n < 0 || n > 0xffffffff) throw new Error('INVALID_KIND')
+  return n
+}
+
+// String-oriented helpers for app-facing methods. Plaintext travels as
+// base64 on the NIP-07/46 wire so callers can encrypt arbitrary bytes.
+export function encrypt (seckey, pubkey, kind, scope, plaintext) {
+  return encryptBytes(seckey, pubkey, normalizeKind(kind), utf8ToBytes(scope || ''), utf8ToBytes(plaintext))
+}
+
+export function decrypt (seckey, pubkey, kind, scope, ciphertext) {
+  return textDecoder.decode(decryptBytes(seckey, pubkey, normalizeKind(kind), utf8ToBytes(scope || ''), ciphertext))
+}
+
+export function encryptWithConversationKey (conversationKey, kind, scope, plaintext) {
+  return encryptWithConversationKeyBytes(conversationKey, normalizeKind(kind), utf8ToBytes(scope || ''), utf8ToBytes(plaintext))
+}
+
+export function decryptWithConversationKey (conversationKey, kind, scope, ciphertext) {
+  return textDecoder.decode(decryptWithConversationKeyBytes(conversationKey, normalizeKind(kind), utf8ToBytes(scope || ''), ciphertext))
+}
+
+export function nip07Encrypt (seckey, pubkey, kind, scope, plaintextB64) {
+  return encryptBytes(seckey, pubkey, normalizeKind(kind), utf8ToBytes(scope || ''), base64ToBytes(plaintextB64))
+}
+
+export function nip07Decrypt (seckey, pubkey, kind, scope, ciphertext) {
+  return bytesToBase64(decryptBytes(seckey, pubkey, normalizeKind(kind), utf8ToBytes(scope || ''), ciphertext))
+}
+
+export const b64encode = bytesToBase64
+export const b64decode = base64ToBytes
+export const toBytes = utf8ToBytes
+export const fromBytes = b => textDecoder.decode(b)

package/nip46/constants/index.js

@@ -0,0 +1,5 @@
+// NIP-46 request and response event kind.
+export const NIP46_KIND = 24133
+export const DEFAULT_TIMEOUT = 30_000
+export const DEFAULT_TIMEOUT_AFTER_FIRST_EOSE = 500
+export const RELAY_SWITCH_WAIT_TIMEOUT = 1_000

package/nip46/helpers/frame.js

@@ -0,0 +1,51 @@
+import { finalizeEvent, verifyEvent } from 'nostr-tools'
+import { decrypt, encrypt, getConversationKey } from 'nostr-tools/nip44'
+import { NIP46_KIND } from '../constants/index.js'
+
+const PUBKEY = /^[0-9a-f]{64}$/
+
+export function validPubkey (value) {
+  return typeof value === 'string' && PUBKEY.test(value)
+}
+
+export function hasPTag (event, pubkey) {
+  return Array.isArray(event?.tags) && event.tags.some(tag => tag?.[0] === 'p' && tag?.[1] === pubkey)
+}
+
+export function isNip46EventFor (event, pubkey) {
+  return event?.kind === NIP46_KIND &&
+    validPubkey(event.pubkey) &&
+    hasPTag(event, pubkey) &&
+    verifyEvent(event)
+}
+
+export function decodeNip46Frame (event, secretKey) {
+  try {
+    const plaintext = decrypt(event.content, getConversationKey(secretKey, event.pubkey))
+    const frame = JSON.parse(plaintext)
+    return frame && typeof frame === 'object' && !Array.isArray(frame) ? frame : null
+  } catch {
+    return null
+  }
+}
+
+export function createNip46Event ({ secretKey, recipientPubkey, payload }) {
+  return finalizeEvent({
+    kind: NIP46_KIND,
+    created_at: Math.floor(Date.now() / 1000),
+    tags: [['p', recipientPubkey]],
+    content: encrypt(JSON.stringify(payload), getConversationKey(secretKey, recipientPubkey))
+  }, secretKey)
+}
+
+export function validRequestFrame (frame) {
+  return typeof frame?.id === 'string' && frame.id &&
+    typeof frame.method === 'string' && frame.method &&
+    Array.isArray(frame.params) && frame.params.every(param => typeof param === 'string')
+}
+
+export function requestError (reason = 'NIP46_REQUEST_REJECTED') {
+  return reason instanceof Error
+    ? reason
+    : new Error(typeof reason === 'string' && reason ? reason : 'NIP46_REQUEST_REJECTED')
+}

package/nip46/helpers/url.js

@@ -0,0 +1,96 @@
+const PUBKEY = /^[0-9a-f]{64}$/
+
+function uniqueStrings (values) {
+  if (!Array.isArray(values)) return []
+  return [...new Set(values.filter(value => typeof value === 'string' && value))]
+}
+
+function validPubkey (value) {
+  return typeof value === 'string' && PUBKEY.test(value)
+}
+
+export function normalizeBunkerPointer (pointer) {
+  if (!pointer || typeof pointer !== 'object') return null
+  const remoteSignerPubkey = String(pointer.remoteSignerPubkey || '').toLowerCase()
+  const relays = uniqueStrings(pointer.relays)
+  if (!validPubkey(remoteSignerPubkey) || !relays.length) return null
+  return {
+    remoteSignerPubkey,
+    relays,
+    secret: typeof pointer.secret === 'string' && pointer.secret ? pointer.secret : null
+  }
+}
+
+// Parses a direct NIP-46 bunker URL without performing a network lookup.
+export function parseBunkerUrl (input) {
+  try {
+    const url = new URL(input)
+    if (url.protocol !== 'bunker:') return null
+    return normalizeBunkerPointer({
+      remoteSignerPubkey: url.hostname,
+      relays: url.searchParams.getAll('relay'),
+      secret: url.searchParams.get('secret')
+    })
+  } catch {
+    return null
+  }
+}
+
+// Serializes a direct NIP-46 bunker pointer without any network lookup.
+export function toBunkerUrl (pointer) {
+  const normalized = normalizeBunkerPointer(pointer)
+  if (!normalized) throw new Error('INVALID_BUNKER_POINTER')
+  const url = new URL(`bunker://${normalized.remoteSignerPubkey}`)
+  for (const relay of normalized.relays) url.searchParams.append('relay', relay)
+  if (normalized.secret) url.searchParams.set('secret', normalized.secret)
+  return url.toString()
+}
+
+// Builds a NIP-46 client-initiated connection URI.
+export function createNostrConnectURI ({
+  clientPubkey,
+  relays,
+  secret,
+  perms = [],
+  name,
+  url,
+  image
+} = {}) {
+  const normalizedPubkey = String(clientPubkey || '').toLowerCase()
+  const normalizedRelays = uniqueStrings(relays)
+  if (!validPubkey(normalizedPubkey) || !normalizedRelays.length || typeof secret !== 'string' || !secret) {
+    throw new Error('INVALID_NOSTRCONNECT_URI')
+  }
+
+  const uri = new URL(`nostrconnect://${normalizedPubkey}`)
+  for (const relay of normalizedRelays) uri.searchParams.append('relay', relay)
+  uri.searchParams.set('secret', secret)
+  if (Array.isArray(perms) && perms.length) uri.searchParams.set('perms', perms.join(','))
+  if (name) uri.searchParams.set('name', name)
+  if (url) uri.searchParams.set('url', url)
+  if (image) uri.searchParams.set('image', image)
+  return uri.toString()
+}
+
+export function parseNostrConnectURI (input) {
+  try {
+    const url = new URL(input)
+    const clientPubkey = url.hostname.toLowerCase()
+    const relays = uniqueStrings(url.searchParams.getAll('relay'))
+    const secret = url.searchParams.get('secret') || ''
+    if (url.protocol !== 'nostrconnect:' || !validPubkey(clientPubkey) || !relays.length || !secret) return null
+    return {
+      clientPubkey,
+      relays,
+      secret,
+      perms: uniqueStrings((url.searchParams.get('perms') || '').split(',')),
+      clientMetadata: {
+        ...(url.searchParams.get('name') ? { name: url.searchParams.get('name') } : {}),
+        ...(url.searchParams.get('url') ? { url: url.searchParams.get('url') } : {}),
+        ...(url.searchParams.get('image') ? { image: url.searchParams.get('image') } : {})
+      }
+    }
+  } catch {
+    return null
+  }
+}

package/nip46/index.js

@@ -0,0 +1,5 @@
+export { NIP46_KIND } from './constants/index.js'
+export { createNostrConnectURI, parseBunkerUrl, toBunkerUrl } from './helpers/url.js'
+export { BunkerSigner } from './services/bunker-signer.js'
+export { Nip46Client } from './services/client.js'
+export { Nip46ServerSession } from './services/server-session.js'

package/nip46/services/bunker-signer.js

@@ -0,0 +1,49 @@
+import { verifyEvent } from 'nostr-tools'
+import { validPubkey } from '../helpers/frame.js'
+import { Nip46Client } from './client.js'
+
+// A NIP-46 remote signer with the standard Nostr signing commands.
+export class BunkerSigner extends Nip46Client {
+  #cachedPubkey = null
+
+  constructor (...args) {
+    super(...args)
+    Object.preventExtensions(this)
+  }
+
+  async getPublicKey (options) {
+    if (!options?.extension && this.#cachedPubkey) return this.#cachedPubkey
+    const pubkey = await this.sendRequest('get_public_key', [], options)
+    if (!validPubkey(pubkey)) throw new Error('NIP46_INVALID_PUBLIC_KEY')
+    if (!options?.extension) this.#cachedPubkey = pubkey
+    return pubkey
+  }
+
+  async signEvent (event, options) {
+    const response = await this.sendRequest('sign_event', [JSON.stringify(event)], options)
+    let signed
+    try {
+      signed = JSON.parse(response)
+    } catch {
+      throw new Error('NIP46_INVALID_SIGNED_EVENT')
+    }
+    if (!verifyEvent(signed)) throw new Error('NIP46_INVALID_SIGNED_EVENT')
+    return signed
+  }
+
+  nip04Encrypt (pubkey, plaintext, options) {
+    return this.sendRequest('nip04_encrypt', [pubkey, plaintext], options)
+  }
+
+  nip04Decrypt (pubkey, ciphertext, options) {
+    return this.sendRequest('nip04_decrypt', [pubkey, ciphertext], options)
+  }
+
+  nip44Encrypt (pubkey, plaintext, options) {
+    return this.sendRequest('nip44_encrypt', [pubkey, plaintext], options)
+  }
+
+  nip44Decrypt (pubkey, ciphertext, options) {
+    return this.sendRequest('nip44_decrypt', [pubkey, ciphertext], options)
+  }
+}