nostr-bray 0.0.0-development

package/dist/context.js

@@ -0,0 +1,184 @@
+import { fromNsec, fromMnemonic, derive, zeroise } from 'nsec-tree';
+import { derivePersona } from 'nsec-tree/persona';
+import { createBlindProof, createFullProof } from 'nsec-tree/proof';
+import { finalizeEvent } from 'nostr-tools/pure';
+export class IdentityContext {
+    root;
+    cache = new Map();
+    masterEntry;
+    activeEntry;
+    maxCacheSize;
+    constructor(secretKey, format, opts) {
+        this.maxCacheSize = opts?.maxCache ?? 5;
+        if (format === 'mnemonic') {
+            this.root = fromMnemonic(secretKey);
+        }
+        else if (format === 'hex') {
+            const bytes = Buffer.from(secretKey, 'hex');
+            this.root = fromNsec(bytes);
+        }
+        else {
+            this.root = fromNsec(secretKey);
+        }
+        // Derive master identity — kept separate from LRU cache
+        const masterIdentity = derive(this.root, 'master', 0);
+        this.masterEntry = {
+            identity: masterIdentity,
+            purpose: 'master',
+            index: 0,
+            lastUsed: Date.now(),
+        };
+        this.activeEntry = this.masterEntry;
+    }
+    /** Current active identity's npub */
+    get activeNpub() {
+        return this.activeEntry.identity.npub;
+    }
+    /** Derive a child identity by purpose and index */
+    derive(purpose, index) {
+        // Return from cache if already derived
+        for (const [npub, entry] of this.cache) {
+            if (entry.purpose === purpose && entry.index === index && !entry.personaName) {
+                entry.lastUsed = Date.now();
+                return { npub, purpose, index };
+            }
+        }
+        const identity = derive(this.root, purpose, index);
+        const entry = {
+            identity,
+            purpose,
+            index,
+            lastUsed: Date.now(),
+        };
+        this.putCache(identity.npub, entry);
+        return { npub: identity.npub, purpose, index };
+    }
+    /** Derive a named persona */
+    derivePersona(name, index) {
+        // Return from cache if already derived
+        for (const [npub, entry] of this.cache) {
+            if (entry.personaName === name && entry.index === index) {
+                entry.lastUsed = Date.now();
+                return { npub, purpose: entry.purpose, index: entry.index, personaName: name };
+            }
+        }
+        const persona = derivePersona(this.root, name, index);
+        const entry = {
+            identity: persona.identity,
+            purpose: persona.identity.purpose,
+            index: persona.index,
+            personaName: name,
+            lastUsed: Date.now(),
+        };
+        this.putCache(persona.identity.npub, entry);
+        return {
+            npub: persona.identity.npub,
+            purpose: persona.identity.purpose,
+            index: persona.index,
+            personaName: name,
+        };
+    }
+    /** Switch active identity by purpose+index, persona name, or "master" */
+    switch(purposeOrName, index) {
+        if (purposeOrName === 'master') {
+            this.activeEntry = this.masterEntry;
+            this.masterEntry.lastUsed = Date.now();
+            return;
+        }
+        // Check cache for matching purpose or persona name
+        for (const [, entry] of this.cache) {
+            const matchesPurpose = entry.purpose === purposeOrName && (index === undefined || entry.index === index);
+            const matchesPersona = entry.personaName === purposeOrName && (index === undefined || entry.index === index);
+            if (matchesPurpose || matchesPersona) {
+                entry.lastUsed = Date.now();
+                this.activeEntry = entry;
+                return;
+            }
+        }
+        // Not in cache — derive on the fly
+        const identity = derive(this.root, purposeOrName, index ?? 0);
+        const entry = {
+            identity,
+            purpose: purposeOrName,
+            index: index ?? 0,
+            lastUsed: Date.now(),
+        };
+        this.putCache(identity.npub, entry);
+        this.activeEntry = entry;
+    }
+    /** Get a signing function bound to the current active identity */
+    getSigningFunction() {
+        return async (template) => {
+            return finalizeEvent(template, this.activeEntry.identity.privateKey);
+        };
+    }
+    /** List all known identities — returns public info only, never private keys */
+    listIdentities() {
+        const result = [
+            { npub: this.masterEntry.identity.npub, purpose: 'master', index: 0 },
+        ];
+        for (const [, entry] of this.cache) {
+            result.push({
+                npub: entry.identity.npub,
+                purpose: entry.purpose,
+                index: entry.index,
+                personaName: entry.personaName,
+            });
+        }
+        return result;
+    }
+    /** Create a linkage proof for the active identity */
+    prove(mode = 'blind') {
+        const child = this.activeEntry.identity;
+        if (mode === 'full') {
+            return createFullProof(this.root, child);
+        }
+        return createBlindProof(this.root, child);
+    }
+    /** Get the active identity's private key for NIP-17/44/04 crypto operations */
+    get activePrivateKey() {
+        return this.activeEntry.identity.privateKey;
+    }
+    /** Test helper — returns reference to private key bytes for verifying zeroise */
+    _getPrivateKeyRefForTesting(npub) {
+        if (this.masterEntry.identity.npub === npub)
+            return this.masterEntry.identity.privateKey;
+        const entry = this.cache.get(npub);
+        return entry?.identity.privateKey;
+    }
+    /** Destroy all identities and the tree root */
+    destroy() {
+        zeroise(this.masterEntry.identity);
+        for (const [, entry] of this.cache) {
+            zeroise(entry.identity);
+        }
+        this.cache.clear();
+        this.root.destroy();
+    }
+    /** Insert into LRU cache, evicting oldest if at capacity */
+    putCache(npub, entry) {
+        if (this.cache.has(npub)) {
+            this.cache.set(npub, entry);
+            return;
+        }
+        if (this.cache.size >= this.maxCacheSize) {
+            let oldestNpub;
+            let oldestTime = Infinity;
+            for (const [n, e] of this.cache) {
+                // Never evict the active identity
+                if (n === this.activeEntry.identity.npub)
+                    continue;
+                if (e.lastUsed < oldestTime) {
+                    oldestTime = e.lastUsed;
+                    oldestNpub = n;
+                }
+            }
+            if (oldestNpub) {
+                const evicted = this.cache.get(oldestNpub);
+                zeroise(evicted.identity);
+                this.cache.delete(oldestNpub);
+            }
+        }
+        this.cache.set(npub, entry);
+    }
+}

package/dist/identity/handlers.d.ts

@@ -0,0 +1,31 @@
+import type { LinkageProof } from 'nsec-tree';
+import type { IdentityContext } from '../context.js';
+import type { PublicIdentity } from '../types.js';
+/** Generate a fresh identity — returns mnemonic + master npub, no raw private keys */
+export declare function handleIdentityCreate(): {
+    npub: string;
+    mnemonic: string;
+};
+/** Derive a child identity by purpose and index */
+export declare function handleIdentityDerive(ctx: IdentityContext, args: {
+    purpose: string;
+    index: number;
+}): PublicIdentity;
+/** Derive a named persona */
+export declare function handleIdentityDerivePersona(ctx: IdentityContext, args: {
+    name: string;
+    index: number;
+}): PublicIdentity;
+/** Switch active identity */
+export declare function handleIdentitySwitch(ctx: IdentityContext, args: {
+    target: string;
+    index?: number;
+}): {
+    npub: string;
+};
+/** List all known identities — returns public info only */
+export declare function handleIdentityList(ctx: IdentityContext): PublicIdentity[];
+/** Create a linkage proof for the active identity. Defaults to blind (no purpose/index). */
+export declare function handleIdentityProve(ctx: IdentityContext, args: {
+    mode?: 'blind' | 'full';
+}): LinkageProof;

package/dist/identity/handlers.js

@@ -0,0 +1,32 @@
+import { generateMnemonic } from '@scure/bip39';
+import { wordlist } from '@scure/bip39/wordlists/english.js';
+import { fromMnemonic } from 'nsec-tree';
+/** Generate a fresh identity — returns mnemonic + master npub, no raw private keys */
+export function handleIdentityCreate() {
+    const mnemonic = generateMnemonic(wordlist, 256); // 24 words
+    const root = fromMnemonic(mnemonic);
+    const npub = root.masterPubkey;
+    root.destroy();
+    return { npub, mnemonic };
+}
+/** Derive a child identity by purpose and index */
+export function handleIdentityDerive(ctx, args) {
+    return ctx.derive(args.purpose, args.index);
+}
+/** Derive a named persona */
+export function handleIdentityDerivePersona(ctx, args) {
+    return ctx.derivePersona(args.name, args.index);
+}
+/** Switch active identity */
+export function handleIdentitySwitch(ctx, args) {
+    ctx.switch(args.target, args.index);
+    return { npub: ctx.activeNpub };
+}
+/** List all known identities — returns public info only */
+export function handleIdentityList(ctx) {
+    return ctx.listIdentities();
+}
+/** Create a linkage proof for the active identity. Defaults to blind (no purpose/index). */
+export function handleIdentityProve(ctx, args) {
+    return ctx.prove(args.mode ?? 'blind');
+}

package/dist/identity/migration.d.ts

@@ -0,0 +1,37 @@
+import type { Event as NostrEvent } from 'nostr-tools';
+import type { IdentityContext } from '../context.js';
+import type { RelayPool } from '../relay-pool.js';
+export interface BackupBundle {
+    pubkeyHex: string;
+    events: NostrEvent[];
+}
+export interface RestoreResult {
+    restored: Array<{
+        kind: number;
+        id: string;
+    }>;
+    skipped: Array<{
+        kind: number;
+        reason: string;
+    }>;
+}
+export interface MigrateSummary {
+    profileFields: string[];
+    contactCount: number;
+    relayCount: number;
+    attestationCount: number;
+}
+export interface MigrateResult {
+    status: 'preview' | 'migrated';
+    summary: MigrateSummary;
+}
+/** Fetch all relevant events for a pubkey (profile, contacts, relay list, attestations) */
+export declare function handleIdentityBackup(pool: RelayPool, pubkeyHex: string, npub: string): Promise<BackupBundle>;
+/** Re-sign migratable events under the active identity. Skips attestations (trust chain protection). */
+export declare function handleIdentityRestore(ctx: IdentityContext, pool: RelayPool, backup: BackupBundle): Promise<RestoreResult>;
+/** Migrate identity: preview first, then execute when confirmed */
+export declare function handleIdentityMigrate(ctx: IdentityContext, pool: RelayPool, args: {
+    oldPubkeyHex: string;
+    oldNpub: string;
+    confirm: boolean;
+}): Promise<MigrateResult>;

package/dist/identity/migration.js

@@ -0,0 +1,84 @@
+import { verifyEvent } from 'nostr-tools/pure';
+/** Kinds to backup and the subset that can be re-signed */
+const BACKUP_KINDS = [0, 3, 10002, 31000];
+const RESIGNABLE_KINDS = new Set([0, 3, 10002]);
+/** Fetch all relevant events for a pubkey (profile, contacts, relay list, attestations) */
+export async function handleIdentityBackup(pool, pubkeyHex, npub) {
+    const events = await pool.query(npub, {
+        kinds: BACKUP_KINDS,
+        authors: [pubkeyHex],
+    });
+    return { pubkeyHex, events };
+}
+/** Re-sign migratable events under the active identity. Skips attestations (trust chain protection). */
+export async function handleIdentityRestore(ctx, pool, backup) {
+    const sign = ctx.getSigningFunction();
+    const restored = [];
+    const skipped = [];
+    for (const event of backup.events) {
+        // Verify signature and author before re-signing
+        if (!verifyEvent(event) || event.pubkey !== backup.pubkeyHex) {
+            skipped.push({
+                kind: event.kind,
+                reason: `Event ${event.id} failed signature verification or author mismatch`,
+            });
+            continue;
+        }
+        if (!RESIGNABLE_KINDS.has(event.kind)) {
+            skipped.push({
+                kind: event.kind,
+                reason: `Kind ${event.kind} attestation — cannot re-sign (trust chain protection)`,
+            });
+            continue;
+        }
+        // Re-sign the event content under the new identity
+        const template = {
+            kind: event.kind,
+            created_at: Math.floor(Date.now() / 1000),
+            tags: event.tags,
+            content: event.content,
+        };
+        const signed = await sign(template);
+        restored.push({ kind: event.kind, id: signed.id });
+    }
+    return { restored, skipped };
+}
+/** Migrate identity: preview first, then execute when confirmed */
+export async function handleIdentityMigrate(ctx, pool, args) {
+    const backup = await handleIdentityBackup(pool, args.oldPubkeyHex, args.oldNpub);
+    // Build summary
+    const profileEvent = backup.events.find(e => e.kind === 0);
+    let profileFields = [];
+    if (profileEvent) {
+        try {
+            const parsed = JSON.parse(profileEvent.content);
+            profileFields = Object.keys(parsed);
+        }
+        catch { /* empty profile */ }
+    }
+    const contactEvent = backup.events.find(e => e.kind === 3);
+    const contactCount = contactEvent?.tags.filter(t => t[0] === 'p').length ?? 0;
+    const relayEvent = backup.events.find(e => e.kind === 10002);
+    const relayCount = relayEvent?.tags.filter(t => t[0] === 'r').length ?? 0;
+    const attestationCount = backup.events.filter(e => e.kind === 31000).length;
+    const summary = { profileFields, contactCount, relayCount, attestationCount };
+    if (!args.confirm) {
+        return { status: 'preview', summary };
+    }
+    // Execute migration: re-sign migratable events
+    await handleIdentityRestore(ctx, pool, backup);
+    // Publish linkage proof connecting old → new
+    const proof = ctx.prove('full');
+    const sign = ctx.getSigningFunction();
+    const proofEvent = await sign({
+        kind: 30078,
+        created_at: Math.floor(Date.now() / 1000),
+        tags: [
+            ['d', `migration:${args.oldPubkeyHex}`],
+            ['p', args.oldPubkeyHex],
+        ],
+        content: JSON.stringify(proof),
+    });
+    await pool.publish(args.oldNpub, proofEvent);
+    return { status: 'migrated', summary };
+}

package/dist/identity/shamir.d.ts

@@ -0,0 +1,18 @@
+export interface BackupArgs {
+    secret: Uint8Array;
+    threshold: number;
+    shares: number;
+    outputDir: string;
+}
+export interface RestoreArgs {
+    files: string[];
+    threshold: number;
+}
+/** Split a secret into Shamir shards and write to files. Returns file paths only, never shard content. */
+export declare function handleBackupShamir(args: BackupArgs): {
+    files: string[];
+    threshold: number;
+    shares: number;
+};
+/** Restore a secret from shard files. Returns the reconstructed secret bytes. */
+export declare function handleRestoreShamir(args: RestoreArgs): Uint8Array;

package/dist/identity/shamir.js

@@ -0,0 +1,46 @@
+import { writeFileSync, readFileSync, statSync, renameSync } from 'node:fs';
+import { join } from 'node:path';
+import { splitSecret, reconstructSecret, shareToWords, wordsToShare, } from '@forgesworn/shamir-words';
+/** Split a secret into Shamir shards and write to files. Returns file paths only, never shard content. */
+export function handleBackupShamir(args) {
+    // Validate output directory exists
+    try {
+        const stat = statSync(args.outputDir);
+        if (!stat.isDirectory())
+            throw new Error(`Not a directory: ${args.outputDir}`);
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            throw new Error(`Output directory does not exist: ${args.outputDir}`);
+        throw err;
+    }
+    const shamirShares = splitSecret(args.secret, args.threshold, args.shares);
+    const files = [];
+    // Write to temp files first, then rename atomically
+    const tempPaths = [];
+    for (let i = 0; i < shamirShares.length; i++) {
+        const words = shareToWords(shamirShares[i]);
+        const filePath = join(args.outputDir, `shard-${i + 1}.bray`);
+        const tempPath = `${filePath}.tmp`;
+        writeFileSync(tempPath, words.join(' '), { encoding: 'utf-8', mode: 0o600 });
+        tempPaths.push(tempPath);
+        files.push(filePath);
+    }
+    // Atomic rename — all or nothing
+    for (let i = 0; i < tempPaths.length; i++) {
+        renameSync(tempPaths[i], files[i]);
+    }
+    return { files, threshold: args.threshold, shares: args.shares };
+}
+/** Restore a secret from shard files. Returns the reconstructed secret bytes. */
+export function handleRestoreShamir(args) {
+    if (args.files.length < args.threshold) {
+        throw new Error(`Insufficient shards: have ${args.files.length}, need ${args.threshold}`);
+    }
+    const shares = args.files.map(filePath => {
+        const content = readFileSync(filePath, 'utf-8').trim();
+        const words = content.split(' ');
+        return wordsToShare(words);
+    });
+    return reconstructSecret(shares, args.threshold);
+}

package/dist/identity/tools.d.ts

@@ -0,0 +1,11 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { IdentityContext } from '../context.js';
+import type { RelayPool } from '../relay-pool.js';
+import type { Nip65Manager } from '../nip65.js';
+export interface ToolDeps {
+    ctx: IdentityContext;
+    pool: RelayPool;
+    nip65: Nip65Manager;
+    nwcUri?: string;
+}
+export declare function registerIdentityTools(server: McpServer, deps: ToolDeps): void;

package/dist/identity/tools.js

@@ -0,0 +1,168 @@
+import { z } from 'zod';
+import { handleIdentityCreate, handleIdentityDerive, handleIdentityDerivePersona, handleIdentitySwitch, handleIdentityList, handleIdentityProve, } from './handlers.js';
+import { handleBackupShamir, handleRestoreShamir } from './shamir.js';
+import { hexId } from '../validation.js';
+import { handleIdentityBackup, handleIdentityRestore, handleIdentityMigrate } from './migration.js';
+export function registerIdentityTools(server, deps) {
+    server.registerTool('identity_create', {
+        description: 'Generate a fresh Nostr identity with a BIP-39 mnemonic seed. Returns the master npub and mnemonic for backup.',
+        annotations: { readOnlyHint: false },
+    }, async () => {
+        const result = handleIdentityCreate();
+        return {
+            content: [{ type: 'text', text: JSON.stringify(result, null, 2) }],
+        };
+    });
+    server.registerTool('identity_derive', {
+        description: 'Derive a child Nostr identity from the active tree root. Returns the new npub.',
+        inputSchema: {
+            purpose: z.string().describe('Purpose string for derivation (e.g. "messaging", "signing")'),
+            index: z.number().int().min(0).default(0).describe('Derivation index (default 0)'),
+        },
+        annotations: { readOnlyHint: false },
+    }, async ({ purpose, index }) => {
+        const result = handleIdentityDerive(deps.ctx, { purpose, index });
+        return {
+            content: [{ type: 'text', text: JSON.stringify(result, null, 2) }],
+        };
+    });
+    server.registerTool('identity_derive_persona', {
+        description: 'Derive a named persona identity (e.g. "work", "personal", "anonymous"). Returns the new npub.',
+        inputSchema: {
+            name: z.string().describe('Persona name (e.g. "work", "personal", "anonymous")'),
+            index: z.number().int().min(0).default(0).describe('Derivation index (default 0)'),
+        },
+        annotations: { readOnlyHint: false },
+    }, async ({ name, index }) => {
+        const result = handleIdentityDerivePersona(deps.ctx, { name, index });
+        return {
+            content: [{ type: 'text', text: JSON.stringify(result, null, 2) }],
+        };
+    });
+    server.registerTool('identity_switch', {
+        description: 'Switch the active Nostr identity. All subsequent tools operate as the new identity. Use "master" to return to root.',
+        inputSchema: {
+            target: z.string().describe('Purpose, persona name, or "master" to switch to'),
+            index: z.number().int().min(0).optional().describe('Derivation index (if switching by purpose)'),
+        },
+        annotations: { readOnlyHint: false },
+    }, async ({ target, index }) => {
+        const result = handleIdentitySwitch(deps.ctx, { target, index });
+        return {
+            content: [{ type: 'text', text: JSON.stringify(result, null, 2) }],
+        };
+    });
+    server.registerTool('identity_list', {
+        description: 'List all known Nostr identities. Returns npub, purpose, and persona name for each. Never includes private keys.',
+        annotations: { readOnlyHint: true },
+    }, async () => {
+        const result = handleIdentityList(deps.ctx);
+        return {
+            content: [{ type: 'text', text: JSON.stringify(result, null, 2) }],
+        };
+    });
+    server.registerTool('identity_prove', {
+        description: 'Create a cryptographic linkage proof between the master key and the active identity. Defaults to blind proof (no purpose/index revealed).',
+        inputSchema: {
+            mode: z.enum(['blind', 'full']).default('blind').describe('Proof mode: "blind" hides derivation path, "full" reveals purpose and index'),
+        },
+        annotations: { readOnlyHint: true },
+    }, async ({ mode }) => {
+        const proof = handleIdentityProve(deps.ctx, { mode });
+        return {
+            content: [{ type: 'text', text: JSON.stringify(proof, null, 2) }],
+        };
+    });
+    server.registerTool('identity_backup_shamir', {
+        description: 'Split the master secret into Shamir shard files. Shard content is written to disk — never returned in the response.',
+        inputSchema: {
+            threshold: z.number().int().min(2).describe('Minimum shards needed to reconstruct'),
+            shares: z.number().int().min(2).describe('Total number of shards to create'),
+            outputDir: z.string().describe('Directory to write shard files to'),
+        },
+        annotations: { readOnlyHint: false, destructiveHint: false },
+    }, async ({ threshold, shares, outputDir }) => {
+        const result = handleBackupShamir({
+            secret: new Uint8Array(deps.ctx.activePrivateKey),
+            threshold,
+            shares,
+            outputDir,
+        });
+        return {
+            content: [{ type: 'text', text: JSON.stringify({
+                        message: `Created ${result.shares} shards (threshold: ${result.threshold})`,
+                        files: result.files,
+                    }, null, 2) }],
+        };
+    });
+    server.registerTool('identity_restore_shamir', {
+        description: 'Reconstruct a secret from Shamir shard files. Returns the restored npub for verification.',
+        inputSchema: {
+            files: z.array(z.string()).describe('Paths to shard files'),
+            threshold: z.number().int().min(2).describe('Threshold used during backup'),
+        },
+        annotations: { readOnlyHint: true },
+    }, async ({ files, threshold }) => {
+        const secret = handleRestoreShamir({ files, threshold });
+        // Verify by creating a temporary context from the restored secret
+        const { fromNsec } = await import('nsec-tree');
+        const root = fromNsec(secret);
+        const npub = root.masterPubkey;
+        root.destroy();
+        // Zeroise the restored secret
+        secret.fill(0);
+        return {
+            content: [{ type: 'text', text: JSON.stringify({
+                        message: 'Secret reconstructed successfully',
+                        masterNpub: npub,
+                    }, null, 2) }],
+        };
+    });
+    server.registerTool('identity_backup', {
+        description: 'Fetch profile, contacts, relay list, and attestations for a pubkey. Returns a portable JSON bundle (no private keys).',
+        inputSchema: {
+            pubkeyHex: hexId.describe('Hex pubkey to back up'),
+            npub: z.string().optional().describe('Bech32 npub for relay routing (defaults to active identity)'),
+        },
+        annotations: { readOnlyHint: true },
+    }, async ({ pubkeyHex, npub }) => {
+        const resolvedNpub = npub ?? deps.ctx.activeNpub;
+        const bundle = await handleIdentityBackup(deps.pool, pubkeyHex, resolvedNpub);
+        return {
+            content: [{ type: 'text', text: JSON.stringify({
+                        pubkeyHex: bundle.pubkeyHex,
+                        eventCount: bundle.events.length,
+                        kinds: [...new Set(bundle.events.map(e => e.kind))],
+                    }, null, 2) }],
+        };
+    });
+    server.registerTool('identity_restore', {
+        description: 'Re-sign migratable events (profile, contacts, relay list) under the active identity. Skips attestations (trust chain protection).',
+        inputSchema: {
+            pubkeyHex: hexId.describe('Hex pubkey of the original identity to restore from'),
+            npub: z.string().optional().describe('Bech32 npub for relay routing'),
+        },
+        annotations: { readOnlyHint: false },
+    }, async ({ pubkeyHex, npub }) => {
+        const resolvedNpub = npub ?? deps.ctx.activeNpub;
+        const backup = await handleIdentityBackup(deps.pool, pubkeyHex, resolvedNpub);
+        const result = await handleIdentityRestore(deps.ctx, deps.pool, backup);
+        return {
+            content: [{ type: 'text', text: JSON.stringify(result, null, 2) }],
+        };
+    });
+    server.registerTool('identity_migrate', {
+        description: 'Migrate from an old identity to the active one. Shows preview first — set confirm: true to execute. Publishes linkage proof and re-signs migratable events.',
+        inputSchema: {
+            oldPubkeyHex: z.string().describe('Hex pubkey of the old identity'),
+            oldNpub: z.string().describe('Bech32 npub of the old identity'),
+            confirm: z.boolean().default(false).describe('Set true to execute migration (preview by default)'),
+        },
+        annotations: { readOnlyHint: false },
+    }, async ({ oldPubkeyHex, oldNpub, confirm }) => {
+        const result = await handleIdentityMigrate(deps.ctx, deps.pool, { oldPubkeyHex, oldNpub, confirm });
+        return {
+            content: [{ type: 'text', text: JSON.stringify(result, null, 2) }],
+        };
+    });
+}

package/dist/index.d.ts

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+import { IdentityContext } from './context.js';
+import { RelayPool } from './relay-pool.js';
+import { Nip65Manager } from './nip65.js';
+export declare const deps: {
+    ctx: IdentityContext;
+    pool: RelayPool;
+    nip65: Nip65Manager;
+    nwcUri: string | undefined;
+};