nostr-bray 1.13.0 → 1.15.0

package/dist/bunker-context.d.ts

@@ -0,0 +1,42 @@
+/**
+ * BunkerContext — an IdentityContext-compatible interface backed by a NIP-46 bunker.
+ *
+ * Instead of holding the secret key locally, all signing is delegated to a
+ * remote bunker via encrypted Nostr relay messages.
+ *
+ * Usage:
+ *   BUNKER_URI=bunker://pk?relay=wss://...
+ *   or
+ *   BUNKER_URI=bunker://pk?relay=wss://...&secret=clienthex
+ */
+import type { PublicIdentity, SignFn } from './types.js';
+export interface BunkerConfig {
+    pubkey: string;
+    relay: string;
+    secret?: string;
+}
+/** Parse a bunker:// URI */
+export declare function parseBunkerUri(uri: string): BunkerConfig;
+export declare class BunkerContext {
+    private signer;
+    private pool;
+    private pubkeyHex;
+    private clientSk;
+    private constructor();
+    /** Connect to a remote bunker. Blocks until the connection is established. */
+    static connect(uri: string, timeoutMs?: number): Promise<BunkerContext>;
+    /** The remote identity's npub */
+    get activeNpub(): string;
+    /** The remote identity's hex pubkey */
+    get activePublicKeyHex(): string;
+    /** Sign an event via the remote bunker */
+    getSigningFunction(): SignFn;
+    /** List identities — bunker mode only has one (the remote key) */
+    listIdentities(): PublicIdentity[];
+    /** NIP-44 encrypt via the remote bunker */
+    nip44Encrypt(recipientPubkey: string, plaintext: string): Promise<string>;
+    /** NIP-44 decrypt via the remote bunker */
+    nip44Decrypt(senderPubkey: string, ciphertext: string): Promise<string>;
+    /** Clean up */
+    destroy(): void;
+}

package/dist/bunker-context.js

@@ -0,0 +1,87 @@
+/**
+ * BunkerContext — an IdentityContext-compatible interface backed by a NIP-46 bunker.
+ *
+ * Instead of holding the secret key locally, all signing is delegated to a
+ * remote bunker via encrypted Nostr relay messages.
+ *
+ * Usage:
+ *   BUNKER_URI=bunker://pk?relay=wss://...
+ *   or
+ *   BUNKER_URI=bunker://pk?relay=wss://...&secret=clienthex
+ */
+import { BunkerSigner } from 'nostr-tools/nip46';
+import { useWebSocketImplementation, SimplePool } from 'nostr-tools/pool';
+import { generateSecretKey } from 'nostr-tools/pure';
+import { npubEncode } from 'nostr-tools/nip19';
+import WebSocket from 'ws';
+useWebSocketImplementation(WebSocket);
+/** Parse a bunker:// URI */
+export function parseBunkerUri(uri) {
+    // bunker://<pubkey>?relay=<url>&secret=<hex>
+    const url = new URL(uri);
+    const pubkey = url.hostname || url.pathname.replace('//', '');
+    const relay = url.searchParams.get('relay');
+    const secret = url.searchParams.get('secret') ?? undefined;
+    if (!pubkey || !relay) {
+        throw new Error('Invalid bunker URI: missing pubkey or relay');
+    }
+    return { pubkey, relay, secret };
+}
+export class BunkerContext {
+    signer;
+    pool;
+    pubkeyHex;
+    clientSk;
+    constructor(signer, pool, clientSk) {
+        this.signer = signer;
+        this.pool = pool;
+        this.clientSk = clientSk;
+    }
+    /** Connect to a remote bunker. Blocks until the connection is established. */
+    static async connect(uri, timeoutMs = 15_000) {
+        const config = parseBunkerUri(uri);
+        const clientSk = config.secret
+            ? Buffer.from(config.secret, 'hex')
+            : generateSecretKey();
+        const pool = new SimplePool();
+        const signer = BunkerSigner.fromBunker(clientSk, { pubkey: config.pubkey, relays: [config.relay], secret: null }, { pool });
+        // Connect and verify
+        await signer.connect();
+        await signer.ping();
+        const ctx = new BunkerContext(signer, pool, clientSk);
+        ctx.pubkeyHex = await signer.getPublicKey();
+        return ctx;
+    }
+    /** The remote identity's npub */
+    get activeNpub() {
+        return npubEncode(this.pubkeyHex);
+    }
+    /** The remote identity's hex pubkey */
+    get activePublicKeyHex() {
+        return this.pubkeyHex;
+    }
+    /** Sign an event via the remote bunker */
+    getSigningFunction() {
+        return async (template) => {
+            return this.signer.signEvent(template);
+        };
+    }
+    /** List identities — bunker mode only has one (the remote key) */
+    listIdentities() {
+        return [{ npub: this.activeNpub, purpose: 'bunker', index: 0 }];
+    }
+    /** NIP-44 encrypt via the remote bunker */
+    async nip44Encrypt(recipientPubkey, plaintext) {
+        return this.signer.nip44Encrypt(recipientPubkey, plaintext);
+    }
+    /** NIP-44 decrypt via the remote bunker */
+    async nip44Decrypt(senderPubkey, ciphertext) {
+        return this.signer.nip44Decrypt(senderPubkey, ciphertext);
+    }
+    /** Clean up */
+    destroy() {
+        this.signer.close();
+        this.pool.destroy();
+        this.clientSk.fill(0);
+    }
+}

package/dist/bunker.d.ts

@@ -0,0 +1,25 @@
+/**
+ * NIP-46 Bunker — remote signing daemon.
+ *
+ * Holds the user's secret key and responds to signing requests from
+ * authorised clients over Nostr relays. Clients never see the nsec.
+ *
+ * Protocol: NIP-46 (Nostr Connect)
+ * - Client sends kind 24133 encrypted request
+ * - Bunker responds with kind 24133 encrypted response
+ * - All communication NIP-44 encrypted between client and bunker
+ */
+import type { IdentityContext } from './context.js';
+export interface BunkerOptions {
+    ctx: IdentityContext;
+    relays: string[];
+    authorizedKeys?: string[];
+    quiet?: boolean;
+}
+export interface BunkerInstance {
+    url: string;
+    pubkey: string;
+    npub: string;
+    close: () => void;
+}
+export declare function startBunker(opts: BunkerOptions): BunkerInstance;

package/dist/bunker.js

@@ -0,0 +1,140 @@
+/**
+ * NIP-46 Bunker — remote signing daemon.
+ *
+ * Holds the user's secret key and responds to signing requests from
+ * authorised clients over Nostr relays. Clients never see the nsec.
+ *
+ * Protocol: NIP-46 (Nostr Connect)
+ * - Client sends kind 24133 encrypted request
+ * - Bunker responds with kind 24133 encrypted response
+ * - All communication NIP-44 encrypted between client and bunker
+ */
+import { getConversationKey, encrypt, decrypt } from 'nostr-tools/nip44';
+import { finalizeEvent, getPublicKey, generateSecretKey } from 'nostr-tools/pure';
+import { npubEncode } from 'nostr-tools/nip19';
+import { useWebSocketImplementation, SimplePool } from 'nostr-tools/pool';
+import WebSocket from 'ws';
+useWebSocketImplementation(WebSocket);
+export function startBunker(opts) {
+    const { ctx, relays, quiet } = opts;
+    const authorizedKeys = new Set(opts.authorizedKeys ?? []);
+    const log = quiet ? () => { } : (...args) => console.error('[bunker]', ...args);
+    // Generate a bunker-specific keypair for NIP-46 communication
+    const bunkerSk = generateSecretKey();
+    const bunkerPk = getPublicKey(bunkerSk);
+    const bunkerNpub = npubEncode(bunkerPk);
+    const pool = new SimplePool();
+    // Subscribe to kind 24133 events addressed to us
+    const sub = pool.subscribeMany(relays, { kinds: [24133], '#p': [bunkerPk] }, {
+        onevent: async (event) => {
+            try {
+                await handleRequest(event);
+            }
+            catch (e) {
+                log(`Error handling request: ${e.message}`);
+            }
+        },
+    });
+    async function handleRequest(event) {
+        const clientPk = event.pubkey;
+        // Check authorization
+        if (authorizedKeys.size > 0 && !authorizedKeys.has(clientPk)) {
+            log(`Rejected request from unauthorized key: ${clientPk.slice(0, 12)}...`);
+            return;
+        }
+        // Decrypt the request
+        const conversationKey = getConversationKey(bunkerSk, clientPk);
+        let request;
+        try {
+            const plaintext = decrypt(event.content, conversationKey);
+            request = JSON.parse(plaintext);
+        }
+        catch {
+            log('Failed to decrypt request');
+            return;
+        }
+        log(`Request ${request.id}: ${request.method}`);
+        let result;
+        let error;
+        switch (request.method) {
+            case 'connect':
+                result = 'ack';
+                break;
+            case 'ping':
+                result = 'pong';
+                break;
+            case 'get_public_key':
+                result = ctx.activePublicKeyHex;
+                break;
+            case 'sign_event': {
+                const template = JSON.parse(request.params[0]);
+                const sign = ctx.getSigningFunction();
+                const signed = await sign(template);
+                result = JSON.stringify(signed);
+                break;
+            }
+            case 'nip04_encrypt': {
+                const [thirdPartyPk, plaintext] = request.params;
+                const { encrypt: nip04encrypt } = await import('nostr-tools/nip04');
+                result = nip04encrypt(ctx.activePrivateKey, thirdPartyPk, plaintext);
+                break;
+            }
+            case 'nip04_decrypt': {
+                const [thirdPartyPk, ciphertext] = request.params;
+                const { decrypt: nip04decrypt } = await import('nostr-tools/nip04');
+                result = nip04decrypt(ctx.activePrivateKey, thirdPartyPk, ciphertext);
+                break;
+            }
+            case 'nip44_encrypt': {
+                const [thirdPartyPk, plaintext] = request.params;
+                const ck = getConversationKey(ctx.activePrivateKey, thirdPartyPk);
+                result = encrypt(plaintext, ck);
+                break;
+            }
+            case 'nip44_decrypt': {
+                const [thirdPartyPk, ciphertext] = request.params;
+                const ck = getConversationKey(ctx.activePrivateKey, thirdPartyPk);
+                result = decrypt(ciphertext, ck);
+                break;
+            }
+            default:
+                result = '';
+                error = `unsupported method: ${request.method}`;
+        }
+        // Encrypt and send response
+        const response = error
+            ? JSON.stringify({ id: request.id, result: '', error })
+            : JSON.stringify({ id: request.id, result });
+        const encrypted = encrypt(response, conversationKey);
+        const responseEvent = finalizeEvent({
+            kind: 24133,
+            created_at: Math.floor(Date.now() / 1000),
+            tags: [['p', clientPk]],
+            content: encrypted,
+        }, bunkerSk);
+        await Promise.any(pool.publish(relays, responseEvent));
+        log(`Response ${request.id}: ${error ?? 'ok'}`);
+    }
+    // Build bunker:// URI
+    const relayParams = relays.map(r => `relay=${encodeURIComponent(r)}`).join('&');
+    const bunkerUrl = `bunker://${bunkerPk}?${relayParams}`;
+    log(`Bunker started: ${bunkerNpub}`);
+    log(`URI: ${bunkerUrl}`);
+    log(`Signing as: ${ctx.activeNpub}`);
+    if (authorizedKeys.size > 0) {
+        log(`Authorized keys: ${authorizedKeys.size}`);
+    }
+    else {
+        log('WARNING: No authorized keys set — accepting requests from anyone');
+    }
+    return {
+        url: bunkerUrl,
+        pubkey: bunkerPk,
+        npub: bunkerNpub,
+        close: () => {
+            sub.close();
+            pool.destroy();
+            bunkerSk.fill(0);
+        },
+    };
+}

package/dist/cli.js

@@ -19,6 +19,7 @@ import { handleTrustSpokenChallenge, handleTrustSpokenVerify } from './trust/spo
 import { handleDuressConfigure, handleDuressActivate } from './safety/handlers.js';
 import { handleZapSend, handleZapBalance, handleZapMakeInvoice, handleZapLookupInvoice, handleZapListTransactions, handleZapReceipts, handleZapDecode } from './zap/handlers.js';
 import { handleDecode, handleEncodeNpub, handleEncodeNote, handleEncodeNprofile, handleEncodeNevent, handleVerify, handleEncrypt, handleDecrypt, handleCount, handleFetch, handleKeyPublic, handleEncodeNsec, handleFilter, handleNipList, handleNipShow } from './util/handlers.js';
+import { handleKeyEncrypt, handleKeyDecrypt } from './util/ncryptsec.js';
 import { getCommandHelp } from './help.js';
 import * as fmt from './format.js';
 const args = process.argv.slice(2);
@@ -28,6 +29,30 @@ if (!command) {
     await import('./index.js');
     process.exit(0);
 }
+// Bunker = NIP-46 remote signer
+if (command === 'bunker' && !args.includes('--help')) {
+    const { startBunker } = await import('./bunker.js');
+    const config = (await import('./config.js')).loadConfig();
+    const { IdentityContext: IC } = await import('./context.js');
+    const bCtx = new IC(config.secretKey, config.secretFormat);
+    config.secretKey = '';
+    const authorizedKeys = args.includes('--authorized-keys')
+        ? args[args.indexOf('--authorized-keys') + 1].split(',')
+        : undefined;
+    const bunker = startBunker({
+        ctx: bCtx,
+        relays: config.relays,
+        authorizedKeys,
+        quiet: args.includes('--quiet'),
+    });
+    console.error(`nostr-bray bunker running`);
+    console.error(`URI: ${bunker.url}`);
+    console.error(`Signing as: ${bCtx.activeNpub}`);
+    console.error('Press Ctrl+C to stop');
+    process.on('SIGINT', () => { bunker.close(); bCtx.destroy(); process.exit(0); });
+    process.on('SIGTERM', () => { bunker.close(); bCtx.destroy(); process.exit(0); });
+    await new Promise(() => { });
+}
 // Serve = in-memory test relay
 if (command === 'serve' && !args.includes('--help')) {
     const { startRelay } = await import('./serve.js');
@@ -133,6 +158,8 @@ Utility:
   encode-nevent <hex> [relay,...]     Encode event ID + relays as nevent
   encode-nsec <hex>                   Encode hex private key as nsec
   key-public <nsec-or-hex>            Derive pubkey from secret key
+  key-encrypt <nsec-or-hex> <pass>    Encrypt key as ncryptsec (NIP-49)
+  key-decrypt <ncryptsec> <pass>      Decrypt ncryptsec to verify pubkey
   filter <event-json> <filter-json>   Test if event matches filter
   nips                                List all official NIPs
   nip <number>                        Show a specific NIP
@@ -145,11 +172,13 @@ Utility:
 Modes:
   (no command)                        Start MCP server (stdio)
   serve [--port N] [--events file]    Start in-memory test relay
+  bunker [--authorized-keys pk,pk]    Start NIP-46 remote signer daemon
   shell                               Interactive REPL (persistent relay connection)
 
 Environment:
   NOSTR_SECRET_KEY              nsec, hex, or BIP-39 mnemonic
   NOSTR_SECRET_KEY_FILE         Path to secret key file
+  BUNKER_URI / BUNKER_URI_FILE  bunker:// URI (use INSTEAD of secret key)
   NOSTR_RELAYS                  Comma-separated relay URLs
   NWC_URI / NWC_URI_FILE        Nostr Wallet Connect URI
   TOR_PROXY                     SOCKS5h proxy URL
@@ -601,6 +630,12 @@ async function run(cmdArgs) {
         case 'key-public':
             out(handleKeyPublic(req(1, 'key-public <nsec-or-hex>')));
             break;
+        case 'key-encrypt':
+            out(handleKeyEncrypt(req(1, 'key-encrypt <nsec-or-hex> <password>'), req(2, 'key-encrypt <nsec-or-hex> <password>')));
+            break;
+        case 'key-decrypt':
+            out(handleKeyDecrypt(req(1, 'key-decrypt <ncryptsec> <password>'), req(2, 'key-decrypt <ncryptsec> <password>')));
+            break;
         case 'filter':
             out(handleFilter(JSON.parse(req(1, 'filter <event-json> <filter-json>')), JSON.parse(req(2, 'filter <event-json> <filter-json>'))));
             break;
@@ -660,7 +695,8 @@ const ALL_COMMANDS = [
     'blossom-upload', 'blossom-list', 'blossom-delete',
     'group-info', 'group-chat', 'group-send', 'group-members',
     'decode', 'encode-npub', 'encode-note', 'encode-nprofile', 'encode-nevent', 'encode-nsec',
-    'key-public', 'filter', 'nips', 'nip', 'verify', 'encrypt', 'decrypt', 'count', 'fetch',
+    'key-public', 'key-encrypt', 'key-decrypt', 'filter', 'nips', 'nip', 'verify', 'encrypt', 'decrypt', 'count', 'fetch',
+    'bunker',
     'help', 'exit',
 ];
 async function shell() {

package/dist/config.js

@@ -36,14 +36,21 @@ export function loadConfig() {
     const keyFilePath = process.env.NOSTR_SECRET_KEY_FILE;
     const keyEnvVar = process.env.NOSTR_SECRET_KEY;
     let secretKey;
+    const bunkerUri = process.env.BUNKER_URI ?? process.env.BUNKER_URI_FILE
+        ? (process.env.BUNKER_URI_FILE ? readSecretFile(process.env.BUNKER_URI_FILE) : process.env.BUNKER_URI)
+        : undefined;
     if (keyFilePath) {
         secretKey = readSecretFile(keyFilePath);
     }
     else if (keyEnvVar) {
         secretKey = keyEnvVar;
     }
+    else if (bunkerUri) {
+        // Bunker mode — no local secret needed
+        secretKey = '';
+    }
     else {
-        throw new Error('No secret key provided: set NOSTR_SECRET_KEY or NOSTR_SECRET_KEY_FILE');
+        throw new Error('No secret key provided: set NOSTR_SECRET_KEY, NOSTR_SECRET_KEY_FILE, or BUNKER_URI');
     }
     const secretFormat = detectKeyFormat(secretKey);
     // --- NWC URI ---
@@ -72,10 +79,13 @@ export function loadConfig() {
     delete process.env.NOSTR_SECRET_KEY_FILE;
     delete process.env.NWC_URI;
     delete process.env.NWC_URI_FILE;
+    delete process.env.BUNKER_URI;
+    delete process.env.BUNKER_URI_FILE;
     return {
         secretKey,
         secretFormat,
         relays,
+        bunkerUri: bunkerUri ?? undefined,
         nwcUri,
         torProxy,
         allowClearnetWithTor,

package/dist/help.js

@@ -84,6 +84,9 @@ export const COMMAND_HELP = {
     count: { usage: 'count [--kinds N,N] [--authors X,X] [--since N]', description: 'Count events matching a filter on relays.', examples: ['nostr-bray count --kinds 1', 'nostr-bray count --kinds 1,7 --authors abc123...'] },
     fetch: { usage: 'fetch <nip19>', description: 'Fetch events by nip19 code (note, nevent, nprofile, npub, naddr). Resolves the entity and queries relays.', examples: ['nostr-bray fetch note1...', 'nostr-bray fetch nevent1...', 'nostr-bray fetch npub1...'] },
     shell: { usage: 'shell', description: 'Start an interactive REPL with a persistent relay connection. Supports tab autocomplete. Type "help" for commands, "exit" to quit.', examples: ['nostr-bray shell'] },
+    'key-encrypt': { usage: 'key-encrypt <nsec-or-hex> <password>', description: 'Encrypt a secret key with a password using NIP-49. Returns an ncryptsec string safe for storage. Also returns the derived pubkey for verification.', examples: ['nostr-bray key-encrypt nsec1... mypassword'], notes: 'WARNING: secret key is passed as a CLI argument. Use only on trusted systems.' },
+    'key-decrypt': { usage: 'key-decrypt <ncryptsec> <password>', description: 'Decrypt an ncryptsec (NIP-49) with a password. Returns the pubkey for verification — never the raw secret key.', examples: ['nostr-bray key-decrypt ncryptsec1... mypassword'] },
+    bunker: { usage: 'bunker [--authorized-keys pk1,pk2] [--quiet]', description: 'Start a NIP-46 remote signer daemon. Holds your secret key and responds to signing requests from authorised clients over Nostr relays. Clients never see your nsec.', examples: ['nostr-bray bunker', 'nostr-bray bunker --authorized-keys abc123...,def456...', 'nostr-bray bunker --quiet'], notes: 'Without --authorized-keys, accepts requests from anyone. Set authorized keys for production use.' },
     serve: { usage: 'serve [--port N] [--hostname H] [--events file.jsonl] [--quiet]', description: 'Start an in-memory Nostr relay for testing. Implements NIP-01 (events, subscriptions, EOSE) and NIP-11 (relay info). Events live in memory only — no persistence. Optionally pre-load events from a JSONL file.', examples: ['nostr-bray serve', 'nostr-bray serve --port 7777', 'nostr-bray serve --events test-data.jsonl', 'nostr-bray serve --port 7777 --quiet'] },
 };
 /** Get formatted help for a single command */

package/dist/index.d.ts

@@ -1,9 +1,8 @@
 #!/usr/bin/env node
-import { IdentityContext } from './context.js';
 import { RelayPool } from './relay-pool.js';
 import { Nip65Manager } from './nip65.js';
 export declare const deps: {
-    ctx: IdentityContext;
+    ctx: any;
     pool: RelayPool;
     nip65: Nip65Manager;
     nwcUri: string | undefined;

package/dist/index.js

@@ -18,10 +18,20 @@ const pool = new RelayPool({
     defaultRelays: config.relays,
 });
 const nip65 = new Nip65Manager(pool, config.relays);
-const ctx = new IdentityContext(config.secretKey, config.secretFormat);
-export const deps = { ctx, pool, nip65, nwcUri: config.nwcUri };
+// Connect to bunker or use local key
+let ctx;
+if (config.bunkerUri) {
+    const { BunkerContext } = await import('./bunker-context.js');
+    ctx = await BunkerContext.connect(config.bunkerUri);
+    console.error(`Connected to bunker — signing as ${ctx.activeNpub}`);
+}
+else {
+    ctx = new IdentityContext(config.secretKey, config.secretFormat);
+}
+export const deps = { ctx: ctx, pool, nip65, nwcUri: config.nwcUri };
 config.secretKey = '';
 config.nwcUri = undefined;
+config.bunkerUri = undefined;
 // Load master identity relay list
 const masterRelays = await nip65.loadForIdentity(ctx.activeNpub);
 pool.reconfigure(ctx.activeNpub, masterRelays);

package/dist/types.d.ts

@@ -31,6 +31,7 @@ export interface BrayConfig {
     readonly secretKey: string;
     readonly secretFormat: 'nsec' | 'hex' | 'mnemonic';
     readonly relays: string[];
+    readonly bunkerUri?: string;
     readonly nwcUri?: string;
     readonly torProxy?: string;
     readonly allowClearnetWithTor: boolean;

package/dist/util/ncryptsec.d.ts

@@ -0,0 +1,17 @@
+/**
+ * NIP-49 ncryptsec — password-encrypted secret keys.
+ *
+ * Encrypt an nsec with a passphrase for safe storage.
+ * Decrypt an ncryptsec back to the raw key.
+ */
+/** Encrypt a secret key (nsec or hex) with a password. Returns ncryptsec string. */
+export declare function handleKeyEncrypt(secret: string, password: string): {
+    ncryptsec: string;
+    pubkeyHex: string;
+    npub: string;
+};
+/** Decrypt an ncryptsec with a password. Returns the derived pubkey (never the raw key). */
+export declare function handleKeyDecrypt(ncryptsec: string, password: string): {
+    pubkeyHex: string;
+    npub: string;
+};

package/dist/util/ncryptsec.js

@@ -0,0 +1,39 @@
+/**
+ * NIP-49 ncryptsec — password-encrypted secret keys.
+ *
+ * Encrypt an nsec with a passphrase for safe storage.
+ * Decrypt an ncryptsec back to the raw key.
+ */
+import { encrypt, decrypt } from 'nostr-tools/nip49';
+import { decode } from 'nostr-tools/nip19';
+import { getPublicKey } from 'nostr-tools/pure';
+import { npubEncode } from 'nostr-tools/nip19';
+/** Encrypt a secret key (nsec or hex) with a password. Returns ncryptsec string. */
+export function handleKeyEncrypt(secret, password) {
+    let bytes;
+    if (secret.startsWith('nsec1')) {
+        bytes = decode(secret).data;
+    }
+    else {
+        bytes = Buffer.from(secret, 'hex');
+    }
+    try {
+        const ncryptsec = encrypt(bytes, password);
+        const pubkeyHex = getPublicKey(bytes);
+        return { ncryptsec, pubkeyHex, npub: npubEncode(pubkeyHex) };
+    }
+    finally {
+        bytes.fill(0);
+    }
+}
+/** Decrypt an ncryptsec with a password. Returns the derived pubkey (never the raw key). */
+export function handleKeyDecrypt(ncryptsec, password) {
+    const bytes = decrypt(ncryptsec, password);
+    try {
+        const pubkeyHex = getPublicKey(bytes);
+        return { pubkeyHex, npub: npubEncode(pubkeyHex) };
+    }
+    finally {
+        bytes.fill(0);
+    }
+}

package/dist/util/tools.js

@@ -1,5 +1,6 @@
 import { z } from 'zod';
 import { hexId } from '../validation.js';
+import { handleKeyEncrypt, handleKeyDecrypt } from './ncryptsec.js';
 import { handleDecode, handleEncodeNpub, handleEncodeNote, handleEncodeNprofile, handleEncodeNevent, handleEncodeNaddr, handleVerify, handleEncrypt, handleDecrypt, handleCount, handleFetch, handleKeyPublic, handleEncodeNsec, handleFilter, handleNipList, handleNipShow, } from './handlers.js';
 export function registerUtilTools(server, deps) {
     server.registerTool('decode', {
@@ -167,4 +168,26 @@ export function registerUtilTools(server, deps) {
         const nip = await handleNipShow(number);
         return { content: [{ type: 'text', text: nip.content }] };
     });
+    server.registerTool('key_encrypt', {
+        description: 'Encrypt a secret key with a password (NIP-49 ncryptsec). Returns the ncryptsec string and the derived pubkey. WARNING: secret key is transmitted through the MCP transport.',
+        inputSchema: {
+            secret: z.string().describe('Secret key (nsec or hex)'),
+            password: z.string().describe('Password to encrypt with'),
+        },
+        annotations: { readOnlyHint: true },
+    }, async ({ secret, password }) => {
+        const result = handleKeyEncrypt(secret, password);
+        return { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] };
+    });
+    server.registerTool('key_decrypt', {
+        description: 'Decrypt an ncryptsec (NIP-49) with a password. Returns the derived pubkey for verification — never the raw key.',
+        inputSchema: {
+            ncryptsec: z.string().describe('ncryptsec string to decrypt'),
+            password: z.string().describe('Password used during encryption'),
+        },
+        annotations: { readOnlyHint: true },
+    }, async ({ ncryptsec, password }) => {
+        const result = handleKeyDecrypt(ncryptsec, password);
+        return { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] };
+    });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nostr-bray",
-  "version": "1.13.0",
+  "version": "1.15.0",
   "description": "MCP server giving AI agents sovereign Nostr identities — key derivation, personas, attestations, duress detection, zaps",
   "type": "module",
   "main": "dist/index.js",