nostr-bray 1.14.0 → 1.16.0

package/dist/bunker-context.d.ts

@@ -0,0 +1,42 @@
+/**
+ * BunkerContext — an IdentityContext-compatible interface backed by a NIP-46 bunker.
+ *
+ * Instead of holding the secret key locally, all signing is delegated to a
+ * remote bunker via encrypted Nostr relay messages.
+ *
+ * Usage:
+ *   BUNKER_URI=bunker://pk?relay=wss://...
+ *   or
+ *   BUNKER_URI=bunker://pk?relay=wss://...&secret=clienthex
+ */
+import type { PublicIdentity, SignFn } from './types.js';
+export interface BunkerConfig {
+    pubkey: string;
+    relay: string;
+    secret?: string;
+}
+/** Parse a bunker:// URI */
+export declare function parseBunkerUri(uri: string): BunkerConfig;
+export declare class BunkerContext {
+    private signer;
+    private pool;
+    private pubkeyHex;
+    private clientSk;
+    private constructor();
+    /** Connect to a remote bunker. Blocks until the connection is established. */
+    static connect(uri: string, timeoutMs?: number): Promise<BunkerContext>;
+    /** The remote identity's npub */
+    get activeNpub(): string;
+    /** The remote identity's hex pubkey */
+    get activePublicKeyHex(): string;
+    /** Sign an event via the remote bunker */
+    getSigningFunction(): SignFn;
+    /** List identities — bunker mode only has one (the remote key) */
+    listIdentities(): PublicIdentity[];
+    /** NIP-44 encrypt via the remote bunker */
+    nip44Encrypt(recipientPubkey: string, plaintext: string): Promise<string>;
+    /** NIP-44 decrypt via the remote bunker */
+    nip44Decrypt(senderPubkey: string, ciphertext: string): Promise<string>;
+    /** Clean up */
+    destroy(): void;
+}

package/dist/bunker-context.js

@@ -0,0 +1,87 @@
+/**
+ * BunkerContext — an IdentityContext-compatible interface backed by a NIP-46 bunker.
+ *
+ * Instead of holding the secret key locally, all signing is delegated to a
+ * remote bunker via encrypted Nostr relay messages.
+ *
+ * Usage:
+ *   BUNKER_URI=bunker://pk?relay=wss://...
+ *   or
+ *   BUNKER_URI=bunker://pk?relay=wss://...&secret=clienthex
+ */
+import { BunkerSigner } from 'nostr-tools/nip46';
+import { useWebSocketImplementation, SimplePool } from 'nostr-tools/pool';
+import { generateSecretKey } from 'nostr-tools/pure';
+import { npubEncode } from 'nostr-tools/nip19';
+import WebSocket from 'ws';
+useWebSocketImplementation(WebSocket);
+/** Parse a bunker:// URI */
+export function parseBunkerUri(uri) {
+    // bunker://<pubkey>?relay=<url>&secret=<hex>
+    const url = new URL(uri);
+    const pubkey = url.hostname || url.pathname.replace('//', '');
+    const relay = url.searchParams.get('relay');
+    const secret = url.searchParams.get('secret') ?? undefined;
+    if (!pubkey || !relay) {
+        throw new Error('Invalid bunker URI: missing pubkey or relay');
+    }
+    return { pubkey, relay, secret };
+}
+export class BunkerContext {
+    signer;
+    pool;
+    pubkeyHex;
+    clientSk;
+    constructor(signer, pool, clientSk) {
+        this.signer = signer;
+        this.pool = pool;
+        this.clientSk = clientSk;
+    }
+    /** Connect to a remote bunker. Blocks until the connection is established. */
+    static async connect(uri, timeoutMs = 15_000) {
+        const config = parseBunkerUri(uri);
+        const clientSk = config.secret
+            ? Buffer.from(config.secret, 'hex')
+            : generateSecretKey();
+        const pool = new SimplePool();
+        const signer = BunkerSigner.fromBunker(clientSk, { pubkey: config.pubkey, relays: [config.relay], secret: null }, { pool });
+        // Connect and verify
+        await signer.connect();
+        await signer.ping();
+        const ctx = new BunkerContext(signer, pool, clientSk);
+        ctx.pubkeyHex = await signer.getPublicKey();
+        return ctx;
+    }
+    /** The remote identity's npub */
+    get activeNpub() {
+        return npubEncode(this.pubkeyHex);
+    }
+    /** The remote identity's hex pubkey */
+    get activePublicKeyHex() {
+        return this.pubkeyHex;
+    }
+    /** Sign an event via the remote bunker */
+    getSigningFunction() {
+        return async (template) => {
+            return this.signer.signEvent(template);
+        };
+    }
+    /** List identities — bunker mode only has one (the remote key) */
+    listIdentities() {
+        return [{ npub: this.activeNpub, purpose: 'bunker', index: 0 }];
+    }
+    /** NIP-44 encrypt via the remote bunker */
+    async nip44Encrypt(recipientPubkey, plaintext) {
+        return this.signer.nip44Encrypt(recipientPubkey, plaintext);
+    }
+    /** NIP-44 decrypt via the remote bunker */
+    async nip44Decrypt(senderPubkey, ciphertext) {
+        return this.signer.nip44Decrypt(senderPubkey, ciphertext);
+    }
+    /** Clean up */
+    destroy() {
+        this.signer.close();
+        this.pool.destroy();
+        this.clientSk.fill(0);
+    }
+}

package/dist/cli.js

@@ -178,6 +178,7 @@ Modes:
 Environment:
   NOSTR_SECRET_KEY              nsec, hex, or BIP-39 mnemonic
   NOSTR_SECRET_KEY_FILE         Path to secret key file
+  BUNKER_URI / BUNKER_URI_FILE  bunker:// URI (use INSTEAD of secret key)
   NOSTR_RELAYS                  Comma-separated relay URLs
   NWC_URI / NWC_URI_FILE        Nostr Wallet Connect URI
   TOR_PROXY                     SOCKS5h proxy URL

package/dist/config.js

@@ -36,14 +36,21 @@ export function loadConfig() {
     const keyFilePath = process.env.NOSTR_SECRET_KEY_FILE;
     const keyEnvVar = process.env.NOSTR_SECRET_KEY;
     let secretKey;
+    const bunkerUri = process.env.BUNKER_URI ?? process.env.BUNKER_URI_FILE
+        ? (process.env.BUNKER_URI_FILE ? readSecretFile(process.env.BUNKER_URI_FILE) : process.env.BUNKER_URI)
+        : undefined;
     if (keyFilePath) {
         secretKey = readSecretFile(keyFilePath);
     }
     else if (keyEnvVar) {
         secretKey = keyEnvVar;
     }
+    else if (bunkerUri) {
+        // Bunker mode — no local secret needed
+        secretKey = '';
+    }
     else {
-        throw new Error('No secret key provided: set NOSTR_SECRET_KEY or NOSTR_SECRET_KEY_FILE');
+        throw new Error('No secret key provided: set NOSTR_SECRET_KEY, NOSTR_SECRET_KEY_FILE, or BUNKER_URI');
     }
     const secretFormat = detectKeyFormat(secretKey);
     // --- NWC URI ---
@@ -72,10 +79,13 @@ export function loadConfig() {
     delete process.env.NOSTR_SECRET_KEY_FILE;
     delete process.env.NWC_URI;
     delete process.env.NWC_URI_FILE;
+    delete process.env.BUNKER_URI;
+    delete process.env.BUNKER_URI_FILE;
     return {
         secretKey,
         secretFormat,
         relays,
+        bunkerUri: bunkerUri ?? undefined,
         nwcUri,
         torProxy,
         allowClearnetWithTor,

package/dist/index.d.ts

@@ -1,9 +1,8 @@
 #!/usr/bin/env node
-import { IdentityContext } from './context.js';
 import { RelayPool } from './relay-pool.js';
 import { Nip65Manager } from './nip65.js';
 export declare const deps: {
-    ctx: IdentityContext;
+    ctx: any;
     pool: RelayPool;
     nip65: Nip65Manager;
     nwcUri: string | undefined;

package/dist/index.js

@@ -18,10 +18,20 @@ const pool = new RelayPool({
     defaultRelays: config.relays,
 });
 const nip65 = new Nip65Manager(pool, config.relays);
-const ctx = new IdentityContext(config.secretKey, config.secretFormat);
-export const deps = { ctx, pool, nip65, nwcUri: config.nwcUri };
+// Connect to bunker or use local key
+let ctx;
+if (config.bunkerUri) {
+    const { BunkerContext } = await import('./bunker-context.js');
+    ctx = await BunkerContext.connect(config.bunkerUri);
+    console.error(`Connected to bunker — signing as ${ctx.activeNpub}`);
+}
+else {
+    ctx = new IdentityContext(config.secretKey, config.secretFormat);
+}
+export const deps = { ctx: ctx, pool, nip65, nwcUri: config.nwcUri };
 config.secretKey = '';
 config.nwcUri = undefined;
+config.bunkerUri = undefined;
 // Load master identity relay list
 const masterRelays = await nip65.loadForIdentity(ctx.activeNpub);
 pool.reconfigure(ctx.activeNpub, masterRelays);

package/dist/types.d.ts

@@ -31,6 +31,7 @@ export interface BrayConfig {
     readonly secretKey: string;
     readonly secretFormat: 'nsec' | 'hex' | 'mnemonic';
     readonly relays: string[];
+    readonly bunkerUri?: string;
     readonly nwcUri?: string;
     readonly torProxy?: string;
     readonly allowClearnetWithTor: boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nostr-bray",
-  "version": "1.14.0",
+  "version": "1.16.0",
   "description": "MCP server giving AI agents sovereign Nostr identities — key derivation, personas, attestations, duress detection, zaps",
   "type": "module",
   "main": "dist/index.js",