Struct GuardedSigner 

pub struct GuardedSigner { /* private fields */ }

A signer backed by the MY_SECRET_KEY vault.

The secret key is never stored in this struct — it’s fetched from the GuardedKey vault on every operation and zeroized immediately after use.

Implementations

impl GuardedSigner

pub fn new(public_key: PublicKey) -> Self

pub fn unwrap_gift_wrap(gift_wrap: &Event) -> Result<UnwrappedGift, SignerError>

NIP-59 unwrap under one vault read; see Self::unwrap_batch.

pub fn unwrap_batch(wraps: &[&Event]) -> Vec<Result<UnwrappedGift, SignerError>>

NIP-59 unwrap of many wraps under one vault read, one result per wrap in order. Checks what nostr’s from_gift_wrap checks, but opens every layer before verifying any seal, so the key lives only for the NIP-44 opens and never across a signature check. Opening an unverified seal is safe: its content authenticates under ECDH with its claimed author, and nothing from it is trusted until that author’s signature verifies.

A sender’s conversation key is derived once per batch and wiped with the secret key.

No identity check against my_public_key: a vault key that isn’t the identity can only open wraps sealed to itself, which then authenticate their sender like any DM. Signing keeps active_signer’s fail-closed check.

Trait Implementations

impl AsyncGetPublicKey for GuardedSigner

type Error = SignerError

Error type

fn get_public_key_async( &self, ) -> BoxedFuture<'_, Result<PublicKey, Self::Error>>

Get public key

impl AsyncNip04 for GuardedSigner

type Error = SignerError

NIP-04 error

fn nip04_encrypt_async<'a>( &'a self, public_key: &'a PublicKey, content: &'a str, ) -> BoxedFuture<'a, Result<String, Self::Error>>

Encrypts asynchronously using NIP-04.

fn nip04_decrypt_async<'a>( &'a self, public_key: &'a PublicKey, encrypted_content: &'a str, ) -> BoxedFuture<'a, Result<String, Self::Error>>

Decrypts asynchronously a NIP-04 payload.

impl AsyncNip44 for GuardedSigner

type Error = SignerError

NIP-44 error

fn nip44_encrypt_async<'a>( &'a self, public_key: &'a PublicKey, content: &'a str, ) -> BoxedFuture<'a, Result<String, Self::Error>>

Encrypts asynchronously using NIP-44.

fn nip44_decrypt_async<'a>( &'a self, public_key: &'a PublicKey, payload: &'a str, ) -> BoxedFuture<'a, Result<String, Self::Error>>

Decrypts asynchronously a NIP-44 payload.

impl AsyncSignEvent for GuardedSigner

type Error = SignerError

Error type

fn sign_event_async( &self, unsigned: UnsignedEvent, ) -> BoxedFuture<'_, Result<Event, Self::Error>>

Sign an unsigned event

impl Clone for GuardedSigner

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for GuardedSigner

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl GetPublicKey for GuardedSigner

type Error = SignerError

Error type

fn get_public_key(&self) -> Result<PublicKey, Self::Error>

Get public key

impl Nip04 for GuardedSigner

type Error = SignerError

NIP-04 error

fn nip04_encrypt( &self, public_key: &PublicKey, content: &str, ) -> Result<String, Self::Error>

Encrypts synchronously using NIP-04.

fn nip04_decrypt( &self, public_key: &PublicKey, payload: &str, ) -> Result<String, Self::Error>

Decrypts synchronously a NIP-04 payload.

impl Nip44 for GuardedSigner

type Error = SignerError

NIP-44 error

fn nip44_encrypt( &self, public_key: &PublicKey, content: &str, ) -> Result<String, Self::Error>

Encrypts synchronously using NIP-44.

fn nip44_decrypt( &self, public_key: &PublicKey, payload: &str, ) -> Result<String, Self::Error>

Decrypts synchronously a NIP-44 payload.

impl SignEvent for GuardedSigner

type Error = SignerError

Error type

fn sign_event(&self, unsigned: UnsignedEvent) -> Result<Event, Self::Error>

Sign an unsigned event