const { type, origin } = message;

if (DEBUG) console.log('[Podkey] Message received:', type, 'from', origin || 'popup');

switch (type) {

case 'GET_PUBLIC_KEY':

return await handleGetPublicKey(origin, sender);

case 'SIGN_EVENT':

return await handleSignEvent(message.event, origin, sender);

case 'GENERATE_KEYPAIR':

return await handleGenerateKeypair(message.passphrase);

case 'IMPORT_KEYPAIR':

return await handleImportKeypair(message.privateKey, message.passphrase);

case 'UNLOCK_VAULT':

return await handleUnlockVault(message.passphrase);

case 'LOCK_VAULT':

return await handleLockVault();

case 'GET_KEYPAIR_STATUS':

return await handleGetKeypairStatus();

case 'NIP44_ENCRYPT':

return await handleNip44Encrypt(message.pubkey, message.plaintext, origin);

case 'NIP44_DECRYPT':

return await handleNip44Decrypt(message.pubkey, message.ciphertext, origin);

case 'NIP44_GET_CONVERSATION_KEY':

return await handleNip44GetConversationKey(message.pubkey, origin);

case 'CREATE_NIP98_AUTH_HEADER':

return await createNip98AuthHeader(

message.url,

message.method,

message.body,

message.bodyHash

);

default:

throw new Error(`Unknown message type: ${type}`);

}

if (await hasKeypair()) return;

if (await hasVault()) {

openUnlockPopup();

throw new Error('Podkey is locked. Open Podkey, unlock with your passphrase, and try again.');

}

throw new Error('No key in Podkey. Open the extension to generate or import a key first.');

try {

chrome.windows.create({

url: 'popup/popup.html',

type: 'popup',

width: 400,

height: 560,

focused: true

});

} catch (e) {

if (DEBUG) console.log('[Podkey] Could not open unlock popup:', e.message);

}

// Require an unlocked key (locked vault -> opens unlock UI; no key -> setup).

await ensureUnlocked();

// Check if origin is trusted

const trusted = await isTrustedOrigin(origin);

if (!trusted) {

// Show permission prompt

const allowed = await showPermissionPrompt(origin, 'read your public key');

if (!allowed) {

throw new Error('User denied permission');

}

// Trust this origin

await addTrustedOrigin(origin);

}

// Get and return public key (ensure it's a string)

const keypair = await getKeypair();

if (!keypair || !keypair.publicKey || typeof keypair.publicKey !== 'string') {

throw new Error('Invalid keypair format');

}

return String(keypair.publicKey);

// Require an unlocked key (locked vault -> opens unlock UI; no key -> setup).

await ensureUnlocked();

const keypair = await getKeypair();

// A trusted origin signs without a prompt — the same trust model already used

// by GET_PUBLIC_KEY and nip44.{encrypt,decrypt} (decrypting DMs is strictly

// more sensitive than signing, and is silent for trusted origins). An

// untrusted origin always prompts, and approving it establishes revocable

// trust. The previous `&& autoSign && isSolidAuth` gate special-cased Solid

// kind-27235 and made Podkey unusable as a general NIP-07 signer — a normal

// client (kind 0/1/10002/22242…) re-prompted on every page load. isSolidAuth

// now only tunes the wording of the first-contact prompt.

const isSolidAuth = event.kind === 27235;

const trusted = await isTrustedOrigin(origin);

let shouldSign = trusted;

if (!shouldSign) {

// Show signing prompt with event preview

const actionLabel = isSolidAuth ? 'sign a Solid authentication event' : `sign an event (kind ${event.kind})`;

const previewData = JSON.stringify({

kind: event.kind,

content: (event.content || '').substring(0, 200),

tags: (event.tags || []).length

});

const allowed = await showPermissionPrompt(origin, actionLabel, previewData);

if (!allowed) {

throw new Error('User denied signing');

}

// Trust this origin if not already trusted

if (!trusted) {

await addTrustedOrigin(origin);

}

}

// Sign the event

const signedEvent = await signEvent(event, keypair.privateKey);

if (DEBUG) console.log('[Podkey] Event signed:', signedEvent.id.substring(0, 16) + '...');

// Ensure event structure is correct (tags should be array, content should be string)

// Preserve original event structure but ensure required fields are correct types

return {

...signedEvent,

kind: Number(signedEvent.kind),

created_at: Number(signedEvent.created_at),

tags: Array.isArray(signedEvent.tags) ? signedEvent.tags : [],

content: String(signedEvent.content || '')

};

// Require an unlocked key (locked vault -> opens unlock UI; no key -> setup).

await ensureUnlocked();

const trusted = await isTrustedOrigin(origin);

if (!trusted) {

const allowed = await showPermissionPrompt(origin, action);

if (!allowed) {

throw new Error('User denied permission');

}

await addTrustedOrigin(origin);

}

const keypair = await getKeypair();

if (!keypair || typeof keypair.privateKey !== 'string') {

throw new Error('Invalid keypair format');

}

return keypair;

if (typeof peerPubkey !== 'string' || typeof plaintext !== 'string') {

throw new Error('nip44.encrypt requires (pubkey, plaintext) strings');

}

const keypair = await resolveKeypairForEncryption(origin, 'encrypt a message (NIP-44)');

const conversationKey = getConversationKey(keypair.privateKey, peerPubkey);

return nip44Encrypt(plaintext, conversationKey);

if (typeof peerPubkey !== 'string' || typeof ciphertext !== 'string') {

throw new Error('nip44.decrypt requires (pubkey, ciphertext) strings');

}

const keypair = await resolveKeypairForEncryption(origin, 'decrypt a message (NIP-44)');

const conversationKey = getConversationKey(keypair.privateKey, peerPubkey);

return nip44Decrypt(ciphertext, conversationKey);

if (typeof peerPubkey !== 'string') {

throw new Error('nip44.getConversationKey requires a pubkey string');

}

const keypair = await resolveKeypairForEncryption(origin, 'derive a NIP-44 conversation key');

const conversationKey = getConversationKey(keypair.privateKey, peerPubkey);

return nip44BytesToHex(conversationKey);

try {

const keypair = await generateKeypair();

await createVault(keypair.privateKey, passphrase); // encrypted at rest

await storeKeypair(keypair.privateKey, keypair.publicKey); // unlocked session

if (DEBUG) console.log('[Podkey] Keypair generated, sealed, and unlocked');

return {

publicKey: keypair.publicKey,

did: `did:nostr:${keypair.publicKey}`

};

} catch (error) {

console.error('[Podkey] Error generating keypair:', error);

throw error;

}

// Validate private key format

if (!privateKey || privateKey.length !== 64) {

throw new Error('Private key must be 64-char hex');

}

if (!/^[0-9a-fA-F]{64}$/.test(privateKey)) {

throw new Error('Private key must be valid hexadecimal');

}

// Derive public key

const publicKey = getPublicKey(privateKey);

await createVault(privateKey, passphrase); // encrypted at rest (validates passphrase)

await storeKeypair(privateKey, publicKey); // unlocked session

if (DEBUG) console.log('[Podkey] Keypair imported and sealed');

return {

publicKey,

did: `did:nostr:${publicKey}`

};

const privateKey = await unlockVault(passphrase); // throws on wrong passphrase

const publicKey = getPublicKey(privateKey);

await storeKeypair(privateKey, publicKey); // populate session cache

if (DEBUG) console.log('[Podkey] Vault unlocked');

return {

publicKey,

did: `did:nostr:${publicKey}`

};

await clearSessionKey();

if (DEBUG) console.log('[Podkey] Vault locked');

return { ok: true };

if (await hasKeypair()) {

const keypair = await getKeypair();

return {

state: 'unlocked',

exists: true,

publicKey: keypair.publicKey,

did: `did:nostr:${keypair.publicKey}`

};

}

if (await hasVault()) {

const publicKey = await getStoredPublicKey();

return {

state: 'locked',

exists: true,

publicKey: publicKey || null,

did: publicKey ? `did:nostr:${publicKey}` : null

};

}

return { state: 'none', exists: false };

const requestId = crypto.randomUUID();

return new Promise((resolve) => {

pendingApprovals.set(requestId, resolve);

// Auto-deny after 60 seconds if no response

const timeout = setTimeout(() => {

if (pendingApprovals.has(requestId)) {

pendingApprovals.delete(requestId);

console.log(`[Podkey] Signing request ${requestId} timed out, auto-denying`);

resolve(false);

}

}, 60000);

// Clean up timeout when resolved normally

const originalResolve = resolve;

pendingApprovals.set(requestId, (approved) => {

clearTimeout(timeout);

originalResolve(approved);

});

const params = new URLSearchParams({

id: requestId,

origin: origin || 'Unknown',

action: action || 'sign',

preview: eventPreview || ''

});

chrome.windows.create({

url: `popup/approve.html?${params.toString()}`,

type: 'popup',

width: 420,

height: 380,

focused: true

});

});

const eventJson = JSON.stringify(signedEvent);

// Use btoa for base64 encoding (available in service workers)

return btoa(eventJson);

let hostname;

try {

hostname = new URL(origin).hostname;

} catch {

return false;

}

const trustedHosts = [

'solid.social',

'solidcommunity.net',

'inrupt.net',

'solidweb.org'

];

return trustedHosts.some(trusted =>

hostname === trusted || hostname.endsWith('.' + trusted)

);

try {

// Check if we should add auth

const origin = new URL(url).origin;

const trusted = await isTrustedOrigin(origin);

const autoSign = await getAutoSign();

const keyExists = await hasKeypair();

const isSolid = isLikelySolidServer(origin);

if (DEBUG) console.log('[Podkey] NIP-98 auth check:', { url, origin, keyExists, trusted, autoSign, isSolid });

if (!keyExists) {

if (DEBUG) console.log('[Podkey] No keypair found, skipping NIP-98 auth');

return null;

}

// For Solid servers, auto-trust on first use if auto-sign is enabled

if (!trusted && isSolid && autoSign) {

if (DEBUG) console.log('[Podkey] Auto-trusting Solid server:', origin);

await addTrustedOrigin(origin);

} else if (!trusted) {

if (DEBUG) console.log('[Podkey] Origin not trusted, skipping NIP-98 auth');

return null;

}

if (!autoSign) {

if (DEBUG) console.log('[Podkey] Auto-sign disabled, skipping NIP-98 auth');

return null;

}

// Prefer a body hash computed in the page context (the only place where

// FormData / URLSearchParams / streamed bodies survive intact). Fall back

// to hashing here for body types that cross the message channel losslessly.

let resolvedBodyHash = typeof bodyHash === 'string' ? bodyHash : '';

if (!resolvedBodyHash && body) {

if (typeof body === 'string') {

resolvedBodyHash = bytesToHex(sha256(new TextEncoder().encode(body)));

} else if (body instanceof ArrayBuffer) {

resolvedBodyHash = bytesToHex(sha256(new Uint8Array(body)));

} else if (body instanceof Blob) {

resolvedBodyHash = bytesToHex(sha256(new Uint8Array(await body.arrayBuffer())));

}

}

// Always create a fresh signed event (no caching -- reusing signed events

// causes replay issues and servers with replay protection reject them).

// created_at has 1-second resolution, so a random nonce tag guarantees a

// distinct event id for repeated identical requests within the same second.

const event = {

kind: 27235,

content: '',

created_at: Math.floor(Date.now() / 1000),

tags: [

['u', url],

['method', method],

['nonce', bytesToHex(crypto.getRandomValues(new Uint8Array(16)))]

]

};

if (resolvedBodyHash) {

event.tags.push(['payload', resolvedBodyHash]);

}

const keypair = await getKeypair();

const signedEvent = await signEvent(event, keypair.privateKey);

if (DEBUG) {

console.log('[Podkey] NIP-98 event:', JSON.stringify(signedEvent));

console.log('[Podkey] Public key (did:nostr):', `did:nostr:${keypair.publicKey}`);

}

return `Nostr ${encodeNip98Header(signedEvent)}`;

} catch (error) {

console.error('[Podkey] Error creating NIP-98 auth header:', error);

return null;

}