# nsigner Browser Extension — NIP-07 frontend over nsigner

> **Project:** subtree of `n_signer` at `browser-extension/` (may spin out later).
>
> **Status:** Planning. This document describes a WebExtension that exposes [NIP-07](https://github.com/nostr-protocol/nips/blob/master/07.md) `window.nostr` and forwards calls to a running `nsigner` instance.
>
> **Authoritative signer behavior:** [`../README.md`](../README.md)

## 1. What this is

A Chrome/Firefox/Brave WebExtension (Manifest V3) that:

1. injects a standard NIP-07-compatible `window.nostr` surface
2. forwards each call to `nsigner` over native-messaging, TLS, or relay fallback transport
3. applies per-origin permission policy and per-origin role pinning

The extension is not a wallet and holds no private keys.

## 2. Important compatibility note with multi-purpose roles

`nsigner` role entries now carry explicit purpose/curve metadata (see [`../README.md`](../README.md)).
For browser NIP-07 operations, the extension must request only roles whose purpose resolves to `nostr`.
If a role is configured for another purpose (e.g. bitcoin/ssh/age), extension UI must hide or reject it for NIP-07 signing/encryption calls instead of forwarding an invalid request.

## 3. Architecture (unchanged high level)

- page -> content script -> service worker
- service worker -> chosen transport -> `nsigner`
- policy and user prompts in extension UI

## 4. NIP-07 surface mapping

Standard NIP-07 calls map to `nsigner` request verbs:

- `getPublicKey`
- `signEvent`
- `nip04.encrypt` / `nip04.decrypt`
- `nip44.encrypt` / `nip44.decrypt`

The extension attaches role selector options when needed, but role choices must remain purpose-compatible with Nostr operations.

## 5. Transport options

1. Native messaging bridge (primary)
2. TLS to local/nearby `nsigner`
3. Relay-based fallback

## 6. Permission model

Per-origin policy remains the control point:

- allow/deny by verb/kind/origin
- origin-level role pinning
- explicit prompts for sensitive operations

## 7. Security constraints

- no private key/mnemonic persistence in extension storage
- no plaintext decrypt cache
- strong defaults for decrypt operations
- role purpose compatibility checks before forwarding signer requests

## 8. Implementation phases (extension-specific)

1. native helper
2. MVP extension with native path
3. role-aware UI
4. TLS transport
5. management/audit UX
6. relay fallback transport
7. browser polish and release

## 9. Repo location

Planned extension subtree remains:

- `browser-extension/extension/`
- `browser-extension/native-bridge/`
- `browser-extension/install/`
- `browser-extension/tests/`

## 10. Open questions

- extension coexistence with other NIP-07 providers
- multi-profile signer selection UX
- mobile constraints without native messaging
- hardware-token pending-confirmation UX in popup