v0.0.12 - Add n_signer URL auth envelopes and policy/auth error handling

include/nsigner_auth.h

@@ -0,0 +1,26 @@
+#ifndef NSIGNER_AUTH_H
+#define NSIGNER_AUTH_H
+
+#include "../resources/nostr_core_lib/cjson/cJSON.h"
+
+#include <time.h>
+
+typedef struct {
+    int enabled;
+    unsigned char privkey[32];
+    char label[64];
+} nt_nsigner_auth_ctx_t;
+
+/*
+ * Build a TCP auth envelope event (kind 27235) for an n_signer JSON-RPC request.
+ * Caller owns *out_auth and must cJSON_Delete() it.
+ * Returns 0 on success.
+ */
+int nt_nsigner_auth_build(const char *request_id,
+                          const char *method,
+                          const cJSON *params,
+                          const nt_nsigner_auth_ctx_t *auth_ctx,
+                          time_t created_at,
+                          cJSON **out_auth);
+
+#endif /* NSIGNER_AUTH_H */

include/nsigner_client.h

@@ -2,6 +2,22 @@
 #define NSIGNER_CLIENT_H
 
 #include "../resources/nostr_core_lib/cjson/cJSON.h"
+#include "nsigner_auth.h"
+
+/* Selector for key derivation/role in n_signer requests. */
+typedef struct {
+    int has_nostr_index;
+    int nostr_index;
+    char role[64];
+} nt_nsigner_selector_t;
+
+static inline nt_nsigner_selector_t nsigner_selector_default(void) {
+    nt_nsigner_selector_t s;
+    s.has_nostr_index = 1;
+    s.nostr_index = 0;
+    s.role[0] = '\0';
+    return s;
+}
 
 /* Error codes */
 #define NT_NSIGNER_OK          0
@@ -10,6 +26,7 @@
 #define NT_NSIGNER_E_UNAUTH   -3
 #define NT_NSIGNER_E_PARSE    -4
 #define NT_NSIGNER_E_ERROR    -5
+#define NT_NSIGNER_E_AUTH     -6
 
 /*
  * Enumerate running nsigner instances by reading /proc/net/unix.
@@ -39,44 +56,102 @@ int nsigner_rpc(int fd, const cJSON *request, cJSON **response_out, int read_tim
  * socket_name: without '@' prefix.
  * role: the role selector string (e.g. "main").
  */
-int nsigner_get_public_key(const char *socket_name, const char *role, char *out_hex_65);
+int nsigner_get_public_key(const char *socket_name, const nt_nsigner_selector_t *selector, char *out_hex_65);
 
-int nsigner_sign_event(const char *socket_name, const char *role,
+int nsigner_sign_event(const char *socket_name, const nt_nsigner_selector_t *selector,
                        const char *unsigned_event_json, char **signed_event_json_out);
 
-int nsigner_nip04_encrypt(const char *socket_name, const char *role,
+int nsigner_nip04_encrypt(const char *socket_name, const nt_nsigner_selector_t *selector,
                           const char *peer_pub_hex, const char *plaintext, char **cipher_out);
 
-int nsigner_nip04_decrypt(const char *socket_name, const char *role,
+int nsigner_nip04_decrypt(const char *socket_name, const nt_nsigner_selector_t *selector,
                           const char *peer_pub_hex, const char *ciphertext, char **plain_out);
 
-int nsigner_nip44_encrypt(const char *socket_name, const char *role,
+int nsigner_nip44_encrypt(const char *socket_name, const nt_nsigner_selector_t *selector,
                           const char *peer_pub_hex, const char *plaintext, char **cipher_out);
 
-int nsigner_nip44_decrypt(const char *socket_name, const char *role,
+int nsigner_nip44_decrypt(const char *socket_name, const nt_nsigner_selector_t *selector,
                           const char *peer_pub_hex, const char *ciphertext, char **plain_out);
 
 /*
  * URL helpers for FIPS/TCP transport.
  * URL format: http://host:port (path/query ignored if present).
  */
-int nsigner_get_public_key_url(const char *url, const char *role, char *out_hex_65);
+int nsigner_get_public_key_url(const char *url, const nt_nsigner_selector_t *selector,
+                               const nt_nsigner_auth_ctx_t *auth, char *out_hex_65);
 
-int nsigner_sign_event_url(const char *url, const char *role,
+int nsigner_sign_event_url(const char *url, const nt_nsigner_selector_t *selector,
+                           const nt_nsigner_auth_ctx_t *auth,
                            const char *unsigned_event_json, char **signed_event_json_out);
 
-int nsigner_nip04_encrypt_url(const char *url, const char *role,
+int nsigner_nip04_encrypt_url(const char *url, const nt_nsigner_selector_t *selector,
+                              const nt_nsigner_auth_ctx_t *auth,
                               const char *peer_pub_hex, const char *plaintext, char **cipher_out);
 
-int nsigner_nip04_decrypt_url(const char *url, const char *role,
+int nsigner_nip04_decrypt_url(const char *url, const nt_nsigner_selector_t *selector,
+                              const nt_nsigner_auth_ctx_t *auth,
                               const char *peer_pub_hex, const char *ciphertext, char **plain_out);
 
-int nsigner_nip44_encrypt_url(const char *url, const char *role,
+int nsigner_nip44_encrypt_url(const char *url, const nt_nsigner_selector_t *selector,
+                              const nt_nsigner_auth_ctx_t *auth,
                               const char *peer_pub_hex, const char *plaintext, char **cipher_out);
 
-int nsigner_nip44_decrypt_url(const char *url, const char *role,
+int nsigner_nip44_decrypt_url(const char *url, const nt_nsigner_selector_t *selector,
+                              const nt_nsigner_auth_ctx_t *auth,
                               const char *peer_pub_hex, const char *ciphertext, char **plain_out);
 
+/*
+ * Persistent URL session helpers.
+ * Open once and reuse the fd for all RPC calls to keep a stable TCP source port.
+ */
+int nsigner_session_open_url(const char *url);
+void nsigner_session_close(int fd);
+
+int nsigner_session_get_public_key(int *fd_inout,
+                                   const char *url,
+                                   const nt_nsigner_selector_t *selector,
+                                   const nt_nsigner_auth_ctx_t *auth,
+                                   char *out_hex_65);
+
+int nsigner_session_sign_event(int *fd_inout,
+                               const char *url,
+                               const nt_nsigner_selector_t *selector,
+                               const nt_nsigner_auth_ctx_t *auth,
+                               const char *unsigned_event_json,
+                               char **signed_event_json_out);
+
+int nsigner_session_nip04_encrypt(int *fd_inout,
+                                  const char *url,
+                                  const nt_nsigner_selector_t *selector,
+                                  const nt_nsigner_auth_ctx_t *auth,
+                                  const char *peer_pub_hex,
+                                  const char *plaintext,
+                                  char **cipher_out);
+
+int nsigner_session_nip04_decrypt(int *fd_inout,
+                                  const char *url,
+                                  const nt_nsigner_selector_t *selector,
+                                  const nt_nsigner_auth_ctx_t *auth,
+                                  const char *peer_pub_hex,
+                                  const char *ciphertext,
+                                  char **plain_out);
+
+int nsigner_session_nip44_encrypt(int *fd_inout,
+                                  const char *url,
+                                  const nt_nsigner_selector_t *selector,
+                                  const nt_nsigner_auth_ctx_t *auth,
+                                  const char *peer_pub_hex,
+                                  const char *plaintext,
+                                  char **cipher_out);
+
+int nsigner_session_nip44_decrypt(int *fd_inout,
+                                  const char *url,
+                                  const nt_nsigner_selector_t *selector,
+                                  const nt_nsigner_auth_ctx_t *auth,
+                                  const char *peer_pub_hex,
+                                  const char *ciphertext,
+                                  char **plain_out);
+
 /*
  * qrexec helpers for cross-qube n_signer transport.
  * target_qube: destination signer qube (e.g. "nsigner-vault").
@@ -84,39 +159,39 @@ int nsigner_nip44_decrypt_url(const char *url, const char *role,
  */
 int nsigner_qrexec_get_public_key(const char *target_qube,
                                   const char *service_name,
-                                  const char *role,
+                                  const nt_nsigner_selector_t *selector,
                                   char *out_hex_65);
 
 int nsigner_qrexec_sign_event(const char *target_qube,
                               const char *service_name,
-                              const char *role,
+                              const nt_nsigner_selector_t *selector,
                               const char *unsigned_event_json,
                               char **signed_event_json_out);
 
 int nsigner_qrexec_nip04_encrypt(const char *target_qube,
                                  const char *service_name,
-                                 const char *role,
+                                 const nt_nsigner_selector_t *selector,
                                  const char *peer_pub_hex,
                                  const char *plaintext,
                                  char **cipher_out);
 
 int nsigner_qrexec_nip04_decrypt(const char *target_qube,
                                  const char *service_name,
-                                 const char *role,
+                                 const nt_nsigner_selector_t *selector,
                                  const char *peer_pub_hex,
                                  const char *ciphertext,
                                  char **plain_out);
 
 int nsigner_qrexec_nip44_encrypt(const char *target_qube,
                                  const char *service_name,
-                                 const char *role,
+                                 const nt_nsigner_selector_t *selector,
                                  const char *peer_pub_hex,
                                  const char *plaintext,
                                  char **cipher_out);
 
 int nsigner_qrexec_nip44_decrypt(const char *target_qube,
                                  const char *service_name,
-                                 const char *role,
+                                 const nt_nsigner_selector_t *selector,
                                  const char *peer_pub_hex,
                                  const char *ciphertext,
                                  char **plain_out);

include/signer.h

@@ -2,8 +2,10 @@
 #define SIGNER_H
 
 #include "../resources/nostr_core_lib/cjson/cJSON.h"
+#include "nsigner_client.h"
 
 #include <time.h>
+#include <stdint.h>
 
 typedef enum {
     NT_SIGNER_LOCAL = 0,
@@ -18,16 +20,27 @@ typedef struct {
     char qrexec_target[128];
     char qrexec_service[128];
     char endpoint_url[256];
-    char role[64];
+    int url_session_fd;
+    nt_nsigner_selector_t selector;
+    nt_nsigner_auth_ctx_t url_auth;
 } nt_signer_t;
 
 extern nt_signer_t g_signer;
 
 void signer_init(void);
+void signer_shutdown(void);
 int signer_init_local(void);
-int signer_init_nsigner(const char *socket_name);
-int signer_init_nsigner_qrexec(const char *target_qube, const char *service_name);
-int signer_init_nsigner_url(const char *endpoint_url);
+void signer_set_selector(int has_index, int index, const char *role);
+int signer_init_nsigner(const char *socket_name, const nt_nsigner_selector_t *selector);
+int signer_init_nsigner_qrexec(const char *target_qube, const char *service_name, const nt_nsigner_selector_t *selector);
+int signer_init_nsigner_url(const char *endpoint_url, const nt_nsigner_selector_t *selector);
+int signer_init_nsigner_url_with_session(const char *endpoint_url,
+                                         const nt_nsigner_selector_t *selector,
+                                         int session_fd);
+int signer_init_nsigner_url_with_session_auth(const char *endpoint_url,
+                                              const nt_nsigner_selector_t *selector,
+                                              int session_fd,
+                                              const nt_nsigner_auth_ctx_t *auth_or_null);
 
 int signer_create_and_sign(int kind,
                            const char *content,

src/db.c

@@ -179,7 +179,10 @@ int db_open(void) {
         return -1;
     }
 
-    snprintf(db_path, sizeof(db_path), "%s/nostr.db", dir_path);
+    if (snprintf(db_path, sizeof(db_path), "%s/nostr.db", dir_path) >= (int)sizeof(db_path)) {
+        fprintf(stderr, "db_open: database path too long\n");
+        return -1;
+    }
     rc = sqlite3_open(db_path, &g_db);
     if (rc != SQLITE_OK) {
         fprintf(stderr, "db_open: sqlite open failed: %s\n", sqlite3_errmsg(g_db));

src/main.c

@@ -3,6 +3,7 @@
 #include "tui.h"
 
 #include "../resources/nostr_core_lib/nostr_core/nostr_common.h"
+#include "signer.h"
 
 /*
  * Canonical version is the latest git tag.
@@ -10,8 +11,8 @@
  */
 #define NT_VERSION_MAJOR 0
 #define NT_VERSION_MINOR 0
-#define NT_VERSION_PATCH 10
-#define NT_VERSION "v0.0.10"
+#define NT_VERSION_PATCH 12
+#define NT_VERSION "v0.0.12"
 
 #include <stdio.h>
 #include <stdlib.h>
@@ -208,6 +209,7 @@ int main(int argc, char *argv[]) {
     menu_main();
 
     nostr_cleanup();
+    signer_shutdown();
     state_cleanup();
     tui_cleanup();
     db_close();

src/menu_ai.c

@@ -500,7 +500,7 @@ static void ai_chat(const ai_prefs_t *prefs) {
     char auth[4096];
     char *resp_json;
     char *answer;
-    char hold[16];
+    char hold[512];
 
     if (!prefs) {
         return;
@@ -513,7 +513,7 @@ static void ai_chat(const ai_prefs_t *prefs) {
 
     if (!prefs->api_key || prefs->api_key[0] == '\0') {
         tui_print("AI API key is empty. Configure settings first.");
-        tui_get_line(">", hold, (int)sizeof(hold));
+        tui_get_line("Press Enter to continue >", hold, (int)sizeof(hold));
         return;
     }
 
@@ -548,7 +548,7 @@ static void ai_chat(const ai_prefs_t *prefs) {
 
     if (!resp_json) {
         tui_print("AI request failed.");
-        tui_get_line(">", hold, (int)sizeof(hold));
+        tui_get_line("Press Enter to continue >", hold, (int)sizeof(hold));
         return;
     }
 
@@ -563,7 +563,7 @@ static void ai_chat(const ai_prefs_t *prefs) {
         tui_print("Failed to parse AI response.");
     }
     free(answer);
-    tui_get_line(">", hold, (int)sizeof(hold));
+    tui_get_line("Press Enter to continue >", hold, (int)sizeof(hold));
 }
 
 static void ai_choose_model(ai_prefs_t *prefs) {
@@ -585,7 +585,7 @@ static void ai_settings(ai_prefs_t *prefs) {
     char endpoint[512];
     char key[1024];
     char model[256];
-    char hold[16];
+    char hold[512];
 
     if (!prefs) {
         return;
@@ -617,12 +617,12 @@ static void ai_settings(ai_prefs_t *prefs) {
         tui_print("Prefs saved.");
     }
 
-    tui_get_line(">", hold, (int)sizeof(hold));
+    tui_get_line("Press Enter to continue >", hold, (int)sizeof(hold));
 }
 
 void menu_ai(void) {
     ai_prefs_t prefs;
-    char input[16];
+    char input[512];
 
     ai_prefs_init(&prefs);
     (void)ai_load_prefs(&prefs);

src/menu_follows.c

@@ -127,7 +127,8 @@ void menu_follows(void) {
                     tui_get_line(">", input, (int)sizeof(input));
                     continue;
                 }
-                snprintf(follow_hex, sizeof(follow_hex), "%s", who);
+                strncpy(follow_hex, who, sizeof(follow_hex) - 1U);
+                follow_hex[sizeof(follow_hex) - 1U] = '\0';
             } else {
                 tui_print("Enter npub or 64-char hex pubkey.");
                 tui_get_line(">", input, (int)sizeof(input));

src/menu_live.c

@@ -60,7 +60,7 @@ static void live_preview_text(const char *text, int max_len, char *buf, size_t b
     buf[0] = '\0';
 
     if (!text || text[0] == '\0' || max_len <= 0) {
-        snprintf(buf, buf_size, "");
+        buf[0] = '\0';
         return;
     }
 

src/menu_login.c

@@ -17,6 +17,7 @@
 #include <stdlib.h>
 #include <string.h>
 #include <time.h>
+#include <sys/random.h>
 
 #define NT_DEV_SEED_PHRASE "cube dirt movie learn depth axis ball view aunt electric finish release"
 
@@ -174,6 +175,7 @@ void menu_login(void) {
 
         if (strcmp(input, "q") == 0 || strcmp(input, "x") == 0) {
             tui_print("\nHasta luego.\n");
+            signer_shutdown();
             exit(0);
         }
 
@@ -196,6 +198,9 @@ void menu_login(void) {
             int name_count = 0;
             char pubkey_hex[65] = {0};
             int selected = 0;
+            nt_nsigner_selector_t selector = nsigner_selector_default();
+            char idxbuf[32];
+            int nostr_index = 0;
 
             tui_print("Searching for running n_signer instances...");
 
@@ -210,20 +215,31 @@ void menu_login(void) {
                 selected = 0;
             } else {
                 int idx;
-                char idxbuf[16];
+                char pickbuf[16];
                 tui_print("Found %d n_signer instances:", name_count);
                 for (idx = 0; idx < name_count; idx++) {
                     tui_print("  [%d] @%s", idx, names[idx]);
                 }
-                tui_get_line("Select (0) >", idxbuf, (int)sizeof(idxbuf));
-                selected = (idxbuf[0] != '\0') ? atoi(idxbuf) : 0;
+                tui_get_line("Select (0) >", pickbuf, (int)sizeof(pickbuf));
+                selected = (pickbuf[0] != '\0') ? atoi(pickbuf) : 0;
                 if (selected < 0 || selected >= name_count) {
                     selected = 0;
                 }
             }
 
+            tui_get_line("Seed phrase index (0) >", idxbuf, (int)sizeof(idxbuf));
+            if (idxbuf[0] != '\0') {
+                nostr_index = atoi(idxbuf);
+                if (nostr_index < 0) {
+                    nostr_index = 0;
+                }
+            }
+            selector.has_nostr_index = 1;
+            selector.nostr_index = nostr_index;
+            selector.role[0] = '\0';
+
             tui_print("Waiting for n_signer approval...");
-            if (nsigner_get_public_key(names[selected], "main", pubkey_hex) != 0) {
+            if (nsigner_get_public_key(names[selected], &selector, pubkey_hex) != 0) {
                 int i;
                 tui_print("Failed to get public key from n_signer (denied or error).");
                 for (i = 0; i < name_count; i++) {
@@ -234,7 +250,7 @@ void menu_login(void) {
                 continue;
             }
 
-            signer_init_nsigner(names[selected]);
+            signer_init_nsigner(names[selected], &selector);
 
             snprintf(g_state.npub_hex, sizeof(g_state.npub_hex), "%s", pubkey_hex);
             {
@@ -273,6 +289,11 @@ void menu_login(void) {
             char pubkey_hex[65] = {0};
             char endpoint_url[256];
             const char *saved_endpoint = db_get_local("nsigner_url_endpoint");
+            nt_nsigner_selector_t selector = nsigner_selector_default();
+            char idxbuf[32];
+            int nostr_index = 0;
+            int session_fd = -1;
+            nt_nsigner_auth_ctx_t auth = {0};
 
             snprintf(endpoint_url, sizeof(endpoint_url), "%s", (saved_endpoint && saved_endpoint[0] != '\0') ? saved_endpoint : "");
             tui_get_line("Signer URL (http://<npub>.fips:8080) >", endpoint_url, (int)sizeof(endpoint_url));
@@ -286,16 +307,44 @@ void menu_login(void) {
                 }
             }
 
+            tui_get_line("Seed phrase index (0) >", idxbuf, (int)sizeof(idxbuf));
+            if (idxbuf[0] != '\0') {
+                nostr_index = atoi(idxbuf);
+                if (nostr_index < 0) {
+                    nostr_index = 0;
+                }
+            }
+            selector.has_nostr_index = 1;
+            selector.nostr_index = nostr_index;
+            selector.role[0] = '\0';
+
             tui_print("Connecting to n_signer URL: %s", endpoint_url);
             tui_print("Waiting for n_signer approval...");
 
-            if (nsigner_get_public_key_url(endpoint_url, "main", pubkey_hex) != 0) {
+            auth.enabled = 1;
+            if (getrandom(auth.privkey, sizeof(auth.privkey), 0) != (ssize_t)sizeof(auth.privkey)) {
+                tui_print("Failed to generate URL auth key.");
+                tui_get_line(">", input, (int)sizeof(input));
+                continue;
+            }
+            snprintf(auth.label, sizeof(auth.label), "%s", "nostr_terminal");
+
+            session_fd = nsigner_session_open_url(endpoint_url);
+            if (session_fd < 0) {
+                tui_print("Failed to open persistent connection to n_signer URL.");
+                tui_get_line(">", input, (int)sizeof(input));
+                continue;
+            }
+
+            if (nsigner_session_get_public_key(&session_fd, endpoint_url, &selector, &auth, pubkey_hex) != 0) {
+                nsigner_session_close(session_fd);
                 tui_print("Failed to get public key from n_signer URL (denied or error).");
                 tui_get_line(">", input, (int)sizeof(input));
                 continue;
             }
 
-            if (signer_init_nsigner_url(endpoint_url) != 0) {
+            if (signer_init_nsigner_url_with_session_auth(endpoint_url, &selector, session_fd, &auth) != 0) {
+                nsigner_session_close(session_fd);
                 tui_print("Failed to initialize URL signer mode.");
                 tui_get_line(">", input, (int)sizeof(input));
                 continue;
@@ -333,6 +382,9 @@ void menu_login(void) {
             char target_qube[128];
             char service_name[128];
             const char *saved_target = db_get_local("nsigner_qrexec_target");
+            nt_nsigner_selector_t selector = nsigner_selector_default();
+            char idxbuf[32];
+            int nostr_index = 0;
 
             snprintf(target_qube, sizeof(target_qube), "%s", (saved_target && saved_target[0] != '\0') ? saved_target : "nsigner-vault");
             snprintf(service_name, sizeof(service_name), "%s", "qubes.NsignerRpc");
@@ -347,16 +399,27 @@ void menu_login(void) {
                 snprintf(service_name, sizeof(service_name), "%s", "qubes.NsignerRpc");
             }
 
+            tui_get_line("Seed phrase index (0) >", idxbuf, (int)sizeof(idxbuf));
+            if (idxbuf[0] != '\0') {
+                nostr_index = atoi(idxbuf);
+                if (nostr_index < 0) {
+                    nostr_index = 0;
+                }
+            }
+            selector.has_nostr_index = 1;
+            selector.nostr_index = nostr_index;
+            selector.role[0] = '\0';
+
             tui_print("Calling qrexec service %s in %s...", service_name, target_qube);
             tui_print("Waiting for n_signer approval...");
 
-            if (nsigner_qrexec_get_public_key(target_qube, service_name, "main", pubkey_hex) != 0) {
+            if (nsigner_qrexec_get_public_key(target_qube, service_name, &selector, pubkey_hex) != 0) {
                 tui_print("Failed to get public key via qrexec (denied or error).");
                 tui_get_line(">", input, (int)sizeof(input));
                 continue;
             }
 
-            if (signer_init_nsigner_qrexec(target_qube, service_name) != 0) {
+            if (signer_init_nsigner_qrexec(target_qube, service_name, &selector) != 0) {
                 tui_print("Failed to initialize qrexec signer mode.");
                 tui_get_line(">", input, (int)sizeof(input));
                 continue;

src/menu_profile.c

@@ -29,13 +29,28 @@ void menu_profile(void) {
 
         if (g_signer.kind == NT_SIGNER_NSIGNER) {
             tui_print("Signer:            n_signer (@%s)", g_signer.socket_name);
+            if (g_signer.selector.has_nostr_index) {
+                tui_print("Signer selector:   nostr_index=%d", g_signer.selector.nostr_index);
+            } else {
+                tui_print("Signer selector:   role=%s", g_signer.selector.role[0] ? g_signer.selector.role : "main");
+            }
         } else if (g_signer.kind == NT_SIGNER_NSIGNER_QREXEC) {
             tui_print("Signer:            n_signer qrexec");
             tui_print("Signer target:     %s", g_signer.qrexec_target);
             tui_print("Signer service:    %s", g_signer.qrexec_service);
+            if (g_signer.selector.has_nostr_index) {
+                tui_print("Signer selector:   nostr_index=%d", g_signer.selector.nostr_index);
+            } else {
+                tui_print("Signer selector:   role=%s", g_signer.selector.role[0] ? g_signer.selector.role : "main");
+            }
         } else if (g_signer.kind == NT_SIGNER_NSIGNER_URL) {
             tui_print("Signer:            n_signer URL");
             tui_print("Signer endpoint:   %s", g_signer.endpoint_url);
+            if (g_signer.selector.has_nostr_index) {
+                tui_print("Signer selector:   nostr_index=%d", g_signer.selector.nostr_index);
+            } else {
+                tui_print("Signer selector:   role=%s", g_signer.selector.role[0] ? g_signer.selector.role : "main");
+            }
         } else {
             tui_print("nsecHex:           %s", g_state.nsec_hex);
             tui_print("nsec:              %s", g_state.nsec_bech32);

src/net.c

@@ -8,6 +8,7 @@
 #include "../resources/nostr_core_lib/nostr_core/nip042.h"
 #include "../resources/nostr_core_lib/nostr_core/utils.h"
 #include "../resources/nostr_core_lib/nostr_websocket/nostr_websocket_tls.h"
+#include "../resources/nostr_core_lib/nostr_core/nostr_core.h"
 
 #include <curl/curl.h>
 #include <errno.h>
@@ -19,7 +20,7 @@
 #include <unistd.h>
 
 #define NT_SUB_ID "sub1"
-#define NT_WS_BUFFER_SIZE 65536
+#define NT_WS_BUFFER_SIZE 262144
 
 static long long nt_now_ms(void) {
     struct timeval tv;
@@ -529,7 +530,7 @@ void nt_publish_results_free(nt_publish_result_t *results, int result_count) {
 }
 
 /* Query one relay and append deduplicated EVENT payloads until EOSE/timeout. */
-static int nt_query_one_relay(const char *relay_url,
+static __attribute__((unused)) int nt_query_one_relay(const char *relay_url,
                               cJSON *filter,
                               int timeout_ms,
                               int verbose,
@@ -685,13 +686,12 @@ int nt_query_sync_verbose(const char *filter_json,
                           char ***events_out,
                           int *event_count) {
     cJSON *filter = NULL;
+    nostr_relay_pool_t *pool = NULL;
+    cJSON **pool_events = NULL;
+    int pool_event_count = 0;
     char **events = NULL;
-    char **seen_ids = NULL;
     int events_n = 0;
     int events_cap = 0;
-    int seen_n = 0;
-    int seen_cap = 0;
-    int success_relays = 0;
     int i;
 
     if (!events_out || !event_count || !filter_json || !relay_urls || relay_count <= 0) {
@@ -708,59 +708,62 @@ int nt_query_sync_verbose(const char *filter_json,
         return -1;
     }
 
-    for (i = 0; i < relay_count; i++) {
-        const char *relay = relay_urls[i];
-        int rc;
-        const char *reason = "unknown";
-
-        if (!relay || relay[0] == '\0') {
-            continue;
-        }
-
-        if (verbose && phase_label) {
-            fprintf(stderr, "%s: attempting relay %d/%d %s\n", phase_label, i + 1, relay_count, relay);
-        }
-
-        rc = nt_query_one_relay(relay,
-                                filter,
-                                timeout_ms,
-                                verbose,
-                                phase_label,
-                                &events,
-                                &events_n,
-                                &events_cap,
-                                &seen_ids,
-                                &seen_n,
-                                &seen_cap,
-                                &reason);
-        if (rc < 0) {
-            if (verbose && phase_label) {
-                fprintf(stderr, "%s: failed %s (%s)\n", phase_label, relay, reason ? reason : "error");
-            }
-            nt_free_string_array(events, events_n);
-            nt_free_string_array(seen_ids, seen_n);
-            cJSON_Delete(filter);
-            return -1;
-        }
-
-        if (rc > 0) {
-            success_relays++;
-            if (verbose && phase_label) {
-                fprintf(stderr, "%s: connected %s (%s)\n", phase_label, relay, reason ? reason : "ok");
-            }
-        } else if (verbose && phase_label) {
-            fprintf(stderr, "%s: failed %s (%s)\n", phase_label, relay, reason ? reason : "failed");
-        }
-    }
-
-    nt_free_string_array(seen_ids, seen_n);
-    cJSON_Delete(filter);
-
-    if (success_relays == 0) {
-        nt_free_string_array(events, events_n);
+    pool = nostr_relay_pool_create(NULL);
+    if (!pool) {
+        cJSON_Delete(filter);
+        fprintf(stderr, "query: failed to create relay pool\n");
         return -1;
     }
 
+    if (verbose && phase_label) {
+        fprintf(stderr,
+                "%s: querying %d relays via nostr_core relay pool\n",
+                phase_label,
+                relay_count);
+    }
+
+    pool_events = nostr_relay_pool_query_sync(pool,
+                                              relay_urls,
+                                              relay_count,
+                                              filter,
+                                              &pool_event_count,
+                                              timeout_ms);
+
+    cJSON_Delete(filter);
+    filter = NULL;
+
+    if (!pool_events || pool_event_count <= 0) {
+        nostr_relay_pool_destroy(pool);
+        return -1;
+    }
+
+    for (i = 0; i < pool_event_count; i++) {
+        char *event_str = cJSON_PrintUnformatted(pool_events[i]);
+        if (!event_str || nt_push_string(&events, &events_n, &events_cap, event_str) != 0) {
+            free(event_str);
+            nt_free_string_array(events, events_n);
+            for (i = 0; i < pool_event_count; i++) {
+                cJSON_Delete(pool_events[i]);
+            }
+            free(pool_events);
+            nostr_relay_pool_destroy(pool);
+            return -1;
+        }
+    }
+
+    for (i = 0; i < pool_event_count; i++) {
+        cJSON_Delete(pool_events[i]);
+    }
+    free(pool_events);
+
+    if (verbose && phase_label) {
+        fprintf(stderr,
+                "%s: relay pool collected %d unique events\n",
+                phase_label,
+                events_n);
+    }
+
+    nostr_relay_pool_destroy(pool);
     *events_out = events;
     *event_count = events_n;
     return 0;

src/nsigner_auth.c

@@ -0,0 +1,109 @@
+#include "nsigner_auth.h"
+
+#include "../resources/nostr_core_lib/nostr_core/nip001.h"
+#include "../resources/nostr_core_lib/nostr_core/utils.h"
+
+#include <stdlib.h>
+#include <string.h>
+#include <time.h>
+
+#define NT_NSIGNER_AUTH_EVENT_KIND 27235
+
+static cJSON *nt_nsigner_auth_build_tag_pair(const char *name, const char *value) {
+    cJSON *pair;
+
+    if (!name || !value) {
+        return NULL;
+    }
+
+    pair = cJSON_CreateArray();
+    if (!pair) {
+        return NULL;
+    }
+
+    cJSON_AddItemToArray(pair, cJSON_CreateString(name));
+    cJSON_AddItemToArray(pair, cJSON_CreateString(value));
+    return pair;
+}
+
+static int nt_nsigner_auth_compute_params_hash_hex(const cJSON *params, char out_hex_65[65]) {
+    char *params_json = NULL;
+    unsigned char hash[32];
+    int rc = -1;
+
+    if (!out_hex_65) {
+        return -1;
+    }
+
+    if (params) {
+        params_json = cJSON_PrintUnformatted((cJSON *)params);
+    } else {
+        params_json = strdup("null");
+    }
+
+    if (!params_json) {
+        return -1;
+    }
+
+    if (nostr_sha256((const unsigned char *)params_json, strlen(params_json), hash) != 0) {
+        goto cleanup;
+    }
+
+    nostr_bytes_to_hex(hash, sizeof(hash), out_hex_65);
+    out_hex_65[64] = '\0';
+    rc = 0;
+
+cleanup:
+    free(params_json);
+    return rc;
+}
+
+int nt_nsigner_auth_build(const char *request_id,
+                          const char *method,
+                          const cJSON *params,
+                          const nt_nsigner_auth_ctx_t *auth_ctx,
+                          time_t created_at,
+                          cJSON **out_auth) {
+    char body_hash_hex[65];
+    cJSON *tags = NULL;
+    cJSON *auth_event = NULL;
+
+    if (!request_id || request_id[0] == '\0' ||
+        !method || method[0] == '\0' ||
+        !auth_ctx || !auth_ctx->enabled ||
+        !out_auth) {
+        return -1;
+    }
+
+    *out_auth = NULL;
+
+    if (nt_nsigner_auth_compute_params_hash_hex(params, body_hash_hex) != 0) {
+        return -1;
+    }
+
+    tags = cJSON_CreateArray();
+    if (!tags) {
+        return -1;
+    }
+
+    cJSON_AddItemToArray(tags, nt_nsigner_auth_build_tag_pair("nsigner_rpc", request_id));
+    cJSON_AddItemToArray(tags, nt_nsigner_auth_build_tag_pair("nsigner_method", method));
+    cJSON_AddItemToArray(tags, nt_nsigner_auth_build_tag_pair("nsigner_body_hash", body_hash_hex));
+
+    if (created_at <= 0) {
+        created_at = time(NULL);
+    }
+
+    auth_event = nostr_create_and_sign_event(NT_NSIGNER_AUTH_EVENT_KIND,
+                                             auth_ctx->label,
+                                             tags,
+                                             auth_ctx->privkey,
+                                             created_at);
+    if (!auth_event) {
+        cJSON_Delete(tags);
+        return -1;
+    }
+
+    *out_auth = auth_event;
+    return 0;
+}

src/nsigner_client.c

@@ -12,6 +12,7 @@
 #include <sys/wait.h>
 #include <unistd.h>
 #include <netdb.h>
+#include <netinet/tcp.h>
 
 static int write_all(int fd, const void *buf, size_t len) {
     const unsigned char *p = (const unsigned char *)buf;
@@ -71,6 +72,7 @@ static int set_recv_timeout_ms(int fd, int timeout_ms) {
 static int nsigner_error_code_from_response(const cJSON *response) {
     const cJSON *error_item;
     const char *name = NULL;
+    int code = 0;
 
     error_item = cJSON_GetObjectItemCaseSensitive((cJSON *)response, "error");
     if (!error_item || cJSON_IsNull(error_item)) {
@@ -81,18 +83,28 @@ static int nsigner_error_code_from_response(const cJSON *response) {
         name = error_item->valuestring;
     } else if (cJSON_IsObject(error_item)) {
         const cJSON *message_item = cJSON_GetObjectItemCaseSensitive((cJSON *)error_item, "message");
+        const cJSON *code_item = cJSON_GetObjectItemCaseSensitive((cJSON *)error_item, "code");
         if (cJSON_IsString(message_item) && message_item->valuestring) {
             name = message_item->valuestring;
         }
+        if (cJSON_IsNumber(code_item)) {
+            code = code_item->valueint;
+        }
     }
 
-    if (name && strcmp(name, "approval_denied") == 0) {
+    if ((name && strcmp(name, "approval_denied") == 0) ||
+        (name && strcmp(name, "policy_denied") == 0)) {
         return NT_NSIGNER_E_DENIED;
     }
     if (name && strcmp(name, "unauthorized") == 0) {
         return NT_NSIGNER_E_UNAUTH;
     }
 
+    if ((name && strncmp(name, "auth_envelope_", 14) == 0) ||
+        (code >= 2010 && code <= 2017)) {
+        return NT_NSIGNER_E_AUTH;
+    }
+
     return NT_NSIGNER_E_ERROR;
 }
 
@@ -349,6 +361,7 @@ static int nsigner_connect_url(const char *url) {
 
     for (ai = res; ai; ai = ai->ai_next) {
         struct timeval tv;
+        int one = 1;
 
         fd = socket(ai->ai_family, ai->ai_socktype, ai->ai_protocol);
         if (fd < 0) {
@@ -358,6 +371,10 @@ static int nsigner_connect_url(const char *url) {
         tv.tv_sec = 5;
         tv.tv_usec = 0;
         (void)setsockopt(fd, SOL_SOCKET, SO_SNDTIMEO, &tv, sizeof(tv));
+        (void)setsockopt(fd, SOL_SOCKET, SO_KEEPALIVE, &one, sizeof(one));
+#ifdef TCP_NODELAY
+        (void)setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, &one, sizeof(one));
+#endif
 
         if (connect(fd, ai->ai_addr, ai->ai_addrlen) == 0) {
             break;
@@ -448,8 +465,41 @@ int nsigner_rpc(int fd, const cJSON *request, cJSON **response_out, int read_tim
     return NT_NSIGNER_OK;
 }
 
+static cJSON *nsigner_selector_to_json(const nt_nsigner_selector_t *selector) {
+    nt_nsigner_selector_t fallback;
+    const nt_nsigner_selector_t *sel = selector;
+    cJSON *selector_obj;
+
+    if (!sel) {
+        fallback = nsigner_selector_default();
+        sel = &fallback;
+    }
+
+    selector_obj = cJSON_CreateObject();
+    if (!selector_obj) {
+        return NULL;
+    }
+
+    if (sel->has_nostr_index) {
+        if (!cJSON_AddNumberToObject(selector_obj, "nostr_index", sel->nostr_index)) {
+            cJSON_Delete(selector_obj);
+            return NULL;
+        }
+        return selector_obj;
+    }
+
+    if (!cJSON_AddStringToObject(selector_obj,
+                                 "role",
+                                 (sel->role[0] != '\0') ? sel->role : "main")) {
+        cJSON_Delete(selector_obj);
+        return NULL;
+    }
+
+    return selector_obj;
+}
+
 static int nsigner_call_string_method(const char *socket_name,
-                                      const char *role,
+                                      const nt_nsigner_selector_t *selector,
                                       const char *method,
                                       const char **args,
                                       int arg_count,
@@ -457,7 +507,7 @@ static int nsigner_call_string_method(const char *socket_name,
     int fd = -1;
     cJSON *request = NULL;
     cJSON *params = NULL;
-    cJSON *role_obj = NULL;
+    cJSON *selector_obj = NULL;
     cJSON *response = NULL;
     cJSON *result_item;
     int rc;
@@ -494,15 +544,14 @@ static int nsigner_call_string_method(const char *socket_name,
         cJSON_AddItemToArray(params, cJSON_CreateString(args[i]));
     }
 
-    role_obj = cJSON_CreateObject();
-    if (!role_obj) {
+    selector_obj = nsigner_selector_to_json(selector);
+    if (!selector_obj) {
         cJSON_Delete(request);
         cJSON_Delete(params);
         close(fd);
         return NT_NSIGNER_E_IO;
     }
-    cJSON_AddStringToObject(role_obj, "role", (role && *role) ? role : "main");
-    cJSON_AddItemToArray(params, role_obj);
+    cJSON_AddItemToArray(params, selector_obj);
 
     cJSON_AddItemToObject(request, "params", params);
 
@@ -525,36 +574,69 @@ static int nsigner_call_string_method(const char *socket_name,
     return *result_out ? NT_NSIGNER_OK : NT_NSIGNER_E_IO;
 }
 
-static int nsigner_call_string_method_url(const char *url,
-                                          const char *role,
-                                          const char *method,
-                                          const char **args,
-                                          int arg_count,
-                                          char **result_out) {
-    int fd = -1;
+static int nsigner_rpc_with_retry(int *fd_inout,
+                                  const char *url,
+                                  const cJSON *request,
+                                  cJSON **response_out,
+                                  int read_timeout_ms) {
+    int attempts = 0;
+
+    if (!fd_inout || !url || !request || !response_out) {
+        return NT_NSIGNER_E_IO;
+    }
+    *response_out = NULL;
+
+    while (attempts < 2) {
+        int rc;
+
+        if (*fd_inout < 0) {
+            *fd_inout = nsigner_connect_url(url);
+            if (*fd_inout < 0) {
+                attempts++;
+                continue;
+            }
+        }
+
+        rc = nsigner_rpc(*fd_inout, request, response_out, read_timeout_ms);
+        if (rc == NT_NSIGNER_E_IO) {
+            close(*fd_inout);
+            *fd_inout = -1;
+            attempts++;
+            continue;
+        }
+
+        return rc;
+    }
+
+    return NT_NSIGNER_E_IO;
+}
+
+static int nsigner_call_string_method_url_session(int *fd_inout,
+                                                  const char *url,
+                                                  const nt_nsigner_selector_t *selector,
+                                                  const nt_nsigner_auth_ctx_t *auth,
+                                                  const char *method,
+                                                  const char **args,
+                                                  int arg_count,
+                                                  char **result_out) {
     cJSON *request = NULL;
     cJSON *params = NULL;
+    cJSON *selector_obj = NULL;
     cJSON *response = NULL;
     cJSON *result_item;
+    cJSON *auth_json = NULL;
     int rc;
 
-    if (!url || !method || !result_out || arg_count < 0) {
+    if (!fd_inout || !url || !method || !result_out || arg_count < 0) {
         return NT_NSIGNER_E_IO;
     }
-    (void)role;
     *result_out = NULL;
 
-    fd = nsigner_connect_url(url);
-    if (fd < 0) {
-        return NT_NSIGNER_E_IO;
-    }
-
     request = cJSON_CreateObject();
     params = cJSON_CreateArray();
     if (!request || !params) {
         cJSON_Delete(request);
         cJSON_Delete(params);
-        close(fd);
         return NT_NSIGNER_E_IO;
     }
 
@@ -565,17 +647,34 @@ static int nsigner_call_string_method_url(const char *url,
         if (!args || !args[i]) {
             cJSON_Delete(request);
             cJSON_Delete(params);
-            close(fd);
             return NT_NSIGNER_E_IO;
         }
         cJSON_AddItemToArray(params, cJSON_CreateString(args[i]));
     }
 
+    selector_obj = nsigner_selector_to_json(selector);
+    if (!selector_obj) {
+        cJSON_Delete(request);
+        cJSON_Delete(params);
+        return NT_NSIGNER_E_IO;
+    }
+    cJSON_AddItemToArray(params, selector_obj);
+
     cJSON_AddItemToObject(request, "params", params);
 
-    rc = nsigner_rpc(fd, request, &response, 60000);
+    if (auth && auth->enabled) {
+        if (nt_nsigner_auth_build("1", method, params, auth, 0, &auth_json) != 0 ||
+            !auth_json ||
+            !cJSON_AddItemToObject(request, "auth", auth_json)) {
+            cJSON_Delete(auth_json);
+            cJSON_Delete(request);
+            return NT_NSIGNER_E_IO;
+        }
+        auth_json = NULL;
+    }
+
+    rc = nsigner_rpc_with_retry(fd_inout, url, request, &response, 60000);
     cJSON_Delete(request);
-    close(fd);
     if (rc != NT_NSIGNER_OK) {
         return rc;
     }
@@ -592,6 +691,23 @@ static int nsigner_call_string_method_url(const char *url,
     return *result_out ? NT_NSIGNER_OK : NT_NSIGNER_E_IO;
 }
 
+static int nsigner_call_string_method_url(const char *url,
+                                          const nt_nsigner_selector_t *selector,
+                                          const nt_nsigner_auth_ctx_t *auth,
+                                          const char *method,
+                                          const char **args,
+                                          int arg_count,
+                                          char **result_out) {
+    int fd = -1;
+    int rc;
+
+    rc = nsigner_call_string_method_url_session(&fd, url, selector, auth, method, args, arg_count, result_out);
+    if (fd >= 0) {
+        close(fd);
+    }
+    return rc;
+}
+
 static int nsigner_qrexec_rpc(const char *target_qube,
                               const char *service_name,
                               const cJSON *request,
@@ -727,14 +843,14 @@ static int nsigner_qrexec_rpc(const char *target_qube,
 
 static int nsigner_qrexec_call_string_method(const char *target_qube,
                                              const char *service_name,
-                                             const char *role,
+                                             const nt_nsigner_selector_t *selector,
                                              const char *method,
                                              const char **args,
                                              int arg_count,
                                              char **result_out) {
     cJSON *request = NULL;
     cJSON *params = NULL;
-    cJSON *role_obj = NULL;
+    cJSON *selector_obj = NULL;
     cJSON *response = NULL;
     cJSON *result_item;
     int rc;
@@ -764,14 +880,13 @@ static int nsigner_qrexec_call_string_method(const char *target_qube,
         cJSON_AddItemToArray(params, cJSON_CreateString(args[i]));
     }
 
-    role_obj = cJSON_CreateObject();
-    if (!role_obj) {
+    selector_obj = nsigner_selector_to_json(selector);
+    if (!selector_obj) {
         cJSON_Delete(request);
         cJSON_Delete(params);
         return NT_NSIGNER_E_IO;
     }
-    cJSON_AddStringToObject(role_obj, "role", (role && *role) ? role : "main");
-    cJSON_AddItemToArray(params, role_obj);
+    cJSON_AddItemToArray(params, selector_obj);
 
     cJSON_AddItemToObject(request, "params", params);
 
@@ -793,7 +908,7 @@ static int nsigner_qrexec_call_string_method(const char *target_qube,
     return *result_out ? NT_NSIGNER_OK : NT_NSIGNER_E_IO;
 }
 
-int nsigner_get_public_key(const char *socket_name, const char *role, char *out_hex_65) {
+int nsigner_get_public_key(const char *socket_name, const nt_nsigner_selector_t *selector, char *out_hex_65) {
     char *result = NULL;
     int rc;
     size_t len;
@@ -802,7 +917,7 @@ int nsigner_get_public_key(const char *socket_name, const char *role, char *out_
         return NT_NSIGNER_E_IO;
     }
 
-    rc = nsigner_call_string_method(socket_name, role, "get_public_key", NULL, 0, &result);
+    rc = nsigner_call_string_method(socket_name, selector, "get_public_key", NULL, 0, &result);
     if (rc != NT_NSIGNER_OK) {
         return rc;
     }
@@ -818,7 +933,7 @@ int nsigner_get_public_key(const char *socket_name, const char *role, char *out_
     return NT_NSIGNER_OK;
 }
 
-int nsigner_sign_event(const char *socket_name, const char *role,
+int nsigner_sign_event(const char *socket_name, const nt_nsigner_selector_t *selector,
                        const char *unsigned_event_json, char **signed_event_json_out) {
     const char *args[1];
 
@@ -827,10 +942,10 @@ int nsigner_sign_event(const char *socket_name, const char *role,
     }
 
     args[0] = unsigned_event_json;
-    return nsigner_call_string_method(socket_name, role, "sign_event", args, 1, signed_event_json_out);
+    return nsigner_call_string_method(socket_name, selector, "sign_event", args, 1, signed_event_json_out);
 }
 
-int nsigner_nip04_encrypt(const char *socket_name, const char *role,
+int nsigner_nip04_encrypt(const char *socket_name, const nt_nsigner_selector_t *selector,
                           const char *peer_pub_hex, const char *plaintext, char **cipher_out) {
     const char *args[2];
 
@@ -840,10 +955,10 @@ int nsigner_nip04_encrypt(const char *socket_name, const char *role,
 
     args[0] = peer_pub_hex;
     args[1] = plaintext;
-    return nsigner_call_string_method(socket_name, role, "nip04_encrypt", args, 2, cipher_out);
+    return nsigner_call_string_method(socket_name, selector, "nip04_encrypt", args, 2, cipher_out);
 }
 
-int nsigner_nip04_decrypt(const char *socket_name, const char *role,
+int nsigner_nip04_decrypt(const char *socket_name, const nt_nsigner_selector_t *selector,
                           const char *peer_pub_hex, const char *ciphertext, char **plain_out) {
     const char *args[2];
 
@@ -853,10 +968,10 @@ int nsigner_nip04_decrypt(const char *socket_name, const char *role,
 
     args[0] = peer_pub_hex;
     args[1] = ciphertext;
-    return nsigner_call_string_method(socket_name, role, "nip04_decrypt", args, 2, plain_out);
+    return nsigner_call_string_method(socket_name, selector, "nip04_decrypt", args, 2, plain_out);
 }
 
-int nsigner_nip44_encrypt(const char *socket_name, const char *role,
+int nsigner_nip44_encrypt(const char *socket_name, const nt_nsigner_selector_t *selector,
                           const char *peer_pub_hex, const char *plaintext, char **cipher_out) {
     const char *args[2];
 
@@ -866,10 +981,10 @@ int nsigner_nip44_encrypt(const char *socket_name, const char *role,
 
     args[0] = peer_pub_hex;
     args[1] = plaintext;
-    return nsigner_call_string_method(socket_name, role, "nip44_encrypt", args, 2, cipher_out);
+    return nsigner_call_string_method(socket_name, selector, "nip44_encrypt", args, 2, cipher_out);
 }
 
-int nsigner_nip44_decrypt(const char *socket_name, const char *role,
+int nsigner_nip44_decrypt(const char *socket_name, const nt_nsigner_selector_t *selector,
                           const char *peer_pub_hex, const char *ciphertext, char **plain_out) {
     const char *args[2];
 
@@ -879,19 +994,33 @@ int nsigner_nip44_decrypt(const char *socket_name, const char *role,
 
     args[0] = peer_pub_hex;
     args[1] = ciphertext;
-    return nsigner_call_string_method(socket_name, role, "nip44_decrypt", args, 2, plain_out);
+    return nsigner_call_string_method(socket_name, selector, "nip44_decrypt", args, 2, plain_out);
 }
 
-int nsigner_get_public_key_url(const char *url, const char *role, char *out_hex_65) {
+int nsigner_session_open_url(const char *url) {
+    return nsigner_connect_url(url);
+}
+
+void nsigner_session_close(int fd) {
+    if (fd >= 0) {
+        close(fd);
+    }
+}
+
+int nsigner_session_get_public_key(int *fd_inout,
+                                   const char *url,
+                                   const nt_nsigner_selector_t *selector,
+                                   const nt_nsigner_auth_ctx_t *auth,
+                                   char *out_hex_65) {
     char *result = NULL;
     int rc;
     size_t len;
 
-    if (!out_hex_65) {
+    if (!fd_inout || !out_hex_65) {
         return NT_NSIGNER_E_IO;
     }
 
-    rc = nsigner_call_string_method_url(url, role, "get_public_key", NULL, 0, &result);
+    rc = nsigner_call_string_method_url_session(fd_inout, url, selector, auth, "get_public_key", NULL, 0, &result);
     if (rc != NT_NSIGNER_OK) {
         return rc;
     }
@@ -907,7 +1036,122 @@ int nsigner_get_public_key_url(const char *url, const char *role, char *out_hex_
     return NT_NSIGNER_OK;
 }
 
-int nsigner_sign_event_url(const char *url, const char *role,
+int nsigner_session_sign_event(int *fd_inout,
+                               const char *url,
+                               const nt_nsigner_selector_t *selector,
+                               const nt_nsigner_auth_ctx_t *auth,
+                               const char *unsigned_event_json,
+                               char **signed_event_json_out) {
+    const char *args[1];
+
+    if (!fd_inout || !url || !unsigned_event_json || !signed_event_json_out) {
+        return NT_NSIGNER_E_IO;
+    }
+
+    args[0] = unsigned_event_json;
+    return nsigner_call_string_method_url_session(fd_inout, url, selector, auth, "sign_event", args, 1, signed_event_json_out);
+}
+
+int nsigner_session_nip04_encrypt(int *fd_inout,
+                                  const char *url,
+                                  const nt_nsigner_selector_t *selector,
+                                  const nt_nsigner_auth_ctx_t *auth,
+                                  const char *peer_pub_hex,
+                                  const char *plaintext,
+                                  char **cipher_out) {
+    const char *args[2];
+
+    if (!fd_inout || !url || !peer_pub_hex || !plaintext || !cipher_out) {
+        return NT_NSIGNER_E_IO;
+    }
+
+    args[0] = peer_pub_hex;
+    args[1] = plaintext;
+    return nsigner_call_string_method_url_session(fd_inout, url, selector, auth, "nip04_encrypt", args, 2, cipher_out);
+}
+
+int nsigner_session_nip04_decrypt(int *fd_inout,
+                                  const char *url,
+                                  const nt_nsigner_selector_t *selector,
+                                  const nt_nsigner_auth_ctx_t *auth,
+                                  const char *peer_pub_hex,
+                                  const char *ciphertext,
+                                  char **plain_out) {
+    const char *args[2];
+
+    if (!fd_inout || !url || !peer_pub_hex || !ciphertext || !plain_out) {
+        return NT_NSIGNER_E_IO;
+    }
+
+    args[0] = peer_pub_hex;
+    args[1] = ciphertext;
+    return nsigner_call_string_method_url_session(fd_inout, url, selector, auth, "nip04_decrypt", args, 2, plain_out);
+}
+
+int nsigner_session_nip44_encrypt(int *fd_inout,
+                                  const char *url,
+                                  const nt_nsigner_selector_t *selector,
+                                  const nt_nsigner_auth_ctx_t *auth,
+                                  const char *peer_pub_hex,
+                                  const char *plaintext,
+                                  char **cipher_out) {
+    const char *args[2];
+
+    if (!fd_inout || !url || !peer_pub_hex || !plaintext || !cipher_out) {
+        return NT_NSIGNER_E_IO;
+    }
+
+    args[0] = peer_pub_hex;
+    args[1] = plaintext;
+    return nsigner_call_string_method_url_session(fd_inout, url, selector, auth, "nip44_encrypt", args, 2, cipher_out);
+}
+
+int nsigner_session_nip44_decrypt(int *fd_inout,
+                                  const char *url,
+                                  const nt_nsigner_selector_t *selector,
+                                  const nt_nsigner_auth_ctx_t *auth,
+                                  const char *peer_pub_hex,
+                                  const char *ciphertext,
+                                  char **plain_out) {
+    const char *args[2];
+
+    if (!fd_inout || !url || !peer_pub_hex || !ciphertext || !plain_out) {
+        return NT_NSIGNER_E_IO;
+    }
+
+    args[0] = peer_pub_hex;
+    args[1] = ciphertext;
+    return nsigner_call_string_method_url_session(fd_inout, url, selector, auth, "nip44_decrypt", args, 2, plain_out);
+}
+
+int nsigner_get_public_key_url(const char *url, const nt_nsigner_selector_t *selector,
+                               const nt_nsigner_auth_ctx_t *auth, char *out_hex_65) {
+    char *result = NULL;
+    int rc;
+    size_t len;
+
+    if (!out_hex_65) {
+        return NT_NSIGNER_E_IO;
+    }
+
+    rc = nsigner_call_string_method_url(url, selector, auth, "get_public_key", NULL, 0, &result);
+    if (rc != NT_NSIGNER_OK) {
+        return rc;
+    }
+
+    len = strlen(result);
+    if (len != 64) {
+        free(result);
+        return NT_NSIGNER_E_PARSE;
+    }
+
+    memcpy(out_hex_65, result, len + 1);
+    free(result);
+    return NT_NSIGNER_OK;
+}
+
+int nsigner_sign_event_url(const char *url, const nt_nsigner_selector_t *selector,
+                           const nt_nsigner_auth_ctx_t *auth,
                            const char *unsigned_event_json, char **signed_event_json_out) {
     const char *args[1];
 
@@ -916,10 +1160,11 @@ int nsigner_sign_event_url(const char *url, const char *role,
     }
 
     args[0] = unsigned_event_json;
-    return nsigner_call_string_method_url(url, role, "sign_event", args, 1, signed_event_json_out);
+    return nsigner_call_string_method_url(url, selector, auth, "sign_event", args, 1, signed_event_json_out);
 }
 
-int nsigner_nip04_encrypt_url(const char *url, const char *role,
+int nsigner_nip04_encrypt_url(const char *url, const nt_nsigner_selector_t *selector,
+                              const nt_nsigner_auth_ctx_t *auth,
                               const char *peer_pub_hex, const char *plaintext, char **cipher_out) {
     const char *args[2];
 
@@ -929,10 +1174,11 @@ int nsigner_nip04_encrypt_url(const char *url, const char *role,
 
     args[0] = peer_pub_hex;
     args[1] = plaintext;
-    return nsigner_call_string_method_url(url, role, "nip04_encrypt", args, 2, cipher_out);
+    return nsigner_call_string_method_url(url, selector, auth, "nip04_encrypt", args, 2, cipher_out);
 }
 
-int nsigner_nip04_decrypt_url(const char *url, const char *role,
+int nsigner_nip04_decrypt_url(const char *url, const nt_nsigner_selector_t *selector,
+                              const nt_nsigner_auth_ctx_t *auth,
                               const char *peer_pub_hex, const char *ciphertext, char **plain_out) {
     const char *args[2];
 
@@ -942,10 +1188,11 @@ int nsigner_nip04_decrypt_url(const char *url, const char *role,
 
     args[0] = peer_pub_hex;
     args[1] = ciphertext;
-    return nsigner_call_string_method_url(url, role, "nip04_decrypt", args, 2, plain_out);
+    return nsigner_call_string_method_url(url, selector, auth, "nip04_decrypt", args, 2, plain_out);
 }
 
-int nsigner_nip44_encrypt_url(const char *url, const char *role,
+int nsigner_nip44_encrypt_url(const char *url, const nt_nsigner_selector_t *selector,
+                              const nt_nsigner_auth_ctx_t *auth,
                               const char *peer_pub_hex, const char *plaintext, char **cipher_out) {
     const char *args[2];
 
@@ -955,10 +1202,11 @@ int nsigner_nip44_encrypt_url(const char *url, const char *role,
 
     args[0] = peer_pub_hex;
     args[1] = plaintext;
-    return nsigner_call_string_method_url(url, role, "nip44_encrypt", args, 2, cipher_out);
+    return nsigner_call_string_method_url(url, selector, auth, "nip44_encrypt", args, 2, cipher_out);
 }
 
-int nsigner_nip44_decrypt_url(const char *url, const char *role,
+int nsigner_nip44_decrypt_url(const char *url, const nt_nsigner_selector_t *selector,
+                              const nt_nsigner_auth_ctx_t *auth,
                               const char *peer_pub_hex, const char *ciphertext, char **plain_out) {
     const char *args[2];
 
@@ -968,12 +1216,12 @@ int nsigner_nip44_decrypt_url(const char *url, const char *role,
 
     args[0] = peer_pub_hex;
     args[1] = ciphertext;
-    return nsigner_call_string_method_url(url, role, "nip44_decrypt", args, 2, plain_out);
+    return nsigner_call_string_method_url(url, selector, auth, "nip44_decrypt", args, 2, plain_out);
 }
 
 int nsigner_qrexec_get_public_key(const char *target_qube,
                                   const char *service_name,
-                                  const char *role,
+                                  const nt_nsigner_selector_t *selector,
                                   char *out_hex_65) {
     char *result = NULL;
     int rc;
@@ -983,7 +1231,7 @@ int nsigner_qrexec_get_public_key(const char *target_qube,
         return NT_NSIGNER_E_IO;
     }
 
-    rc = nsigner_qrexec_call_string_method(target_qube, service_name, role,
+    rc = nsigner_qrexec_call_string_method(target_qube, service_name, selector,
                                            "get_public_key", NULL, 0, &result);
     if (rc != NT_NSIGNER_OK) {
         return rc;
@@ -1002,7 +1250,7 @@ int nsigner_qrexec_get_public_key(const char *target_qube,
 
 int nsigner_qrexec_sign_event(const char *target_qube,
                               const char *service_name,
-                              const char *role,
+                              const nt_nsigner_selector_t *selector,
                               const char *unsigned_event_json,
                               char **signed_event_json_out) {
     const char *args[1];
@@ -1012,13 +1260,13 @@ int nsigner_qrexec_sign_event(const char *target_qube,
     }
 
     args[0] = unsigned_event_json;
-    return nsigner_qrexec_call_string_method(target_qube, service_name, role,
+    return nsigner_qrexec_call_string_method(target_qube, service_name, selector,
                                              "sign_event", args, 1, signed_event_json_out);
 }
 
 int nsigner_qrexec_nip04_encrypt(const char *target_qube,
                                  const char *service_name,
-                                 const char *role,
+                                 const nt_nsigner_selector_t *selector,
                                  const char *peer_pub_hex,
                                  const char *plaintext,
                                  char **cipher_out) {
@@ -1030,13 +1278,13 @@ int nsigner_qrexec_nip04_encrypt(const char *target_qube,
 
     args[0] = peer_pub_hex;
     args[1] = plaintext;
-    return nsigner_qrexec_call_string_method(target_qube, service_name, role,
+    return nsigner_qrexec_call_string_method(target_qube, service_name, selector,
                                              "nip04_encrypt", args, 2, cipher_out);
 }
 
 int nsigner_qrexec_nip04_decrypt(const char *target_qube,
                                  const char *service_name,
-                                 const char *role,
+                                 const nt_nsigner_selector_t *selector,
                                  const char *peer_pub_hex,
                                  const char *ciphertext,
                                  char **plain_out) {
@@ -1048,13 +1296,13 @@ int nsigner_qrexec_nip04_decrypt(const char *target_qube,
 
     args[0] = peer_pub_hex;
     args[1] = ciphertext;
-    return nsigner_qrexec_call_string_method(target_qube, service_name, role,
+    return nsigner_qrexec_call_string_method(target_qube, service_name, selector,
                                              "nip04_decrypt", args, 2, plain_out);
 }
 
 int nsigner_qrexec_nip44_encrypt(const char *target_qube,
                                  const char *service_name,
-                                 const char *role,
+                                 const nt_nsigner_selector_t *selector,
                                  const char *peer_pub_hex,
                                  const char *plaintext,
                                  char **cipher_out) {
@@ -1066,13 +1314,13 @@ int nsigner_qrexec_nip44_encrypt(const char *target_qube,
 
     args[0] = peer_pub_hex;
     args[1] = plaintext;
-    return nsigner_qrexec_call_string_method(target_qube, service_name, role,
+    return nsigner_qrexec_call_string_method(target_qube, service_name, selector,
                                              "nip44_encrypt", args, 2, cipher_out);
 }
 
 int nsigner_qrexec_nip44_decrypt(const char *target_qube,
                                  const char *service_name,
-                                 const char *role,
+                                 const nt_nsigner_selector_t *selector,
                                  const char *peer_pub_hex,
                                  const char *ciphertext,
                                  char **plain_out) {
@@ -1084,6 +1332,6 @@ int nsigner_qrexec_nip44_decrypt(const char *target_qube,
 
     args[0] = peer_pub_hex;
     args[1] = ciphertext;
-    return nsigner_qrexec_call_string_method(target_qube, service_name, role,
+    return nsigner_qrexec_call_string_method(target_qube, service_name, selector,
                                              "nip44_decrypt", args, 2, plain_out);
 }

src/signer.c

@@ -16,7 +16,17 @@ nt_signer_t g_signer = {
     .kind = NT_SIGNER_LOCAL,
     .socket_name = {0},
     .endpoint_url = {0},
-    .role = "main",
+    .url_session_fd = -1,
+    .selector = {
+        .has_nostr_index = 1,
+        .nostr_index = 0,
+        .role = {0}
+    },
+    .url_auth = {
+        .enabled = 0,
+        .privkey = {0},
+        .label = {0}
+    }
 };
 
 static int signer_local_private_key(unsigned char out_priv[32]) {
@@ -29,13 +39,38 @@ static int signer_local_private_key(unsigned char out_priv[32]) {
     return 0;
 }
 
+void signer_set_selector(int has_index, int index, const char *role) {
+    g_signer.selector.has_nostr_index = has_index ? 1 : 0;
+    g_signer.selector.nostr_index = (index < 0) ? 0 : index;
+    if (role && role[0] != '\0') {
+        snprintf(g_signer.selector.role, sizeof(g_signer.selector.role), "%s", role);
+    } else {
+        g_signer.selector.role[0] = '\0';
+    }
+}
+
 void signer_init(void) {
+    nt_nsigner_selector_t sel = nsigner_selector_default();
+
+    if (g_signer.url_session_fd >= 0) {
+        nsigner_session_close(g_signer.url_session_fd);
+        g_signer.url_session_fd = -1;
+    }
+
     g_signer.kind = NT_SIGNER_LOCAL;
     g_signer.socket_name[0] = '\0';
     g_signer.qrexec_target[0] = '\0';
     g_signer.qrexec_service[0] = '\0';
     g_signer.endpoint_url[0] = '\0';
-    snprintf(g_signer.role, sizeof(g_signer.role), "%s", "main");
+    signer_set_selector(sel.has_nostr_index, sel.nostr_index, sel.role);
+    g_signer.url_auth.enabled = 0;
+    memset(g_signer.url_auth.privkey, 0, sizeof(g_signer.url_auth.privkey));
+    g_signer.url_auth.label[0] = '\0';
+}
+
+void signer_shutdown(void) {
+    memset(g_signer.url_auth.privkey, 0, sizeof(g_signer.url_auth.privkey));
+    signer_init();
 }
 
 int signer_init_local(void) {
@@ -43,7 +78,9 @@ int signer_init_local(void) {
     return 0;
 }
 
-int signer_init_nsigner(const char *socket_name) {
+int signer_init_nsigner(const char *socket_name, const nt_nsigner_selector_t *selector) {
+    nt_nsigner_selector_t sel = selector ? *selector : nsigner_selector_default();
+
     if (!socket_name || socket_name[0] == '\0') {
         return -1;
     }
@@ -52,11 +89,17 @@ int signer_init_nsigner(const char *socket_name) {
     g_signer.qrexec_target[0] = '\0';
     g_signer.qrexec_service[0] = '\0';
     g_signer.endpoint_url[0] = '\0';
-    snprintf(g_signer.role, sizeof(g_signer.role), "%s", "main");
+    if (g_signer.url_session_fd >= 0) {
+        nsigner_session_close(g_signer.url_session_fd);
+        g_signer.url_session_fd = -1;
+    }
+    signer_set_selector(sel.has_nostr_index, sel.nostr_index, sel.role);
     return 0;
 }
 
-int signer_init_nsigner_qrexec(const char *target_qube, const char *service_name) {
+int signer_init_nsigner_qrexec(const char *target_qube, const char *service_name, const nt_nsigner_selector_t *selector) {
+    nt_nsigner_selector_t sel = selector ? *selector : nsigner_selector_default();
+
     if (!target_qube || target_qube[0] == '\0' || !service_name || service_name[0] == '\0') {
         return -1;
     }
@@ -65,12 +108,24 @@ int signer_init_nsigner_qrexec(const char *target_qube, const char *service_name
     snprintf(g_signer.qrexec_target, sizeof(g_signer.qrexec_target), "%s", target_qube);
     snprintf(g_signer.qrexec_service, sizeof(g_signer.qrexec_service), "%s", service_name);
     g_signer.endpoint_url[0] = '\0';
-    snprintf(g_signer.role, sizeof(g_signer.role), "%s", "main");
+    if (g_signer.url_session_fd >= 0) {
+        nsigner_session_close(g_signer.url_session_fd);
+        g_signer.url_session_fd = -1;
+    }
+    signer_set_selector(sel.has_nostr_index, sel.nostr_index, sel.role);
     return 0;
 }
 
-int signer_init_nsigner_url(const char *endpoint_url) {
+int signer_init_nsigner_url_with_session_auth(const char *endpoint_url,
+                                              const nt_nsigner_selector_t *selector,
+                                              int session_fd,
+                                              const nt_nsigner_auth_ctx_t *auth_or_null) {
+    nt_nsigner_selector_t sel = selector ? *selector : nsigner_selector_default();
+
     if (!endpoint_url || endpoint_url[0] == '\0') {
+        if (session_fd >= 0) {
+            nsigner_session_close(session_fd);
+        }
         return -1;
     }
 
@@ -79,10 +134,41 @@ int signer_init_nsigner_url(const char *endpoint_url) {
     g_signer.qrexec_target[0] = '\0';
     g_signer.qrexec_service[0] = '\0';
     snprintf(g_signer.endpoint_url, sizeof(g_signer.endpoint_url), "%s", endpoint_url);
-    snprintf(g_signer.role, sizeof(g_signer.role), "%s", "main");
+
+    if (g_signer.url_session_fd >= 0 && g_signer.url_session_fd != session_fd) {
+        nsigner_session_close(g_signer.url_session_fd);
+    }
+    g_signer.url_session_fd = session_fd;
+
+    if (g_signer.url_session_fd < 0) {
+        g_signer.url_session_fd = nsigner_session_open_url(g_signer.endpoint_url);
+    }
+
+    signer_set_selector(sel.has_nostr_index, sel.nostr_index, sel.role);
+
+    g_signer.url_auth.enabled = 0;
+    memset(g_signer.url_auth.privkey, 0, sizeof(g_signer.url_auth.privkey));
+    g_signer.url_auth.label[0] = '\0';
+
+    if (auth_or_null && auth_or_null->enabled) {
+        g_signer.url_auth.enabled = 1;
+        memcpy(g_signer.url_auth.privkey, auth_or_null->privkey, sizeof(g_signer.url_auth.privkey));
+        snprintf(g_signer.url_auth.label, sizeof(g_signer.url_auth.label), "%s", auth_or_null->label);
+    }
+
     return 0;
 }
 
+int signer_init_nsigner_url_with_session(const char *endpoint_url,
+                                         const nt_nsigner_selector_t *selector,
+                                         int session_fd) {
+    return signer_init_nsigner_url_with_session_auth(endpoint_url, selector, session_fd, NULL);
+}
+
+int signer_init_nsigner_url(const char *endpoint_url, const nt_nsigner_selector_t *selector) {
+    return signer_init_nsigner_url_with_session_auth(endpoint_url, selector, -1, NULL);
+}
+
 int signer_get_local_private_key(unsigned char out_priv[32]) {
     if (!out_priv) {
         return -1;
@@ -148,7 +234,7 @@ int signer_create_and_sign(int kind,
         }
 
         rc = nsigner_sign_event(g_signer.socket_name,
-                                g_signer.role,
+                                &g_signer.selector,
                                 unsigned_json,
                                 signed_event_json_out);
 
@@ -199,7 +285,7 @@ int signer_create_and_sign(int kind,
 
         rc = nsigner_qrexec_sign_event(g_signer.qrexec_target,
                                        g_signer.qrexec_service,
-                                       g_signer.role,
+                                       &g_signer.selector,
                                        unsigned_json,
                                        signed_event_json_out);
 
@@ -248,10 +334,12 @@ int signer_create_and_sign(int kind,
             return -1;
         }
 
-        rc = nsigner_sign_event_url(g_signer.endpoint_url,
-                                    g_signer.role,
-                                    unsigned_json,
-                                    signed_event_json_out);
+        rc = nsigner_session_sign_event(&g_signer.url_session_fd,
+                                        g_signer.endpoint_url,
+                                        &g_signer.selector,
+                                        g_signer.url_auth.enabled ? &g_signer.url_auth : NULL,
+                                        unsigned_json,
+                                        signed_event_json_out);
 
         free(unsigned_json);
         cJSON_Delete(unsigned_event);
@@ -307,7 +395,7 @@ int signer_sign_event_json(const char *unsigned_event_json, char **signed_event_
 
     if (g_signer.kind == NT_SIGNER_NSIGNER) {
         return nsigner_sign_event(g_signer.socket_name,
-                                  g_signer.role,
+                                  &g_signer.selector,
                                   unsigned_event_json,
                                   signed_event_json_out);
     }
@@ -315,16 +403,18 @@ int signer_sign_event_json(const char *unsigned_event_json, char **signed_event_
     if (g_signer.kind == NT_SIGNER_NSIGNER_QREXEC) {
         return nsigner_qrexec_sign_event(g_signer.qrexec_target,
                                          g_signer.qrexec_service,
-                                         g_signer.role,
+                                         &g_signer.selector,
                                          unsigned_event_json,
                                          signed_event_json_out);
     }
 
     if (g_signer.kind == NT_SIGNER_NSIGNER_URL) {
-        return nsigner_sign_event_url(g_signer.endpoint_url,
-                                      g_signer.role,
-                                      unsigned_event_json,
-                                      signed_event_json_out);
+        return nsigner_session_sign_event(&g_signer.url_session_fd,
+                                          g_signer.endpoint_url,
+                                          &g_signer.selector,
+                                          g_signer.url_auth.enabled ? &g_signer.url_auth : NULL,
+                                          unsigned_event_json,
+                                          signed_event_json_out);
     }
 
     if (g_signer.kind != NT_SIGNER_LOCAL) {
@@ -385,7 +475,7 @@ int signer_nip04_encrypt(const char *peer_pub_hex, const char *plaintext, char *
 
     if (g_signer.kind == NT_SIGNER_NSIGNER) {
         return nsigner_nip04_encrypt(g_signer.socket_name,
-                                     g_signer.role,
+                                     &g_signer.selector,
                                      peer_pub_hex,
                                      plaintext,
                                      cipher_out);
@@ -394,18 +484,20 @@ int signer_nip04_encrypt(const char *peer_pub_hex, const char *plaintext, char *
     if (g_signer.kind == NT_SIGNER_NSIGNER_QREXEC) {
         return nsigner_qrexec_nip04_encrypt(g_signer.qrexec_target,
                                             g_signer.qrexec_service,
-                                            g_signer.role,
+                                            &g_signer.selector,
                                             peer_pub_hex,
                                             plaintext,
                                             cipher_out);
     }
 
     if (g_signer.kind == NT_SIGNER_NSIGNER_URL) {
-        return nsigner_nip04_encrypt_url(g_signer.endpoint_url,
-                                         g_signer.role,
-                                         peer_pub_hex,
-                                         plaintext,
-                                         cipher_out);
+        return nsigner_session_nip04_encrypt(&g_signer.url_session_fd,
+                                             g_signer.endpoint_url,
+                                             &g_signer.selector,
+                                             g_signer.url_auth.enabled ? &g_signer.url_auth : NULL,
+                                             peer_pub_hex,
+                                             plaintext,
+                                             cipher_out);
     }
 
     if (g_signer.kind != NT_SIGNER_LOCAL) {
@@ -444,7 +536,7 @@ int signer_nip04_decrypt(const char *peer_pub_hex, const char *ciphertext, char
 
     if (g_signer.kind == NT_SIGNER_NSIGNER) {
         return nsigner_nip04_decrypt(g_signer.socket_name,
-                                     g_signer.role,
+                                     &g_signer.selector,
                                      peer_pub_hex,
                                      ciphertext,
                                      plain_out);
@@ -453,18 +545,20 @@ int signer_nip04_decrypt(const char *peer_pub_hex, const char *ciphertext, char
     if (g_signer.kind == NT_SIGNER_NSIGNER_QREXEC) {
         return nsigner_qrexec_nip04_decrypt(g_signer.qrexec_target,
                                             g_signer.qrexec_service,
-                                            g_signer.role,
+                                            &g_signer.selector,
                                             peer_pub_hex,
                                             ciphertext,
                                             plain_out);
     }
 
     if (g_signer.kind == NT_SIGNER_NSIGNER_URL) {
-        return nsigner_nip04_decrypt_url(g_signer.endpoint_url,
-                                         g_signer.role,
-                                         peer_pub_hex,
-                                         ciphertext,
-                                         plain_out);
+        return nsigner_session_nip04_decrypt(&g_signer.url_session_fd,
+                                             g_signer.endpoint_url,
+                                             &g_signer.selector,
+                                             g_signer.url_auth.enabled ? &g_signer.url_auth : NULL,
+                                             peer_pub_hex,
+                                             ciphertext,
+                                             plain_out);
     }
 
     if (g_signer.kind != NT_SIGNER_LOCAL) {
@@ -503,7 +597,7 @@ int signer_nip44_encrypt(const char *peer_pub_hex, const char *plaintext, char *
 
     if (g_signer.kind == NT_SIGNER_NSIGNER) {
         return nsigner_nip44_encrypt(g_signer.socket_name,
-                                     g_signer.role,
+                                     &g_signer.selector,
                                      peer_pub_hex,
                                      plaintext,
                                      cipher_out);
@@ -512,18 +606,20 @@ int signer_nip44_encrypt(const char *peer_pub_hex, const char *plaintext, char *
     if (g_signer.kind == NT_SIGNER_NSIGNER_QREXEC) {
         return nsigner_qrexec_nip44_encrypt(g_signer.qrexec_target,
                                             g_signer.qrexec_service,
-                                            g_signer.role,
+                                            &g_signer.selector,
                                             peer_pub_hex,
                                             plaintext,
                                             cipher_out);
     }
 
     if (g_signer.kind == NT_SIGNER_NSIGNER_URL) {
-        return nsigner_nip44_encrypt_url(g_signer.endpoint_url,
-                                         g_signer.role,
-                                         peer_pub_hex,
-                                         plaintext,
-                                         cipher_out);
+        return nsigner_session_nip44_encrypt(&g_signer.url_session_fd,
+                                             g_signer.endpoint_url,
+                                             &g_signer.selector,
+                                             g_signer.url_auth.enabled ? &g_signer.url_auth : NULL,
+                                             peer_pub_hex,
+                                             plaintext,
+                                             cipher_out);
     }
 
     if (g_signer.kind != NT_SIGNER_LOCAL) {
@@ -562,7 +658,7 @@ int signer_nip44_decrypt(const char *peer_pub_hex, const char *ciphertext, char
 
     if (g_signer.kind == NT_SIGNER_NSIGNER) {
         return nsigner_nip44_decrypt(g_signer.socket_name,
-                                     g_signer.role,
+                                     &g_signer.selector,
                                      peer_pub_hex,
                                      ciphertext,
                                      plain_out);
@@ -571,18 +667,20 @@ int signer_nip44_decrypt(const char *peer_pub_hex, const char *ciphertext, char
     if (g_signer.kind == NT_SIGNER_NSIGNER_QREXEC) {
         return nsigner_qrexec_nip44_decrypt(g_signer.qrexec_target,
                                             g_signer.qrexec_service,
-                                            g_signer.role,
+                                            &g_signer.selector,
                                             peer_pub_hex,
                                             ciphertext,
                                             plain_out);
     }
 
     if (g_signer.kind == NT_SIGNER_NSIGNER_URL) {
-        return nsigner_nip44_decrypt_url(g_signer.endpoint_url,
-                                         g_signer.role,
-                                         peer_pub_hex,
-                                         ciphertext,
-                                         plain_out);
+        return nsigner_session_nip44_decrypt(&g_signer.url_session_fd,
+                                             g_signer.endpoint_url,
+                                             &g_signer.selector,
+                                             g_signer.url_auth.enabled ? &g_signer.url_auth : NULL,
+                                             peer_pub_hex,
+                                             ciphertext,
+                                             plain_out);
     }
 
     if (g_signer.kind != NT_SIGNER_LOCAL) {