Product shape
The practical product is a shared companion plus five signer solutions,
not five unrelated experiments. Every shared feature behaves the same
across implementations because the contract_id in
nSealr/specs defines it once.
The five signer solutions
A solution is the unit at which feature parity is contracted. See the Signers section for the per-solution capability matrix and live maturity.
- Raspberry/Pi Stateless QR Vault — air-gapped, RAM-only, SeedSigner-style.
- ESP32 Stateless QR Vault — air-gapped ESP32-S3 camera + display.
- ESP32 USB/NIP-46 Signer — daily-use connected signer, real signing gated.
- JavaCard/NFC Smartcard Signer — display-less APDU custody, external review required.
- Custom Nostr Hardware Wallet With Persistent Secret — research line for purpose-built hardware.
Companion surfaces
The companion is a single TypeScript monorepo that ships multiple access surfaces over the same secretless platform. Every surface reuses the same validation, transport, and response-verification logic.
| Surface | Purpose |
|---|---|
nsealr CLI | Request construction, transports, verification, audit export. |
| npm SDK | Embed the companion in any Nostr client or service. |
| Browser extension | NIP-07 surface backed by a signer. |
| Local app | Desktop UI for routing and review. |
| Local service | Background daemon for the extension and apps. |
| NIP-46 bridge | Converts already-decrypted NIP-46 payloads into standard nSealr signing requests. |
The companion is never trusted with key custody. It composes requests, moves them over the selected transport, and verifies every successful response against shared fixtures.
Trust boundaries (summary)
| Layer | Trusted with… | Not trusted with… |
|---|---|---|
| Client | building requests | private keys |
| Companion | routing & response verification | private keys, policy execution |
| QR vault | RAM-only signing | persistent secret |
| USB signer | persistent secret (after gates) | the universe outside its boundary |
| Smartcard | persistent secret, APDU signing | trusted event review (display-less) |
| Custom HW | persistent secret + display review (after gates) | claims before evidence |
The trust boundaries page and the threat model cover this in depth.