Phase 1 of docs/npub-sign-in.md. A type change and nothing a user can see.
Identity.nostrPrivateKey becomes nullable and nostrPublicKey becomes a
constructor field, because the kind this plan adds -- NostrPublic, a bare
public key -- has nothing to derive a pubkey from. A data class would let
the two disagree, so two checks in init refuse an identity whose kind and
key disagree about whether there is one, and one whose key does not derive
the public key it was given. Identity.signing derives the pubkey and refuses
the read-only kind; Identity.readOnly builds the other; nothing else
constructs one now. The id of a read-only identity is toWalletId() of the
x-only key -- the same id its nsec would have -- which is what will let a
read-only identity become a signing one and keep its preferences.
canSign is a property of the identity rather than nostrPrivateKey != null
at each site, so that a signer with no local key has one place to answer.
Every reader of the key already reached it through ?. on a nullable
identity, so the compiler forces nothing here; the sites that need a
decision are the plan's Phase 5, found by reading. The one site that did
change is KeyRecoveryScreen, whose two whens branched on NostrSecret with an
else that meant "mnemonic": both are exhaustive now, so the new kind is not
handed the phrase option by default.
Tests: NavigationIdentityRoutingJvmTest gains a read-only fixture with the
same id and pubkey as the secret one, the routing case for it (by its
account, like any other), and the three refusals plus the factory's own.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Pulled-From: curated/curated@15766596e4
cf43973b36