@elisym/sdk 0.1.3 → 0.2.1

package/dist/index.cjs

@@ -1,11 +1,11 @@
 'use strict';
 
+var web3_js = require('@solana/web3.js');
+var Decimal2 = require('decimal.js-light');
 var nostrTools = require('nostr-tools');
 var nip44 = require('nostr-tools/nip44');
 var nip17 = require('nostr-tools/nip17');
 var nip59 = require('nostr-tools/nip59');
-var web3_js = require('@solana/web3.js');
-var Decimal = require('decimal.js-light');
 
 function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
 
@@ -27,12 +27,10 @@ function _interopNamespace(e) {
   return Object.freeze(n);
 }
 
+var Decimal2__default = /*#__PURE__*/_interopDefault(Decimal2);
 var nip44__namespace = /*#__PURE__*/_interopNamespace(nip44);
 var nip17__namespace = /*#__PURE__*/_interopNamespace(nip17);
 var nip59__namespace = /*#__PURE__*/_interopNamespace(nip59);
-var Decimal__default = /*#__PURE__*/_interopDefault(Decimal);
-
-// src/core/pool.ts
 
 // src/constants.ts
 var RELAYS = [
@@ -51,9 +49,15 @@ var KIND_GIFT_WRAP = 1059;
 var KIND_JOB_REQUEST = KIND_JOB_REQUEST_BASE + DEFAULT_KIND_OFFSET;
 var KIND_JOB_RESULT = KIND_JOB_RESULT_BASE + DEFAULT_KIND_OFFSET;
 function jobRequestKind(offset) {
+  if (!Number.isInteger(offset) || offset < 0 || offset >= 1e3) {
+    throw new Error(`Invalid kind offset: ${offset}. Must be integer 0-999.`);
+  }
   return KIND_JOB_REQUEST_BASE + offset;
 }
 function jobResultKind(offset) {
+  if (!Number.isInteger(offset) || offset < 0 || offset >= 1e3) {
+    throw new Error(`Invalid kind offset: ${offset}. Must be integer 0-999.`);
+  }
   return KIND_JOB_RESULT_BASE + offset;
 }
 var KIND_PING = 20200;
@@ -61,192 +65,453 @@ var KIND_PONG = 20201;
 var LAMPORTS_PER_SOL = 1e9;
 var PROTOCOL_FEE_BPS = 300;
 var PROTOCOL_TREASURY = "GY7vnWMkKpftU4nQ16C2ATkj1JwrQpHhknkaBUn67VTy";
-
-// src/core/pool.ts
-var NostrPool = class {
-  pool;
-  relays;
-  constructor(relays = RELAYS) {
-    this.pool = new nostrTools.SimplePool();
-    this.relays = relays;
+var DEFAULTS = {
+  SUBSCRIPTION_TIMEOUT_MS: 12e4,
+  PING_TIMEOUT_MS: 15e3,
+  PING_RETRIES: 2,
+  PING_CACHE_TTL_MS: 3e4,
+  PAYMENT_EXPIRY_SECS: 600,
+  BATCH_SIZE: 250,
+  QUERY_TIMEOUT_MS: 15e3,
+  EOSE_TIMEOUT_MS: 3e3,
+  VERIFY_RETRIES: 10,
+  VERIFY_INTERVAL_MS: 3e3,
+  VERIFY_BY_REF_RETRIES: 15,
+  VERIFY_BY_REF_INTERVAL_MS: 2e3,
+  RESULT_RETRY_COUNT: 3,
+  RESULT_RETRY_BASE_MS: 1e3,
+  QUERY_MAX_CONCURRENCY: 6,
+  VERIFY_SIGNATURE_LIMIT: 25
+};
+var LIMITS = {
+  MAX_INPUT_LENGTH: 1e5,
+  MAX_TIMEOUT_SECS: 600,
+  MAX_CAPABILITIES: 20,
+  MAX_DESCRIPTION_LENGTH: 500,
+  MAX_AGENT_NAME_LENGTH: 64,
+  MAX_MESSAGE_LENGTH: 1e4,
+  MAX_CAPABILITY_LENGTH: 64
+};
+function assertLamports(value, field) {
+  if (!Number.isInteger(value) || value < 0) {
+    throw new Error(`Invalid ${field}: ${value}. Must be a non-negative integer.`);
   }
-  async querySync(filter) {
-    return Promise.race([
-      this.pool.querySync(this.relays, filter),
-      new Promise(
-        (resolve) => setTimeout(() => resolve([]), 15e3)
-      )
-    ]);
-  }
-  async queryBatched(filter, keys, batchSize = 250) {
-    const batches = [];
-    for (let i = 0; i < keys.length; i += batchSize) {
-      const batch = keys.slice(i, i + batchSize);
-      batches.push(
-        Promise.race([
-          this.pool.querySync(this.relays, {
-            ...filter,
-            authors: batch
-          }),
-          new Promise(
-            (resolve) => setTimeout(() => resolve([]), 15e3)
-          )
-        ])
-      );
-    }
-    return (await Promise.all(batches)).flat();
+}
+function calculateProtocolFee(amount) {
+  if (!Number.isInteger(amount) || amount < 0) {
+    throw new Error(`Invalid fee amount: ${amount}. Must be a non-negative integer.`);
   }
-  async queryBatchedByTag(filter, tagName, values, batchSize = 250) {
-    const batches = [];
-    for (let i = 0; i < values.length; i += batchSize) {
-      const batch = values.slice(i, i + batchSize);
-      batches.push(
-        Promise.race([
-          this.pool.querySync(this.relays, {
-            ...filter,
-            [`#${tagName}`]: batch
-          }),
-          new Promise(
-            (resolve) => setTimeout(() => resolve([]), 15e3)
-          )
-        ])
-      );
-    }
-    return (await Promise.all(batches)).flat();
+  if (amount === 0) {
+    return 0;
   }
-  async publish(event) {
+  return new Decimal2__default.default(amount).mul(PROTOCOL_FEE_BPS).div(1e4).toDecimalPlaces(0, Decimal2__default.default.ROUND_CEIL).toNumber();
+}
+function validateExpiry(createdAt, expirySecs) {
+  if (!Number.isInteger(createdAt) || createdAt <= 0) {
+    return "Invalid or missing created_at in payment request.";
+  }
+  if (!Number.isInteger(expirySecs) || expirySecs <= 0) {
+    return "Invalid or missing expiry_secs in payment request.";
+  }
+  const now = Math.floor(Date.now() / 1e3);
+  if (createdAt > now + 120) {
+    return `Payment request created_at is in the future (${createdAt} vs now ${now}). Possible manipulation.`;
+  }
+  if (now - createdAt > expirySecs) {
+    return `Payment request expired (created ${createdAt}, expiry ${expirySecs}s).`;
+  }
+  return null;
+}
+function assertExpiry(createdAt, expirySecs) {
+  const error = validateExpiry(createdAt, expirySecs);
+  if (error) {
+    throw new Error(error);
+  }
+}
+
+// src/payment/solana.ts
+function isValidSolanaAddress(address) {
+  try {
+    void new web3_js.PublicKey(address);
+    return true;
+  } catch {
+    return false;
+  }
+}
+var SolanaPaymentStrategy = class {
+  chain = "solana";
+  calculateFee(amount) {
+    return calculateProtocolFee(amount);
+  }
+  createPaymentRequest(recipientAddress, amount, expirySecs = DEFAULTS.PAYMENT_EXPIRY_SECS) {
     try {
-      await Promise.any(this.pool.publish(this.relays, event));
-    } catch (err) {
-      if (err instanceof AggregateError) {
-        throw new Error(
-          `Failed to publish to all ${this.relays.length} relays: ${err.errors.map((e) => e.message).join(", ")}`
-        );
-      }
-      throw err;
+      void new web3_js.PublicKey(recipientAddress);
+    } catch {
+      throw new Error(`Invalid Solana address: ${recipientAddress}`);
     }
-  }
-  /** Publish to all relays and wait for all to settle. Throws if none accepted. */
-  async publishAll(event) {
-    const results = await Promise.allSettled(this.pool.publish(this.relays, event));
-    const anyOk = results.some((r) => r.status === "fulfilled");
-    if (!anyOk) {
+    assertLamports(amount, "payment amount");
+    if (amount === 0) {
+      throw new Error("Invalid payment amount: 0. Must be positive.");
+    }
+    if (!Number.isInteger(expirySecs) || expirySecs <= 0 || expirySecs > LIMITS.MAX_TIMEOUT_SECS) {
       throw new Error(
-        `Failed to publish to all ${this.relays.length} relays`
+        `Invalid expiry: ${expirySecs}. Must be integer 1-${LIMITS.MAX_TIMEOUT_SECS}.`
       );
     }
+    const feeAmount = calculateProtocolFee(amount);
+    const reference = web3_js.Keypair.generate().publicKey.toBase58();
+    return {
+      recipient: recipientAddress,
+      amount,
+      reference,
+      fee_address: PROTOCOL_TREASURY,
+      fee_amount: feeAmount,
+      created_at: Math.floor(Date.now() / 1e3),
+      expiry_secs: expirySecs
+    };
   }
-  subscribe(filter, onEvent) {
-    return this.pool.subscribeMany(
-      this.relays,
-      filter,
-      { onevent: onEvent }
-    );
-  }
-  /**
-   * Subscribe and wait until at least one relay confirms the subscription
-   * is active (EOSE). Resolves on the first relay that responds.
-   * Essential for ephemeral events where the subscription must be live
-   * before publishing.
-   */
-  subscribeAndWait(filter, onEvent, timeoutMs = 3e3) {
-    return new Promise((resolve) => {
-      let resolved = false;
-      const done = () => {
-        if (resolved) return;
-        resolved = true;
-        resolve(combinedSub);
+  validatePaymentRequest(requestJson, expectedRecipient) {
+    let data;
+    try {
+      data = JSON.parse(requestJson);
+    } catch (e) {
+      return { code: "invalid_json", message: `Invalid payment request JSON: ${e}` };
+    }
+    if (typeof data.amount !== "number" || !Number.isInteger(data.amount) || data.amount <= 0) {
+      return {
+        code: "invalid_amount",
+        message: `Invalid amount in payment request: ${data.amount}`
       };
-      const subs = [];
-      for (const relay of this.relays) {
-        const sub = this.pool.subscribeMany(
-          [relay],
-          filter,
-          {
-            onevent: onEvent,
-            oneose: done
-          }
-        );
-        subs.push(sub);
+    }
+    if (typeof data.recipient !== "string" || !data.recipient) {
+      return { code: "missing_recipient", message: "Missing recipient in payment request" };
+    }
+    if (!isValidSolanaAddress(data.recipient)) {
+      return {
+        code: "invalid_recipient_address",
+        message: `Invalid Solana address for recipient: ${data.recipient}`
+      };
+    }
+    if (typeof data.reference !== "string" || !data.reference) {
+      return { code: "missing_reference", message: "Missing reference in payment request" };
+    }
+    if (!isValidSolanaAddress(data.reference)) {
+      return {
+        code: "invalid_reference_address",
+        message: `Invalid Solana address for reference: ${data.reference}`
+      };
+    }
+    if (expectedRecipient && data.recipient !== expectedRecipient) {
+      return {
+        code: "recipient_mismatch",
+        message: `Recipient mismatch: expected ${expectedRecipient}, got ${data.recipient}. Provider may be attempting to redirect payment.`
+      };
+    }
+    const expiryError = validateExpiry(data.created_at, data.expiry_secs);
+    if (expiryError) {
+      const code = expiryError.includes("future") ? "future_timestamp" : "expired";
+      return { code, message: expiryError };
+    }
+    const expectedFee = calculateProtocolFee(data.amount);
+    const { fee_address, fee_amount } = data;
+    const hasFeeAddress = typeof fee_address === "string" && fee_address.length > 0;
+    const hasFeeAmount = typeof fee_amount === "number" && fee_amount > 0;
+    if (hasFeeAddress && hasFeeAmount) {
+      if (fee_address !== PROTOCOL_TREASURY) {
+        return {
+          code: "fee_address_mismatch",
+          message: `Fee address mismatch: expected ${PROTOCOL_TREASURY}, got ${fee_address}. Provider may be attempting to redirect fees.`
+        };
       }
-      const combinedSub = {
-        close: (reason) => {
-          for (const s of subs) s.close(reason);
-        }
+      if (fee_amount !== expectedFee) {
+        return {
+          code: "fee_amount_mismatch",
+          message: `Fee amount mismatch: expected ${expectedFee} lamports (${PROTOCOL_FEE_BPS}bps of ${data.amount}), got ${fee_amount}. Provider may be tampering with fee.`
+        };
+      }
+      return null;
+    }
+    if (!hasFeeAddress && (fee_amount === null || fee_amount === void 0 || fee_amount === 0)) {
+      return {
+        code: "missing_fee",
+        message: `Payment request missing protocol fee (${PROTOCOL_FEE_BPS}bps). Expected fee: ${expectedFee} lamports to ${PROTOCOL_TREASURY}.`
       };
-      setTimeout(done, timeoutMs);
-    });
-  }
-  /**
-   * Tear down pool and create a fresh one.
-   * Works around nostr-tools `onerror → skipReconnection = true` bug
-   * that permanently kills subscriptions. Callers must re-subscribe.
-   */
-  reset() {
-    try {
-      this.pool.close(this.relays);
-    } catch {
     }
-    this.pool = new nostrTools.SimplePool();
+    return {
+      code: "invalid_fee_params",
+      message: `Invalid fee params in payment request. Expected fee: ${expectedFee} lamports to ${PROTOCOL_TREASURY}.`
+    };
   }
   /**
-   * Lightweight connectivity probe. Returns true if at least one relay responds.
+   * Build an unsigned transaction from a payment request.
+   * The caller must set `recentBlockhash` and `feePayer` on the
+   * returned Transaction before signing and sending.
    */
-  async probe(timeoutMs = 3e3) {
-    let timer;
-    try {
-      await Promise.race([
-        this.pool.querySync(this.relays, { kinds: [0], limit: 1 }),
-        new Promise((_, reject) => {
-          timer = setTimeout(() => reject(new Error("probe timeout")), timeoutMs);
+  async buildTransaction(payerAddress, paymentRequest) {
+    assertLamports(paymentRequest.amount, "payment amount");
+    if (paymentRequest.amount === 0) {
+      throw new Error("Invalid payment amount: 0. Must be positive.");
+    }
+    if (paymentRequest.fee_amount !== null && paymentRequest.fee_amount !== void 0 && (!Number.isInteger(paymentRequest.fee_amount) || paymentRequest.fee_amount < 0)) {
+      throw new Error(
+        `Invalid fee amount: ${paymentRequest.fee_amount}. Must be a non-negative integer (lamports).`
+      );
+    }
+    assertExpiry(paymentRequest.created_at, paymentRequest.expiry_secs);
+    if (paymentRequest.fee_address && paymentRequest.fee_address !== PROTOCOL_TREASURY) {
+      throw new Error(
+        `Invalid fee address: expected ${PROTOCOL_TREASURY}, got ${paymentRequest.fee_address}. Cannot build transaction with redirected fees.`
+      );
+    }
+    const payerPubkey = new web3_js.PublicKey(payerAddress);
+    const recipient = new web3_js.PublicKey(paymentRequest.recipient);
+    const reference = new web3_js.PublicKey(paymentRequest.reference);
+    const feeAddress = paymentRequest.fee_address ? new web3_js.PublicKey(paymentRequest.fee_address) : null;
+    const feeAmount = paymentRequest.fee_amount ?? 0;
+    const providerAmount = feeAddress && feeAmount > 0 ? paymentRequest.amount - feeAmount : paymentRequest.amount;
+    if (providerAmount <= 0) {
+      throw new Error(
+        `Fee amount (${feeAmount}) exceeds or equals total amount (${paymentRequest.amount}). Cannot create transaction with non-positive provider amount.`
+      );
+    }
+    const transferIx = web3_js.SystemProgram.transfer({
+      fromPubkey: payerPubkey,
+      toPubkey: recipient,
+      lamports: providerAmount
+    });
+    transferIx.keys.push({
+      pubkey: reference,
+      isSigner: false,
+      isWritable: false
+    });
+    const tx = new web3_js.Transaction().add(transferIx);
+    if (feeAddress && feeAmount > 0) {
+      tx.add(
+        web3_js.SystemProgram.transfer({
+          fromPubkey: payerPubkey,
+          toPubkey: feeAddress,
+          lamports: feeAmount
         })
-      ]);
-      return true;
-    } catch {
-      return false;
-    } finally {
-      clearTimeout(timer);
+      );
     }
+    return tx;
   }
-  getRelays() {
-    return this.relays;
-  }
-  close() {
-    this.pool.close(this.relays);
-  }
-};
-var ElisymIdentity = class _ElisymIdentity {
-  secretKey;
-  publicKey;
-  npub;
-  constructor(secretKey) {
-    this.secretKey = secretKey;
-    this.publicKey = nostrTools.getPublicKey(secretKey);
-    this.npub = nostrTools.nip19.npubEncode(this.publicKey);
-  }
-  static generate() {
-    return new _ElisymIdentity(nostrTools.generateSecretKey());
-  }
-  static fromSecretKey(sk) {
-    return new _ElisymIdentity(sk);
+  async verifyPayment(connection, paymentRequest, options) {
+    if (!connection || typeof connection.getTransaction !== "function") {
+      return { verified: false, error: "Invalid connection: expected Solana Connection instance" };
+    }
+    const conn = connection;
+    if (!paymentRequest.reference || !paymentRequest.recipient) {
+      return { verified: false, error: "Missing required fields in payment request" };
+    }
+    if (!Number.isInteger(paymentRequest.amount) || paymentRequest.amount <= 0) {
+      return {
+        verified: false,
+        error: `Invalid payment amount: ${paymentRequest.amount}. Must be a positive integer.`
+      };
+    }
+    if (paymentRequest.fee_amount !== null && paymentRequest.fee_amount !== void 0 && (!Number.isInteger(paymentRequest.fee_amount) || paymentRequest.fee_amount < 0)) {
+      return {
+        verified: false,
+        error: `Invalid fee_amount: ${paymentRequest.fee_amount}. Must be a non-negative integer.`
+      };
+    }
+    const expectedFee = calculateProtocolFee(paymentRequest.amount);
+    const feeAmount = paymentRequest.fee_amount ?? 0;
+    if (expectedFee > 0) {
+      if (feeAmount < expectedFee) {
+        return {
+          verified: false,
+          error: `Protocol fee ${feeAmount} below required ${expectedFee} (${PROTOCOL_FEE_BPS}bps of ${paymentRequest.amount})`
+        };
+      }
+      if (!paymentRequest.fee_address) {
+        return { verified: false, error: "Missing fee address in payment request" };
+      }
+      if (paymentRequest.fee_address !== PROTOCOL_TREASURY) {
+        return { verified: false, error: `Invalid fee address: ${paymentRequest.fee_address}` };
+      }
+    }
+    const expectedNet = paymentRequest.amount - feeAmount;
+    if (expectedNet <= 0) {
+      return {
+        verified: false,
+        error: `Fee amount (${feeAmount}) exceeds or equals total amount (${paymentRequest.amount})`
+      };
+    }
+    if (options?.txSignature) {
+      return this._verifyBySignature(
+        conn,
+        options.txSignature,
+        paymentRequest.reference,
+        paymentRequest.recipient,
+        expectedNet,
+        feeAmount,
+        options?.retries ?? DEFAULTS.VERIFY_RETRIES,
+        options?.intervalMs ?? DEFAULTS.VERIFY_INTERVAL_MS
+      );
+    }
+    return this._verifyByReference(
+      conn,
+      paymentRequest.reference,
+      paymentRequest.recipient,
+      expectedNet,
+      feeAmount,
+      options?.retries ?? DEFAULTS.VERIFY_BY_REF_RETRIES,
+      options?.intervalMs ?? DEFAULTS.VERIFY_BY_REF_INTERVAL_MS
+    );
   }
-  static fromHex(hex) {
-    if (hex.length !== 64 || !/^[0-9a-fA-F]{64}$/.test(hex)) {
-      throw new Error("Invalid secret key hex: expected 64 hex characters (32 bytes).");
+  async _verifyBySignature(connection, txSignature, referenceKey, recipientAddress, expectedNet, expectedFee, retries, intervalMs) {
+    let lastError;
+    for (let attempt = 0; attempt < retries; attempt++) {
+      try {
+        const tx = await connection.getTransaction(txSignature, {
+          maxSupportedTransactionVersion: 0,
+          commitment: "confirmed"
+        });
+        if (!tx?.meta || tx.meta.err) {
+          if (attempt < retries - 1) {
+            await new Promise((r) => setTimeout(r, intervalMs));
+            continue;
+          }
+          return {
+            verified: false,
+            error: tx?.meta?.err ? "Transaction failed on-chain" : "Transaction not found"
+          };
+        }
+        const accountKeys = tx.transaction.message.getAccountKeys();
+        const balanceCount = tx.meta.preBalances.length;
+        const keyToIdx = /* @__PURE__ */ new Map();
+        for (let i = 0; i < Math.min(accountKeys.length, balanceCount); i++) {
+          const key = accountKeys.get(i);
+          if (key) {
+            keyToIdx.set(key.toBase58(), i);
+          }
+        }
+        if (!keyToIdx.has(referenceKey)) {
+          return {
+            verified: false,
+            error: "Reference key not found in transaction - possible replay"
+          };
+        }
+        const recipientIdx = keyToIdx.get(recipientAddress);
+        if (recipientIdx === void 0) {
+          return { verified: false, error: "Recipient not found in transaction" };
+        }
+        const recipientDelta = (tx.meta.postBalances[recipientIdx] ?? 0) - (tx.meta.preBalances[recipientIdx] ?? 0);
+        if (recipientDelta < expectedNet) {
+          return {
+            verified: false,
+            error: `Recipient received ${recipientDelta}, expected >= ${expectedNet}`
+          };
+        }
+        if (expectedFee > 0) {
+          const treasuryIdx = keyToIdx.get(PROTOCOL_TREASURY);
+          if (treasuryIdx === void 0) {
+            return { verified: false, error: "Treasury not found in transaction" };
+          }
+          const treasuryDelta = (tx.meta.postBalances[treasuryIdx] ?? 0) - (tx.meta.preBalances[treasuryIdx] ?? 0);
+          if (treasuryDelta < expectedFee) {
+            return {
+              verified: false,
+              error: `Treasury received ${treasuryDelta}, expected >= ${expectedFee}`
+            };
+          }
+        }
+        return { verified: true, txSignature };
+      } catch (err) {
+        lastError = err;
+        if (attempt < retries - 1) {
+          await new Promise((r) => setTimeout(r, intervalMs));
+        }
+      }
     }
-    const bytes = new Uint8Array(32);
-    for (let i = 0; i < 64; i += 2) {
-      bytes[i / 2] = parseInt(hex.substring(i, i + 2), 16);
+    return {
+      verified: false,
+      error: `Verification failed after ${retries} retries: ${lastError instanceof Error ? lastError.message : "unknown error"}`
+    };
+  }
+  async _verifyByReference(connection, referenceKey, recipientAddress, expectedNet, expectedFee, retries, intervalMs) {
+    const reference = new web3_js.PublicKey(referenceKey);
+    let lastError;
+    for (let attempt = 0; attempt < retries; attempt++) {
+      try {
+        const signatures = await connection.getSignaturesForAddress(reference, {
+          limit: DEFAULTS.VERIFY_SIGNATURE_LIMIT
+        });
+        const validSigs = signatures.filter((s) => !s.err);
+        if (validSigs.length > 0) {
+          const txResults = await Promise.all(
+            validSigs.map(
+              (s) => connection.getTransaction(s.signature, {
+                maxSupportedTransactionVersion: 0,
+                commitment: "confirmed"
+              }).then((tx) => ({ sig: s.signature, tx })).catch(() => ({
+                sig: s.signature,
+                tx: null
+              }))
+            )
+          );
+          for (const { sig, tx } of txResults) {
+            if (!tx?.meta || tx.meta.err) {
+              continue;
+            }
+            const accountKeys = tx.transaction.message.getAccountKeys();
+            const balanceCount = tx.meta.preBalances.length;
+            const keyToIdx = /* @__PURE__ */ new Map();
+            for (let i = 0; i < Math.min(accountKeys.length, balanceCount); i++) {
+              const key = accountKeys.get(i);
+              if (key) {
+                keyToIdx.set(key.toBase58(), i);
+              }
+            }
+            const recipientIdx = keyToIdx.get(recipientAddress);
+            if (recipientIdx === void 0) {
+              continue;
+            }
+            const recipientDelta = (tx.meta.postBalances[recipientIdx] ?? 0) - (tx.meta.preBalances[recipientIdx] ?? 0);
+            if (recipientDelta < expectedNet) {
+              continue;
+            }
+            if (expectedFee > 0) {
+              const treasuryIdx = keyToIdx.get(PROTOCOL_TREASURY);
+              if (treasuryIdx === void 0) {
+                continue;
+              }
+              const treasuryDelta = (tx.meta.postBalances[treasuryIdx] ?? 0) - (tx.meta.preBalances[treasuryIdx] ?? 0);
+              if (treasuryDelta < expectedFee) {
+                continue;
+              }
+            }
+            return { verified: true, txSignature: sig };
+          }
+        }
+      } catch (err) {
+        lastError = err;
+      }
+      if (attempt < retries - 1) {
+        await new Promise((r) => setTimeout(r, intervalMs));
+      }
     }
-    return new _ElisymIdentity(bytes);
+    return {
+      verified: false,
+      error: lastError ? `Verification failed: ${lastError instanceof Error ? lastError.message : "unknown error"}` : "No matching transaction found for reference key"
+    };
   }
 };
 function toDTag(name) {
-  return name.toLowerCase().replace(/\s+/g, "-");
+  const tag = name.toLowerCase().replace(/[^a-z0-9\s-]/g, (ch) => "_" + ch.charCodeAt(0).toString(16).padStart(2, "0")).replace(/\s+/g, "-").replace(/^-+|-+$/g, "");
+  if (!tag) {
+    throw new Error("Capability name must contain at least one ASCII alphanumeric character.");
+  }
+  return tag;
 }
 function buildAgentsFromEvents(events, network) {
   const latestByDTag = /* @__PURE__ */ new Map();
   for (const event of events) {
+    if (!nostrTools.verifyEvent(event)) {
+      continue;
+    }
     const dTag = event.tags.find((t) => t[0] === "d")?.[1] ?? "";
     const key = `${event.pubkey}:${dTag}`;
     const prev = latestByDTag.get(key);
@@ -257,10 +522,36 @@ function buildAgentsFromEvents(events, network) {
   const accumMap = /* @__PURE__ */ new Map();
   for (const event of latestByDTag.values()) {
     try {
-      const card = JSON.parse(event.content);
-      if (!card.name || card.deleted) continue;
+      if (!event.content) {
+        continue;
+      }
+      const raw = JSON.parse(event.content);
+      if (!raw || typeof raw !== "object") {
+        continue;
+      }
+      if (typeof raw.name !== "string" || !raw.name) {
+        continue;
+      }
+      if (typeof raw.description !== "string") {
+        continue;
+      }
+      if (!Array.isArray(raw.capabilities) || !raw.capabilities.every((c) => typeof c === "string")) {
+        continue;
+      }
+      if (raw.deleted) {
+        continue;
+      }
+      const card = raw;
+      if (card.payment && (typeof card.payment.chain !== "string" || typeof card.payment.network !== "string" || typeof card.payment.address !== "string")) {
+        continue;
+      }
+      if (card.payment?.job_price !== null && card.payment?.job_price !== void 0 && (!Number.isInteger(card.payment.job_price) || card.payment.job_price < 0)) {
+        continue;
+      }
       const agentNetwork = card.payment?.network ?? "devnet";
-      if (agentNetwork !== network) continue;
+      if (agentNetwork !== network) {
+        continue;
+      }
       const kTags = event.tags.filter((t) => t[0] === "k").map((t) => parseInt(t[1] ?? "", 10)).filter((k) => !isNaN(k));
       const entry = { card, kTags, createdAt: event.created_at };
       const existing = accumMap.get(event.pubkey);
@@ -291,12 +582,13 @@ function buildAgentsFromEvents(events, network) {
   }
   const agentMap = /* @__PURE__ */ new Map();
   for (const [pubkey, acc] of accumMap) {
-    const supportedKinds = [];
+    const kindsSet = /* @__PURE__ */ new Set();
     for (const e of acc.entries) {
       for (const k of e.kTags) {
-        if (!supportedKinds.includes(k)) supportedKinds.push(k);
+        kindsSet.add(k);
       }
     }
+    const supportedKinds = [...kindsSet];
     agentMap.set(pubkey, {
       pubkey: acc.pubkey,
       npub: acc.npub,
@@ -312,23 +604,28 @@ var DiscoveryService = class {
   constructor(pool) {
     this.pool = pool;
   }
-  // Instance-level set — avoids module-level state leak across clients
-  allSeenAgents = /* @__PURE__ */ new Set();
   /** Count elisym agents (kind:31990 with "elisym" tag). */
   async fetchAllAgentCount() {
     const events = await this.pool.querySync({
       kinds: [KIND_APP_HANDLER],
       "#t": ["elisym"]
     });
+    const uniquePubkeys = /* @__PURE__ */ new Set();
     for (const event of events) {
-      this.allSeenAgents.add(event.pubkey);
+      if (!nostrTools.verifyEvent(event)) {
+        continue;
+      }
+      uniquePubkeys.add(event.pubkey);
     }
-    return this.allSeenAgents.size;
+    return uniquePubkeys.size;
   }
   /**
    * Fetch a single page of elisym agents with relay-side pagination.
    * Uses `until` cursor for Nostr cursor-based pagination.
-   * Does NOT fetch activity (faster than fetchAgents).
+   *
+   * Unlike `fetchAgents`, this method does NOT enrich agents with
+   * kind:0 metadata (name, picture, about) or update `lastSeen` from
+   * recent job activity. Call `enrichWithMetadata()` separately if needed.
    */
   async fetchAgentsPage(network = "devnet", limit = 20, until) {
     const filter = {
@@ -348,21 +645,24 @@ var DiscoveryService = class {
       }
     }
     const agentMap = buildAgentsFromEvents(events, network);
-    const agents = Array.from(agentMap.values()).sort(
-      (a, b) => b.lastSeen - a.lastSeen
-    );
+    const agents = Array.from(agentMap.values()).sort((a, b) => b.lastSeen - a.lastSeen);
     return { agents, oldestCreatedAt, rawEventCount };
   }
   /** Enrich agents with kind:0 metadata (name, picture, about). Mutates in place and returns the same array. */
   async enrichWithMetadata(agents) {
     const pubkeys = agents.map((a) => a.pubkey);
-    if (pubkeys.length === 0) return agents;
+    if (pubkeys.length === 0) {
+      return agents;
+    }
     const metaEvents = await this.pool.queryBatched(
       { kinds: [0] },
       pubkeys
     );
     const latestMeta = /* @__PURE__ */ new Map();
     for (const ev of metaEvents) {
+      if (!nostrTools.verifyEvent(ev)) {
+        continue;
+      }
       const prev = latestMeta.get(ev.pubkey);
       if (!prev || ev.created_at > prev.created_at) {
         latestMeta.set(ev.pubkey, ev);
@@ -371,12 +671,20 @@ var DiscoveryService = class {
     const agentLookup = new Map(agents.map((a) => [a.pubkey, a]));
     for (const [pubkey, ev] of latestMeta) {
       const agent = agentLookup.get(pubkey);
-      if (!agent) continue;
+      if (!agent) {
+        continue;
+      }
       try {
         const meta = JSON.parse(ev.content);
-        if (meta.picture) agent.picture = meta.picture;
-        if (meta.name) agent.name = meta.name;
-        if (meta.about) agent.about = meta.about;
+        if (typeof meta.picture === "string") {
+          agent.picture = meta.picture;
+        }
+        if (typeof meta.name === "string") {
+          agent.name = meta.name;
+        }
+        if (typeof meta.about === "string") {
+          agent.about = meta.about;
+        }
       } catch {
       }
     }
@@ -388,9 +696,12 @@ var DiscoveryService = class {
       kinds: [KIND_APP_HANDLER],
       "#t": ["elisym"]
     };
-    if (limit !== void 0) filter.limit = limit;
+    if (limit !== void 0) {
+      filter.limit = limit;
+    }
     const events = await this.pool.querySync(filter);
     const agentMap = buildAgentsFromEvents(events, network);
+    const agents = Array.from(agentMap.values()).sort((a, b) => b.lastSeen - a.lastSeen);
     const agentPubkeys = Array.from(agentMap.keys());
     if (agentPubkeys.length > 0) {
       const activitySince = Math.floor(Date.now() / 1e3) - 24 * 60 * 60;
@@ -403,33 +714,65 @@ var DiscoveryService = class {
         }
       }
       resultKinds.add(jobResultKind(DEFAULT_KIND_OFFSET));
-      const activityEvents = await this.pool.queryBatched(
-        {
-          kinds: [...resultKinds, KIND_JOB_FEEDBACK],
-          since: activitySince
-        },
-        agentPubkeys
-      );
+      const [activityEvents] = await Promise.all([
+        this.pool.queryBatched(
+          {
+            kinds: [...resultKinds, KIND_JOB_FEEDBACK],
+            since: activitySince
+          },
+          agentPubkeys
+        ),
+        this.enrichWithMetadata(agents)
+      ]);
       for (const ev of activityEvents) {
+        if (!nostrTools.verifyEvent(ev)) {
+          continue;
+        }
         const agent = agentMap.get(ev.pubkey);
         if (agent && ev.created_at > agent.lastSeen) {
           agent.lastSeen = ev.created_at;
         }
       }
+      agents.sort((a, b) => b.lastSeen - a.lastSeen);
     }
-    const agents = Array.from(agentMap.values()).sort(
-      (a, b) => b.lastSeen - a.lastSeen
-    );
-    await this.enrichWithMetadata(agents);
     return agents;
   }
-  /** Publish a capability card (kind:31990) as a provider. */
+  /**
+   * Publish a capability card (kind:31990) as a provider.
+   * Solana address is validated for Base58 format only - full decode
+   * validation (32-byte public key) happens at payment time.
+   */
   async publishCapability(identity, card, kinds = [KIND_JOB_REQUEST]) {
     if (!card.payment?.address) {
       throw new Error(
         "Cannot publish capability without a payment address. Connect a wallet before publishing."
       );
     }
+    if (card.payment.chain === "solana" && !/^[1-9A-HJ-NP-Za-km-z]{32,44}$/.test(card.payment.address)) {
+      throw new Error(`Invalid Solana address format: ${card.payment.address}`);
+    }
+    if (card.name.length > LIMITS.MAX_AGENT_NAME_LENGTH) {
+      throw new Error(
+        `Agent name too long: ${card.name.length} chars (max ${LIMITS.MAX_AGENT_NAME_LENGTH}).`
+      );
+    }
+    if (card.description.length > LIMITS.MAX_DESCRIPTION_LENGTH) {
+      throw new Error(
+        `Description too long: ${card.description.length} chars (max ${LIMITS.MAX_DESCRIPTION_LENGTH}).`
+      );
+    }
+    if (card.capabilities.length > LIMITS.MAX_CAPABILITIES) {
+      throw new Error(
+        `Too many capabilities: ${card.capabilities.length} (max ${LIMITS.MAX_CAPABILITIES}).`
+      );
+    }
+    for (const cap of card.capabilities) {
+      if (cap.length > LIMITS.MAX_CAPABILITY_LENGTH) {
+        throw new Error(
+          `Capability name too long: "${cap}" (${cap.length} chars, max ${LIMITS.MAX_CAPABILITY_LENGTH}).`
+        );
+      }
+    }
     const tags = [
       ["d", toDTag(card.name)],
       ["t", "elisym"],
@@ -445,13 +788,28 @@ var DiscoveryService = class {
       },
       identity.secretKey
     );
-    await this.pool.publish(event);
+    await this.pool.publishAll(event);
     return event.id;
   }
   /** Publish a Nostr profile (kind:0) as a provider. */
-  async publishProfile(identity, name, about, picture) {
+  async publishProfile(identity, name, about, picture, banner) {
+    if (name.length > LIMITS.MAX_AGENT_NAME_LENGTH) {
+      throw new Error(
+        `Profile name too long: ${name.length} chars (max ${LIMITS.MAX_AGENT_NAME_LENGTH}).`
+      );
+    }
+    if (about.length > LIMITS.MAX_DESCRIPTION_LENGTH) {
+      throw new Error(
+        `Profile about too long: ${about.length} chars (max ${LIMITS.MAX_DESCRIPTION_LENGTH}).`
+      );
+    }
     const content = { name, about };
-    if (picture) content.picture = picture;
+    if (picture) {
+      content.picture = picture;
+    }
+    if (banner) {
+      content.banner = banner;
+    }
     const event = nostrTools.finalizeEvent(
       {
         kind: 0,
@@ -461,7 +819,7 @@ var DiscoveryService = class {
       },
       identity.secretKey
     );
-    await this.pool.publish(event);
+    await this.pool.publishAll(event);
     return event.id;
   }
   /**
@@ -488,20 +846,40 @@ var DiscoveryService = class {
     return event.id;
   }
 };
-function isEncrypted(event) {
-  return event.tags.some((t) => t[0] === "encrypted" && t[1] === "nip44");
-}
-function nip44Encrypt(plaintext, secretKey, recipientPubkey) {
-  const conversationKey = nip44__namespace.v2.utils.getConversationKey(secretKey, recipientPubkey);
+function nip44Encrypt(plaintext, senderSk, recipientPubkey) {
+  const conversationKey = nip44__namespace.v2.utils.getConversationKey(senderSk, recipientPubkey);
   return nip44__namespace.v2.encrypt(plaintext, conversationKey);
 }
-function nip44Decrypt(ciphertext, secretKey, senderPubkey) {
-  const conversationKey = nip44__namespace.v2.utils.getConversationKey(secretKey, senderPubkey);
+function nip44Decrypt(ciphertext, receiverSk, senderPubkey) {
+  const conversationKey = nip44__namespace.v2.utils.getConversationKey(receiverSk, senderPubkey);
   return nip44__namespace.v2.decrypt(ciphertext, conversationKey);
 }
+
+// src/services/marketplace.ts
+function isEncrypted(event) {
+  return event.tags.some((t) => t[0] === "encrypted" && t[1] === "nip44");
+}
 function resolveRequestId(event) {
   return event.tags.find((t) => t[0] === "e")?.[1];
 }
+function safeParseInt(value) {
+  if (!value) {
+    return void 0;
+  }
+  const n = parseInt(value, 10);
+  return isNaN(n) ? void 0 : n;
+}
+var VALID_JOB_STATUSES = /* @__PURE__ */ new Set([
+  "payment-required",
+  "payment-completed",
+  "processing",
+  "error",
+  "success",
+  "partial"
+]);
+function toJobStatus(raw) {
+  return VALID_JOB_STATUSES.has(raw) ? raw : "unknown";
+}
 var MarketplaceService = class {
   constructor(pool) {
     this.pool = pool;
@@ -511,11 +889,21 @@ var MarketplaceService = class {
     if (!options.input) {
       throw new Error("Job input must not be empty.");
     }
+    if (options.input.length > LIMITS.MAX_INPUT_LENGTH) {
+      throw new Error(
+        `Job input too long: ${options.input.length} chars (max ${LIMITS.MAX_INPUT_LENGTH}).`
+      );
+    }
+    if (!options.capability || options.capability.length > LIMITS.MAX_CAPABILITY_LENGTH) {
+      throw new Error(`Invalid capability: must be 1-${LIMITS.MAX_CAPABILITY_LENGTH} characters.`);
+    }
+    if (options.providerPubkey && !/^[0-9a-f]{64}$/.test(options.providerPubkey)) {
+      throw new Error("Invalid provider pubkey: expected 64 hex characters.");
+    }
     const plaintext = options.input;
     const encrypted = options.providerPubkey ? nip44Encrypt(plaintext, identity.secretKey, options.providerPubkey) : plaintext;
-    const iValue = options.providerPubkey ? "encrypted" : "";
     const tags = [
-      ["i", iValue, "text"],
+      ["i", options.providerPubkey ? "encrypted" : "text", "text"],
       ["t", options.capability],
       ["t", "elisym"],
       ["output", "text/plain"]
@@ -539,80 +927,148 @@ var MarketplaceService = class {
   }
   /**
    * Subscribe to job updates (feedback + results) for a given job.
-   * Returns a cleanup function.
+   * Creates 3 subscriptions per call (feedback, result by #e, result by #p+#e)
+   * to cover different relay indexing strategies. Returns a cleanup function.
    */
-  subscribeToJobUpdates(jobEventId, providerPubkey, customerPublicKey, callbacks, timeoutMs = 12e4, customerSecretKey, kindOffsets) {
-    const offsets = kindOffsets ?? [DEFAULT_KIND_OFFSET];
+  subscribeToJobUpdates(options) {
+    const {
+      jobEventId: jid,
+      providerPubkey: provPk,
+      customerPublicKey: custPk,
+      callbacks: cb,
+      timeoutMs = DEFAULTS.SUBSCRIPTION_TIMEOUT_MS,
+      customerSecretKey: custSk,
+      kindOffsets: offsets_,
+      sinceOverride: since_
+    } = options;
+    const offsets = offsets_ ?? [DEFAULT_KIND_OFFSET];
+    if (offsets.length === 0) {
+      throw new Error("kindOffsets must not be empty.");
+    }
     const resultKinds = offsets.map(jobResultKind);
-    const since = Math.floor(Date.now() / 1e3) - 5;
+    const since = since_ ?? Math.floor(Date.now() / 1e3) - 30;
     const subs = [];
     let resolved = false;
     let resultDelivered = false;
     let timer;
     const done = () => {
       resolved = true;
-      if (timer) clearTimeout(timer);
-      for (const s of subs) s.close();
+      if (timer) {
+        clearTimeout(timer);
+      }
+      for (const s of subs) {
+        try {
+          s.close();
+        } catch {
+        }
+      }
     };
     const decryptResult = (ev) => {
-      if (customerSecretKey && isEncrypted(ev)) {
+      if (isEncrypted(ev)) {
+        if (!custSk) {
+          return null;
+        }
         try {
-          return nip44Decrypt(ev.content, customerSecretKey, ev.pubkey);
+          return nip44Decrypt(ev.content, custSk, ev.pubkey);
         } catch {
-          return ev.content;
+          return null;
         }
       }
       return ev.content;
     };
     const handleResult = (ev) => {
-      if (resolved || resultDelivered) return;
-      if (providerPubkey && ev.pubkey !== providerPubkey) return;
+      if (resolved || resultDelivered) {
+        return;
+      }
+      if (!nostrTools.verifyEvent(ev)) {
+        return;
+      }
+      if (provPk && ev.pubkey !== provPk) {
+        return;
+      }
+      const eTag = ev.tags.find((t) => t[0] === "e")?.[1];
+      if (eTag !== jid) {
+        return;
+      }
+      const content = decryptResult(ev);
+      if (content === null) {
+        return;
+      }
       resultDelivered = true;
-      callbacks.onResult?.(decryptResult(ev), ev.id);
-      done();
-    };
-    const feedbackSub = this.pool.subscribe(
-      {
-        kinds: [KIND_JOB_FEEDBACK],
-        "#e": [jobEventId],
-        since
-      },
-      (ev) => {
-        if (resolved) return;
-        if (providerPubkey && ev.pubkey !== providerPubkey) return;
-        const statusTag = ev.tags.find((t) => t[0] === "status");
-        if (statusTag?.[1] === "payment-required") {
-          const amtTag = ev.tags.find((t) => t[0] === "amount");
-          const amt = amtTag?.[1] ? parseInt(amtTag[1], 10) : 0;
-          const paymentReq = amtTag?.[2];
-          callbacks.onFeedback?.("payment-required", amt, paymentReq);
-        }
+      try {
+        cb.onResult?.(content, ev.id);
+      } catch {
+      } finally {
+        done();
       }
-    );
-    subs.push(feedbackSub);
-    const resultSub = this.pool.subscribe(
-      {
-        kinds: resultKinds,
-        "#e": [jobEventId],
-        since
-      },
-      handleResult
-    );
-    subs.push(resultSub);
-    const resultSub2 = this.pool.subscribe(
-      {
-        kinds: resultKinds,
-        "#p": [customerPublicKey],
-        "#e": [jobEventId],
-        since
-      },
-      handleResult
-    );
-    subs.push(resultSub2);
+    };
+    try {
+      subs.push(
+        this.pool.subscribe(
+          {
+            kinds: [KIND_JOB_FEEDBACK],
+            "#e": [jid],
+            since
+          },
+          (ev) => {
+            if (resolved) {
+              return;
+            }
+            if (!nostrTools.verifyEvent(ev)) {
+              return;
+            }
+            if (provPk && ev.pubkey !== provPk) {
+              return;
+            }
+            const eTag = ev.tags.find((t) => t[0] === "e")?.[1];
+            if (eTag !== jid) {
+              return;
+            }
+            const statusTag = ev.tags.find((t) => t[0] === "status");
+            if (statusTag?.[1]) {
+              const amtTag = ev.tags.find((t) => t[0] === "amount");
+              const amt = safeParseInt(amtTag?.[1]) ?? 0;
+              const paymentReq = amtTag?.[2];
+              try {
+                cb.onFeedback?.(statusTag[1], amt, paymentReq, ev.pubkey);
+              } catch {
+              }
+            }
+          }
+        )
+      );
+      subs.push(
+        this.pool.subscribe(
+          {
+            kinds: resultKinds,
+            "#e": [jid],
+            since
+          },
+          handleResult
+        )
+      );
+      subs.push(
+        this.pool.subscribe(
+          {
+            kinds: resultKinds,
+            "#p": [custPk],
+            "#e": [jid],
+            since
+          },
+          handleResult
+        )
+      );
+    } catch (err) {
+      done();
+      throw err;
+    }
     timer = setTimeout(() => {
       if (!resolved) {
         done();
-        callbacks.onError?.(`Timed out waiting for response (${timeoutMs / 1e3}s).`);
+        try {
+          cb.onError?.(`Timed out waiting for response (${timeoutMs / 1e3}s).`);
+        } catch {
+        }
       }
     }, timeoutMs);
     return done;
@@ -634,7 +1090,7 @@ var MarketplaceService = class {
       },
       identity.secretKey
     );
-    await this.pool.publish(event);
+    await this.pool.publishAll(event);
   }
   /** Submit rating feedback for a job. */
   async submitFeedback(identity, jobEventId, providerPubkey, positive, capability) {
@@ -645,7 +1101,9 @@ var MarketplaceService = class {
       ["rating", positive ? "1" : "0"],
       ["t", "elisym"]
     ];
-    if (capability) tags.push(["t", capability]);
+    if (capability) {
+      tags.push(["t", capability]);
+    }
     const event = nostrTools.finalizeEvent(
       {
         kind: KIND_JOB_FEEDBACK,
@@ -655,31 +1113,67 @@ var MarketplaceService = class {
       },
       identity.secretKey
     );
-    await this.pool.publish(event);
+    await this.pool.publishAll(event);
   }
   // --- Provider methods ---
-  /** Subscribe to incoming job requests for specific kinds. */
+  /**
+   * Subscribe to incoming job requests for specific kinds.
+   * Automatically decrypts NIP-44 encrypted content.
+   * Note: decrypted events have modified `content` - do not call `verifyEvent()` on them.
+   * Signature verification is performed before decryption.
+   */
   subscribeToJobRequests(identity, kinds, onRequest) {
     return this.pool.subscribe(
       {
         kinds,
         "#p": [identity.publicKey],
-        since: Math.floor(Date.now() / 1e3)
+        "#t": ["elisym"],
+        since: Math.floor(Date.now() / 1e3) - 5
       },
-      onRequest
+      (event) => {
+        if (!nostrTools.verifyEvent(event)) {
+          return;
+        }
+        if (isEncrypted(event) && event.content) {
+          try {
+            const decrypted = nip44Decrypt(event.content, identity.secretKey, event.pubkey);
+            onRequest({ ...event, content: decrypted });
+          } catch {
+            return;
+          }
+        } else {
+          onRequest(event);
+        }
+      }
     );
   }
   /** Submit a job result with NIP-44 encrypted content. Result kind is derived from the request kind. */
   async submitJobResult(identity, requestEvent, content, amount) {
-    const encrypted = nip44Encrypt(content, identity.secretKey, requestEvent.pubkey);
-    const resultKind = KIND_JOB_RESULT_BASE + (requestEvent.kind - KIND_JOB_REQUEST_BASE);
+    if (!content) {
+      throw new Error("Job result content must not be empty.");
+    }
+    if (!Number.isInteger(requestEvent.kind)) {
+      throw new Error(`Invalid request event kind: expected integer, got ${requestEvent.kind}.`);
+    }
+    const offset = requestEvent.kind - KIND_JOB_REQUEST_BASE;
+    if (offset < 0 || offset >= 1e3) {
+      throw new Error(
+        `Invalid request event kind ${requestEvent.kind}: expected a NIP-90 job request kind (5000-5999).`
+      );
+    }
+    const shouldEncrypt = isEncrypted(requestEvent);
+    const resultContent = shouldEncrypt ? nip44Encrypt(content, identity.secretKey, requestEvent.pubkey) : content;
+    const resultKind = KIND_JOB_RESULT_BASE + offset;
     const tags = [
       ["e", requestEvent.id],
       ["p", requestEvent.pubkey],
-      ["t", "elisym"],
-      ["encrypted", "nip44"]
+      ["t", "elisym"]
     ];
-    if (amount != null) {
+    if (shouldEncrypt) {
+      tags.push(["encrypted", "nip44"]);
+    }
+    if (amount !== null && amount !== void 0) {
+      assertLamports(amount, "result amount");
       tags.push(["amount", String(amount)]);
     }
     const event = nostrTools.finalizeEvent(
@@ -687,15 +1181,50 @@ var MarketplaceService = class {
         kind: resultKind,
         created_at: Math.floor(Date.now() / 1e3),
         tags,
-        content: encrypted
+        content: resultContent
       },
       identity.secretKey
     );
-    await this.pool.publish(event);
+    await this.pool.publishAll(event);
     return event.id;
   }
+  /**
+   * Submit a job result with retry and exponential backoff.
+   * Retries on publish failures (e.g. relay disconnects).
+   * With maxAttempts=3: try, ~1s, try, ~2s, try, throw.
+   * Jitter: 0.5x-1.0x of calculated delay.
+   */
+  async submitJobResultWithRetry(identity, requestEvent, content, amount, maxAttempts = DEFAULTS.RESULT_RETRY_COUNT, baseDelayMs = DEFAULTS.RESULT_RETRY_BASE_MS) {
+    const attempts = Math.max(1, maxAttempts);
+    for (let attempt = 0; attempt < attempts; attempt++) {
+      try {
+        return await this.submitJobResult(identity, requestEvent, content, amount);
+      } catch (e) {
+        if (attempt >= attempts - 1) {
+          throw e;
+        }
+        const jitter = 0.5 + Math.random() * 0.5;
+        await new Promise((r) => setTimeout(r, baseDelayMs * Math.pow(2, attempt) * jitter));
+      }
+    }
+    throw new Error("All delivery attempts failed");
+  }
   /** Submit payment-required feedback with a payment request. */
   async submitPaymentRequiredFeedback(identity, requestEvent, amount, paymentRequestJson) {
+    assertLamports(amount, "payment amount");
+    if (amount === 0) {
+      throw new Error("Invalid payment amount: 0. Must be positive.");
+    }
+    try {
+      JSON.parse(paymentRequestJson);
+    } catch {
+      throw new Error("Invalid paymentRequestJson: must be valid JSON.");
+    }
+    if (paymentRequestJson.length > LIMITS.MAX_INPUT_LENGTH) {
+      throw new Error(
+        `paymentRequestJson too long: ${paymentRequestJson.length} chars (max ${LIMITS.MAX_INPUT_LENGTH}).`
+      );
+    }
     const event = nostrTools.finalizeEvent(
       {
         kind: KIND_JOB_FEEDBACK,
@@ -711,74 +1240,193 @@ var MarketplaceService = class {
       },
       identity.secretKey
     );
-    await this.pool.publish(event);
+    await this.pool.publishAll(event);
+  }
+  /** Submit processing feedback to notify customer that work has started. */
+  async submitProcessingFeedback(identity, requestEvent) {
+    const event = nostrTools.finalizeEvent(
+      {
+        kind: KIND_JOB_FEEDBACK,
+        created_at: Math.floor(Date.now() / 1e3),
+        tags: [
+          ["e", requestEvent.id],
+          ["p", requestEvent.pubkey],
+          ["status", "processing"],
+          ["t", "elisym"]
+        ],
+        content: ""
+      },
+      identity.secretKey
+    );
+    await this.pool.publishAll(event);
+  }
+  /** Submit error feedback to notify customer of a failure. */
+  async submitErrorFeedback(identity, requestEvent, message) {
+    if (!message) {
+      throw new Error("Error message must not be empty.");
+    }
+    if (message.length > LIMITS.MAX_INPUT_LENGTH) {
+      throw new Error(
+        `Error message too long: ${message.length} chars (max ${LIMITS.MAX_INPUT_LENGTH}).`
+      );
+    }
+    const event = nostrTools.finalizeEvent(
+      {
+        kind: KIND_JOB_FEEDBACK,
+        created_at: Math.floor(Date.now() / 1e3),
+        tags: [
+          ["e", requestEvent.id],
+          ["p", requestEvent.pubkey],
+          ["status", "error"],
+          ["t", "elisym"]
+        ],
+        content: message
+      },
+      identity.secretKey
+    );
+    await this.pool.publishAll(event);
+  }
+  /** Query job results by request IDs and decrypt NIP-44 content. */
+  async queryJobResults(identity, requestIds, kindOffsets, providerPubkey) {
+    const offsets = kindOffsets ?? [DEFAULT_KIND_OFFSET];
+    if (offsets.length === 0) {
+      throw new Error("kindOffsets must not be empty.");
+    }
+    const resultKinds = offsets.map(jobResultKind);
+    const results = await this.pool.queryBatchedByTag(
+      { kinds: resultKinds },
+      "e",
+      requestIds
+    );
+    const resultByRequest = /* @__PURE__ */ new Map();
+    const createdAtByRequest = /* @__PURE__ */ new Map();
+    for (const r of results) {
+      if (!nostrTools.verifyEvent(r)) {
+        continue;
+      }
+      if (providerPubkey && r.pubkey !== providerPubkey) {
+        continue;
+      }
+      const eTag = r.tags.find((t) => t[0] === "e");
+      if (!eTag?.[1]) {
+        continue;
+      }
+      const prevTs = createdAtByRequest.get(eTag[1]) ?? 0;
+      if (r.created_at < prevTs) {
+        continue;
+      }
+      const amtTag = r.tags.find((t) => t[0] === "amount");
+      let content = r.content;
+      let decryptionFailed = false;
+      if (isEncrypted(r)) {
+        try {
+          content = nip44Decrypt(r.content, identity.secretKey, r.pubkey);
+        } catch {
+          content = "";
+          decryptionFailed = true;
+        }
+      }
+      createdAtByRequest.set(eTag[1], r.created_at);
+      resultByRequest.set(eTag[1], {
+        content,
+        amount: safeParseInt(amtTag?.[1]),
+        senderPubkey: r.pubkey,
+        decryptionFailed
+      });
+    }
+    return resultByRequest;
   }
   // --- Query methods ---
-  /** Fetch recent jobs from the network. */
+  /**
+   * Fetch recent jobs from the network.
+   * NOTE: Job.result contains raw event content. For encrypted jobs,
+   * this will be NIP-44 ciphertext - use queryJobResults() for decryption.
+   */
   async fetchRecentJobs(agentPubkeys, limit, since, kindOffsets) {
     const offsets = kindOffsets ?? [DEFAULT_KIND_OFFSET];
+    if (offsets.length === 0) {
+      throw new Error("kindOffsets must not be empty.");
+    }
     const requestKinds = offsets.map(jobRequestKind);
     const resultKinds = offsets.map(jobResultKind);
     const reqFilter = {
       kinds: requestKinds,
       "#t": ["elisym"],
-      ...limit != null && { limit },
-      ...since != null && { since }
+      ...limit !== null && limit !== void 0 && { limit },
+      ...since !== null && since !== void 0 && { since }
     };
-    const requests = await this.pool.querySync(reqFilter);
+    const rawRequests = await this.pool.querySync(reqFilter);
+    const requests = rawRequests.filter(nostrTools.verifyEvent);
     const requestIds = requests.map((r) => r.id);
     let results = [];
     let feedbacks = [];
     if (requestIds.length > 0) {
-      const [resultArrays, feedbackArrays] = await Promise.all([
-        this.pool.queryBatchedByTag(
-          { kinds: resultKinds },
-          "e",
-          requestIds
-        ),
-        this.pool.queryBatchedByTag(
-          { kinds: [KIND_JOB_FEEDBACK] },
-          "e",
-          requestIds
-        )
+      const [rawResults, rawFeedbacks] = await Promise.all([
+        this.pool.queryBatchedByTag({ kinds: resultKinds }, "e", requestIds),
+        this.pool.queryBatchedByTag({ kinds: [KIND_JOB_FEEDBACK] }, "e", requestIds)
       ]);
-      results = resultArrays;
-      feedbacks = feedbackArrays;
+      results = rawResults.filter(nostrTools.verifyEvent);
+      feedbacks = rawFeedbacks.filter(nostrTools.verifyEvent);
     }
     const targetedAgentByRequest = /* @__PURE__ */ new Map();
     for (const req of requests) {
       const pTag = req.tags.find((t) => t[0] === "p");
-      if (pTag?.[1]) targetedAgentByRequest.set(req.id, pTag[1]);
+      if (pTag?.[1]) {
+        targetedAgentByRequest.set(req.id, pTag[1]);
+      }
     }
     const resultsByRequest = /* @__PURE__ */ new Map();
     for (const r of results) {
       const reqId = resolveRequestId(r);
-      if (!reqId) continue;
+      if (!reqId) {
+        continue;
+      }
       const targeted = targetedAgentByRequest.get(reqId);
-      if (targeted && r.pubkey !== targeted) continue;
+      if (targeted && r.pubkey !== targeted) {
+        continue;
+      }
       const existing = resultsByRequest.get(reqId);
-      if (!existing || targeted && r.pubkey === targeted) {
+      if (!existing || r.created_at > existing.created_at) {
         resultsByRequest.set(reqId, r);
       }
     }
     const feedbackByRequest = /* @__PURE__ */ new Map();
     for (const f of feedbacks) {
       const reqId = resolveRequestId(f);
-      if (!reqId) continue;
+      if (!reqId) {
+        continue;
+      }
       const targeted = targetedAgentByRequest.get(reqId);
-      if (targeted && f.pubkey !== targeted) continue;
+      if (targeted && f.pubkey !== targeted) {
+        continue;
+      }
       const existing = feedbackByRequest.get(reqId);
-      if (!existing || targeted && f.pubkey === targeted) {
+      if (!existing || f.created_at > existing.created_at) {
         feedbackByRequest.set(reqId, f);
       }
     }
+    const feedbacksByRequestId = /* @__PURE__ */ new Map();
+    for (const f of feedbacks) {
+      const reqId = resolveRequestId(f);
+      if (!reqId) {
+        continue;
+      }
+      const arr = feedbacksByRequestId.get(reqId);
+      if (arr) {
+        arr.push(f);
+      } else {
+        feedbacksByRequestId.set(reqId, [f]);
+      }
+    }
     const jobs = [];
     for (const req of requests) {
       const result = resultsByRequest.get(req.id);
       const feedback = feedbackByRequest.get(req.id);
       const jobAgentPubkey = result?.pubkey ?? feedback?.pubkey;
       if (agentPubkeys && agentPubkeys.size > 0 && jobAgentPubkey) {
-        if (!agentPubkeys.has(jobAgentPubkey)) continue;
+        if (!agentPubkeys.has(jobAgentPubkey)) {
+          continue;
+        }
       }
       const capability = req.tags.find((t) => t[0] === "t" && t[1] !== "elisym")?.[1];
       const bid = req.tags.find((t) => t[0] === "bid")?.[1];
@@ -788,11 +1436,9 @@ var MarketplaceService = class {
       if (result) {
         status = "success";
         const amtTag = result.tags.find((t) => t[0] === "amount");
-        if (amtTag?.[1]) amount = parseInt(amtTag[1], 10);
+        amount = safeParseInt(amtTag?.[1]);
       }
-      const allFeedbacksForReq = feedbacks.filter(
-        (f) => resolveRequestId(f) === req.id
-      );
+      const allFeedbacksForReq = feedbacksByRequestId.get(req.id) ?? [];
       for (const fb of allFeedbacksForReq) {
         const txTag = fb.tags.find((t) => t[0] === "tx");
         if (txTag?.[1]) {
@@ -806,13 +1452,13 @@ var MarketplaceService = class {
           if (statusTag?.[1]) {
             const isTargeted = targetedAgentByRequest.has(req.id);
             if (statusTag[1] === "payment-required" && !bid && !isTargeted) ; else {
-              status = statusTag[1];
+              status = toJobStatus(statusTag[1]);
             }
           }
         }
         if (!amount) {
           const amtTag = feedback.tags.find((t) => t[0] === "amount");
-          if (amtTag?.[1]) amount = parseInt(amtTag[1], 10);
+          amount = safeParseInt(amtTag?.[1]);
         }
       }
       jobs.push({
@@ -820,7 +1466,7 @@ var MarketplaceService = class {
         customer: req.pubkey,
         agentPubkey: jobAgentPubkey,
         capability,
-        bid: bid ? parseInt(bid, 10) : void 0,
+        bid: safeParseInt(bid),
         status,
         result: result?.content,
         resultEventId: result?.id,
@@ -839,96 +1485,285 @@ var MarketplaceService = class {
         "#t": ["elisym"],
         since: Math.floor(Date.now() / 1e3)
       },
-      onEvent
+      (event) => {
+        if (!nostrTools.verifyEvent(event)) {
+          return;
+        }
+        onEvent(event);
+      }
     );
   }
 };
-var MessagingService = class _MessagingService {
-  // 30s
-  constructor(pool) {
-    this.pool = pool;
-    this.sessionIdentity = ElisymIdentity.generate();
+var KIND_HTTP_AUTH = 27235;
+var DEFAULT_UPLOAD_URL = "https://nostr.build/api/v2/upload/files";
+var MediaService = class {
+  constructor(uploadUrl = DEFAULT_UPLOAD_URL) {
+    this.uploadUrl = uploadUrl;
   }
-  sessionIdentity;
-  pingCache = /* @__PURE__ */ new Map();
-  // pubkey → timestamp of last online result
-  pendingPings = /* @__PURE__ */ new Map();
-  // dedup in-flight pings
-  static PING_CACHE_TTL = 3e4;
   /**
-   * Ping an agent via ephemeral Nostr events (kind 20200/20201).
-   * Uses a persistent session identity to avoid relay rate-limiting.
-   * Publishes to ALL relays for maximum delivery reliability.
-   * Caches results for 30s to prevent redundant publishes.
+   * Upload a file with NIP-98 authentication.
+   * Works with browser File objects and Node.js/Bun Blobs.
+   *
+   * @param identity - Nostr identity used to sign the NIP-98 auth event.
+   * @param file - File or Blob to upload.
+   * @param filename - Optional filename for the upload (defaults to "upload").
+   * @returns URL of the uploaded file.
    */
-  async pingAgent(agentPubkey, timeoutMs = 15e3, signal) {
-    const cachedAt = this.pingCache.get(agentPubkey);
-    if (cachedAt && Date.now() - cachedAt < _MessagingService.PING_CACHE_TTL) {
-      console.log(`[ping] cache hit for ${agentPubkey.slice(0, 8)}: online`);
-      return { online: true, identity: this.sessionIdentity };
+  async upload(identity, file, filename) {
+    const hashBuffer = await crypto.subtle.digest("SHA-256", await file.arrayBuffer());
+    const hashHex = [...new Uint8Array(hashBuffer)].map((b) => b.toString(16).padStart(2, "0")).join("");
+    const authEvent = nostrTools.finalizeEvent(
+      {
+        kind: KIND_HTTP_AUTH,
+        created_at: Math.floor(Date.now() / 1e3),
+        tags: [
+          ["u", this.uploadUrl],
+          ["method", "POST"],
+          ["payload", hashHex]
+        ],
+        content: ""
+      },
+      identity.secretKey
+    );
+    const authHeader = "Nostr " + btoa(JSON.stringify(authEvent));
+    const formData = new FormData();
+    formData.append("file", file, filename ?? "upload");
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), 3e4);
+    try {
+      const res = await fetch(this.uploadUrl, {
+        method: "POST",
+        headers: { Authorization: authHeader },
+        body: formData,
+        signal: controller.signal
+      });
+      if (!res.ok) {
+        throw new Error(`Upload failed: ${res.status} ${res.statusText}`);
+      }
+      let data;
+      try {
+        data = await res.json();
+      } catch {
+        throw new Error("Invalid response from upload service.");
+      }
+      const url = data?.data?.[0]?.url;
+      if (!url) {
+        throw new Error("No URL returned from upload service.");
+      }
+      return url;
+    } finally {
+      clearTimeout(timer);
     }
-    const pending = this.pendingPings.get(agentPubkey);
-    if (pending) {
-      console.log(`[ping] dedup: reusing in-flight ping for ${agentPubkey.slice(0, 8)}`);
-      return pending;
+  }
+};
+
+// src/primitives/bounded-set.ts
+var BoundedSet = class {
+  constructor(maxSize) {
+    this.maxSize = maxSize;
+    if (maxSize <= 0) {
+      throw new Error("BoundedSet maxSize must be positive.");
     }
-    const promise = this._doPing(agentPubkey, timeoutMs, signal);
-    this.pendingPings.set(agentPubkey, promise);
-    promise.finally(() => this.pendingPings.delete(agentPubkey));
-    return promise;
+    this.items = new Array(maxSize);
+  }
+  items;
+  set = /* @__PURE__ */ new Set();
+  head = 0;
+  count = 0;
+  has(item) {
+    return this.set.has(item);
+  }
+  add(item) {
+    if (this.set.has(item)) {
+      return;
+    }
+    if (this.count >= this.maxSize) {
+      const evicted = this.items[this.head];
+      this.set.delete(evicted);
+    } else {
+      this.count++;
+    }
+    this.items[this.head] = item;
+    this.head = (this.head + 1) % this.maxSize;
+    this.set.add(item);
+  }
+};
+var ElisymIdentity = class _ElisymIdentity {
+  _secretKey;
+  publicKey;
+  npub;
+  get secretKey() {
+    return new Uint8Array(this._secretKey);
+  }
+  constructor(secretKey) {
+    this._secretKey = new Uint8Array(secretKey);
+    this.publicKey = nostrTools.getPublicKey(secretKey);
+    this.npub = nostrTools.nip19.npubEncode(this.publicKey);
+  }
+  static generate() {
+    return new _ElisymIdentity(nostrTools.generateSecretKey());
+  }
+  static fromSecretKey(sk) {
+    if (sk.length !== 32) {
+      throw new Error("Secret key must be exactly 32 bytes.");
+    }
+    return new _ElisymIdentity(sk);
+  }
+  toJSON() {
+    return { publicKey: this.publicKey, npub: this.npub };
+  }
+  /** Best-effort scrub of the secret key bytes in memory. */
+  scrub() {
+    this._secretKey.fill(0);
+  }
+  static fromHex(hex) {
+    if (hex.length !== 64 || !/^[0-9a-fA-F]{64}$/.test(hex)) {
+      throw new Error("Invalid secret key hex: expected 64 hex characters (32 bytes).");
+    }
+    const bytes = new Uint8Array(32);
+    for (let i = 0; i < 64; i += 2) {
+      bytes[i / 2] = parseInt(hex.substring(i, i + 2), 16);
+    }
+    return new _ElisymIdentity(bytes);
+  }
+};
+
+// src/services/messaging.ts
+var MessagingService = class _MessagingService {
+  // dedup in-flight pings
+  constructor(pool) {
+    this.pool = pool;
+    this.sessionIdentity = ElisymIdentity.generate();
+  }
+  static PING_CACHE_MAX = 1e3;
+  sessionIdentity;
+  pingCache = /* @__PURE__ */ new Map();
+  // pubkey - timestamp of last online result
+  pendingPings = /* @__PURE__ */ new Map();
+  /**
+   * Ping an agent via ephemeral Nostr events (kind 20200/20201).
+   * Uses a persistent session identity to avoid relay rate-limiting.
+   * Publishes to ALL relays for maximum delivery reliability.
+   * Caches results for 30s to prevent redundant publishes.
+   */
+  async pingAgent(agentPubkey, timeoutMs = DEFAULTS.PING_TIMEOUT_MS, signal, retries = DEFAULTS.PING_RETRIES) {
+    const cachedAt = this.pingCache.get(agentPubkey);
+    if (cachedAt) {
+      if (Date.now() - cachedAt < DEFAULTS.PING_CACHE_TTL_MS) {
+        return { online: true, identity: this.sessionIdentity };
+      }
+      this.pingCache.delete(agentPubkey);
+    }
+    if (this.pingCache.size > _MessagingService.PING_CACHE_MAX / 2) {
+      const now = Date.now();
+      for (const [key, ts] of this.pingCache) {
+        if (now - ts >= DEFAULTS.PING_CACHE_TTL_MS) {
+          this.pingCache.delete(key);
+        }
+      }
+    }
+    const pending = this.pendingPings.get(agentPubkey);
+    if (pending) {
+      return pending;
+    }
+    if (this.pendingPings.size >= _MessagingService.PING_CACHE_MAX) {
+      return { online: false, identity: null };
+    }
+    const promise = this._doPingWithRetry(agentPubkey, timeoutMs, retries, signal);
+    this.pendingPings.set(agentPubkey, promise);
+    promise.finally(() => this.pendingPings.delete(agentPubkey));
+    return promise;
+  }
+  async _doPingWithRetry(agentPubkey, timeoutMs, retries, signal) {
+    const attempts = retries + 1;
+    const perAttemptTimeout = Math.floor(timeoutMs / attempts);
+    for (let i = 0; i < attempts; i++) {
+      if (signal?.aborted) {
+        return { online: false, identity: null };
+      }
+      const result = await this._doPing(agentPubkey, perAttemptTimeout, signal);
+      if (result.online) {
+        return result;
+      }
+    }
+    return { online: false, identity: null };
   }
   async _doPing(agentPubkey, timeoutMs, signal) {
     const sk = this.sessionIdentity.secretKey;
     const pk = this.sessionIdentity.publicKey;
     const nonce = crypto.getRandomValues(new Uint8Array(16)).reduce((s, b) => s + b.toString(16).padStart(2, "0"), "");
-    const shortNonce = nonce.slice(0, 8);
-    const shortAgent = agentPubkey.slice(0, 8);
-    console.log(`[ping] \u2192 ping ${shortAgent} nonce=${shortNonce}`);
     if (signal?.aborted) {
       return { online: false, identity: null };
     }
-    return new Promise(async (resolve) => {
-      let resolved = false;
-      const done = (online, reason) => {
-        if (resolved) return;
-        resolved = true;
+    let resolved = false;
+    let sub;
+    let timer;
+    let resolvePing;
+    const promise = new Promise((resolve) => {
+      resolvePing = resolve;
+    });
+    const done = (online) => {
+      if (resolved) {
+        return;
+      }
+      resolved = true;
+      if (timer) {
         clearTimeout(timer);
-        sub.close();
-        signal?.removeEventListener("abort", onAbort);
-        console.log(`[ping] ${online ? "\u2713 ONLINE" : "\u2717 OFFLINE"} agent=${shortAgent} nonce=${shortNonce}${reason ? ` (${reason})` : ""}`);
-        if (online) this.pingCache.set(agentPubkey, Date.now());
-        resolve({ online, identity: online ? this.sessionIdentity : null });
-      };
-      const onAbort = () => done(false, "aborted");
-      signal?.addEventListener("abort", onAbort);
-      const sub = this.pool.subscribe(
-        { kinds: [KIND_PONG], "#p": [pk] },
-        (ev) => {
-          try {
-            const msg = JSON.parse(ev.content);
-            if (msg.type === "elisym_pong" && msg.nonce === nonce) {
-              console.log(`[ping] \u2190 pong from ${ev.pubkey.slice(0, 8)} nonce=${shortNonce}`);
-              done(true, "pong matched");
-            }
-          } catch {
+      }
+      sub?.close();
+      signal?.removeEventListener("abort", onAbort);
+      if (online) {
+        this.pingCache.delete(agentPubkey);
+        this.pingCache.set(agentPubkey, Date.now());
+        if (this.pingCache.size > _MessagingService.PING_CACHE_MAX) {
+          const oldest = this.pingCache.keys().next().value;
+          if (oldest !== void 0) {
+            this.pingCache.delete(oldest);
           }
         }
-      );
-      const pingEvent = nostrTools.finalizeEvent(
-        {
-          kind: KIND_PING,
-          created_at: Math.floor(Date.now() / 1e3),
-          tags: [["p", agentPubkey]],
-          content: JSON.stringify({ type: "elisym_ping", nonce })
-        },
-        sk
-      );
-      this.pool.publishAll(pingEvent).then(() => console.log(`[ping] \u2713 published nonce=${shortNonce}`)).catch((err) => {
-        console.error(`[ping] \u2717 publish failed nonce=${shortNonce}`, err);
-        done(false, "publish failed");
+      }
+      resolvePing({ online, identity: online ? this.sessionIdentity : null });
+    };
+    const onAbort = () => done(false);
+    signal?.addEventListener("abort", onAbort);
+    timer = setTimeout(() => done(false), timeoutMs);
+    try {
+      sub = await this.pool.subscribeAndWait({ kinds: [KIND_PONG], "#p": [pk] }, (ev) => {
+        if (!nostrTools.verifyEvent(ev)) {
+          return;
+        }
+        if (ev.pubkey !== agentPubkey) {
+          return;
+        }
+        try {
+          const msg = JSON.parse(ev.content);
+          if (msg.type === "elisym_pong" && typeof msg.nonce === "string" && msg.nonce.length === 32 && msg.nonce === nonce) {
+            done(true);
+          }
+        } catch {
+        }
       });
-      const timer = setTimeout(() => done(false, "timeout"), timeoutMs);
+    } catch {
+      done(false);
+      return promise;
+    }
+    if (resolved) {
+      sub?.close();
+      return promise;
+    }
+    const pingEvent = nostrTools.finalizeEvent(
+      {
+        kind: KIND_PING,
+        created_at: Math.floor(Date.now() / 1e3),
+        tags: [["p", agentPubkey]],
+        content: JSON.stringify({ type: "elisym_ping", nonce })
+      },
+      sk
+    );
+    this.pool.publishAll(pingEvent).catch(() => {
+      done(false);
     });
+    return promise;
   }
   /**
    * Subscribe to incoming ephemeral ping events (kind 20200).
@@ -938,9 +1773,12 @@ var MessagingService = class _MessagingService {
     return this.pool.subscribe(
       { kinds: [KIND_PING], "#p": [identity.publicKey] },
       (ev) => {
+        if (!nostrTools.verifyEvent(ev)) {
+          return;
+        }
         try {
           const msg = JSON.parse(ev.content);
-          if (msg.type === "elisym_ping" && msg.nonce) {
+          if (msg.type === "elisym_ping" && typeof msg.nonce === "string" && msg.nonce.length === 32) {
             onPing(ev.pubkey, msg.nonce);
           }
         } catch {
@@ -963,11 +1801,15 @@ var MessagingService = class _MessagingService {
   }
   /** Send a NIP-17 DM. */
   async sendMessage(identity, recipientPubkey, content) {
-    const wrap = nip17__namespace.wrapEvent(
-      identity.secretKey,
-      { publicKey: recipientPubkey },
-      content
-    );
+    if (!/^[0-9a-f]{64}$/.test(recipientPubkey)) {
+      throw new Error("Invalid recipient pubkey: expected 64 hex characters.");
+    }
+    if (content.length > LIMITS.MAX_MESSAGE_LENGTH) {
+      throw new Error(
+        `Message too long: ${content.length} chars (max ${LIMITS.MAX_MESSAGE_LENGTH}).`
+      );
+    }
+    const wrap = nip17__namespace.wrapEvent(identity.secretKey, { publicKey: recipientPubkey }, content);
     await this.pool.publish(wrap);
   }
   /** Fetch historical NIP-17 DMs from relays. Returns decrypted messages sorted by time. */
@@ -977,12 +1819,17 @@ var MessagingService = class _MessagingService {
       "#p": [identity.publicKey],
       since
     });
-    const seen = /* @__PURE__ */ new Set();
+    const seen = new BoundedSet(1e4);
     const messages = [];
     for (const ev of events) {
       try {
         const rumor = nip59__namespace.unwrapEvent(ev, identity.secretKey);
-        if (seen.has(rumor.id)) continue;
+        if (rumor.kind !== 14) {
+          continue;
+        }
+        if (seen.has(rumor.id)) {
+          continue;
+        }
         seen.add(rumor.id);
         messages.push({
           senderPubkey: rumor.pubkey,
@@ -997,134 +1844,312 @@ var MessagingService = class _MessagingService {
   }
   /** Subscribe to incoming NIP-17 DMs. */
   subscribeToMessages(identity, onMessage, since) {
-    const seen = /* @__PURE__ */ new Set();
+    const seen = new BoundedSet(1e4);
     const filter = {
       kinds: [KIND_GIFT_WRAP],
       "#p": [identity.publicKey]
     };
-    if (since !== void 0) filter.since = since;
-    return this.pool.subscribe(
-      filter,
-      (ev) => {
-        try {
-          const rumor = nip59__namespace.unwrapEvent(ev, identity.secretKey);
-          if (seen.has(rumor.id)) return;
-          seen.add(rumor.id);
-          onMessage(rumor.pubkey, rumor.content, rumor.created_at, rumor.id);
-        } catch {
+    if (since !== void 0) {
+      filter.since = since;
+    }
+    return this.pool.subscribe(filter, (ev) => {
+      try {
+        const rumor = nip59__namespace.unwrapEvent(ev, identity.secretKey);
+        if (rumor.kind !== 14) {
+          return;
+        }
+        if (seen.has(rumor.id)) {
+          return;
         }
+        seen.add(rumor.id);
+        onMessage(rumor.pubkey, rumor.content, rumor.created_at, rumor.id);
+      } catch {
       }
-    );
+    });
   }
 };
-var PaymentService = class _PaymentService {
-  /**
-   * Calculate protocol fee using Decimal basis-point math (no floats).
-   * Returns ceil(amount * PROTOCOL_FEE_BPS / 10000).
-   */
-  static calculateProtocolFee(amount) {
-    if (amount === 0) return 0;
-    return new Decimal__default.default(amount).mul(PROTOCOL_FEE_BPS).div(1e4).toDecimalPlaces(0, Decimal__default.default.ROUND_CEIL).toNumber();
+var NostrPool = class {
+  pool;
+  relays;
+  activeSubscriptions = /* @__PURE__ */ new Set();
+  constructor(relays = RELAYS) {
+    this.pool = new nostrTools.SimplePool();
+    this.relays = relays;
   }
-  /**
-   * Validate that a payment request has the correct recipient and protocol fee.
-   * Returns an error message if invalid, null if OK.
-   */
-  static validatePaymentFee(requestJson, expectedRecipient) {
-    let data;
+  /** Query relays synchronously. Returns `[]` on timeout (no error thrown). */
+  async querySync(filter) {
+    let timer;
+    const query = this.pool.querySync(this.relays, filter);
+    query.catch(() => {
+    });
     try {
-      data = JSON.parse(requestJson);
-    } catch (e) {
-      return `Invalid payment request JSON: ${e}`;
+      const result = await Promise.race([
+        query,
+        new Promise((resolve) => {
+          timer = setTimeout(() => resolve([]), DEFAULTS.QUERY_TIMEOUT_MS);
+        })
+      ]);
+      return result;
+    } finally {
+      clearTimeout(timer);
     }
-    if (expectedRecipient && data.recipient !== expectedRecipient) {
-      return `Recipient mismatch: expected ${expectedRecipient}, got ${data.recipient}. Provider may be attempting to redirect payment.`;
+  }
+  async queryBatched(filter, keys, batchSize = DEFAULTS.BATCH_SIZE, maxConcurrency = DEFAULTS.QUERY_MAX_CONCURRENCY) {
+    const batchKeys = [];
+    for (let i = 0; i < keys.length; i += batchSize) {
+      batchKeys.push(keys.slice(i, i + batchSize));
+    }
+    const results = [];
+    for (let c = 0; c < batchKeys.length; c += maxConcurrency) {
+      const chunk = batchKeys.slice(c, c + maxConcurrency);
+      const chunkResults = await Promise.all(
+        chunk.map((batch) => {
+          let timer;
+          const query = this.pool.querySync(this.relays, {
+            ...filter,
+            authors: batch
+          });
+          query.catch(() => {
+          });
+          return (async () => {
+            try {
+              return await Promise.race([
+                query,
+                new Promise((resolve) => {
+                  timer = setTimeout(() => resolve([]), DEFAULTS.QUERY_TIMEOUT_MS);
+                })
+              ]);
+            } finally {
+              clearTimeout(timer);
+            }
+          })();
+        })
+      );
+      results.push(...chunkResults.flat());
     }
-    if (data.created_at > 0 && data.expiry_secs > 0) {
-      const elapsed = Math.floor(Date.now() / 1e3) - data.created_at;
-      if (elapsed > data.expiry_secs) {
-        return `Payment request expired (created ${data.created_at}, expiry ${data.expiry_secs}s).`;
+    return results;
+  }
+  async queryBatchedByTag(filter, tagName, values, batchSize = DEFAULTS.BATCH_SIZE, maxConcurrency = DEFAULTS.QUERY_MAX_CONCURRENCY) {
+    const batchValues = [];
+    for (let i = 0; i < values.length; i += batchSize) {
+      batchValues.push(values.slice(i, i + batchSize));
+    }
+    const results = [];
+    for (let c = 0; c < batchValues.length; c += maxConcurrency) {
+      const chunk = batchValues.slice(c, c + maxConcurrency);
+      const chunkResults = await Promise.all(
+        chunk.map((batch) => {
+          let timer;
+          const query = this.pool.querySync(this.relays, {
+            ...filter,
+            [`#${tagName}`]: batch
+          });
+          query.catch(() => {
+          });
+          return (async () => {
+            try {
+              return await Promise.race([
+                query,
+                new Promise((resolve) => {
+                  timer = setTimeout(() => resolve([]), DEFAULTS.QUERY_TIMEOUT_MS);
+                })
+              ]);
+            } finally {
+              clearTimeout(timer);
+            }
+          })();
+        })
+      );
+      results.push(...chunkResults.flat());
+    }
+    return results;
+  }
+  async publish(event) {
+    try {
+      await Promise.any(this.pool.publish(this.relays, event));
+    } catch (err) {
+      if (err instanceof AggregateError) {
+        throw new Error(
+          `Failed to publish to all ${this.relays.length} relays: ${err.errors.map((e) => e instanceof Error ? e.message : String(e)).join(", ")}`
+        );
       }
+      throw err;
     }
-    const expectedFee = _PaymentService.calculateProtocolFee(data.amount);
-    const { fee_address, fee_amount } = data;
-    if (fee_address && fee_amount && fee_amount > 0) {
-      if (fee_address !== PROTOCOL_TREASURY) {
-        return `Fee address mismatch: expected ${PROTOCOL_TREASURY}, got ${fee_address}. Provider may be attempting to redirect fees.`;
+  }
+  /** Publish to all relays and wait for all to settle. Throws if none accepted. */
+  async publishAll(event) {
+    const results = await Promise.allSettled(this.pool.publish(this.relays, event));
+    const anyOk = results.some((r) => r.status === "fulfilled");
+    if (!anyOk) {
+      throw new Error(`Failed to publish to all ${this.relays.length} relays`);
+    }
+  }
+  subscribe(filter, onEvent) {
+    const rawSub = this.pool.subscribeMany(this.relays, filter, { onevent: onEvent });
+    const tracked = {
+      close: (reason) => {
+        this.activeSubscriptions.delete(tracked);
+        rawSub.close(reason);
       }
-      if (fee_amount !== expectedFee) {
-        return `Fee amount mismatch: expected ${expectedFee} lamports (${PROTOCOL_FEE_BPS}bps of ${data.amount}), got ${fee_amount}. Provider may be tampering with fee.`;
+    };
+    this.activeSubscriptions.add(tracked);
+    return tracked;
+  }
+  /**
+   * Subscribe and wait until at least one relay confirms the subscription
+   * is active (EOSE). Resolves on the first relay that responds.
+   * Essential for ephemeral events where the subscription must be live
+   * before publishing.
+   *
+   * Note: resolves on timeout even if no relay sent EOSE. The caller
+   * cannot distinguish timeout from success - this is intentional for
+   * best-effort ephemeral event delivery.
+   */
+  subscribeAndWait(filter, onEvent, timeoutMs = DEFAULTS.EOSE_TIMEOUT_MS) {
+    return new Promise((resolve) => {
+      let resolved = false;
+      let timer;
+      const subs = [];
+      const combinedSub = {
+        close: (reason) => {
+          this.activeSubscriptions.delete(combinedSub);
+          for (const s of subs) {
+            s.close(reason);
+          }
+        }
+      };
+      this.activeSubscriptions.add(combinedSub);
+      const done = () => {
+        if (resolved) {
+          return;
+        }
+        resolved = true;
+        if (timer) {
+          clearTimeout(timer);
+        }
+        resolve(combinedSub);
+      };
+      const seen = new BoundedSet(1e4);
+      const dedupedOnEvent = (ev) => {
+        if (seen.has(ev.id)) {
+          return;
+        }
+        seen.add(ev.id);
+        onEvent(ev);
+      };
+      for (const relay of this.relays) {
+        try {
+          const sub = this.pool.subscribeMany([relay], filter, {
+            onevent: dedupedOnEvent,
+            oneose: done
+          });
+          subs.push(sub);
+        } catch {
+        }
       }
-      return null;
+      if (subs.length === 0) {
+        done();
+        return;
+      }
+      if (!resolved) {
+        timer = setTimeout(done, timeoutMs);
+      }
+    });
+  }
+  /**
+   * Tear down pool and create a fresh one.
+   * Works around nostr-tools `onerror - skipReconnection = true` bug
+   * that permanently kills subscriptions. Callers must re-subscribe.
+   */
+  reset() {
+    for (const sub of this.activeSubscriptions) {
+      sub.close("pool reset");
     }
-    if (!fee_address && !fee_amount) {
-      return `Payment request missing protocol fee (${PROTOCOL_FEE_BPS}bps). Expected fee: ${expectedFee} lamports to ${PROTOCOL_TREASURY}.`;
+    this.activeSubscriptions.clear();
+    try {
+      this.pool.close(this.relays);
+    } catch {
     }
-    return `Invalid fee params in payment request. Expected fee: ${expectedFee} lamports to ${PROTOCOL_TREASURY}.`;
+    this.pool = new nostrTools.SimplePool();
   }
   /**
-   * Build a Solana transaction from a payment request.
-   * The caller must sign and send via wallet adapter.
+   * Lightweight connectivity probe. Returns true if at least one relay responds.
    */
-  static buildPaymentTransaction(payerPubkey, paymentRequest) {
-    const recipient = new web3_js.PublicKey(paymentRequest.recipient);
-    const reference = new web3_js.PublicKey(paymentRequest.reference);
-    const feeAddress = paymentRequest.fee_address ? new web3_js.PublicKey(paymentRequest.fee_address) : null;
-    const feeAmount = paymentRequest.fee_amount ?? 0;
-    const providerAmount = feeAddress && feeAmount > 0 ? new Decimal__default.default(paymentRequest.amount).minus(feeAmount).toNumber() : paymentRequest.amount;
-    const transferIx = web3_js.SystemProgram.transfer({
-      fromPubkey: payerPubkey,
-      toPubkey: recipient,
-      lamports: providerAmount
-    });
-    transferIx.keys.push({
-      pubkey: reference,
-      isSigner: false,
-      isWritable: false
+  async probe(timeoutMs = DEFAULTS.EOSE_TIMEOUT_MS) {
+    let timer;
+    const query = this.pool.querySync(this.relays, { kinds: [0], limit: 1 });
+    query.catch(() => {
     });
-    const tx = new web3_js.Transaction().add(transferIx);
-    if (feeAddress && feeAmount > 0) {
-      tx.add(
-        web3_js.SystemProgram.transfer({
-          fromPubkey: payerPubkey,
-          toPubkey: feeAddress,
-          lamports: feeAmount
+    try {
+      await Promise.race([
+        query,
+        new Promise((_, reject) => {
+          timer = setTimeout(() => reject(new Error("probe timeout")), timeoutMs);
         })
-      );
+      ]);
+      return true;
+    } catch {
+      return false;
+    } finally {
+      clearTimeout(timer);
     }
-    return tx;
   }
-  /**
-   * Create a payment request with auto-calculated protocol fee.
-   * Used by providers to generate payment requests for customers.
-   */
-  static createPaymentRequest(recipientAddress, amount, expirySecs = 600) {
-    const feeAmount = _PaymentService.calculateProtocolFee(amount);
-    const reference = web3_js.PublicKey.unique().toBase58();
-    return {
-      recipient: recipientAddress,
-      amount,
-      reference,
-      fee_address: PROTOCOL_TREASURY,
-      fee_amount: feeAmount,
-      created_at: Math.floor(Date.now() / 1e3),
-      expiry_secs: expirySecs
-    };
+  getRelays() {
+    return this.relays;
+  }
+  close() {
+    for (const sub of this.activeSubscriptions) {
+      sub.close("pool closed");
+    }
+    this.activeSubscriptions.clear();
+    try {
+      this.pool.close(this.relays);
+    } catch {
+    }
+  }
+};
+
+// src/client.ts
+var ElisymClient = class {
+  pool;
+  discovery;
+  marketplace;
+  messaging;
+  media;
+  payment;
+  constructor(config = {}) {
+    this.pool = new NostrPool(config.relays ?? RELAYS);
+    this.discovery = new DiscoveryService(this.pool);
+    this.marketplace = new MarketplaceService(this.pool);
+    this.messaging = new MessagingService(this.pool);
+    this.media = new MediaService(config.uploadUrl);
+    this.payment = config.payment ?? new SolanaPaymentStrategy();
+  }
+  close() {
+    this.pool.close();
   }
 };
 function formatSol(lamports) {
-  const sol = new Decimal__default.default(lamports).div(LAMPORTS_PER_SOL);
-  if (sol.gte(1e6)) return `${sol.idiv(1e6)}m SOL`;
-  if (sol.gte(1e4)) return `${sol.idiv(1e3)}k SOL`;
+  const sol = new Decimal2__default.default(lamports).div(LAMPORTS_PER_SOL);
+  if (sol.gte(1e6)) {
+    return `${sol.idiv(1e6)}m SOL`;
+  }
+  if (sol.gte(1e4)) {
+    return `${sol.idiv(1e3)}k SOL`;
+  }
   return `${compactSol(sol)} SOL`;
 }
 function compactSol(sol) {
-  if (sol.isZero()) return "0";
-  if (sol.gte(1e3)) return sol.toDecimalPlaces(0, Decimal__default.default.ROUND_FLOOR).toString();
+  if (sol.isZero()) {
+    return "0";
+  }
+  if (sol.gte(1e3)) {
+    return sol.toDecimalPlaces(0, Decimal2__default.default.ROUND_FLOOR).toString();
+  }
   const maxFrac = 9;
   for (let d = 1; d <= maxFrac; d++) {
     const s = sol.toFixed(d);
-    if (new Decimal__default.default(s).eq(sol)) {
+    if (new Decimal2__default.default(s).eq(sol)) {
       return s.replace(/0+$/, "").replace(/\.$/, "");
     }
   }
@@ -1132,43 +2157,39 @@ function compactSol(sol) {
 }
 function timeAgo(unix) {
   const seconds = Math.max(0, Math.floor(Date.now() / 1e3 - unix));
-  if (seconds < 60) return `${seconds}s ago`;
+  if (seconds < 60) {
+    return `${seconds}s ago`;
+  }
   const minutes = Math.floor(seconds / 60);
-  if (minutes < 60) return `${minutes}m ago`;
+  if (minutes < 60) {
+    return `${minutes}m ago`;
+  }
   const hours = Math.floor(minutes / 60);
-  if (hours < 24) return `${hours}h ago`;
+  if (hours < 24) {
+    return `${hours}h ago`;
+  }
   const days = Math.floor(hours / 24);
   return `${days}d ago`;
 }
 function truncateKey(hex, chars = 6) {
-  if (hex.length <= chars * 2) return hex;
+  if (hex.length <= chars * 2) {
+    return hex;
+  }
   return `${hex.slice(0, chars)}...${hex.slice(-chars)}`;
 }
-function makeNjumpUrl(eventId, relays = RELAYS) {
-  const nevent = nostrTools.nip19.neventEncode({
-    id: eventId,
-    relays: relays.slice(0, 2)
-  });
-  return `https://njump.me/${nevent}`;
-}
 
-// src/index.ts
-var ElisymClient = class {
-  pool;
-  discovery;
-  marketplace;
-  messaging;
-  constructor(config = {}) {
-    this.pool = new NostrPool(config.relays ?? RELAYS);
-    this.discovery = new DiscoveryService(this.pool);
-    this.marketplace = new MarketplaceService(this.pool);
-    this.messaging = new MessagingService(this.pool);
-  }
-  close() {
-    this.pool.close();
+// src/primitives/config.ts
+function validateAgentName(name) {
+  if (!name || name.length > LIMITS.MAX_AGENT_NAME_LENGTH || !/^[a-zA-Z0-9_-]+$/.test(name)) {
+    throw new Error("Agent name must be 1-64 characters, alphanumeric, underscore, or hyphen.");
   }
-};
+}
+function serializeConfig(config) {
+  return JSON.stringify(config, null, 2) + "\n";
+}
 
+exports.BoundedSet = BoundedSet;
+exports.DEFAULTS = DEFAULTS;
 exports.DEFAULT_KIND_OFFSET = DEFAULT_KIND_OFFSET;
 exports.DiscoveryService = DiscoveryService;
 exports.ElisymClient = ElisymClient;
@@ -1183,19 +2204,28 @@ exports.KIND_JOB_RESULT_BASE = KIND_JOB_RESULT_BASE;
 exports.KIND_PING = KIND_PING;
 exports.KIND_PONG = KIND_PONG;
 exports.LAMPORTS_PER_SOL = LAMPORTS_PER_SOL;
+exports.LIMITS = LIMITS;
 exports.MarketplaceService = MarketplaceService;
+exports.MediaService = MediaService;
 exports.MessagingService = MessagingService;
 exports.NostrPool = NostrPool;
 exports.PROTOCOL_FEE_BPS = PROTOCOL_FEE_BPS;
 exports.PROTOCOL_TREASURY = PROTOCOL_TREASURY;
-exports.PaymentService = PaymentService;
 exports.RELAYS = RELAYS;
+exports.SolanaPaymentStrategy = SolanaPaymentStrategy;
+exports.assertExpiry = assertExpiry;
+exports.assertLamports = assertLamports;
+exports.calculateProtocolFee = calculateProtocolFee;
 exports.formatSol = formatSol;
 exports.jobRequestKind = jobRequestKind;
 exports.jobResultKind = jobResultKind;
-exports.makeNjumpUrl = makeNjumpUrl;
+exports.nip44Decrypt = nip44Decrypt;
+exports.nip44Encrypt = nip44Encrypt;
+exports.serializeConfig = serializeConfig;
 exports.timeAgo = timeAgo;
 exports.toDTag = toDTag;
 exports.truncateKey = truncateKey;
+exports.validateAgentName = validateAgentName;
+exports.validateExpiry = validateExpiry;
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map