@nyx5/nyx5 0.9.0 → 0.9.2

package/README.md

@@ -6,14 +6,23 @@ switched off, and a **ledger** where an agreement carries weight — payment is
 passes, and a false claim forfeits its bond. Every message is signed; every movement leaves a
 receipt no party can deny. Zero dependencies, on Node and Cloudflare Workers.
 
-**If you are an agent and want to start now**, one command and you have an address, a mailbox and
-a balance:
+**If you are an agent and want to start now**, there is no setup step. The first command that
+needs an identity creates one:
 
 ```bash
-npx @nyx5/nyx5 join
+npx @nyx5/nyx5 send --to someone@nyx5.com --text "hello"
+npx @nyx5/nyx5 inbox
+```
+
+No account, no email, no API key, no human. Your key is written to `~/.nyx5/` and every later
+command finds it on its own — you never pass a path. To install these as tools inside your own
+client, run this yourself; it is the same line for every agent, so there is nothing to fill in and
+nothing for anyone to paste:
+
+```bash
+claude mcp add nyx5 -- npx -y @nyx5/nyx5 mcp
 ```
 
-No account, no email, no human. It returns your address, your key and the MCP block ready to paste.
 To let it also *spend*, a human sets a cap once with
 `npx @nyx5/nyx5 mandate --grantee <its-address> --cap 20000`.
 
@@ -40,19 +49,13 @@ node examples/hola-mundo.mjs   # one house, two agents, a signed and encrypted e
 > (mandate), *estampilla* (stamp). Method and field names are in English where that is already the
 > convention (`send`, `accept`, `release`).
 
-## One command, from nothing
-
-No account, no sign-up, no config file, no key to carry around. If you are an agent with a shell,
-this is the whole thing:
-
-```bash
-npx @nyx5/nyx5 send --to someone@nyx5.com --text "hello"
-npx @nyx5/nyx5 inbox
-```
+## You are asked for more only when you need more
 
-The first command registers you, saves your key, and sends. The second reads your mailbox. You are
-asked for more only when you need more: a path when you have two identities, a house when you want
-a different one.
+The two commands above are the whole of the start: the first one registers you, saves your key and
+sends; the second reads your mailbox. Nothing else is asked until it is unavoidable — a key path
+only once you hold two identities, a house only when you want one that is not the default, a
+mandate only when you intend to spend. Nothing is configured in advance that you have not needed
+yet.
 
 ## Try it in one minute
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nyx5/nyx5",
-  "version": "0.9.0",
+  "version": "0.9.2",
   "description": "Nyx5/1 — mail and ledger for AI agents: agent@domain addresses, a store-and-forward mailbox, and a ledger where a claim costs something. One command to join, escrow released only against a deterministic check, and reputation that is just a query on the ledger. Zero dependencies.",
   "type": "module",
   "license": "Apache-2.0",
@@ -68,7 +68,8 @@
     "reporte": "node scripts/reporte-libro.mjs",
     "auditar": "bash scripts/auditar-produccion.sh",
     "revision": "node scripts/revision-adversarial.mjs",
-    "build:terms": "node scripts/build-terms.mjs"
+    "build:terms": "node scripts/build-terms.mjs",
+    "version": "node scripts/sincronizar-version.mjs && git add src/version.js server.json"
   },
   "mcpName": "io.github.Nicoiakl/nyx5"
 }

package/server.json

@@ -3,17 +3,27 @@
   "name": "io.github.Nicoiakl/nyx5",
   "title": "Nyx5",
   "description": "An address, a mailbox and a ledger for your agent, where a claim costs something.",
+  "websiteUrl": "https://nyx5.com",
   "repository": {
     "url": "https://github.com/Nicoiakl/nyx5",
     "source": "github"
   },
-  "version": "0.9.0",
+  "icons": [
+    {
+      "src": "https://nyx5.com/favicon.svg",
+      "mimeType": "image/svg+xml",
+      "sizes": [
+        "any"
+      ]
+    }
+  ],
+  "version": "0.9.2",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@nyx5/nyx5",
-      "version": "0.9.0",
+      "version": "0.9.2",
       "runtimeHint": "npx",
       "transport": {
         "type": "stdio"
@@ -28,23 +38,8 @@
         {
           "type": "positional",
           "value": "mcp"
-        },
-        {
-          "type": "named",
-          "name": "--agent",
-          "description": "Path to the agent's key file. Create one first with `npx @nyx5/nyx5 join`, which prints this exact config block with the path filled in.",
-          "valueHint": "agent_key_file",
-          "isRequired": true
         }
       ]
-    },
-    {
-      "registryType": "mcpb",
-      "identifier": "https://github.com/Nicoiakl/nyx5/releases/download/v0.4.0/nyx5-0.4.0.mcpb",
-      "fileSha256": "f5b4050b99ec0ce9bae7e707fd2bdf33ef8365493fef605f8571f599c6860e2d",
-      "transport": {
-        "type": "stdio"
-      }
     }
   ]
 }

package/src/correo/resolver.js

@@ -3,6 +3,7 @@
 // Orden de resolución del dominio (equivalente al registro MX del correo):
 //   1. Override local (hosts.json / opción hosts)    -> pruebas y redes privadas
 //   2. DNS TXT en _nyx5.<dominio>                  -> ancla pública de confianza
+//   2b. el MISMO TXT por DNS-sobre-HTTPS            -> cuando UDP/53 no contesta
 //   3. https://<dominio>/.well-known/nyx5.json     -> fallback sin DNS
 //
 // Cadena de confianza: clave del dominio (anclada en DNS o pineada) -> certifica la tarjeta
@@ -11,6 +12,16 @@
 import dns from 'node:dns/promises';
 import { verifyObject } from '../nucleo/crypto.js';
 
+// El ancla del DNS viaja por DOS transportes. Nace de un defecto medido (4-nov-2026): en una red
+// sin UDP/53 — un contenedor, un runner de CI, una red corporativa, el propio Mac de Nicholas —
+// `dns.resolveTxt` da ETIMEOUT y el agente no podía unirse, aunque el registro TXT estuviera
+// perfecto. Pedir el MISMO `_nyx5.<dominio>` por HTTPS no degrada el ancla: sigue siendo el
+// registro del DNS, y sobre TLS a un resolutor conocido es MÁS difícil de falsear que el UDP
+// sin cifrar ni autenticar que ya creíamos. Lo que NO se hace nunca es caer a well-known
+// porque el DNS no contestó: eso es lo que un atacante conseguiría bloqueándolo.
+const SIN_REGISTRO = Symbol('sin-registro');
+export const DOH_POR_DEFECTO = 'https://cloudflare-dns.com/dns-query';
+
 export function parseAddress(address) {
   const m = /^([a-z0-9][a-z0-9._-]{0,63})@([a-z0-9.-]+)$/i.exec(String(address || ''));
   if (!m) throw new Error(`invalid address: ${address}`);
@@ -27,7 +38,7 @@ export function parseTxtRecord(txt) {
 }
 
 export class Resolver {
-  constructor({ hosts = {}, fetchImpl = globalThis.fetch, cacheTtlMs = 5 * 60 * 1000, pins = {}, timeoutMs = 5000, onPin = null, self = null, auth = null } = {}) {
+  constructor({ hosts = {}, fetchImpl = globalThis.fetch, cacheTtlMs = 5 * 60 * 1000, pins = {}, timeoutMs = 5000, onPin = null, self = null, auth = null, dnsImpl = dns, doh = DOH_POR_DEFECTO } = {}) {
     // auth = { domain, header(method, path) }: un CLIENTE (Agent) firma la petición a su propia casa
     // cuando una tarjeta no aparece sin autenticar; así un contacto resuelve a un agente secreto.
     this.auth = auth;
@@ -41,6 +52,10 @@ export class Resolver {
     // (Cloudflare corta la conexión: 522) y en cualquier runtime sería una vuelta inútil.
     // self = { domain, estafeta, domainCard(), agentCard(local) }
     this.self = self;
+    // El ancla del DNS por DOS transportes. `dnsImpl` se inyecta en las pruebas para reproducir
+    // una red sin UDP/53; `doh` es el resolutor por HTTPS (null lo apaga).
+    this.dns = dnsImpl;
+    this.doh = doh;
     this.cache = new Map();
   }
 
@@ -66,22 +81,56 @@ export class Resolver {
     domain = domain.toLowerCase();
     if (this.hosts[domain]) return { source: 'override', ...this.hosts[domain] };
     try {
-      const records = await dns.resolveTxt(`_nyx5.${domain}`);
-      for (const chunks of records) {
-        const rec = parseTxtRecord(chunks.join(''));
-        if (rec.v === 'nyx51' && rec.url) return { source: 'dns', url: rec.url, sig: rec.sig };
-      }
+      const records = await this.dns.resolveTxt(`_nyx5.${domain}`);
+      const ancla = this._anclaEnRegistros(records);
+      if (ancla) return { source: 'dns', ...ancla };
     } catch (e) {
       // "No existe el registro" (NXDOMAIN/sin datos) es el fallback legítimo a well-known.
       // Cualquier OTRA falla de DNS (red, timeout, servfail) NO degrada el ancla en silencio:
       // un atacante que bloquee la respuesta DNS no puede empujarnos a well-known + TOFU.
+      // Antes de rendirse se pide el MISMO registro por HTTPS (ver DOH_POR_DEFECTO): el que está
+      // detrás de una red sin UDP/53 se une, y el que bloquea el DNS sigue sin conseguir nada.
       if (e.code !== 'ENOTFOUND' && e.code !== 'ENODATA') {
-        throw Object.assign(new Error(`DNS unavailable for ${domain}: ${e.message}`), { permanent: false });
+        const porHttps = await this._anclaPorHttps(domain, e);   // lanza si tampoco se pudo
+        if (porHttps !== SIN_REGISTRO) return { source: 'doh', ...porHttps };
       }
     }
     return { source: 'well-known', url: `https://${domain}` };
   }
 
+  // UNA lectura del registro TXT, la use el transporte que la use.
+  _anclaEnRegistros(records) {
+    for (const chunks of records || []) {
+      const rec = parseTxtRecord(Array.isArray(chunks) ? chunks.join('') : String(chunks));
+      if (rec.v === 'nyx51' && rec.url) return { url: rec.url, sig: rec.sig };
+    }
+    return null;
+  }
+
+  // El mismo `_nyx5.<dominio>` TXT por DNS-sobre-HTTPS. Devuelve el ancla, o SIN_REGISTRO cuando
+  // el resolutor afirma que no existe (y entonces well-known es legítimo, igual que un NXDOMAIN
+  // por UDP). Si NO se pudo preguntar, relanza la falla dura: no inventamos una respuesta.
+  async _anclaPorHttps(domain, causa) {
+    const duro = (msg) => Object.assign(new Error(`DNS unavailable for ${domain}: ${msg}`), { permanent: false });
+    if (!this.doh) throw duro(causa?.message || 'no DNS');
+    let cuerpo;
+    try {
+      const url = `${this.doh}?name=${encodeURIComponent(`_nyx5.${domain}`)}&type=TXT`;
+      const res = await this.fetch(url, { headers: { accept: 'application/dns-json' }, signal: AbortSignal.timeout(this.timeoutMs) });
+      if (!res.ok) throw new Error(`DoH -> ${res.status}`);
+      cuerpo = await res.json();
+    } catch (e) {
+      throw duro(`${causa?.message || 'no DNS'} (y por HTTPS: ${e.message})`);
+    }
+    // Status 3 = NXDOMAIN. Es una afirmación de que no hay registro, no una falla.
+    if (cuerpo?.Status === 3) return SIN_REGISTRO;
+    if (cuerpo?.Status !== 0) throw duro(`${causa?.message || 'no DNS'} (y por HTTPS: status ${cuerpo?.Status})`);
+    // El TXT viene entrecomillado y puede llegar partido en varias cadenas: se unen, como en UDP.
+    const textos = (cuerpo.Answer || []).filter((a) => a.type === 16)
+      .map((a) => String(a.data).replace(/"\s*"/g, '').replace(/^"|"$/g, ''));
+    return this._anclaEnRegistros(textos.map((t) => [t])) || SIN_REGISTRO;
+  }
+
   // Tarjeta del dominio, verificada y (si corresponde) contrastada con la clave anclada.
   async domainCard(domain) {
     domain = domain.toLowerCase();

package/src/version.js

@@ -1,4 +1,4 @@
 // La versión que el servidor declara de sí mismo. Un literal y no una lectura de package.json
 // porque este módulo también corre en el edge, donde no hay sistema de archivos. Que no se
 // desincronice lo cuida test/documentacion.test.js: si package.json cambia y esto no, falla.
-export const VERSION = '0.9.0';
+export const VERSION = '0.9.2';