@unicitylabs/nostr-js-sdk 0.5.0 → 0.6.0

package/dist/browser/index.js

@@ -9244,6 +9244,16 @@ var NametagUtils = /*#__PURE__*/Object.freeze({
  */
 /** Default country code for phone number normalization (shared with NametagUtils) */
 const DEFAULT_COUNTRY = 'US';
+/**
+ * UNIP-01 namespace label for nametag ownership bindings.
+ *
+ * A binding event carrying a NIP-32 ["L", UNICITY_NAMETAG_NAMESPACE] label opts
+ * into relay-enforced single-owner semantics: the first author a UNIP-01 relay
+ * accepts for a given identifier (d-tag) owns it, by relay receive order. The
+ * marker is what makes ownership independent of the self-asserted `created_at`.
+ * See the UNIP-01 spec (unicity-tokens-relay/docs/UNIP-01.md).
+ */
+const UNICITY_NAMETAG_NAMESPACE = 'unicity:nametag';
 /**
  * Create a nametag binding event.
  *
@@ -9275,6 +9285,8 @@ async function createBindingEvent(keyManager, nametagId, unicityAddress, default
     };
     const tags = [
         ['d', hashedNametag],
+        // UNIP-01: opt this binding into relay-enforced single-owner semantics.
+        ['L', UNICITY_NAMETAG_NAMESPACE],
         ['nametag', hashedNametag],
         ['t', hashedNametag],
         ['address', unicityAddress],
@@ -9478,6 +9490,18 @@ function parseAddressFromEvent(event) {
         return undefined;
     }
 }
+/**
+ * UNIP-01: true if this binding event carries the single-owner namespace marker
+ * (a NIP-32 ["L", UNICITY_NAMETAG_NAMESPACE] label). Such bindings are vetted by
+ * UNIP-01 relays for single ownership and are preferred at resolution over
+ * unmarked (legacy) bindings, independent of the self-asserted `created_at`.
+ *
+ * @param event Binding event
+ * @returns true if the UNIP-01 nametag marker is present
+ */
+function hasNametagOwnershipMarker(event) {
+    return event.getTagValues('L').includes(UNICITY_NAMETAG_NAMESPACE);
+}
 /**
  * Verify that a binding event is valid.
  * Checks signature and structure.
@@ -9510,11 +9534,13 @@ function isValidBindingEvent(event) {
 
 var NametagBinding = /*#__PURE__*/Object.freeze({
     __proto__: null,
+    UNICITY_NAMETAG_NAMESPACE: UNICITY_NAMETAG_NAMESPACE,
     createAddressToBindingFilter: createAddressToBindingFilter,
     createBindingEvent: createBindingEvent,
     createIdentityBindingEvent: createIdentityBindingEvent,
     createNametagToPubkeyFilter: createNametagToPubkeyFilter,
     createPubkeyToNametagFilter: createPubkeyToNametagFilter,
+    hasNametagOwnershipMarker: hasNametagOwnershipMarker,
     isValidBindingEvent: isValidBindingEvent,
     parseAddressFromEvent: parseAddressFromEvent,
     parseBindingInfo: parseBindingInfo,
@@ -10448,7 +10474,18 @@ class NostrClient {
             await this.publishEvent(event);
             return true;
         }
-        catch {
+        catch (err) {
+            // UNIP-01: a relay-enforced single-owner rejection (NIP-20 `blocked:`)
+            // means the nametag is owned by another key — surface it as a hard
+            // failure rather than a silent `false`, which a caller could mistake for
+            // a transient publish error. Other (transient) errors keep returning
+            // false, preserving the prior best-effort behavior.
+            const msg = err instanceof Error ? err.message : String(err);
+            // Match only the ownership-conflict message, not the generic NIP-20
+            // `blocked:` prefix (which also covers spam/rate-limit/policy rejections).
+            if (/owned by another key|already claimed/i.test(msg)) {
+                throw new Error(`Nametag "${nametagId}" is already claimed by another key`);
+            }
             return false;
         }
     }
@@ -10532,20 +10569,26 @@ class NostrClient {
         }
     }
     /**
-     * Query binding events with first-seen-wins anti-hijacking resolution.
+     * Query binding events and select the owner.
      *
-     * Strategy: first-seen-wins across authors, latest-wins for same author.
-     * - Across authors: the pubkey that first published wins (earliest created_at)
-     * - Same author: the most recent event is used (latest created_at = most complete data)
-     * - Tie-breaking: deterministic by lexicographic pubkey comparison (lowest wins)
+     * UNIP-01 (preferred): if any returned binding carries the single-owner
+     * namespace marker (NIP-32 ["L", "unicity:nametag"]), ownership is taken from
+     * the marked binding. These are vetted by UNIP-01 relays for single ownership
+     * (first author by relay receive order owns the identifier), so the
+     * self-asserted `created_at` is ignored entirely. With a UNIP-01 relay set
+     * there is exactly one marked owner; observing more than one distinct marked
+     * author (e.g. across relays in differing states) is treated as ambiguous and
+     * resolves to null rather than guessing.
      *
-     * Events with invalid signatures are silently skipped to prevent relay injection attacks.
+     * Legacy fallback (no marked binding present — e.g. an identifier not yet
+     * migrated): first-seen-wins across authors by `created_at`, latest-wins for
+     * the same author, lexicographic pubkey tie-break. Retained for backward
+     * compatibility during migration; superseded as soon as the owner republishes
+     * a marked binding. (Self-asserted timestamps are not authoritative — this
+     * path exists only so un-migrated identifiers keep resolving.)
      *
-     * Known limitations:
-     * - Timestamps are self-reported (NIP-01). An attacker can set created_at to 0.
-     *   Chain-anchored proof of registration time is the only reliable defense.
-     * - TOCTOU: between conflict check and publish, another user can claim the same nametag.
-     *   This is inherent to Nostr's eventually-consistent relay model.
+     * Events with invalid signatures are silently skipped to prevent relay
+     * injection of forged events.
      *
      * @param filter Subscription filter
      * @param extractResult Callback to extract the desired result from the winning event
@@ -10581,6 +10624,19 @@ class NostrClient {
             const authors = new Map();
             const allRelaysDone = (id) => this.allRelaysDoneFor(id);
             const pickWinner = () => {
+                // UNIP-01: prefer marker-carrying (relay-vetted single-owner) bindings,
+                // ignoring the self-asserted created_at. The marker is read from each
+                // author's CURRENT (latest, per NIP-33 replaceable) event, so a newer
+                // unmarked update correctly drops the author from the marked set, and a
+                // marked owner resolves to their freshest binding.
+                const marked = [...authors.values()].filter((e) => hasNametagOwnershipMarker(e.latestEvent));
+                if (marked.length > 0) {
+                    // Exactly one marked owner is the relay-enforced norm. More than one
+                    // distinct marked author means cross-relay disagreement — do not guess.
+                    const owner = marked.length === 1 ? marked[0] : undefined;
+                    return owner ? extractResult(owner.latestEvent) : null;
+                }
+                // Legacy fallback: first-seen-wins by self-asserted created_at.
                 let winnerEntry = null;
                 let winnerPubkey = '';
                 for (const [pubkey, entry] of authors) {
@@ -11387,5 +11443,5 @@ function isReadReceipt(message) {
     return message.kind === 15;
 }
 
-export { AGENT_LOCATION, AGENT_PROFILE, APP_DATA, AUTH, bech32 as Bech32, CHAT_MESSAGE, CLOSED, CLOSING, CONNECTING, CONTACTS, CallbackEventListener, DELETION, ENCRYPTED_DM, Event, EventKinds, FILE_METADATA, Filter, FilterBuilder, GIFT_WRAP, NAMETAG_MAX_LENGTH, NAMETAG_MIN_LENGTH, nip04 as NIP04, nip17 as NIP17, nip44 as NIP44, NametagBinding, NametagUtils, NostrClient, NostrKeyManager, OPEN, PAYMENT_REQUEST, PAYMENT_REQUEST_RESPONSE, PROFILE, PaymentRequestProtocol, REACTION, READ_RECEIPT, RECOMMEND_RELAY, RELAY_LIST, SEAL, schnorr as SchnorrSigner, TEXT_NOTE, TOKEN_TRANSFER, TokenTransferProtocol, areSameNametag, createAddressToBindingFilter, createBindingEvent, createGiftWrap, createIdentityBindingEvent, createNametagToPubkeyFilter, createPubkeyToNametagFilter, createReadReceipt, createWebSocket, decode, decodeNpub, decodeNsec, decryptNametag, encode, encodeNpub, encodeNsec, encryptNametag, extractMessageData, formatForDisplay, getName, getPublicKey, getPublicKeyHex, hashAddressForTag, hashNametag, isChatMessage, isEphemeral, isParameterizedReplaceable, isPhoneNumber, isReadReceipt, isReplaceable, isValidBindingEvent, isValidNametag, normalizeNametag, parseAddressFromEvent, parseBindingInfo, parseNametagHashFromEvent, sha256Hex, sign, signHex, unwrap, verify, verifyHex };
+export { AGENT_LOCATION, AGENT_PROFILE, APP_DATA, AUTH, bech32 as Bech32, CHAT_MESSAGE, CLOSED, CLOSING, CONNECTING, CONTACTS, CallbackEventListener, DELETION, ENCRYPTED_DM, Event, EventKinds, FILE_METADATA, Filter, FilterBuilder, GIFT_WRAP, NAMETAG_MAX_LENGTH, NAMETAG_MIN_LENGTH, nip04 as NIP04, nip17 as NIP17, nip44 as NIP44, NametagBinding, NametagUtils, NostrClient, NostrKeyManager, OPEN, PAYMENT_REQUEST, PAYMENT_REQUEST_RESPONSE, PROFILE, PaymentRequestProtocol, REACTION, READ_RECEIPT, RECOMMEND_RELAY, RELAY_LIST, SEAL, schnorr as SchnorrSigner, TEXT_NOTE, TOKEN_TRANSFER, TokenTransferProtocol, UNICITY_NAMETAG_NAMESPACE, areSameNametag, createAddressToBindingFilter, createBindingEvent, createGiftWrap, createIdentityBindingEvent, createNametagToPubkeyFilter, createPubkeyToNametagFilter, createReadReceipt, createWebSocket, decode, decodeNpub, decodeNsec, decryptNametag, encode, encodeNpub, encodeNsec, encryptNametag, extractMessageData, formatForDisplay, getName, getPublicKey, getPublicKeyHex, hasNametagOwnershipMarker, hashAddressForTag, hashNametag, isChatMessage, isEphemeral, isParameterizedReplaceable, isPhoneNumber, isReadReceipt, isReplaceable, isValidBindingEvent, isValidNametag, normalizeNametag, parseAddressFromEvent, parseBindingInfo, parseNametagHashFromEvent, sha256Hex, sign, signHex, unwrap, verify, verifyHex };
 //# sourceMappingURL=index.js.map