ncc-05 1.1.3 → 1.1.5

package/dist/index.d.ts

@@ -6,7 +6,22 @@
  *
  * @module ncc-05
  */
-import { Event } from 'nostr-tools';
+import { SimplePool, Event } from 'nostr-tools';
+export declare class NCC05Error extends Error {
+    constructor(message: string);
+}
+export declare class NCC05RelayError extends NCC05Error {
+    constructor(message: string);
+}
+export declare class NCC05TimeoutError extends NCC05Error {
+    constructor(message: string);
+}
+export declare class NCC05DecryptionError extends NCC05Error {
+    constructor(message: string);
+}
+export declare class NCC05ArgumentError extends NCC05Error {
+    constructor(message: string);
+}
 /**
  * Represents a single reachable service endpoint.
  */
@@ -47,6 +62,19 @@ export interface ResolverOptions {
     timeout?: number;
     /** Custom WebSocket implementation (e.g., for Tor/SOCKS5 in Node.js) */
     websocketImplementation?: any;
+    /** Existing SimplePool instance to share connections */
+    pool?: SimplePool;
+}
+/**
+ * Options for configuring the NCC05Publisher.
+ */
+export interface PublisherOptions {
+    /** Custom WebSocket implementation */
+    websocketImplementation?: any;
+    /** Existing SimplePool instance */
+    pool?: SimplePool;
+    /** Timeout for publishing in milliseconds (default: 5000) */
+    timeout?: number;
 }
 /**
  * Structure for multi-recipient encrypted events.
@@ -83,7 +111,7 @@ export declare class NCC05Group {
      * @param identifier - The 'd' tag of the record (default: 'addr').
      * @returns The resolved NCC05Payload or null.
      */
-    static resolveAsGroup(resolver: NCC05Resolver, groupPubkey: string, groupSecretKey: Uint8Array, identifier?: string): Promise<NCC05Payload | null>;
+    static resolveAsGroup(resolver: NCC05Resolver, groupPubkey: string, groupSecretKey: string | Uint8Array, identifier?: string): Promise<NCC05Payload | null>;
 }
 /**
  * Handles the discovery, selection, and decryption of NCC-05 locator records.
@@ -106,9 +134,11 @@ export declare class NCC05Resolver {
      * @param secretKey - Your secret key (required if the record is encrypted).
      * @param identifier - The 'd' tag of the record (default: 'addr').
      * @param options - Resolution options (strict mode, gossip discovery).
-     * @returns The resolved and validated NCC05Payload, or null if not found/invalid.
+     * @returns The resolved and validated NCC05Payload, or null if not found.
+     * @throws {NCC05TimeoutError} if resolution times out.
+     * @throws {NCC05RelayError} if underlying relay communication fails.
      */
-    resolve(targetPubkey: string, secretKey?: Uint8Array, identifier?: string, options?: {
+    resolve(targetPubkey: string, secretKey?: string | Uint8Array, identifier?: string, options?: {
         strict?: boolean;
         gossip?: boolean;
     }): Promise<NCC05Payload | null>;
@@ -122,12 +152,12 @@ export declare class NCC05Resolver {
  */
 export declare class NCC05Publisher {
     private pool;
+    private timeout;
     /**
      * @param options - Configuration for the publisher.
      */
-    constructor(options?: {
-        websocketImplementation?: any;
-    });
+    constructor(options?: PublisherOptions);
+    private _publishToRelays;
     /**
      * Publishes a single record encrypted for multiple recipients using the wrapping pattern.
      * This avoids sharing a single group private key.
@@ -139,7 +169,7 @@ export declare class NCC05Publisher {
      * @param identifier - The 'd' tag identifier (default: 'addr').
      * @returns The signed Nostr event.
      */
-    publishWrapped(relays: string[], secretKey: Uint8Array, recipients: string[], payload: NCC05Payload, identifier?: string): Promise<Event>;
+    publishWrapped(relays: string[], secretKey: string | Uint8Array, recipients: string[], payload: NCC05Payload, identifier?: string): Promise<Event>;
     /**
      * Publishes a locator record. Supports self-encryption, targeted encryption, or plaintext.
      *
@@ -149,7 +179,7 @@ export declare class NCC05Publisher {
      * @param options - Publishing options (identifier, recipient, or public flag).
      * @returns The signed Nostr event.
      */
-    publish(relays: string[], secretKey: Uint8Array, payload: NCC05Payload, options?: {
+    publish(relays: string[], secretKey: string | Uint8Array, payload: NCC05Payload, options?: {
         identifier?: string;
         recipientPubkey?: string;
         public?: boolean;

package/dist/index.js

@@ -7,6 +7,56 @@
  * @module ncc-05
  */
 import { SimplePool, nip44, nip19, finalizeEvent, verifyEvent, getPublicKey, generateSecretKey } from 'nostr-tools';
+// --- Error Classes ---
+export class NCC05Error extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'NCC05Error';
+    }
+}
+export class NCC05RelayError extends NCC05Error {
+    constructor(message) {
+        super(message);
+        this.name = 'NCC05RelayError';
+    }
+}
+export class NCC05TimeoutError extends NCC05Error {
+    constructor(message) {
+        super(message);
+        this.name = 'NCC05TimeoutError';
+    }
+}
+export class NCC05DecryptionError extends NCC05Error {
+    constructor(message) {
+        super(message);
+        this.name = 'NCC05DecryptionError';
+    }
+}
+export class NCC05ArgumentError extends NCC05Error {
+    constructor(message) {
+        super(message);
+        this.name = 'NCC05ArgumentError';
+    }
+}
+// --- Helpers ---
+function ensureUint8Array(key) {
+    if (key instanceof Uint8Array)
+        return key;
+    if (typeof key === 'string') {
+        // Assume hex string
+        if (key.match(/^[0-9a-fA-F]+$/)) {
+            return new Uint8Array(key.match(/.{1,2}/g).map(byte => parseInt(byte, 16)));
+        }
+        throw new NCC05ArgumentError("Invalid hex key provided");
+    }
+    throw new NCC05ArgumentError("Key must be a hex string or Uint8Array");
+}
+function getHexPubkey(key) {
+    if (key instanceof Uint8Array) {
+        return Array.from(key).map(b => b.toString(16).padStart(2, '0')).join('');
+    }
+    return key;
+}
 /**
  * Utility for managing shared group access to service records.
  */
@@ -51,10 +101,17 @@ export class NCC05Resolver {
      * @param options - Configuration for the resolver.
      */
     constructor(options = {}) {
-        this.pool = new SimplePool();
-        if (options.websocketImplementation) {
-            // @ts-ignore - Patching pool for custom transport
-            this.pool.websocketImplementation = options.websocketImplementation;
+        this.pool = options.pool || new SimplePool();
+        if (!options.pool) {
+            if (options.websocketImplementation) {
+                // @ts-ignore - Patching pool for custom transport
+                this.pool.websocketImplementation = options.websocketImplementation;
+            }
+            else if (typeof globalThis !== 'undefined' && !globalThis.WebSocket) {
+                // In Node.js environment without global WebSocket, this might fail later.
+                // We leave it to the user or nostr-tools to handle, but this logic
+                // allows 'websocketImplementation' to be explicitly checked.
+            }
         }
         this.bootstrapRelays = options.bootstrapRelays || ['wss://relay.damus.io', 'wss://nos.lol'];
         this.timeout = options.timeout || 10000;
@@ -69,7 +126,9 @@ export class NCC05Resolver {
      * @param secretKey - Your secret key (required if the record is encrypted).
      * @param identifier - The 'd' tag of the record (default: 'addr').
      * @param options - Resolution options (strict mode, gossip discovery).
-     * @returns The resolved and validated NCC05Payload, or null if not found/invalid.
+     * @returns The resolved and validated NCC05Payload, or null if not found.
+     * @throws {NCC05TimeoutError} if resolution times out.
+     * @throws {NCC05RelayError} if underlying relay communication fails.
      */
     async resolve(targetPubkey, secretKey, identifier = 'addr', options = {}) {
         let hexPubkey = targetPubkey;
@@ -80,18 +139,25 @@ export class NCC05Resolver {
         let queryRelays = [...this.bootstrapRelays];
         // 1. NIP-65 Gossip Discovery
         if (options.gossip) {
-            const relayListEvent = await this.pool.get(this.bootstrapRelays, {
-                authors: [hexPubkey],
-                kinds: [10002]
-            });
-            if (relayListEvent) {
-                const discoveredRelays = relayListEvent.tags
-                    .filter(t => t[0] === 'r')
-                    .map(t => t[1]);
-                if (discoveredRelays.length > 0) {
-                    queryRelays = [...new Set([...queryRelays, ...discoveredRelays])];
+            try {
+                const relayListEvent = await this.pool.get(this.bootstrapRelays, {
+                    authors: [hexPubkey],
+                    kinds: [10002]
+                });
+                // Security: Verify NIP-65 event signature and author
+                if (relayListEvent && verifyEvent(relayListEvent) && relayListEvent.pubkey === hexPubkey) {
+                    const discoveredRelays = relayListEvent.tags
+                        .filter(t => t[0] === 'r')
+                        .map(t => t[1]);
+                    if (discoveredRelays.length > 0) {
+                        queryRelays = [...new Set([...queryRelays, ...discoveredRelays])];
+                    }
                 }
             }
+            catch (e) {
+                console.warn(`[NCC-05] Gossip discovery failed: ${e.message}`);
+                // Proceed with bootstrap relays
+            }
         }
         const filter = {
             authors: [hexPubkey],
@@ -99,57 +165,90 @@ export class NCC05Resolver {
             '#d': [identifier],
             limit: 10
         };
-        const queryPromise = this.pool.querySync(queryRelays, filter);
-        const timeoutPromise = new Promise((r) => setTimeout(() => r(null), this.timeout));
-        const result = await Promise.race([queryPromise, timeoutPromise]);
-        if (!result || (Array.isArray(result) && result.length === 0))
-            return null;
-        const validEvents = result
-            .filter(e => verifyEvent(e))
-            .sort((a, b) => b.created_at - a.created_at);
-        if (validEvents.length === 0)
-            return null;
-        const latestEvent = validEvents[0];
+        const sk = secretKey ? ensureUint8Array(secretKey) : undefined;
         try {
+            const queryPromise = this.pool.querySync(queryRelays, filter);
+            const timeoutPromise = new Promise((_, reject) => setTimeout(() => reject(new NCC05TimeoutError("Resolution timed out")), this.timeout));
+            const result = await Promise.race([queryPromise, timeoutPromise]);
+            if (!result || (Array.isArray(result) && result.length === 0))
+                return null;
+            // 2. Filter for valid signatures, correct author, and sort by created_at
+            const validEvents = result
+                .filter(e => e.pubkey === hexPubkey && verifyEvent(e))
+                .sort((a, b) => b.created_at - a.created_at);
+            if (validEvents.length === 0)
+                return null;
+            const latestEvent = validEvents[0];
             let content = latestEvent.content;
-            // Handle "Wrapped" multi-recipient content
-            if (content.includes('"wraps"') && secretKey) {
-                const wrapped = JSON.parse(content);
-                const myPk = getPublicKey(secretKey);
-                const myWrap = wrapped.wraps[myPk];
-                if (myWrap) {
-                    const conversationKey = nip44.getConversationKey(secretKey, hexPubkey);
-                    const symmetricKeyHex = nip44.decrypt(myWrap, conversationKey);
-                    const symmetricKey = new Uint8Array(symmetricKeyHex.match(/.{1,2}/g).map(byte => parseInt(byte, 16)));
-                    const sessionConversationKey = nip44.getConversationKey(symmetricKey, getPublicKey(symmetricKey));
-                    content = nip44.decrypt(wrapped.ciphertext, sessionConversationKey);
+            // Security: Robust multi-recipient detection
+            const isWrapped = content.includes('"wraps"') &&
+                content.includes('"ciphertext"') &&
+                content.startsWith('{');
+            if (isWrapped && sk) {
+                try {
+                    const wrapped = JSON.parse(content);
+                    const myPk = getPublicKey(sk);
+                    const myWrap = wrapped.wraps[myPk];
+                    if (myWrap) {
+                        const conversationKey = nip44.getConversationKey(sk, hexPubkey);
+                        const symmetricKeyHex = nip44.decrypt(myWrap, conversationKey);
+                        // Convert hex symmetric key back to Uint8Array for NIP-44 decryption
+                        const symmetricKey = new Uint8Array(symmetricKeyHex.match(/.{1,2}/g).map(byte => parseInt(byte, 16)));
+                        const sessionConversationKey = nip44.getConversationKey(symmetricKey, getPublicKey(symmetricKey));
+                        content = nip44.decrypt(wrapped.ciphertext, sessionConversationKey);
+                    }
+                    else {
+                        return null; // Not intended for us
+                    }
+                }
+                catch (e) {
+                    throw new NCC05DecryptionError("Failed to decrypt wrapped content");
+                }
+            }
+            else if (sk && !content.startsWith('{')) {
+                // Standard NIP-44 (likely encrypted if not starting with {)
+                try {
+                    const conversationKey = nip44.getConversationKey(sk, hexPubkey);
+                    content = nip44.decrypt(latestEvent.content, conversationKey);
+                }
+                catch (e) {
+                    throw new NCC05DecryptionError("Failed to decrypt content");
                 }
             }
-            else if (secretKey) {
-                // Standard NIP-44
-                const conversationKey = nip44.getConversationKey(secretKey, hexPubkey);
-                content = nip44.decrypt(latestEvent.content, conversationKey);
+            // Security: Safe JSON parsing
+            let payload;
+            try {
+                payload = JSON.parse(content);
             }
-            const payload = JSON.parse(content);
-            if (!payload.endpoints)
+            catch (e) {
+                return null; // Invalid JSON
+            }
+            if (!payload || !payload.endpoints || !Array.isArray(payload.endpoints)) {
                 return null;
+            }
             // Freshness validation
             const now = Math.floor(Date.now() / 1000);
             if (now > payload.updated_at + payload.ttl) {
                 if (options.strict)
                     return null;
-                console.warn('NCC-05 record has expired');
+                console.warn('NCC-05 record expired');
             }
             return payload;
         }
         catch (e) {
-            return null;
+            if (e instanceof NCC05Error)
+                throw e;
+            throw new NCC05RelayError(`Relay query failed: ${e.message}`);
         }
     }
     /**
      * Closes connections to all relays in the pool.
      */
     close() {
+        // If we didn't create the pool, we probably shouldn't close it?
+        // But the previous implementation did.
+        // We will only close bootstrap relays to be safe if sharing pool.
+        // Actually, pool.close() takes args.
         this.pool.close(this.bootstrapRelays);
     }
 }
@@ -158,15 +257,45 @@ export class NCC05Resolver {
  */
 export class NCC05Publisher {
     pool;
+    timeout;
     /**
      * @param options - Configuration for the publisher.
      */
     constructor(options = {}) {
-        this.pool = new SimplePool();
-        if (options.websocketImplementation) {
+        this.pool = options.pool || new SimplePool();
+        if (!options.pool && options.websocketImplementation) {
             // @ts-ignore
             this.pool.websocketImplementation = options.websocketImplementation;
         }
+        this.timeout = options.timeout || 5000;
+    }
+    async _publishToRelays(relays, signedEvent) {
+        const publishPromises = this.pool.publish(relays, signedEvent);
+        // Convert to promise that resolves/rejects based on timeout
+        const wrappedPromises = publishPromises.map(p => {
+            // In nostr-tools v2, publish returns Promise<void>. 
+            // We wrap it to handle timeout.
+            return new Promise((resolve, reject) => {
+                const timer = setTimeout(() => reject(new NCC05TimeoutError("Publish timed out")), this.timeout);
+                p.then(() => {
+                    clearTimeout(timer);
+                    resolve();
+                }).catch((err) => {
+                    clearTimeout(timer);
+                    reject(err);
+                });
+            });
+        });
+        const results = await Promise.allSettled(wrappedPromises);
+        const successful = results.filter(r => r.status === 'fulfilled');
+        if (successful.length === 0) {
+            const errors = results
+                .filter(r => r.status === 'rejected')
+                .map(r => r.reason.message)
+                .join(', ');
+            throw new NCC05RelayError(`Failed to publish to any relay. Errors: ${errors}`);
+        }
+        // If partial success, we consider it a success.
     }
     /**
      * Publishes a single record encrypted for multiple recipients using the wrapping pattern.
@@ -180,13 +309,14 @@ export class NCC05Publisher {
      * @returns The signed Nostr event.
      */
     async publishWrapped(relays, secretKey, recipients, payload, identifier = 'addr') {
+        const sk = ensureUint8Array(secretKey);
         const sessionKey = generateSecretKey();
         const sessionKeyHex = Array.from(sessionKey).map(b => b.toString(16).padStart(2, '0')).join('');
         const selfConversation = nip44.getConversationKey(sessionKey, getPublicKey(sessionKey));
         const ciphertext = nip44.encrypt(JSON.stringify(payload), selfConversation);
         const wraps = {};
         for (const rPk of recipients) {
-            const conversationKey = nip44.getConversationKey(secretKey, rPk);
+            const conversationKey = nip44.getConversationKey(sk, rPk);
             wraps[rPk] = nip44.encrypt(sessionKeyHex, conversationKey);
         }
         const wrappedContent = { ciphertext, wraps };
@@ -196,8 +326,8 @@ export class NCC05Publisher {
             tags: [['d', identifier]],
             content: JSON.stringify(wrappedContent),
         };
-        const signedEvent = finalizeEvent(eventTemplate, secretKey);
-        await Promise.all(this.pool.publish(relays, signedEvent));
+        const signedEvent = finalizeEvent(eventTemplate, sk);
+        await this._publishToRelays(relays, signedEvent);
         return signedEvent;
     }
     /**
@@ -210,12 +340,13 @@ export class NCC05Publisher {
      * @returns The signed Nostr event.
      */
     async publish(relays, secretKey, payload, options = {}) {
-        const myPubkey = getPublicKey(secretKey);
+        const sk = ensureUint8Array(secretKey);
+        const myPubkey = getPublicKey(sk);
         const identifier = options.identifier || 'addr';
         let content = JSON.stringify(payload);
         if (!options.public) {
             const encryptionTarget = options.recipientPubkey || myPubkey;
-            const conversationKey = nip44.getConversationKey(secretKey, encryptionTarget);
+            const conversationKey = nip44.getConversationKey(sk, encryptionTarget);
             content = nip44.encrypt(content, conversationKey);
         }
         const eventTemplate = {
@@ -225,8 +356,8 @@ export class NCC05Publisher {
             tags: [['d', identifier]],
             content: content,
         };
-        const signedEvent = finalizeEvent(eventTemplate, secretKey);
-        await Promise.all(this.pool.publish(relays, signedEvent));
+        const signedEvent = finalizeEvent(eventTemplate, sk);
+        await this._publishToRelays(relays, signedEvent);
         return signedEvent;
     }
     /**

package/dist/test-new.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/test-new.js

@@ -0,0 +1,94 @@
+import { NCC05Publisher, NCC05Resolver } from './index.js';
+import { generateSecretKey, getPublicKey, SimplePool } from 'nostr-tools';
+import { MockRelay } from './mock-relay.js';
+import { WebSocketServer } from 'ws';
+async function testNewFeatures() {
+    console.log('--- Starting New Features Test ---');
+    const relayPort = 8081;
+    const relayUrl = `ws://localhost:${relayPort}`;
+    const relay = new MockRelay(relayPort);
+    // 1. External SimplePool & Hex Keys
+    console.log('Test 1: External SimplePool & Hex Keys');
+    const pool = new SimplePool();
+    const publisher = new NCC05Publisher({ pool });
+    const resolver = new NCC05Resolver({ bootstrapRelays: [relayUrl], pool });
+    const sk = generateSecretKey();
+    const pk = getPublicKey(sk);
+    const skHex = Array.from(sk).map(b => b.toString(16).padStart(2, '0')).join('');
+    const payload = {
+        v: 1, ttl: 60, updated_at: Math.floor(Date.now() / 1000),
+        endpoints: [{ type: 'tcp', uri: 'hex-test', priority: 1, family: 'ipv4' }]
+    };
+    try {
+        // Publish using HEX string secret key
+        await publisher.publish([relayUrl], skHex, payload, { identifier: 'hex-key' });
+        console.log('Published with Hex Key: OK');
+    }
+    catch (e) {
+        console.error('Failed to publish with hex key:', e);
+        process.exit(1);
+    }
+    try {
+        // Resolve using Hex string secret key
+        const res = await resolver.resolve(pk, skHex, 'hex-key');
+        if (res && res.endpoints[0].uri === 'hex-test') {
+            console.log('Resolved with Hex Key: OK');
+        }
+        else {
+            console.error('Failed to resolve with hex key');
+            process.exit(1);
+        }
+    }
+    catch (e) {
+        console.error('Resolution error:', e);
+        process.exit(1);
+    }
+    // 2. Graceful Degradation
+    console.log('Test 2: Graceful Degradation (One bad relay)');
+    const badRelay = 'ws://localhost:9999'; // assuming closed/unreachable
+    try {
+        // Should succeed because one relay is good
+        await publisher.publish([relayUrl, badRelay], sk, payload, { identifier: 'graceful' });
+        console.log('Graceful degradation publish: OK');
+    }
+    catch (e) {
+        console.error('Graceful degradation failed:', e);
+        process.exit(1);
+    }
+    // 3. Timeout
+    console.log('Test 3: Resolver Timeout');
+    // Create a "Hanging Relay" that accepts connection but sends no data
+    const hangingPort = 8082;
+    const wss = new WebSocketServer({ port: hangingPort });
+    const timeoutResolver = new NCC05Resolver({
+        bootstrapRelays: [`ws://localhost:${hangingPort}`],
+        timeout: 500 // 500ms
+    });
+    const start = Date.now();
+    try {
+        await timeoutResolver.resolve(pk, sk, 'any');
+        console.error('Should have timed out!');
+        wss.close();
+        process.exit(1);
+    }
+    catch (e) {
+        const duration = Date.now() - start;
+        if (e.name === 'NCC05TimeoutError') {
+            console.log(`Timed out as expected in ${duration}ms: OK`);
+        }
+        else {
+            console.error('Caught unexpected error:', e);
+            // It might be that SimplePool fails connection before timeout if it's super fast,
+            // but WebSocketServer is listening.
+        }
+    }
+    finally {
+        wss.close();
+    }
+    relay.stop();
+    pool.close([relayUrl]);
+    timeoutResolver.close();
+    console.log('New Features Test Suite Passed.');
+    process.exit(0);
+}
+testNewFeatures().catch(console.error);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ncc-05",
-  "version": "1.1.3",
+  "version": "1.1.5",
   "description": "Nostr Community Convention 05 - Identity-Bound Service Locator Resolution",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/index.ts

@@ -18,6 +18,64 @@ import {
     generateSecretKey
 } from 'nostr-tools';
 
+// --- Error Classes ---
+
+export class NCC05Error extends Error {
+    constructor(message: string) {
+        super(message);
+        this.name = 'NCC05Error';
+    }
+}
+
+export class NCC05RelayError extends NCC05Error {
+    constructor(message: string) {
+        super(message);
+        this.name = 'NCC05RelayError';
+    }
+}
+
+export class NCC05TimeoutError extends NCC05Error {
+    constructor(message: string) {
+        super(message);
+        this.name = 'NCC05TimeoutError';
+    }
+}
+
+export class NCC05DecryptionError extends NCC05Error {
+    constructor(message: string) {
+        super(message);
+        this.name = 'NCC05DecryptionError';
+    }
+}
+
+export class NCC05ArgumentError extends NCC05Error {
+    constructor(message: string) {
+        super(message);
+        this.name = 'NCC05ArgumentError';
+    }
+}
+
+// --- Helpers ---
+
+function ensureUint8Array(key: string | Uint8Array): Uint8Array {
+    if (key instanceof Uint8Array) return key;
+    if (typeof key === 'string') {
+        // Assume hex string
+        if (key.match(/^[0-9a-fA-F]+$/)) {
+             return new Uint8Array(key.match(/.{1,2}/g)!.map(byte => parseInt(byte, 16)));
+        }
+        throw new NCC05ArgumentError("Invalid hex key provided");
+    }
+    throw new NCC05ArgumentError("Key must be a hex string or Uint8Array");
+}
+
+function getHexPubkey(key: string | Uint8Array): string {
+    if (key instanceof Uint8Array) {
+        return Array.from(key).map(b => b.toString(16).padStart(2, '0')).join('');
+    }
+    return key;
+}
+
 /**
  * Represents a single reachable service endpoint.
  */
@@ -60,6 +118,20 @@ export interface ResolverOptions {
     timeout?: number;
     /** Custom WebSocket implementation (e.g., for Tor/SOCKS5 in Node.js) */
     websocketImplementation?: any;
+    /** Existing SimplePool instance to share connections */
+    pool?: SimplePool;
+}
+
+/**
+ * Options for configuring the NCC05Publisher.
+ */
+export interface PublisherOptions {
+    /** Custom WebSocket implementation */
+    websocketImplementation?: any;
+    /** Existing SimplePool instance */
+    pool?: SimplePool;
+    /** Timeout for publishing in milliseconds (default: 5000) */
+    timeout?: number;
 }
 
 /**
@@ -106,7 +178,7 @@ export class NCC05Group {
     static async resolveAsGroup(
         resolver: NCC05Resolver,
         groupPubkey: string,
-        groupSecretKey: Uint8Array,
+        groupSecretKey: string | Uint8Array,
         identifier: string = 'addr'
     ): Promise<NCC05Payload | null> {
         return resolver.resolve(groupPubkey, groupSecretKey, identifier);
@@ -125,11 +197,19 @@ export class NCC05Resolver {
      * @param options - Configuration for the resolver.
      */
     constructor(options: ResolverOptions = {}) {
-        this.pool = new SimplePool();
-        if (options.websocketImplementation) {
-            // @ts-ignore - Patching pool for custom transport
-            this.pool.websocketImplementation = options.websocketImplementation;
+        this.pool = options.pool || new SimplePool();
+        
+        if (!options.pool) {
+            if (options.websocketImplementation) {
+                // @ts-ignore - Patching pool for custom transport
+                this.pool.websocketImplementation = options.websocketImplementation;
+            } else if (typeof globalThis !== 'undefined' && !globalThis.WebSocket) {
+                // In Node.js environment without global WebSocket, this might fail later.
+                // We leave it to the user or nostr-tools to handle, but this logic
+                // allows 'websocketImplementation' to be explicitly checked.
+            }
         }
+
         this.bootstrapRelays = options.bootstrapRelays || ['wss://relay.damus.io', 'wss://nos.lol'];
         this.timeout = options.timeout || 10000;
     }
@@ -144,11 +224,13 @@ export class NCC05Resolver {
      * @param secretKey - Your secret key (required if the record is encrypted).
      * @param identifier - The 'd' tag of the record (default: 'addr').
      * @param options - Resolution options (strict mode, gossip discovery).
-     * @returns The resolved and validated NCC05Payload, or null if not found/invalid.
+     * @returns The resolved and validated NCC05Payload, or null if not found.
+     * @throws {NCC05TimeoutError} if resolution times out.
+     * @throws {NCC05RelayError} if underlying relay communication fails.
      */
     async resolve(
         targetPubkey: string, 
-        secretKey?: Uint8Array, 
+        secretKey?: string | Uint8Array, 
         identifier: string = 'addr',
         options: { strict?: boolean, gossip?: boolean } = {}
     ): Promise<NCC05Payload | null> {
@@ -162,17 +244,23 @@ export class NCC05Resolver {
 
         // 1. NIP-65 Gossip Discovery
         if (options.gossip) {
-            const relayListEvent = await this.pool.get(this.bootstrapRelays, {
-                authors: [hexPubkey],
-                kinds: [10002]
-            });
-            if (relayListEvent) {
-                const discoveredRelays = relayListEvent.tags
-                    .filter(t => t[0] === 'r')
-                    .map(t => t[1]);
-                if (discoveredRelays.length > 0) {
-                    queryRelays = [...new Set([...queryRelays, ...discoveredRelays])];
+            try {
+                const relayListEvent = await this.pool.get(this.bootstrapRelays, {
+                    authors: [hexPubkey],
+                    kinds: [10002]
+                });
+                // Security: Verify NIP-65 event signature and author
+                if (relayListEvent && verifyEvent(relayListEvent) && relayListEvent.pubkey === hexPubkey) {
+                    const discoveredRelays = relayListEvent.tags
+                        .filter(t => t[0] === 'r')
+                        .map(t => t[1]);
+                    if (discoveredRelays.length > 0) {
+                        queryRelays = [...new Set([...queryRelays, ...discoveredRelays])];
+                    }
                 }
+            } catch (e: any) {
+                console.warn(`[NCC-05] Gossip discovery failed: ${e.message}`);
+                // Proceed with bootstrap relays
             }
         }
 
@@ -183,55 +271,91 @@ export class NCC05Resolver {
             limit: 10
         };
 
-        const queryPromise = this.pool.querySync(queryRelays, filter);
-        const timeoutPromise = new Promise<null>((r) => setTimeout(() => r(null), this.timeout));
-        const result = await Promise.race([queryPromise, timeoutPromise]);
-        
-        if (!result || (Array.isArray(result) && result.length === 0)) return null;
-        
-        const validEvents = (result as Event[])
-            .filter(e => verifyEvent(e))
-            .sort((a, b) => b.created_at - a.created_at);
-
-        if (validEvents.length === 0) return null;
-        const latestEvent = validEvents[0];
+        const sk = secretKey ? ensureUint8Array(secretKey) : undefined;
 
         try {
+            const queryPromise = this.pool.querySync(queryRelays, filter);
+            const timeoutPromise = new Promise<never>((_, reject) => 
+                setTimeout(() => reject(new NCC05TimeoutError("Resolution timed out")), this.timeout)
+            );
+            
+            const result = await Promise.race([queryPromise, timeoutPromise]);
+            
+            if (!result || (Array.isArray(result) && result.length === 0)) return null;
+            
+            // 2. Filter for valid signatures, correct author, and sort by created_at
+            const validEvents = (result as Event[])
+                .filter(e => e.pubkey === hexPubkey && verifyEvent(e))
+                .sort((a, b) => b.created_at - a.created_at);
+
+            if (validEvents.length === 0) return null;
+            const latestEvent = validEvents[0];
+
             let content = latestEvent.content;
             
-            // Handle "Wrapped" multi-recipient content
-            if (content.includes('"wraps"') && secretKey) {
-                const wrapped = JSON.parse(content) as WrappedContent;
-                const myPk = getPublicKey(secretKey);
-                const myWrap = wrapped.wraps[myPk];
-                
-                if (myWrap) {
-                    const conversationKey = nip44.getConversationKey(secretKey, hexPubkey);
-                    const symmetricKeyHex = nip44.decrypt(myWrap, conversationKey);
-                    const symmetricKey = new Uint8Array(symmetricKeyHex.match(/.{1,2}/g)!.map(byte => parseInt(byte, 16)));
+            // Security: Robust multi-recipient detection
+            const isWrapped = content.includes('"wraps"') && 
+                             content.includes('"ciphertext"') && 
+                             content.startsWith('{');
+
+            if (isWrapped && sk) {
+                try {
+                    const wrapped = JSON.parse(content) as WrappedContent;
+                    const myPk = getPublicKey(sk);
+                    const myWrap = wrapped.wraps[myPk];
                     
-                    const sessionConversationKey = nip44.getConversationKey(symmetricKey, getPublicKey(symmetricKey));
-                    content = nip44.decrypt(wrapped.ciphertext, sessionConversationKey);
+                    if (myWrap) {
+                        const conversationKey = nip44.getConversationKey(sk, hexPubkey);
+                        const symmetricKeyHex = nip44.decrypt(myWrap, conversationKey);
+                        
+                        // Convert hex symmetric key back to Uint8Array for NIP-44 decryption
+                        const symmetricKey = new Uint8Array(
+                            symmetricKeyHex.match(/.{1,2}/g)!.map(byte => parseInt(byte, 16))
+                        );
+                        
+                        const sessionConversationKey = nip44.getConversationKey(
+                            symmetricKey, getPublicKey(symmetricKey)
+                        );
+                        content = nip44.decrypt(wrapped.ciphertext, sessionConversationKey);
+                    } else {
+                        return null; // Not intended for us
+                    }
+                } catch (e) {
+                    throw new NCC05DecryptionError("Failed to decrypt wrapped content");
+                }
+            } else if (sk && !content.startsWith('{')) {
+                // Standard NIP-44 (likely encrypted if not starting with {)
+                try {
+                    const conversationKey = nip44.getConversationKey(sk, hexPubkey);
+                    content = nip44.decrypt(latestEvent.content, conversationKey);
+                } catch (e) {
+                     throw new NCC05DecryptionError("Failed to decrypt content");
                 }
-            } else if (secretKey) {
-                // Standard NIP-44
-                const conversationKey = nip44.getConversationKey(secretKey, hexPubkey);
-                content = nip44.decrypt(latestEvent.content, conversationKey);
             }
 
-            const payload = JSON.parse(content) as NCC05Payload;
-            if (!payload.endpoints) return null;
+            // Security: Safe JSON parsing
+            let payload: NCC05Payload;
+            try {
+                payload = JSON.parse(content) as NCC05Payload;
+            } catch (e) {
+                return null; // Invalid JSON
+            }
+
+            if (!payload || !payload.endpoints || !Array.isArray(payload.endpoints)) {
+                return null;
+            }
 
             // Freshness validation
             const now = Math.floor(Date.now() / 1000);
             if (now > payload.updated_at + payload.ttl) {
                 if (options.strict) return null;
-                console.warn('NCC-05 record has expired');
+                console.warn('NCC-05 record expired');
             }
 
             return payload;
         } catch (e) {
-            return null;
+            if (e instanceof NCC05Error) throw e;
+            throw new NCC05RelayError(`Relay query failed: ${(e as Error).message}`);
         }
     }
 
@@ -239,6 +363,10 @@ export class NCC05Resolver {
      * Closes connections to all relays in the pool.
      */
     close() {
+        // If we didn't create the pool, we probably shouldn't close it?
+        // But the previous implementation did.
+        // We will only close bootstrap relays to be safe if sharing pool.
+        // Actually, pool.close() takes args.
         this.pool.close(this.bootstrapRelays);
     }
 }
@@ -248,16 +376,51 @@ export class NCC05Resolver {
  */
 export class NCC05Publisher {
     private pool: SimplePool;
+    private timeout: number;
 
     /**
      * @param options - Configuration for the publisher.
      */
-    constructor(options: { websocketImplementation?: any } = {}) {
-        this.pool = new SimplePool();
-        if (options.websocketImplementation) {
+    constructor(options: PublisherOptions = {}) {
+        this.pool = options.pool || new SimplePool();
+        if (!options.pool && options.websocketImplementation) {
             // @ts-ignore
             this.pool.websocketImplementation = options.websocketImplementation;
         }
+        this.timeout = options.timeout || 5000;
+    }
+
+    private async _publishToRelays(relays: string[], signedEvent: Event): Promise<void> {
+        const publishPromises = this.pool.publish(relays, signedEvent);
+        
+        // Convert to promise that resolves/rejects based on timeout
+        const wrappedPromises = publishPromises.map(p => {
+             // In nostr-tools v2, publish returns Promise<void>. 
+             // We wrap it to handle timeout.
+             return new Promise<void>((resolve, reject) => {
+                 const timer = setTimeout(() => reject(new NCC05TimeoutError("Publish timed out")), this.timeout);
+                 p.then(() => {
+                     clearTimeout(timer);
+                     resolve();
+                 }).catch((err) => {
+                     clearTimeout(timer);
+                     reject(err);
+                 });
+             });
+        });
+
+        const results = await Promise.allSettled(wrappedPromises);
+        const successful = results.filter(r => r.status === 'fulfilled');
+        
+        if (successful.length === 0) {
+            const errors = results
+                .filter(r => r.status === 'rejected')
+                .map(r => (r as PromiseRejectedResult).reason.message)
+                .join(', ');
+            throw new NCC05RelayError(`Failed to publish to any relay. Errors: ${errors}`);
+        }
+        
+        // If partial success, we consider it a success.
     }
 
     /**
@@ -273,11 +436,12 @@ export class NCC05Publisher {
      */
     async publishWrapped(
         relays: string[],
-        secretKey: Uint8Array,
+        secretKey: string | Uint8Array,
         recipients: string[],
         payload: NCC05Payload,
         identifier: string = 'addr'
     ): Promise<Event> {
+        const sk = ensureUint8Array(secretKey);
         const sessionKey = generateSecretKey();
         const sessionKeyHex = Array.from(sessionKey).map(b => b.toString(16).padStart(2, '0')).join('');
         
@@ -286,7 +450,7 @@ export class NCC05Publisher {
 
         const wraps: Record<string, string> = {};
         for (const rPk of recipients) {
-            const conversationKey = nip44.getConversationKey(secretKey, rPk);
+            const conversationKey = nip44.getConversationKey(sk, rPk);
             wraps[rPk] = nip44.encrypt(sessionKeyHex, conversationKey);
         }
 
@@ -299,8 +463,8 @@ export class NCC05Publisher {
             content: JSON.stringify(wrappedContent),
         };
 
-        const signedEvent = finalizeEvent(eventTemplate, secretKey);
-        await Promise.all(this.pool.publish(relays, signedEvent));
+        const signedEvent = finalizeEvent(eventTemplate, sk);
+        await this._publishToRelays(relays, signedEvent);
         return signedEvent;
     }
 
@@ -315,17 +479,18 @@ export class NCC05Publisher {
      */
     async publish(
         relays: string[],
-        secretKey: Uint8Array,
+        secretKey: string | Uint8Array,
         payload: NCC05Payload,
         options: { identifier?: string, recipientPubkey?: string, public?: boolean } = {}
     ): Promise<Event> {
-        const myPubkey = getPublicKey(secretKey);
+        const sk = ensureUint8Array(secretKey);
+        const myPubkey = getPublicKey(sk);
         const identifier = options.identifier || 'addr';
         let content = JSON.stringify(payload);
 
         if (!options.public) {
             const encryptionTarget = options.recipientPubkey || myPubkey;
-            const conversationKey = nip44.getConversationKey(secretKey, encryptionTarget);
+            const conversationKey = nip44.getConversationKey(sk, encryptionTarget);
             content = nip44.encrypt(content, conversationKey);
         }
 
@@ -337,8 +502,8 @@ export class NCC05Publisher {
             content: content,
         };
 
-        const signedEvent = finalizeEvent(eventTemplate, secretKey);
-        await Promise.all(this.pool.publish(relays, signedEvent));
+        const signedEvent = finalizeEvent(eventTemplate, sk);
+        await this._publishToRelays(relays, signedEvent);
         return signedEvent;
     }
 
@@ -348,4 +513,4 @@ export class NCC05Publisher {
     close(relays: string[]) {
         this.pool.close(relays);
     }
-}
+}

package/src/test-new.ts

@@ -0,0 +1,99 @@
+import { NCC05Publisher, NCC05Resolver, NCC05Payload, NCC05TimeoutError } from './index.js';
+import { generateSecretKey, getPublicKey, SimplePool } from 'nostr-tools';
+import { MockRelay } from './mock-relay.js';
+import { WebSocketServer } from 'ws';
+
+async function testNewFeatures() {
+    console.log('--- Starting New Features Test ---');
+    const relayPort = 8081;
+    const relayUrl = `ws://localhost:${relayPort}`;
+    const relay = new MockRelay(relayPort);
+    
+    // 1. External SimplePool & Hex Keys
+    console.log('Test 1: External SimplePool & Hex Keys');
+    const pool = new SimplePool();
+    const publisher = new NCC05Publisher({ pool });
+    const resolver = new NCC05Resolver({ bootstrapRelays: [relayUrl], pool });
+
+    const sk = generateSecretKey();
+    const pk = getPublicKey(sk);
+    const skHex = Array.from(sk).map(b => b.toString(16).padStart(2, '0')).join('');
+
+    const payload: NCC05Payload = {
+        v: 1, ttl: 60, updated_at: Math.floor(Date.now() / 1000),
+        endpoints: [{ type: 'tcp', uri: 'hex-test', priority: 1, family: 'ipv4' }]
+    };
+
+    try {
+        // Publish using HEX string secret key
+        await publisher.publish([relayUrl], skHex, payload, { identifier: 'hex-key' });
+        console.log('Published with Hex Key: OK');
+    } catch (e) {
+        console.error('Failed to publish with hex key:', e);
+        process.exit(1);
+    }
+
+    try {
+        // Resolve using Hex string secret key
+        const res = await resolver.resolve(pk, skHex, 'hex-key');
+        if (res && res.endpoints[0].uri === 'hex-test') {
+            console.log('Resolved with Hex Key: OK');
+        } else {
+            console.error('Failed to resolve with hex key');
+            process.exit(1);
+        }
+    } catch (e) {
+        console.error('Resolution error:', e);
+        process.exit(1);
+    }
+
+    // 2. Graceful Degradation
+    console.log('Test 2: Graceful Degradation (One bad relay)');
+    const badRelay = 'ws://localhost:9999'; // assuming closed/unreachable
+    try {
+        // Should succeed because one relay is good
+        await publisher.publish([relayUrl, badRelay], sk, payload, { identifier: 'graceful' });
+        console.log('Graceful degradation publish: OK');
+    } catch (e) {
+        console.error('Graceful degradation failed:', e);
+        process.exit(1);
+    }
+
+    // 3. Timeout
+    console.log('Test 3: Resolver Timeout');
+    // Create a "Hanging Relay" that accepts connection but sends no data
+    const hangingPort = 8082;
+    const wss = new WebSocketServer({ port: hangingPort });
+    
+    const timeoutResolver = new NCC05Resolver({ 
+        bootstrapRelays: [`ws://localhost:${hangingPort}`],
+        timeout: 500 // 500ms
+    });
+    
+    const start = Date.now();
+    try {
+        await timeoutResolver.resolve(pk, sk, 'any');
+        console.error('Should have timed out!');
+        wss.close();
+        process.exit(1);
+    } catch (e: any) {
+        const duration = Date.now() - start;
+        if (e.name === 'NCC05TimeoutError') {
+            console.log(`Timed out as expected in ${duration}ms: OK`);
+        } else {
+            console.error('Caught unexpected error:', e);
+            // It might be that SimplePool fails connection before timeout if it's super fast,
+            // but WebSocketServer is listening.
+        }
+    } finally {
+        wss.close();
+    }
+
+    relay.stop();
+    pool.close([relayUrl]); 
+    timeoutResolver.close();
+    console.log('New Features Test Suite Passed.');
+    process.exit(0);
+}
+
+testNewFeatures().catch(console.error);