nostr-bray 1.26.1 → 1.27.0

package/dist/bunker-context.d.ts

@@ -20,6 +20,8 @@ export interface BunkerConfig {
 }
 /** Parse a bunker:// URI */
 export declare function parseBunkerUri(uri: string): BunkerConfig;
+/** Resolve the client secret key: URI secret > cached > generate & persist. */
+export declare function resolveClientKey(config: BunkerConfig, stateDir?: string): Uint8Array;
 export declare class BunkerContext implements SigningContext {
     protected signer: BunkerSigner;
     protected pool: SimplePool;

package/dist/bunker-context.js

@@ -14,6 +14,7 @@ import { useWebSocketImplementation, SimplePool } from 'nostr-tools/pool';
 import { generateSecretKey } from 'nostr-tools/pure';
 import { npubEncode } from 'nostr-tools/nip19';
 import WebSocket from 'ws';
+import { readStateFile, writeStateFile } from './state.js';
 useWebSocketImplementation(WebSocket);
 /** Parse a bunker:// URI */
 export function parseBunkerUri(uri) {
@@ -27,6 +28,21 @@ export function parseBunkerUri(uri) {
     }
     return { pubkey, relays, secret };
 }
+const CLIENT_KEYS_FILE = 'client-keys.json';
+/** Resolve the client secret key: URI secret > cached > generate & persist. */
+export function resolveClientKey(config, stateDir) {
+    if (config.secret) {
+        return Buffer.from(config.secret, 'hex');
+    }
+    const cache = readStateFile(CLIENT_KEYS_FILE, stateDir);
+    if (cache[config.pubkey]) {
+        return Buffer.from(cache[config.pubkey], 'hex');
+    }
+    const sk = generateSecretKey();
+    cache[config.pubkey] = Buffer.from(sk).toString('hex');
+    writeStateFile(CLIENT_KEYS_FILE, cache, stateDir);
+    return sk;
+}
 export class BunkerContext {
     signer;
     pool;
@@ -40,9 +56,7 @@ export class BunkerContext {
     /** Connect to a remote bunker. Blocks until the connection is established. */
     static async connect(uri, timeoutMs = 15_000) {
         const config = parseBunkerUri(uri);
-        const clientSk = config.secret
-            ? Buffer.from(config.secret, 'hex')
-            : generateSecretKey();
+        const clientSk = resolveClientKey(config);
         const pool = new SimplePool();
         const signer = BunkerSigner.fromBunker(clientSk, { pubkey: config.pubkey, relays: config.relays, secret: null }, { pool });
         // Connect and verify

package/dist/bunker.d.ts

@@ -17,6 +17,7 @@ export interface BunkerOptions {
     bunkerKeyHex?: string;
     quiet?: boolean;
     heartwoodExtensions?: boolean;
+    stateDir?: string;
 }
 export interface BunkerInstance {
     url: string;

package/dist/bunker.js

@@ -14,17 +14,26 @@ import { finalizeEvent, getPublicKey, generateSecretKey } from 'nostr-tools/pure
 import { npubEncode } from 'nostr-tools/nip19';
 import { useWebSocketImplementation, SimplePool } from 'nostr-tools/pool';
 import WebSocket from 'ws';
+import { readStateFile, writeStateFile } from './state.js';
 useWebSocketImplementation(WebSocket);
 export function startBunker(opts) {
     const { ctx, relays, quiet } = opts;
-    const authorizedKeys = new Set(opts.authorizedKeys ?? []);
     const log = quiet ? () => { } : (...args) => console.error('[bunker]', ...args);
-    // Use persistent key if provided, otherwise generate ephemeral
+    // Bunker keypair — must be computed first so we can load persisted approvals
     const bunkerSk = opts.bunkerKeyHex
         ? Buffer.from(opts.bunkerKeyHex, 'hex')
         : generateSecretKey();
     const bunkerPk = getPublicKey(bunkerSk);
     const bunkerNpub = npubEncode(bunkerPk);
+    // Authorised clients: CLI flag controls the gate, persisted approvals supplement
+    const APPROVALS_FILE = 'approved-clients.json';
+    const persisted = readStateFile(APPROVALS_FILE, opts.stateDir);
+    const bunkerApprovals = persisted[bunkerPk] ?? [];
+    const cliAuthorizedKeys = new Set(opts.authorizedKeys ?? []);
+    const authorizedKeys = new Set([
+        ...cliAuthorizedKeys,
+        ...bunkerApprovals,
+    ]);
     const pool = new SimplePool();
     // Subscribe to kind 24133 events addressed to us
     const sub = pool.subscribeMany(relays, { kinds: [24133], '#p': [bunkerPk] }, {
@@ -39,8 +48,8 @@ export function startBunker(opts) {
     });
     async function handleRequest(event) {
         const clientPk = event.pubkey;
-        // Check authorization
-        if (authorizedKeys.size > 0 && !authorizedKeys.has(clientPk)) {
+        // Check authorization — gate only activates when CLI --authorized-keys were set
+        if (cliAuthorizedKeys.size > 0 && !authorizedKeys.has(clientPk)) {
             log(`Rejected request from unauthorized key: ${clientPk.slice(0, 12)}...`);
             return;
         }
@@ -60,6 +69,15 @@ export function startBunker(opts) {
         let error;
         switch (request.method) {
             case 'connect':
+                // Persist newly-approved client
+                if (!bunkerApprovals.includes(clientPk)) {
+                    bunkerApprovals.push(clientPk);
+                    authorizedKeys.add(clientPk);
+                    const current = readStateFile(APPROVALS_FILE, opts.stateDir);
+                    current[bunkerPk] = bunkerApprovals;
+                    writeStateFile(APPROVALS_FILE, current, opts.stateDir);
+                    log(`Approved and persisted client: ${clientPk.slice(0, 12)}...`);
+                }
                 result = 'ack';
                 break;
             case 'ping':
@@ -188,8 +206,8 @@ export function startBunker(opts) {
     log(`Bunker started: ${bunkerNpub}`);
     log(`URI: ${bunkerUrl}`);
     log(`Signing as: ${ctx.activeNpub}`);
-    if (authorizedKeys.size > 0) {
-        log(`Authorized keys: ${authorizedKeys.size}`);
+    if (cliAuthorizedKeys.size > 0) {
+        log(`Authorized keys: ${authorizedKeys.size} (${cliAuthorizedKeys.size} CLI + ${bunkerApprovals.length} persisted)`);
     }
     else {
         log('WARNING: No authorized keys set — accepting requests from anyone');

package/dist/state.d.ts

@@ -0,0 +1,4 @@
+/** Read and parse a JSON state file. Returns `{}` if missing or corrupt. */
+export declare function readStateFile<T = Record<string, unknown>>(name: string, stateDir?: string): T;
+/** Write a JSON state file with 0600 permissions. Creates directory if needed. */
+export declare function writeStateFile(name: string, data: unknown, stateDir?: string): void;

package/dist/state.js

@@ -0,0 +1,23 @@
+import { readFileSync, writeFileSync, mkdirSync, chmodSync, existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+const DEFAULT_STATE_DIR = join(process.env.XDG_CONFIG_HOME ?? join(homedir(), '.config'), 'bray');
+/** Read and parse a JSON state file. Returns `{}` if missing or corrupt. */
+export function readStateFile(name, stateDir = DEFAULT_STATE_DIR) {
+    const path = join(stateDir, name);
+    try {
+        return JSON.parse(readFileSync(path, 'utf-8'));
+    }
+    catch {
+        return {};
+    }
+}
+/** Write a JSON state file with 0600 permissions. Creates directory if needed. */
+export function writeStateFile(name, data, stateDir = DEFAULT_STATE_DIR) {
+    if (!existsSync(stateDir)) {
+        mkdirSync(stateDir, { recursive: true });
+    }
+    const path = join(stateDir, name);
+    writeFileSync(path, JSON.stringify(data, null, 2), { mode: 0o600 });
+    chmodSync(path, 0o600);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nostr-bray",
-  "version": "1.26.1",
+  "version": "1.27.0",
   "description": "Trust-aware Nostr for AI and humans. Three dimensions of trust -- verification, proximity, and access -- woven into every interaction.",
   "type": "module",
   "main": "dist/index.js",