nostr-bray 1.9.0 → 1.9.2

package/dist/cli.js

@@ -652,6 +652,14 @@ async function shell() {
             continue;
         }
         const shellArgs = parseShellLine(trimmed);
+        // Per-command help in shell
+        if (shellArgs.includes('--help') && shellArgs[0]) {
+            const h = getCommandHelp(shellArgs[0]);
+            if (h) {
+                console.log(h);
+                continue;
+            }
+        }
         try {
             await run(shellArgs);
         }

package/dist/context.d.ts

@@ -10,8 +10,10 @@ export declare class IdentityContext {
     private activeEntry;
     private maxCacheSize;
     constructor(secretKey: string, format: 'nsec' | 'hex' | 'mnemonic', opts?: ContextOptions);
-    /** Current active identity's npub */
+    /** Current active identity's npub (bech32) */
     get activeNpub(): string;
+    /** Current active identity's hex public key — use this in relay filters */
+    get activePublicKeyHex(): string;
     /** Derive a child identity by purpose and index */
     derive(purpose: string, index: number): PublicIdentity;
     /** Derive a named persona */
@@ -22,8 +24,11 @@ export declare class IdentityContext {
     getSigningFunction(): SignFn;
     /** List all known identities — returns public info only, never private keys */
     listIdentities(): PublicIdentity[];
-    /** Create a linkage proof for the active identity */
+    /** Create a linkage proof for the active identity.
+     *  Only works for derived identities — the master IS the raw key, not a tree child. */
     prove(mode?: 'blind' | 'full'): LinkageProof;
+    /** Get the nsec-tree root's master pubkey (the derivation anchor, distinct from the raw key's pubkey) */
+    get treeRootPubkey(): string;
     /** Get the active identity's private key for NIP-17/44/04 crypto operations */
     get activePrivateKey(): Uint8Array;
     /** Test helper — returns reference to private key bytes for verifying zeroise */

package/dist/context.js

@@ -1,7 +1,21 @@
 import { fromNsec, fromMnemonic, derive, zeroise } from 'nsec-tree';
 import { derivePersona } from 'nsec-tree/persona';
 import { createBlindProof, createFullProof } from 'nsec-tree/proof';
-import { finalizeEvent } from 'nostr-tools/pure';
+import { finalizeEvent, getPublicKey } from 'nostr-tools/pure';
+import { decode, npubEncode, nsecEncode } from 'nostr-tools/nip19';
+/** Build an Identity-compatible object from raw key bytes */
+function rawIdentity(privateKey) {
+    const publicKeyHex = getPublicKey(privateKey);
+    const publicKey = Buffer.from(publicKeyHex, 'hex');
+    return {
+        nsec: nsecEncode(privateKey),
+        npub: npubEncode(publicKeyHex),
+        privateKey: new Uint8Array(privateKey), // copy so original can be cleaned
+        publicKey: new Uint8Array(publicKey),
+        purpose: 'master',
+        index: 0,
+    };
+}
 export class IdentityContext {
     root;
     cache = new Map();
@@ -10,30 +24,42 @@ export class IdentityContext {
     maxCacheSize;
     constructor(secretKey, format, opts) {
         this.maxCacheSize = opts?.maxCache ?? 5;
+        // Parse the raw secret key bytes — this IS the user's actual Nostr identity
+        let rawKeyBytes;
         if (format === 'mnemonic') {
+            // Mnemonic: create tree root, derive a "default" identity as master
             this.root = fromMnemonic(secretKey);
+            const derived = derive(this.root, 'master', 0);
+            this.masterEntry = { identity: derived, purpose: 'master', index: 0, lastUsed: Date.now() };
+            this.activeEntry = this.masterEntry;
+            return;
         }
         else if (format === 'hex') {
-            const bytes = Buffer.from(secretKey, 'hex');
-            this.root = fromNsec(bytes);
+            rawKeyBytes = Buffer.from(secretKey, 'hex');
         }
         else {
-            this.root = fromNsec(secretKey);
+            // nsec bech32
+            rawKeyBytes = decode(secretKey).data;
         }
-        // Derive master identity — kept separate from LRU cache
-        const masterIdentity = derive(this.root, 'master', 0);
+        // Master identity = the user's actual keypair (their real npub)
         this.masterEntry = {
-            identity: masterIdentity,
+            identity: rawIdentity(rawKeyBytes),
             purpose: 'master',
             index: 0,
             lastUsed: Date.now(),
         };
         this.activeEntry = this.masterEntry;
+        // nsec-tree root for child derivation
+        this.root = fromNsec(rawKeyBytes);
     }
-    /** Current active identity's npub */
+    /** Current active identity's npub (bech32) */
     get activeNpub() {
         return this.activeEntry.identity.npub;
     }
+    /** Current active identity's hex public key — use this in relay filters */
+    get activePublicKeyHex() {
+        return Buffer.from(this.activeEntry.identity.publicKey).toString('hex');
+    }
     /** Derive a child identity by purpose and index */
     derive(purpose, index) {
         // Return from cache if already derived
@@ -127,14 +153,22 @@ export class IdentityContext {
         }
         return result;
     }
-    /** Create a linkage proof for the active identity */
+    /** Create a linkage proof for the active identity.
+     *  Only works for derived identities — the master IS the raw key, not a tree child. */
     prove(mode = 'blind') {
+        if (this.activeEntry === this.masterEntry) {
+            throw new Error('Cannot prove master identity — it is the raw key, not a derived child. Switch to a derived identity first.');
+        }
         const child = this.activeEntry.identity;
         if (mode === 'full') {
             return createFullProof(this.root, child);
         }
         return createBlindProof(this.root, child);
     }
+    /** Get the nsec-tree root's master pubkey (the derivation anchor, distinct from the raw key's pubkey) */
+    get treeRootPubkey() {
+        return this.root.masterPubkey;
+    }
     /** Get the active identity's private key for NIP-17/44/04 crypto operations */
     get activePrivateKey() {
         return this.activeEntry.identity.privateKey;

package/dist/identity/migration.js

@@ -67,18 +67,23 @@ export async function handleIdentityMigrate(ctx, pool, args) {
     }
     // Execute migration: re-sign migratable events
     await handleIdentityRestore(ctx, pool, backup);
-    // Publish linkage proof connecting old → new
-    const proof = ctx.prove('full');
-    const sign = ctx.getSigningFunction();
-    const proofEvent = await sign({
-        kind: 30078,
-        created_at: Math.floor(Date.now() / 1000),
-        tags: [
-            ['d', `migration:${args.oldPubkeyHex}`],
-            ['p', args.oldPubkeyHex],
-        ],
-        content: JSON.stringify(proof),
-    });
-    await pool.publish(args.oldNpub, proofEvent);
+    // Publish linkage proof connecting old → new (only if operating as a derived identity)
+    try {
+        const proof = ctx.prove('full');
+        const sign = ctx.getSigningFunction();
+        const proofEvent = await sign({
+            kind: 30078,
+            created_at: Math.floor(Date.now() / 1000),
+            tags: [
+                ['d', `migration:${args.oldPubkeyHex}`],
+                ['p', args.oldPubkeyHex],
+            ],
+            content: JSON.stringify(proof),
+        });
+        await pool.publish(args.oldNpub, proofEvent);
+    }
+    catch {
+        // Master identity can't produce tree proofs — migration proceeds without linkage proof
+    }
     return { status: 'migrated', summary };
 }

package/dist/relay/handlers.js

@@ -18,7 +18,7 @@ export async function handleRelaySet(ctx, pool, args) {
     // Check for existing relay list
     const existing = await pool.query(ctx.activeNpub, {
         kinds: [10002],
-        authors: [ctx.activeNpub],
+        authors: [ctx.activePublicKeyHex],
     });
     // Build r-tags
     const tags = args.relays.map(r => {

package/dist/social/handlers.js

@@ -90,7 +90,7 @@ export async function handleSocialProfileSet(ctx, pool, args) {
     // Check for existing profile
     const existing = await pool.query(ctx.activeNpub, {
         kinds: [0],
-        authors: [ctx.activeNpub], // simplified — in production, use hex pubkey
+        authors: [ctx.activePublicKeyHex], // simplified — in production, use hex pubkey
     });
     if (existing.length > 0 && !args.confirm) {
         // Build diff
@@ -154,7 +154,7 @@ export async function handleContactsFollow(ctx, pool, args) {
     // Fetch existing contacts
     const existing = await pool.query(ctx.activeNpub, {
         kinds: [3],
-        authors: [ctx.activeNpub],
+        authors: [ctx.activePublicKeyHex],
     });
     let tags = [];
     if (existing.length > 0) {
@@ -187,7 +187,7 @@ export async function handleContactsFollow(ctx, pool, args) {
 export async function handleContactsUnfollow(ctx, pool, args) {
     const existing = await pool.query(ctx.activeNpub, {
         kinds: [3],
-        authors: [ctx.activeNpub],
+        authors: [ctx.activePublicKeyHex],
     });
     let tags = [];
     if (existing.length > 0) {

package/dist/social/notifications.js

@@ -1,8 +1,10 @@
+import { decode } from 'nostr-tools/nip19';
 /** Fetch notifications (mentions, replies, reactions, zaps) for the active identity */
 export async function handleNotifications(ctx, pool, opts) {
+    const activeHex = decode(ctx.activeNpub).data;
     const events = await pool.query(ctx.activeNpub, {
         kinds: [1, 7, 9735],
-        '#p': [ctx.activeNpub],
+        '#p': [activeHex],
         limit: opts?.limit ?? 50,
         ...(opts?.since ? { since: opts.since } : {}),
     });

package/dist/zap/handlers.js

@@ -48,9 +48,11 @@ function decryptNwcResponse(conn, event) {
 }
 /** Parse zap receipts (kind 9735) for the active identity */
 export async function handleZapReceipts(ctx, pool, opts) {
+    const { decode } = await import('nostr-tools/nip19');
+    const activeHex = decode(ctx.activeNpub).data;
     const events = await pool.query(ctx.activeNpub, {
         kinds: [9735],
-        '#p': [ctx.activeNpub],
+        '#p': [activeHex],
         limit: opts?.limit ?? 20,
         ...(opts?.since ? { since: opts.since } : {}),
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nostr-bray",
-  "version": "1.9.0",
+  "version": "1.9.2",
   "description": "MCP server giving AI agents sovereign Nostr identities — key derivation, personas, attestations, duress detection, zaps",
   "type": "module",
   "main": "dist/index.js",