refactor(audio-rooms): NestsClient API matches nostrnests reality (phase 2/3)

The Phase-1 interop harness exposed a substantial mismatch between our production HTTP client and what the nostrnests reference server actually exposes. This commit refactors `:nestsClient` and the wiring above it so the production code path can talk to a real moq-auth + moq-relay. | Aspect | Before | After (matches nostrnests/moq-auth/src/index.ts) | |-----------|-------------------------------------------|--------------------------------------------------| | Method | GET | POST | | URL | `<base>/<roomId>` | `<base>/auth` | | Body | none | `{"namespace":"nests/<kind>:<host>:<roomId>","publish":bool}` | | Response | `{endpoint, token, codec, sample_rate}` | `{token}` only | | Endpoint | from response | from event's `endpoint` tag (passed via `NestsRoomConfig.endpoint`) | | NIP-98 | bound to GET URL | bound to POST URL + body hash | Type changes: - New `NestsRoomConfig` data class bundling (authBaseUrl, endpoint, hostPubkey, roomId, kind). Built by the caller (UI / VM) from the NIP-53 kind 30312 event before invoking connectNests*. - `NestsRoomConfig.moqNamespace()` produces the exact format moq-auth's NAMESPACE_REGEX expects: `nests/<kind>:<hex64>:<roomId>`. - `NestsRoomInfo` deleted; replaced with a tiny `NestsTokenResponse(token)` matching the real response shape. - `NestsClient.resolveRoom(serviceBase, roomId, signer): NestsRoomInfo` → `NestsClient.mintToken(room, publish, signer): String`. The publish flag drives the JWT claims (`get` for listeners, `put` for speakers). Wire path: - `OkHttpNestsClient` now POSTs `<authBase>/auth` with a JSON body and a NIP-98 Authorization header bound to (POST, url, body-hash). - `connectNestsListener` / `connectNestsSpeaker` take `room: NestsRoomConfig` instead of split (serviceBase, roomId), pass `publish=false` / `publish=true` respectively, and use the room's `endpoint` (not a server-returned one) for the WebTransport connect. The minted JWT is the bearer token. - `NestsListenerState.Connected` / `NestsSpeakerState.Connected` / `Broadcasting` carry the `room: NestsRoomConfig` instead of the old `roomInfo: NestsRoomInfo`. - MoQ TrackNamespace for the room is now a single segment whose bytes are `room.moqNamespace()` — the simplest mapping to the relay's JWT claim check (`root: "<namespace>"`); Phase-3 round-trip test will confirm and adjust if the relay expects a multi-segment tuple. Wiring above: - `AudioRoomViewModel` constructor: replaces `(serviceBase, roomId)` with `(room: NestsRoomConfig)`. Connector seam interfaces (NestsListenerConnector, NestsSpeakerConnector) follow the same shape. - `AudioRoomViewModelFactory` (Android) takes `room: NestsRoomConfig`. - `AudioRoomActivity` adds `EXTRA_AUTH_BASE_URL`, `EXTRA_ENDPOINT`, `EXTRA_HOST_PUBKEY`, `EXTRA_KIND` Intent extras (was just service + roomId) and reconstructs `NestsRoomConfig` in onCreate. Drops `EXTRA_SERVICE_BASE`. - `AudioRoomJoinCard` reads `event.endpoint()` + `event.pubKey` + `event.kind` in addition to `event.service()`; rooms missing any of those are silently un-joinable (the event author didn't host on a nests-compatible relay). - `AudioRoomActivityContent` takes `room: NestsRoomConfig` in place of (serviceBase, roomId) and threads it down. Phase-1 ping test rewired to use the production `OkHttpNestsClient` end-to-end against the real `/auth`, asserting we get back a 3-segment JWT. Existing in-process tests updated for the new types: NestsConnectTest, NestsSpeakerTest, AudioRoomViewModelTest. NestsRoomInfoTest renamed to NestsRoomConfigTest with new cases for the namespace formatter and the auth-URL helper. All 80 in-process tests still green. Phase 3 (next) will add the full round-trip interop test that runs production `connectNestsListener` + `connectNestsSpeaker` through the real moq-relay — that's where MoQ wire-format assumptions (draft revision, OBJECT_DATAGRAM layout, namespace tuple shape) get verified or get followup audit findings.
2026-04-26 14:42:26 +00:00
parent 3283d302fa
commit beec8204e5
17 changed files with 353 additions and 318 deletions
@@ -98,9 +98,18 @@ class AudioRoomActivity : AppCompatActivity() {

        val accountViewModel = AudioRoomBridge.accountViewModel
        val addressValue = intent.getStringExtra(EXTRA_ADDRESS)
-        val serviceBase = intent.getStringExtra(EXTRA_SERVICE_BASE)
+        val authBaseUrl = intent.getStringExtra(EXTRA_AUTH_BASE_URL)
+        val endpoint = intent.getStringExtra(EXTRA_ENDPOINT)
+        val hostPubkey = intent.getStringExtra(EXTRA_HOST_PUBKEY)
        val roomId = intent.getStringExtra(EXTRA_ROOM_ID)
-        if (accountViewModel == null || addressValue == null || serviceBase == null || roomId == null) {
+        val kind = intent.getIntExtra(EXTRA_KIND, com.vitorpamplona.nestsclient.NestsRoomConfig.MEETING_SPACE_KIND)
+        if (accountViewModel == null ||
+            addressValue == null ||
+            authBaseUrl == null ||
+            endpoint == null ||
+            hostPubkey == null ||
+            roomId == null
+        ) {
            // After process death the bridge is empty (the previous
            // process's AccountViewModel is gone). Bounce the user back to
            // MainActivity so they land on the lobby instead of a black
@@ -138,8 +147,14 @@ class AudioRoomActivity : AppCompatActivity() {
            AmethystTheme {
                AudioRoomActivityContent(
                    addressValue = addressValue,
-                    serviceBase = serviceBase,
-                    roomId = roomId,
+                    room =
+                        com.vitorpamplona.nestsclient.NestsRoomConfig(
+                            authBaseUrl = authBaseUrl,
+                            endpoint = endpoint,
+                            hostPubkey = hostPubkey,
+                            roomId = roomId,
+                            kind = kind,
+                        ),
                    accountViewModel = accountViewModel,
                    isInPipMode = isInPipMode.value,
                    onMuteState = { muted ->
@@ -237,8 +252,11 @@ class AudioRoomActivity : AppCompatActivity() {

    companion object {
        const val EXTRA_ADDRESS = "com.vitorpamplona.amethyst.AUDIO_ROOM_ADDRESS"
-        const val EXTRA_SERVICE_BASE = "com.vitorpamplona.amethyst.AUDIO_ROOM_SERVICE_BASE"
+        const val EXTRA_AUTH_BASE_URL = "com.vitorpamplona.amethyst.AUDIO_ROOM_AUTH_BASE_URL"
+        const val EXTRA_ENDPOINT = "com.vitorpamplona.amethyst.AUDIO_ROOM_ENDPOINT"
+        const val EXTRA_HOST_PUBKEY = "com.vitorpamplona.amethyst.AUDIO_ROOM_HOST_PUBKEY"
        const val EXTRA_ROOM_ID = "com.vitorpamplona.amethyst.AUDIO_ROOM_ROOM_ID"
+        const val EXTRA_KIND = "com.vitorpamplona.amethyst.AUDIO_ROOM_KIND"
        private const val ACTION_PIP_TOGGLE_MUTE = "com.vitorpamplona.amethyst.AUDIO_ROOM_PIP_MUTE"
        private const val ACTION_PIP_LEAVE = "com.vitorpamplona.amethyst.AUDIO_ROOM_PIP_LEAVE"
        private const val PIP_MUTE_REQ = 0x6A001
@@ -247,15 +265,21 @@ class AudioRoomActivity : AppCompatActivity() {
        fun launch(
            context: Context,
            addressValue: String,
-            serviceBase: String,
+            authBaseUrl: String,
+            endpoint: String,
+            hostPubkey: String,
            roomId: String,
+            kind: Int,
        ) {
            context.startActivity(
                Intent(context, AudioRoomActivity::class.java).apply {
                    addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)
                    putExtra(EXTRA_ADDRESS, addressValue)
-                    putExtra(EXTRA_SERVICE_BASE, serviceBase)
+                    putExtra(EXTRA_AUTH_BASE_URL, authBaseUrl)
+                    putExtra(EXTRA_ENDPOINT, endpoint)
+                    putExtra(EXTRA_HOST_PUBKEY, hostPubkey)
                    putExtra(EXTRA_ROOM_ID, roomId)
+                    putExtra(EXTRA_KIND, kind)
                },
            )
        }
@@ -60,8 +60,7 @@ import kotlinx.coroutines.launch
@Composable
 internal fun AudioRoomActivityContent(
    addressValue: String,
-    serviceBase: String,
-    roomId: String,
+    room: com.vitorpamplona.nestsclient.NestsRoomConfig,
    accountViewModel: AccountViewModel,
    isInPipMode: Boolean,
    onMuteState: (Boolean) -> Unit,
@@ -82,8 +81,7 @@ internal fun AudioRoomActivityContent(
        val event = addressableNote.event as? MeetingSpaceEvent ?: return@LoadAddressableNote
        AudioRoomActivityBody(
            event = event,
-            serviceBase = serviceBase,
-            roomId = roomId,
+            room = room,
            accountViewModel = accountViewModel,
            isInPipMode = isInPipMode,
            onMuteState = onMuteState,
@@ -97,8 +95,7 @@ internal fun AudioRoomActivityContent(
@Composable
 private fun AudioRoomActivityBody(
    event: MeetingSpaceEvent,
-    serviceBase: String,
-    roomId: String,
+    room: com.vitorpamplona.nestsclient.NestsRoomConfig,
    accountViewModel: AccountViewModel,
    isInPipMode: Boolean,
    onMuteState: (Boolean) -> Unit,
@@ -124,13 +121,12 @@ private fun AudioRoomActivityBody(

    val viewModel: AudioRoomViewModel =
        viewModel(
-            key = "$serviceBase|$roomId",
+            key = "${room.authBaseUrl}|${room.roomId}",
            factory =
-                remember(serviceBase, roomId, signer) {
+                remember(room, signer) {
                    AudioRoomViewModelFactory(
                        signer = signer,
-                        serviceBase = serviceBase,
-                        roomId = roomId,
+                        room = room,
                    )
                },
        )
@@ -74,11 +74,17 @@ private fun AudioRoomJoinCardContent(
    accountViewModel: AccountViewModel,
 ) {
    val serviceBase = event.service()
+    val endpoint = event.endpoint()
    val roomId = event.address().dTag
-    if (serviceBase.isNullOrBlank() || roomId.isBlank()) return
+    // Need the auth base, MoQ endpoint, and the room creator's pubkey to
+    // mint a JWT scoped to this namespace. Skip rendering Join when any
+    // are missing — those rooms aren't joinable on the audio plane.
+    if (serviceBase.isNullOrBlank() || endpoint.isNullOrBlank() || roomId.isBlank()) return

    val context = LocalContext.current
    val addressValue = remember(event) { event.address().toValue() }
+    val hostPubkey = event.pubKey
+    val kind = event.kind

    Card(
        modifier = Modifier.fillMaxWidth().padding(8.dp),
@@ -106,8 +112,11 @@ private fun AudioRoomJoinCardContent(
                    AudioRoomActivity.launch(
                        context = context,
                        addressValue = addressValue,
-                        serviceBase = serviceBase,
+                        authBaseUrl = serviceBase,
+                        endpoint = endpoint,
+                        hostPubkey = hostPubkey,
                        roomId = roomId,
+                        kind = kind,
                    )
                }) {
                    Text(stringRes(R.string.audio_room_join))
@@ -23,6 +23,7 @@ package com.vitorpamplona.amethyst.ui.screen.loggedIn.audiorooms.room
 import androidx.lifecycle.ViewModel
 import androidx.lifecycle.ViewModelProvider
 import com.vitorpamplona.amethyst.commons.viewmodels.AudioRoomViewModel
+import com.vitorpamplona.nestsclient.NestsRoomConfig
 import com.vitorpamplona.nestsclient.OkHttpNestsClient
 import com.vitorpamplona.nestsclient.audio.AudioRecordCapture
 import com.vitorpamplona.nestsclient.audio.AudioTrackPlayer
@@ -40,8 +41,7 @@ import com.vitorpamplona.quartz.nip01Core.signers.NostrSigner
 */
 internal class AudioRoomViewModelFactory(
    private val signer: NostrSigner,
-    private val serviceBase: String,
-    private val roomId: String,
+    private val room: NestsRoomConfig,
 ) : ViewModelProvider.Factory {
    @Suppress("UNCHECKED_CAST")
    override fun <T : ViewModel> create(modelClass: Class<T>): T =
@@ -51,8 +51,7 @@ internal class AudioRoomViewModelFactory(
            decoderFactory = { MediaCodecOpusDecoder() },
            playerFactory = { AudioTrackPlayer() },
            signer = signer,
-            serviceBase = serviceBase,
-            roomId = roomId,
+            room = room,
            captureFactory = { AudioRecordCapture() },
            encoderFactory = { MediaCodecOpusEncoder() },
        ) as T
@@ -28,6 +28,7 @@ import com.vitorpamplona.nestsclient.BroadcastHandle
 import com.vitorpamplona.nestsclient.NestsClient
 import com.vitorpamplona.nestsclient.NestsListener
 import com.vitorpamplona.nestsclient.NestsListenerState
+import com.vitorpamplona.nestsclient.NestsRoomConfig
 import com.vitorpamplona.nestsclient.NestsSpeaker
 import com.vitorpamplona.nestsclient.NestsSpeakerState
 import com.vitorpamplona.nestsclient.audio.AudioCapture
@@ -95,8 +96,7 @@ class AudioRoomViewModel(
    private val decoderFactory: () -> OpusDecoder,
    private val playerFactory: () -> AudioPlayer,
    private val signer: NostrSigner,
-    private val serviceBase: String,
-    private val roomId: String,
+    private val room: NestsRoomConfig,
    // Speaker-side audio capture/encode actuals. Optional — desktop and
    // listener-only callers pass null and the speaker UI hides the talk
    // button. Android passes `{ AudioRecordCapture() }` /
@@ -240,8 +240,7 @@ class AudioRoomViewModel(
                            httpClient = httpClient,
                            transport = transport,
                            scope = viewModelScope,
-                            serviceBase = serviceBase,
-                            roomId = roomId,
+                            room = room,
                            signer = signer,
                            speakerPubkeyHex = speakerPubkeyHex,
                            captureFactory = captureFactory!!,
@@ -486,8 +485,7 @@ class AudioRoomViewModel(
                            httpClient = httpClient,
                            transport = transport,
                            scope = viewModelScope,
-                            serviceBase = serviceBase,
-                            roomId = roomId,
+                            room = room,
                            signer = signer,
                        )
                    if (closed) {
@@ -844,20 +842,18 @@ fun interface NestsListenerConnector {
        httpClient: NestsClient,
        transport: WebTransportFactory,
        scope: CoroutineScope,
-        serviceBase: String,
-        roomId: String,
+        room: NestsRoomConfig,
        signer: NostrSigner,
    ): NestsListener
 }

 private val DefaultNestsListenerConnector =
-    NestsListenerConnector { httpClient, transport, scope, serviceBase, roomId, signer ->
+    NestsListenerConnector { httpClient, transport, scope, room, signer ->
        connectNestsListener(
            httpClient = httpClient,
            transport = transport,
            scope = scope,
-            serviceBase = serviceBase,
-            roomId = roomId,
+            room = room,
            signer = signer,
        )
    }
@@ -868,8 +864,7 @@ fun interface NestsSpeakerConnector {
        httpClient: NestsClient,
        transport: WebTransportFactory,
        scope: CoroutineScope,
-        serviceBase: String,
-        roomId: String,
+        room: NestsRoomConfig,
        signer: NostrSigner,
        speakerPubkeyHex: String,
        captureFactory: () -> AudioCapture,
@@ -878,13 +873,12 @@ fun interface NestsSpeakerConnector {
 }

 private val DefaultNestsSpeakerConnector =
-    NestsSpeakerConnector { httpClient, transport, scope, serviceBase, roomId, signer, pubkey, capF, encF ->
+    NestsSpeakerConnector { httpClient, transport, scope, room, signer, pubkey, capF, encF ->
        connectNestsSpeaker(
            httpClient = httpClient,
            transport = transport,
            scope = scope,
-            serviceBase = serviceBase,
-            roomId = roomId,
+            room = room,
            signer = signer,
            speakerPubkeyHex = pubkey,
            captureFactory = capF,
@@ -24,7 +24,7 @@ import com.vitorpamplona.nestsclient.NestsClient
 import com.vitorpamplona.nestsclient.NestsException
 import com.vitorpamplona.nestsclient.NestsListener
 import com.vitorpamplona.nestsclient.NestsListenerState
-import com.vitorpamplona.nestsclient.NestsRoomInfo
+import com.vitorpamplona.nestsclient.NestsRoomConfig
 import com.vitorpamplona.nestsclient.audio.AudioPlayer
 import com.vitorpamplona.nestsclient.audio.OpusDecoder
 import com.vitorpamplona.nestsclient.moq.SubscribeHandle
@@ -93,7 +93,7 @@ class AudioRoomViewModelTest {

            // Connector resolves with the listener; it's still Idle until we
            // emit something. Drive it Connected directly.
-            fakeListener.emit(NestsListenerState.Connected(roomInfo = ROOM_INFO, negotiatedMoqVersion = 0xff000011))
+            fakeListener.emit(NestsListenerState.Connected(room = ROOM_CONFIG, negotiatedMoqVersion = 0xff000011))

            assertEquals(ConnectionUiState.Connected, vm.uiState.value.connection)
        }
@@ -161,7 +161,7 @@ class AudioRoomViewModelTest {
            val vm = newViewModel { fakeListener }

            vm.connect()
-            fakeListener.emit(NestsListenerState.Connected(ROOM_INFO, 0xff000011))
+            fakeListener.emit(NestsListenerState.Connected(ROOM_CONFIG, 0xff000011))
            assertEquals(ConnectionUiState.Connected, vm.uiState.value.connection)

            vm.disconnect()
@@ -195,7 +195,7 @@ class AudioRoomViewModelTest {
            val vm = newViewModel { fakeListener }

            vm.connect()
-            fakeListener.emit(NestsListenerState.Connected(ROOM_INFO, 0xff000011))
+            fakeListener.emit(NestsListenerState.Connected(ROOM_CONFIG, 0xff000011))
            // Speaking-now is empty until an object arrives — exercising the
            // timeout-based clearing requires a live SubscribeHandle, which is
            // covered in nestsClient's pipe tests. Here we just verify the
@@ -219,10 +219,9 @@ class AudioRoomViewModelTest {
            decoderFactory = { NoopOpusDecoder },
            playerFactory = { NoopAudioPlayer() },
            signer = NoopSigner,
-            serviceBase = "https://example.test/api/v1/nests",
-            roomId = "test-room",
+            room = ROOM_CONFIG,
            connector =
-                NestsListenerConnector { _, _, scope, _, _, _ ->
+                NestsListenerConnector { _, _, scope, _, _ ->
                    connect(scope)
                },
            // Wire to the test's backgroundScope so close calls run during
@@ -249,11 +248,11 @@ class AudioRoomViewModelTest {
    }

    private object NoopNestsClient : NestsClient {
-        override suspend fun resolveRoom(
-            serviceBase: String,
-            roomId: String,
+        override suspend fun mintToken(
+            room: NestsRoomConfig,
+            publish: Boolean,
            signer: NostrSigner,
-        ): NestsRoomInfo = error("resolveRoom not used (connector seam bypasses it)")
+        ): String = error("mintToken not used (connector seam bypasses it)")
    }

    private object NoopWebTransportFactory : WebTransportFactory {
@@ -318,6 +317,12 @@ class AudioRoomViewModelTest {
    }

    companion object {
-        private val ROOM_INFO = NestsRoomInfo(endpoint = "https://relay.example.test/moq")
+        private val ROOM_CONFIG =
+            NestsRoomConfig(
+                authBaseUrl = "https://relay.example.test/api/v1/nests",
+                endpoint = "https://relay.example.test/moq",
+                hostPubkey = "0".repeat(64),
+                roomId = "test-room",
+            )
    }
 }
@@ -35,21 +35,25 @@ import com.vitorpamplona.quartz.nip01Core.signers.NostrSigner
 */
 interface NestsClient {
    /**
-     * Fetch [NestsRoomInfo] for a specific room.
+     * Mint a JWT scoped to one MoQ namespace. Posts a NIP-98-signed
+     * request to `<authBase>/auth` per the nostrnests reference server
+     * (`moq-auth/src/index.ts`); the returned token is the bearer the
+     * MoQ relay validates against the auth sidecar's JWKS endpoint.
     *
-     * @param serviceBase value of the NIP-53 kind 30312 `service` tag
-     *     (e.g. `https://nostrnests.com/api/v1/nests`)
-     * @param roomId the event's `d` tag
-     * @param signer signs the NIP-98 auth event that the server uses to verify
-     *     the caller owns the pubkey it claims
-     * @throws NestsException on transport errors, non-2xx responses, or malformed
-     *     JSON
+     * @param room per-room config carrying authBase, host pubkey, room id.
+     * @param publish `true` if the caller wants publish rights for their
+     *     own pubkey under this namespace; `false` for listen-only.
+     * @param signer signs the NIP-98 auth event. The server verifies the
+     *     event binds to this exact (url, method, body-hash) tuple, so
+     *     the JWT cannot be replayed against a different request.
+     * @throws NestsException on transport errors, non-2xx responses, or
+     *     malformed JSON.
     */
-    suspend fun resolveRoom(
-        serviceBase: String,
-        roomId: String,
+    suspend fun mintToken(
+        room: NestsRoomConfig,
+        publish: Boolean,
        signer: NostrSigner,
-    ): NestsRoomInfo
+    ): String
 }

 /**
@@ -36,10 +36,11 @@ import kotlinx.coroutines.flow.MutableStateFlow
 * Walk the full join-as-listener handshake against a nests-compatible audio
 * server:
 *
- *   1. Resolve the room — POST/GET `<serviceBase>/<roomId>` with NIP-98 auth,
- *      returning [NestsRoomInfo] (the MoQ endpoint + bearer token).
+ *   1. Mint a JWT — POST `<authBase>/auth` with NIP-98 + namespace body
+ *      (see [NestsClient.mintToken]).
 *   2. Open a [com.vitorpamplona.nestsclient.transport.WebTransportSession]
- *      against the endpoint via [transport].
+ *      against the [room.endpoint] via [transport], passing the JWT as the
+ *      bearer token.
 *   3. Run the MoQ SETUP handshake.
 *
 * The returned [NestsListener] is in state [NestsListenerState.Connected];
@@ -47,7 +48,9 @@ import kotlinx.coroutines.flow.MutableStateFlow
 * [NestsListenerState.Failed] with the underlying cause attached and the
 * transport torn down.
 *
- * @param signer NIP-98 signer for the resolveRoom HTTP call.
+ * @param room per-room config built from the NIP-53 kind 30312 event by
+ *   the caller (UI / VM).
+ * @param signer NIP-98 signer for the mintToken HTTP call.
 * @param scope where the [MoqSession] pumps live (typically the caller's
 *   ViewModel scope so they cancel when the screen leaves).
 * @param supportedMoqVersions in preference order; defaults to draft-17.
@@ -56,8 +59,7 @@ suspend fun connectNestsListener(
    httpClient: NestsClient,
    transport: WebTransportFactory,
    scope: CoroutineScope,
-    serviceBase: String,
-    roomId: String,
+    room: NestsRoomConfig,
    signer: NostrSigner,
    supportedMoqVersions: List<Long> = listOf(MoqVersion.DRAFT_17),
 ): NestsListener {
@@ -66,11 +68,11 @@ suspend fun connectNestsListener(
            NestsListenerState.Connecting(NestsListenerState.Connecting.ConnectStep.ResolvingRoom),
        )

-    val roomInfo =
+    val token =
        try {
-            httpClient.resolveRoom(serviceBase = serviceBase, roomId = roomId, signer = signer)
+            httpClient.mintToken(room = room, publish = false, signer = signer)
        } catch (t: NestsException) {
-            state.value = NestsListenerState.Failed("Room resolution failed: ${t.message}", t)
+            state.value = NestsListenerState.Failed("Auth failed: ${t.message}", t)
            return failedListener(state)
        }

@@ -78,11 +80,11 @@ suspend fun connectNestsListener(

    val (authority, path) =
        try {
-            parseEndpoint(roomInfo.endpoint)
+            parseEndpoint(room.endpoint)
        } catch (t: Throwable) {
            state.value =
                NestsListenerState.Failed(
-                    "Malformed MoQ endpoint URL '${roomInfo.endpoint}': ${t.message}",
+                    "Malformed MoQ endpoint URL '${room.endpoint}': ${t.message}",
                    t,
                )
            return failedListener(state)
@@ -90,7 +92,7 @@ suspend fun connectNestsListener(

    val webTransport =
        try {
-            transport.connect(authority = authority, path = path, bearerToken = roomInfo.token)
+            transport.connect(authority = authority, path = path, bearerToken = token)
        } catch (t: WebTransportException) {
            state.value =
                NestsListenerState.Failed(
@@ -118,10 +120,15 @@ suspend fun connectNestsListener(
            return failedListener(state)
        }

-    state.value = NestsListenerState.Connected(roomInfo, negotiatedVersion)
+    state.value = NestsListenerState.Connected(room, negotiatedVersion)
    return DefaultNestsListener(
        session = moq,
-        roomNamespace = TrackNamespace.of("nests", roomId),
+        // moq-auth's JWT claim is `root: "<moqNamespace>"` — the simplest
+        // wire-level mapping is a 1-segment TrackNamespace whose only
+        // element is that exact string. Phase-3 interop test will
+        // confirm; if the real relay expects a multi-segment tuple
+        // (e.g. split on `/` or `:`), adjust here.
+        roomNamespace = TrackNamespace.of(room.moqNamespace()),
        mutableState = state,
    )
 }
@@ -160,8 +167,7 @@ suspend fun connectNestsSpeaker(
    httpClient: NestsClient,
    transport: WebTransportFactory,
    scope: CoroutineScope,
-    serviceBase: String,
-    roomId: String,
+    room: NestsRoomConfig,
    signer: NostrSigner,
    speakerPubkeyHex: String,
    captureFactory: () -> AudioCapture,
@@ -173,11 +179,11 @@ suspend fun connectNestsSpeaker(
            NestsSpeakerState.Connecting(NestsSpeakerState.Connecting.ConnectStep.ResolvingRoom),
        )

-    val roomInfo =
+    val token =
        try {
-            httpClient.resolveRoom(serviceBase = serviceBase, roomId = roomId, signer = signer)
+            httpClient.mintToken(room = room, publish = true, signer = signer)
        } catch (t: NestsException) {
-            state.value = NestsSpeakerState.Failed("Room resolution failed: ${t.message}", t)
+            state.value = NestsSpeakerState.Failed("Auth failed: ${t.message}", t)
            return failedSpeaker(state)
        }

@@ -185,11 +191,11 @@ suspend fun connectNestsSpeaker(

    val (authority, path) =
        try {
-            parseEndpoint(roomInfo.endpoint)
+            parseEndpoint(room.endpoint)
        } catch (t: Throwable) {
            state.value =
                NestsSpeakerState.Failed(
-                    "Malformed MoQ endpoint URL '${roomInfo.endpoint}': ${t.message}",
+                    "Malformed MoQ endpoint URL '${room.endpoint}': ${t.message}",
                    t,
                )
            return failedSpeaker(state)
@@ -197,7 +203,7 @@ suspend fun connectNestsSpeaker(

    val webTransport =
        try {
-            transport.connect(authority = authority, path = path, bearerToken = roomInfo.token)
+            transport.connect(authority = authority, path = path, bearerToken = token)
        } catch (t: WebTransportException) {
            state.value =
                NestsSpeakerState.Failed(
@@ -225,10 +231,11 @@ suspend fun connectNestsSpeaker(
            return failedSpeaker(state)
        }

-    state.value = NestsSpeakerState.Connected(roomInfo, negotiatedVersion)
+    state.value = NestsSpeakerState.Connected(room, negotiatedVersion)
    return DefaultNestsSpeaker(
        session = moq,
-        roomNamespace = TrackNamespace.of("nests", roomId),
+        // Same single-segment shape as the listener path; see comment there.
+        roomNamespace = TrackNamespace.of(room.moqNamespace()),
        speakerTrackName = speakerPubkeyHex.encodeToByteArray(),
        captureFactory = captureFactory,
        encoderFactory = encoderFactory,
@@ -82,9 +82,9 @@ sealed class NestsListenerState {
        }
    }

-    /** Connection is live. [roomInfo] reflects the resolved server metadata. */
+    /** Connection is live. [room] reflects the (auth, endpoint, room) we connected to. */
    data class Connected(
-        val roomInfo: NestsRoomInfo,
+        val room: NestsRoomConfig,
        val negotiatedMoqVersion: Long,
    ) : NestsListenerState()

@@ -20,30 +20,51 @@
 */
 package com.vitorpamplona.nestsclient

-import kotlinx.serialization.SerialName
 import kotlinx.serialization.Serializable
 import kotlinx.serialization.json.Json
-import kotlinx.serialization.json.JsonElement

 /**
- * Information returned by a nests audio-room backend when a client
- * authenticates against `<service>/api/v1/nests/<roomId>`.
+ * Per-room configuration that orchestration needs to connect. Built from
+ * the NIP-53 kind 30312 [MeetingSpaceEvent] by the caller (UI / VM)
+ * before invoking `connectNestsListener` / `connectNestsSpeaker`:
 *
- * Field names mirror the nests reference server payload:
- * ```
- * { "endpoint": "...", "token": "...", "codec": "opus", "sample_rate": 48000 }
- * ```
- * All fields except [endpoint] are optional so the client can negotiate with
- * alternate nests implementations that omit codec/token metadata.
+ *   - [authBaseUrl] — the event's `service` tag (e.g. `https://nostrnests.com/api/v1/nests`).
+ *     Note: the real moq-auth API is rooted at this base; the client posts
+ *     to `<authBaseUrl>/auth` to mint a JWT.
+ *   - [endpoint] — the event's `endpoint` tag (e.g. `https://relay.nostrnests.com:4443/anon`).
+ *     The MoQ relay's WebTransport URL.
+ *   - [hostPubkey] — the event author's pubkey. Goes into the
+ *     [NestsAuth.MOQ_NAMESPACE_PREFIX] to scope the JWT to this room.
+ *   - [roomId] — the event's `d` tag.
+ *   - [kind] — the NIP-53 event kind (30312 for meeting spaces).
+ */
+data class NestsRoomConfig(
+    val authBaseUrl: String,
+    val endpoint: String,
+    val hostPubkey: String,
+    val roomId: String,
+    val kind: Int = MEETING_SPACE_KIND,
+) {
+    /**
+     * MoQ namespace string for this room, in the format moq-auth expects:
+     * `nests/<kind>:<host_pubkey_hex>:<roomId>`.
+     */
+    fun moqNamespace(): String = "nests/$kind:$hostPubkey:$roomId"
+
+    companion object {
+        const val MEETING_SPACE_KIND: Int = 30312
+    }
+}
+
+/**
+ * Response shape from `POST <authBase>/auth`. The reference server
+ * (`nostrnests/nests/moq-auth/src/index.ts`) returns `{"token":"<jwt>"}`
+ * — that JWT is then passed as the WebTransport bearer token to the
+ * MoQ relay.
 */
@Serializable
-data class NestsRoomInfo(
-    val endpoint: String,
-    val token: String? = null,
-    val codec: String? = null,
-    @SerialName("sample_rate") val sampleRate: Int? = null,
-    val transport: String? = null,
-    val extra: Map<String, JsonElement> = emptyMap(),
+data class NestsTokenResponse(
+    val token: String,
 ) {
    companion object {
        private val json =
@@ -52,23 +73,15 @@ data class NestsRoomInfo(
                explicitNulls = false
            }

-        fun parse(body: String): NestsRoomInfo = json.decodeFromString(serializer(), body)
+        fun parse(body: String): NestsTokenResponse = json.decodeFromString(serializer(), body)
    }
 }

 /**
- * Build the URL a client should call to resolve [NestsRoomInfo] for a specific
- * room. [serviceBase] comes from the `service` tag of the NIP-53 kind 30312
- * event; [roomId] is the event's `d` tag.
+ * Build the auth URL for a given service base. Trims trailing slashes
+ * and appends `/auth`.
 *
- * Example: `https://nostrnests.com/api/v1/nests` + `abc-123` →
- * `https://nostrnests.com/api/v1/nests/abc-123`.
+ * Example: `https://nostrnests.com/api/v1/nests` →
+ * `https://nostrnests.com/api/v1/nests/auth`.
 */
-fun nestsRoomInfoUrl(
-    serviceBase: String,
-    roomId: String,
-): String {
-    val trimmed = serviceBase.trimEnd('/')
-    val encoded = roomId.trim()
-    return "$trimmed/$encoded"
-}
+fun nestsAuthUrl(authBase: String): String = authBase.trimEnd('/') + "/auth"
@@ -95,13 +95,13 @@ sealed class NestsSpeakerState {

    /** Connection live; ready for [NestsSpeaker.startBroadcasting]. */
    data class Connected(
-        val roomInfo: NestsRoomInfo,
+        val room: NestsRoomConfig,
        val negotiatedMoqVersion: Long,
    ) : NestsSpeakerState()

    /** Currently announcing + emitting OBJECT_DATAGRAMs for our track. */
    data class Broadcasting(
-        val roomInfo: NestsRoomInfo,
+        val room: NestsRoomConfig,
        val negotiatedMoqVersion: Long,
        val isMuted: Boolean,
    ) : NestsSpeakerState()
@@ -161,7 +161,7 @@ class DefaultNestsSpeaker internal constructor(
            broadcaster.start()
            mutableState.value =
                NestsSpeakerState.Broadcasting(
-                    roomInfo = current.roomInfo,
+                    room = current.room,
                    negotiatedMoqVersion = current.negotiatedMoqVersion,
                    isMuted = false,
                )
@@ -187,7 +187,7 @@ class DefaultNestsSpeaker internal constructor(
        val current = mutableState.value
        if (current is NestsSpeakerState.Broadcasting) {
            mutableState.value =
-                NestsSpeakerState.Connected(current.roomInfo, current.negotiatedMoqVersion)
+                NestsSpeakerState.Connected(current.room, current.negotiatedMoqVersion)
        }
    }

@@ -41,17 +41,19 @@ import kotlin.test.assertTrue
 import kotlin.test.fail

 class NestsConnectTest {
+    private val room =
+        NestsRoomConfig(
+            authBaseUrl = "https://relay.example.com/api/v1/nests",
+            endpoint = "https://relay.example.com/moq",
+            hostPubkey = "0".repeat(64),
+            roomId = "abc",
+        )
+
    @Test
-    fun connect_walks_resolveRoom_then_transport_then_moq_handshake() =
+    fun connect_walks_mintToken_then_transport_then_moq_handshake() =
        runTest {
            val (clientSide, serverSide) = FakeWebTransport.pair()
-            val httpClient =
-                FakeNestsClient(
-                    NestsRoomInfo(
-                        endpoint = "https://relay.example.com/moq",
-                        token = "tok-abc",
-                    ),
-                )
+            val httpClient = FakeNestsClient(token = "tok-abc")
            val transport = ConstantWebTransportFactory(clientSide)

            // Server-side raw peer answers SETUP.
@@ -67,31 +69,29 @@ class NestsConnectTest {
                    httpClient = httpClient,
                    transport = transport,
                    scope = this,
-                    serviceBase = "https://relay.example.com/api/v1/nests",
-                    roomId = "abc",
+                    room = room,
                    signer = NostrSignerInternal(KeyPair()),
                )
            server.await()

            val connected = assertIs<NestsListenerState.Connected>(listener.state.value)
-            assertEquals("https://relay.example.com/moq", connected.roomInfo.endpoint)
+            assertEquals(room, connected.room)
            assertEquals(MoqVersion.DRAFT_17, connected.negotiatedMoqVersion)

            assertEquals("relay.example.com", transport.lastConnectedAuthority)
            assertEquals("/moq", transport.lastConnectedPath)
            assertEquals("tok-abc", transport.lastBearer)

+            assertEquals(false, httpClient.lastPublishFlag, "listener mints with publish=false")
+
            listener.close()
            assertIs<NestsListenerState.Closed>(listener.state.value)
        }

    @Test
-    fun resolveRoom_failure_short_circuits_to_Failed() =
+    fun mintToken_failure_short_circuits_to_Failed() =
        runTest {
-            val httpClient =
-                ThrowingNestsClient(
-                    NestsException("server returned 500", status = 500),
-                )
+            val httpClient = ThrowingNestsClient(NestsException("server returned 500", status = 500))
            val transport = NeverConnectFactory()

            val listener =
@@ -99,13 +99,12 @@ class NestsConnectTest {
                    httpClient = httpClient,
                    transport = transport,
                    scope = this,
-                    serviceBase = "https://relay.example.com/api/v1/nests",
-                    roomId = "abc",
+                    room = room,
                    signer = NostrSignerInternal(KeyPair()),
                )

            val failed = assertIs<NestsListenerState.Failed>(listener.state.value)
-            assertTrue("Room resolution failed" in failed.reason)
+            assertTrue("Auth failed" in failed.reason)
            assertTrue("500" in failed.reason || (failed.cause as? NestsException)?.status == 500)
            assertEquals(0, transport.connectCallCount, "transport must not be reached")
        }
@@ -113,8 +112,7 @@ class NestsConnectTest {
    @Test
    fun transport_handshake_failure_short_circuits_to_Failed() =
        runTest {
-            val httpClient =
-                FakeNestsClient(NestsRoomInfo(endpoint = "https://relay.example.com/moq"))
+            val httpClient = FakeNestsClient(token = "tok")
            val transport =
                ThrowingTransportFactory(
                    WebTransportException(
@@ -128,8 +126,7 @@ class NestsConnectTest {
                    httpClient = httpClient,
                    transport = transport,
                    scope = this,
-                    serviceBase = "https://relay.example.com/api/v1/nests",
-                    roomId = "abc",
+                    room = room,
                    signer = NostrSignerInternal(KeyPair()),
                )

@@ -140,16 +137,13 @@ class NestsConnectTest {
    @Test
    fun malformed_endpoint_url_short_circuits_to_Failed() =
        runTest {
-            val httpClient =
-                FakeNestsClient(NestsRoomInfo(endpoint = "not-a-url"))
-
+            val badRoom = room.copy(endpoint = "not-a-url")
            val listener =
                connectNestsListener(
-                    httpClient = httpClient,
+                    httpClient = FakeNestsClient(token = "tok"),
                    transport = NeverConnectFactory(),
                    scope = this,
-                    serviceBase = "https://relay.example.com/api/v1/nests",
-                    roomId = "abc",
+                    room = badRoom,
                    signer = NostrSignerInternal(KeyPair()),
                )

@@ -180,23 +174,29 @@ class NestsConnectTest {
    // ---------------------------------------------------------- fakes

    private class FakeNestsClient(
-        private val info: NestsRoomInfo,
+        private val token: String,
    ) : NestsClient {
-        override suspend fun resolveRoom(
-            serviceBase: String,
-            roomId: String,
+        var lastPublishFlag: Boolean? = null
+            private set
+
+        override suspend fun mintToken(
+            room: NestsRoomConfig,
+            publish: Boolean,
            signer: NostrSigner,
-        ): NestsRoomInfo = info
+        ): String {
+            lastPublishFlag = publish
+            return token
+        }
    }

    private class ThrowingNestsClient(
        private val toThrow: NestsException,
    ) : NestsClient {
-        override suspend fun resolveRoom(
-            serviceBase: String,
-            roomId: String,
+        override suspend fun mintToken(
+            room: NestsRoomConfig,
+            publish: Boolean,
            signer: NostrSigner,
-        ): NestsRoomInfo = throw toThrow
+        ): String = throw toThrow
    }

    private class ConstantWebTransportFactory(
@@ -0,0 +1,76 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.nestsclient
+
+import kotlin.test.Test
+import kotlin.test.assertEquals
+import kotlin.test.assertFailsWith
+
+class NestsRoomConfigTest {
+    @Test
+    fun moq_namespace_uses_kind_host_pubkey_room_id_format() {
+        val cfg =
+            NestsRoomConfig(
+                authBaseUrl = "https://nostrnests.com/api/v1/nests",
+                endpoint = "https://relay.nostrnests.com:4443/anon",
+                hostPubkey = "0".repeat(64),
+                roomId = "room-abc",
+            )
+        // Matches moq-auth's NAMESPACE_REGEX: nests/<kind>:<hex64>:<room>
+        assertEquals(
+            "nests/30312:${"0".repeat(64)}:room-abc",
+            cfg.moqNamespace(),
+        )
+    }
+
+    @Test
+    fun parses_token_response_from_moq_auth() {
+        val r = NestsTokenResponse.parse("""{"token":"abc.def.ghi"}""")
+        assertEquals("abc.def.ghi", r.token)
+    }
+
+    @Test
+    fun ignores_unknown_response_fields() {
+        val r = NestsTokenResponse.parse("""{"token":"t","exp":1234567,"future_knob":"x"}""")
+        assertEquals("t", r.token)
+    }
+
+    @Test
+    fun rejects_missing_token_field() {
+        assertFailsWith<Exception> { NestsTokenResponse.parse("""{"endpoint":"x"}""") }
+    }
+
+    @Test
+    fun builds_auth_url_from_service_base() {
+        assertEquals(
+            "https://nostrnests.com/api/v1/nests/auth",
+            nestsAuthUrl("https://nostrnests.com/api/v1/nests"),
+        )
+    }
+
+    @Test
+    fun trims_trailing_slash_from_service_base() {
+        assertEquals(
+            "https://nostrnests.com/api/v1/nests/auth",
+            nestsAuthUrl("https://nostrnests.com/api/v1/nests/"),
+        )
+    }
+}
@@ -1,90 +0,0 @@
-/*
- * Copyright (c) 2025 Vitor Pamplona
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy of
- * this software and associated documentation files (the "Software"), to deal in
- * the Software without restriction, including without limitation the rights to use,
- * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
- * Software, and to permit persons to whom the Software is furnished to do so,
- * subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in all
- * copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
- * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
- * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
- * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
- * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
- */
-package com.vitorpamplona.nestsclient
-
-import kotlin.test.Test
-import kotlin.test.assertEquals
-import kotlin.test.assertFailsWith
-import kotlin.test.assertNull
-
-class NestsRoomInfoTest {
-    @Test
-    fun parses_full_payload() {
-        val info =
-            NestsRoomInfo.parse(
-                """{"endpoint":"https://relay.example.com/moq","token":"abc.def","codec":"opus","sample_rate":48000,"transport":"webtransport"}""",
-            )
-        assertEquals("https://relay.example.com/moq", info.endpoint)
-        assertEquals("abc.def", info.token)
-        assertEquals("opus", info.codec)
-        assertEquals(48000, info.sampleRate)
-        assertEquals("webtransport", info.transport)
-    }
-
-    @Test
-    fun tolerates_minimal_payload() {
-        val info = NestsRoomInfo.parse("""{"endpoint":"https://r.example.com/moq"}""")
-        assertEquals("https://r.example.com/moq", info.endpoint)
-        assertNull(info.token)
-        assertNull(info.codec)
-        assertNull(info.sampleRate)
-    }
-
-    @Test
-    fun ignores_unknown_fields() {
-        val info =
-            NestsRoomInfo.parse(
-                """{"endpoint":"https://r.example.com/moq","token":"t","future_knob":"future_value"}""",
-            )
-        assertEquals("t", info.token)
-    }
-
-    @Test
-    fun rejects_missing_endpoint() {
-        assertFailsWith<Exception> {
-            NestsRoomInfo.parse("""{"token":"t"}""")
-        }
-    }
-
-    @Test
-    fun builds_room_info_url_from_service_and_room_id() {
-        assertEquals(
-            "https://nostrnests.com/api/v1/nests/abc-123",
-            nestsRoomInfoUrl("https://nostrnests.com/api/v1/nests", "abc-123"),
-        )
-    }
-
-    @Test
-    fun trims_trailing_slash_from_service_base() {
-        assertEquals(
-            "https://nostrnests.com/api/v1/nests/xyz",
-            nestsRoomInfoUrl("https://nostrnests.com/api/v1/nests/", "xyz"),
-        )
-    }
-
-    @Test
-    fun trims_whitespace_from_room_id() {
-        assertEquals(
-            "https://a.example.com/api/v1/nests/room",
-            nestsRoomInfoUrl("https://a.example.com/api/v1/nests", "  room  "),
-        )
-    }
-}
@@ -63,7 +63,7 @@ class NestsSpeakerTest {
            val state =
                MutableStateFlow<NestsSpeakerState>(
                    NestsSpeakerState.Connected(
-                        roomInfo = NestsRoomInfo(endpoint = "https://relay.example/moq"),
+                        room = TEST_ROOM,
                        negotiatedMoqVersion = speakerSession.selectedVersion!!,
                    ),
                )
@@ -118,7 +118,7 @@ class NestsSpeakerTest {
            val state =
                MutableStateFlow<NestsSpeakerState>(
                    NestsSpeakerState.Connected(
-                        roomInfo = NestsRoomInfo(endpoint = "https://relay.example/moq"),
+                        room = TEST_ROOM,
                        negotiatedMoqVersion = speakerSession.selectedVersion!!,
                    ),
                )
@@ -167,4 +167,14 @@ class NestsSpeakerTest {

        override fun release() {}
    }
+
+    companion object {
+        private val TEST_ROOM =
+            NestsRoomConfig(
+                authBaseUrl = "https://relay.example/api/v1/nests",
+                endpoint = "https://relay.example/moq",
+                hostPubkey = "0".repeat(64),
+                roomId = "test-room",
+            )
+    }
 }
@@ -23,8 +23,10 @@ package com.vitorpamplona.nestsclient
 import com.vitorpamplona.quartz.nip01Core.signers.NostrSigner
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.withContext
+import okhttp3.MediaType.Companion.toMediaType
 import okhttp3.OkHttpClient
 import okhttp3.Request
+import okhttp3.RequestBody.Companion.toRequestBody
 import java.io.IOException

 /**
@@ -35,19 +37,35 @@ import java.io.IOException
 class OkHttpNestsClient(
    private val http: OkHttpClient = OkHttpClient(),
 ) : NestsClient {
-    override suspend fun resolveRoom(
-        serviceBase: String,
-        roomId: String,
+    override suspend fun mintToken(
+        room: NestsRoomConfig,
+        publish: Boolean,
        signer: NostrSigner,
-    ): NestsRoomInfo {
-        val url = nestsRoomInfoUrl(serviceBase, roomId)
-        val authHeader = NestsAuth.header(signer = signer, url = url, method = "GET")
+    ): String {
+        val url = nestsAuthUrl(room.authBaseUrl)
+        val bodyJson =
+            buildString {
+                append('{')
+                append("\"namespace\":\"").append(room.moqNamespace()).append('"')
+                append(",\"publish\":").append(publish)
+                append('}')
+            }
+        val bodyBytes = bodyJson.encodeToByteArray()
+        // NIP-98 binds the signed event to (url, method, body-hash) so the
+        // server can reject a token replayed against a different request.
+        val authHeader =
+            NestsAuth.header(
+                signer = signer,
+                url = url,
+                method = "POST",
+                payload = bodyBytes,
+            )

        val request =
            Request
                .Builder()
                .url(url)
-                .get()
+                .post(bodyJson.toRequestBody(JSON_MEDIA_TYPE))
                .header("Authorization", authHeader)
                .header("Accept", "application/json")
                .build()
@@ -59,12 +77,12 @@ class OkHttpNestsClient(
                    val body = response.body.string()
                    if (!response.isSuccessful) {
                        throw NestsException(
-                            "nests server returned ${response.code} for $url",
+                            "nests server returned ${response.code} for $url: $body",
                            status = response.code,
                        )
                    }
                    try {
-                        NestsRoomInfo.parse(body)
+                        NestsTokenResponse.parse(body).token
                    } catch (e: IOException) {
                        throw NestsException("Malformed nests response from $url", e)
                    } catch (e: IllegalArgumentException) {
@@ -75,4 +93,8 @@ class OkHttpNestsClient(
                }
        }
    }
+
+    private companion object {
+        private val JSON_MEDIA_TYPE = "application/json".toMediaType()
+    }
 }
@@ -20,86 +20,52 @@
 */
 package com.vitorpamplona.nestsclient.interop

-import com.vitorpamplona.nestsclient.NestsAuth
+import com.vitorpamplona.nestsclient.NestsRoomConfig
+import com.vitorpamplona.nestsclient.OkHttpNestsClient
 import com.vitorpamplona.quartz.nip01Core.crypto.KeyPair
 import com.vitorpamplona.quartz.nip01Core.signers.NostrSignerInternal
 import kotlinx.coroutines.runBlocking
-import okhttp3.MediaType.Companion.toMediaType
-import okhttp3.OkHttpClient
-import okhttp3.Request
-import okhttp3.RequestBody.Companion.toRequestBody
 import org.junit.AfterClass
 import org.junit.BeforeClass
 import org.junit.Test
-import kotlin.test.assertEquals
 import kotlin.test.assertTrue

 /**
 * Phase-1 interop smoke test. Brings up a real nostrnests stack (auth
- * sidecar + MoQ relay + strfry) via Docker Compose, then exercises the
- * `/auth` endpoint with a hand-rolled NIP-98 request that matches what
- * the server actually expects.
- *
- * Doesn't yet use [com.vitorpamplona.nestsclient.NestsClient] —
- * `OkHttpNestsClient`'s wire shape (GET `<base>/<roomId>` with no body,
- * expecting `{endpoint, token}` back) doesn't match the real server
- * (POST `<base>/auth` with `{namespace, publish}` body, returning just
- * `{token}`). Phase 2 of this audit refactors the production client to
- * match; until then this test documents the divergence on the wire.
+ * sidecar + MoQ relay + strfry) via Docker Compose, then drives the
+ * production [OkHttpNestsClient] against the real `/auth` endpoint to
+ * mint a JWT. Validates the wire format (POST `<base>/auth` with
+ * `{namespace, publish}` body + NIP-98 Authorization header, returning
+ * `{token}`) end-to-end.
 *
 * Skipped by default — set `-DnestsInterop=true` to enable.
 */
 class NostrNestsAuthInteropTest {
    @Test
-    fun auth_endpoint_returns_jwt_for_a_well_formed_nip98_request() =
+    fun production_OkHttpNestsClient_mints_a_jwt_against_real_moq_auth() =
        runBlocking {
            NostrNestsHarness.assumeNestsInterop()
            val harness = harnessOrNull ?: return@runBlocking

-            val keys = KeyPair()
-            val signer = NostrSignerInternal(keys)
-            val pubkeyHex = signer.pubKey
-
-            val authUrl = "${harness.authBaseUrl}/auth"
-            val roomId = "interop-${System.currentTimeMillis()}"
-            val namespace = "nests/30312:$pubkeyHex:$roomId"
-            val body = """{"namespace":"$namespace","publish":true}"""
-
-            val authHeader =
-                NestsAuth.header(
-                    signer = signer,
-                    url = authUrl,
-                    method = "POST",
-                    payload = body.toByteArray(),
+            val signer = NostrSignerInternal(KeyPair())
+            val client = OkHttpNestsClient()
+            val room =
+                NestsRoomConfig(
+                    authBaseUrl = harness.authBaseUrl,
+                    endpoint = harness.moqEndpoint,
+                    hostPubkey = signer.pubKey,
+                    roomId = "interop-${System.currentTimeMillis()}",
                )

-            val request =
-                Request
-                    .Builder()
-                    .url(authUrl)
-                    .post(body.toRequestBody("application/json".toMediaType()))
-                    .header("Authorization", authHeader)
-                    .build()
+            val token = client.mintToken(room = room, publish = true, signer = signer)

-            val (status, responseBody) =
-                http.newCall(request).execute().use { response ->
-                    response.code to (response.body.string())
-                }
-
-            assertEquals(
-                200,
-                status,
-                "POST /auth should return 200 with a valid NIP-98 + namespace; got $status: $responseBody",
-            )
-            // moq-auth's response is `{"token":"<jwt>"}` per its index.ts.
-            assertTrue(
-                responseBody.contains("\"token\":\""),
-                "Expected JWT in `token` field, got: $responseBody",
-            )
+            // moq-auth signs JWS tokens with three base64url-encoded
+            // segments separated by dots.
+            assertTrue(token.count { it == '.' } == 2, "Expected JWT (3 segments), got: $token")
+            assertTrue(token.isNotBlank(), "JWT must be non-empty")
        }

    companion object {
-        private val http = OkHttpClient()
        private var harnessOrNull: NostrNestsHarness? = null

        @BeforeClass