Introduces a signer decorator that automatically appends the NIP-89
client tag to every event before signing, ensuring all events carry
client identification without modifying individual event creation sites.
Works transparently with internal, external (NIP-55), and remote (NIP-46) signers.
https://claude.ai/code/session_01WRtuk1ySCfqXzfFrieKsDs
Tests the StringIndexOutOfBoundsException fix in Url.getPart() by directly
constructing Url objects with UrlMarker indices that exceed the trimmed
originalUrl length — the exact scenario that occurs when readEnd() strips
a trailing character (e.g. ':') while the PORT/QUERY marker still points
to the original buffer position.
https://claude.ai/code/session_013rJ9iYndYVJgpYK2VazxL2
Tests cover the StringIndexOutOfBoundsException in Url.getPart() that
occurred when readEnd() trimmed trailing characters (e.g. ':') from a
detected URL but urlMarker indices remained pointing past the trimmed
string's end.
- UrlMarkerTest: three cases testing PORT/QUERY index at or beyond
string length (the boundary conditions fixed by minOf clamping and
the startIndex >= length guard)
- UrlsDetectorTest: regression for "今北産業" (no crash, 0 URLs) and
for a bare "example.com:" host
- UrlParserTest: end-to-end regression for "今北産業" and "example.com:"
https://claude.ai/code/session_013rJ9iYndYVJgpYK2VazxL2
Replace the requireAuth: Boolean parameter in NostrServer with a
pluggable AuthPolicy interface. Each policy has trigger points for
EVENT (acceptEvent), REQ (acceptReq with filter rewriting), COUNT
(acceptCount), and live event delivery (canSendToSession).
Built-in policies: OpenPolicy (allow all) and RequireAuthPolicy
(require auth for all commands, matching the previous behavior).
https://claude.ai/code/session_017vdjbdxdYK1oJMH66koVZE
Add server-side AUTH challenge/response handling per NIP-42 spec:
- RelaySession generates a unique challenge per connection and tracks
authenticated pubkeys (multiple users can auth on one session)
- NostrServer gains relayUrl and requireAuth parameters; when requireAuth
is true, EVENT/REQ/COUNT are rejected with auth-required: prefix
- AUTH handler validates kind 22242, created_at within 10 min, challenge
and relay tag matching
- AuthCmd now accepts Event (not just RelayAuthEvent) so the server can
gracefully reject wrong-kind auth attempts
- 11 new tests covering auth success, wrong challenge/relay/kind/timestamp,
multi-user auth, and requireAuth gating
https://claude.ai/code/session_017vdjbdxdYK1oJMH66koVZE
Add NwcTransactionMetadata parser that extracts comment, payer_data,
recipient_data, and nostr zap data from the untyped metadata field.
The transaction list UI now shows the Nostr user profile picture and
name for zap senders/recipients, falls back to payer name/email or
lightning address, and displays comment when it differs from description.
https://claude.ai/code/session_01JFogiwyR4CPVP8cRznqahJ
Add tests using exact JSON payloads from Alby Hub's test suite:
- Real bolt11 invoice strings from Alby's mock data
- pay_keysend with TLV records and preimage
- make_invoice with nested metadata objects
- make_hold_invoice with 64-char payment hash
- settle_hold_invoice with preimage
- list_transactions with unpaid_outgoing filter
- create_connection with isolated=true
https://claude.ai/code/session_01JFogiwyR4CPVP8cRznqahJ
- Add get_budget, sign_message, create_connection request/response types
- Add NwcTransactionType (incoming/outgoing) and NwcTransactionState
(PENDING/SETTLED/FAILED/ACCEPTED) constants
- Add missing error codes: BAD_REQUEST, NOT_FOUND, EXPIRED
- Add settle_deadline field to NwcTransaction
- Add total_count to ListTransactionsResult
- Add metadata and lud16 to GetInfoResult
- Add unpaid_outgoing and unpaid_incoming to ListTransactionsParams
- Update Jackson deserializers for new method types
- Add AlbyInteropTest with 25+ tests verifying compatibility with
Alby Hub's JSON formats for all request/response types
- Update existing tests for new constants and error codes
https://claude.ai/code/session_01JFogiwyR4CPVP8cRznqahJ
Covers all 10 request methods (create, serialize, deserialize), all success
and error response types, notification deserialization, EncryptionTag and
NotificationsTag parse/assemble/isTag, NwcInfoEvent build and capabilities,
NwcNotificationEvent structure, LnZapPaymentRequestEvent create/decrypt
with NIP-04 and NIP-44, and Nip47WalletConnect URI parsing and serialization.
https://claude.ai/code/session_01JFogiwyR4CPVP8cRznqahJ
Implements a pure-Kotlin (commonMain) parser for the BUD-10 blossom: URI
scheme, which allows sharing blob references with discovery hints.
Format: blossom:<sha256>.<ext>[?xs=<server>&as=<pubkey>&sz=<bytes>]
- BlossomUri data class holds sha256, extension, servers (xs), authors (as), size (sz)
- BlossomUri.parse() returns null for non-blossom URIs or invalid SHA-256
- Supports repeated xs/as params (multiple servers and authors)
- Percent-encodes server URLs on serialisation; decodes on parse
- BlossomUri.toUriString() round-trips back to a canonical URI
- Includes commonTest coverage for all parsing cases
https://claude.ai/code/session_01T4jyLbkNWd3f7i6MwsBcD4
Per Amber maintainer: connect never returns a pubkey — response is
"ack" or the secret string. Rewrote ConnectResponse.parse() to check
result/error fields directly on base BunkerResponse (matching Jackson
deserialization). connect() is now a pure protocol handshake; callers
call getPublicKey() separately as a domain concern.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Vitor Pamplona