Merge branch 'main' into feat/nip66-publish-events

Author: Ferryx349

.changeset/codeql-admin-rate-limit-models.md

@@ -0,0 +1,9 @@
+---
+"nostream": patch
+---
+
+ci: disable CodeQL workflow
+
+Removes the CodeQL Advanced GitHub Actions workflow, custom query pack, config,
+and route suppression comments to stop false-positive security alerts on admin
+routes that already use custom auth and rate limiting.

.changeset/disable-codeql.md

@@ -0,0 +1,35 @@
+---
+"nostream": minor
+---
+
+feat(nip43): issue kind 28935 invite codes on request
+
+NIP-43 kind 28935 is not an event clients publish — it is a REQ the relay answers by
+minting an invite code on the fly and returning a relay-signed ephemeral event. Nostream
+now serves those subscriptions, completing the membership flow: request a claim, join with
+kind 28934, publish.
+
+Off by default. It requires `nip43.enabled` and the new `nip43.allowInviteRequests`, a
+NIP-42 authenticated requester, an `info.self` consistent with the relay signing key, and a
+per-pubkey budget under the new `limits.invite.rateLimits` (5/hour by default). This also
+makes the previously inert `nip43.inviteRequestWhitelist` setting take effect. The minted
+event is never persisted and never broadcast: the claim tag is a bearer secret and is sent
+only to the socket that asked for it.
+
+Two fixes the flow depended on. The relay signs its own events with a key derived from
+`SECRET`, but `info.self` was a hand-edited string that nothing validated — by default it
+was a placeholder that is not a pubkey at all, so any NIP-43 client verifying a relay-signed
+event against `self` would reject it. `info.self` is now optional: when unset or unparseable,
+NIP-11 advertises the derived signing pubkey instead, and `nostream info` prints that pubkey
+so operators can pin it.
+
+Kind 28935 also sits in the ephemeral range, so a client-published one fell through to
+`EphemeralEventStrategy` and was broadcast to every subscriber — including everyone
+subscribed to kind 28935 waiting for a real invite. Anyone could inject a forged `claim` tag
+into that subscription. It is now rejected with an `OK` false and never broadcast, and
+bypasses the NIP-43 admission gate so that rejection actually reaches non-members, who are
+the ones most likely to publish it by mistake while trying to obtain a code.
+
+CLI.md and README.md now describe the request flow. CLI.md previously claimed the relay
+"does not yet generate kind 28935 on `REQ`", and never mentioned that `nostream info`
+prints the signing pubkey that CONFIGURATION.md tells operators to pin.

.changeset/nip43-invite-requests.md

@@ -0,0 +1,7 @@
+---
+"nostream": minor
+---
+
+feat(ops): add /readyz readiness probe for Postgres and Redis
+
+Adds a public readiness endpoint for zero-downtime deploy workflows. HAProxy (or similar) can use `/readyz` to confirm an instance can serve traffic before cutover, while `/healthz` remains a lightweight liveness check.

.changeset/readyz-endpoint.md

@@ -0,0 +1,10 @@
+---
+"nostream": minor
+---
+
+feat: add a Web of Trust graph service that tracks NIP-02 follow distance from an operator-configured seed pubkey
+
+Adds a `WotGraphService` that builds a trust graph rooted at `wot.seedPubkey`, updated in real
+time as kind-3 contact list events are ingested, with configurable depth (`wot.maxDepth`) and a
+minimum-followers threshold for 2+ hop trust (`wot.minimumFollowers`). Exposes `getDistance()` and
+`isTrusted()` for other parts of the relay to query. Disabled by default (`wot.enabled: false`).

.changeset/wot-graph-service.md

@@ -46,7 +46,20 @@ docker compose exec nostream node src/cli/index.js invite create
 
 `--uses` defaults to `nip43.defaultMaxUses` (1). `--expires-in` defaults to `nip43.inviteCodeExpirySeconds` (600 = 10 minutes). `--expires-in` must be a positive integer; never-expiring codes are a yaml policy (`nip43.inviteCodeExpirySeconds: 0`), not a CLI flag. The printed code is the first line of human output so scripts can capture it. If `info.self` is a hex pubkey or `npub1…`, it is stored as `created_by`.
 
-This does not yet generate kind 28935 on `REQ` or publish membership list events.
+The relay also answers `REQ`s for kind 28935 by minting a code on the fly and returning it as a relay-signed ephemeral event, so users can obtain a claim string without an operator handing one out. It is off by default and requires `nip43.enabled`, `nip43.allowInviteRequests` and a NIP-42 authenticated client — see [CONFIGURATION.md](CONFIGURATION.md). Membership list events (kind 13534) are not published yet.
+
+Invites minted over `REQ` record the requesting pubkey as `created_by`; `nostream invite create` records `info.self`.
+
+### Relay signing pubkey
+
+NIP-43 clients verify relay-signed events against the `self` field of the NIP-11 document, so `self` must match the key the relay actually signs with. That key is derived from `SECRET` and is otherwise invisible, so `nostream info` prints it:
+
+```bash
+nostream info | grep 'Signing pubkey'
+nostream info --json     # same value under relay.signingPubkey
+```
+
+Leave `info.self` unset in settings to have this value advertised automatically. Set it only if you want to pin it explicitly, and set it to exactly this value — a mismatch disables kind 28935 invite requests.
 
 ## Removed Legacy Wrappers