git: percent-decode relay and identifier segments in nostr://

copied from https://gitworkshop.dev/fiatjaf.com/nak/prs/nevent1qqswm2nmw68uqf9d66f3c4vspt0fna8g0vd24z5yyeq35a0p33kmpach2gch6/files

README.md

@@ -167,6 +167,9 @@ relays:
    wss://140.f7z.io (write)
    wss://r.f7z.io (read/write)
 follows: 1051
+~>
+~> nak profile f7z.io --name
+PABLOF7z
 ```
 
 ### sign an event using a bunker provider (amber, promenade etc)
@@ -308,6 +311,28 @@ type the password to decrypt your secret key: ********
 ~> nak req -i 412f2d3e73acc312942c055ac2a695dc60bf58ff97e06689a8a79e97796c4cdb relay.westernbtc.com | jq -r .content > ~/.jq
 ```
 
+### filter and transform events with the built-in `--jq` helpers
+
+extra-filter events with `select()` based on tags:
+
+```shell
+~> nak req -k 1 -l 10 relay.damus.io --jq 'select(has("t"))'
+```
+
+extract a tag value:
+
+```shell
+~> nak req -k 1 -l 10 -t t=gm relay.damus.io --jq 'value("t")'
+```
+
+make an event easier to read by removing fields and adding human-readable time:
+
+```shell
+~> nak req -k 1 -l 5 relay.damus.io --jq '. + { d: datetime } | del(.sig, .created_at)'
+```
+
+you can do these same things by piping to standalone `jq`, take the functions in https://github.com/fiatjaf/nak/blob/master/jq.go#L10 and add them to your `~/.jq` file.
+
 ### watch a NIP-53 livestream (zap.stream, amethyst, shosho etc)
 ```shell
 ~> # this requires the jq utils from the step above

admin.go

@@ -47,6 +47,17 @@ var admin = &cli.Command{
 			{"blockip", []string{"ip", "reason"}},
 			{"unblockip", []string{"ip", "reason"}},
 			{"listblockedips", nil},
+			{"listallowedevents", nil},
+			{"listdisallowedkinds", nil},
+			{"supportedmethods", nil},
+			{"stats", nil},
+			{"grantadmin", []string{"pubkey", "methods"}},
+			{"revokeadmin", []string{"pubkey", "methods"}},
+			{"createrole", []string{"role_id", "label", "description", "color", "order"}},
+			{"editrole", []string{"role_id", "label", "description", "color", "order"}},
+			{"deleterole", []string{"role_id"}},
+			{"assignrole", []string{"pubkey", "role_id"}},
+			{"unassignrole", []string{"pubkey", "role_id"}},
 		}
 
 		commands := make([]*cli.Command, 0, len(methods))
@@ -121,6 +132,7 @@ var admin = &cli.Command{
 							continue
 						}
 						b, err := io.ReadAll(resp.Body)
+						resp.Body.Close()
 						if err != nil {
 							log("failed to read response: %s\n", err)
 							continue
@@ -131,7 +143,7 @@ var admin = &cli.Command{
 							if len(bodyPrintable) > 300 {
 								bodyPrintable = bodyPrintable[0:297] + "..."
 							}
-							log(bodyPrintable)
+							log("%s", bodyPrintable)
 							continue
 						}
 						var response nip86.Response
@@ -141,10 +153,9 @@ var admin = &cli.Command{
 							if len(bodyPrintable) > 300 {
 								bodyPrintable = bodyPrintable[0:297] + "..."
 							}
-							log(bodyPrintable)
+							log("%s", bodyPrintable)
 							continue
 						}
-						resp.Body.Close()
 
 						// print the result
 						log("\n")
@@ -166,10 +177,16 @@ var admin = &cli.Command{
 func declareFlag(argName string) cli.Flag {
 	usage := "parameter for this management RPC call, see https://nips.nostr.com/86 for more information."
 	switch argName {
-	case "kind":
+	case "pubkey":
+		return &PubKeyFlag{Name: argName, Usage: usage}
+	case "id":
+		return &IDFlag{Name: argName, Usage: usage}
+	case "kind", "order", "color":
 		return &cli.IntFlag{Name: argName, Required: true, Usage: usage}
 	case "reason":
 		return &cli.StringFlag{Name: argName, Usage: usage}
+	case "methods":
+		return &cli.StringSliceFlag{Name: argName, Required: true, Usage: usage}
 	default:
 		return &cli.StringFlag{Name: argName, Required: true, Usage: usage}
 	}
@@ -177,8 +194,14 @@ func declareFlag(argName string) cli.Flag {
 
 func getArgument(c *cli.Command, argName string) any {
 	switch argName {
-	case "kind":
+	case "pubkey":
+		return getPubKey(c, argName)
+	case "id":
+		return getID(c, argName)
+	case "kind", "order", "color":
 		return c.Int(argName)
+	case "methods":
+		return c.StringSlice(argName)
 	default:
 		return c.String(argName)
 	}

blossom.go

@@ -179,7 +179,7 @@ var blossomCmd = &cli.Command{
 							hasError = true
 							continue
 						}
-						stdout(data)
+						os.Stdout.Write(data)
 					}
 				}
 
@@ -238,6 +238,11 @@ if any of the files are not found the command will fail, otherwise it will succe
 
 				hasError := false
 				for _, hash := range c.Args().Slice() {
+					// a sha256 is 64 hex characters, anything after that is an extension
+					if len(hash) > 64 {
+						hash = hash[0:64]
+					}
+
 					err := client.Check(ctx, hash)
 					if err != nil {
 						hasError = true
@@ -281,7 +286,7 @@ if any of the files are not found the command will fail, otherwise it will succe
 						return err
 					}
 					out, _ := json.Marshal(bd)
-					stdout(out)
+					stdout(string(out))
 					return nil
 				}
 
@@ -300,7 +305,7 @@ if any of the files are not found the command will fail, otherwise it will succe
 						continue
 					}
 					out, _ := json.Marshal(bd)
-					stdout(out)
+					stdout(string(out))
 				}
 
 				exitIfLineProcessingError(ctx)

bunker.go

@@ -13,6 +13,7 @@ import (
 	"path/filepath"
 	"slices"
 	"strings"
+	"sync"
 	"time"
 
 	"fiatjaf.com/nostr"
@@ -44,15 +45,6 @@ var bunker = &cli.Command{
 			OnlyOnce: true,
 			Category: PERSISTENCE,
 		},
-		&cli.StringFlag{
-			Name:        "sec",
-			Usage:       "secret key to sign the event, as hex or nsec",
-			DefaultText: "the key '1'",
-		},
-		&cli.BoolFlag{
-			Name:  "prompt-sec",
-			Usage: "prompt the user to paste a hex or nsec with which to sign the event",
-		},
 		&cli.StringSliceFlag{
 			Name:    "authorized-secrets",
 			Aliases: []string{"s"},
@@ -162,10 +154,10 @@ var bunker = &cli.Command{
 			}
 
 			if config.Secret.Plain == nil && config.Secret.Encrypted == nil {
-				// we don't have any secret key stored, so just use whatever was given via flags
+				// we don't have any secret key stored, so just use whatever was given via flags (or defaults)
 				config.Secret = baseSecret
-			} else if baseSecret.Plain == nil && baseSecret.Encrypted == nil {
-				// we didn't provide any keys, so we just use the stored
+			} else if !c.IsSet("sec") && !c.IsSet("prompt-sec") {
+				// we didn't provide any keys explicitly, so we just use the stored
 			} else {
 				// we have a secret key stored
 				// if we also provided a key we check if they match and fail otherwise
@@ -185,7 +177,7 @@ var bunker = &cli.Command{
 		if config.Secret.Plain == nil && config.Secret.Encrypted == nil {
 			sec := os.Getenv("NOSTR_SECRET_KEY")
 			if sec == "" {
-				sec = defaultKey
+				sec = defaultKey().Hex()
 			}
 			sk, err := nostr.SecretKeyFromHex(sec)
 			if err != nil {
@@ -244,12 +236,19 @@ var bunker = &cli.Command{
 		// it will be stored
 		newSecret := randString(12)
 
+		// guards config.Clients, newSecret and cancelPreviousBunkerInfoPrint, which are
+		// accessed from the socket goroutine, the per-request handler goroutines and here
+		var mu sync.Mutex
+
 		// static information
 		pubkey := sec.Public()
 		npub := nip19.EncodeNpub(pubkey)
 
 		// this function will be called every now and then
 		printBunkerInfo := func() {
+			mu.Lock()
+			defer mu.Unlock()
+
 			iqs := make(url.Values)
 			maps.Copy(iqs, qs)
 			iqs.Set("secret", newSecret)
@@ -351,70 +350,15 @@ var bunker = &cli.Command{
 		signer := nip46.NewStaticKeySigner(sec)
 		signer.DefaultRelays = config.Relays
 
-		// unix socket nostrconnect:// handling
-		go func() {
-			for uri := range onSocketConnect(ctx, c) {
-				clientPublicKey, err := nostr.PubKeyFromHex(uri.Host)
-				if err != nil {
-					continue
-				}
-				log("- got nostrconnect:// request from '%s': %s\n", color.New(color.Bold, color.FgBlue).Sprint(clientPublicKey.Hex()), uri.String())
-
-				relays := uri.Query()["relay"]
-
-				// pre-authorize this client since the user has explicitly added it
-				if !slices.ContainsFunc(config.Clients, func(c BunkerConfigClient) bool {
-					return c.PubKey == clientPublicKey
-				}) {
-					config.Clients = append(config.Clients, BunkerConfigClient{
-						PubKey:       clientPublicKey,
-						Name:         uri.Query().Get("name"),
-						URL:          uri.Query().Get("url"),
-						Icon:         uri.Query().Get("icon"),
-						CustomRelays: relays,
-					})
-				}
-
-				if persist != nil {
-					persist()
-				}
-
-				resp, eventResponse, err := signer.HandleNostrConnectURI(ctx, uri)
-				if err != nil {
-					log("* failed to handle: %s\n", err)
-					continue
-				}
-
-				go func() {
-					for event := range sys.Pool.SubscribeMany(ctx, relays, nostr.Filter{
-						Kinds:     []nostr.Kind{nostr.KindNostrConnect},
-						Tags:      nostr.TagMap{"p": []string{pubkey.Hex()}},
-						Since:     nostr.Now(),
-						LimitZero: true,
-					}, nostr.SubscriptionOptions{Label: "nak-bunker"}) {
-						events <- event
-					}
-				}()
-
-				time.Sleep(time.Millisecond * 25)
-				jresp, _ := json.MarshalIndent(resp, "", "  ")
-				log("~ responding with %s\n", string(jresp))
-				for res := range sys.Pool.PublishMany(ctx, relays, eventResponse) {
-					if res.Error == nil {
-						log("* sent through %s\n", res.Relay.URL)
-					} else {
-						log("* failed to send through %s: %s\n", res.RelayURL, res.Error)
-					}
-				}
-			}
-		}()
-
 		// just a gimmick
 		var cancelPreviousBunkerInfoPrint context.CancelFunc
 		_, cancel := context.WithCancel(ctx)
 		cancelPreviousBunkerInfoPrint = cancel
 
 		signer.AuthorizeRequest = func(harmless bool, from nostr.PubKey, secret string) bool {
+			mu.Lock()
+			defer mu.Unlock()
+
 			if slices.ContainsFunc(config.Clients, func(b BunkerConfigClient) bool { return b.PubKey == from }) {
 				return true
 			}
@@ -450,60 +394,130 @@ var bunker = &cli.Command{
 			return false
 		}
 
-		for ie := range events {
+		handleBunkerRequest := func(ie nostr.RelayEvent) {
+			mu.Lock()
 			cancelPreviousBunkerInfoPrint() // this prevents us from printing a million bunker info blocks
+			mu.Unlock()
 
-			go func() {
-				// handle the NIP-46 request event
-				from := ie.Event.PubKey
-				req, resp, eventResponse, err := signer.HandleRequest(ctx, ie.Event)
-				if err != nil {
-					if errors.Is(err, nip46.AlreadyHandled) {
-						return
-					}
-
-					log("< failed to handle request from %s: %s\n", from.Hex(), err.Error())
+			// handle the NIP-46 request event
+			from := ie.Event.PubKey
+			req, resp, eventResponse, err := signer.HandleRequest(ctx, ie.Event)
+			if err != nil {
+				if errors.Is(err, nip46.AlreadyHandled) {
 					return
 				}
 
-				jreq, _ := json.MarshalIndent(req, "", "  ")
-				log("- got request from '%s': %s\n", color.New(color.Bold, color.FgBlue).Sprint(from.Hex()), string(jreq))
-				jresp, _ := json.MarshalIndent(resp, "", "  ")
-				log("~ responding with %s\n", string(jresp))
+				log("< failed to handle request from %s: %s\n", from.Hex(), err.Error())
+				return
+			}
 
-				// use custom relays if they are defined for this client
-				// (normally if the initial connection came from a nostrconnect:// URL)
-				relays := config.Relays
-				for _, c := range config.Clients {
-					if c.PubKey == from && len(c.CustomRelays) > 0 {
-						relays = c.CustomRelays
-						break
-					}
+			jreq, _ := json.MarshalIndent(req, "", "  ")
+			log("- got request from '%s': %s\n", color.New(color.Bold, color.FgBlue).Sprint(from.Hex()), string(jreq))
+			jresp, _ := json.MarshalIndent(resp, "", "  ")
+			log("~ responding with %s\n", string(jresp))
+
+			// use custom relays if they are defined for this client
+			// (normally if the initial connection came from a nostrconnect:// URL)
+			relays := config.Relays
+			mu.Lock()
+			for _, c := range config.Clients {
+				if c.PubKey == from && len(c.CustomRelays) > 0 {
+					relays = c.CustomRelays
+					break
+				}
+			}
+			mu.Unlock()
+
+			for res := range sys.Pool.PublishMany(ctx, relays, eventResponse) {
+				if res.Error == nil {
+					log("* sent response through %s\n", res.Relay.URL)
+				} else {
+					log("* failed to send response through %s: %s\n", res.RelayURL, res.Error)
+				}
+			}
+
+			// just after handling one request we trigger this
+			go func() {
+				ctx, cancel := context.WithCancel(ctx)
+				defer cancel()
+				mu.Lock()
+				cancelPreviousBunkerInfoPrint = cancel
+				mu.Unlock()
+				// the idea is that we will print the bunker URL again so it is easier to copy-paste by users
+				// but we will only do if the bunker is inactive for more than 5 minutes
+				select {
+				case <-ctx.Done():
+				case <-time.After(time.Minute * 5):
+					log("\n")
+					printBunkerInfo()
+				}
+			}()
+		}
+
+		// unix socket nostrconnect:// handling
+		go func() {
+			for uri := range onSocketConnect(ctx, c) {
+				clientPublicKey, err := nostr.PubKeyFromHex(uri.Host)
+				if err != nil {
+					continue
+				}
+				log("- got nostrconnect:// request from '%s': %s\n", color.New(color.Bold, color.FgBlue).Sprint(clientPublicKey.Hex()), uri.String())
+
+				relays := uri.Query()["relay"]
+
+				// pre-authorize this client since the user has explicitly added it
+				mu.Lock()
+				if !slices.ContainsFunc(config.Clients, func(c BunkerConfigClient) bool {
+					return c.PubKey == clientPublicKey
+				}) {
+					config.Clients = append(config.Clients, BunkerConfigClient{
+						PubKey:       clientPublicKey,
+						Name:         uri.Query().Get("name"),
+						URL:          uri.Query().Get("url"),
+						Icon:         uri.Query().Get("icon"),
+						CustomRelays: relays,
+					})
 				}
 
-				for res := range sys.Pool.PublishMany(ctx, relays, eventResponse) {
-					if res.Error == nil {
-						log("* sent response through %s\n", res.Relay.URL)
-					} else {
-						log("* failed to send response through %s: %s\n", res.RelayURL, res.Error)
-					}
+				if persist != nil {
+					persist()
+				}
+				mu.Unlock()
+
+				resp, eventResponse, err := signer.HandleNostrConnectURI(ctx, uri)
+				if err != nil {
+					log("* failed to handle: %s\n", err)
+					continue
 				}
 
-				// just after handling one request we trigger this
 				go func() {
-					ctx, cancel := context.WithCancel(ctx)
-					defer cancel()
-					cancelPreviousBunkerInfoPrint = cancel
-					// the idea is that we will print the bunker URL again so it is easier to copy-paste by users
-					// but we will only do if the bunker is inactive for more than 5 minutes
-					select {
-					case <-ctx.Done():
-					case <-time.After(time.Minute * 5):
-						log("\n")
-						printBunkerInfo()
+					for event := range sys.Pool.SubscribeMany(ctx, relays, nostr.Filter{
+						Kinds:     []nostr.Kind{nostr.KindNostrConnect},
+						Tags:      nostr.TagMap{"p": []string{pubkey.Hex()}},
+						Since:     nostr.Now(),
+						LimitZero: true,
+					}, nostr.SubscriptionOptions{Label: "nak-bunker"}) {
+						// handle directly instead of forwarding into the main events
+						// channel, which is owned (and eventually closed) by the pool
+						go handleBunkerRequest(event)
 					}
 				}()
-			}()
+
+				time.Sleep(time.Millisecond * 25)
+				jresp, _ := json.MarshalIndent(resp, "", "  ")
+				log("~ responding with %s\n", string(jresp))
+				for res := range sys.Pool.PublishMany(ctx, relays, eventResponse) {
+					if res.Error == nil {
+						log("* sent through %s\n", res.Relay.URL)
+					} else {
+						log("* failed to send through %s: %s\n", res.RelayURL, res.Error)
+					}
+				}
+			}
+		}()
+
+		for ie := range events {
+			go handleBunkerRequest(ie)
 		}
 
 		return nil

cli_test.go

@@ -229,3 +229,17 @@ func TestNaturalTimestamps(t *testing.T) {
 	require.Equal(t, nostr.Timestamp(1526711839), evt.CreatedAt)
 	require.Equal(t, "nn", evt.Content)
 }
+
+func TestEventJQ(t *testing.T) {
+	// default: string results come out JSON-quoted, like plain jq
+	quoted := call(t, "nak event --ts 1699485669 -c hello --jq .content")
+	require.Equal(t, `"hello"`, quoted)
+
+	// --jq-raw: string results come out unquoted, like `jq -r`
+	raw := call(t, "nak event --ts 1699485669 -c hello --jq .content --jq-raw")
+	require.Equal(t, "hello", raw)
+
+	// --jq-raw on a non-string result is still JSON-encoded, like `jq -r`
+	num := call(t, "nak event --ts 1699485669 -k 7 --jq .kind --jq-raw")
+	require.Equal(t, "7", num)
+}

count.go

@@ -63,7 +63,21 @@ var count = &cli.Command{
 					hll = hyperloglog.New(offset)
 				}
 				for _, relayUrl := range relayUrls {
-					relay, _ := sys.Pool.EnsureRelay(relayUrl)
+					nm := nostr.NormalizeURL(relayUrl)
+					relay, ok := sys.Pool.Relays.Load(nm)
+					if !ok || relay == nil || !relay.IsConnected() {
+						ct, cancel := context.WithTimeout(context.Background(), connectTimeout)
+						var err error
+						relay, err = nostr.RelayConnect(ct, relayUrl, sys.Pool.RelayOptions)
+						cancel()
+						if err != nil {
+							fmt.Fprintf(os.Stderr, "%s%s: ", strings.Repeat(" ", biggerUrlSize-len(relayUrl)), relayUrl)
+							fmt.Fprintf(os.Stderr, "error: %s\n", err)
+							continue
+						}
+						sys.Pool.Relays.Store(nm, relay)
+					}
+
 					count, hllRegisters, err := relay.Count(ctx, filter, nostr.SubscriptionOptions{
 						Label: "nak-count",
 					})

curl.go

@@ -20,6 +20,9 @@ var curl = &cli.Command{
 	Usage:                     "calls curl but with a nip98 header",
 	Description:               "accepts all flags and arguments exactly as they would be passed to curl.",
 	DisableSliceFlagSeparator: true,
+	// this command is always run standalone (see realCurl()), never under the root
+	// command, so it needs its own copy of the key flags
+	Flags: defaultKeyFlags,
 	Action: func(ctx context.Context, c *cli.Command) error {
 		kr, _, err := gatherKeyerFromArguments(ctx, c)
 		if err != nil {
@@ -129,5 +132,6 @@ func realCurl() error {
 		}
 	}
 
-	return curl.Run(context.Background(), keyFlags)
+	// Run treats the first element as the program name, so prepend one
+	return curl.Run(context.Background(), append([]string{"nak curl"}, keyFlags...))
 }

dekey.go

@@ -164,7 +164,7 @@ var dekey = &cli.Command{
 					return fmt.Errorf("invalid main key: %w", err)
 				}
 				if eSec.Public() != ePub {
-					return fmt.Errorf("stored decoupled encryption key is corrupted: %w", err)
+					return fmt.Errorf("stored decoupled encryption key at %s doesn't match the announced key %s", eKeyPath, ePub.Hex())
 				}
 			} else {
 				log("- decoupled encryption key not found locally, attempting to fetch the key from other devices\n")
@@ -236,12 +236,14 @@ var dekey = &cli.Command{
 					if err != nil {
 						continue
 					}
-					eSec, err = nostr.SecretKeyFromHex(eSecHex)
+					candidate, err := nostr.SecretKeyFromHex(eSecHex)
 					if err != nil {
 						continue
 					}
-					// check if it matches mainPub
-					if eSec.Public() == ePub {
+					// check if it matches mainPub -- only keep it if it does, otherwise a
+					// stale key received from another device would end up being redistributed
+					if candidate.Public() == ePub {
+						eSec = candidate
 						log(color.GreenString("successfully received decoupled encryption key from another device\n"))
 						// store it
 						os.MkdirAll(filepath.Dir(eKeyPath), 0700)

event.go

@@ -90,6 +90,16 @@ example:
 			Usage:    "print the event enveloped in a [\"EVENT\", ...] message ready to be sent to a relay",
 			Category: CATEGORY_EXTRAS,
 		},
+		&cli.StringFlag{
+			Name:     "jq",
+			Usage:    "filter returned events with jq expression",
+			Category: CATEGORY_EXTRAS,
+		},
+		&cli.BoolFlag{
+			Name:     "jq-raw",
+			Usage:    "print --jq string results without JSON quoting, like `jq -r`",
+			Category: CATEGORY_EXTRAS,
+		},
 		&cli.BoolFlag{
 			Name:     "nevent",
 			Usage:    "print the nevent code (to stderr) after the event is published",
@@ -175,13 +185,18 @@ example:
 	),
 	ArgsUsage: "[relay...]",
 	Action: func(ctx context.Context, c *cli.Command) error {
-		relayUrls := c.Args().Slice()
+		argRelayUrls := c.Args().Slice()
 
 		kr, sec, err := gatherKeyerFromArguments(ctx, c)
 		if err != nil {
 			return err
 		}
 
+		jq, err := jqPrepare(c.String("jq"), c.Bool("jq-raw"))
+		if err != nil {
+			return err
+		}
+
 		// then process input and generate events:
 
 		// will reuse this
@@ -191,7 +206,7 @@ example:
 		handleEvent := func(stdinEvent string) error {
 			evt.Content = ""
 			evt.CreatedAt = 0
-			clear(evt.Tags)
+			evt.Tags = evt.Tags[:0]
 			evt.ID = nostr.ZeroID
 			evt.PubKey = nostr.ZeroPK
 			evt.Sig = [64]byte{}
@@ -368,6 +383,9 @@ example:
 			}
 
 			var relays []*nostr.Relay
+			// start from the given relays on every event so --outbox additions
+			// for one event don't leak into the next
+			relayUrls := slices.Clone(argRelayUrls)
 			if len(relayUrls) > 0 || c.Bool("outbox") {
 				if c.Bool("outbox") {
 					if evt.PubKey != nostr.ZeroPK {
@@ -401,15 +419,25 @@ example:
 			}
 
 			// print event as json
-			var result string
-			if c.Bool("envelope") {
-				j, _ := json.Marshal(nostr.EventEnvelope{Event: evt})
-				result = string(j)
+			if jq == nil {
+				var result string
+				if c.Bool("envelope") {
+					j, _ := json.Marshal(nostr.EventEnvelope{Event: evt})
+					result = string(j)
+				} else {
+					j, _ := easyjson.Marshal(&evt)
+					result = string(j)
+				}
+				stdout(result)
 			} else {
-				j, _ := easyjson.Marshal(&evt)
-				result = string(j)
+				out, matches, err := jq(evt)
+				if err != nil {
+					return fmt.Errorf("jq filter failed: %w", err)
+				}
+				if matches {
+					stdout(out)
+				}
 			}
-			stdout(result)
 
 			return publishFlow(ctx, c, kr, evt, relays)
 		}
@@ -515,9 +543,19 @@ func publishFlow(ctx context.Context, c *cli.Command, kr nostr.Signer, evt nostr
 				defer cancel()
 
 				if !relay.IsConnected() {
-					if new_, err := sys.Pool.EnsureRelay(relay.URL); err == nil {
-						relays[i] = new_
-						relay = new_
+					nm := nostr.NormalizeURL(relay.URL)
+					if r, ok := sys.Pool.Relays.Load(nm); ok && r != nil && r.IsConnected() {
+						relays[i] = r
+						relay = r
+					} else {
+						ct, cancel := context.WithTimeout(context.Background(), connectTimeout)
+						new_, err := nostr.RelayConnect(ct, relay.URL, sys.Pool.RelayOptions)
+						cancel()
+						if err == nil {
+							sys.Pool.Relays.Store(nm, new_)
+							relays[i] = new_
+							relay = new_
+						}
 					}
 				}
 
@@ -550,6 +588,10 @@ func publishFlow(ctx context.Context, c *cli.Command, kr nostr.Signer, evt nostr
 		if len(successRelays) > 0 && c.Bool("nevent") {
 			log(nip19.EncodeNevent(evt.ID, successRelays, evt.PubKey) + "\n")
 		}
+
+		if len(successRelays) == 0 {
+			return fmt.Errorf("failed to publish to any of the relays")
+		}
 	}
 
 	return nil

fetch.go

@@ -24,9 +24,22 @@ var fetch = &cli.Command{
 			Aliases: []string{"r"},
 			Usage:   "also use these relays to fetch from",
 		},
+		&cli.StringFlag{
+			Name:  "jq",
+			Usage: "filter returned events with jq expression",
+		},
+		&cli.BoolFlag{
+			Name:  "jq-raw",
+			Usage: "print --jq string results without JSON quoting, like `jq -r`",
+		},
 	),
 	ArgsUsage: "[nip05_or_nip19_code]",
 	Action: func(ctx context.Context, c *cli.Command) error {
+		jq, err := jqPrepare(c.String("jq"), c.Bool("jq-raw"))
+		if err != nil {
+			return err
+		}
+
 		for code := range getStdinLinesOrArguments(c.Args()) {
 			filter := nostr.Filter{}
 			var authorHint nostr.PubKey
@@ -61,7 +74,7 @@ var fetch = &cli.Command{
 					}
 					relays = append(relays, v.Relays...)
 				case "note":
-					filter.IDs = append(filter.IDs, value.([32]byte))
+					filter.IDs = append(filter.IDs, value.(nostr.EventPointer).ID)
 				case "naddr":
 					v := value.(nostr.EntityPointer)
 					filter.Kinds = []nostr.Kind{v.Kind}
@@ -88,7 +101,7 @@ var fetch = &cli.Command{
 					sys.Hints.Save(authorHint, nostr.NormalizeURL(url), hints.LastInHint, nostr.Now())
 				}
 
-				for _, url := range sys.FetchOutboxRelays(ctx, authorHint, 3) {
+				for _, url := range sys.FetchOutboxRelays(ctx, authorHint, 6) {
 					relays = append(relays, url)
 				}
 			}
@@ -111,7 +124,20 @@ var fetch = &cli.Command{
 				Label: "nak-fetch",
 			}) {
 				found = true
-				stdout(ie.Event)
+				var out string
+				if jq == nil {
+					out = ie.Event.String()
+				} else {
+					v, matches, err := jq(ie.Event)
+					if err != nil {
+						return fmt.Errorf("jq filter failed: %w", err)
+					}
+					if !matches {
+						continue
+					}
+					out = v
+				}
+				stdout(out)
 			}
 
 			if !found {

filter.go

@@ -24,6 +24,10 @@ example:
 			Name:  "jq",
 			Usage: "filter matching events with jq expression",
 		},
+		&cli.BoolFlag{
+			Name:  "jq-raw",
+			Usage: "print --jq string results without JSON quoting, like `jq -r`",
+		},
 	),
 	ArgsUsage: "[event_json] [base_filter_json]",
 	Action: func(ctx context.Context, c *cli.Command) error {
@@ -59,7 +63,7 @@ example:
 			return err
 		}
 
-		jq, err := jqPrepare(c.String("jq"))
+		jq, err := jqPrepare(c.String("jq"), c.Bool("jq-raw"))
 		if err != nil {
 			return err
 		}
@@ -82,6 +86,9 @@ example:
 			if evt.Sig == [64]byte{} {
 				evt.Sig = baseEvent.Sig
 			}
+			if evt.Kind == 0 {
+				evt.Kind = baseEvent.Kind
+			}
 			if evt.Content == "" {
 				evt.Content = baseEvent.Content
 			}
@@ -104,7 +111,7 @@ example:
 					if !matches {
 						continue
 					}
-					out, _ = json.MarshalToString(v)
+					out = v
 				}
 				stdout(out)
 			} else {

flags.go

@@ -131,6 +131,45 @@ func getNaturalDate(cmd *cli.Command, name string) nostr.Timestamp {
 //
 //
 
+type (
+	SecretKeyFlag = cli.FlagBase[nostr.SecretKey, struct{}, secretkeyValue]
+)
+
+type secretkeyValue struct {
+	secretkey  nostr.SecretKey
+	hasBeenSet bool
+}
+
+var _ cli.ValueCreator[nostr.SecretKey, struct{}] = secretkeyValue{}
+
+func (t secretkeyValue) Create(val nostr.SecretKey, p *nostr.SecretKey, c struct{}) cli.Value {
+	*p = val
+	return &secretkeyValue{
+		secretkey: val,
+	}
+}
+
+func (t secretkeyValue) ToString(b nostr.SecretKey) string { return t.secretkey.String() }
+
+func (t *secretkeyValue) Set(value string) error {
+	secretkey, err := parseSecretKey(value)
+	t.secretkey = secretkey
+	t.hasBeenSet = true
+	return err
+}
+
+func (t *secretkeyValue) String() string         { return fmt.Sprintf("%#v", t.secretkey) }
+func (t *secretkeyValue) Value() nostr.SecretKey { return t.secretkey }
+func (t *secretkeyValue) Get() any               { return t.secretkey }
+
+func getSecretKey(cmd *cli.Command, name string) nostr.SecretKey {
+	return cmd.Value(name).(nostr.SecretKey)
+}
+
+//
+//
+//
+
 type (
 	PubKeyFlag = cli.FlagBase[nostr.PubKey, struct{}, pubkeyValue]
 )

gift.go

@@ -332,7 +332,7 @@ func getDecoupledEncryptionSecretKey(ctx context.Context, configPath string, pub
 				return [32]byte{}, true, fmt.Errorf("invalid main key: %w", err)
 			}
 			if eSec.Public() != ePub {
-				return [32]byte{}, true, fmt.Errorf("stored decoupled encryption key is corrupted: %w", err)
+				return [32]byte{}, true, fmt.Errorf("stored decoupled encryption key at %s doesn't match the announced key %s", eKeyPath, ePub.Hex())
 			}
 			return eSec, true, nil
 		}

go.mod

@@ -3,7 +3,7 @@ module github.com/fiatjaf/nak
 go 1.25
 
 require (
-	fiatjaf.com/nostr v0.0.0-20260615112943-0616b30ab35c
+	fiatjaf.com/nostr v0.0.0-20260716191248-c205ed45b97e
 	github.com/AlecAivazis/survey/v2 v2.3.7
 	github.com/bep/debounce v1.2.1
 	github.com/btcsuite/btcd/btcec/v2 v2.3.6
@@ -29,6 +29,7 @@ require (
 
 require (
 	fiatjaf.com/lib v0.3.7
+	github.com/denisbrodbeck/machineid v1.0.1
 	github.com/hanwen/go-fuse/v2 v2.9.0
 	github.com/itchyny/gojq v0.12.19
 	github.com/lithammer/fuzzysearch v1.1.8

go.sum

@@ -1,7 +1,7 @@
 fiatjaf.com/lib v0.3.7 h1:mXZOn7NrUcjSdy4oNvwQyAmes7Ueb+Zr5hjqMIe2dxI=
 fiatjaf.com/lib v0.3.7/go.mod h1:UlHaZvPHj25PtKLh9GjZkUHRmQ2xZ8Jkoa4VRaLeeQ8=
-fiatjaf.com/nostr v0.0.0-20260615112943-0616b30ab35c h1:LyUM+6Z8e51OyIRriZooY3+W0ogWBUJe0B/nU1uD04o=
-fiatjaf.com/nostr v0.0.0-20260615112943-0616b30ab35c/go.mod h1:b1EIUDnd133Ie8Pg8O/biaKdFyCMz28aD4n64g1GqvM=
+fiatjaf.com/nostr v0.0.0-20260716191248-c205ed45b97e h1:/vgoytiH4qQ28O/oX1hj656X69CnTy1pGj/17HFjH+A=
+fiatjaf.com/nostr v0.0.0-20260716191248-c205ed45b97e/go.mod h1:b1EIUDnd133Ie8Pg8O/biaKdFyCMz28aD4n64g1GqvM=
 github.com/AlecAivazis/survey/v2 v2.3.7 h1:6I/u8FvytdGsgonrYsVn2t8t4QiRnh6QSTqkkhIiSjQ=
 github.com/AlecAivazis/survey/v2 v2.3.7/go.mod h1:xUTIdE4KCOIjsBAE1JYsUPoCqYdZ1reCfTwbto0Fduo=
 github.com/FastFilter/xorfilter v0.2.1 h1:lbdeLG9BdpquK64ZsleBS8B4xO/QW1IM0gMzF7KaBKc=
@@ -102,6 +102,8 @@ github.com/decred/dcrd/dcrec/secp256k1/v4 v4.0.1/go.mod h1:hyedUtir6IdtD/7lIxGeC
 github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0 h1:NMZiJj8QnKe1LgsbDayM4UoHwbvwDRwnI3hwNaAHRnc=
 github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0/go.mod h1:ZXNYxsqcloTdSy/rNShjYzMhyjf0LaoftYK0p+A3h40=
 github.com/decred/dcrd/lru v1.0.0/go.mod h1:mxKOwFd7lFjN2GZYsiz/ecgqR6kkYAl+0pz0tEMk218=
+github.com/denisbrodbeck/machineid v1.0.1 h1:geKr9qtkB876mXguW2X6TU4ZynleN6ezuMSRhl4D7AQ=
+github.com/denisbrodbeck/machineid v1.0.1/go.mod h1:dJUwb7PTidGDeYyUBmXZ2GphQBbjJCrnectwCyxcUSI=
 github.com/dgraph-io/ristretto/v2 v2.3.0 h1:qTQ38m7oIyd4GAed/QkUZyPFNMnvVWyazGXRwvOt5zk=
 github.com/dgraph-io/ristretto/v2 v2.3.0/go.mod h1:gpoRV3VzrEY1a9dWAYV6T1U7YzfgttXdd/ZzL1s9OZM=
 github.com/dgryski/go-farm v0.0.0-20240924180020-3414d57e47da h1:aIftn67I1fkbMa512G+w+Pxci9hJPB8oMnkcP3iZF38=

group.go

@@ -29,7 +29,6 @@ var group = &cli.Command{
 	ArgsUsage:                 "<subcommand> <relay>'<identifier> [flags]",
 	Flags:                     combineFlags([][]cli.Flag{}),
 	Before: func(ctx context.Context, c *cli.Command) (context.Context, error) {
-
 		return ctx, nil
 	},
 	Commands: []*cli.Command{
@@ -244,9 +243,17 @@ var group = &cli.Command{
 					return err
 				}
 
-				r, err := sys.Pool.EnsureRelay(relay)
-				if err != nil {
-					return err
+				nm := nostr.NormalizeURL(relay)
+				r, ok := sys.Pool.Relays.Load(nm)
+				if !ok || r == nil || !r.IsConnected() {
+					ct, cancel := context.WithTimeout(context.Background(), connectTimeout)
+					var err error
+					r, err = nostr.RelayConnect(ct, relay, sys.Pool.RelayOptions)
+					cancel()
+					if err != nil {
+						return err
+					}
+					sys.Pool.Relays.Store(nm, r)
 				}
 
 				sub, err := r.Subscribe(ctx, nostr.Filter{
@@ -317,11 +324,19 @@ var group = &cli.Command{
 							return fmt.Errorf("failed to sign message: %w", err)
 						}
 
-						if r, err := sys.Pool.EnsureRelay(relay); err != nil {
-							return err
-						} else {
-							return r.Publish(ctx, msg)
+						nm := nostr.NormalizeURL(relay)
+						r, ok := sys.Pool.Relays.Load(nm)
+						if !ok || r == nil || !r.IsConnected() {
+							ct, cancel := context.WithTimeout(context.Background(), connectTimeout)
+							var err error
+							r, err = nostr.RelayConnect(ct, relay, sys.Pool.RelayOptions)
+							cancel()
+							if err != nil {
+								return err
+							}
+							sys.Pool.Relays.Store(nm, r)
 						}
+						return r.Publish(ctx, msg)
 					},
 				},
 			},
@@ -475,9 +490,17 @@ write your forum post
 							return fmt.Errorf("failed to sign forum topic event: %w", err)
 						}
 
-						r, err := sys.Pool.EnsureRelay(relay)
-						if err != nil {
-							return err
+						nm := nostr.NormalizeURL(relay)
+						r, ok := sys.Pool.Relays.Load(nm)
+						if !ok || r == nil || !r.IsConnected() {
+							ct, cancel := context.WithTimeout(context.Background(), connectTimeout)
+							var err error
+							r, err = nostr.RelayConnect(ct, relay, sys.Pool.RelayOptions)
+							cancel()
+							if err != nil {
+								return err
+							}
+							sys.Pool.Relays.Store(nm, r)
 						}
 
 						return r.Publish(ctx, evt)
@@ -582,9 +605,17 @@ write your forum post
 							return fmt.Errorf("failed to sign forum comment event: %w", err)
 						}
 
-						r, err := sys.Pool.EnsureRelay(relay)
-						if err != nil {
-							return err
+						nm := nostr.NormalizeURL(relay)
+						r, ok := sys.Pool.Relays.Load(nm)
+						if !ok || r == nil || !r.IsConnected() {
+							ct, cancel := context.WithTimeout(context.Background(), connectTimeout)
+							var err error
+							r, err = nostr.RelayConnect(ct, relay, sys.Pool.RelayOptions)
+							cancel()
+							if err != nil {
+								return err
+							}
+							sys.Pool.Relays.Store(nm, r)
 						}
 
 						return r.Publish(ctx, evt)
@@ -696,6 +727,18 @@ write your forum post
 					Name:  "all-kinds",
 					Usage: "specify this to delete the supported_kinds property, meaning everything will be supported",
 				},
+				&cli.StringFlag{
+					Name:  "parent",
+					Usage: "set parent group identifier",
+				},
+				&cli.StringFlag{
+					Name:  "children",
+					Usage: "set child group identifiers (semicolon-separated)",
+				},
+				&cli.BoolFlag{
+					Name:  "orphan",
+					Usage: "remove parent tag, making this group an orphan",
+				},
 			},
 			Action: func(ctx context.Context, c *cli.Command) error {
 				relay, identifier, err := parseGroupIdentifier(c)
@@ -760,6 +803,18 @@ write your forum post
 				} else if c.Bool("all-kinds") {
 					group.SupportedKinds = nil
 				}
+				if parent := c.String("parent"); parent != "" {
+					group.Parent = parent
+				}
+				if children := c.String("children"); children != "" {
+					group.Children = strings.Split(children, ";")
+					for i := range group.Children {
+						group.Children[i] = strings.TrimSpace(group.Children[i])
+					}
+				}
+				if c.Bool("orphan") {
+					group.Parent = ""
+				}
 
 				return publishModerationEvent(ctx, c, 9002, func(evt *nostr.Event, args []string) error {
 					evt.Tags = append(evt.Tags, nostr.Tag{"name", group.Name})
@@ -790,6 +845,12 @@ write your forum post
 						}
 						evt.Tags = append(evt.Tags, tag)
 					}
+					if group.Parent != "" {
+						evt.Tags = append(evt.Tags, nostr.Tag{"parent", group.Parent})
+					}
+					for _, child := range group.Children {
+						evt.Tags = append(evt.Tags, nostr.Tag{"child", child})
+					}
 					return nil
 				})
 			},
@@ -877,9 +938,17 @@ func publishModerationEvent(ctx context.Context, c *cli.Command, kind nostr.Kind
 
 	stdout(evt.String())
 
-	r, err := sys.Pool.EnsureRelay(relay)
-	if err != nil {
-		return err
+	nm := nostr.NormalizeURL(relay)
+	r, ok := sys.Pool.Relays.Load(nm)
+	if !ok || r == nil || !r.IsConnected() {
+		ct, cancel := context.WithTimeout(context.Background(), connectTimeout)
+		var err error
+		r, err = nostr.RelayConnect(ct, relay, sys.Pool.RelayOptions)
+		cancel()
+		if err != nil {
+			return err
+		}
+		sys.Pool.Relays.Store(nm, r)
 	}
 
 	return r.Publish(ctx, evt)

helpers.go

@@ -48,6 +48,8 @@ var (
 	stdout     = func(args ...any) { fmt.Fprintln(color.Output, args...) }
 )
 
+var connectTimeout = 2 * time.Second
+
 func isPiped() bool {
 	stat, err := os.Stdin.Stat()
 	if err != nil {
@@ -219,21 +221,28 @@ func connectToAllRelays(
 
 		wg := sync.WaitGroup{}
 		wg.Add(len(relayUrls))
+		mu := sync.Mutex{} // guards lines and relays, written from the goroutines below
 		for i, url := range relayUrls {
 			lines[i] = make([][]byte, 1, 2)
 			logthis := func(s string, args ...any) {
+				mu.Lock()
 				lines[i] = append(lines[i], []byte(fmt.Sprintf(s, args...)))
 				render()
+				mu.Unlock()
 			}
 			colorizepreamble := func(c func(string, ...any) string) {
+				mu.Lock()
 				lines[i][0] = []byte(fmt.Sprintf("%s... ", c(url)))
+				mu.Unlock()
 			}
 			colorizepreamble(color.CyanString)
 
 			go func() {
 				relay := connectToSingleRelay(ctx, c, url, colorizepreamble, logthis)
 				if relay != nil {
+					mu.Lock()
 					relays = append(relays, relay)
+					mu.Unlock()
 				}
 				wg.Done()
 			}()
@@ -261,63 +270,75 @@ func connectToSingleRelay(
 	colorizepreamble func(c func(string, ...any) string),
 	logthis func(s string, args ...any),
 ) *nostr.Relay {
-	if relay, err := sys.Pool.EnsureRelay(url); err == nil {
-		if c.Bool("force-pre-auth") {
-			if colorizepreamble != nil {
-				colorizepreamble(color.YellowString)
-			}
-			logthis("waiting for auth challenge... ")
-			time.Sleep(time.Millisecond * 200)
+	nm := nostr.NormalizeURL(url)
 
-			for range 5 {
-				if err := relay.Auth(ctx, func(ctx context.Context, authEvent *nostr.Event) error {
-					challengeTag := authEvent.Tags.Find("challenge")
-					if challengeTag == nil || len(challengeTag) < 2 || challengeTag[1] == "" {
-						return fmt.Errorf("auth not received yet *****") // what a giant hack
-					}
-					return authSigner(ctx, c, logthis, authEvent)
-				}); err == nil {
-					// auth succeeded
-					goto preauthSuccess
-				} else {
-					// auth failed
-					if strings.HasSuffix(err.Error(), "auth not received yet *****") {
-						// it failed because we didn't receive the challenge yet, so keep waiting
-						time.Sleep(time.Second)
-						continue
-					} else {
-						// it failed for some other reason, so skip this relay
-						if colorizepreamble != nil {
-							colorizepreamble(colors.errorf)
-						}
-						logthis(err.Error())
-						return nil
-					}
-				}
-			}
+	relay, ok := sys.Pool.Relays.Load(nm)
+	if !ok || relay == nil || !relay.IsConnected() {
+		connectCtx, cancel := context.WithTimeout(context.Background(), connectTimeout)
+		defer cancel()
+
+		var err error
+		if relay, err = nostr.RelayConnect(connectCtx, url, sys.Pool.RelayOptions); err != nil {
 			if colorizepreamble != nil {
 				colorizepreamble(colors.errorf)
 			}
-			logthis("failed to get an AUTH challenge in enough time.")
+			logthis(clampError(err, len(url)+12))
 			return nil
 		}
 
-	preauthSuccess:
+		sys.Pool.Relays.Store(nm, relay)
+		go func(r *nostr.Relay, relayURL string) {
+			<-r.Context().Done()
+			if current, ok := sys.Pool.Relays.Load(relayURL); ok && current == r {
+				sys.Pool.Relays.Delete(relayURL)
+			}
+		}(relay, nm)
+	}
+
+	if c.Bool("force-pre-auth") {
 		if colorizepreamble != nil {
-			colorizepreamble(colors.successf)
+			colorizepreamble(color.YellowString)
+		}
+		logthis("waiting for auth challenge... ")
+		time.Sleep(time.Millisecond * 200)
+
+		for range 5 {
+			if err := relay.Auth(ctx, func(ctx context.Context, authEvent *nostr.Event) error {
+				challengeTag := authEvent.Tags.Find("challenge")
+				if challengeTag == nil || len(challengeTag) < 2 || challengeTag[1] == "" {
+					return fmt.Errorf("auth not received yet *****") // what a giant hack
+				}
+				return authSigner(ctx, c, logthis, authEvent)
+			}); err == nil {
+				// auth succeeded
+				goto preauthSuccess
+			} else {
+				// auth failed
+				if strings.HasSuffix(err.Error(), "auth not received yet *****") {
+					time.Sleep(time.Second)
+					continue
+				} else {
+					if colorizepreamble != nil {
+						colorizepreamble(colors.errorf)
+					}
+					logthis(err.Error())
+					return nil
+				}
+			}
 		}
-		logthis("ok.")
-		return relay
-	} else {
 		if colorizepreamble != nil {
 			colorizepreamble(colors.errorf)
 		}
-
-		// if we're here that means we've failed to connect, this may be a huge message
-		// but we're likely to only be interested in the lowest level error (although we can leave space)
-		logthis(clampError(err, len(url)+12))
+		logthis("failed to get an AUTH challenge in enough time.")
 		return nil
 	}
+
+preauthSuccess:
+	if colorizepreamble != nil {
+		colorizepreamble(colors.successf)
+	}
+	logthis("ok.")
+	return relay
 }
 
 func clearLines(lineCount int) {
@@ -478,6 +499,19 @@ func parsePubKey(value string) (nostr.PubKey, error) {
 	return nostr.PubKey{}, fmt.Errorf("invalid pubkey (\"%s\"): expected hex, npub, or nprofile", value)
 }
 
+func parseSecretKey(input string) (nostr.SecretKey, error) {
+	if prefix, ski, err := nip19.Decode(input); err == nil && prefix == "nsec" {
+		return ski.(nostr.SecretKey), nil
+	}
+
+	sk, err := nostr.SecretKeyFromHex(input)
+	if err != nil {
+		return nostr.SecretKey{}, fmt.Errorf("invalid secret key: %w", err)
+	}
+
+	return sk, nil
+}
+
 func parseEventID(value string) (nostr.ID, error) {
 	id, err := nostr.IDFromHex(value)
 	if err == nil {
@@ -487,8 +521,8 @@ func parseEventID(value string) (nostr.ID, error) {
 	if prefix, decoded, err := nip19.Decode(value); err == nil {
 		switch prefix {
 		case "note":
-			if id, ok := decoded.(nostr.ID); ok {
-				return id, nil
+			if event, ok := decoded.(nostr.EventPointer); ok {
+				return event.ID, nil
 			}
 		case "nevent":
 			if event, ok := decoded.(nostr.EventPointer); ok {
@@ -607,6 +641,9 @@ func getSchema() (schema.Schema, error) {
 
 func stringToKind(value string) (nostr.Kind, error) {
 	if n, err := strconv.Atoi(value); err == nil && n >= 0 {
+		if n > 65535 {
+			return 0, fmt.Errorf("kind number %d is out of range (0-65535)", n)
+		}
 		return nostr.Kind(n), nil
 	}
 

helpers_key.go

@@ -2,22 +2,37 @@ package main
 
 import (
 	"context"
+	"crypto/sha256"
 	"fmt"
 	"os"
 	"strings"
 
 	"fiatjaf.com/nostr"
 	"fiatjaf.com/nostr/keyer"
-	"fiatjaf.com/nostr/nip19"
 	"fiatjaf.com/nostr/nip42"
 	"fiatjaf.com/nostr/nip46"
 	"fiatjaf.com/nostr/nip49"
 	"github.com/chzyer/readline"
+	"github.com/denisbrodbeck/machineid"
 	"github.com/fatih/color"
 	"github.com/mattn/go-tty/v2"
 	"github.com/urfave/cli/v3"
 )
 
+// the default secret key we will use when "--sec" is not provided
+func defaultKey() nostr.SecretKey {
+	mid, err := machineid.ID()
+	if err != nil {
+		k := nostr.SecretKey{}
+		k[29] = 'n'
+		k[30] = 'a'
+		k[31] = 'k'
+		return k
+	}
+
+	return sha256.Sum256([]byte(mid))
+}
+
 func gatherKeyerFromArguments(ctx context.Context, c *cli.Command) (nostr.Keyer, nostr.SecretKey, error) {
 	key, bunker, err := gatherSecretKeyOrBunkerFromArguments(ctx, c)
 	if err != nil {
@@ -25,10 +40,10 @@ func gatherKeyerFromArguments(ctx context.Context, c *cli.Command) (nostr.Keyer,
 	}
 
 	var kr nostr.Keyer
-	if bunker != nil {
-		kr = keyer.NewBunkerSignerFromBunkerClient(bunker)
-	} else {
+	if bunker == nil {
 		kr = keyer.NewPlainKeySigner(key)
+	} else {
+		kr = keyer.NewBunkerSignerFromBunkerClient(bunker)
 	}
 
 	return kr, key, nil
@@ -36,25 +51,15 @@ func gatherKeyerFromArguments(ctx context.Context, c *cli.Command) (nostr.Keyer,
 
 func gatherSecretKeyOrBunkerFromArguments(ctx context.Context, c *cli.Command) (nostr.SecretKey, *nip46.BunkerClient, error) {
 	sec := c.String("sec")
+
 	if strings.HasPrefix(sec, "bunker://") {
 		// it's a bunker
 		bunkerURL := sec
-		clientKeyHex := c.String("connect-as")
-		var clientKey nostr.SecretKey
-
-		if clientKeyHex != "" {
-			var err error
-			clientKey, err = nostr.SecretKeyFromHex(clientKeyHex)
-			if err != nil {
-				return nostr.SecretKey{}, nil, fmt.Errorf("bunker client key '%s' is invalid: %w", clientKeyHex, err)
-			}
-		} else {
-			clientKey = nostr.Generate()
-		}
 
+		clientKey := getSecretKey(c, "connect-as")
 		logverbose("[nip46]: connecting to %s with client key %s\n", bunkerURL, clientKey.Hex())
 
-		bunker, err := nip46.ConnectBunker(ctx, clientKey, bunkerURL, nil, func(s string) {
+		bunker, err := nip46.ConnectBunker(ctx, clientKey, bunkerURL, sys.Pool, func(s string) {
 			log(color.CyanString("[nip46]: open the following URL: %s"), s)
 		})
 		if err != nil {
@@ -80,16 +85,8 @@ func gatherSecretKeyOrBunkerFromArguments(ctx context.Context, c *cli.Command) (
 		return sk, nil, nil
 	}
 
-	if prefix, ski, err := nip19.Decode(sec); err == nil && prefix == "nsec" {
-		return ski.(nostr.SecretKey), nil, nil
-	}
-
-	sk, err := nostr.SecretKeyFromHex(sec)
-	if err != nil {
-		return nostr.SecretKey{}, nil, fmt.Errorf("invalid secret key: %w", err)
-	}
-
-	return sk, nil, nil
+	sk, err := parseSecretKey(sec)
+	return sk, nil, err
 }
 
 func authSigner(ctx context.Context, c *cli.Command, log func(s string, args ...any), authEvent *nostr.Event) (err error) {
@@ -104,14 +101,19 @@ func authSigner(ctx context.Context, c *cli.Command, log func(s string, args ...
 		return fmt.Errorf("auth required, but --auth flag not given")
 	}
 
-	kr, _, err := gatherKeyerFromArguments(ctx, c)
-	if err != nil {
-		return err
+	var kr nostr.Keyer
+
+	if nip46.IsBunkerClientOperation(ctx) {
+		kr = keyer.NewPlainKeySigner(getSecretKey(c, "connect-as"))
+	} else {
+		kr, _, err = gatherKeyerFromArguments(ctx, c)
+		if err != nil {
+			return err
+		}
 	}
 
 	pk, _ := kr.GetPublicKey(ctx)
-	npub := nip19.EncodeNpub(pk)
-	log("authenticating as %s... ", color.YellowString("%s…%s", npub[0:7], npub[58:]))
+	log("authenticating as %s... ", color.YellowString("%s…", pk.Hex()[0:16]))
 
 	return kr.SignEvent(ctx, authEvent)
 }

jq.go

@@ -14,11 +14,16 @@ def value(tagName): tag(tagName)[1];
 def has(tagName): (tags(tagName) | length) > 0;
 def hasnt(tagName): (tags(tagName) | length) == 0;
 def has_value(tagName; tagValue): tags(tagName) | map(select(.[1] == tagValue)) | length > 0;
+def date: .created_at | gmtime | strftime("%Y-%m-%d");
+def time: .created_at | gmtime | strftime("%H:%M:%S");
+def datetime: .created_at | gmtime | strftime("%Y-%m-%dT%H:%M:%SZ");
 `
 
-type jqProcessor func(nostr.Event) (any, bool, error)
+// jqProcessor runs the compiled jq expression against an event and returns the
+// rendered output string. When matches is false the event should be skipped.
+type jqProcessor func(nostr.Event) (out string, matches bool, err error)
 
-func jqPrepare(expr string) (jqProcessor, error) {
+func jqPrepare(expr string, raw bool) (jqProcessor, error) {
 	if expr == "" {
 		return nil, nil
 	}
@@ -33,30 +38,43 @@ func jqPrepare(expr string) (jqProcessor, error) {
 		return nil, fmt.Errorf("failed to compile jq expression: %w", err)
 	}
 
-	return func(evt nostr.Event) (any, bool, error) {
+	return func(evt nostr.Event) (string, bool, error) {
 		input, err := toJQInput(evt)
 		if err != nil {
-			return nil, false, err
+			return "", false, err
 		}
 
 		iter := code.Run(input)
 		for {
 			v, ok := iter.Next()
 			if !ok {
-				return v, false, nil
+				return "", false, nil
 			}
 
 			if err, ok := v.(error); ok {
-				return v, false, err
+				return "", false, err
 			}
 
 			if jqTruthy(v) {
-				return v, true, nil
+				return jqStringify(v, raw), true, nil
 			}
 		}
 	}, nil
 }
 
+// jqStringify renders a jq result value. In raw mode string results are printed
+// without JSON quoting (like `jq -r`); non-string results are always
+// JSON-encoded.
+func jqStringify(v any, raw bool) string {
+	if raw {
+		if s, ok := v.(string); ok {
+			return s
+		}
+	}
+	out, _ := json.MarshalToString(v)
+	return out
+}
+
 func toJQInput(v any) (any, error) {
 	data, err := json.Marshal(v)
 	if err != nil {

key.go

@@ -28,6 +28,7 @@ var key = &cli.Command{
 		decryptKey,
 		combine,
 		validate,
+		defaultCommand,
 	},
 }
 
@@ -56,7 +57,21 @@ var public = &cli.Command{
 		},
 	},
 	Action: func(ctx context.Context, c *cli.Command) error {
-		for sk := range getSecretKeysFromStdinLinesOrSlice(ctx, c, c.Args().Slice()) {
+		args := c.Args().Slice()
+		if len(args) == 0 && !isPiped() {
+			kr, _, err := gatherKeyerFromArguments(ctx, c)
+			if err != nil {
+				return err
+			}
+			pk, err := kr.GetPublicKey(ctx)
+			if err != nil {
+				return fmt.Errorf("failed to get public key: %w", err)
+			}
+			stdout(pk.Hex())
+			return nil
+		}
+
+		for sk := range getSecretKeysFromStdinLinesOrSlice(ctx, c, args) {
 			_, pk := btcec.PrivKeyFromBytes(sk[:])
 
 			if c.Bool("with-parity") {
@@ -172,7 +187,8 @@ var decryptKey = &cli.Command{
 				}
 			} else {
 				password = c.Args().Get(0)
-				for ncryptsec := range getStdinLinesOrArgumentsFromSlice([]string{ncryptsec}) {
+				// the ncryptsec codes come from stdin
+				for ncryptsec := range getStdinLinesOrArgumentsFromSlice(nil) {
 					sk, err := nip49.Decrypt(ncryptsec, password)
 					if err != nil {
 						ctx = lineProcessingError(ctx, "failed to decrypt: %s", err)
@@ -180,6 +196,7 @@ var decryptKey = &cli.Command{
 					}
 					stdout(sk.Hex())
 				}
+				exitIfLineProcessingError(ctx)
 				return nil
 			}
 		default:
@@ -211,7 +228,7 @@ Returns error if key is invalid, otherwise exits successfully.`,
 					ctx = lineProcessingError(ctx, "invalid npub: %s", err)
 					continue
 				}
-				tmp := data.([32]byte)
+				tmp := data.(nostr.PubKey)
 				pkBytes = tmp[:]
 			} else {
 				pkBytes, err = hex.DecodeString(pk)
@@ -235,6 +252,17 @@ Returns error if key is invalid, otherwise exits successfully.`,
 	},
 }
 
+var defaultCommand = &cli.Command{
+	Name:                      "default",
+	Usage:                     "prints the default secret key",
+	Description:               `the default secret key is generated differently for each machine (or falls back to a hardcoded one in case of failure), it is not save in any way, but this command makes it available if that is needed.`,
+	DisableSliceFlagSeparator: true,
+	Action: func(ctx context.Context, c *cli.Command) error {
+		stdout(nip19.EncodeNsec(defaultKey()))
+		return nil
+	},
+}
+
 var combine = &cli.Command{
 	Name:  "combine",
 	Usage: "combines two or more pubkeys using musig2",
@@ -298,6 +326,12 @@ However, if the intent is to check if two existing Nostr pubkeys match a given c
 
 				continue
 			}
+
+			return fmt.Errorf("invalid key %s: expected 32 or 33 bytes hex", keyhex)
+		}
+
+		if len(keyGroups) < 2 {
+			return fmt.Errorf("at least two pubkeys are required")
 		}
 
 		result.Combinations = make([]Combination, 0, 16)

lmdb.go

@@ -22,9 +22,10 @@ func setupLocalDatabases(c *cli.Command, sys *sdk.System) {
 
 	hintsPath := filepath.Join(configPath, "outbox/hints")
 	os.MkdirAll(hintsPath, 0755)
-	_, err := lmdbh.NewLMDBHints(hintsPath)
-	if err != nil {
+	if hdb, err := lmdbh.NewLMDBHints(hintsPath); err != nil {
 		log("failed to create lmdb hints db at '%s': %s\n", hintsPath, err)
+	} else {
+		sys.Hints = hdb
 	}
 
 	eventsPath := filepath.Join(configPath, "events")

main.go

@@ -7,6 +7,7 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
+	"time"
 
 	"fiatjaf.com/nostr"
 	"fiatjaf.com/nostr/nip42"
@@ -15,8 +16,6 @@ import (
 	"github.com/urfave/cli/v3"
 )
 
-var defaultKey = nostr.KeyOne.Hex()
-
 var authFlags = []cli.Flag{
 	&cli.BoolFlag{
 		Name:     "auth",
@@ -35,23 +34,25 @@ var defaultKeyFlags = []cli.Flag{
 	&cli.StringFlag{
 		Name:        "sec",
 		Usage:       "secret key to sign the event, as nsec, ncryptsec or hex, or a bunker URL",
-		DefaultText: "the key '01'",
 		Category:    CATEGORY_SIGNER,
 		Sources:     cli.EnvVars("NOSTR_SECRET_KEY"),
-		Value:       defaultKey,
-		HideDefault: true,
+		Value:       defaultKey().Hex(),
+		DefaultText: "a default key specific to your machine, see it with `nak key default`",
 	},
 	&cli.BoolFlag{
 		Name:     "prompt-sec",
 		Usage:    "prompt the user to paste a hex or nsec with which to sign the event",
 		Category: CATEGORY_SIGNER,
+		Hidden:   true,
 	},
-	&cli.StringFlag{
+	&SecretKeyFlag{
 		Name:        "connect-as",
 		Usage:       "private key to use when communicating with nip46 bunkers",
-		DefaultText: "a random key",
 		Category:    CATEGORY_SIGNER,
 		Sources:     cli.EnvVars("NOSTR_CLIENT_KEY"),
+		Value:       defaultKey(),
+		DefaultText: "the default key (see `nak key default`)",
+		Hidden:      true,
 	},
 }
 
@@ -130,6 +131,7 @@ var app = &cli.Command{
 					}
 					return nil
 				},
+				Hidden: true,
 			},
 			&cli.BoolFlag{
 				Name:    "verbose",
@@ -143,6 +145,17 @@ var app = &cli.Command{
 					}
 					return nil
 				},
+				Hidden: true,
+			},
+			&cli.DurationFlag{
+				Name:  "connect-timeout",
+				Usage: "timeout for connecting to relays",
+				Value: connectTimeout,
+				Action: func(ctx context.Context, c *cli.Command, d time.Duration) error {
+					connectTimeout = d
+					return nil
+				},
+				Hidden: true,
 			},
 		},
 		defaultKeyFlags,

mcp.go

@@ -155,6 +155,9 @@ var mcpServer = &cli.Command{
 		), func(ctx context.Context, r mcp.CallToolRequest) (*mcp.CallToolResult, error) {
 			name := required[string](r, "name")
 			limit, _ := optional[float64](r, "limit")
+			if limit == 0 {
+				limit = 10
+			}
 
 			res := strings.Builder{}
 			res.Grow(500)
@@ -239,7 +242,7 @@ var mcpServer = &cli.Command{
 			for ie := range events {
 				result.WriteString("author public key: ")
 				result.WriteString(ie.PubKey.Hex())
-				result.WriteString("content: '")
+				result.WriteString("\ncontent: '")
 				result.WriteString(ie.Content)
 				result.WriteString("'")
 				result.WriteString("\n---\n")

nip.go

@@ -65,7 +65,6 @@ examples:
 				}
 
 				url := "https://github.com/nostr-protocol/nips/blob/master/" + foundLink
-				fmt.Println("Opening " + url)
 
 				var cmd *exec.Cmd
 				switch runtime.GOOS {
@@ -147,7 +146,7 @@ examples:
 			return fmt.Errorf("failed to render markdown: %w", err)
 		}
 
-		fmt.Print(rendered)
+		stdout(rendered)
 		return nil
 	},
 }

nostrfs_cgo/root.go

@@ -996,10 +996,13 @@ func (r *NostrRoot) publishNote(path string) {
 	}
 
 	for _, url := range relays {
-		relay, err := r.sys.Pool.EnsureRelay(url)
+		connectCtx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+		relay, err := nostr.RelayConnect(connectCtx, url, r.sys.Pool.RelayOptions)
+		cancel()
 		if err != nil {
 			continue
 		}
+		r.sys.Pool.Relays.Store(nostr.NormalizeURL(url), relay)
 		relay.Publish(ctx, *evt)
 	}
 

podcast.go

@@ -157,8 +157,7 @@ func resolvePodcastEpisode(ctx context.Context, target string, relayHints []stri
 			pointer := value.(nostr.EventPointer)
 			return fetchSpecificPodcastEpisode(ctx, pointer, relayHints)
 		case "note":
-			pointer := nostr.EventPointer{ID: value.(nostr.ID)}
-			return fetchSpecificPodcastEpisode(ctx, pointer, relayHints)
+			return fetchSpecificPodcastEpisode(ctx, value.(nostr.EventPointer), relayHints)
 		}
 	}
 
@@ -557,16 +556,16 @@ func printPodcastInfo(p podcastInfo) {
 
 	authors := make([]string, 0, 2)
 	for _, tag := range p.Metadata.Tags {
-		if len(tag) >= 3 && tag[0] == "p" {
-			role := ""
-			if len(tag) >= 3 {
-				role = tag[2]
-			}
+		if len(tag) >= 2 && tag[0] == "p" {
 			pk, err := nostr.PubKeyFromHex(tag[1])
 			if err != nil {
 				continue
 			}
-			authors = append(authors, nip19.EncodeNpub(pk)+" "+role)
+			author := nip19.EncodeNpub(pk)
+			if len(tag) >= 3 && tag[2] != "" {
+				author += " " + tag[2]
+			}
+			authors = append(authors, author)
 		}
 	}
 	if len(authors) > 0 {
@@ -583,11 +582,11 @@ func printPodcastEpisodeList(ctx context.Context, p podcastInfo, limit int) erro
 	}
 
 	if len(episodes) == 0 {
-		stdout(color.YellowString("no episodes found for %s"), p.Title)
+		stdout(color.YellowString("no episodes found for %s", p.Title))
 		return nil
 	}
 
-	stdout(color.CyanString("episodes for %s:"), p.Title)
+	stdout(color.CyanString("episodes for %s:", p.Title))
 	for _, ep := range episodes {
 		title := podcastTagValue(ep, "title")
 		if title == "" {

profile.go

@@ -3,6 +3,8 @@ package main
 import (
 	"context"
 
+	stdjson "encoding/json"
+
 	"fiatjaf.com/nostr/nip19"
 	"github.com/fatih/color"
 	"github.com/urfave/cli/v3"
@@ -16,6 +18,24 @@ var profile = &cli.Command{
 example usage:
   nak profile npub1h8spmtw9m2huyv6v2j2qd5zv956z2zdugl6mgx02f2upffwpm3nqv0j4ps
   nak profile user@example.com`,
+	Flags: []cli.Flag{
+		&cli.BoolFlag{
+			Name:  "name",
+			Usage: "print only the name",
+		},
+		&cli.BoolFlag{
+			Name:  "picture",
+			Usage: "print only the picture URL",
+		},
+		&cli.BoolFlag{
+			Name:  "about",
+			Usage: "print only the about text",
+		},
+		&cli.BoolFlag{
+			Name:  "metadata",
+			Usage: "print the profile metadata as JSON",
+		},
+	},
 	ArgsUsage: "[pubkey]",
 	Action: func(ctx context.Context, c *cli.Command) error {
 		for pubkeyInput := range getStdinLinesOrArguments(c.Args()) {
@@ -27,6 +47,24 @@ example usage:
 
 			pm := sys.FetchProfileMetadata(ctx, pk)
 
+			if c.Bool("name") {
+				stdout(pm.Name)
+				continue
+			}
+			if c.Bool("picture") {
+				stdout(pm.Picture)
+				continue
+			}
+			if c.Bool("about") {
+				stdout(pm.About)
+				continue
+			}
+			if c.Bool("metadata") {
+				j, _ := stdjson.Marshal(pm)
+				stdout(string(j))
+				continue
+			}
+
 			npub := nip19.EncodeNpub(pk)
 			stdout(colors.bold("pubkey (hex):"), pk.Hex())
 			stdout(colors.bold("npub:"), color.HiCyanString(npub))

publish.go

@@ -8,26 +8,36 @@ import (
 	"strings"
 
 	"fiatjaf.com/nostr"
-	"fiatjaf.com/nostr/nip19"
 	"fiatjaf.com/nostr/sdk"
 	"github.com/urfave/cli/v3"
 )
 
 var publish = &cli.Command{
 	Name:  "publish",
-	Usage: "publishes a note with content from stdin",
-	Description: `reads content from stdin and publishes it as a note, optionally as a reply to another note.
+	Usage: "publishes a note with content from stdin or argument",
+	Description: `reads content and publishes it as a note, optionally as a reply to another note.
+Either pipe content or pass it as the first argument.
 
 example:
 	echo "hello world" | nak publish
+	nak publish "hello world"
 	echo "I agree!" | nak publish --reply nevent1...
-	echo "tagged post" | nak publish -t t=mytag -t e=someeventid`,
+	nak publish -t t=mytag -t e=someeventid "tagged post"`,
 	DisableSliceFlagSeparator: true,
 	Flags: combineFlags([][]cli.Flag{},
+		&cli.StringSliceFlag{
+			Name:    "relay",
+			Aliases: []string{"r"},
+			Usage:   "also publish to these relays",
+		},
 		&cli.StringFlag{
 			Name:  "reply",
 			Usage: "event id, naddr1 or nevent1 code to reply to",
 		},
+		&cli.StringFlag{
+			Name:  "comment",
+			Usage: "event id, naddr1 or nevent1 code to comment on (NIP-22 kind 1111, takes precedence over --reply)",
+		},
 		&cli.StringSliceFlag{
 			Name:    "tag",
 			Aliases: []string{"t"},
@@ -52,9 +62,17 @@ example:
 		},
 	),
 	Action: func(ctx context.Context, c *cli.Command) error {
-		content, err := io.ReadAll(os.Stdin)
-		if err != nil {
-			return fmt.Errorf("failed to read from stdin: %w", err)
+		var content []byte
+		if isPiped() {
+			var err error
+			content, err = io.ReadAll(os.Stdin)
+			if err != nil {
+				return fmt.Errorf("failed to read from stdin: %w", err)
+			}
+		} else if firstArg := c.Args().First(); firstArg != "" {
+			content = []byte(firstArg)
+		} else {
+			return fmt.Errorf("no content. pipe or pass content as argument.")
 		}
 
 		evt := nostr.Event{
@@ -69,51 +87,67 @@ example:
 			evt.CreatedAt = getNaturalDate(c, "created-at")
 		}
 
-		// handle reply flag
+		// handle reply/comment flag
+		// --comment takes precedence over --reply
+		target := c.String("comment")
+		isComment := c.IsSet("comment")
+		if target == "" {
+			target = c.String("reply")
+		}
 		var replyRelays []string
-		if replyTo := c.String("reply"); replyTo != "" {
-			var replyEvent *nostr.Event
-
-			// try to decode as nevent or naddr first
-			if strings.HasPrefix(replyTo, "nevent1") || strings.HasPrefix(replyTo, "naddr1") {
-				_, value, err := nip19.Decode(replyTo)
-				if err != nil {
-					return fmt.Errorf("invalid reply target: %w", err)
-				}
-
-				switch pointer := value.(type) {
-				case nostr.EventPointer:
-					replyEvent, _, err = sys.FetchSpecificEvent(ctx, pointer, sdk.FetchSpecificEventParameters{})
-				case nostr.EntityPointer:
-					replyEvent, _, err = sys.FetchSpecificEvent(ctx, pointer, sdk.FetchSpecificEventParameters{})
-				default:
-					return fmt.Errorf("unexpected reply target type: %T", value)
-				}
-				if err != nil {
-					return fmt.Errorf("failed to fetch reply target event: %w", err)
-				}
-			} else {
-				// try as raw event ID
-				id, err := nostr.IDFromHex(replyTo)
-				if err != nil {
-					return fmt.Errorf("invalid event id: %w", err)
-				}
-				replyEvent, _, err = sys.FetchSpecificEvent(ctx, nostr.EventPointer{ID: id}, sdk.FetchSpecificEventParameters{})
-				if err != nil {
-					return fmt.Errorf("failed to fetch reply target event: %w", err)
-				}
+		if target != "" {
+			replyEvent, relayHints, err := sys.FetchSpecificEventFromInput(ctx, target, sdk.FetchSpecificEventParameters{})
+			if err != nil {
+				return fmt.Errorf("failed to fetch reply target event: %w", err)
 			}
 
-			if replyEvent.Kind != 1 {
+			if isComment || replyEvent.Kind != 1 {
+				// NIP-22 comment
 				evt.Kind = 1111
-				evt.Tags = append(evt.Tags, nostr.Tag{"K", fmt.Sprint(replyEvent.Kind)})
-			}
+				buildNIP22Tags(&evt, replyEvent, relayHints)
+			} else {
+				// NIP-10 reply
+				if replyEvent.Kind != 1 {
+					evt.Kind = 1111
+					evt.Tags = append(evt.Tags, nostr.Tag{"K", fmt.Sprint(replyEvent.Kind)})
+				}
 
-			// add reply tags
-			evt.Tags = append(evt.Tags,
-				nostr.Tag{"e", replyEvent.ID.Hex(), "", "reply"},
-				nostr.Tag{"p", replyEvent.PubKey.Hex()},
-			)
+				// add reply tags per NIP-10
+				rootID := ""
+				rootRelay := ""
+				for _, tag := range replyEvent.Tags {
+					if len(tag) >= 2 && tag[0] == "e" {
+						if len(tag) >= 4 && tag[3] == "root" {
+							rootID = tag[1]
+							if len(tag) >= 3 {
+								rootRelay = tag[2]
+							}
+							break
+						}
+						if rootID == "" {
+							rootID = tag[1]
+							if len(tag) >= 3 {
+								rootRelay = tag[2]
+							}
+						}
+					}
+				}
+				if rootID == "" {
+					// replying to root event
+					evt.Tags = append(evt.Tags,
+						nostr.Tag{"e", replyEvent.ID.Hex(), "", "root"},
+					)
+				} else {
+					// replying to a reply
+					evt.Tags = append(evt.Tags,
+						nostr.Tag{"e", rootID, rootRelay, "root"},
+						nostr.Tag{"e", replyEvent.ID.Hex(), "", "reply"},
+					)
+				}
+				evt.Tags = append(evt.Tags,
+					nostr.Tag{"p", replyEvent.PubKey.Hex()},
+				)
+			}
 
 			replyRelays = sys.FetchInboxRelays(ctx, replyEvent.PubKey, 3)
 		}
@@ -148,7 +182,7 @@ example:
 		relayUrls := sys.FetchWriteRelays(ctx, pk)
 		relayUrls = nostr.AppendUnique(relayUrls, targetRelays...)
 		relayUrls = nostr.AppendUnique(relayUrls, replyRelays...)
-		relayUrls = nostr.AppendUnique(relayUrls, c.Args().Slice()...)
+		relayUrls = nostr.AppendUnique(relayUrls, c.StringSlice("relay")...)
 
 		relays := connectToAllRelays(ctx, c, relayUrls)
 
@@ -172,3 +206,102 @@ example:
 		return publishFlow(ctx, c, kr, evt, relays)
 	},
 }
+
+func buildNIP22Tags(evt *nostr.Event, target *nostr.Event, relayHints []string) {
+	var relayHint string
+	if len(relayHints) > 0 {
+		relayHint = relayHints[0]
+	}
+
+	dtag := func() string {
+		for _, tag := range target.Tags {
+			if len(tag) >= 2 && tag[0] == "d" {
+				return tag[1]
+			}
+		}
+		return ""
+	}
+
+	// find root scope in target's uppercase NIP-22 tags
+	var rootScopeName, rootScopeValue, rootScopeRelay, rootKind, rootPubkey string
+	for _, tag := range target.Tags {
+		if len(tag) >= 2 && (tag[0] == "E" || tag[0] == "A" || tag[0] == "I") {
+			rootScopeName = tag[0]
+			rootScopeValue = tag[1]
+			if len(tag) >= 3 {
+				rootScopeRelay = tag[2]
+			}
+			break
+		}
+	}
+
+	if rootScopeName != "" {
+		for _, tag := range target.Tags {
+			if len(tag) >= 2 && tag[0] == "K" {
+				rootKind = tag[1]
+				break
+			}
+		}
+		for _, tag := range target.Tags {
+			if len(tag) >= 2 && tag[0] == "P" {
+				rootPubkey = tag[1]
+				break
+			}
+		}
+	} else {
+		if target.Kind.IsAddressable() || target.Kind.IsReplaceable() {
+			rootScopeName = "A"
+			rootScopeValue = fmt.Sprintf("%d:%s:%s", target.Kind, target.PubKey.Hex(), dtag())
+		} else {
+			rootScopeName = "E"
+			rootScopeValue = target.ID.Hex()
+		}
+		rootScopeRelay = relayHint
+		rootKind = fmt.Sprint(target.Kind)
+		rootPubkey = target.PubKey.Hex()
+	}
+
+	// root scope tag
+	rootScopeTag := nostr.Tag{rootScopeName, rootScopeValue}
+	if rootScopeName == "E" && rootPubkey != "" {
+		// the pubkey goes in the 4th position, so the relay hint must be
+		// present (even if empty) to keep it there
+		rootScopeTag = append(rootScopeTag, rootScopeRelay, rootPubkey)
+	} else if rootScopeRelay != "" {
+		rootScopeTag = append(rootScopeTag, rootScopeRelay)
+	}
+	evt.Tags = append(evt.Tags, rootScopeTag)
+
+	if rootKind != "" {
+		evt.Tags = append(evt.Tags, nostr.Tag{"K", rootKind})
+	}
+	if rootPubkey != "" && rootScopeName != "I" {
+		evt.Tags = append(evt.Tags, nostr.Tag{"P", rootPubkey})
+	}
+
+	// parent tags (lowercase) - always reference the target event
+	if target.Kind.IsAddressable() || target.Kind.IsReplaceable() {
+		aValue := fmt.Sprintf("%d:%s:%s", target.Kind, target.PubKey.Hex(), dtag())
+		aTag := nostr.Tag{"a", aValue}
+		if relayHint != "" {
+			aTag = append(aTag, relayHint)
+		}
+		evt.Tags = append(evt.Tags, aTag)
+	}
+	eTag := nostr.Tag{"e", target.ID.Hex()}
+	if target.PubKey != (nostr.PubKey{}) {
+		// same here: keep the pubkey in the 4th position
+		eTag = append(eTag, relayHint, target.PubKey.Hex())
+	} else if relayHint != "" {
+		eTag = append(eTag, relayHint)
+	}
+	evt.Tags = append(evt.Tags, eTag)
+
+	evt.Tags = append(evt.Tags, nostr.Tag{"k", fmt.Sprint(target.Kind)})
+
+	pTag := nostr.Tag{"p", target.PubKey.Hex()}
+	if relayHint != "" {
+		pTag = append(pTag, relayHint)
+	}
+	evt.Tags = append(evt.Tags, pTag)
+}

relay.go

@@ -31,6 +31,7 @@ var relay = &cli.Command{
 			pretty, _ := json.MarshalIndent(info, "", "  ")
 			stdout(string(pretty))
 		}
+		exitIfLineProcessingError(ctx)
 		return nil
 	},
 }

req.go

@@ -46,6 +46,10 @@ example:
 			Name:  "jq",
 			Usage: "filter returned events with jq expression",
 		},
+		&cli.BoolFlag{
+			Name:  "jq-raw",
+			Usage: "print --jq string results without JSON quoting, like `jq -r`",
+		},
 		&cli.BoolFlag{
 			Name:  "no-verify",
 			Usage: "skip event signature verification from relays",
@@ -124,7 +128,7 @@ example:
 			return fmt.Errorf("relay URLs are incompatible with --bare or --spell")
 		}
 
-		jq, err := jqPrepare(c.String("jq"))
+		jq, err := jqPrepare(c.String("jq"), c.Bool("jq-raw"))
 		if err != nil {
 			return err
 		}
@@ -329,21 +333,15 @@ func performReq(
 						}
 
 						matchUrl := func(def nostr.DirectedFilter) bool { return def.Relay == url }
-						idx := slices.IndexFunc(defs, matchUrl)
-						if idx == -1 {
+						mu.Lock()
+						if slices.IndexFunc(defs, matchUrl) == -1 {
 							// new relay, add it
-							mu.Lock()
-							idx = slices.IndexFunc(defs, matchUrl)
-							if idx == -1 {
-								defs = append(defs, nostr.DirectedFilter{
-									Filter: filter,
-									Relay:  url,
-								})
-								mu.Unlock()
-								continue
-							}
-							mu.Unlock()
+							defs = append(defs, nostr.DirectedFilter{
+								Filter: filter,
+								Relay:  url,
+							})
 						}
+						mu.Unlock()
 					}
 
 					return nil
@@ -369,30 +367,20 @@ func performReq(
 						}
 
 						matchUrl := func(def nostr.DirectedFilter) bool { return def.Relay == url }
-						idx := slices.IndexFunc(defs, matchUrl)
-						if idx == -1 {
+						mu.Lock()
+						if idx := slices.IndexFunc(defs, matchUrl); idx == -1 {
 							// new relay, add it
-							mu.Lock()
-							// check again after locking to prevent races
-							idx = slices.IndexFunc(defs, matchUrl)
-							if idx == -1 {
-								// then add it
-								filter := filter.Clone()
-								filter.Authors = []nostr.PubKey{pubkey}
-								defs = append(defs, nostr.DirectedFilter{
-									Filter: filter,
-									Relay:  url,
-								})
-								mu.Unlock()
-								continue // done with this relay url
-							}
-
-							// otherwise we'll just use the idx
-							mu.Unlock()
+							filter := filter.Clone()
+							filter.Authors = []nostr.PubKey{pubkey}
+							defs = append(defs, nostr.DirectedFilter{
+								Filter: filter,
+								Relay:  url,
+							})
+						} else {
+							// existing relay, add this pubkey
+							defs[idx].Authors = append(defs[idx].Authors, pubkey)
 						}
-
-						// existing relay, add this pubkey
-						defs[idx].Authors = append(defs[idx].Authors, pubkey)
+						mu.Unlock()
 					}
 
 					return nil
@@ -437,7 +425,7 @@ readevents:
 				if !matches {
 					continue
 				}
-				out, _ = json.MarshalToString(v)
+				out = v
 			}
 			stdout(out)
 
@@ -641,7 +629,7 @@ func (p PrintingQuerierPublisher) Publish(ctx context.Context, evt nostr.Event)
 			if !matches {
 				return nil
 			}
-			out, _ = json.MarshalToString(v)
+			out = v
 		}
 		stdout(out)
 		return nil

serve.go

@@ -64,6 +64,14 @@ var serve = &cli.Command{
 			Name:  "blossom",
 			Usage: "enable blossom server",
 		},
+		&cli.BoolFlag{
+			Name:  "auth",
+			Usage: "require AUTH for all operations",
+		},
+		&cli.BoolFlag{
+			Name:  "eager-auth",
+			Usage: "send AUTH challenge immediately on connect",
+		},
 	},
 	Action: func(ctx context.Context, c *cli.Command) error {
 		db := &slicestore.SliceStore{}
@@ -116,12 +124,19 @@ var serve = &cli.Command{
 		totalConnections := atomic.Int32{}
 		rl.OnConnect = func(ctx context.Context) {
 			totalConnections.Add(1)
+			if c.Bool("eager-auth") {
+				khatru.RequestAuth(ctx)
+			}
 			go func() {
 				<-ctx.Done()
 				totalConnections.Add(-1)
 			}()
 		}
 
+		rl.OnAuth = func(ctx context.Context, pubkey nostr.PubKey) {
+			log("    got %s %s\n", color.GreenString("authenticated"), pubkey.Hex())
+		}
+
 		d := debounce.New(time.Second * 2)
 		var printStatus func()
 		printStatus = func() {
@@ -228,23 +243,47 @@ var serve = &cli.Command{
 
 		// relay logging
 		rl.OnRequest = func(ctx context.Context, filter nostr.Filter) (reject bool, msg string) {
+			if c.Bool("auth") {
+				if _, isAuthed := khatru.GetAuthed(ctx); !isAuthed {
+					return true, "auth-required: subscribe"
+				}
+			}
+
 			negentropy := ""
 			if khatru.IsNegentropySession(ctx) {
 				negentropy = color.HiBlueString("negentropy ")
 			}
 
-			log("    got %s%s %v\n", negentropy, color.HiYellowString("request"), colors.italic(filter))
+			authedString := ""
+			if pubkey, ok := khatru.GetAuthed(ctx); ok {
+				authedString = fmt.Sprintf(" from %s", color.GreenString(pubkey.Hex()))
+			}
+
+			log("    got %s%s %v%s\n",
+				negentropy, color.HiYellowString("request"), colors.italic(filter), authedString)
 			printStatus()
 			return false, ""
 		}
 
 		rl.OnCount = func(ctx context.Context, filter nostr.Filter) (reject bool, msg string) {
+			if c.Bool("auth") {
+				if _, isAuthed := khatru.GetAuthed(ctx); !isAuthed {
+					return true, "auth-required: count"
+				}
+			}
+
 			log("    got %s %v\n", color.HiCyanString("count request"), colors.italic(filter))
 			printStatus()
 			return false, ""
 		}
 
 		rl.OnEvent = func(ctx context.Context, event nostr.Event) (reject bool, msg string) {
+			if c.Bool("auth") {
+				if _, isAuthed := khatru.GetAuthed(ctx); !isAuthed {
+					return true, "auth-required: event"
+				}
+			}
+
 			log("    got %s %v\n", color.BlueString("event"), colors.italic(event))
 			printStatus()
 			return false, ""

sync.go

@@ -124,9 +124,27 @@ func getBoundKey(b negentropy.Bound) boundKey {
 type RelayThirdPartyRemote struct {
 	relay    *nostr.Relay
 	messages chan string
+	mu       sync.Mutex
 	err      error
 }
 
+// fail records the error and closes the messages channel so a Receive()
+// that is already blocked on it wakes up instead of hanging forever.
+func (rtpr *RelayThirdPartyRemote) fail(err error) {
+	rtpr.mu.Lock()
+	if rtpr.err == nil {
+		rtpr.err = err
+		close(rtpr.messages)
+	}
+	rtpr.mu.Unlock()
+}
+
+func (rtpr *RelayThirdPartyRemote) getErr() error {
+	rtpr.mu.Lock()
+	defer rtpr.mu.Unlock()
+	return rtpr.err
+}
+
 func NewRelayThirdPartyRemote(ctx context.Context, url string) (*RelayThirdPartyRemote, error) {
 	rtpr := &RelayThirdPartyRemote{
 		messages: make(chan string, 3),
@@ -141,13 +159,18 @@ func NewRelayThirdPartyRemote(ctx context.Context, url string) (*RelayThirdParty
 			}
 			switch env := envelope.(type) {
 			case *nip77.OpenEnvelope, *nip77.CloseEnvelope:
-				rtpr.err = fmt.Errorf("unexpected %s received from relay", env.Label())
+				rtpr.fail(fmt.Errorf("unexpected %s received from relay", env.Label()))
 				return
 			case *nip77.ErrorEnvelope:
-				rtpr.err = fmt.Errorf("relay returned a %s: %s", env.Label(), env.Reason)
+				rtpr.fail(fmt.Errorf("relay returned a %s: %s", env.Label(), env.Reason))
 				return
 			case *nip77.MessageEnvelope:
-				rtpr.messages <- env.Message
+				rtpr.mu.Lock()
+				failed := rtpr.err != nil
+				rtpr.mu.Unlock()
+				if !failed {
+					rtpr.messages <- env.Message
+				}
 			}
 		},
 	})
@@ -185,12 +208,13 @@ func (rtpr *RelayThirdPartyRemote) SendClose() error {
 var thirdPartyRemoteEndOfMessages = errors.New("the-end")
 
 func (rtpr *RelayThirdPartyRemote) Receive() (string, error) {
-	if rtpr.err != nil {
-		return "", rtpr.err
-	}
 	if msg, ok := <-rtpr.messages; ok {
 		return msg, nil
 	}
+	// channel closed by fail()
+	if err := rtpr.getErr(); err != nil {
+		return "", err
+	}
 	return "", thirdPartyRemoteEndOfMessages
 }
 
@@ -204,6 +228,9 @@ func NewThirdPartyNegentropy(peerA, peerB *RelayThirdPartyRemote, filter nostr.F
 }
 
 func (n *ThirdPartyNegentropy) Run(ctx context.Context) error {
+	// always close Deltas so the consumer goroutine doesn't hang when we return an error
+	defer close(n.Deltas)
+
 	peerAIds := make(map[nostr.ID]struct{})
 	peerBIds := make(map[nostr.ID]struct{})
 	peerASkippedBounds := make(map[boundKey]struct{})
@@ -341,7 +368,6 @@ func (n *ThirdPartyNegentropy) Run(ctx context.Context) error {
 
 	n.PeerA.SendClose()
 	n.PeerB.SendClose()
-	close(n.Deltas)
 
 	return nil
 }

validate.go

@@ -51,7 +51,8 @@ nak event -k 1 -p not_a_pubkey | nak validate
 		}
 
 		for stdinEvent := range getJsonsOrBlank() {
-			if stdinEvent == "" {
+			if stdinEvent == "{}" && !isPiped() {
+				// blank sentinel from getJsonsOrBlank(), use the arguments instead
 				for _, arg := range c.Args().Slice() {
 					if err := handleEvent(arg); err != nil {
 						ctx = lineProcessingError(ctx, "%s", err)

verify.go

@@ -19,7 +19,8 @@ it outputs nothing if the verification is successful.`,
 	Action: func(ctx context.Context, c *cli.Command) error {
 		for stdinEvent := range getJsonsOrBlank() {
 			evt := nostr.Event{}
-			if stdinEvent == "" {
+			if stdinEvent == "{}" && !isPiped() {
+				// blank sentinel from getJsonsOrBlank(), use the argument instead
 				stdinEvent = c.Args().First()
 				if stdinEvent == "" {
 					continue

wallet.go

@@ -499,8 +499,13 @@ var wallet = &cli.Command{
 							} else {
 								return fmt.Errorf("missing --private-key")
 							}
-						} else if sk := c.String("private-key"); sk != "" && !c.Bool("force") {
-							return fmt.Errorf("refusing to replace existing private key, use the --force flag")
+						} else if sk := c.String("private-key"); sk != "" {
+							if !c.Bool("force") {
+								return fmt.Errorf("refusing to replace existing private key, use the --force flag")
+							}
+							if err := w.SetPrivateKey(ctx, sk); err != nil {
+								return err
+							}
 						}
 
 						kr, _, _ := gatherKeyerFromArguments(ctx, c)
@@ -517,13 +522,18 @@ var wallet = &cli.Command{
 							info.ParseEvent(ie.Event)
 						}
 
-						if mints := c.StringSlice("mints"); len(mints) == 0 && len(info.Mints) == 0 {
+						if mints := c.StringSlice("mint"); len(mints) > 0 {
+							info.Mints = mints
+						} else if len(info.Mints) == 0 {
 							info.Mints = w.Mints
 						}
 						if len(info.Mints) == 0 {
 							return fmt.Errorf("missing --mint")
 						}
 
+						// the pubkey tag is mandatory, without it no one can send us nutzaps
+						info.PublicKey = nostr.PubKey(w.PublicKey.SerializeCompressed()[1:])
+
 						evt := nostr.Event{}
 						if err := info.ToEvent(ctx, kr, &evt); err != nil {
 							return err