diff --git a/package.json b/package.json index 30f5445..d4b5c0b 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "post_quantum_nostr", - "version": "0.0.29", + "version": "0.0.30", "description": "A migration strategy for bringing post-quantum security to Nostr without breaking the social graph, without requiring consensus on a single post-quantum algorithm, and without forcing existing users to abandon their identities.", "main": "index.js", "scripts": { diff --git a/www/js/index-app.mjs b/www/js/index-app.mjs index 578bf50..eb859d8 100644 --- a/www/js/index-app.mjs +++ b/www/js/index-app.mjs @@ -556,11 +556,25 @@ setStatus(pqSignStatus, 'info', ' Building kind 1 announcement event...'); const kind1Template = buildKind1Announcement(currentPubkey, blockHeight, pqKeys); + // Strip the non-NIP-01 helper field 'statementBytes' before sending to + // the signer. buildKind1Announcement includes it for internal use, but + // it is not a valid NIP-01 event field and validateSignerOutput (G56-05) + // rejects extra fields. The signer must only see the 6 NIP-01 template + // fields (pubkey, created_at, kind, tags, content — id/sig are added by + // the signer). + const kind1SignerTemplate = { + pubkey: kind1Template.pubkey, + created_at: kind1Template.created_at, + kind: kind1Template.kind, + tags: kind1Template.tags, + content: kind1Template.content + }; + setStatus(pqSignStatus, 'info', 'PQ signatures complete. Requesting secp256k1 signature for kind 1 announcement...'); - const kind1Signed = await window.nostr.signEvent(kind1Template); + const kind1Signed = await window.nostr.signEvent(kind1SignerTemplate); // G56-05: validate signer output — never reconstruct from mixed fields - kind1Event = validateSignerOutput(kind1Signed, kind1Template, currentPubkey); + kind1Event = validateSignerOutput(kind1Signed, kind1SignerTemplate, currentPubkey); otsLog(`Kind 1 announcement signed. Event ID: ${kind1Event.id.substring(0, 32)}...`); // ---- Phase 2: Timestamp the canonical kind 1 event digest (F-D1) ---- diff --git a/www/js/version.json b/www/js/version.json index 8ad00eb..5a30de6 100644 --- a/www/js/version.json +++ b/www/js/version.json @@ -1,5 +1,5 @@ { - "VERSION": "v0.0.29", - "VERSION_NUMBER": "0.0.29", - "BUILD_DATE": "2026-07-25T15:14:52.913Z" + "VERSION": "v0.0.30", + "VERSION_NUMBER": "0.0.30", + "BUILD_DATE": "2026-07-25T17:00:12.091Z" }