"Share on Nostr" published a kind-1 note whose body ended with a bare thumbnail
URL. Many clients only inline such a URL when a NIP-92 `imeta` entry describes
it, so the viewer often saw a plain link instead of a preview image.
- buildShareEvent now emits an `imeta` entry for the thumbnail. The media type
is inferred from the extension and OMITTED when unknown -- a wrong `m` is
worse than a missing one, since clients use it to decide whether to render
inline at all, so extensionless Blossom URLs ship url + alt only.
- inferImageMimeTypeFromUrl lives in a SEPARATE map from EXTENSION_MIME_MAP:
that map gates video upload/publish paths, and folding image types into it
would let an image pass a video check.
- shareNostrController was passing only { id, pubkey } to buildShareEvent, so
the tag could never be built; it now forwards title and thumbnail.
When a video has a NIP-71 mirror, the note instead quotes it with
`nostr:naddr1...`, which nostr clients render as a native video quote card --
the closest thing to a rich preview that does not depend on any client fetching
OpenGraph tags (most never do).
- The mirror is addressable (kind 34235/34236, author = video pubkey,
d = videoRootId), so js/nostr/mirrorPointer.js derives the coordinate with no
relay lookup, and the pointer survives the author editing the video where a
plain `nevent` would rot on the next replace.
- The pointer is only embedded after nip71MirrorService.findMirror() confirms
the mirror exists. A pointer to a missing event renders as a broken/empty
quote box, which is worse than the plain-link fallback, so a disabled
service, a throwing lookup, a 2.5s timeout or a missing videoRootId all fall
back to the thumbnail note.
- resolveMirrorKind prefers the kinds actually observed on relays and only then
falls back to the same portrait rule the mirror builder uses, so a derived
pointer matches what would be published rather than guessing independently.
- While quoting, the raw thumbnail URL is dropped from the body and the imeta
tag is skipped: the quote card already shows the thumbnail, and emitting both
rendered the same image twice. An `a` tag links the note to the coordinate.
Known limitation: a client rendering the quote card still has to play the
video, so mirrors whose imeta url is an .m3u8 hit the same HLS wall -- title and
thumbnail render, playback depends on the client.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
- deleteByUrl maps a Blossom URL back to its content-addressed blob (blobSha256FromUrl) and deletes it via BUD-12, defaulting to the URL's own origin. Wired into the edit-modal orphan cleanup so a superseded Blossom video/thumbnail is reclaimed (best-effort, never blocks the edit).
- BUD-03 kind-10063 server-list discovery: read (serversFromServerListEvent) + build (buildBlossomServerListEvent) + an extracted, testable import/publish helper (blossomServerList.js), plus 'Import from my server list' / 'Publish my server list' controls in the Storage pane's Blossom section.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Blossom servers reject a .torrent (415), so a Blossom video's magnet is webseed-only and can't bootstrap WebTorrent. This restores P2P without hosting a .torrent:
- Upload hardening: correct Content-Type (overrides empty/generic application/octet-stream), HTTP status surfaced in errors, and best-effort .torrent sidecar so a rejected sidecar no longer sinks the upload (URL-first fallback).
- Publish: when the .torrent can't be hosted, publish the piece-map as an infohash-keyed companion event (kind 30078, d=bitvid:torrent:<infohash>) and ship a ws= magnet. Gated by FEATURE_BLOSSOM_TORRENT_METADATA (default off = no trace); size-capped.
- Playback: torrentMetadataService lazily fetches the companion, VERIFIES the reconstructed infohash === the magnet's btih (untrusted content), sources the webseed from the video event, and hands the .torrent buffer to WebTorrent so it streams with zero peers. Relay reads go through the subscription manager.
Inherited by any upload-based media (shorts, audio-publish); excludes ingest/live. See docs/blossom-torrent-metadata-plan.md. Includes a Prettier reflow in css/tailwind.source.css.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
First slice of structured submissions (replacing the kind-4 encrypted DM forms).
Pure, hermetic core — no UI or network yet.
- nostrEventSchemas.js: SUBMISSION_KIND=30083 (+ NOTE_TYPES.SUBMISSION, BASE_SCHEMAS
entry) and buildSubmissionEvent(). PUBLIC + addressable; data in tags: d (id),
k (type), applicant (npub), p (admin), t=bitvid-submission; free-text in content.
- js/submissions/submissionService.js: SUBMISSION_TYPES + labels, parseSubmissionEvent,
buildSubmission, generateSubmissionId. Pure — unit-testable with no relays/signer.
- constants.js: FEATURE_SUBMISSIONS (default OFF until the admin UI + forms ship).
- tests/submission-service.test.mjs: 8 scenarios (build tags/type/default, d-tag
required, parse structure/reject/unknown-type→other, build→parse round-trip of
every type, id generation).
- check-file-size.mjs: bump nostrEventSchemas grandfather 3250→3541 (adding a new
event type to the schema registry is the prescribed pattern).
- docs/nostr-event-schemas.md: catalogue row.
Schema validation ✨, lint, build all pass; tests 8/8.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
First slice of creator playlists. Adds a bitvid-native addressable playlist
event and the pure, hermetic core that builds/parses/mutates it. No UI or network
yet — those land in follow-up commits.
- nostrEventSchemas.js: PLAYLIST_KIND=30082 (+ NOTE_TYPES.PLAYLIST, BASE_SCHEMAS
entry) and buildPlaylistEvent(). Data lives in tags: d (id), title/description/
image, and ordered `a` refs (30078:pubkey:d) to videos; order = tag order;
repeated refs deduped. Deliberately NOT NIP-51's 30005 "video curation set" —
bitvid already reads 30005 as legacy interest-sets, so reuse would collide.
- js/playlists/playlistService.js: parsePlaylistEvent, buildPlaylist, and
immutable add/remove/reorder item helpers + videoCoordinate() (reuses the
canonical buildVideoAddressPointer, same 30078 contract as the zap fix) +
generatePlaylistId(). Pure — fully unit-testable with no relays/signer.
- tests/playlist-service.test.mjs: 12 scenarios (build tags + order + dedup,
d-tag required, parse structure/rejects/defaults, build→parse round-trip,
add/remove/reorder immutability + clamping, coordinate derivation incl. the
kind-0 internal-object case).
- docs/nostr-event-schemas.md: catalogue row for the new kind.
Schema validation, lint, and build all pass; tests 12/12.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
First slice of docs/zap-tally-plan.md (decisions D1-D5 resolved in the doc):
- ZAP_TALLY_KIND = 30081 (addressable, d=payment_hash → one canonical event
per real payment) + NOTE_TYPES.ZAP_TALLY schema + buildZapTallyEvent
(nostrEventSchemas.js). Video + profile pointers.
- FEATURE_ZAP_TALLY flag (constants.js), default ON per D4.
- zapReceiptValidator.js: extractBolt11Fields (payment_hash + description_hash
from the existing bech32 walker), verifyPaymentPreimage
(sha256(preimage)==payment_hash), verifyBitvidZapTally — the security core:
proves the invoice was paid AND bound to this zap request (description-hash
binding blocks reusing a leaked preimage for another video). Amount is
bolt11-derived, never the tag; pointers come from the embedded zap request.
- Schema-doc row for kind 30081.
Tests: tests/zap-tally-verify.test.mjs (8) — preimage check, bech32 field
round-trip, valid/bad-preimage/replay/zero-sats decisions, builder tag shape
(video + profile). Lint + build green.
No publishing or counting wired yet — next slices per the plan checklist.
Co-Authored-By: Claude Fable 5 <[email protected]>
Admin moderation was author/community-level only. Admins (any editor — same gate as
the author blacklist) can now hide a SINGLE offending video.
- Record: a published kind-30000 NIP-51 list under d-tag bitvid:admin:event-blacklist,
carrying blocked event ids as `e` tags (NOTE_TYPES.ADMIN_EVENT_BLACKLIST schema).
Loaded/persisted through the existing admin-list machinery (adminListStore) and cached
like whitelist/blacklist.
- accessControl: eventBlacklist Set + getEventBlacklist/isEventBlacklisted/
addToEventBlacklist/removeFromEventBlacklist (editor-gated; normalizes hex or
nevent/note) + onEventBlacklistChange.
- Render filter already existed (app.blacklistedEventIds, honored by every feed/grid/
search/playback path) but was fed only by the static ADMIN_INITIAL_EVENT_BLACKLIST
config. app._rebuildBlacklistedEventIds() now merges that static base with the dynamic
admin list, and an onEventBlacklistChange listener rebuilds + refreshes grids on change.
- UI: a "Block this video" item in the per-video ⋯ menu (editor-only), handled by
handleBlacklistEventAction (js/ui/moreMenu/blacklistEventAction.js).
Helpers extracted to js/adminEventBlacklistHelpers.js to keep adminListStore /
accessControl / moreMenuController under their size caps. Tests:
tests/admin-event-blacklist.test.mjs (9). Build + lint clean; admin/access/moderation
suites 56/56.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
View counts inflated. viewCounter.js dedupes locally by (viewer, time-window)
correctly, but the published events couldn't be deduped by relays:
generateViewEventDedupeTag built the kind-30079 `d` tag with random entropy +
exact timestamp, so every view was a UNIQUE event. And exactCountForPointer runs
a NIP-45 COUNT (raw event count, no dedupe) and bumped the displayed total up to
it (max(deduped, raw)). Net: reloads / multi-device / re-watches each added a
view.
Make the `d` tag deterministic and window-bucketed (scope:viewer:bucket, no
entropy) so kind-30079 view events are genuinely parameterized-replaceable:
relays keep one event per (viewer, video, window), so the cheap NIP-45 COUNT
becomes accurate AND scalable and the raw count stops inflating. buildViewEvent
no longer invents a random `d` tag (the only production caller, publishViewEvent,
always supplies the deterministic one). Pre-existing entropy events age out over
the backfill horizon.
Tests: tests/view-event-dedupe.test.mjs.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
- Introduce `js/constants.js` with semantic time constants (e.g., `ONE_MINUTE_MS`, `STANDARD_TIMEOUT_MS`) and feature-specific TTLs.
- Export `KIND_MUTE_LIST` from `js/nostrEventSchemas.js` to standardize NIP-51 mute list kind usage.
- Refactor `js/state/cache.js`, `js/nostr/cachePolicies.js`, `js/channelProfile.js`, and various services to use centralized constants instead of hardcoded magic numbers.
- Update `js/nostr/relayConstants.js` to derive values from the shared time constants.
- Replace duplicate definitions of timeouts and retry delays across the codebase.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Created `scripts/agent/validate-events.mjs` to validate event builders against schemas, covering standard and specific usage patterns.
- Updated `js/nostrEventSchemas.js` to include NIP-17 event types (`GIFT_WRAP`, `SEAL`, `CHAT_MESSAGE`) and their builders.
- Refactored `js/nostr/client.js` to use NIP-17 builders in `sendDirectMessage`, enabling runtime schema validation.
- Updated `docs/nostr-event-schemas.md` to document the new event types.
Co-authored-by: PR0M3TH3AN <[email protected]>
Extracted parameter normalization, context resolution, and tag building into dedicated helper functions (`normalizeCommentInputs`, `resolveCommentContext`, `buildCommentTags`) to improve readability and maintainability of `buildCommentEvent`. This simplifies the main function logic and makes it easier to test individual components in the future if exported.
No functional changes intended. Verified with existing unit and integration tests.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Updates `js/userBlocks.js` to treat Kind 10000 (standard Mute List) as the primary write target.
- Public mutes are stored in `p` tags, and private blocks are stored in encrypted content within the same event.
- Legacy `d=user-blocks` lists are still read for backward compatibility (preferring the newest event), but no longer written.
- Updates `js/nostrEventSchemas.js` to mark `USER_BLOCK_LIST` as legacy and standardise `MUTE_LIST`.
- Updates UI controllers (`MoreMenuController`, `ProfileModalController`) to use "Mute/Block List" terminology and delegate all mute/block actions to `userBlocks`.
- Updates `ModerationService` to delegate viewer mute operations to `userBlocks` and disable direct Kind 10000 publishing to prevent overwrites.
- Documentation updated in `docs/nostr-event-schemas.md`.
- Fixes regressions in `more-menu-controller.test.mjs`, `moderation-service.test.mjs`, `trusted-mute-lists.test.mjs`, and `user-blocks.test.mjs`.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Expand fuzzing coverage for `js/nostrEventSchemas.js` to include all builder functions.
- Fix a crash in `buildAdminListEvent` where non-array `hexPubkeys` caused a TypeError.
- Update `scripts/agent/fuzz-dmDecryptor.mjs` and `scripts/agent/fuzz-magnetUtils.mjs` iterations.
- Add reproducer for the `buildAdminListEvent` crash.
- Generate fuzz reports in `artifacts/`.
Co-authored-by: PR0M3TH3AN <[email protected]>
Implemented fuzz testing harnesses and fixed a circular reference crash in nostrEventSchemas.js. Improved robustness of magnetUtils and dmDecryptor.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Created `scripts/agent/validate-events.mjs` to validate event builders against schemas.
- Refactored `buildVideoPostEvent` in `js/nostrEventSchemas.js` to automatically generate the required `s` (storage pointer) tag if missing, using `infoHash`, `url`, or `videoRootId`.
- Verified that `js/utils/storagePointer.js` exists and is imported correctly.
- Updated `docs/nostr-event-schemas.md` to reflect the auto-generation behavior.
- Verified fixes with `scripts/agent/validate-events.mjs` and existing unit tests.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Added `scripts/agent/validate-events.mjs` to validate event builders.
- Added `GENERIC_REPOST` (kind 16) to `js/nostrEventSchemas.js` and `docs/nostr-event-schemas.md`.
- Updated `buildRepostEvent` to validate against `GENERIC_REPOST` when producing kind 16 events.
- Created `scripts/agent/validate-events.mjs` to validate all event builders.
- Fixed `buildViewEvent` to generate a fallback `d` tag for kind 30079 compliance.
- Relaxed `REPOST` schema validation to allow empty content (blind reposts), per NIP-18.
- Updated `docs/nostr-event-schemas.md` to reflect schema changes.
- Added `scripts/agent/fuzz-schemas.mjs`, `fuzz-dm.mjs`, `fuzz-magnet.mjs` and `fuzz-setup.mjs`.
- Fixed crash in `js/nostrEventSchemas.js` (buildAdminListEvent log and getNostrEventSchema type check).
- Added crash reproducers in `examples/reproducers/`.
- Fuzzers output reports to `artifacts/`.
- Updated fuzzers to deduplicate crashes and safely stringify inputs.
- Added fuzzing scripts for nostrEventSchemas, dmDecryptor, and magnetUtils.
- Fixed crashes in nostrEventSchemas related to unsafe stringification of content.
- Fixed crash in magnetUtils when options argument is null.
- Added safeStringify helper in nostrEventSchemas.js.
- Included fuzzing reports and reproducers.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Created `scripts/agent/validate-events.mjs` to validate event builders against schemas.
- Instrumented all event builders in `js/nostrEventSchemas.js` to run validation in dev mode.
- Added `tests/event-schemas.test.mjs` to CI suite.
- Updated `docs/nostr-event-schemas.md` with validation instructions.
Fuzzer discovered a crash when `pointerTags` is passed as null.
Added array check to prevent TypeError.
Also added fuzz harnesses for schemas, dm decryptor and magnet utils.
- Format `css/tailwind.source.css` with Prettier.
- Add allowlist entry for `VideoCard.js` media query pixel value in `scripts/check-design-tokens.mjs`.
- Remove accidental artifact `js/ui/dm/jules_session_4520373547615093905.zip`.
- Fix bug in `js/app.js` and `js/services/moderationActionController.js` where blocked users' videos were not correctly hidden in the UI immediately after blocking.
- Fix bug in `tests/app/moderation-overrides.test.mjs` where `userBlocks` mocks were insufficient to reflect state changes.
- Created scripts/agent/validate-events.mjs to validate event builders against schemas.
- Added schemas and builders for Kind 5 (Deletion) and Kind 4 (Legacy DM) to js/nostrEventSchemas.js.
- Updated js/nostr/client.js to use new builders for Kind 5 and Kind 4 events.
- Updated js/nostr/client.js to use buildVideoPostEvent for video reverts.
- Verified all builders produce valid events.
- Created `scripts/agent/validate-events.mjs` to validate all event builders against schemas.
- Updated `docs/nostr-event-schemas.md` to match codebase (fixed `WATCH_HISTORY` key, removed unused `STORAGE_CHALLENGE`).
- Added `validateEventAgainstSchema` to `js/nostrEventSchemas.js` for runtime validation in dev mode.
- Instrumented `buildVideoPostEvent` to use runtime validation.
- Verified that all 22 builders produce conformant events.
- Added `scripts/agent/validate-events.mjs` to validate event builders against schemas.
- Fixed `NOTE_TYPES.REPOST` schema content format (json instead of empty).
- Added `NOTE_TYPES.MUTE_LIST` and `buildMuteListEvent`.
- Added `buildProfileMetadataEvent` to standardise Kind 0 creation.
- Updated `js/ui/profileModalController.js` to use `buildProfileMetadataEvent`.
- Updated `js/userBlocks.js` to use `buildMuteListEvent` for publishing mute list snapshots.
- Updated `docs/nostr-event-schemas.md` with new schemas and builders.
Removes unused JavaScript files, exports, and npm dependencies identified during a dead code sweep.
- Deleted `js/healthService.js` (unused).
- Deleted `js/nostr/signer-interface.js` (unused).
- Deleted `js/watchHistorySort.js` (unused).
- Deleted `js/services/signerKeyManager.js` and `tests/ui/signerKeyManager.test.mjs` (unused).
- Removed `buildStorageChallengeEvent` from `js/nostrEventSchemas.js`.
- Removed `path` and `webtorrent` from `package.json` dependencies (unused/vendored).
- Updated `tests/hashtag-preferences.test.mjs` to fix a mock-related failure exposed by environment checks.
Verified with `npm run test:unit`. `lint` and `format` checks run.
Note: `tests/moderation-service.test.mjs` failure deemed pre-existing.
See `artifacts/depcheck.json` (if retained) for dependency analysis.
- Add fuzz testing scripts for `nostrEventSchemas.js`, `dmDecryptor.js`, and `magnetUtils.js` in `scripts/agent/`.
- Fix `build...` functions in `nostrEventSchemas.js` to handle `null`/`undefined` inputs.
- Fix `buildVideoPostEvent` to gracefully handle circular references in content serialization.
- Fix `normalizeAndAugmentMagnet` in `magnetUtils.js` to handle non-iterable `extraTrackers`.
- Include minimal reproducers for discovered crashes in `examples/reproducers/`.
- Migrated Kind 0 profile metadata storage to unified `profileCache.js` with partitioning and persistence.
- Added `defaultDTag` for hashtag preferences in `cachePolicies.js` to ensure consistent key resolution.
- Updated `hashtagPreferencesService.js` to use `profileCache` and implemented legacy data migration.
- Added `handleEvent` to `NostrClient` to centrally ingest Kind 0 events into the cache.
- Updated `authService.js` and `cache.js` to delegate profile operations to the unified cache system.
- Added `PROFILE_METADATA` schema to `nostrEventSchemas.js`.
- Defines `STORAGE_CHALLENGE` event type (Kind 22242) in `js/nostrEventSchemas.js` and docs.
- Implements `js/services/signerKeyManager.js` to derive symmetric keys from signer signatures or passphrases.
- Validates inputs and returns safe `CryptoKey` objects (AES-GCM).
- Fix circular dependency in `js/adminListStore.js` by importing from `js/nostrClientRegistry.js`.
- Update `js/services/hashtagPreferencesService.js` to include legacy kind 30005 in filters.
- Fix JSDOM mocking in `tests/modal-accessibility.test.mjs` (navigator getter) and `UploadModal` selectors.
- Add `getRoot()` to `js/ui/components/UploadModal.js` for API consistency.
- Update `tests/magnet-utils.test.mjs` expectations to reflect removed default tracker.
- Mock `ensureActiveSignerForPubkey` in `tests/moderation/submit-report.test.mjs`.
- Fix mock loader path in `tests/moderation/trust-seeds.test.mjs` to target `trustBootstrap.js`.
- Fix duplicate pointer tags in `js/nostrEventSchemas.js`'s `buildCommentEvent`.
- Update `tests/nostr/comment-events.test.mjs` and `tests/comment-event-builder.test.mjs` to match current code behavior (legacy kinds, unique tags).
- Update `js/nostrEventSchemas.js` to remove encryption tagging and update schema for `WATCH_HISTORY`.
- Update `js/nostr/watchHistory.js` to:
- Bump storage version to 4.
- Bucket items by `YYYY-MM`.
- Publish plaintext JSON payloads with only event IDs and timestamps.
- Remove encryption logic from publishing.
- Update fetching to handle plaintext and fallback to legacy parsing.
- Update `js/watchHistoryService.js` to strip metadata from queued items and handle new snapshot response.
- Update `tests/watch-history.test.mjs` to reflect new plaintext behavior and disabled obsolete tests.
