padreug commented on pull request aiolabs/lightning-pub#4

padreug
2026-04-01T17:12:18Z

feat(extensions): add NIP-05 identity extension
NIP-05 Spec Compliance Review

Compared the implementation against the NIP-05 spec and NIP-57 (zaps). The extension is ~90% complete. Here's what needs attention:

Must Fix

1. Username validation rejects hyphens (spec violation)
The regex /^[a-z][a-z0-9_]*$/ disallows hyphens. NIP-05 spec explicitly states:

"the <local-part> part MUST only use characters a-z0-9-_."

Fix: update to /^[a-z][a-z0-9_-]*$/ in nip05Manager.ts

2. HTTP type definitions missing from types.ts
HttpRoute, HttpRequest, HttpResponse are imported in index.ts but not defined in the extension system's types.ts. This blocks TypeScript compilation. The withdraw extension likely has these defined in its copy — need to consolidate into the shared types.ts from PR #3 (extension-loader).

3. getHttpRoutes() not in the Extension interface
Same issue — the method exists in the implementation but the interface in types.ts doesn't declare it. Needs adding as an optional method in PR #3.

Should Fix

4. No HTTP redirect prevention
NIP-05 spec: "The /.well-known/nostr.json endpoint MUST NOT return any HTTP redirects." This is likely handled at the reverse proxy level, but should be documented as a deployment requirement.

5. Verify zap configuration completeness
The /.well-known/lnurlp/:username endpoint calls ctx.getLnurlPayInfo() — need to verify the response includes allowsNostr: true and nostrPubkey fields per NIP-57. Without these, wallets won't send zap requests.

Nice-to-Have (Not Blocking)

No _@domain root identifier support (optional per spec, low priority)

No relay array size limit per user (could produce large responses)

No-name query returns up to 1000 identities (may want a tighter default)

No . (period) support in usernames (spec allows it but uncommon)

Looks Good

/.well-known/nostr.json response format correct

Relay hints in response (optional relays field)

CORS Access-Control-Allow-Origin: * header

Multi-tenancy via application scoping

One identity per user per application constraint

Reserved username blocking

RPC method surface is comprehensive (claim, release, lookup, admin controls)

Lightning Address integration via LUD-16