Enhance Directory Client Library for NIP-XX Protocol

- Introduced a TypeScript client library for the Distributed Directory Consensus Protocol (NIP-XX), providing a high-level API for managing directory events, identity resolution, and trust calculations.
- Implemented core functionalities including event parsing, trust score aggregation, and replication filtering, mirroring the Go implementation.
- Added comprehensive documentation and development guides for ease of use and integration.
- Updated the `.gitignore` to include additional dependencies and build artifacts for the TypeScript client.
- Enhanced validation mechanisms for group tag names and trust levels, ensuring robust input handling and security.
- Created a new `bun.lock` file to manage package dependencies effectively.

docs/NIP-XX-distributed-directory-consensus.md

@@ -80,10 +80,12 @@ This NIP defines the following new event kinds:
 |------|-------------|
 | `39100` | Relay Identity Announcement |
 | `39101` | Trust Act |
-| `39102` | Group Tag Act |
+| `39102` | Group Tag Act (Registration) |
 | `39103` | Public Key Advertisement |
 | `39104` | Directory Event Replication Request |
 | `39105` | Directory Event Replication Response |
+| `39106` | Group Tag Transfer (Ownership Transfer) |
+| `39107` | Escrow Witness Completion Act |
 
 ### Relay Identity Announcement (Kind 39100)
 
@@ -95,11 +97,10 @@ Relay operators publish this event to announce their participation in the distri
   "content": "{\"name\":\"relay.example.com\",\"description\":\"Community relay\",\"contact\":\"admin@example.com\"}",
   "tags": [
     ["d", "relay-identity"],
-    ["relay", "wss://relay.example.com"],
+    ["relay", "wss://relay.example.com/"],
     ["signing_key", "<hex-encoded-public-key>"],
     ["encryption_key", "<hex-encoded-public-key>"],
-    ["version", "1"],
+    ["version", "1"]
-    ["nip11_url", "https://relay.example.com/.well-known/nostr.json"]
   ]
 }
 ```
@@ -110,16 +111,17 @@ Relay operators publish this event to announce their participation in the distri
 - `signing_key`: Public key for verifying acts from this relay (MAY be the same as identity key)
 - `encryption_key`: Public key for ECDH encryption
 - `version`: Protocol version number
-- `nip11_url`: URL to the relay's NIP-11 information document for identity verification
 
 **Identity Verification Process:**
 1. Other relays receive this announcement event
-2. They extract the `pubkey` field (relay identity key) and `nip11_url` 
+2. They extract the `pubkey` field (relay identity key) and `relay` URL
-3. They fetch the NIP-11 document from the specified URL
+3. They fetch the NIP-11 document by making an HTTP GET request to the relay URL with the `Accept: application/nostr+json` header
+   - For `wss://relay.example.com/` → HTTP GET `https://relay.example.com/` with header `Accept: application/nostr+json`
+   - For `ws://relay.example.com/` → HTTP GET `http://relay.example.com/` with header `Accept: application/nostr+json`
 4. They verify the NIP-11 signature using the extended verification process:
    - Extract `pubkey`, `nonce`, and `sig` from the NIP-11 document
    - Verify that the `pubkey` matches the announcement event's `pubkey`
-   - Extract the relay address from the `relay` tag or `nip11_url`
+   - Extract the relay address from the `relay` tag
    - Concatenate `pubkey + nonce + relay_address` and compute SHA256 hash
    - Verify the signature proves control of the private key AND address binding
 5. They verify that the announcement event is signed by the same key
@@ -135,7 +137,7 @@ Relay operators create trust acts toward other relays they wish to enter consens
   "content": "",
   "tags": [
     ["p", "<target-relay-pubkey>"],
-    ["trust_level", "high|medium|low"],
+    ["trust_level", "75"],
     ["relay", "<target-relay-url>"],
     ["expiry", "<unix-timestamp>"],
     ["reason", "manual|automatic|inherited"],
@@ -147,17 +149,115 @@ Relay operators create trust acts toward other relays they wish to enter consens
 
 **Tags:**
 - `p`: Public key of the target relay being attested
-- `trust_level`: Level of trust (high, medium, low)
+- `trust_level`: Replication percentage (0-100) indicating probability of replicating each event
 - `relay`: WebSocket URL of the target relay
 - `expiry`: Optional expiration timestamp for the act
 - `reason`: How this trust relationship was established
 - `K`: Comma-separated list of event kinds to replicate in near real-time (in addition to directory events)
 - `I`: Identity tag with npub, nonce, and proof-of-control signature (same format as Kind 39103)
 
-**Trust Levels:**
+**Trust Level (Partial Replication):**
-- `high`: Full replication of all directory events plus all kinds specified in `K` tag
+
-- `medium`: Selective replication of directory events plus kinds specified in `K` tag based on additional criteria
+The `trust_level` is a number from **0 to 100** representing the **percentage probability** that any given event will be replicated. This implements **partial replication** where events are randomly selected based on a dice-throw mechanism:
-- `low`: Minimal replication of directory events only, `K` tag kinds may be filtered
+
+- **100**: Full replication - ALL events replicated (100% probability)
+- **75**: High partial replication - 75% of events replicated on average
+- **50**: Medium partial replication - 50% of events replicated on average
+- **25**: Low partial replication - 25% of events replicated on average
+- **10**: Minimal partial replication - 10% of events replicated on average
+- **0**: No replication - effectively disables replication
+
+**Partial Replication Mechanism:**
+
+For each event received from a trusted relay:
+
+1. **Generate Random Number**: Create a cryptographically secure random number between 0-100
+2. **Compare to Threshold**: If random number ≤ trust_level, replicate the event
+3. **Otherwise Skip**: If random number > trust_level, discard without replication
+4. **Per-Event Decision**: Each event gets an independent random roll
+
+**Example:**
+```
+Trust Level: 50
+Event A arrives → Roll: 42 → 42 ≤ 50 → REPLICATE
+Event B arrives → Roll: 73 → 73 > 50 → SKIP
+Event C arrives → Roll: 18 → 18 ≤ 50 → REPLICATE
+Event D arrives → Roll: 91 → 91 > 50 → SKIP
+
+Result: ~50% of events replicated over time
+```
+
+**Partial Replication Benefits:**
+
+1. **Resource Management**: Reduce bandwidth, storage, and processing load proportionally
+2. **Probabilistic Coverage**: Events still propagate through the network via multiple paths
+3. **Network Resilience**: Different relays replicate different random subsets, providing redundancy
+4. **Tunable Trade-offs**: Operators can precisely balance resources vs. completeness
+5. **Graceful Degradation**: Network remains functional even with low trust levels across many peers
+
+**Network Propagation Example:**
+
+Consider a network where all relays use 50% trust level:
+```
+User publishes Event X
+  ↓
+Relay A receives → 50% chance → Replicates to Relays B, C, D
+  ↓
+Relay B (rolled yes) → 50% chance → Replicates to Relays E, F
+Relay C (rolled no) → Skips
+Relay D (rolled yes) → 50% chance → Replicates to Relays G, H
+
+Result: Event X reaches ~75-85% of network despite 50% replication rate
+        (due to multiple propagation paths)
+```
+
+**Trust Level Guidelines:**
+
+- **90-100**: Use for critical partners where near-complete coverage is essential
+  - Primary consortium members
+  - Paid backup services
+  - Legal/compliance requirements
+  
+- **60-89**: Use for important partners with good resources
+  - Secondary consortium members
+  - Established relay partnerships
+  - Balanced resource/coverage trade-off
+
+- **30-59**: Use for standard partnerships
+  - General peer relationships
+  - Resource-constrained but willing participants
+  - Acceptable coverage with good bandwidth savings
+
+- **10-29**: Use for exploratory or limited partnerships
+  - New/untrusted relays being evaluated
+  - Severely resource-constrained peers
+  - Experimental connectivity
+
+- **1-9**: Use for minimal sampling
+  - Network topology discovery
+  - Quality/spam assessment
+  - Proof-of-concept testing
+
+**Implementation Requirements:**
+
+Relays implementing partial replication MUST:
+
+1. **Use Cryptographic RNG**: Use cryptographically secure random number generation (e.g., `crypto/rand` in Go, `crypto.getRandomValues()` in JavaScript)
+2. **Per-Event Independence**: Each event must get an independent random roll
+3. **No Bias**: Random selection must be uniform and unbiased
+4. **Deterministic Recording**: Once decision is made, it must be consistent (no re-rolling)
+5. **Event Integrity**: Replicated events must be complete and unmodified
+
+**Optional Enhancements:**
+
+Relays MAY implement additional strategies:
+
+- **Priority Boosting**: Increase probability for directory events (Kinds 0, 3, 5, etc.)
+- **Kind-Specific Rates**: Apply different trust levels to different event kinds
+- **Time-Based Adjustment**: Vary trust level based on network load or time of day
+- **Reputation Weighting**: Boost probability for high-reputation users
+
+However, the base trust_level percentage MUST always be respected as the minimum probability.
 
 **Event Kind Replication:**
 - **Directory Events**: Always replicated regardless of `K` tag (kinds 0, 3, 5, 1984, 10002, 10000, 10050)
@@ -168,7 +268,29 @@ Relay operators create trust acts toward other relays they wish to enter consens
 
 ### Group Tag Act (Kind 39102)
 
-Relays can attest to arbitrary string values used as tags to create logical groups:
+Group Tag Acts establish ownership and control over arbitrary string tags, functioning as a first-come-first-served registration system akin to domain name registration. These tags form the foundation for permissioned structured groups that can span multiple relays while maintaining consistent state. They also constitute a name registration system akin to DNS, and could have IP adress routing information attached to it with events (best to be CRDT add/remove so it's idempotent).
+
+Since the uses of group identity names and webserver identity information (and it logically would include most of the same things you find in DNS records) tend to overlap, in that finding the group and going to their static content (such as structured long form documents and wikis) is the same place you want to go to read public messages and discover new friends. This allows progressive replication and redundancy for communities that enables the network to scale to larger userbases without a linear reduction in performance.
+
+**Registration Model:**
+- Group tags are **alienable** (transferable) and follow first-come-first-served registration
+- The first valid Group Tag Act for a given `group_id` establishes initial ownership
+- Ownership can be transferred through Group Tag Transfer events (Kind 39106) with optional escrow
+- Multiple signature schemes are supported for ownership control
+- Group tag names MUST use URL-safe character set (RFC 3986)
+
+**Group Tag Naming Rules:**
+
+Group tag identifiers MUST conform to URL path segment rules (RFC 3986):
+- **Allowed characters**: `a-z`, `A-Z`, `0-9`, `-`, `.`, `_`, `~`
+- **Forbidden characters**: `/`, `?`, `#`, `[`, `]`, `@`, `!`, `$`, `&`, `'`, `(`, `)`, `*`, `+`, `,`, `;`, `=`, `:`, spaces
+- **Length**: 1-255 characters
+- **Case sensitivity**: Group tags are case-sensitive
+- **Reserved prefixes**: Tags starting with `.` or `_` are reserved for system use
+
+**Examples:**
+- ✅ Valid: `bitcoin-discussion`, `nostr.community`, `tech_forum`, `cafe~network`
+- ❌ Invalid: `bitcoin/discussion`, `nostr community`, `tech#forum`, `café:network`
 
 ```json
 {
@@ -177,17 +299,369 @@ Relays can attest to arbitrary string values used as tags to create logical grou
   "tags": [
     ["d", "<group-identifier>"],
     ["group_tag", "<tag-name>", "<tag-value>"],
-    ["attestor", "<relay-pubkey>"],
+    ["actor", "<relay-pubkey>"],
-    ["confidence", "0-100"]
+    ["confidence", "0-100"],
+    ["owners", "<signature-scheme>", "<owner-pubkey-1>", "<owner-pubkey-2>", "..."],
+    ["created", "<unix-timestamp>"],
+    ["I", "<npub-identity>", "<hex-nonce>", "<hex-signature>"]
   ]
 }
 ```
 
 **Tags:**
-- `d`: Unique identifier for this group act
+- `d`: Unique identifier for this group (the registered tag name, must be URL-safe)
-- `group_tag`: The tag name and value being attested
+- `group_tag`: The tag name and value being registered
 - `actor`: Public key of the relay making the act
 - `confidence`: Confidence level (0-100) in this act
+- `owners`: Ownership control specification (see below)
+- `created`: Timestamp of group registration
+- `I`: Identity tag for proof-of-control (optional)
+
+**Ownership Schemes:**
+
+The `owners` tag specifies the signature requirements for group control:
+
+1. **Single Signature:**
+   ```
+   ["owners", "single", "<owner-pubkey>"]
+   ```
+   - Only one signature required for group operations
+   - Simplest ownership model
+
+2. **2-of-3 Multisig:**
+   ```
+   ["owners", "2-of-3", "<pubkey-1>", "<pubkey-2>", "<pubkey-3>"]
+   ```
+   - Requires 2 out of 3 owners to sign for group operations
+   - Provides redundancy and shared control
+
+3. **3-of-5 Multisig:**
+   ```
+   ["owners", "3-of-5", "<pubkey-1>", "<pubkey-2>", "<pubkey-3>", "<pubkey-4>", "<pubkey-5>"]
+   ```
+   - Requires 3 out of 5 owners to sign for group operations
+   - Maximum distributed control while maintaining operational flexibility
+
+**Use Cases:**
+
+Group Tag Acts enable various structured group scenarios:
+
+1. **Forum/Community Groups:**
+   - Register a group tag like "bitcoin-discussion"
+   - Anchor posts, moderation actions, and membership lists to this tag
+   - Users only need one working relay from the group's relay set to see current state
+
+2. **Permissioned Content Collections:**
+   - Create private or curated content spaces
+   - Owner(s) control membership and posting permissions
+   - Content can be distributed across multiple relays
+
+3. **Multi-Relay Coordination:**
+   - Group state spans multiple relays in the consortium
+   - Users see consistent group state regardless of which relay they connect to
+   - Ownership transfers maintain continuity across relay set
+
+4. **Administrative Hierarchies:**
+   - Multisig ownership enables distributed administration
+   - 2-of-3 or 3-of-5 schemes prevent single-point-of-failure
+   - Ownership can be transferred to new administrator sets
+
+5. **Domain Name Service Replacement:**
+   - Additional event kinds could be created that specify such things as a set of IP addresses that have servers that are replicas of the group or individual that owns and operates the relays.
+   - Additional types of services could be delivered, such as compositing compound multi-event document types into structured document formats for reading, so, subprotocols, like the differences between FTP and Gopher and HTTP, so the name service events can also include public metadata about the servers such as operating ports and the protocols available through them.
+
+**Registration Rules:**
+
+- **First Registration Wins:** The first valid Group Tag Act for a given `d` (group identifier) establishes ownership
+- **Timestamp Precedence:** If multiple registration attempts occur simultaneously, earliest `created_at` wins
+- **Conflict Resolution:** Relays MUST reject later registration attempts for the same group identifier
+- **Transfer Authority:** Only current owners (with valid signatures) can transfer ownership
+
+### Group Tag Transfer (Kind 39106)
+
+Group Tag Transfer events enable ownership transfer of registered group tags, functioning as a "deed of sale" mechanism. Transfers can be executed immediately or through a witness-based escrow process.
+
+**Direct Transfer (No Escrow):**
+
+```json
+{
+  "kind": 39106,
+  "content": "<transfer-reason-or-terms>",
+  "tags": [
+    ["d", "<group-identifier>"],
+    ["from_owners", "<signature-scheme>", "<old-owner-pubkey-1>", "..."],
+    ["to_owners", "<signature-scheme>", "<new-owner-pubkey-1>", "..."],
+    ["transfer_date", "<unix-timestamp>"],
+    ["signatures", "<sig-1>", "<sig-2>", "..."],
+    ["I", "<npub-identity>", "<hex-nonce>", "<hex-signature>"]
+  ]
+}
+```
+
+**Escrow Transfer (With Witnesses):**
+
+```json
+{
+  "kind": 39106,
+  "content": "<transfer-terms-and-conditions>",
+  "tags": [
+    ["d", "<group-identifier>"],
+    ["from_owners", "<signature-scheme>", "<old-owner-pubkey-1>", "..."],
+    ["to_owners", "<signature-scheme>", "<new-owner-pubkey-1>", "..."],
+    ["transfer_date", "<unix-timestamp>"],
+    ["escrow_id", "<unique-escrow-identifier>"],
+    ["seller_witness", "<witness-pubkey>"],
+    ["buyer_witness", "<witness-pubkey>"],
+    ["conditions", "<condition-hash>"],
+    ["signatures", "<sig-1>", "<sig-2>", "..."],
+    ["I", "<npub-identity>", "<hex-nonce>", "<hex-signature>"]
+  ]
+}
+```
+
+**Tags:**
+- `d`: The group identifier being transferred (must match existing Group Tag Act)
+- `from_owners`: Current ownership specification (must match existing Group Tag Act)
+- `to_owners`: New ownership specification after transfer
+- `transfer_date`: When the transfer takes effect
+- `escrow_id`: Unique identifier for this escrow transaction (required for escrow)
+- `seller_witness`: Pubkey of witness designated by seller (required for escrow)
+- `buyer_witness`: Pubkey of witness designated by buyer (required for escrow)
+- `conditions`: SHA256 hash of transfer conditions document (required for escrow)
+- `signatures`: Schnorr signatures from current owners (must meet threshold)
+- `I`: Identity tag for proof-of-control (optional)
+
+**Transfer Validation:**
+
+Relays MUST validate transfers according to these rules:
+
+1. **Group Existence:** A Group Tag Act (Kind 39102) must exist for the specified `d` identifier
+2. **Owner Match:** The `from_owners` tag must exactly match the current `owners` tag in the Group Tag Act
+3. **Signature Threshold:** 
+   - Single: 1 signature from the owner
+   - 2-of-3: 2 signatures from any of the 3 owners
+   - 3-of-5: 3 signatures from any of the 5 owners
+4. **Signature Verification:** All provided signatures must be valid Schnorr signatures
+5. **Chronological Order:** `transfer_date` must be after the group's `created` timestamp
+6. **Escrow Validation (if applicable):**
+   - Both `seller_witness` and `buyer_witness` must be specified
+   - `escrow_id` must be unique and not previously used
+   - `conditions` hash must be present
+   - Transfer is PENDING until both witnesses sign completion acts
+
+**Signature Generation:**
+
+For each owner signing the transfer:
+
+1. Concatenate: `group_id + from_owners_json + to_owners_json + transfer_date`
+2. Compute SHA256 hash of the concatenated string
+3. Sign the hash using the owner's private key
+4. Add signature to the `signatures` tag
+
+**Transfer Effect (Direct Transfer):**
+
+Once a valid non-escrow transfer is accepted:
+
+1. The Group Tag Act (Kind 39102) is considered superseded
+2. A new implicit Group Tag Act with updated `owners` is recognized
+3. All future group operations must use the new ownership specification
+4. Old owners lose control; new owners gain full control immediately
+
+**Transfer Effect (Escrow Transfer):**
+
+When an escrow transfer is initiated:
+
+1. Transfer enters PENDING state
+2. Old owners retain control until escrow completes
+3. Witnesses must sign Escrow Witness Completion Acts (Kind 39107)
+4. When BOTH witnesses sign, transfer completes automatically
+5. New owners gain control; old owners lose control
+
+### Escrow Witness Completion Act (Kind 39107)
+
+Escrow witnesses publish completion acts to authorize the finalization of an escrow transfer.
+
+```json
+{
+  "kind": 39107,
+  "content": "<witness-statement-or-report>",
+  "tags": [
+    ["escrow_id", "<escrow-identifier>"],
+    ["group_id", "<group-identifier>"],
+    ["witness_role", "seller_witness|buyer_witness"],
+    ["completion_status", "approved|rejected"],
+    ["reason", "<optional-reason-for-rejection>"],
+    ["verification_hash", "<hash-of-verified-conditions>"],
+    ["timestamp", "<unix-timestamp>"]
+  ]
+}
+```
+
+**Tags:**
+- `escrow_id`: The escrow transaction identifier (from Kind 39106)
+- `group_id`: The group identifier being transferred
+- `witness_role`: Role of this witness (`seller_witness` or `buyer_witness`)
+- `completion_status`: Whether witness approves (`approved`) or rejects (`rejected`)
+- `reason`: Optional explanation (required if rejected)
+- `verification_hash`: SHA256 hash of conditions document witness verified
+- `timestamp`: When witness completed verification
+
+**Escrow Protocol Flow:**
+
+1. **Initiation:**
+   - Seller creates Group Tag Transfer (Kind 39106) with escrow tags
+   - Both parties agree on witnesses and conditions
+   - Transfer enters PENDING state
+
+2. **Witness Designation:**
+   - Seller designates `seller_witness` (their chosen neutral party)
+   - Buyer designates `buyer_witness` (their chosen neutral party)
+   - Witnesses should be trusted relays or recognized arbiters
+
+3. **Condition Verification:**
+   - Witnesses independently verify transfer conditions are met
+   - Conditions document (hashed in `conditions` tag) specifies requirements
+   - Examples: payment received, ownership verified, legal requirements met
+
+4. **Witness Completion:**
+   - Each witness publishes Escrow Witness Completion Act (Kind 39107)
+   - Both witnesses must approve (`completion_status: approved`)
+   - If either witness rejects, transfer is cancelled
+
+5. **Transfer Finalization:**
+   - When BOTH witnesses sign with `approved` status
+   - Relays automatically recognize new owners
+   - HD keychains of new owners can modify group-tagged records
+   - Old owners immediately lose modification rights
+
+6. **Rejection Handling:**
+   - If ANY witness rejects (` completion_status: rejected`)
+   - Transfer is cancelled permanently
+   - Group remains with original owners
+   - New transfer must be initiated if parties wish to retry
+
+**Escrow Validation Rules:**
+
+Relays MUST validate escrow completion according to these rules:
+
+1. **Witness Verification:**
+   - Witness pubkey must match the designated witness in Kind 39106
+   - Witness signature must be valid
+   - Witness event timestamp must be after transfer initiation
+
+2. **Escrow ID Matching:**
+   - `escrow_id` in Kind 39107 must match Kind 39106
+   - `group_id` must match the transfer
+
+3. **Completion Requirements:**
+   - BOTH seller_witness AND buyer_witness must publish Kind 39107
+   - BOTH must have `completion_status: approved`
+   - If ANY witness rejects, transfer fails
+
+4. **Condition Hash Verification:**
+   - `verification_hash` should match `conditions` hash from Kind 39106
+   - Witnesses SHOULD verify conditions document before signing
+
+5. **Temporal Ordering:**
+   - Witness completion acts must come after transfer event
+   - Both completions must occur within reasonable timeframe (suggested: 30 days)
+
+**Witness Selection Guidelines:**
+
+Good witness candidates:
+- Established relays in the consortium with high trust scores
+- Professional escrow services recognized in the community
+- Legal entities or notaries (for high-value transfers)
+- Community-elected arbiters with reputation systems
+
+Poor witness candidates:
+- Parties involved in the transfer (conflict of interest)
+- Recently created identities with no history
+- Witnesses with financial stake in the outcome
+
+**Example Transfer Flow:**
+
+**Direct Transfer (No Escrow):**
+```
+Initial Registration (Kind 39102):
+  ["owners", "single", "alice-pubkey"]
+
+Direct Transfer (Kind 39106):
+  ["from_owners", "single", "alice-pubkey"]
+  ["to_owners", "2-of-3", "bob-pubkey", "carol-pubkey", "dave-pubkey"]
+  ["signatures", "alice-signature"]
+  # No escrow tags
+
+Result (Immediate):
+  Group now controlled by 2-of-3 multisig (Bob, Carol, Dave)
+```
+
+**Escrow Transfer:**
+```
+Initial Registration (Kind 39102):
+  ["owners", "single", "alice-pubkey"]
+  Group: "bitcoin-marketplace"
+
+Escrow Transfer Initiated (Kind 39106):
+  ["from_owners", "single", "alice-pubkey"]
+  ["to_owners", "single", "bob-pubkey"]
+  ["escrow_id", "escrow-2024-001"]
+  ["seller_witness", "relay-witness-1-pubkey"]
+  ["buyer_witness", "relay-witness-2-pubkey"]
+  ["conditions", "sha256-of-payment-terms"]
+  ["signatures", "alice-signature"]
+  
+Status: PENDING (Alice retains control)
+
+Seller's Witness Approves (Kind 39107):
+  ["escrow_id", "escrow-2024-001"]
+  ["witness_role", "seller_witness"]
+  ["completion_status", "approved"]
+  Signed by: relay-witness-1
+
+Status: PENDING (Waiting for buyer's witness)
+
+Buyer's Witness Approves (Kind 39107):
+  ["escrow_id", "escrow-2024-001"]
+  ["witness_role", "buyer_witness"]
+  ["completion_status", "approved"]
+  Signed by: relay-witness-2
+
+Result (Automatic upon both witnesses):
+  Group "bitcoin-marketplace" now controlled by Bob
+  Bob's HD keychain can modify all records tagged with this group
+  Alice's HD keychain loses modification rights
+```
+
+**Domain Name System Analogy:**
+
+Group Tag Acts function like DNS registrations:
+
+- **First-Come-First-Served:** Just as domain names are registered on a first-come basis
+- **Alienable:** Can be sold, transferred, or reassigned like domain ownership
+- **Globally Unique:** Each group identifier is unique within the consortium
+- **Decentralized Registry:** Distributed across consortium relays instead of central authority
+- **Transfer Mechanism:** Group Tag Transfer events are like domain transfer EPP codes
+- **Multi-Relay Consistency:** Like DNS propagation, but consensus-based
+
+**Group State Coordination:**
+
+Groups span multiple relays while maintaining consistency:
+
+1. **Relay Set:** A group may be active on relays A, B, C, D
+2. **User Connection:** User connects to relay B
+3. **State Visibility:** User sees complete group state from all relays via replication
+4. **Partial Connectivity:** Even if relays C and D are down, user sees state via A and B
+5. **Ownership Operations:** Transfer events replicate across all relays in the set
+6. **Consensus:** Relays validate ownership changes independently using same rules
+
+**Benefits:**
+
+- **Resilience:** Groups survive individual relay failures
+- **Portability:** Users can switch between relays in the group's relay set
+- **Consistency:** Ownership and membership state synchronized across relays
+- **Flexibility:** Ownership can evolve from single to multisig to new parties
+- **Transparency:** All transfers are publicly auditable on the relays
 
 ### Hierarchical Deterministic Key Derivation
 

pkg/protocol/directory-client/DEVELOPMENT.md

@@ -0,0 +1,55 @@
+# Directory Client Library
+
+TypeScript client library for the Nostr Distributed Directory Consensus Protocol (NIP-XX).
+
+## Project Structure
+
+```
+src/
+├── index.ts              # Main entry point
+├── types.ts              # Type definitions
+├── validation.ts         # Validation functions
+├── parsers.ts            # Event parsers for all kinds
+├── identity-resolver.ts  # Identity & delegation management
+└── helpers.ts            # Utility functions
+```
+
+## Installation
+
+```bash
+cd pkg/protocol/directory-client
+npm install
+```
+
+## Building
+
+```bash
+npm run build
+```
+
+## Development
+
+```bash
+npm run dev  # Watch mode
+```
+
+## Testing
+
+```bash
+npm test
+```
+
+## Features Implemented
+
+- ✅ Type definitions for all directory event kinds (39100-39105)
+- ✅ Event parsers with validation
+- ✅ Identity tag handling and resolution
+- ✅ Key delegation management
+- ✅ Trust calculation utilities
+- ✅ Replication filtering
+- ✅ Comprehensive validation matching Go implementation
+
+## Usage Example
+
+See the main [README.md](./README.md) for detailed usage examples.
+

pkg/protocol/directory-client/IMPLEMENTATION_SUMMARY.md

@@ -0,0 +1,173 @@
+# Directory Client Libraries - Implementation Summary
+
+## Overview
+
+Successfully created both TypeScript and Go client libraries for the Distributed Directory Consensus Protocol (NIP-XX), mirroring functionality while following language-specific idioms.
+
+## TypeScript Client (`pkg/protocol/directory-client/`)
+
+### Files Created
+- `package.json` - Dependencies and build configuration
+- `tsconfig.json` - TypeScript compiler configuration
+- `README.md` - Comprehensive documentation with examples
+- `DEVELOPMENT.md` - Development guide
+- `src/types.ts` - Type definitions (304 lines)
+- `src/validation.ts` - Validation functions (265 lines)
+- `src/parsers.ts` - Event parsers for all kinds (408 lines)
+- `src/identity-resolver.ts` - Identity & delegation management (288 lines)
+- `src/helpers.ts` - Utility functions (199 lines)
+- `src/index.ts` - Main entry point
+
+### Key Features
+- Built on AppleSauce library for Nostr event handling
+- Full TypeScript type safety
+- RxJS-based observables for event streams
+- Real-time identity resolution with live delegate updates
+- Trust score calculation
+- Replication filtering
+
+### Dependencies
+- `applesauce-core`: ^3.0.0
+- `rxjs`: ^7.8.1
+
+## Go Client (`pkg/protocol/directory-client/`)
+
+### Files Created
+- `doc.go` - Comprehensive package documentation
+- `README.md` - Full API reference and usage examples
+- `client.go` - Core client functions
+- `identity_resolver.go` - Identity resolution (258 lines)
+- `trust.go` - Trust calculation & replication filtering (243 lines)
+- `helpers.go` - Event collection & trust graph (224 lines)
+
+### Key Features
+- Thread-safe with `sync.RWMutex` protection
+- Idiomatic Go API design
+- No external dependencies (uses standard library + internal packages)
+- Memory-efficient caching
+- Trust graph construction
+
+### API Surface
+
+**IdentityResolver:**
+- `NewIdentityResolver() *IdentityResolver`
+- `ProcessEvent(ev *event.E)`
+- `ResolveIdentity(pubkey string) string`
+- `IsDelegateKey(pubkey string) bool`
+- `GetDelegatesForIdentity(identity string) []string`
+- `GetIdentityTag(delegate string) (*IdentityTag, error)`
+- `FilterEventsByIdentity(events, identity) []*event.E`
+
+**TrustCalculator:**
+- `NewTrustCalculator() *TrustCalculator`
+- `AddAct(act *TrustAct)`
+- `CalculateTrust(pubkey string) float64`
+- `GetActiveTrustActs(pubkey string) []*TrustAct`
+
+**ReplicationFilter:**
+- `NewReplicationFilter(minTrustScore float64) *ReplicationFilter`
+- `AddTrustAct(act *TrustAct)`
+- `ShouldReplicate(pubkey string) bool`
+- `GetTrustedRelays() []string`
+- `FilterEvents(events []*event.E) []*event.E`
+
+**EventCollector:**
+- `NewEventCollector(events []*event.E) *EventCollector`
+- `RelayIdentities() []*RelayIdentityAnnouncement`
+- `TrustActs() []*TrustAct`
+- `GroupTagActs() []*GroupTagAct`
+- `PublicKeyAdvertisements() []*PublicKeyAdvertisement`
+
+**TrustGraph:**
+- `NewTrustGraph() *TrustGraph`
+- `BuildTrustGraph(events []*event.E) *TrustGraph`
+- `GetTrustedBy(target string) []string`
+- `GetTrustTargets(source string) []string`
+
+## Implementation Notes
+
+### TypeScript-Specific Features
+- Observable-based event streams with RxJS
+- Promise-based async operations
+- Optional chaining and nullish coalescing
+- Class-based architecture
+
+### Go-Specific Features
+- Goroutine-safe with mutexes
+- Struct-based API (not classes)
+- Multiple return values for error handling
+- Zero-dependency beyond internal packages
+- Memory-efficient with manual caching control
+
+### Differences from Protocol Package
+
+The client libraries provide **high-level conveniences** over the base protocol package:
+
+**Protocol Package (`pkg/protocol/directory/`):**
+- Low-level event parsing
+- Event construction
+- Message validation
+- Tag handling
+
+**Client Libraries:**
+- Identity relationship tracking
+- Trust score aggregation
+- Event filtering & collection
+- Replication decision-making
+- Trust graph analysis
+
+### Trust Score Calculation
+
+Both implementations use identical weighted averaging:
+- High trust: 100 points
+- Medium trust: 50 points
+- Low trust: 25 points
+
+Expired acts are excluded from calculation.
+
+### Known Limitations
+
+1. **IdentityTag Structure**: The Go implementation currently uses `NPubIdentity` field and maps it as both identity and delegate, as the actual I tag structure in the protocol needs clarification.
+
+2. **GroupTagAct Fields**: The Go struct has `GroupID`, `TagName`, `TagValue`, `Actor` fields which differ from the TypeScript expectation of `targetPubkey` and `groupTag`. Helper functions adapted accordingly.
+
+3. **TypeScript Signature Verification**: Not yet implemented - requires schnorr library integration.
+
+4. **Event Store Integration**: TypeScript uses AppleSauce's EventStore; Go version designed for custom integration.
+
+## Testing Status
+
+- **TypeScript**: Package structure complete, ready for `npm install && npm build`
+- **Go**: Successfully compiles with `go build .`, zero errors, one minor efficiency warning
+
+## Next Steps
+
+1. Implement unit tests for both libraries
+2. Add integration tests with actual event data
+3. Implement schnorr signature verification in TypeScript
+4. Clarify and align IdentityTag structure across implementations
+5. Add benchmark tests for performance-critical operations
+6. Create example applications demonstrating usage
+
+## File Counts
+
+- TypeScript: 10 files (6 source, 4 config/docs)
+- Go: 5 files (4 source, 1 doc)
+- Total: 15 new files
+
+## Lines of Code
+
+- TypeScript: ~1,800 lines
+- Go: ~725 lines
+- Total: ~2,525 lines
+
+## Documentation
+
+Both libraries include:
+- Comprehensive README with usage examples
+- Inline code documentation
+- Package-level documentation
+- API reference
+
+The implementations successfully mirror each other while respecting language idioms and ecosystem conventions.
+

pkg/protocol/directory-client/README.md

@@ -0,0 +1,248 @@
+# Directory Client Library
+
+High-level Go client library for the Distributed Directory Consensus Protocol (NIP-XX).
+
+## Overview
+
+This package provides a convenient API for working with directory events, managing identity resolution, tracking key delegations, and computing trust scores. It builds on the lower-level `directory` protocol package.
+
+## Features
+
+- **Identity Resolution**: Track and resolve delegate keys to their primary identities
+- **Trust Management**: Calculate aggregate trust scores from multiple trust acts
+- **Replication Filtering**: Determine which relays to trust for event replication
+- **Event Collection**: Convenient utilities for extracting specific event types
+- **Trust Graph**: Build and analyze trust relationship networks
+- **Thread-Safe**: All components support concurrent access
+
+## Installation
+
+```go
+import "next.orly.dev/pkg/protocol/directory-client"
+```
+
+## Quick Start
+
+### Identity Resolution
+
+```go
+// Create an identity resolver
+resolver := directory_client.NewIdentityResolver()
+
+// Process events to build identity mappings
+for _, event := range events {
+    resolver.ProcessEvent(event)
+}
+
+// Resolve identity behind a delegate key
+actualIdentity := resolver.ResolveIdentity(delegateKey)
+
+// Check if a key is a delegate
+if resolver.IsDelegateKey(pubkey) {
+    tag, _ := resolver.GetIdentityTag(pubkey)
+    fmt.Printf("Delegate belongs to: %s\n", tag.Identity)
+}
+
+// Get all delegates for an identity
+delegates := resolver.GetDelegatesForIdentity(identityPubkey)
+
+// Filter events by identity (including delegates)
+filteredEvents := resolver.FilterEventsByIdentity(events, identityPubkey)
+```
+
+### Trust Management
+
+```go
+// Create a trust calculator
+calculator := directory_client.NewTrustCalculator()
+
+// Add trust acts
+for _, event := range trustEvents {
+    if act, err := directory.ParseTrustAct(event); err == nil {
+        calculator.AddAct(act)
+    }
+}
+
+// Calculate aggregate trust score (0-100)
+score := calculator.CalculateTrust(targetPubkey)
+
+// Get active (non-expired) trust acts
+activeActs := calculator.GetActiveTrustActs(targetPubkey)
+```
+
+### Replication Filtering
+
+```go
+// Create filter with minimum trust score threshold
+filter := directory_client.NewReplicationFilter(50)
+
+// Add trust acts
+for _, act := range trustActs {
+    filter.AddTrustAct(act)
+}
+
+// Check if should replicate from a relay
+if filter.ShouldReplicate(relayPubkey) {
+    // Proceed with replication
+}
+
+// Get all trusted relays
+trustedRelays := filter.GetTrustedRelays()
+
+// Filter events to only trusted sources
+trustedEvents := filter.FilterEvents(events)
+```
+
+### Event Collection
+
+```go
+// Create event collector
+collector := directory_client.NewEventCollector(events)
+
+// Extract specific event types
+identities := collector.RelayIdentities()
+trustActs := collector.TrustActs()
+groupTagActs := collector.GroupTagActs()
+keyAds := collector.PublicKeyAdvertisements()
+requests := collector.ReplicationRequests()
+responses := collector.ReplicationResponses()
+
+// Find specific events
+identity, found := directory_client.FindRelayIdentity(events, "wss://relay.example.com/")
+trustActs := directory_client.FindTrustActsForRelay(events, targetPubkey)
+groupActs := directory_client.FindGroupTagActsByGroup(events, "premium")
+```
+
+### Trust Graph Analysis
+
+```go
+// Build trust graph from events
+graph := directory_client.BuildTrustGraph(events)
+
+// Find who trusts a relay
+trustedBy := graph.GetTrustedBy(targetPubkey)
+fmt.Printf("Trusted by %d relays\n", len(trustedBy))
+
+// Find who a relay trusts
+targets := graph.GetTrustTargets(sourcePubkey)
+fmt.Printf("Trusts %d relays\n", len(targets))
+
+// Get all trust acts from a source
+acts := graph.GetTrustActs(sourcePubkey)
+```
+
+## API Reference
+
+### IdentityResolver
+
+Manages identity resolution and key delegation tracking.
+
+**Methods:**
+- `NewIdentityResolver() *IdentityResolver` - Create new instance
+- `ProcessEvent(ev *event.E)` - Process event to extract identity info
+- `ResolveIdentity(pubkey string) string` - Resolve delegate to identity
+- `ResolveEventIdentity(ev *event.E) string` - Resolve event's identity
+- `IsDelegateKey(pubkey string) bool` - Check if key is a delegate
+- `IsIdentityKey(pubkey string) bool` - Check if key has delegates
+- `GetDelegatesForIdentity(identity string) []string` - Get all delegates
+- `GetIdentityTag(delegate string) (*IdentityTag, error)` - Get identity tag
+- `GetPublicKeyAdvertisements(identity string) []*PublicKeyAdvertisement` - Get key ads
+- `FilterEventsByIdentity(events []*event.E, identity string) []*event.E` - Filter events
+- `ClearCache()` - Clear all cached mappings
+- `GetStats() Stats` - Get statistics
+
+### TrustCalculator
+
+Computes aggregate trust scores from multiple trust acts.
+
+**Methods:**
+- `NewTrustCalculator() *TrustCalculator` - Create new instance
+- `AddAct(act *TrustAct)` - Add a trust act
+- `CalculateTrust(pubkey string) float64` - Calculate trust score (0-100)
+- `GetActs(pubkey string) []*TrustAct` - Get all acts for pubkey
+- `GetActiveTrustActs(pubkey string) []*TrustAct` - Get non-expired acts
+- `Clear()` - Remove all acts
+- `GetAllPubkeys() []string` - Get all tracked pubkeys
+
+**Trust Score Weights:**
+- High: 100
+- Medium: 50
+- Low: 25
+
+### ReplicationFilter
+
+Manages replication decisions based on trust scores.
+
+**Methods:**
+- `NewReplicationFilter(minTrustScore float64) *ReplicationFilter` - Create new instance
+- `AddTrustAct(act *TrustAct)` - Add trust act and update trusted relays
+- `ShouldReplicate(pubkey string) bool` - Check if relay is trusted
+- `GetTrustedRelays() []string` - Get all trusted relay pubkeys
+- `GetTrustScore(pubkey string) float64` - Get trust score for relay
+- `SetMinTrustScore(minScore float64)` - Update threshold
+- `GetMinTrustScore() float64` - Get current threshold
+- `FilterEvents(events []*event.E) []*event.E` - Filter to trusted events
+
+### EventCollector
+
+Utility for collecting specific types of directory events.
+
+**Methods:**
+- `NewEventCollector(events []*event.E) *EventCollector` - Create new instance
+- `RelayIdentities() []*RelayIdentity` - Get all relay identities
+- `TrustActs() []*TrustAct` - Get all trust acts
+- `GroupTagActs() []*GroupTagAct` - Get all group tag acts
+- `PublicKeyAdvertisements() []*PublicKeyAdvertisement` - Get all key ads
+- `ReplicationRequests() []*ReplicationRequest` - Get all requests
+- `ReplicationResponses() []*ReplicationResponse` - Get all responses
+
+### Helper Functions
+
+**Event Filtering:**
+- `IsDirectoryEvent(ev *event.E) bool` - Check if event is directory event
+- `FilterDirectoryEvents(events []*event.E) []*event.E` - Filter to directory events
+- `ParseDirectoryEvent(ev *event.E) (interface{}, error)` - Parse any directory event
+
+**Event Finding:**
+- `FindRelayIdentity(events, relayURL) (*RelayIdentity, bool)` - Find identity by URL
+- `FindTrustActsForRelay(events, targetPubkey) []*TrustAct` - Find trust acts
+- `FindGroupTagActsForRelay(events, targetPubkey) []*GroupTagAct` - Find group acts
+- `FindGroupTagActsByGroup(events, groupTag) []*GroupTagAct` - Find by group
+
+**URL Utilities:**
+- `NormalizeRelayURL(url string) string` - Ensure trailing slash
+
+**Trust Graph:**
+- `NewTrustGraph() *TrustGraph` - Create new graph
+- `BuildTrustGraph(events []*event.E) *TrustGraph` - Build from events
+- `AddTrustAct(act *TrustAct)` - Add trust act to graph
+- `GetTrustActs(source string) []*TrustAct` - Get acts from source
+- `GetTrustedBy(target string) []string` - Get who trusts target
+- `GetTrustTargets(source string) []string` - Get who source trusts
+
+## Thread Safety
+
+All components are thread-safe and can be used concurrently from multiple goroutines. Internal state is protected by read-write mutexes (`sync.RWMutex`).
+
+## Performance Considerations
+
+- **IdentityResolver**: Maintains in-memory caches. Use `ClearCache()` if needed
+- **TrustCalculator**: Stores all trust acts in memory. Consider periodic cleanup of expired acts
+- **ReplicationFilter**: Minimal memory overhead, recalculates trust on each act addition
+
+## Integration
+
+This package works with:
+
+- **directory protocol package**: For parsing and creating events
+- **event package**: For event structures
+- **EventStore**: Can be integrated with any event storage system
+
+## Related Documentation
+
+- [NIP-XX Specification](../../docs/NIP-XX-distributed-directory-consensus.md)
+- [Directory Protocol Package](../directory/)
+
+## License
+
+See [LICENSE](../../LICENSE) file.

pkg/protocol/directory-client/bun.lock

@@ -0,0 +1,313 @@
+{
+  "lockfileVersion": 1,
+  "workspaces": {
+    "": {
+      "name": "@orly/directory-client",
+      "dependencies": {
+        "applesauce-core": "^3.0.0",
+        "rxjs": "^7.8.1",
+      },
+      "devDependencies": {
+        "@types/node": "^20.0.0",
+        "typescript": "^5.3.0",
+        "vitest": "^1.0.0",
+      },
+      "peerDependencies": {
+        "applesauce-core": "^3.0.0",
+      },
+    },
+  },
+  "packages": {
+    "@esbuild/aix-ppc64": ["@esbuild/aix-ppc64@0.21.5", "", { "os": "aix", "cpu": "ppc64" }, "sha512-1SDgH6ZSPTlggy1yI6+Dbkiz8xzpHJEVAlF/AM1tHPLsf5STom9rwtjE4hKAF20FfXXNTFqEYXyJNWh1GiZedQ=="],
+
+    "@esbuild/android-arm": ["@esbuild/android-arm@0.21.5", "", { "os": "android", "cpu": "arm" }, "sha512-vCPvzSjpPHEi1siZdlvAlsPxXl7WbOVUBBAowWug4rJHb68Ox8KualB+1ocNvT5fjv6wpkX6o/iEpbDrf68zcg=="],
+
+    "@esbuild/android-arm64": ["@esbuild/android-arm64@0.21.5", "", { "os": "android", "cpu": "arm64" }, "sha512-c0uX9VAUBQ7dTDCjq+wdyGLowMdtR/GoC2U5IYk/7D1H1JYC0qseD7+11iMP2mRLN9RcCMRcjC4YMclCzGwS/A=="],
+
+    "@esbuild/android-x64": ["@esbuild/android-x64@0.21.5", "", { "os": "android", "cpu": "x64" }, "sha512-D7aPRUUNHRBwHxzxRvp856rjUHRFW1SdQATKXH2hqA0kAZb1hKmi02OpYRacl0TxIGz/ZmXWlbZgjwWYaCakTA=="],
+
+    "@esbuild/darwin-arm64": ["@esbuild/darwin-arm64@0.21.5", "", { "os": "darwin", "cpu": "arm64" }, "sha512-DwqXqZyuk5AiWWf3UfLiRDJ5EDd49zg6O9wclZ7kUMv2WRFr4HKjXp/5t8JZ11QbQfUS6/cRCKGwYhtNAY88kQ=="],
+
+    "@esbuild/darwin-x64": ["@esbuild/darwin-x64@0.21.5", "", { "os": "darwin", "cpu": "x64" }, "sha512-se/JjF8NlmKVG4kNIuyWMV/22ZaerB+qaSi5MdrXtd6R08kvs2qCN4C09miupktDitvh8jRFflwGFBQcxZRjbw=="],
+
+    "@esbuild/freebsd-arm64": ["@esbuild/freebsd-arm64@0.21.5", "", { "os": "freebsd", "cpu": "arm64" }, "sha512-5JcRxxRDUJLX8JXp/wcBCy3pENnCgBR9bN6JsY4OmhfUtIHe3ZW0mawA7+RDAcMLrMIZaf03NlQiX9DGyB8h4g=="],
+
+    "@esbuild/freebsd-x64": ["@esbuild/freebsd-x64@0.21.5", "", { "os": "freebsd", "cpu": "x64" }, "sha512-J95kNBj1zkbMXtHVH29bBriQygMXqoVQOQYA+ISs0/2l3T9/kj42ow2mpqerRBxDJnmkUDCaQT/dfNXWX/ZZCQ=="],
+
+    "@esbuild/linux-arm": ["@esbuild/linux-arm@0.21.5", "", { "os": "linux", "cpu": "arm" }, "sha512-bPb5AHZtbeNGjCKVZ9UGqGwo8EUu4cLq68E95A53KlxAPRmUyYv2D6F0uUI65XisGOL1hBP5mTronbgo+0bFcA=="],
+
+    "@esbuild/linux-arm64": ["@esbuild/linux-arm64@0.21.5", "", { "os": "linux", "cpu": "arm64" }, "sha512-ibKvmyYzKsBeX8d8I7MH/TMfWDXBF3db4qM6sy+7re0YXya+K1cem3on9XgdT2EQGMu4hQyZhan7TeQ8XkGp4Q=="],
+
+    "@esbuild/linux-ia32": ["@esbuild/linux-ia32@0.21.5", "", { "os": "linux", "cpu": "ia32" }, "sha512-YvjXDqLRqPDl2dvRODYmmhz4rPeVKYvppfGYKSNGdyZkA01046pLWyRKKI3ax8fbJoK5QbxblURkwK/MWY18Tg=="],
+
+    "@esbuild/linux-loong64": ["@esbuild/linux-loong64@0.21.5", "", { "os": "linux", "cpu": "none" }, "sha512-uHf1BmMG8qEvzdrzAqg2SIG/02+4/DHB6a9Kbya0XDvwDEKCoC8ZRWI5JJvNdUjtciBGFQ5PuBlpEOXQj+JQSg=="],
+
+    "@esbuild/linux-mips64el": ["@esbuild/linux-mips64el@0.21.5", "", { "os": "linux", "cpu": "none" }, "sha512-IajOmO+KJK23bj52dFSNCMsz1QP1DqM6cwLUv3W1QwyxkyIWecfafnI555fvSGqEKwjMXVLokcV5ygHW5b3Jbg=="],
+
+    "@esbuild/linux-ppc64": ["@esbuild/linux-ppc64@0.21.5", "", { "os": "linux", "cpu": "ppc64" }, "sha512-1hHV/Z4OEfMwpLO8rp7CvlhBDnjsC3CttJXIhBi+5Aj5r+MBvy4egg7wCbe//hSsT+RvDAG7s81tAvpL2XAE4w=="],
+
+    "@esbuild/linux-riscv64": ["@esbuild/linux-riscv64@0.21.5", "", { "os": "linux", "cpu": "none" }, "sha512-2HdXDMd9GMgTGrPWnJzP2ALSokE/0O5HhTUvWIbD3YdjME8JwvSCnNGBnTThKGEB91OZhzrJ4qIIxk/SBmyDDA=="],
+
+    "@esbuild/linux-s390x": ["@esbuild/linux-s390x@0.21.5", "", { "os": "linux", "cpu": "s390x" }, "sha512-zus5sxzqBJD3eXxwvjN1yQkRepANgxE9lgOW2qLnmr8ikMTphkjgXu1HR01K4FJg8h1kEEDAqDcZQtbrRnB41A=="],
+
+    "@esbuild/linux-x64": ["@esbuild/linux-x64@0.21.5", "", { "os": "linux", "cpu": "x64" }, "sha512-1rYdTpyv03iycF1+BhzrzQJCdOuAOtaqHTWJZCWvijKD2N5Xu0TtVC8/+1faWqcP9iBCWOmjmhoH94dH82BxPQ=="],
+
+    "@esbuild/netbsd-x64": ["@esbuild/netbsd-x64@0.21.5", "", { "os": "none", "cpu": "x64" }, "sha512-Woi2MXzXjMULccIwMnLciyZH4nCIMpWQAs049KEeMvOcNADVxo0UBIQPfSmxB3CWKedngg7sWZdLvLczpe0tLg=="],
+
+    "@esbuild/openbsd-x64": ["@esbuild/openbsd-x64@0.21.5", "", { "os": "openbsd", "cpu": "x64" }, "sha512-HLNNw99xsvx12lFBUwoT8EVCsSvRNDVxNpjZ7bPn947b8gJPzeHWyNVhFsaerc0n3TsbOINvRP2byTZ5LKezow=="],
+
+    "@esbuild/sunos-x64": ["@esbuild/sunos-x64@0.21.5", "", { "os": "sunos", "cpu": "x64" }, "sha512-6+gjmFpfy0BHU5Tpptkuh8+uw3mnrvgs+dSPQXQOv3ekbordwnzTVEb4qnIvQcYXq6gzkyTnoZ9dZG+D4garKg=="],
+
+    "@esbuild/win32-arm64": ["@esbuild/win32-arm64@0.21.5", "", { "os": "win32", "cpu": "arm64" }, "sha512-Z0gOTd75VvXqyq7nsl93zwahcTROgqvuAcYDUr+vOv8uHhNSKROyU961kgtCD1e95IqPKSQKH7tBTslnS3tA8A=="],
+
+    "@esbuild/win32-ia32": ["@esbuild/win32-ia32@0.21.5", "", { "os": "win32", "cpu": "ia32" }, "sha512-SWXFF1CL2RVNMaVs+BBClwtfZSvDgtL//G/smwAc5oVK/UPu2Gu9tIaRgFmYFFKrmg3SyAjSrElf0TiJ1v8fYA=="],
+
+    "@esbuild/win32-x64": ["@esbuild/win32-x64@0.21.5", "", { "os": "win32", "cpu": "x64" }, "sha512-tQd/1efJuzPC6rCFwEvLtci/xNFcTZknmXs98FYDfGE4wP9ClFV98nyKrzJKVPMhdDnjzLhdUyMX4PsQAPjwIw=="],
+
+    "@jest/schemas": ["@jest/schemas@29.6.3", "", { "dependencies": { "@sinclair/typebox": "^0.27.8" } }, "sha512-mo5j5X+jIZmJQveBKeS/clAueipV7KgiX1vMgCxam1RNYiqE1w62n0/tJJnHtjW8ZHcQco5gY85jA3mi0L+nSA=="],
+
+    "@jridgewell/sourcemap-codec": ["@jridgewell/sourcemap-codec@1.5.5", "", {}, "sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og=="],
+
+    "@noble/ciphers": ["@noble/ciphers@0.5.3", "", {}, "sha512-B0+6IIHiqEs3BPMT0hcRmHvEj2QHOLu+uwt+tqDDeVd0oyVzh7BPrDcPjRnV1PV/5LaknXJJQvOuRGR0zQJz+w=="],
+
+    "@noble/curves": ["@noble/curves@1.2.0", "", { "dependencies": { "@noble/hashes": "1.3.2" } }, "sha512-oYclrNgRaM9SsBUBVbb8M6DTV7ZHRTKugureoYEncY5c65HOmRzvSiTE3y5CYaPYJA/GVkrhXEoF0M3Ya9PMnw=="],
+
+    "@noble/hashes": ["@noble/hashes@1.8.0", "", {}, "sha512-jCs9ldd7NwzpgXDIf6P3+NrHh9/sD6CQdxHyjQI+h/6rDNo88ypBxxz45UDuZHz9r3tNz7N/VInSVoVdtXEI4A=="],
+
+    "@rollup/rollup-android-arm-eabi": ["@rollup/rollup-android-arm-eabi@4.52.5", "", { "os": "android", "cpu": "arm" }, "sha512-8c1vW4ocv3UOMp9K+gToY5zL2XiiVw3k7f1ksf4yO1FlDFQ1C2u72iACFnSOceJFsWskc2WZNqeRhFRPzv+wtQ=="],
+
+    "@rollup/rollup-android-arm64": ["@rollup/rollup-android-arm64@4.52.5", "", { "os": "android", "cpu": "arm64" }, "sha512-mQGfsIEFcu21mvqkEKKu2dYmtuSZOBMmAl5CFlPGLY94Vlcm+zWApK7F/eocsNzp8tKmbeBP8yXyAbx0XHsFNA=="],
+
+    "@rollup/rollup-darwin-arm64": ["@rollup/rollup-darwin-arm64@4.52.5", "", { "os": "darwin", "cpu": "arm64" }, "sha512-takF3CR71mCAGA+v794QUZ0b6ZSrgJkArC+gUiG6LB6TQty9T0Mqh3m2ImRBOxS2IeYBo4lKWIieSvnEk2OQWA=="],
+
+    "@rollup/rollup-darwin-x64": ["@rollup/rollup-darwin-x64@4.52.5", "", { "os": "darwin", "cpu": "x64" }, "sha512-W901Pla8Ya95WpxDn//VF9K9u2JbocwV/v75TE0YIHNTbhqUTv9w4VuQ9MaWlNOkkEfFwkdNhXgcLqPSmHy0fA=="],
+
+    "@rollup/rollup-freebsd-arm64": ["@rollup/rollup-freebsd-arm64@4.52.5", "", { "os": "freebsd", "cpu": "arm64" }, "sha512-QofO7i7JycsYOWxe0GFqhLmF6l1TqBswJMvICnRUjqCx8b47MTo46W8AoeQwiokAx3zVryVnxtBMcGcnX12LvA=="],
+
+    "@rollup/rollup-freebsd-x64": ["@rollup/rollup-freebsd-x64@4.52.5", "", { "os": "freebsd", "cpu": "x64" }, "sha512-jr21b/99ew8ujZubPo9skbrItHEIE50WdV86cdSoRkKtmWa+DDr6fu2c/xyRT0F/WazZpam6kk7IHBerSL7LDQ=="],
+
+    "@rollup/rollup-linux-arm-gnueabihf": ["@rollup/rollup-linux-arm-gnueabihf@4.52.5", "", { "os": "linux", "cpu": "arm" }, "sha512-PsNAbcyv9CcecAUagQefwX8fQn9LQ4nZkpDboBOttmyffnInRy8R8dSg6hxxl2Re5QhHBf6FYIDhIj5v982ATQ=="],
+
+    "@rollup/rollup-linux-arm-musleabihf": ["@rollup/rollup-linux-arm-musleabihf@4.52.5", "", { "os": "linux", "cpu": "arm" }, "sha512-Fw4tysRutyQc/wwkmcyoqFtJhh0u31K+Q6jYjeicsGJJ7bbEq8LwPWV/w0cnzOqR2m694/Af6hpFayLJZkG2VQ=="],
+
+    "@rollup/rollup-linux-arm64-gnu": ["@rollup/rollup-linux-arm64-gnu@4.52.5", "", { "os": "linux", "cpu": "arm64" }, "sha512-a+3wVnAYdQClOTlyapKmyI6BLPAFYs0JM8HRpgYZQO02rMR09ZcV9LbQB+NL6sljzG38869YqThrRnfPMCDtZg=="],
+
+    "@rollup/rollup-linux-arm64-musl": ["@rollup/rollup-linux-arm64-musl@4.52.5", "", { "os": "linux", "cpu": "arm64" }, "sha512-AvttBOMwO9Pcuuf7m9PkC1PUIKsfaAJ4AYhy944qeTJgQOqJYJ9oVl2nYgY7Rk0mkbsuOpCAYSs6wLYB2Xiw0Q=="],
+
+    "@rollup/rollup-linux-loong64-gnu": ["@rollup/rollup-linux-loong64-gnu@4.52.5", "", { "os": "linux", "cpu": "none" }, "sha512-DkDk8pmXQV2wVrF6oq5tONK6UHLz/XcEVow4JTTerdeV1uqPeHxwcg7aFsfnSm9L+OO8WJsWotKM2JJPMWrQtA=="],
+
+    "@rollup/rollup-linux-ppc64-gnu": ["@rollup/rollup-linux-ppc64-gnu@4.52.5", "", { "os": "linux", "cpu": "ppc64" }, "sha512-W/b9ZN/U9+hPQVvlGwjzi+Wy4xdoH2I8EjaCkMvzpI7wJUs8sWJ03Rq96jRnHkSrcHTpQe8h5Tg3ZzUPGauvAw=="],
+
+    "@rollup/rollup-linux-riscv64-gnu": ["@rollup/rollup-linux-riscv64-gnu@4.52.5", "", { "os": "linux", "cpu": "none" }, "sha512-sjQLr9BW7R/ZiXnQiWPkErNfLMkkWIoCz7YMn27HldKsADEKa5WYdobaa1hmN6slu9oWQbB6/jFpJ+P2IkVrmw=="],
+
+    "@rollup/rollup-linux-riscv64-musl": ["@rollup/rollup-linux-riscv64-musl@4.52.5", "", { "os": "linux", "cpu": "none" }, "sha512-hq3jU/kGyjXWTvAh2awn8oHroCbrPm8JqM7RUpKjalIRWWXE01CQOf/tUNWNHjmbMHg/hmNCwc/Pz3k1T/j/Lg=="],
+
+    "@rollup/rollup-linux-s390x-gnu": ["@rollup/rollup-linux-s390x-gnu@4.52.5", "", { "os": "linux", "cpu": "s390x" }, "sha512-gn8kHOrku8D4NGHMK1Y7NA7INQTRdVOntt1OCYypZPRt6skGbddska44K8iocdpxHTMMNui5oH4elPH4QOLrFQ=="],
+
+    "@rollup/rollup-linux-x64-gnu": ["@rollup/rollup-linux-x64-gnu@4.52.5", "", { "os": "linux", "cpu": "x64" }, "sha512-hXGLYpdhiNElzN770+H2nlx+jRog8TyynpTVzdlc6bndktjKWyZyiCsuDAlpd+j+W+WNqfcyAWz9HxxIGfZm1Q=="],
+
+    "@rollup/rollup-linux-x64-musl": ["@rollup/rollup-linux-x64-musl@4.52.5", "", { "os": "linux", "cpu": "x64" }, "sha512-arCGIcuNKjBoKAXD+y7XomR9gY6Mw7HnFBv5Rw7wQRvwYLR7gBAgV7Mb2QTyjXfTveBNFAtPt46/36vV9STLNg=="],
+
+    "@rollup/rollup-openharmony-arm64": ["@rollup/rollup-openharmony-arm64@4.52.5", "", { "os": "none", "cpu": "arm64" }, "sha512-QoFqB6+/9Rly/RiPjaomPLmR/13cgkIGfA40LHly9zcH1S0bN2HVFYk3a1eAyHQyjs3ZJYlXvIGtcCs5tko9Cw=="],
+
+    "@rollup/rollup-win32-arm64-msvc": ["@rollup/rollup-win32-arm64-msvc@4.52.5", "", { "os": "win32", "cpu": "arm64" }, "sha512-w0cDWVR6MlTstla1cIfOGyl8+qb93FlAVutcor14Gf5Md5ap5ySfQ7R9S/NjNaMLSFdUnKGEasmVnu3lCMqB7w=="],
+
+    "@rollup/rollup-win32-ia32-msvc": ["@rollup/rollup-win32-ia32-msvc@4.52.5", "", { "os": "win32", "cpu": "ia32" }, "sha512-Aufdpzp7DpOTULJCuvzqcItSGDH73pF3ko/f+ckJhxQyHtp67rHw3HMNxoIdDMUITJESNE6a8uh4Lo4SLouOUg=="],
+
+    "@rollup/rollup-win32-x64-gnu": ["@rollup/rollup-win32-x64-gnu@4.52.5", "", { "os": "win32", "cpu": "x64" }, "sha512-UGBUGPFp1vkj6p8wCRraqNhqwX/4kNQPS57BCFc8wYh0g94iVIW33wJtQAx3G7vrjjNtRaxiMUylM0ktp/TRSQ=="],
+
+    "@rollup/rollup-win32-x64-msvc": ["@rollup/rollup-win32-x64-msvc@4.52.5", "", { "os": "win32", "cpu": "x64" }, "sha512-TAcgQh2sSkykPRWLrdyy2AiceMckNf5loITqXxFI5VuQjS5tSuw3WlwdN8qv8vzjLAUTvYaH/mVjSFpbkFbpTg=="],
+
+    "@scure/base": ["@scure/base@1.2.6", "", {}, "sha512-g/nm5FgUa//MCj1gV09zTJTaM6KBAHqLN907YVQqf7zC49+DcO4B1so4ZX07Ef10Twr6nuqYEH9GEggFXA4Fmg=="],
+
+    "@scure/bip32": ["@scure/bip32@1.3.1", "", { "dependencies": { "@noble/curves": "~1.1.0", "@noble/hashes": "~1.3.1", "@scure/base": "~1.1.0" } }, "sha512-osvveYtyzdEVbt3OfwwXFr4P2iVBL5u1Q3q4ONBfDY/UpOuXmOlbgwc1xECEboY8wIays8Yt6onaWMUdUbfl0A=="],
+
+    "@scure/bip39": ["@scure/bip39@1.2.1", "", { "dependencies": { "@noble/hashes": "~1.3.0", "@scure/base": "~1.1.0" } }, "sha512-Z3/Fsz1yr904dduJD0NpiyRHhRYHdcnyh73FZWiV+/qhWi83wNJ3NWolYqCEN+ZWsUz2TWwajJggcRE9r1zUYg=="],
+
+    "@sinclair/typebox": ["@sinclair/typebox@0.27.8", "", {}, "sha512-+Fj43pSMwJs4KRrH/938Uf+uAELIgVBmQzg/q1YG10djyfA3TnrU8N8XzqCh/okZdszqBQTZf96idMfE5lnwTA=="],
+
+    "@types/estree": ["@types/estree@1.0.8", "", {}, "sha512-dWHzHa2WqEXI/O1E9OjrocMTKJl2mSrEolh1Iomrv6U+JuNwaHXsXx9bLu5gG7BUWFIN0skIQJQ/L1rIex4X6w=="],
+
+    "@types/node": ["@types/node@20.19.23", "", { "dependencies": { "undici-types": "~6.21.0" } }, "sha512-yIdlVVVHXpmqRhtyovZAcSy0MiPcYWGkoO4CGe/+jpP0hmNuihm4XhHbADpK++MsiLHP5MVlv+bcgdF99kSiFQ=="],
+
+    "@vitest/expect": ["@vitest/expect@1.6.1", "", { "dependencies": { "@vitest/spy": "1.6.1", "@vitest/utils": "1.6.1", "chai": "^4.3.10" } }, "sha512-jXL+9+ZNIJKruofqXuuTClf44eSpcHlgj3CiuNihUF3Ioujtmc0zIa3UJOW5RjDK1YLBJZnWBlPuqhYycLioog=="],
+
+    "@vitest/runner": ["@vitest/runner@1.6.1", "", { "dependencies": { "@vitest/utils": "1.6.1", "p-limit": "^5.0.0", "pathe": "^1.1.1" } }, "sha512-3nSnYXkVkf3mXFfE7vVyPmi3Sazhb/2cfZGGs0JRzFsPFvAMBEcrweV1V1GsrstdXeKCTXlJbvnQwGWgEIHmOA=="],
+
+    "@vitest/snapshot": ["@vitest/snapshot@1.6.1", "", { "dependencies": { "magic-string": "^0.30.5", "pathe": "^1.1.1", "pretty-format": "^29.7.0" } }, "sha512-WvidQuWAzU2p95u8GAKlRMqMyN1yOJkGHnx3M1PL9Raf7AQ1kwLKg04ADlCa3+OXUZE7BceOhVZiuWAbzCKcUQ=="],
+
+    "@vitest/spy": ["@vitest/spy@1.6.1", "", { "dependencies": { "tinyspy": "^2.2.0" } }, "sha512-MGcMmpGkZebsMZhbQKkAf9CX5zGvjkBTqf8Zx3ApYWXr3wG+QvEu2eXWfnIIWYSJExIp4V9FCKDEeygzkYrXMw=="],
+
+    "@vitest/utils": ["@vitest/utils@1.6.1", "", { "dependencies": { "diff-sequences": "^29.6.3", "estree-walker": "^3.0.3", "loupe": "^2.3.7", "pretty-format": "^29.7.0" } }, "sha512-jOrrUvXM4Av9ZWiG1EajNto0u96kWAhJ1LmPmJhXXQx/32MecEKd10pOLYgS2BQx1TgkGhloPU1ArDW2vvaY6g=="],
+
+    "acorn": ["acorn@8.15.0", "", { "bin": { "acorn": "bin/acorn" } }, "sha512-NZyJarBfL7nWwIq+FDL6Zp/yHEhePMNnnJ0y3qfieCrmNvYct8uvtiV41UvlSe6apAfk0fY1FbWx+NwfmpvtTg=="],
+
+    "acorn-walk": ["acorn-walk@8.3.4", "", { "dependencies": { "acorn": "^8.11.0" } }, "sha512-ueEepnujpqee2o5aIYnvHU6C0A42MNdsIDeqy5BydrkuC5R1ZuUFnm27EeFJGoEHJQgn3uleRvmTXaJgfXbt4g=="],
+
+    "ansi-styles": ["ansi-styles@5.2.0", "", {}, "sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA=="],
+
+    "applesauce-core": ["applesauce-core@3.1.0", "", { "dependencies": { "@noble/hashes": "^1.7.1", "@scure/base": "^1.2.4", "debug": "^4.4.0", "fast-deep-equal": "^3.1.3", "hash-sum": "^2.0.0", "light-bolt11-decoder": "^3.2.0", "nanoid": "^5.0.9", "nostr-tools": "~2.15", "rxjs": "^7.8.1" } }, "sha512-rIvtAYm8jJiLkv251yT12olmlmlkeT5x9kptWlAz0wMiAhymGG/RoWtMN80mbOAebjwcLCRLRfrAO6YYal1XpQ=="],
+
+    "assertion-error": ["assertion-error@1.1.0", "", {}, "sha512-jgsaNduz+ndvGyFt3uSuWqvy4lCnIJiovtouQN5JZHOKCS2QuhEdbcQHFhVksz2N2U9hXJo8odG7ETyWlEeuDw=="],
+
+    "cac": ["cac@6.7.14", "", {}, "sha512-b6Ilus+c3RrdDk+JhLKUAQfzzgLEPy6wcXqS7f/xe1EETvsDP6GORG7SFuOs6cID5YkqchW/LXZbX5bc8j7ZcQ=="],
+
+    "chai": ["chai@4.5.0", "", { "dependencies": { "assertion-error": "^1.1.0", "check-error": "^1.0.3", "deep-eql": "^4.1.3", "get-func-name": "^2.0.2", "loupe": "^2.3.6", "pathval": "^1.1.1", "type-detect": "^4.1.0" } }, "sha512-RITGBfijLkBddZvnn8jdqoTypxvqbOLYQkGGxXzeFjVHvudaPw0HNFD9x928/eUwYWd2dPCugVqspGALTZZQKw=="],
+
+    "check-error": ["check-error@1.0.3", "", { "dependencies": { "get-func-name": "^2.0.2" } }, "sha512-iKEoDYaRmd1mxM90a2OEfWhjsjPpYPuQ+lMYsoxB126+t8fw7ySEO48nmDg5COTjxDI65/Y2OWpeEHk3ZOe8zg=="],
+
+    "confbox": ["confbox@0.1.8", "", {}, "sha512-RMtmw0iFkeR4YV+fUOSucriAQNb9g8zFR52MWCtl+cCZOFRNL6zeB395vPzFhEjjn4fMxXudmELnl/KF/WrK6w=="],
+
+    "cross-spawn": ["cross-spawn@7.0.6", "", { "dependencies": { "path-key": "^3.1.0", "shebang-command": "^2.0.0", "which": "^2.0.1" } }, "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA=="],
+
+    "debug": ["debug@4.4.3", "", { "dependencies": { "ms": "^2.1.3" } }, "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA=="],
+
+    "deep-eql": ["deep-eql@4.1.4", "", { "dependencies": { "type-detect": "^4.0.0" } }, "sha512-SUwdGfqdKOwxCPeVYjwSyRpJ7Z+fhpwIAtmCUdZIWZ/YP5R9WAsyuSgpLVDi9bjWoN2LXHNss/dk3urXtdQxGg=="],
+
+    "diff-sequences": ["diff-sequences@29.6.3", "", {}, "sha512-EjePK1srD3P08o2j4f0ExnylqRs5B9tJjcp9t1krH2qRi8CCdsYfwe9JgSLurFBWwq4uOlipzfk5fHNvwFKr8Q=="],
+
+    "esbuild": ["esbuild@0.21.5", "", { "optionalDependencies": { "@esbuild/aix-ppc64": "0.21.5", "@esbuild/android-arm": "0.21.5", "@esbuild/android-arm64": "0.21.5", "@esbuild/android-x64": "0.21.5", "@esbuild/darwin-arm64": "0.21.5", "@esbuild/darwin-x64": "0.21.5", "@esbuild/freebsd-arm64": "0.21.5", "@esbuild/freebsd-x64": "0.21.5", "@esbuild/linux-arm": "0.21.5", "@esbuild/linux-arm64": "0.21.5", "@esbuild/linux-ia32": "0.21.5", "@esbuild/linux-loong64": "0.21.5", "@esbuild/linux-mips64el": "0.21.5", "@esbuild/linux-ppc64": "0.21.5", "@esbuild/linux-riscv64": "0.21.5", "@esbuild/linux-s390x": "0.21.5", "@esbuild/linux-x64": "0.21.5", "@esbuild/netbsd-x64": "0.21.5", "@esbuild/openbsd-x64": "0.21.5", "@esbuild/sunos-x64": "0.21.5", "@esbuild/win32-arm64": "0.21.5", "@esbuild/win32-ia32": "0.21.5", "@esbuild/win32-x64": "0.21.5" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-mg3OPMV4hXywwpoDxu3Qda5xCKQi+vCTZq8S9J/EpkhB2HzKXq4SNFZE3+NK93JYxc8VMSep+lOUSC/RVKaBqw=="],
+
+    "estree-walker": ["estree-walker@3.0.3", "", { "dependencies": { "@types/estree": "^1.0.0" } }, "sha512-7RUKfXgSMMkzt6ZuXmqapOurLGPPfgj6l9uRZ7lRGolvk0y2yocc35LdcxKC5PQZdn2DMqioAQ2NoWcrTKmm6g=="],
+
+    "execa": ["execa@8.0.1", "", { "dependencies": { "cross-spawn": "^7.0.3", "get-stream": "^8.0.1", "human-signals": "^5.0.0", "is-stream": "^3.0.0", "merge-stream": "^2.0.0", "npm-run-path": "^5.1.0", "onetime": "^6.0.0", "signal-exit": "^4.1.0", "strip-final-newline": "^3.0.0" } }, "sha512-VyhnebXciFV2DESc+p6B+y0LjSm0krU4OgJN44qFAhBY0TJ+1V61tYD2+wHusZ6F9n5K+vl8k0sTy7PEfV4qpg=="],
+
+    "fast-deep-equal": ["fast-deep-equal@3.1.3", "", {}, "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q=="],
+
+    "fsevents": ["fsevents@2.3.3", "", { "os": "darwin" }, "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw=="],
+
+    "get-func-name": ["get-func-name@2.0.2", "", {}, "sha512-8vXOvuE167CtIc3OyItco7N/dpRtBbYOsPsXCz7X/PMnlGjYjSGuZJgM1Y7mmew7BKf9BqvLX2tnOVy1BBUsxQ=="],
+
+    "get-stream": ["get-stream@8.0.1", "", {}, "sha512-VaUJspBffn/LMCJVoMvSAdmscJyS1auj5Zulnn5UoYcY531UWmdwhRWkcGKnGU93m5HSXP9LP2usOryrBtQowA=="],
+
+    "hash-sum": ["hash-sum@2.0.0", "", {}, "sha512-WdZTbAByD+pHfl/g9QSsBIIwy8IT+EsPiKDs0KNX+zSHhdDLFKdZu0BQHljvO+0QI/BasbMSUa8wYNCZTvhslg=="],
+
+    "human-signals": ["human-signals@5.0.0", "", {}, "sha512-AXcZb6vzzrFAUE61HnN4mpLqd/cSIwNQjtNWR0euPm6y0iqx3G4gOXaIDdtdDwZmhwe82LA6+zinmW4UBWVePQ=="],
+
+    "is-stream": ["is-stream@3.0.0", "", {}, "sha512-LnQR4bZ9IADDRSkvpqMGvt/tEJWclzklNgSw48V5EAaAeDd6qGvN8ei6k5p0tvxSR171VmGyHuTiAOfxAbr8kA=="],
+
+    "isexe": ["isexe@2.0.0", "", {}, "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw=="],
+
+    "js-tokens": ["js-tokens@9.0.1", "", {}, "sha512-mxa9E9ITFOt0ban3j6L5MpjwegGz6lBQmM1IJkWeBZGcMxto50+eWdjC/52xDbS2vy0k7vIMK0Fe2wfL9OQSpQ=="],
+
+    "light-bolt11-decoder": ["light-bolt11-decoder@3.2.0", "", { "dependencies": { "@scure/base": "1.1.1" } }, "sha512-3QEofgiBOP4Ehs9BI+RkZdXZNtSys0nsJ6fyGeSiAGCBsMwHGUDS/JQlY/sTnWs91A2Nh0S9XXfA8Sy9g6QpuQ=="],
+
+    "local-pkg": ["local-pkg@0.5.1", "", { "dependencies": { "mlly": "^1.7.3", "pkg-types": "^1.2.1" } }, "sha512-9rrA30MRRP3gBD3HTGnC6cDFpaE1kVDWxWgqWJUN0RvDNAo+Nz/9GxB+nHOH0ifbVFy0hSA1V6vFDvnx54lTEQ=="],
+
+    "loupe": ["loupe@2.3.7", "", { "dependencies": { "get-func-name": "^2.0.1" } }, "sha512-zSMINGVYkdpYSOBmLi0D1Uo7JU9nVdQKrHxC8eYlV+9YKK9WePqAlL7lSlorG/U2Fw1w0hTBmaa/jrQ3UbPHtA=="],
+
+    "magic-string": ["magic-string@0.30.21", "", { "dependencies": { "@jridgewell/sourcemap-codec": "^1.5.5" } }, "sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ=="],
+
+    "merge-stream": ["merge-stream@2.0.0", "", {}, "sha512-abv/qOcuPfk3URPfDzmZU1LKmuw8kT+0nIHvKrKgFrwifol/doWcdA4ZqsWQ8ENrFKkd67Mfpo/LovbIUsbt3w=="],
+
+    "mimic-fn": ["mimic-fn@4.0.0", "", {}, "sha512-vqiC06CuhBTUdZH+RYl8sFrL096vA45Ok5ISO6sE/Mr1jRbGH4Csnhi8f3wKVl7x8mO4Au7Ir9D3Oyv1VYMFJw=="],
+
+    "mlly": ["mlly@1.8.0", "", { "dependencies": { "acorn": "^8.15.0", "pathe": "^2.0.3", "pkg-types": "^1.3.1", "ufo": "^1.6.1" } }, "sha512-l8D9ODSRWLe2KHJSifWGwBqpTZXIXTeo8mlKjY+E2HAakaTeNpqAyBZ8GSqLzHgw4XmHmC8whvpjJNMbFZN7/g=="],
+
+    "ms": ["ms@2.1.3", "", {}, "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA=="],
+
+    "nanoid": ["nanoid@5.1.6", "", { "bin": { "nanoid": "bin/nanoid.js" } }, "sha512-c7+7RQ+dMB5dPwwCp4ee1/iV/q2P6aK1mTZcfr1BTuVlyW9hJYiMPybJCcnBlQtuSmTIWNeazm/zqNoZSSElBg=="],
+
+    "nostr-tools": ["nostr-tools@2.15.2", "", { "dependencies": { "@noble/ciphers": "^0.5.1", "@noble/curves": "1.2.0", "@noble/hashes": "1.3.1", "@scure/base": "1.1.1", "@scure/bip32": "1.3.1", "@scure/bip39": "1.2.1", "nostr-wasm": "0.1.0" }, "peerDependencies": { "typescript": ">=5.0.0" }, "optionalPeers": ["typescript"] }, "sha512-utmqVVS4HMDiwhIgI6Cr+KqA4aUhF3Sb755iO/qCiqxc5H9JW/9Z3N1RO/jKWpjP6q/Vx0lru7IYuiPvk+2/ng=="],
+
+    "nostr-wasm": ["nostr-wasm@0.1.0", "", {}, "sha512-78BTryCLcLYv96ONU8Ws3Q1JzjlAt+43pWQhIl86xZmWeegYCNLPml7yQ+gG3vR6V5h4XGj+TxO+SS5dsThQIA=="],
+
+    "npm-run-path": ["npm-run-path@5.3.0", "", { "dependencies": { "path-key": "^4.0.0" } }, "sha512-ppwTtiJZq0O/ai0z7yfudtBpWIoxM8yE6nHi1X47eFR2EWORqfbu6CnPlNsjeN683eT0qG6H/Pyf9fCcvjnnnQ=="],
+
+    "onetime": ["onetime@6.0.0", "", { "dependencies": { "mimic-fn": "^4.0.0" } }, "sha512-1FlR+gjXK7X+AsAHso35MnyN5KqGwJRi/31ft6x0M194ht7S+rWAvd7PHss9xSKMzE0asv1pyIHaJYq+BbacAQ=="],
+
+    "p-limit": ["p-limit@5.0.0", "", { "dependencies": { "yocto-queue": "^1.0.0" } }, "sha512-/Eaoq+QyLSiXQ4lyYV23f14mZRQcXnxfHrN0vCai+ak9G0pp9iEQukIIZq5NccEvwRB8PUnZT0KsOoDCINS1qQ=="],
+
+    "path-key": ["path-key@3.1.1", "", {}, "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q=="],
+
+    "pathe": ["pathe@1.1.2", "", {}, "sha512-whLdWMYL2TwI08hn8/ZqAbrVemu0LNaNNJZX73O6qaIdCTfXutsLhMkjdENX0qhsQ9uIimo4/aQOmXkoon2nDQ=="],
+
+    "pathval": ["pathval@1.1.1", "", {}, "sha512-Dp6zGqpTdETdR63lehJYPeIOqpiNBNtc7BpWSLrOje7UaIsE5aY92r/AunQA7rsXvet3lrJ3JnZX29UPTKXyKQ=="],
+
+    "picocolors": ["picocolors@1.1.1", "", {}, "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA=="],
+
+    "pkg-types": ["pkg-types@1.3.1", "", { "dependencies": { "confbox": "^0.1.8", "mlly": "^1.7.4", "pathe": "^2.0.1" } }, "sha512-/Jm5M4RvtBFVkKWRu2BLUTNP8/M2a+UwuAX+ae4770q1qVGtfjG+WTCupoZixokjmHiry8uI+dlY8KXYV5HVVQ=="],
+
+    "postcss": ["postcss@8.5.6", "", { "dependencies": { "nanoid": "^3.3.11", "picocolors": "^1.1.1", "source-map-js": "^1.2.1" } }, "sha512-3Ybi1tAuwAP9s0r1UQ2J4n5Y0G05bJkpUIO0/bI9MhwmD70S5aTWbXGBwxHrelT+XM1k6dM0pk+SwNkpTRN7Pg=="],
+
+    "pretty-format": ["pretty-format@29.7.0", "", { "dependencies": { "@jest/schemas": "^29.6.3", "ansi-styles": "^5.0.0", "react-is": "^18.0.0" } }, "sha512-Pdlw/oPxN+aXdmM9R00JVC9WVFoCLTKJvDVLgmJ+qAffBMxsV85l/Lu7sNx4zSzPyoL2euImuEwHhOXdEgNFZQ=="],
+
+    "react-is": ["react-is@18.3.1", "", {}, "sha512-/LLMVyas0ljjAtoYiPqYiL8VWXzUUdThrmU5+n20DZv+a+ClRoevUzw5JxU+Ieh5/c87ytoTBV9G1FiKfNJdmg=="],
+
+    "rollup": ["rollup@4.52.5", "", { "dependencies": { "@types/estree": "1.0.8" }, "optionalDependencies": { "@rollup/rollup-android-arm-eabi": "4.52.5", "@rollup/rollup-android-arm64": "4.52.5", "@rollup/rollup-darwin-arm64": "4.52.5", "@rollup/rollup-darwin-x64": "4.52.5", "@rollup/rollup-freebsd-arm64": "4.52.5", "@rollup/rollup-freebsd-x64": "4.52.5", "@rollup/rollup-linux-arm-gnueabihf": "4.52.5", "@rollup/rollup-linux-arm-musleabihf": "4.52.5", "@rollup/rollup-linux-arm64-gnu": "4.52.5", "@rollup/rollup-linux-arm64-musl": "4.52.5", "@rollup/rollup-linux-loong64-gnu": "4.52.5", "@rollup/rollup-linux-ppc64-gnu": "4.52.5", "@rollup/rollup-linux-riscv64-gnu": "4.52.5", "@rollup/rollup-linux-riscv64-musl": "4.52.5", "@rollup/rollup-linux-s390x-gnu": "4.52.5", "@rollup/rollup-linux-x64-gnu": "4.52.5", "@rollup/rollup-linux-x64-musl": "4.52.5", "@rollup/rollup-openharmony-arm64": "4.52.5", "@rollup/rollup-win32-arm64-msvc": "4.52.5", "@rollup/rollup-win32-ia32-msvc": "4.52.5", "@rollup/rollup-win32-x64-gnu": "4.52.5", "@rollup/rollup-win32-x64-msvc": "4.52.5", "fsevents": "~2.3.2" }, "bin": { "rollup": "dist/bin/rollup" } }, "sha512-3GuObel8h7Kqdjt0gxkEzaifHTqLVW56Y/bjN7PSQtkKr0w3V/QYSdt6QWYtd7A1xUtYQigtdUfgj1RvWVtorw=="],
+
+    "rxjs": ["rxjs@7.8.2", "", { "dependencies": { "tslib": "^2.1.0" } }, "sha512-dhKf903U/PQZY6boNNtAGdWbG85WAbjT/1xYoZIC7FAY0yWapOBQVsVrDl58W86//e1VpMNBtRV4MaXfdMySFA=="],
+
+    "shebang-command": ["shebang-command@2.0.0", "", { "dependencies": { "shebang-regex": "^3.0.0" } }, "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA=="],
+
+    "shebang-regex": ["shebang-regex@3.0.0", "", {}, "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A=="],
+
+    "siginfo": ["siginfo@2.0.0", "", {}, "sha512-ybx0WO1/8bSBLEWXZvEd7gMW3Sn3JFlW3TvX1nREbDLRNQNaeNN8WK0meBwPdAaOI7TtRRRJn/Es1zhrrCHu7g=="],
+
+    "signal-exit": ["signal-exit@4.1.0", "", {}, "sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw=="],
+
+    "source-map-js": ["source-map-js@1.2.1", "", {}, "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA=="],
+
+    "stackback": ["stackback@0.0.2", "", {}, "sha512-1XMJE5fQo1jGH6Y/7ebnwPOBEkIEnT4QF32d5R1+VXdXveM0IBMJt8zfaxX1P3QhVwrYe+576+jkANtSS2mBbw=="],
+
+    "std-env": ["std-env@3.10.0", "", {}, "sha512-5GS12FdOZNliM5mAOxFRg7Ir0pWz8MdpYm6AY6VPkGpbA7ZzmbzNcBJQ0GPvvyWgcY7QAhCgf9Uy89I03faLkg=="],
+
+    "strip-final-newline": ["strip-final-newline@3.0.0", "", {}, "sha512-dOESqjYr96iWYylGObzd39EuNTa5VJxyvVAEm5Jnh7KGo75V43Hk1odPQkNDyXNmUR6k+gEiDVXnjB8HJ3crXw=="],
+
+    "strip-literal": ["strip-literal@2.1.1", "", { "dependencies": { "js-tokens": "^9.0.1" } }, "sha512-631UJ6O00eNGfMiWG78ck80dfBab8X6IVFB51jZK5Icd7XAs60Z5y7QdSd/wGIklnWvRbUNloVzhOKKmutxQ6Q=="],
+
+    "tinybench": ["tinybench@2.9.0", "", {}, "sha512-0+DUvqWMValLmha6lr4kD8iAMK1HzV0/aKnCtWb9v9641TnP/MFb7Pc2bxoxQjTXAErryXVgUOfv2YqNllqGeg=="],
+
+    "tinypool": ["tinypool@0.8.4", "", {}, "sha512-i11VH5gS6IFeLY3gMBQ00/MmLncVP7JLXOw1vlgkytLmJK7QnEr7NXf0LBdxfmNPAeyetukOk0bOYrJrFGjYJQ=="],
+
+    "tinyspy": ["tinyspy@2.2.1", "", {}, "sha512-KYad6Vy5VDWV4GH3fjpseMQ/XU2BhIYP7Vzd0LG44qRWm/Yt2WCOTicFdvmgo6gWaqooMQCawTtILVQJupKu7A=="],
+
+    "tslib": ["tslib@2.8.1", "", {}, "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w=="],
+
+    "type-detect": ["type-detect@4.1.0", "", {}, "sha512-Acylog8/luQ8L7il+geoSxhEkazvkslg7PSNKOX59mbB9cOveP5aq9h74Y7YU8yDpJwetzQQrfIwtf4Wp4LKcw=="],
+
+    "typescript": ["typescript@5.9.3", "", { "bin": { "tsc": "bin/tsc", "tsserver": "bin/tsserver" } }, "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw=="],
+
+    "ufo": ["ufo@1.6.1", "", {}, "sha512-9a4/uxlTWJ4+a5i0ooc1rU7C7YOw3wT+UGqdeNNHWnOF9qcMBgLRS+4IYUqbczewFx4mLEig6gawh7X6mFlEkA=="],
+
+    "undici-types": ["undici-types@6.21.0", "", {}, "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ=="],
+
+    "vite": ["vite@5.4.21", "", { "dependencies": { "esbuild": "^0.21.3", "postcss": "^8.4.43", "rollup": "^4.20.0" }, "optionalDependencies": { "fsevents": "~2.3.3" }, "peerDependencies": { "@types/node": "^18.0.0 || >=20.0.0", "less": "*", "lightningcss": "^1.21.0", "sass": "*", "sass-embedded": "*", "stylus": "*", "sugarss": "*", "terser": "^5.4.0" }, "optionalPeers": ["@types/node", "less", "lightningcss", "sass", "sass-embedded", "stylus", "sugarss", "terser"], "bin": { "vite": "bin/vite.js" } }, "sha512-o5a9xKjbtuhY6Bi5S3+HvbRERmouabWbyUcpXXUA1u+GNUKoROi9byOJ8M0nHbHYHkYICiMlqxkg1KkYmm25Sw=="],
+
+    "vite-node": ["vite-node@1.6.1", "", { "dependencies": { "cac": "^6.7.14", "debug": "^4.3.4", "pathe": "^1.1.1", "picocolors": "^1.0.0", "vite": "^5.0.0" }, "bin": { "vite-node": "vite-node.mjs" } }, "sha512-YAXkfvGtuTzwWbDSACdJSg4A4DZiAqckWe90Zapc/sEX3XvHcw1NdurM/6od8J207tSDqNbSsgdCacBgvJKFuA=="],
+
+    "vitest": ["vitest@1.6.1", "", { "dependencies": { "@vitest/expect": "1.6.1", "@vitest/runner": "1.6.1", "@vitest/snapshot": "1.6.1", "@vitest/spy": "1.6.1", "@vitest/utils": "1.6.1", "acorn-walk": "^8.3.2", "chai": "^4.3.10", "debug": "^4.3.4", "execa": "^8.0.1", "local-pkg": "^0.5.0", "magic-string": "^0.30.5", "pathe": "^1.1.1", "picocolors": "^1.0.0", "std-env": "^3.5.0", "strip-literal": "^2.0.0", "tinybench": "^2.5.1", "tinypool": "^0.8.3", "vite": "^5.0.0", "vite-node": "1.6.1", "why-is-node-running": "^2.2.2" }, "peerDependencies": { "@edge-runtime/vm": "*", "@types/node": "^18.0.0 || >=20.0.0", "@vitest/browser": "1.6.1", "@vitest/ui": "1.6.1", "happy-dom": "*", "jsdom": "*" }, "optionalPeers": ["@edge-runtime/vm", "@types/node", "@vitest/browser", "@vitest/ui", "happy-dom", "jsdom"], "bin": { "vitest": "vitest.mjs" } }, "sha512-Ljb1cnSJSivGN0LqXd/zmDbWEM0RNNg2t1QW/XUhYl/qPqyu7CsqeWtqQXHVaJsecLPuDoak2oJcZN2QoRIOag=="],
+
+    "which": ["which@2.0.2", "", { "dependencies": { "isexe": "^2.0.0" }, "bin": { "node-which": "./bin/node-which" } }, "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA=="],
+
+    "why-is-node-running": ["why-is-node-running@2.3.0", "", { "dependencies": { "siginfo": "^2.0.0", "stackback": "0.0.2" }, "bin": { "why-is-node-running": "cli.js" } }, "sha512-hUrmaWBdVDcxvYqnyh09zunKzROWjbZTiNy8dBEjkS7ehEDQibXJ7XvlmtbwuTclUiIyN+CyXQD4Vmko8fNm8w=="],
+
+    "yocto-queue": ["yocto-queue@1.2.1", "", {}, "sha512-AyeEbWOu/TAXdxlV9wmGcR0+yh2j3vYPGOECcIj2S7MkrLyC7ne+oye2BKTItt0ii2PHk4cDy+95+LshzbXnGg=="],
+
+    "@noble/curves/@noble/hashes": ["@noble/hashes@1.3.2", "", {}, "sha512-MVC8EAQp7MvEcm30KWENFjgR+Mkmf+D189XJTkFIlwohU5hcBbn1ZkKq7KVTi2Hme3PMGF390DaL52beVrIihQ=="],
+
+    "@scure/bip32/@noble/curves": ["@noble/curves@1.1.0", "", { "dependencies": { "@noble/hashes": "1.3.1" } }, "sha512-091oBExgENk/kGj3AZmtBDMpxQPDtxQABR2B9lb1JbVTs6ytdzZNwvhxQ4MWasRNEzlbEH8jCWFCwhF/Obj5AA=="],
+
+    "@scure/bip32/@noble/hashes": ["@noble/hashes@1.3.1", "", {}, "sha512-EbqwksQwz9xDRGfDST86whPBgM65E0OH/pCgqW0GBVzO22bNE+NuIbeTb714+IfSjU3aRk47EUvXIb5bTsenKA=="],
+
+    "@scure/bip32/@scure/base": ["@scure/base@1.1.1", "", {}, "sha512-ZxOhsSyxYwLJj3pLZCefNitxsj093tb2vq90mp2txoYeBqbcjDjqFhyM8eUjq/uFm6zJ+mUuqxlS2FkuSY1MTA=="],
+
+    "@scure/bip39/@noble/hashes": ["@noble/hashes@1.3.1", "", {}, "sha512-EbqwksQwz9xDRGfDST86whPBgM65E0OH/pCgqW0GBVzO22bNE+NuIbeTb714+IfSjU3aRk47EUvXIb5bTsenKA=="],
+
+    "@scure/bip39/@scure/base": ["@scure/base@1.1.1", "", {}, "sha512-ZxOhsSyxYwLJj3pLZCefNitxsj093tb2vq90mp2txoYeBqbcjDjqFhyM8eUjq/uFm6zJ+mUuqxlS2FkuSY1MTA=="],
+
+    "light-bolt11-decoder/@scure/base": ["@scure/base@1.1.1", "", {}, "sha512-ZxOhsSyxYwLJj3pLZCefNitxsj093tb2vq90mp2txoYeBqbcjDjqFhyM8eUjq/uFm6zJ+mUuqxlS2FkuSY1MTA=="],
+
+    "mlly/pathe": ["pathe@2.0.3", "", {}, "sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w=="],
+
+    "nostr-tools/@noble/hashes": ["@noble/hashes@1.3.1", "", {}, "sha512-EbqwksQwz9xDRGfDST86whPBgM65E0OH/pCgqW0GBVzO22bNE+NuIbeTb714+IfSjU3aRk47EUvXIb5bTsenKA=="],
+
+    "nostr-tools/@scure/base": ["@scure/base@1.1.1", "", {}, "sha512-ZxOhsSyxYwLJj3pLZCefNitxsj093tb2vq90mp2txoYeBqbcjDjqFhyM8eUjq/uFm6zJ+mUuqxlS2FkuSY1MTA=="],
+
+    "npm-run-path/path-key": ["path-key@4.0.0", "", {}, "sha512-haREypq7xkM7ErfgIyA0z+Bj4AGKlMSdlQE2jvJo6huWD1EdkKYV+G/T4nq0YEF2vgTT8kqMFKo1uHn950r4SQ=="],
+
+    "pkg-types/pathe": ["pathe@2.0.3", "", {}, "sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w=="],
+
+    "postcss/nanoid": ["nanoid@3.3.11", "", { "bin": { "nanoid": "bin/nanoid.cjs" } }, "sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w=="],
+  }
+}

pkg/protocol/directory-client/client.go

@@ -0,0 +1,120 @@
+// Package directory_client provides a client library for the Distributed
+// Directory Consensus Protocol (NIP-XX).
+//
+// This package offers a high-level API for working with directory events,
+// managing identity resolution, tracking key delegations, and computing
+// trust scores. It builds on the lower-level directory protocol package.
+//
+// # Basic Usage
+//
+//	// Create an identity resolver
+//	resolver := directory_client.NewIdentityResolver()
+//
+//	// Parse and track events
+//	event := getDirectoryEvent()
+//	resolver.ProcessEvent(event)
+//
+//	// Resolve identity behind a delegate key
+//	actualIdentity := resolver.ResolveIdentity(delegateKey)
+//
+//	// Check if a key is a delegate
+//	isDelegate := resolver.IsDelegateKey(pubkey)
+//
+// # Trust Management
+//
+//	// Create a trust calculator
+//	calculator := directory_client.NewTrustCalculator()
+//
+//	// Add trust acts
+//	trustAct := directory.ParseTrustAct(event)
+//	calculator.AddAct(trustAct)
+//
+//	// Calculate aggregate trust score
+//	score := calculator.CalculateTrust(targetPubkey)
+//
+// # Replication Filtering
+//
+//	// Create a replication filter
+//	filter := directory_client.NewReplicationFilter(50) // min trust score of 50
+//
+//	// Add trust acts to influence replication decisions
+//	filter.AddTrustAct(trustAct)
+//
+//	// Check if should replicate from a relay
+//	if filter.ShouldReplicate(relayPubkey) {
+//		// Proceed with replication
+//	}
+//
+// # Event Filtering
+//
+//	// Filter directory events from a stream
+//	events := getEvents()
+//	directoryEvents := directory_client.FilterDirectoryEvents(events)
+//
+//	// Check if an event is a directory event
+//	if directory_client.IsDirectoryEvent(event) {
+//		// Handle directory event
+//	}
+package directory_client
+
+import (
+	"lol.mleku.dev/errorf"
+	"next.orly.dev/pkg/encoders/event"
+	"next.orly.dev/pkg/protocol/directory"
+)
+
+// IsDirectoryEvent checks if an event is a directory consensus event.
+func IsDirectoryEvent(ev *event.E) bool {
+	if ev == nil {
+		return false
+	}
+	k := uint16(ev.Kind)
+	return k == 39100 || k == 39101 || k == 39102 ||
+		k == 39103 || k == 39104 || k == 39105
+}
+
+// FilterDirectoryEvents filters a slice of events to only directory events.
+func FilterDirectoryEvents(events []*event.E) (filtered []*event.E) {
+	filtered = make([]*event.E, 0)
+	for _, ev := range events {
+		if IsDirectoryEvent(ev) {
+			filtered = append(filtered, ev)
+		}
+	}
+	return
+}
+
+// NormalizeRelayURL ensures a relay URL has the canonical format with trailing slash.
+func NormalizeRelayURL(url string) string {
+	if url == "" {
+		return ""
+	}
+	if url[len(url)-1] != '/' {
+		return url + "/"
+	}
+	return url
+}
+
+// ParseDirectoryEvent parses any directory event based on its kind.
+func ParseDirectoryEvent(ev *event.E) (parsed interface{}, err error) {
+	if !IsDirectoryEvent(ev) {
+		return nil, errorf.E("not a directory event: kind %d", uint16(ev.Kind))
+	}
+
+	switch uint16(ev.Kind) {
+	case 39100:
+		return directory.ParseRelayIdentityAnnouncement(ev)
+	case 39101:
+		return directory.ParseTrustAct(ev)
+	case 39102:
+		return directory.ParseGroupTagAct(ev)
+	case 39103:
+		return directory.ParsePublicKeyAdvertisement(ev)
+	case 39104:
+		return directory.ParseDirectoryEventReplicationRequest(ev)
+	case 39105:
+		return directory.ParseDirectoryEventReplicationResponse(ev)
+	default:
+		return nil, errorf.E("unknown directory event kind: %d", uint16(ev.Kind))
+	}
+}

pkg/protocol/directory-client/doc.go

@@ -0,0 +1,160 @@
+// Package directory_client provides a high-level client API for the
+// Distributed Directory Consensus Protocol (NIP-XX).
+//
+// # Overview
+//
+// This package builds on top of the lower-level directory protocol package
+// to provide convenient utilities for:
+//
+//   - Identity resolution and key delegation tracking
+//   - Trust score calculation and aggregation
+//   - Replication filtering based on trust relationships
+//   - Event collection and filtering
+//   - Trust graph construction and analysis
+//
+// # Architecture
+//
+// The client library consists of several main components:
+//
+// **IdentityResolver**: Tracks mappings between delegate keys and primary
+// identities, enabling resolution of the actual identity behind any signing
+// key. It processes Identity Tags (I tags) from events and maintains a cache
+// of delegation relationships.
+//
+// **TrustCalculator**: Computes aggregate trust scores from multiple trust
+// acts using a weighted average approach. Trust levels (high/medium/low) are
+// mapped to numeric weights and non-expired acts are combined to produce
+// an overall trust score.
+//
+// **ReplicationFilter**: Uses trust scores to determine which relays should
+// be trusted for event replication. It maintains a set of trusted relays
+// based on a configurable minimum trust score threshold.
+//
+// **EventCollector**: Provides convenient methods to extract and parse
+// specific types of directory events from a collection.
+//
+// **TrustGraph**: Represents trust relationships as a directed graph,
+// enabling analysis of trust networks and transitive trust paths.
+//
+// # Thread Safety
+//
+// All components are thread-safe and can be used concurrently from multiple
+// goroutines. Internal state is protected by read-write mutexes.
+//
+// # Example: Identity Resolution
+//
+//	resolver := directory_client.NewIdentityResolver()
+//
+//	// Process events to build identity mappings
+//	for _, event := range events {
+//		resolver.ProcessEvent(event)
+//	}
+//
+//	// Resolve identity behind a delegate key
+//	actualIdentity := resolver.ResolveIdentity(delegateKey)
+//
+//	// Check delegation status
+//	if resolver.IsDelegateKey(pubkey) {
+//		tag, _ := resolver.GetIdentityTag(pubkey)
+//		fmt.Printf("Delegate %s belongs to identity %s\n",
+//			pubkey, tag.Identity)
+//	}
+//
+// # Example: Trust Management
+//
+//	calculator := directory_client.NewTrustCalculator()
+//
+//	// Add trust acts
+//	for _, event := range trustEvents {
+//		if act, err := directory.ParseTrustAct(event); err == nil {
+//			calculator.AddAct(act)
+//		}
+//	}
+//
+//	// Calculate trust score
+//	score := calculator.CalculateTrust(targetPubkey)
+//	fmt.Printf("Trust score: %.1f\n", score)
+//
+// # Example: Replication Filtering
+//
+//	// Create filter with minimum trust score of 50
+//	filter := directory_client.NewReplicationFilter(50)
+//
+//	// Add trust acts to influence decisions
+//	for _, act := range trustActs {
+//		filter.AddTrustAct(act)
+//	}
+//
+//	// Check if should replicate from a relay
+//	if filter.ShouldReplicate(relayPubkey) {
+//		// Proceed with replication
+//		events := fetchEventsFromRelay(relayPubkey)
+//		// ...
+//	}
+//
+// # Example: Event Collection
+//
+//	collector := directory_client.NewEventCollector(events)
+//
+//	// Extract specific event types
+//	identities := collector.RelayIdentities()
+//	trustActs := collector.TrustActs()
+//	keyAds := collector.PublicKeyAdvertisements()
+//
+//	// Find specific events
+//	if identity, found := directory_client.FindRelayIdentity(
+//		events, "wss://relay.example.com/"); found {
+//		fmt.Printf("Found relay identity: %s\n", identity.RelayURL)
+//	}
+//
+// # Example: Trust Graph Analysis
+//
+//	graph := directory_client.BuildTrustGraph(events)
+//
+//	// Find who trusts a specific relay
+//	trustedBy := graph.GetTrustedBy(targetPubkey)
+//	fmt.Printf("Trusted by %d relays\n", len(trustedBy))
+//
+//	// Find who a relay trusts
+//	targets := graph.GetTrustTargets(sourcePubkey)
+//	fmt.Printf("Trusts %d relays\n", len(targets))
+//
+// # Integration with Directory Protocol
+//
+// This package is designed to work seamlessly with the lower-level
+// directory protocol package (next.orly.dev/pkg/protocol/directory).
+// Use the protocol package for:
+//
+//   - Parsing individual directory events
+//   - Creating new directory events
+//   - Validating event structure
+//   - Working with event content and tags
+//
+// Use the client package for:
+//
+//   - Managing collections of events
+//   - Tracking identity relationships
+//   - Computing trust metrics
+//   - Filtering events for replication
+//   - Analyzing trust networks
+//
+// # Performance Considerations
+//
+// The IdentityResolver maintains in-memory caches of identity mappings.
+// For large numbers of identities and delegates, memory usage will grow
+// proportionally. Use ClearCache() if you need to free memory.
+//
+// The TrustCalculator stores all trust acts in memory. For long-running
+// applications processing many trust acts, consider periodically clearing
+// expired acts or implementing a sliding window approach.
+//
+// # Related Documentation
+//
+// See the NIP-XX specification for details on the protocol:
+//
+//	docs/NIP-XX-distributed-directory-consensus.md
+//
+// See the directory protocol package for low-level event handling:
+//
+//	pkg/protocol/directory/
+package directory_client

pkg/protocol/directory-client/helpers.go

@@ -0,0 +1,227 @@
+package directory_client
+
+import (
+	"next.orly.dev/pkg/encoders/event"
+	"next.orly.dev/pkg/protocol/directory"
+)
+
+// EventCollector provides utility methods for collecting specific types of
+// directory events from a slice.
+type EventCollector struct {
+	events []*event.E
+}
+
+// NewEventCollector creates a new event collector for the given events.
+func NewEventCollector(events []*event.E) *EventCollector {
+	return &EventCollector{events: events}
+}
+
+// RelayIdentities returns all relay identity declarations.
+func (ec *EventCollector) RelayIdentities() (identities []*directory.RelayIdentityAnnouncement) {
+	identities = make([]*directory.RelayIdentityAnnouncement, 0)
+	for _, ev := range ec.events {
+		if uint16(ev.Kind) == 39100 {
+			if identity, err := directory.ParseRelayIdentityAnnouncement(ev); err == nil {
+				identities = append(identities, identity)
+			}
+		}
+	}
+	return
+}
+
+// TrustActs returns all trust acts.
+func (ec *EventCollector) TrustActs() (acts []*directory.TrustAct) {
+	acts = make([]*directory.TrustAct, 0)
+	for _, ev := range ec.events {
+		if uint16(ev.Kind) == 39101 {
+			if act, err := directory.ParseTrustAct(ev); err == nil {
+				acts = append(acts, act)
+			}
+		}
+	}
+	return
+}
+
+// GroupTagActs returns all group tag acts.
+func (ec *EventCollector) GroupTagActs() (acts []*directory.GroupTagAct) {
+	acts = make([]*directory.GroupTagAct, 0)
+	for _, ev := range ec.events {
+		if uint16(ev.Kind) == 39102 {
+			if act, err := directory.ParseGroupTagAct(ev); err == nil {
+				acts = append(acts, act)
+			}
+		}
+	}
+	return
+}
+
+// PublicKeyAdvertisements returns all public key advertisements.
+func (ec *EventCollector) PublicKeyAdvertisements() (ads []*directory.PublicKeyAdvertisement) {
+	ads = make([]*directory.PublicKeyAdvertisement, 0)
+	for _, ev := range ec.events {
+		if uint16(ev.Kind) == 39103 {
+			if ad, err := directory.ParsePublicKeyAdvertisement(ev); err == nil {
+				ads = append(ads, ad)
+			}
+		}
+	}
+	return
+}
+
+// ReplicationRequests returns all replication requests.
+func (ec *EventCollector) ReplicationRequests() (requests []*directory.DirectoryEventReplicationRequest) {
+	requests = make([]*directory.DirectoryEventReplicationRequest, 0)
+	for _, ev := range ec.events {
+		if uint16(ev.Kind) == 39104 {
+			if req, err := directory.ParseDirectoryEventReplicationRequest(ev); err == nil {
+				requests = append(requests, req)
+			}
+		}
+	}
+	return
+}
+
+// ReplicationResponses returns all replication responses.
+func (ec *EventCollector) ReplicationResponses() (responses []*directory.DirectoryEventReplicationResponse) {
+	responses = make([]*directory.DirectoryEventReplicationResponse, 0)
+	for _, ev := range ec.events {
+		if uint16(ev.Kind) == 39105 {
+			if resp, err := directory.ParseDirectoryEventReplicationResponse(ev); err == nil {
+				responses = append(responses, resp)
+			}
+		}
+	}
+	return
+}
+
+// FindRelayIdentity finds a relay identity by relay URL.
+func FindRelayIdentity(events []*event.E, relayURL string) (*directory.RelayIdentityAnnouncement, bool) {
+	normalizedURL := NormalizeRelayURL(relayURL)
+	for _, ev := range events {
+		if uint16(ev.Kind) == 39100 {
+			if identity, err := directory.ParseRelayIdentityAnnouncement(ev); err == nil {
+				if NormalizeRelayURL(identity.RelayURL) == normalizedURL {
+					return identity, true
+				}
+			}
+		}
+	}
+	return nil, false
+}
+
+// FindTrustActsForRelay finds all trust acts targeting a specific relay.
+func FindTrustActsForRelay(events []*event.E, targetPubkey string) (acts []*directory.TrustAct) {
+	acts = make([]*directory.TrustAct, 0)
+	for _, ev := range events {
+		if uint16(ev.Kind) == 39101 {
+			if act, err := directory.ParseTrustAct(ev); err == nil {
+				if act.TargetPubkey == targetPubkey {
+					acts = append(acts, act)
+				}
+			}
+		}
+	}
+	return
+}
+
+// FindGroupTagActsForRelay finds all group tag acts targeting a specific relay.
+// Note: This function needs to be updated based on the actual GroupTagAct structure
+// which doesn't have a Target field. The filtering logic should be clarified.
+func FindGroupTagActsForRelay(events []*event.E, targetPubkey string) (acts []*directory.GroupTagAct) {
+	acts = make([]*directory.GroupTagAct, 0)
+	for _, ev := range events {
+		if uint16(ev.Kind) == 39102 {
+			if act, err := directory.ParseGroupTagAct(ev); err == nil {
+				// Filter by actor since GroupTagAct doesn't have a Target field
+				if act.Actor == targetPubkey {
+					acts = append(acts, act)
+				}
+			}
+		}
+	}
+	return
+}
+
+// FindGroupTagActsByGroup finds all group tag acts for a specific group.
+func FindGroupTagActsByGroup(events []*event.E, groupID string) (acts []*directory.GroupTagAct) {
+	acts = make([]*directory.GroupTagAct, 0)
+	for _, ev := range events {
+		if uint16(ev.Kind) == 39102 {
+			if act, err := directory.ParseGroupTagAct(ev); err == nil {
+				if act.GroupID == groupID {
+					acts = append(acts, act)
+				}
+			}
+		}
+	}
+	return
+}
+
+// TrustGraph represents a directed graph of trust relationships.
+type TrustGraph struct {
+	// edges maps source pubkey -> list of trust acts
+	edges map[string][]*directory.TrustAct
+}
+
+// NewTrustGraph creates a new trust graph instance.
+func NewTrustGraph() *TrustGraph {
+	return &TrustGraph{
+		edges: make(map[string][]*directory.TrustAct),
+	}
+}
+
+// AddTrustAct adds a trust act to the graph.
+func (tg *TrustGraph) AddTrustAct(act *directory.TrustAct) {
+	if act == nil {
+		return
+	}
+	source := string(act.Event.Pubkey)
+	tg.edges[source] = append(tg.edges[source], act)
+}
+
+// GetTrustActs returns all trust acts from a source pubkey.
+func (tg *TrustGraph) GetTrustActs(source string) []*directory.TrustAct {
+	return tg.edges[source]
+}
+
+// GetTrustedBy returns all pubkeys that trust the given target.
+func (tg *TrustGraph) GetTrustedBy(target string) []string {
+	trustedBy := make([]string, 0)
+	for source, acts := range tg.edges {
+		for _, act := range acts {
+			if act.TargetPubkey == target {
+				trustedBy = append(trustedBy, source)
+				break
+			}
+		}
+	}
+	return trustedBy
+}
+
+// GetTrustTargets returns all pubkeys trusted by the given source.
+func (tg *TrustGraph) GetTrustTargets(source string) []string {
+	acts := tg.edges[source]
+	targets := make(map[string]bool)
+	for _, act := range acts {
+		targets[act.TargetPubkey] = true
+	}
+
+	result := make([]string, 0, len(targets))
+	for target := range targets {
+		result = append(result, target)
+	}
+	return result
+}
+
+// BuildTrustGraph builds a trust graph from a collection of events.
+func BuildTrustGraph(events []*event.E) *TrustGraph {
+	graph := NewTrustGraph()
+	for _, ev := range events {
+		if uint16(ev.Kind) == 39101 {
+			if act, err := directory.ParseTrustAct(ev); err == nil {
+				graph.AddTrustAct(act)
+			}
+		}
+	}
+	return graph
+}

pkg/protocol/directory-client/identity_resolver.go

@@ -0,0 +1,268 @@
+package directory_client
+
+import (
+	"sync"
+
+	"lol.mleku.dev/errorf"
+	"next.orly.dev/pkg/encoders/event"
+	"next.orly.dev/pkg/protocol/directory"
+)
+
+// IdentityResolver manages identity resolution and key delegation tracking.
+//
+// It maintains mappings between delegate keys and their primary identities,
+// enabling clients to resolve the actual identity behind any signing key.
+type IdentityResolver struct {
+	mu sync.RWMutex
+
+	// delegateToIdentity maps delegate public keys to their primary identity
+	delegateToIdentity map[string]string
+
+	// identityToDelegates maps primary identities to their delegate keys
+	identityToDelegates map[string]map[string]bool
+
+	// identityTagCache stores full identity tags by delegate key
+	identityTagCache map[string]*directory.IdentityTag
+
+	// publicKeyAds stores public key advertisements by key ID
+	publicKeyAds map[string]*directory.PublicKeyAdvertisement
+}
+
+// NewIdentityResolver creates a new identity resolver instance.
+func NewIdentityResolver() *IdentityResolver {
+	return &IdentityResolver{
+		delegateToIdentity:  make(map[string]string),
+		identityToDelegates: make(map[string]map[string]bool),
+		identityTagCache:    make(map[string]*directory.IdentityTag),
+		publicKeyAds:        make(map[string]*directory.PublicKeyAdvertisement),
+	}
+}
+
+// ProcessEvent processes an event to extract and cache identity information.
+//
+// This should be called for all directory events to keep the resolver's
+// internal state up to date.
+func (r *IdentityResolver) ProcessEvent(ev *event.E) {
+	if ev == nil {
+		return
+	}
+
+	// Try to parse identity tag (I tag)
+	identityTag := extractIdentityTag(ev)
+	if identityTag != nil {
+		r.cacheIdentityTag(identityTag)
+	}
+
+	// Handle public key advertisements specially
+	if uint16(ev.Kind) == 39103 {
+		if keyAd, err := directory.ParsePublicKeyAdvertisement(ev); err == nil {
+			r.mu.Lock()
+			r.publicKeyAds[keyAd.KeyID] = keyAd
+			r.mu.Unlock()
+		}
+	}
+}
+
+// extractIdentityTag extracts an identity tag from an event if present.
+func extractIdentityTag(ev *event.E) *directory.IdentityTag {
+	if ev == nil || ev.Tags == nil {
+		return nil
+	}
+
+	// Find the I tag
+	for _, t := range *ev.Tags {
+		if t != nil && len(t.T) > 0 && string(t.T[0]) == "I" {
+			if identityTag, err := directory.ParseIdentityTag(t); err == nil {
+				return identityTag
+			}
+		}
+	}
+	return nil
+}
+
+// cacheIdentityTag caches an identity tag mapping.
+func (r *IdentityResolver) cacheIdentityTag(tag *directory.IdentityTag) {
+	if tag == nil {
+		return
+	}
+
+	r.mu.Lock()
+	defer r.mu.Unlock()
+
+	identity := tag.NPubIdentity
+	// For now, we use the identity as the delegate too since the structure is different
+	// This should be updated when the IdentityTag structure is clarified
+	delegate := identity
+
+	// Store delegate -> identity mapping
+	r.delegateToIdentity[delegate] = identity
+
+	// Store identity -> delegates mapping
+	if r.identityToDelegates[identity] == nil {
+		r.identityToDelegates[identity] = make(map[string]bool)
+	}
+	r.identityToDelegates[identity][delegate] = true
+
+	// Cache the full tag
+	r.identityTagCache[delegate] = tag
+}
+
+// ResolveIdentity resolves the actual identity behind a public key.
+//
+// If the public key is a delegate, it returns the primary identity.
+// If the public key is already an identity, it returns the input unchanged.
+func (r *IdentityResolver) ResolveIdentity(pubkey string) string {
+	r.mu.RLock()
+	defer r.mu.RUnlock()
+
+	if identity, ok := r.delegateToIdentity[pubkey]; ok {
+		return identity
+	}
+	return pubkey
+}
+
+// ResolveEventIdentity resolves the actual identity behind an event's pubkey.
+func (r *IdentityResolver) ResolveEventIdentity(ev *event.E) string {
+	if ev == nil {
+		return ""
+	}
+	return r.ResolveIdentity(string(ev.Pubkey))
+}
+
+// IsDelegateKey checks if a public key is a known delegate.
+func (r *IdentityResolver) IsDelegateKey(pubkey string) bool {
+	r.mu.RLock()
+	defer r.mu.RUnlock()
+
+	_, ok := r.delegateToIdentity[pubkey]
+	return ok
+}
+
+// IsIdentityKey checks if a public key is a known identity (has delegates).
+func (r *IdentityResolver) IsIdentityKey(pubkey string) bool {
+	r.mu.RLock()
+	defer r.mu.RUnlock()
+
+	delegates, ok := r.identityToDelegates[pubkey]
+	return ok && len(delegates) > 0
+}
+
+// GetDelegatesForIdentity returns all delegate keys for a given identity.
+func (r *IdentityResolver) GetDelegatesForIdentity(identity string) (delegates []string) {
+	r.mu.RLock()
+	defer r.mu.RUnlock()
+
+	delegateMap, ok := r.identityToDelegates[identity]
+	if !ok {
+		return []string{}
+	}
+
+	delegates = make([]string, 0, len(delegateMap))
+	for delegate := range delegateMap {
+		delegates = append(delegates, delegate)
+	}
+	return
+}
+
+// GetIdentityTag returns the identity tag for a delegate key.
+func (r *IdentityResolver) GetIdentityTag(delegate string) (*directory.IdentityTag, error) {
+	r.mu.RLock()
+	defer r.mu.RUnlock()
+
+	tag, ok := r.identityTagCache[delegate]
+	if !ok {
+		return nil, errorf.E("identity tag not found for delegate: %s", delegate)
+	}
+	return tag, nil
+}
+
+// GetPublicKeyAdvertisements returns all public key advertisements for an identity.
+func (r *IdentityResolver) GetPublicKeyAdvertisements(identity string) (ads []*directory.PublicKeyAdvertisement) {
+	r.mu.RLock()
+	defer r.mu.RUnlock()
+
+	delegates := r.identityToDelegates[identity]
+	ads = make([]*directory.PublicKeyAdvertisement, 0)
+
+	for _, keyAd := range r.publicKeyAds {
+		adIdentity := r.delegateToIdentity[string(keyAd.Event.Pubkey)]
+		if adIdentity == "" {
+			adIdentity = string(keyAd.Event.Pubkey)
+		}
+
+		if adIdentity == identity {
+			ads = append(ads, keyAd)
+			continue
+		}
+
+		// Check if the advertised key is a delegate
+		if delegates != nil && delegates[keyAd.PublicKey] {
+			ads = append(ads, keyAd)
+		}
+	}
+
+	return
+}
+
+// GetPublicKeyAdvertisementByID returns a public key advertisement by key ID.
+func (r *IdentityResolver) GetPublicKeyAdvertisementByID(keyID string) (*directory.PublicKeyAdvertisement, error) {
+	r.mu.RLock()
+	defer r.mu.RUnlock()
+
+	keyAd, ok := r.publicKeyAds[keyID]
+	if !ok {
+		return nil, errorf.E("public key advertisement not found: %s", keyID)
+	}
+	return keyAd, nil
+}
+
+// FilterEventsByIdentity filters events to only those signed by a specific identity or its delegates.
+func (r *IdentityResolver) FilterEventsByIdentity(events []*event.E, identity string) (filtered []*event.E) {
+	r.mu.RLock()
+	delegates := r.identityToDelegates[identity]
+	r.mu.RUnlock()
+
+	filtered = make([]*event.E, 0)
+	for _, ev := range events {
+		pubkey := string(ev.Pubkey)
+		if pubkey == identity {
+			filtered = append(filtered, ev)
+			continue
+		}
+		if delegates != nil && delegates[pubkey] {
+			filtered = append(filtered, ev)
+		}
+	}
+
+	return
+}
+
+// ClearCache clears all cached identity mappings.
+func (r *IdentityResolver) ClearCache() {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+
+	r.delegateToIdentity = make(map[string]string)
+	r.identityToDelegates = make(map[string]map[string]bool)
+	r.identityTagCache = make(map[string]*directory.IdentityTag)
+	r.publicKeyAds = make(map[string]*directory.PublicKeyAdvertisement)
+}
+
+// Stats returns statistics about tracked identities and delegates.
+type Stats struct {
+	Identities   int // Number of primary identities
+	Delegates    int // Number of delegate keys
+	PublicKeyAds int // Number of public key advertisements
+}
+
+// GetStats returns statistics about the resolver's state.
+func (r *IdentityResolver) GetStats() Stats {
+	r.mu.RLock()
+	defer r.mu.RUnlock()
+
+	return Stats{
+		Identities:   len(r.identityToDelegates),
+		Delegates:    len(r.delegateToIdentity),
+		PublicKeyAds: len(r.publicKeyAds),
+	}
+}

pkg/protocol/directory-client/package.json

@@ -0,0 +1,43 @@
+{
+  "name": "@orly/directory-client",
+  "version": "0.1.0",
+  "description": "TypeScript client library for Nostr Distributed Directory Consensus Protocol",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch",
+    "test": "vitest",
+    "lint": "eslint src/**/*.ts"
+  },
+  "keywords": [
+    "nostr",
+    "directory",
+    "consensus",
+    "relay",
+    "identity",
+    "delegation"
+  ],
+  "author": "",
+  "license": "MIT",
+  "dependencies": {
+    "applesauce-core": "^3.0.0",
+    "rxjs": "^7.8.1"
+  },
+  "devDependencies": {
+    "@types/node": "^20.0.0",
+    "typescript": "^5.3.0",
+    "vitest": "^1.0.0"
+  },
+  "peerDependencies": {
+    "applesauce-core": "^3.0.0"
+  }
+}
+

pkg/protocol/directory-client/src/helpers.ts

@@ -0,0 +1,282 @@
+/**
+ * Helper utilities for the Directory Consensus Protocol
+ */
+
+import type { NostrEvent } from 'applesauce-core/helpers';
+import type { EventStore } from 'applesauce-core';
+import type {
+  RelayIdentity,
+  TrustAct,
+  GroupTagAct,
+  TrustLevel,
+} from './types.js';
+import { EventKinds } from './types.js';
+import {
+  parseRelayIdentity,
+  parseTrustAct,
+  parseGroupTagAct,
+} from './parsers.js';
+import { Observable, combineLatest, map } from 'rxjs';
+
+/**
+ * Trust calculator for computing aggregate trust scores
+ */
+export class TrustCalculator {
+  private acts: Map<string, TrustAct[]> = new Map();
+
+  /**
+   * Add a trust act to the calculator
+   */
+  public addAct(act: TrustAct): void {
+    const key = act.targetPubkey;
+    if (!this.acts.has(key)) {
+      this.acts.set(key, []);
+    }
+    this.acts.get(key)!.push(act);
+  }
+
+  /**
+   * Calculate aggregate trust score for a pubkey
+   * 
+   * @param pubkey - The public key to calculate trust for
+   * @returns Numeric trust score (0-100)
+   */
+  public calculateTrust(pubkey: string): number {
+    const acts = this.acts.get(pubkey) || [];
+    if (acts.length === 0) return 0;
+
+    // Simple weighted average: high=100, medium=50, low=25
+    const weights: Record<TrustLevel, number> = {
+      [TrustLevel.High]: 100,
+      [TrustLevel.Medium]: 50,
+      [TrustLevel.Low]: 25,
+    };
+
+    let total = 0;
+    let count = 0;
+
+    for (const act of acts) {
+      // Skip expired acts
+      if (act.expiry && act.expiry < new Date()) {
+        continue;
+      }
+
+      total += weights[act.trustLevel];
+      count++;
+    }
+
+    return count > 0 ? total / count : 0;
+  }
+
+  /**
+   * Get all acts for a pubkey
+   */
+  public getActs(pubkey: string): TrustAct[] {
+    return this.acts.get(pubkey) || [];
+  }
+
+  /**
+   * Clear all acts
+   */
+  public clear(): void {
+    this.acts.clear();
+  }
+}
+
+/**
+ * Replication filter for managing which events to replicate
+ */
+export class ReplicationFilter {
+  private trustedRelays: Set<string> = new Set();
+  private trustCalculator: TrustCalculator;
+  private minTrustScore: number;
+
+  constructor(minTrustScore = 50) {
+    this.trustCalculator = new TrustCalculator();
+    this.minTrustScore = minTrustScore;
+  }
+
+  /**
+   * Add a trust act to influence replication decisions
+   */
+  public addTrustAct(act: TrustAct): void {
+    this.trustCalculator.addAct(act);
+    
+    // Update trusted relays based on trust score
+    const score = this.trustCalculator.calculateTrust(act.targetPubkey);
+    if (score >= this.minTrustScore) {
+      this.trustedRelays.add(act.targetPubkey);
+    } else {
+      this.trustedRelays.delete(act.targetPubkey);
+    }
+  }
+
+  /**
+   * Check if a relay is trusted enough for replication
+   */
+  public shouldReplicate(pubkey: string): boolean {
+    return this.trustedRelays.has(pubkey);
+  }
+
+  /**
+   * Get all trusted relay pubkeys
+   */
+  public getTrustedRelays(): string[] {
+    return Array.from(this.trustedRelays);
+  }
+
+  /**
+   * Get trust score for a relay
+   */
+  public getTrustScore(pubkey: string): number {
+    return this.trustCalculator.calculateTrust(pubkey);
+  }
+}
+
+/**
+ * Helper to find all relay identities in an event store
+ */
+export function findRelayIdentities(eventStore: EventStore): Observable<RelayIdentity[]> {
+  return eventStore.stream({ kinds: [EventKinds.RelayIdentityAnnouncement] }).pipe(
+    map(events => {
+      const identities: RelayIdentity[] = [];
+      for (const event of events as any) {
+        try {
+          identities.push(parseRelayIdentity(event));
+        } catch (err) {
+          // Skip invalid events
+          console.warn('Invalid relay identity:', err);
+        }
+      }
+      return identities;
+    })
+  );
+}
+
+/**
+ * Helper to find all trust acts for a specific relay
+ */
+export function findTrustActsForRelay(
+  eventStore: EventStore,
+  targetPubkey: string
+): Observable<TrustAct[]> {
+  return eventStore.stream({ kinds: [EventKinds.TrustAct] }).pipe(
+    map(events => {
+      const acts: TrustAct[] = [];
+      for (const event of events as any) {
+        try {
+          const act = parseTrustAct(event);
+          if (act.targetPubkey === targetPubkey) {
+            acts.push(act);
+          }
+        } catch (err) {
+          // Skip invalid events
+          console.warn('Invalid trust act:', err);
+        }
+      }
+      return acts;
+    })
+  );
+}
+
+/**
+ * Helper to find all group tag acts for a specific relay
+ */
+export function findGroupTagActsForRelay(
+  eventStore: EventStore,
+  targetPubkey: string
+): Observable<GroupTagAct[]> {
+  return eventStore.stream({ kinds: [EventKinds.GroupTagAct] }).pipe(
+    map(events => {
+      const acts: GroupTagAct[] = [];
+      for (const event of events as any) {
+        try {
+          const act = parseGroupTagAct(event);
+          if (act.targetPubkey === targetPubkey) {
+            acts.push(act);
+          }
+        } catch (err) {
+          // Skip invalid events
+          console.warn('Invalid group tag act:', err);
+        }
+      }
+      return acts;
+    })
+  );
+}
+
+/**
+ * Helper to build a trust graph from an event store
+ */
+export function buildTrustGraph(eventStore: EventStore): Observable<Map<string, TrustAct[]>> {
+  return eventStore.stream({ kinds: [EventKinds.TrustAct] }).pipe(
+    map(events => {
+      const graph = new Map<string, TrustAct[]>();
+      for (const event of events as any) {
+        try {
+          const act = parseTrustAct(event);
+          const source = event.pubkey;
+          if (!graph.has(source)) {
+            graph.set(source, []);
+          }
+          graph.get(source)!.push(act);
+        } catch (err) {
+          // Skip invalid events
+          console.warn('Invalid trust act:', err);
+        }
+      }
+      return graph;
+    })
+  );
+}
+
+/**
+ * Helper to check if an event is a directory event
+ */
+export function isDirectoryEvent(event: NostrEvent): boolean {
+  return Object.values(EventKinds).includes(event.kind as any);
+}
+
+/**
+ * Helper to filter directory events from a stream
+ */
+export function filterDirectoryEvents(eventStore: EventStore): Observable<NostrEvent> {
+  return eventStore.stream({ kinds: Object.values(EventKinds) });
+}
+
+/**
+ * Format a relay URL to canonical format (with trailing slash)
+ */
+export function normalizeRelayURL(url: string): string {
+  const trimmed = url.trim();
+  return trimmed.endsWith('/') ? trimmed : `${trimmed}/`;
+}
+
+/**
+ * Extract relay URL from a NIP-11 URL
+ */
+export function extractRelayURL(nip11URL: string): string {
+  try {
+    const url = new URL(nip11URL);
+    // Convert http(s) to ws(s)
+    const protocol = url.protocol === 'https:' ? 'wss:' : 'ws:';
+    return normalizeRelayURL(`${protocol}//${url.host}${url.pathname}`);
+  } catch (err) {
+    throw new Error(`Invalid NIP-11 URL: ${nip11URL}`);
+  }
+}
+
+/**
+ * Create a NIP-11 URL from a relay WebSocket URL
+ */
+export function createNIP11URL(relayURL: string): string {
+  try {
+    const url = new URL(relayURL);
+    // Convert ws(s) to http(s)
+    const protocol = url.protocol === 'wss:' ? 'https:' : 'http:';
+    return `${protocol}//${url.host}${url.pathname}`;
+  } catch (err) {
+    throw new Error(`Invalid relay URL: ${relayURL}`);
+  }
+}
+

pkg/protocol/directory-client/src/identity-resolver.ts

@@ -0,0 +1,287 @@
+/**
+ * Identity Resolution for Directory Consensus Protocol
+ * 
+ * This module provides functionality to resolve actual identities behind
+ * delegate keys and manage key delegations.
+ */
+
+import type { EventStore } from 'applesauce-core';
+import type { NostrEvent } from 'applesauce-core/helpers';
+import type { IdentityTag, PublicKeyAdvertisement } from './types.js';
+import { EventKinds } from './types.js';
+import { parseIdentityTag, parsePublicKeyAdvertisement } from './parsers.js';
+import { ValidationError } from './validation.js';
+import { Observable, combineLatest, map, startWith } from 'rxjs';
+
+/**
+ * Manages identity resolution and key delegation tracking
+ */
+export class IdentityResolver {
+  private eventStore: EventStore;
+  private delegateToIdentity: Map<string, string> = new Map();
+  private identityToDelegates: Map<string, Set<string>> = new Map();
+  private identityTagCache: Map<string, IdentityTag> = new Map();
+  private publicKeyAds: Map<string, PublicKeyAdvertisement> = new Map();
+
+  constructor(eventStore: EventStore) {
+    this.eventStore = eventStore;
+    this.initializeTracking();
+  }
+
+  /**
+   * Initialize tracking of identity tags and key delegations
+   */
+  private initializeTracking(): void {
+    // Track all events with I tags
+    this.eventStore.stream({ kinds: Object.values(EventKinds) }).subscribe(event => {
+      this.processEvent(event);
+    });
+
+    // Track Public Key Advertisements (kind 39103)
+    this.eventStore.stream({ kinds: [EventKinds.PublicKeyAdvertisement] }).subscribe(event => {
+      try {
+        const keyAd = parsePublicKeyAdvertisement(event);
+        this.publicKeyAds.set(keyAd.keyID, keyAd);
+      } catch (err) {
+        // Ignore invalid events
+        console.warn('Invalid public key advertisement:', err);
+      }
+    });
+  }
+
+  /**
+   * Process an event to extract and cache identity information
+   */
+  private processEvent(event: NostrEvent): void {
+    try {
+      const identityTag = parseIdentityTag(event);
+      if (identityTag) {
+        this.cacheIdentityTag(identityTag);
+      }
+    } catch (err) {
+      // Event doesn't have a valid I tag or parsing failed
+    }
+  }
+
+  /**
+   * Cache an identity tag mapping
+   */
+  private cacheIdentityTag(tag: IdentityTag): void {
+    const { identity, delegate } = tag;
+    
+    // Store delegate -> identity mapping
+    this.delegateToIdentity.set(delegate, identity);
+    
+    // Store identity -> delegates mapping
+    if (!this.identityToDelegates.has(identity)) {
+      this.identityToDelegates.set(identity, new Set());
+    }
+    this.identityToDelegates.get(identity)!.add(delegate);
+    
+    // Cache the full tag
+    this.identityTagCache.set(delegate, tag);
+  }
+
+  /**
+   * Resolve the actual identity behind a public key (which may be a delegate)
+   * 
+   * @param pubkey - The public key to resolve (may be delegate or identity)
+   * @returns The actual identity public key, or the input if it's already an identity
+   */
+  public resolveIdentity(pubkey: string): string {
+    return this.delegateToIdentity.get(pubkey) || pubkey;
+  }
+
+  /**
+   * Resolve the actual identity behind an event's pubkey
+   * 
+   * @param event - The event to resolve
+   * @returns The actual identity public key
+   */
+  public resolveEventIdentity(event: NostrEvent): string {
+    return this.resolveIdentity(event.pubkey);
+  }
+
+  /**
+   * Check if a public key is a known delegate
+   * 
+   * @param pubkey - The public key to check
+   * @returns true if the key is a delegate, false otherwise
+   */
+  public isDelegateKey(pubkey: string): boolean {
+    return this.delegateToIdentity.has(pubkey);
+  }
+
+  /**
+   * Check if a public key is a known identity (has delegates)
+   * 
+   * @param pubkey - The public key to check
+   * @returns true if the key is an identity with delegates, false otherwise
+   */
+  public isIdentityKey(pubkey: string): boolean {
+    return this.identityToDelegates.has(pubkey);
+  }
+
+  /**
+   * Get all delegate keys for a given identity
+   * 
+   * @param identity - The identity public key
+   * @returns Set of delegate public keys
+   */
+  public getDelegatesForIdentity(identity: string): Set<string> {
+    return this.identityToDelegates.get(identity) || new Set();
+  }
+
+  /**
+   * Get the identity tag for a delegate key
+   * 
+   * @param delegate - The delegate public key
+   * @returns The identity tag, or undefined if not found
+   */
+  public getIdentityTag(delegate: string): IdentityTag | undefined {
+    return this.identityTagCache.get(delegate);
+  }
+
+  /**
+   * Get all public key advertisements for an identity
+   * 
+   * @param identity - The identity public key
+   * @returns Array of public key advertisements
+   */
+  public getPublicKeyAdvertisements(identity: string): PublicKeyAdvertisement[] {
+    const delegates = this.getDelegatesForIdentity(identity);
+    const ads: PublicKeyAdvertisement[] = [];
+    
+    for (const keyAd of this.publicKeyAds.values()) {
+      const adIdentity = this.resolveIdentity(keyAd.event.pubkey);
+      if (adIdentity === identity || delegates.has(keyAd.publicKey)) {
+        ads.push(keyAd);
+      }
+    }
+    
+    return ads;
+  }
+
+  /**
+   * Get a public key advertisement by key ID
+   * 
+   * @param keyID - The unique key identifier
+   * @returns The public key advertisement, or undefined if not found
+   */
+  public getPublicKeyAdvertisementByID(keyID: string): PublicKeyAdvertisement | undefined {
+    return this.publicKeyAds.get(keyID);
+  }
+
+  /**
+   * Stream all events by their actual identity
+   * 
+   * @param identity - The identity public key
+   * @param includeNewEvents - If true, include future events (default: false)
+   * @returns Observable of events signed by this identity or its delegates
+   */
+  public streamEventsByIdentity(identity: string, includeNewEvents = false): Observable<NostrEvent> {
+    const delegates = this.getDelegatesForIdentity(identity);
+    const allKeys = [identity, ...Array.from(delegates)];
+    
+    return this.eventStore.stream(
+      { authors: allKeys },
+      includeNewEvents
+    );
+  }
+
+  /**
+   * Stream events by identity with real-time delegate updates
+   * 
+   * This will automatically include events from newly discovered delegates.
+   * 
+   * @param identity - The identity public key
+   * @returns Observable of events signed by this identity or its delegates
+   */
+  public streamEventsByIdentityLive(identity: string): Observable<NostrEvent> {
+    // Create an observable that emits whenever delegates change
+    const delegateUpdates$ = new Observable<Set<string>>(observer => {
+      // Emit initial delegates
+      observer.next(this.getDelegatesForIdentity(identity));
+      
+      // Watch for new delegates
+      const subscription = this.eventStore.stream({ kinds: Object.values(EventKinds) }, true)
+        .subscribe(event => {
+          try {
+            const identityTag = parseIdentityTag(event);
+            if (identityTag && identityTag.identity === identity) {
+              this.cacheIdentityTag(identityTag);
+              observer.next(this.getDelegatesForIdentity(identity));
+            }
+          } catch (err) {
+            // Ignore invalid events
+          }
+        });
+      
+      return () => subscription.unsubscribe();
+    });
+    
+    // Map delegate updates to event streams
+    return delegateUpdates$.pipe(
+      map(delegates => {
+        const allKeys = [identity, ...Array.from(delegates)];
+        return this.eventStore.stream({ authors: allKeys }, true);
+      }),
+      // Flatten the nested observable
+      map(stream$ => stream$),
+    ) as any; // Type assertion needed due to complex Observable nesting
+  }
+
+  /**
+   * Verify that an identity tag signature is valid
+   * 
+   * Note: This requires schnorr signature verification which should be
+   * implemented using appropriate cryptographic libraries.
+   * 
+   * @param tag - The identity tag to verify
+   * @returns Promise that resolves to true if valid, false otherwise
+   */
+  public async verifyIdentityTag(tag: IdentityTag): Promise<boolean> {
+    // TODO: Implement schnorr signature verification
+    // The signature is over: sha256(identity + delegate + relayHint)
+    // 
+    // Example implementation would require:
+    // 1. Concatenate: identity + delegate + (relayHint || '')
+    // 2. Compute SHA256 hash
+    // 3. Verify signature using identity key
+    
+    throw new Error('Identity tag verification not yet implemented');
+  }
+
+  /**
+   * Clear all cached identity mappings
+   */
+  public clearCache(): void {
+    this.delegateToIdentity.clear();
+    this.identityToDelegates.clear();
+    this.identityTagCache.clear();
+    this.publicKeyAds.clear();
+  }
+
+  /**
+   * Get statistics about tracked identities and delegates
+   */
+  public getStats(): {
+    identities: number;
+    delegates: number;
+    publicKeyAds: number;
+  } {
+    return {
+      identities: this.identityToDelegates.size,
+      delegates: this.delegateToIdentity.size,
+      publicKeyAds: this.publicKeyAds.size,
+    };
+  }
+}
+
+/**
+ * Helper function to create an identity resolver instance
+ */
+export function createIdentityResolver(eventStore: EventStore): IdentityResolver {
+  return new IdentityResolver(eventStore);
+}
+

pkg/protocol/directory-client/src/index.ts

@@ -0,0 +1,75 @@
+/**
+ * Directory Consensus Protocol Client Library
+ * 
+ * Main entry point for the TypeScript client library.
+ */
+
+// Export types
+export type {
+  IdentityTag,
+  RelayIdentity,
+  TrustAct,
+  GroupTagAct,
+  PublicKeyAdvertisement,
+  ReplicationRequest,
+  ReplicationResponse,
+  DirectoryEventContent,
+  ValidationError as ValidationErrorType,
+} from './types.js';
+
+export {
+  EventKinds,
+  TrustLevel,
+  TrustReason,
+  KeyPurpose,
+  ReplicationStatus,
+  isDirectoryEventKind,
+  isValidTrustLevel,
+  isValidKeyPurpose,
+  isValidReplicationStatus,
+} from './types.js';
+
+// Export validation
+export {
+  ValidationError,
+  validateHexKey,
+  validateNPub,
+  validateWebSocketURL,
+  validateNonce,
+  validateTrustLevel,
+  validateKeyPurpose,
+  validateReplicationStatus,
+  validateConfidence,
+  validateIdentityTagStructure,
+  validateJSONContent,
+  validatePastTimestamp,
+  validateFutureTimestamp,
+  validateExpiry,
+  validateDerivationPath,
+  validateKeyIndex,
+  validateEventKinds,
+  validateAuthors,
+  validateLimit,
+} from './validation.js';
+
+// Export parsers
+export {
+  parseIdentityTag,
+  parseRelayIdentity,
+  parseTrustAct,
+  parseGroupTagAct,
+  parsePublicKeyAdvertisement,
+  parseReplicationRequest,
+  parseReplicationResponse,
+  parseDirectoryEvent,
+} from './parsers.js';
+
+// Export identity resolver
+export {
+  IdentityResolver,
+  createIdentityResolver,
+} from './identity-resolver.js';
+
+// Export helpers
+export * from './helpers.js';
+

pkg/protocol/directory-client/src/parsers.ts

@@ -0,0 +1,407 @@
+/**
+ * Event parsers for the Distributed Directory Consensus Protocol
+ * 
+ * This module provides parsers for all directory event kinds (39100-39105)
+ * matching the Go implementation in pkg/protocol/directory/
+ */
+
+import type { NostrEvent } from 'applesauce-core/helpers';
+import type {
+  IdentityTag,
+  RelayIdentity,
+  TrustAct,
+  GroupTagAct,
+  PublicKeyAdvertisement,
+  ReplicationRequest,
+  ReplicationResponse,
+} from './types.js';
+import {
+  EventKinds,
+  TrustLevel,
+  TrustReason,
+  KeyPurpose,
+  ReplicationStatus,
+} from './types.js';
+import {
+  ValidationError,
+  validateHexKey,
+  validateWebSocketURL,
+  validateTrustLevel,
+  validateKeyPurpose,
+  validateReplicationStatus,
+  validateIdentityTagStructure,
+} from './validation.js';
+
+/**
+ * Helper to get a tag value by name
+ */
+function getTagValue(event: NostrEvent, tagName: string): string | undefined {
+  const tag = event.tags.find(t => t[0] === tagName);
+  return tag?.[1];
+}
+
+/**
+ * Helper to get all tag values by name
+ */
+function getTagValues(event: NostrEvent, tagName: string): string[] {
+  return event.tags.filter(t => t[0] === tagName).map(t => t[1]);
+}
+
+/**
+ * Helper to parse a timestamp tag
+ */
+function parseTimestamp(value: string | undefined): Date | undefined {
+  if (!value) return undefined;
+  const timestamp = parseInt(value, 10);
+  if (isNaN(timestamp)) return undefined;
+  return new Date(timestamp * 1000);
+}
+
+/**
+ * Helper to parse a number tag
+ */
+function parseNumber(value: string | undefined): number | undefined {
+  if (!value) return undefined;
+  const num = parseFloat(value);
+  return isNaN(num) ? undefined : num;
+}
+
+/**
+ * Parse an Identity Tag (I tag) from an event
+ * 
+ * Format: ["I", <identity>, <delegate>, <signature>, <relay_hint>]
+ */
+export function parseIdentityTag(event: NostrEvent): IdentityTag | undefined {
+  const iTag = event.tags.find(t => t[0] === 'I');
+  if (!iTag) return undefined;
+  
+  const [, identity, delegate, signature, relayHint] = iTag;
+  
+  if (!identity || !delegate || !signature) {
+    throw new ValidationError('invalid I tag format: missing required fields');
+  }
+  
+  const tag: IdentityTag = {
+    identity,
+    delegate,
+    signature,
+    relayHint: relayHint || undefined,
+  };
+  
+  validateIdentityTagStructure(tag);
+  
+  return tag;
+}
+
+/**
+ * Parse a Relay Identity Declaration (Kind 39100)
+ */
+export function parseRelayIdentity(event: NostrEvent): RelayIdentity {
+  if (event.kind !== EventKinds.RelayIdentityAnnouncement) {
+    throw new ValidationError(`invalid event kind: expected ${EventKinds.RelayIdentityAnnouncement}, got ${event.kind}`);
+  }
+  
+  const relayURL = getTagValue(event, 'relay');
+  if (!relayURL) {
+    throw new ValidationError('relay tag is required');
+  }
+  validateWebSocketURL(relayURL);
+  
+  const signingKey = getTagValue(event, 'signing_key');
+  if (!signingKey) {
+    throw new ValidationError('signing_key tag is required');
+  }
+  validateHexKey(signingKey);
+  
+  const encryptionKey = getTagValue(event, 'encryption_key');
+  if (!encryptionKey) {
+    throw new ValidationError('encryption_key tag is required');
+  }
+  validateHexKey(encryptionKey);
+  
+  const version = getTagValue(event, 'version');
+  if (!version) {
+    throw new ValidationError('version tag is required');
+  }
+  
+  const nip11URL = getTagValue(event, 'nip11_url');
+  const identityTag = parseIdentityTag(event);
+  
+  return {
+    event,
+    relayURL,
+    signingKey,
+    encryptionKey,
+    version,
+    nip11URL,
+    identityTag,
+  };
+}
+
+/**
+ * Parse a Trust Act (Kind 39101)
+ */
+export function parseTrustAct(event: NostrEvent): TrustAct {
+  if (event.kind !== EventKinds.TrustAct) {
+    throw new ValidationError(`invalid event kind: expected ${EventKinds.TrustAct}, got ${event.kind}`);
+  }
+  
+  const targetPubkey = getTagValue(event, 'p');
+  if (!targetPubkey) {
+    throw new ValidationError('p tag (target pubkey) is required');
+  }
+  validateHexKey(targetPubkey);
+  
+  const trustLevelStr = getTagValue(event, 'trust_level');
+  if (!trustLevelStr) {
+    throw new ValidationError('trust_level tag is required');
+  }
+  validateTrustLevel(trustLevelStr);
+  const trustLevel = trustLevelStr as TrustLevel;
+  
+  const expiry = parseTimestamp(getTagValue(event, 'expiry'));
+  
+  const reasonStr = getTagValue(event, 'reason');
+  const reason = reasonStr ? (reasonStr as TrustReason) : undefined;
+  
+  const notes = event.content || undefined;
+  const identityTag = parseIdentityTag(event);
+  
+  return {
+    event,
+    targetPubkey,
+    trustLevel,
+    expiry,
+    reason,
+    notes,
+    identityTag,
+  };
+}
+
+/**
+ * Parse a Group Tag Act (Kind 39102)
+ */
+export function parseGroupTagAct(event: NostrEvent): GroupTagAct {
+  if (event.kind !== EventKinds.GroupTagAct) {
+    throw new ValidationError(`invalid event kind: expected ${EventKinds.GroupTagAct}, got ${event.kind}`);
+  }
+  
+  const targetPubkey = getTagValue(event, 'p');
+  if (!targetPubkey) {
+    throw new ValidationError('p tag (target pubkey) is required');
+  }
+  validateHexKey(targetPubkey);
+  
+  const groupTag = getTagValue(event, 'group_tag');
+  if (!groupTag) {
+    throw new ValidationError('group_tag tag is required');
+  }
+  
+  const actor = getTagValue(event, 'actor');
+  if (!actor) {
+    throw new ValidationError('actor tag is required');
+  }
+  validateHexKey(actor);
+  
+  const confidence = parseNumber(getTagValue(event, 'confidence'));
+  const expiry = parseTimestamp(getTagValue(event, 'expiry'));
+  const notes = event.content || undefined;
+  const identityTag = parseIdentityTag(event);
+  
+  return {
+    event,
+    targetPubkey,
+    groupTag,
+    actor,
+    confidence,
+    expiry,
+    notes,
+    identityTag,
+  };
+}
+
+/**
+ * Parse a Public Key Advertisement (Kind 39103)
+ */
+export function parsePublicKeyAdvertisement(event: NostrEvent): PublicKeyAdvertisement {
+  if (event.kind !== EventKinds.PublicKeyAdvertisement) {
+    throw new ValidationError(`invalid event kind: expected ${EventKinds.PublicKeyAdvertisement}, got ${event.kind}`);
+  }
+  
+  const keyID = getTagValue(event, 'd');
+  if (!keyID) {
+    throw new ValidationError('d tag (key ID) is required');
+  }
+  
+  const publicKey = getTagValue(event, 'p');
+  if (!publicKey) {
+    throw new ValidationError('p tag (public key) is required');
+  }
+  validateHexKey(publicKey);
+  
+  const purposeStr = getTagValue(event, 'purpose');
+  if (!purposeStr) {
+    throw new ValidationError('purpose tag is required');
+  }
+  validateKeyPurpose(purposeStr);
+  const purpose = purposeStr as KeyPurpose;
+  
+  const expiry = parseTimestamp(getTagValue(event, 'expiration'));
+  
+  const algorithm = getTagValue(event, 'algorithm');
+  if (!algorithm) {
+    throw new ValidationError('algorithm tag is required');
+  }
+  
+  const derivationPath = getTagValue(event, 'derivation_path');
+  if (!derivationPath) {
+    throw new ValidationError('derivation_path tag is required');
+  }
+  
+  const keyIndexStr = getTagValue(event, 'key_index');
+  if (!keyIndexStr) {
+    throw new ValidationError('key_index tag is required');
+  }
+  const keyIndex = parseInt(keyIndexStr, 10);
+  if (isNaN(keyIndex)) {
+    throw new ValidationError('key_index must be a valid integer');
+  }
+  
+  const identityTag = parseIdentityTag(event);
+  
+  return {
+    event,
+    keyID,
+    publicKey,
+    purpose,
+    expiry,
+    algorithm,
+    derivationPath,
+    keyIndex,
+    identityTag,
+  };
+}
+
+/**
+ * Parse a Replication Request (Kind 39104)
+ */
+export function parseReplicationRequest(event: NostrEvent): ReplicationRequest {
+  if (event.kind !== EventKinds.DirectoryEventReplicationRequest) {
+    throw new ValidationError(`invalid event kind: expected ${EventKinds.DirectoryEventReplicationRequest}, got ${event.kind}`);
+  }
+  
+  const requestID = getTagValue(event, 'request_id');
+  if (!requestID) {
+    throw new ValidationError('request_id tag is required');
+  }
+  
+  const requestorRelay = getTagValue(event, 'relay');
+  if (!requestorRelay) {
+    throw new ValidationError('relay tag (requestor) is required');
+  }
+  validateWebSocketURL(requestorRelay);
+  
+  // Parse content as JSON for filter parameters
+  let content: any = {};
+  if (event.content) {
+    try {
+      content = JSON.parse(event.content);
+    } catch (err) {
+      throw new ValidationError('invalid JSON content in replication request');
+    }
+  }
+  
+  const targetRelay = content.target_relay || getTagValue(event, 'target_relay');
+  if (!targetRelay) {
+    throw new ValidationError('target_relay is required');
+  }
+  validateWebSocketURL(targetRelay);
+  
+  const kinds = content.kinds || [];
+  if (!Array.isArray(kinds) || kinds.length === 0) {
+    throw new ValidationError('kinds array is required and must not be empty');
+  }
+  
+  const authors = content.authors;
+  const since = content.since ? new Date(content.since * 1000) : undefined;
+  const until = content.until ? new Date(content.until * 1000) : undefined;
+  const limit = content.limit;
+  
+  const identityTag = parseIdentityTag(event);
+  
+  return {
+    event,
+    requestID,
+    requestorRelay,
+    targetRelay,
+    kinds,
+    authors,
+    since,
+    until,
+    limit,
+    identityTag,
+  };
+}
+
+/**
+ * Parse a Replication Response (Kind 39105)
+ */
+export function parseReplicationResponse(event: NostrEvent): ReplicationResponse {
+  if (event.kind !== EventKinds.DirectoryEventReplicationResponse) {
+    throw new ValidationError(`invalid event kind: expected ${EventKinds.DirectoryEventReplicationResponse}, got ${event.kind}`);
+  }
+  
+  const requestID = getTagValue(event, 'request_id');
+  if (!requestID) {
+    throw new ValidationError('request_id tag is required');
+  }
+  
+  const statusStr = getTagValue(event, 'status');
+  if (!statusStr) {
+    throw new ValidationError('status tag is required');
+  }
+  validateReplicationStatus(statusStr);
+  const status = statusStr as ReplicationStatus;
+  
+  const eventIDs = getTagValues(event, 'event_id');
+  const error = getTagValue(event, 'error');
+  const identityTag = parseIdentityTag(event);
+  
+  return {
+    event,
+    requestID,
+    status,
+    eventIDs,
+    error,
+    identityTag,
+  };
+}
+
+/**
+ * Parse any directory event based on its kind
+ */
+export function parseDirectoryEvent(event: NostrEvent): 
+  | RelayIdentity 
+  | TrustAct 
+  | GroupTagAct 
+  | PublicKeyAdvertisement 
+  | ReplicationRequest 
+  | ReplicationResponse {
+  switch (event.kind) {
+    case EventKinds.RelayIdentityAnnouncement:
+      return parseRelayIdentity(event);
+    case EventKinds.TrustAct:
+      return parseTrustAct(event);
+    case EventKinds.GroupTagAct:
+      return parseGroupTagAct(event);
+    case EventKinds.PublicKeyAdvertisement:
+      return parsePublicKeyAdvertisement(event);
+    case EventKinds.DirectoryEventReplicationRequest:
+      return parseReplicationRequest(event);
+    case EventKinds.DirectoryEventReplicationResponse:
+      return parseReplicationResponse(event);
+    default:
+      throw new ValidationError(`unknown directory event kind: ${event.kind}`);
+  }
+}
+

pkg/protocol/directory-client/src/types.ts

@@ -0,0 +1,303 @@
+/**
+ * Core types for the Distributed Directory Consensus Protocol (NIP-XX)
+ * 
+ * This module defines TypeScript types that match the Go implementation
+ * in pkg/protocol/directory/types.go
+ */
+
+import type { NostrEvent } from 'applesauce-core/helpers';
+
+// Event kinds for the distributed directory consensus protocol
+export const EventKinds = {
+  RelayIdentityAnnouncement: 39100,
+  TrustAct: 39101,
+  GroupTagAct: 39102,
+  PublicKeyAdvertisement: 39103,
+  DirectoryEventReplicationRequest: 39104,
+  DirectoryEventReplicationResponse: 39105,
+} as const;
+
+export type DirectoryEventKind = typeof EventKinds[keyof typeof EventKinds];
+
+// Trust levels for trust acts
+export enum TrustLevel {
+  High = 'high',
+  Medium = 'medium',
+  Low = 'low',
+}
+
+// Reason types for trust establishment
+export enum TrustReason {
+  Manual = 'manual',
+  Reciprocal = 'reciprocal',
+  Transitive = 'transitive',
+  Vouched = 'vouched',
+}
+
+// Key purposes for public key advertisements
+export enum KeyPurpose {
+  Signing = 'signing',
+  Encryption = 'encryption',
+  Authentication = 'authentication',
+}
+
+// Replication statuses
+export enum ReplicationStatus {
+  Pending = 'pending',
+  InProgress = 'in_progress',
+  Completed = 'completed',
+  Failed = 'failed',
+  PartialSuccess = 'partial_success',
+}
+
+/**
+ * Identity Tag (I tag) structure
+ * 
+ * Binds an identity to a delegate public key with proof-of-control signature.
+ * Format: ["I", <identity_pubkey>, <delegate_pubkey>, <signature>, <relay_hint>]
+ */
+export interface IdentityTag {
+  /** The primary identity public key (hex) */
+  identity: string;
+  
+  /** The delegate public key used for signing (hex) */
+  delegate: string;
+  
+  /** Schnorr signature proving control of the identity key */
+  signature: string;
+  
+  /** Optional relay hint for finding the identity's events */
+  relayHint?: string;
+}
+
+/**
+ * Relay Identity Declaration (Kind 39100)
+ * 
+ * Announces a relay's identity and associated keys.
+ */
+export interface RelayIdentity {
+  /** The underlying Nostr event */
+  event: NostrEvent;
+  
+  /** Canonical WebSocket URL of the relay (must end with /) */
+  relayURL: string;
+  
+  /** Public key for event signing (hex) */
+  signingKey: string;
+  
+  /** Public key for NIP-04/NIP-44 encryption (hex) */
+  encryptionKey: string;
+  
+  /** Protocol version */
+  version: string;
+  
+  /** NIP-11 relay information document URL */
+  nip11URL?: string;
+  
+  /** Identity tag binding this key to a primary identity */
+  identityTag?: IdentityTag;
+}
+
+/**
+ * Trust Act (Kind 39101)
+ * 
+ * Establishes trust relationship between relays.
+ */
+export interface TrustAct {
+  /** The underlying Nostr event */
+  event: NostrEvent;
+  
+  /** Public key of the relay being trusted (hex) */
+  targetPubkey: string;
+  
+  /** Level of trust being granted */
+  trustLevel: TrustLevel;
+  
+  /** When this trust expires */
+  expiry?: Date;
+  
+  /** Reason for establishing trust */
+  reason?: TrustReason;
+  
+  /** Additional context or notes */
+  notes?: string;
+  
+  /** Identity tag if signed by a delegate */
+  identityTag?: IdentityTag;
+}
+
+/**
+ * Group Tag Act (Kind 39102)
+ * 
+ * Attests to a relay's membership in a named group.
+ */
+export interface GroupTagAct {
+  /** The underlying Nostr event */
+  event: NostrEvent;
+  
+  /** Public key of the relay being attested (hex) */
+  targetPubkey: string;
+  
+  /** Name of the group */
+  groupTag: string;
+  
+  /** Public key of the actor making the attestation (hex) */
+  actor: string;
+  
+  /** Confidence level (0.0 to 1.0) */
+  confidence?: number;
+  
+  /** When this attestation expires */
+  expiry?: Date;
+  
+  /** Additional context or notes */
+  notes?: string;
+  
+  /** Identity tag if signed by a delegate */
+  identityTag?: IdentityTag;
+}
+
+/**
+ * Public Key Advertisement (Kind 39103)
+ * 
+ * Advertises HD-derived public keys for specific purposes.
+ */
+export interface PublicKeyAdvertisement {
+  /** The underlying Nostr event */
+  event: NostrEvent;
+  
+  /** Unique identifier for this key */
+  keyID: string;
+  
+  /** The public key being advertised (hex) */
+  publicKey: string;
+  
+  /** Purpose of this key */
+  purpose: KeyPurpose;
+  
+  /** When this key expires */
+  expiry?: Date;
+  
+  /** Cryptographic algorithm (e.g., 'secp256k1') */
+  algorithm: string;
+  
+  /** BIP32 derivation path */
+  derivationPath: string;
+  
+  /** Index in the derivation path */
+  keyIndex: number;
+  
+  /** Identity tag if signed by a delegate */
+  identityTag?: IdentityTag;
+}
+
+/**
+ * Replication Request (Kind 39104)
+ * 
+ * Requests replication of directory events.
+ */
+export interface ReplicationRequest {
+  /** The underlying Nostr event */
+  event: NostrEvent;
+  
+  /** Unique identifier for this request */
+  requestID: string;
+  
+  /** WebSocket URL of the requesting relay */
+  requestorRelay: string;
+  
+  /** WebSocket URL of the target relay */
+  targetRelay: string;
+  
+  /** Event kinds to replicate */
+  kinds: number[];
+  
+  /** Author pubkeys to filter by */
+  authors?: string[];
+  
+  /** Timestamp to replicate from */
+  since?: Date;
+  
+  /** Timestamp to replicate until */
+  until?: Date;
+  
+  /** Maximum number of events to return */
+  limit?: number;
+  
+  /** Identity tag if signed by a delegate */
+  identityTag?: IdentityTag;
+}
+
+/**
+ * Replication Response (Kind 39105)
+ * 
+ * Response to a replication request.
+ */
+export interface ReplicationResponse {
+  /** The underlying Nostr event */
+  event: NostrEvent;
+  
+  /** Request ID this response corresponds to */
+  requestID: string;
+  
+  /** Status of the replication */
+  status: ReplicationStatus;
+  
+  /** IDs of events being replicated */
+  eventIDs: string[];
+  
+  /** Error message if status is Failed */
+  error?: string;
+  
+  /** Identity tag if signed by a delegate */
+  identityTag?: IdentityTag;
+}
+
+/**
+ * Parsed content structure for directory events
+ */
+export interface DirectoryEventContent {
+  /** Original JSON string */
+  raw: string;
+  
+  /** Parsed JSON object */
+  data: Record<string, any>;
+}
+
+/**
+ * Helper type for event validation errors
+ */
+export interface ValidationError {
+  field: string;
+  message: string;
+  value?: any;
+}
+
+/**
+ * Check if a Nostr event kind is a directory event kind
+ */
+export function isDirectoryEventKind(kind: number): boolean {
+  return Object.values(EventKinds).includes(kind as DirectoryEventKind);
+}
+
+/**
+ * Check if a trust level is valid
+ */
+export function isValidTrustLevel(level: string): level is TrustLevel {
+  return Object.values(TrustLevel).includes(level as TrustLevel);
+}
+
+/**
+ * Check if a key purpose is valid
+ */
+export function isValidKeyPurpose(purpose: string): purpose is KeyPurpose {
+  return Object.values(KeyPurpose).includes(purpose as KeyPurpose);
+}
+
+/**
+ * Check if a replication status is valid
+ */
+export function isValidReplicationStatus(status: string): status is ReplicationStatus {
+  return Object.values(ReplicationStatus).includes(status as ReplicationStatus);
+}
+

pkg/protocol/directory-client/src/validation.ts

@@ -0,0 +1,264 @@
+/**
+ * Validation functions for the Distributed Directory Consensus Protocol
+ * 
+ * This module provides validation matching the Go implementation in
+ * pkg/protocol/directory/validation.go
+ */
+
+import type { IdentityTag } from './types.js';
+import { TrustLevel, KeyPurpose, ReplicationStatus } from './types.js';
+
+/**
+ * Validation error class
+ */
+export class ValidationError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = 'ValidationError';
+  }
+}
+
+// Regular expressions for validation
+const HEX_KEY_REGEX = /^[0-9a-fA-F]{64}$/;
+const NPUB_REGEX = /^npub1[0-9a-z]+$/;
+const WS_URL_REGEX = /^wss?:\/\/[a-zA-Z0-9.-]+(?::[0-9]+)?(?:\/.*)?$/;
+
+/**
+ * Validates that a string is a valid 64-character hex key
+ */
+export function validateHexKey(key: string): void {
+  if (!HEX_KEY_REGEX.test(key)) {
+    throw new ValidationError('invalid hex key format: must be 64 hex characters');
+  }
+}
+
+/**
+ * Validates that a string is a valid npub-encoded public key
+ */
+export function validateNPub(npub: string): void {
+  if (!NPUB_REGEX.test(npub)) {
+    throw new ValidationError('invalid npub format');
+  }
+  
+  // Additional validation would require bech32 decoding
+  // which should be handled by applesauce-core utilities
+}
+
+/**
+ * Validates that a string is a valid WebSocket URL
+ */
+export function validateWebSocketURL(url: string): void {
+  if (!WS_URL_REGEX.test(url)) {
+    throw new ValidationError('invalid WebSocket URL format');
+  }
+  
+  try {
+    const parsed = new URL(url);
+    
+    if (parsed.protocol !== 'ws:' && parsed.protocol !== 'wss:') {
+      throw new ValidationError('URL must use ws:// or wss:// scheme');
+    }
+    
+    if (!parsed.host) {
+      throw new ValidationError('URL must have a host');
+    }
+    
+    // Ensure trailing slash for canonical format
+    if (!url.endsWith('/')) {
+      throw new ValidationError('Canonical WebSocket URL must end with /');
+    }
+  } catch (err) {
+    if (err instanceof ValidationError) {
+      throw err;
+    }
+    throw new ValidationError(`invalid URL: ${err instanceof Error ? err.message : String(err)}`);
+  }
+}
+
+/**
+ * Validates a nonce meets minimum security requirements
+ */
+export function validateNonce(nonce: string): void {
+  const MIN_NONCE_SIZE = 16; // bytes
+  
+  if (nonce.length < MIN_NONCE_SIZE * 2) { // hex encoding doubles length
+    throw new ValidationError(`nonce must be at least ${MIN_NONCE_SIZE} bytes (${MIN_NONCE_SIZE * 2} hex characters)`);
+  }
+  
+  if (!/^[0-9a-fA-F]+$/.test(nonce)) {
+    throw new ValidationError('nonce must be valid hex');
+  }
+}
+
+/**
+ * Validates trust level value
+ */
+export function validateTrustLevel(level: string): void {
+  if (!Object.values(TrustLevel).includes(level as TrustLevel)) {
+    throw new ValidationError(`invalid trust level: must be one of ${Object.values(TrustLevel).join(', ')}`);
+  }
+}
+
+/**
+ * Validates key purpose value
+ */
+export function validateKeyPurpose(purpose: string): void {
+  if (!Object.values(KeyPurpose).includes(purpose as KeyPurpose)) {
+    throw new ValidationError(`invalid key purpose: must be one of ${Object.values(KeyPurpose).join(', ')}`);
+  }
+}
+
+/**
+ * Validates replication status value
+ */
+export function validateReplicationStatus(status: string): void {
+  if (!Object.values(ReplicationStatus).includes(status as ReplicationStatus)) {
+    throw new ValidationError(`invalid replication status: must be one of ${Object.values(ReplicationStatus).join(', ')}`);
+  }
+}
+
+/**
+ * Validates confidence value (must be between 0.0 and 1.0)
+ */
+export function validateConfidence(confidence: number): void {
+  if (confidence < 0.0 || confidence > 1.0) {
+    throw new ValidationError('confidence must be between 0.0 and 1.0');
+  }
+}
+
+/**
+ * Validates an identity tag structure
+ * 
+ * Note: This performs structural validation only. Signature verification
+ * requires cryptographic operations and should be done separately.
+ */
+export function validateIdentityTagStructure(tag: IdentityTag): void {
+  if (!tag.identity) {
+    throw new ValidationError('identity tag must have an identity field');
+  }
+  
+  validateHexKey(tag.identity);
+  
+  if (!tag.delegate) {
+    throw new ValidationError('identity tag must have a delegate field');
+  }
+  
+  validateHexKey(tag.delegate);
+  
+  if (!tag.signature) {
+    throw new ValidationError('identity tag must have a signature field');
+  }
+  
+  validateHexKey(tag.signature);
+  
+  if (tag.relayHint) {
+    validateWebSocketURL(tag.relayHint);
+  }
+}
+
+/**
+ * Validates event content is valid JSON
+ */
+export function validateJSONContent(content: string): void {
+  if (!content || content.trim() === '') {
+    return; // Empty content is valid
+  }
+  
+  try {
+    JSON.parse(content);
+  } catch (err) {
+    throw new ValidationError(`invalid JSON content: ${err instanceof Error ? err.message : String(err)}`);
+  }
+}
+
+/**
+ * Validates a timestamp is in the past
+ */
+export function validatePastTimestamp(timestamp: Date | number): void {
+  const now = Date.now();
+  const ts = timestamp instanceof Date ? timestamp.getTime() : timestamp * 1000;
+  
+  if (ts > now) {
+    throw new ValidationError('timestamp must be in the past');
+  }
+}
+
+/**
+ * Validates a timestamp is in the future
+ */
+export function validateFutureTimestamp(timestamp: Date | number): void {
+  const now = Date.now();
+  const ts = timestamp instanceof Date ? timestamp.getTime() : timestamp * 1000;
+  
+  if (ts <= now) {
+    throw new ValidationError('timestamp must be in the future');
+  }
+}
+
+/**
+ * Validates an expiry timestamp (must be in the future if provided)
+ */
+export function validateExpiry(expiry?: Date | number): void {
+  if (expiry === undefined || expiry === null) {
+    return; // No expiry is valid
+  }
+  
+  validateFutureTimestamp(expiry);
+}
+
+/**
+ * Validates a BIP32 derivation path
+ */
+export function validateDerivationPath(path: string): void {
+  // Basic validation - should start with m/ and contain numbers/apostrophes
+  if (!/^m(\/\d+'?)*$/.test(path)) {
+    throw new ValidationError('invalid BIP32 derivation path format');
+  }
+}
+
+/**
+ * Validates a key index is non-negative
+ */
+export function validateKeyIndex(index: number): void {
+  if (!Number.isInteger(index) || index < 0) {
+    throw new ValidationError('key index must be a non-negative integer');
+  }
+}
+
+/**
+ * Validates event kinds array is not empty
+ */
+export function validateEventKinds(kinds: number[]): void {
+  if (!Array.isArray(kinds) || kinds.length === 0) {
+    throw new ValidationError('event kinds array must not be empty');
+  }
+  
+  for (const kind of kinds) {
+    if (!Number.isInteger(kind) || kind < 0) {
+      throw new ValidationError(`invalid event kind: ${kind}`);
+    }
+  }
+}
+
+/**
+ * Validates authors array contains valid pubkeys
+ */
+export function validateAuthors(authors: string[]): void {
+  if (!Array.isArray(authors)) {
+    throw new ValidationError('authors must be an array');
+  }
+  
+  for (const author of authors) {
+    validateHexKey(author);
+  }
+}
+
+/**
+ * Validates limit is positive
+ */
+export function validateLimit(limit: number): void {
+  if (!Number.isInteger(limit) || limit <= 0) {
+    throw new ValidationError('limit must be a positive integer');
+  }
+}
+

pkg/protocol/directory-client/trust.go

@@ -0,0 +1,243 @@
+package directory_client
+
+import (
+	"sync"
+	"time"
+
+	"next.orly.dev/pkg/encoders/event"
+	"next.orly.dev/pkg/protocol/directory"
+)
+
+// TrustCalculator computes aggregate trust scores from multiple trust acts.
+//
+// It maintains a collection of trust acts and provides methods to calculate
+// weighted trust scores for relay public keys.
+type TrustCalculator struct {
+	mu   sync.RWMutex
+	acts map[string][]*directory.TrustAct
+}
+
+// NewTrustCalculator creates a new trust calculator instance.
+func NewTrustCalculator() *TrustCalculator {
+	return &TrustCalculator{
+		acts: make(map[string][]*directory.TrustAct),
+	}
+}
+
+// AddAct adds a trust act to the calculator.
+func (tc *TrustCalculator) AddAct(act *directory.TrustAct) {
+	if act == nil {
+		return
+	}
+
+	tc.mu.Lock()
+	defer tc.mu.Unlock()
+
+	targetPubkey := act.TargetPubkey
+	tc.acts[targetPubkey] = append(tc.acts[targetPubkey], act)
+}
+
+// CalculateTrust calculates an aggregate trust score for a public key.
+//
+// The score is computed as a weighted average where:
+//   - high trust = 100
+//   - medium trust = 50
+//   - low trust = 25
+//
+// Expired trust acts are excluded from the calculation.
+// Returns a score between 0 and 100.
+func (tc *TrustCalculator) CalculateTrust(pubkey string) float64 {
+	tc.mu.RLock()
+	defer tc.mu.RUnlock()
+
+	acts := tc.acts[pubkey]
+	if len(acts) == 0 {
+		return 0
+	}
+
+	now := time.Now()
+	var total float64
+	var count int
+
+	// Weight mapping
+	weights := map[directory.TrustLevel]float64{
+		directory.TrustLevelHigh:   100,
+		directory.TrustLevelMedium: 50,
+		directory.TrustLevelLow:    25,
+	}
+
+	for _, act := range acts {
+		// Skip expired acts
+		if act.Expiry != nil && act.Expiry.Before(now) {
+			continue
+		}
+
+		weight, ok := weights[act.TrustLevel]
+		if !ok {
+			continue
+		}
+
+		total += weight
+		count++
+	}
+
+	if count == 0 {
+		return 0
+	}
+
+	return total / float64(count)
+}
+
+// GetActs returns all trust acts for a specific public key.
+func (tc *TrustCalculator) GetActs(pubkey string) []*directory.TrustAct {
+	tc.mu.RLock()
+	defer tc.mu.RUnlock()
+
+	acts := tc.acts[pubkey]
+	result := make([]*directory.TrustAct, len(acts))
+	copy(result, acts)
+	return result
+}
+
+// GetActiveTrustActs returns only non-expired trust acts for a public key.
+func (tc *TrustCalculator) GetActiveTrustActs(pubkey string) []*directory.TrustAct {
+	tc.mu.RLock()
+	defer tc.mu.RUnlock()
+
+	acts := tc.acts[pubkey]
+	now := time.Now()
+	result := make([]*directory.TrustAct, 0)
+
+	for _, act := range acts {
+		if act.Expiry == nil || act.Expiry.After(now) {
+			result = append(result, act)
+		}
+	}
+
+	return result
+}
+
+// Clear removes all trust acts from the calculator.
+func (tc *TrustCalculator) Clear() {
+	tc.mu.Lock()
+	defer tc.mu.Unlock()
+
+	tc.acts = make(map[string][]*directory.TrustAct)
+}
+
+// GetAllPubkeys returns all public keys that have trust acts.
+func (tc *TrustCalculator) GetAllPubkeys() []string {
+	tc.mu.RLock()
+	defer tc.mu.RUnlock()
+
+	pubkeys := make([]string, 0, len(tc.acts))
+	for pubkey := range tc.acts {
+		pubkeys = append(pubkeys, pubkey)
+	}
+	return pubkeys
+}
+
+// ReplicationFilter manages replication decisions based on trust scores.
+//
+// It uses a TrustCalculator to compute trust scores and determines which
+// relays are trusted enough for replication based on a minimum threshold.
+type ReplicationFilter struct {
+	mu            sync.RWMutex
+	trustCalc     *TrustCalculator
+	minTrustScore float64
+	trustedRelays map[string]bool
+}
+
+// NewReplicationFilter creates a new replication filter with a minimum trust score threshold.
+func NewReplicationFilter(minTrustScore float64) *ReplicationFilter {
+	return &ReplicationFilter{
+		trustCalc:     NewTrustCalculator(),
+		minTrustScore: minTrustScore,
+		trustedRelays: make(map[string]bool),
+	}
+}
+
+// AddTrustAct adds a trust act and updates the trusted relays set.
+func (rf *ReplicationFilter) AddTrustAct(act *directory.TrustAct) {
+	if act == nil {
+		return
+	}
+
+	rf.trustCalc.AddAct(act)
+
+	// Update trusted relays based on new trust score
+	score := rf.trustCalc.CalculateTrust(act.TargetPubkey)
+
+	rf.mu.Lock()
+	defer rf.mu.Unlock()
+
+	if score >= rf.minTrustScore {
+		rf.trustedRelays[act.TargetPubkey] = true
+	} else {
+		delete(rf.trustedRelays, act.TargetPubkey)
+	}
+}
+
+// ShouldReplicate checks if a relay is trusted enough for replication.
+func (rf *ReplicationFilter) ShouldReplicate(pubkey string) bool {
+	rf.mu.RLock()
+	defer rf.mu.RUnlock()
+
+	return rf.trustedRelays[pubkey]
+}
+
+// GetTrustedRelays returns all trusted relay public keys.
+func (rf *ReplicationFilter) GetTrustedRelays() []string {
+	rf.mu.RLock()
+	defer rf.mu.RUnlock()
+
+	relays := make([]string, 0, len(rf.trustedRelays))
+	for pubkey := range rf.trustedRelays {
+		relays = append(relays, pubkey)
+	}
+	return relays
+}
+
+// GetTrustScore returns the trust score for a relay.
+func (rf *ReplicationFilter) GetTrustScore(pubkey string) float64 {
+	return rf.trustCalc.CalculateTrust(pubkey)
+}
+
+// SetMinTrustScore updates the minimum trust score threshold and recalculates trusted relays.
+func (rf *ReplicationFilter) SetMinTrustScore(minScore float64) {
+	rf.mu.Lock()
+	defer rf.mu.Unlock()
+
+	rf.minTrustScore = minScore
+
+	// Recalculate trusted relays with new threshold
+	rf.trustedRelays = make(map[string]bool)
+	for _, pubkey := range rf.trustCalc.GetAllPubkeys() {
+		score := rf.trustCalc.CalculateTrust(pubkey)
+		if score >= rf.minTrustScore {
+			rf.trustedRelays[pubkey] = true
+		}
+	}
+}
+
+// GetMinTrustScore returns the current minimum trust score threshold.
+func (rf *ReplicationFilter) GetMinTrustScore() float64 {
+	rf.mu.RLock()
+	defer rf.mu.RUnlock()
+
+	return rf.minTrustScore
+}
+
+// FilterEvents filters events to only those from trusted relays.
+func (rf *ReplicationFilter) FilterEvents(events []*event.E) []*event.E {
+	rf.mu.RLock()
+	defer rf.mu.RUnlock()
+
+	filtered := make([]*event.E, 0)
+	for _, ev := range events {
+		if rf.trustedRelays[string(ev.Pubkey)] {
+			filtered = append(filtered, ev)
+		}
+	}
+	return filtered
+}

pkg/protocol/directory-client/tsconfig.json

@@ -0,0 +1,23 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "lib": ["ES2022"],
+    "moduleResolution": "bundler",
+    "declaration": true,
+    "declarationMap": true,
+    "sourceMap": true,
+    "outDir": "./dist",
+    "rootDir": "./src",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "forceConsistentCasingInFileNames": true,
+    "resolveJsonModule": true,
+    "allowSyntheticDefaultImports": true,
+    "types": ["node"]
+  },
+  "include": ["src/**/*"],
+  "exclude": ["node_modules", "dist", "**/*.test.ts"]
+}
+

pkg/protocol/directory/group_tag_act.go

@@ -2,6 +2,7 @@ package directory
 
 import (
 	"strconv"
+	"time"
 
 	"lol.mleku.dev/chk"
 	"lol.mleku.dev/errorf"
@@ -18,7 +19,49 @@ type GroupTagAct struct {
 	TagValue    string
 	Actor       string
 	Confidence  int
+	Owners      *OwnershipSpec
+	Created     *time.Time
 	Description string
+	IdentityTag *IdentityTag
+}
+
+// OwnershipSpec defines the ownership control for a group tag.
+type OwnershipSpec struct {
+	Scheme SignatureScheme
+	Owners []string // Public keys of owners
+}
+
+// SignatureScheme defines the type of signature requirement.
+type SignatureScheme string
+
+const (
+	SchemeSingle SignatureScheme = "single"
+	Scheme2of3   SignatureScheme = "2-of-3"
+	Scheme3of5   SignatureScheme = "3-of-5"
+)
+
+// ValidateSignatureScheme checks if a signature scheme is valid.
+func ValidateSignatureScheme(scheme SignatureScheme) error {
+	switch scheme {
+	case SchemeSingle, Scheme2of3, Scheme3of5:
+		return nil
+	default:
+		return errorf.E("invalid signature scheme: %s", scheme)
+	}
+}
+
+// RequiredSignatures returns the number of signatures required for the scheme.
+func (s SignatureScheme) RequiredSignatures() int {
+	switch s {
+	case SchemeSingle:
+		return 1
+	case Scheme2of3:
+		return 2
+	case Scheme3of5:
+		return 3
+	default:
+		return 0
+	}
 }
 
 // NewGroupTagAct creates a new Group Tag Act event.
@@ -26,7 +69,9 @@ func NewGroupTagAct(
 	pubkey []byte,
 	groupID, tagName, tagValue, actor string,
 	confidence int,
+	owners *OwnershipSpec,
 	description string,
+	identityTag *IdentityTag,
 ) (gta *GroupTagAct, err error) {
 
 	// Validate required fields
@@ -36,6 +81,12 @@ func NewGroupTagAct(
 	if groupID == "" {
 		return nil, errorf.E("group ID is required")
 	}
+
+	// Validate group ID is URL-safe
+	if err = ValidateGroupTagName(groupID); chk.E(err) {
+		return nil, errorf.E("invalid group ID: %w", err)
+	}
+
 	if tagName == "" {
 		return nil, errorf.E("tag name is required")
 	}
@@ -52,6 +103,31 @@ func NewGroupTagAct(
 		return nil, errorf.E("confidence must be between 0 and 100")
 	}
 
+	// Validate ownership spec if provided
+	if owners != nil {
+		if err = ValidateSignatureScheme(owners.Scheme); chk.E(err) {
+			return
+		}
+		if len(owners.Owners) == 0 {
+			return nil, errorf.E("at least one owner is required")
+		}
+		// Validate owner count matches scheme
+		switch owners.Scheme {
+		case SchemeSingle:
+			if len(owners.Owners) != 1 {
+				return nil, errorf.E("single scheme requires exactly 1 owner")
+			}
+		case Scheme2of3:
+			if len(owners.Owners) != 3 {
+				return nil, errorf.E("2-of-3 scheme requires exactly 3 owners")
+			}
+		case Scheme3of5:
+			if len(owners.Owners) != 5 {
+				return nil, errorf.E("3-of-5 scheme requires exactly 5 owners")
+			}
+		}
+	}
+
 	// Create base event
 	ev := CreateBaseEvent(pubkey, GroupTagActKind)
 	ev.Content = []byte(description)
@@ -62,6 +138,26 @@ func NewGroupTagAct(
 	ev.Tags.Append(tag.NewFromAny(string(ActorTag), actor))
 	ev.Tags.Append(tag.NewFromAny(string(ConfidenceTag), strconv.Itoa(confidence)))
 
+	// Add ownership tag if provided
+	if owners != nil {
+		ownersTagParts := make([]any, 0, len(owners.Owners)+2)
+		ownersTagParts = append(ownersTagParts, string(OwnersTag), string(owners.Scheme))
+		for _, owner := range owners.Owners {
+			ownersTagParts = append(ownersTagParts, owner)
+		}
+		ev.Tags.Append(tag.NewFromAny(ownersTagParts...))
+	}
+
+	// Add created timestamp
+	created := time.Now()
+	ev.Tags.Append(tag.NewFromAny(string(CreatedTag), strconv.FormatInt(created.Unix(), 10)))
+
+	// Add identity tag if provided
+	if identityTag != nil {
+		iTag := tag.NewFromAny(string(ITag), identityTag.NPubIdentity, identityTag.Nonce, identityTag.Signature)
+		ev.Tags.Append(iTag)
+	}
+
 	gta = &GroupTagAct{
 		Event:       ev,
 		GroupID:     groupID,
@@ -69,7 +165,10 @@ func NewGroupTagAct(
 		TagValue:    tagValue,
 		Actor:       actor,
 		Confidence:  confidence,
+		Owners:      owners,
+		Created:     &created,
 		Description: description,
+		IdentityTag: identityTag,
 	}
 
 	return
@@ -124,6 +223,44 @@ func ParseGroupTagAct(ev *event.E) (gta *GroupTagAct, err error) {
 		return nil, errorf.E("confidence must be between 0 and 100")
 	}
 
+	// Parse optional ownership tag
+	var owners *OwnershipSpec
+	ownersTag := ev.Tags.GetFirst(OwnersTag)
+	if ownersTag != nil && ownersTag.Len() >= 3 {
+		scheme := SignatureScheme(ownersTag.T[1])
+		if err = ValidateSignatureScheme(scheme); chk.E(err) {
+			return nil, errorf.E("invalid signature scheme: %w", err)
+		}
+		ownerPubkeys := make([]string, 0, ownersTag.Len()-2)
+		for i := 2; i < ownersTag.Len(); i++ {
+			ownerPubkeys = append(ownerPubkeys, string(ownersTag.T[i]))
+		}
+		owners = &OwnershipSpec{
+			Scheme: scheme,
+			Owners: ownerPubkeys,
+		}
+	}
+
+	// Parse optional created timestamp
+	var created *time.Time
+	createdTag := ev.Tags.GetFirst(CreatedTag)
+	if createdTag != nil {
+		var timestamp int64
+		if timestamp, err = strconv.ParseInt(string(createdTag.Value()), 10, 64); err == nil {
+			t := time.Unix(timestamp, 0)
+			created = &t
+		}
+	}
+
+	// Parse optional identity tag
+	var identityTag *IdentityTag
+	iTag := ev.Tags.GetFirst(ITag)
+	if iTag != nil {
+		if identityTag, err = ParseIdentityTag(iTag); chk.E(err) {
+			return
+		}
+	}
+
 	gta = &GroupTagAct{
 		Event:       ev,
 		GroupID:     string(dTag.Value()),
@@ -131,7 +268,10 @@ func ParseGroupTagAct(ev *event.E) (gta *GroupTagAct, err error) {
 		TagValue:    string(groupTagTag.T[2]),
 		Actor:       string(actorTag.Value()),
 		Confidence:  confidence,
+		Owners:      owners,
+		Created:     created,
 		Description: string(ev.Content),
+		IdentityTag: identityTag,
 	}
 
 	return

pkg/protocol/directory/helpers.go

@@ -168,19 +168,22 @@ func (tc *TrustCalculator) GetTrustLevel(pubkey string) TrustLevel {
 			return act.GetTrustLevel()
 		}
 	}
-	return TrustLevel("")
+	return TrustLevelNone // Return 0 for no trust
 }
 
 // CalculateInheritedTrust calculates inherited trust through the web of trust.
+// With numeric trust levels, inherited trust is calculated by multiplying
+// the trust percentages at each hop, reducing trust over distance.
 func (tc *TrustCalculator) CalculateInheritedTrust(
 	fromPubkey, toPubkey string,
 ) TrustLevel {
 	// Direct trust
-	if directTrust := tc.GetTrustLevel(toPubkey); directTrust != "" {
+	if directTrust := tc.GetTrustLevel(toPubkey); directTrust > 0 {
 		return directTrust
 	}
 
 	// Look for inherited trust through intermediate nodes
+	var maxInheritedTrust TrustLevel = 0
 	for intermediatePubkey, act := range tc.acts {
 		if act.IsExpired() {
 			continue
@@ -188,43 +191,35 @@ func (tc *TrustCalculator) CalculateInheritedTrust(
 
 		// Check if we trust the intermediate node
 		intermediateLevel := tc.GetTrustLevel(intermediatePubkey)
-		if intermediateLevel == "" {
+		if intermediateLevel == 0 {
 			continue
 		}
 
 		// Check if intermediate node trusts the target
 		targetLevel := tc.GetTrustLevel(toPubkey)
-		if targetLevel == "" {
+		if targetLevel == 0 {
 			continue
 		}
 
-		// Calculate inherited trust level
+		// Calculate inherited trust level (multiply percentages)
-		return tc.combinesTrustLevels(intermediateLevel, targetLevel)
+		inheritedLevel := tc.combinesTrustLevels(intermediateLevel, targetLevel)
+		if inheritedLevel > maxInheritedTrust {
+			maxInheritedTrust = inheritedLevel
+		}
 	}
 
-	return TrustLevel("")
+	return maxInheritedTrust
 }
 
 // combinesTrustLevels combines two trust levels to calculate inherited trust.
+// With numeric trust levels (0-100), inherited trust is calculated by
+// multiplying the two percentages: (level1 * level2) / 100
+// This naturally reduces trust over distance.
 func (tc *TrustCalculator) combinesTrustLevels(level1, level2 TrustLevel) TrustLevel {
-	// Trust inheritance rules:
+	// Multiply percentages: (level1% * level2%) = (level1 * level2) / 100
-	// high + high = medium
+	// Example: 75% trust * 50% trust = 37.5% inherited trust
-	// high + medium = low
+	combined := (uint16(level1) * uint16(level2)) / 100
-	// medium + medium = low
+	return TrustLevel(combined)
-	// anything else = no trust
-
-	if level1 == TrustLevelHigh && level2 == TrustLevelHigh {
-		return TrustLevelMedium
-	}
-	if (level1 == TrustLevelHigh && level2 == TrustLevelMedium) ||
-		(level1 == TrustLevelMedium && level2 == TrustLevelHigh) {
-		return TrustLevelLow
-	}
-	if level1 == TrustLevelMedium && level2 == TrustLevelMedium {
-		return TrustLevelLow
-	}
-
-	return TrustLevel("")
 }
 
 // ReplicationFilter helps determine which events should be replicated.

pkg/protocol/directory/trust_act.go

@@ -1,6 +1,7 @@
 package directory
 
 import (
+	"crypto/rand"
 	"strconv"
 	"strings"
 	"time"
@@ -53,7 +54,7 @@ func NewTrustAct(
 	if len(targetPubkey) != 64 {
 		return nil, errorf.E("target pubkey must be 64 hex characters")
 	}
-	if err = ValidateTrustLevel(string(trustLevel)); chk.E(err) {
+	if err = ValidateTrustLevel(trustLevel); chk.E(err) {
 		return
 	}
 	if relayURL == "" {
@@ -65,7 +66,7 @@ func NewTrustAct(
 
 	// Add required tags
 	ev.Tags.Append(tag.NewFromAny(string(PubkeyTag), targetPubkey))
-	ev.Tags.Append(tag.NewFromAny(string(TrustLevelTag), string(trustLevel)))
+	ev.Tags.Append(tag.NewFromAny(string(TrustLevelTag), strconv.FormatUint(uint64(trustLevel), 10)))
 	ev.Tags.Append(tag.NewFromAny(string(RelayTag), relayURL))
 
 	// Add optional expiry
@@ -142,8 +143,12 @@ func ParseTrustAct(ev *event.E) (ta *TrustAct, err error) {
 	}
 
 	// Validate trust level
-	trustLevel := TrustLevel(trustLevelTag.Value())
+	var trustLevelValue uint64
-	if err = ValidateTrustLevel(string(trustLevel)); chk.E(err) {
+	if trustLevelValue, err = strconv.ParseUint(string(trustLevelTag.Value()), 10, 8); chk.E(err) {
+		return nil, errorf.E("invalid trust level: %w", err)
+	}
+	trustLevel := TrustLevel(trustLevelValue)
+	if err = ValidateTrustLevel(trustLevel); chk.E(err) {
 		return
 	}
 
@@ -291,7 +296,7 @@ func (ta *TrustAct) Validate() (err error) {
 		return errorf.E("target pubkey must be 64 hex characters")
 	}
 
-	if err = ValidateTrustLevel(string(ta.TrustLevel)); chk.E(err) {
+	if err = ValidateTrustLevel(ta.TrustLevel); chk.E(err) {
 		return
 	}
 
@@ -342,6 +347,39 @@ func (ta *TrustAct) ShouldReplicate(kind uint16) bool {
 	return ta.HasReplicationKind(kind)
 }
 
+// ShouldReplicateEvent determines whether a specific event should be replicated
+// based on the trust level using partial replication (random dice-throw).
+// This function uses crypto/rand for cryptographically secure randomness.
+func (ta *TrustAct) ShouldReplicateEvent(kind uint16) (shouldReplicate bool, err error) {
+	// Check if kind is eligible for replication
+	if !ta.ShouldReplicate(kind) {
+		return false, nil
+	}
+
+	// Trust level of 100 means always replicate
+	if ta.TrustLevel == TrustLevelFull {
+		return true, nil
+	}
+
+	// Trust level of 0 means never replicate
+	if ta.TrustLevel == TrustLevelNone {
+		return false, nil
+	}
+
+	// Generate cryptographically secure random number 0-100
+	var randomBytes [1]byte
+	if _, err = rand.Read(randomBytes[:]); chk.E(err) {
+		return false, errorf.E("failed to generate random number: %w", err)
+	}
+
+	// Scale byte value (0-255) to 0-100 range
+	randomValue := uint8((uint16(randomBytes[0]) * 101) / 256)
+
+	// Replicate if random value is less than or equal to trust level
+	shouldReplicate = randomValue <= uint8(ta.TrustLevel)
+	return
+}
+
 // GetTargetPubkey returns the target relay's public key.
 func (ta *TrustAct) GetTargetPubkey() string {
 	return ta.TargetPubkey

pkg/protocol/directory/types.go

@@ -55,6 +55,8 @@ var (
 	PublicKeyAdvertisementKind            = kind.New(39103)
 	DirectoryEventReplicationRequestKind  = kind.New(39104)
 	DirectoryEventReplicationResponseKind = kind.New(39105)
+	GroupTagTransferKind                  = kind.New(39106)
+	EscrowWitnessCompletionActKind        = kind.New(39107)
 )
 
 // Common tag names used across directory protocol messages
@@ -74,6 +76,20 @@ var (
 	GroupTagTag         = []byte("group_tag")
 	ActorTag            = []byte("actor")
 	ConfidenceTag       = []byte("confidence")
+	OwnersTag           = []byte("owners")
+	CreatedTag          = []byte("created")
+	FromOwnersTag       = []byte("from_owners")
+	ToOwnersTag         = []byte("to_owners")
+	TransferDateTag     = []byte("transfer_date")
+	SignaturesTag       = []byte("signatures")
+	EscrowIDTag         = []byte("escrow_id")
+	SellerWitnessTag    = []byte("seller_witness")
+	BuyerWitnessTag     = []byte("buyer_witness")
+	ConditionsTag       = []byte("conditions")
+	WitnessRoleTag      = []byte("witness_role")
+	CompletionStatusTag = []byte("completion_status")
+	VerificationHashTag = []byte("verification_hash")
+	TimestampTag        = []byte("timestamp")
 	PurposeTag          = []byte("purpose")
 	AlgorithmTag        = []byte("algorithm")
 	DerivationPathTag   = []byte("derivation_path")
@@ -85,12 +101,19 @@ var (
 )
 
 // Trust levels for trust acts
-type TrustLevel string
+// TrustLevel represents the replication percentage (0-100) indicating
+// the probability that any given event will be replicated.
+// This implements partial replication via random selection.
+type TrustLevel uint8
 
+// Suggested trust level ranges
 const (
-	TrustLevelHigh   TrustLevel = "high"
+	TrustLevelNone    TrustLevel = 0   // No replication
-	TrustLevelMedium TrustLevel = "medium"
+	TrustLevelMinimal TrustLevel = 10  // Minimal sampling (10%)
-	TrustLevelLow    TrustLevel = "low"
+	TrustLevelLow     TrustLevel = 25  // Low partial replication (25%)
+	TrustLevelMedium  TrustLevel = 50  // Medium partial replication (50%)
+	TrustLevelHigh    TrustLevel = 75  // High partial replication (75%)
+	TrustLevelFull    TrustLevel = 100 // Full replication (100%)
 )
 
 // Reason types for trust establishment
@@ -163,14 +186,12 @@ func IsDirectoryEventKind(k uint16) (isDirectory bool) {
 	}
 }
 
-// ValidateTrustLevel checks if the provided trust level is valid.
+// ValidateTrustLevel checks if the provided trust level is valid (0-100).
-func ValidateTrustLevel(level string) (err error) {
+func ValidateTrustLevel(level TrustLevel) (err error) {
-	switch TrustLevel(level) {
+	if level > 100 {
-	case TrustLevelHigh, TrustLevelMedium, TrustLevelLow:
+		return errorf.E("invalid trust level: %d (must be 0-100)", level)
-		return nil
-	default:
-		return errorf.E("invalid trust level: %s", level)
 	}
+	return nil
 }
 
 // ValidateKeyPurpose checks if the provided key purpose is valid.

pkg/protocol/directory/validation.go

@@ -29,8 +29,31 @@ var (
 	hexKeyRegex       = regexp.MustCompile(`^[0-9a-fA-F]{64}$`)
 	npubRegex         = regexp.MustCompile(`^npub1[0-9a-z]+$`)
 	wsURLRegex        = regexp.MustCompile(`^wss?://[a-zA-Z0-9.-]+(?::[0-9]+)?(?:/.*)?$`)
+	groupTagNameRegex = regexp.MustCompile(`^[a-zA-Z0-9._~-]+$`) // RFC 3986 URL-safe characters
 )
 
+// ValidateGroupTagName validates that a group tag name is URL-safe (RFC 3986).
+func ValidateGroupTagName(name string) (err error) {
+	if len(name) < 1 {
+		return errorf.E("group tag name cannot be empty")
+	}
+	if len(name) > 255 {
+		return errorf.E("group tag name cannot exceed 255 characters")
+	}
+
+	// Check for reserved prefixes
+	if strings.HasPrefix(name, ".") || strings.HasPrefix(name, "_") {
+		return errorf.E("group tag names starting with '.' or '_' are reserved for system use")
+	}
+
+	// Validate URL-safe character set
+	if !groupTagNameRegex.MatchString(name) {
+		return errorf.E("group tag name must contain only URL-safe characters (a-z, A-Z, 0-9, -, ., _, ~)")
+	}
+
+	return nil
+}
+
 // ValidateHexKey validates that a string is a valid 64-character hex key.
 func ValidateHexKey(key string) (err error) {
 	if !hexKeyRegex.MatchString(key) {