release: promote 0.6.0 cleanup candidate to main

.github/workflows/build-test.yml

@@ -91,19 +91,28 @@ jobs:
         with:
           node-version: ${{ matrix.node-version }}
           cache: 'npm'
+
+      - name: Use canonical npm version
+        run: corepack prepare npm@9.8.1 --activate
 
       - name: Install dependencies
         run: npm ci
+
+      - name: Verify package-manager policy
+        run: npm run package-manager:verify
 
       - name: Lint
         run: npm run lint
 
-      - name: Run tests
+      - name: Run routine tests
         run: npm test
+
+      - name: Run slow security and performance tests
+        run: npm run test:slow
 
-      - name: Run test coverage
+      - name: Run complete test coverage
         if: matrix.node-version == '20.x'
-        run: npm run test:coverage
+        run: npm run test:coverage:all
 
       - name: Build library
         run: npm run build
@@ -141,12 +150,18 @@ jobs:
       - name: Install dependencies
         run: bun install --frozen-lockfile
 
+      - name: Verify package-manager policy
+        run: bun run package-manager:verify
+
       - name: Lint
         run: bun run lint
 
-      - name: Run Bun tests
+      - name: Run Bun routine tests
         run: bun run test:bun
 
+      - name: Run Bun slow security and performance tests
+        run: bun run test:bun:slow
+
       - name: Build library
         run: bun run build
 

AGENTS.md

@@ -1,42 +1,51 @@
 # Repository Guidelines
 
 ## Project Structure & Module Organization
+
 - `src/` — library code by NIP in `src/nipXX/` (e.g., `src/nip46/`). Shared types in `src/types/`, utilities in `src/utils/`. Export surfaces in `src/index.ts` (update when adding modules). Follow `src/NIP_STANDARDIZATION.md` for NIP changes.
 - `tests/` — Jest tests mirror `src/` by NIP (`tests/nipXX/`) plus focused tests like `tests/utils/*.test.ts`.
 - `examples/` — runnable TypeScript examples by feature/NIP.
 - `dist/` — compiled output; do not edit.
 - `scripts/` — helper scripts (e.g., `scripts/promote-to-main.sh`).
 
 ## Build, Test, and Development Commands
-- `npm install` — install dependencies.
+
+- `corepack prepare npm@9.8.1 --activate` — activate the canonical npm toolchain.
+- `npm ci` — install the canonical dependency graph from `package-lock.json`.
+- `npm run package-manager:verify` — verify npm/Bun metadata, lockfiles, and CI policy.
 - `npm run build` — clean and compile TypeScript to `dist/`.
-- `npm test` | `npm run test:watch` | `npm run test:coverage` — run Jest, watch mode, or coverage (reports in `coverage/`).
+- `npm test` | `npm run test:watch` | `npm run test:coverage` — run the routine Jest lane, routine watch mode, or routine coverage.
+- `npm run test:slow` | `npm run test:all` | `npm run test:coverage:all` — run the named security/performance lane or the complete test/coverage inventory.
 - `npm run lint` — ESLint (`@typescript-eslint`) over `.ts` sources.
 - `npm run format` — Prettier 3 for `src/`, `tests/`, `examples/`.
 - `npm run example` (or `example:*`) | `npm start` — run examples; default is the NIP‑07 example.
 - `npm run promote` — maintainers: promote `staging` → `main`.
 
 ## Coding Style & Naming Conventions
+
 - Language: TypeScript (strict). Prefer explicit types; avoid `any`.
 - Formatting: Prettier, 2‑space indent; run `npm run format` before pushing.
 - Linting: `@typescript-eslint`; intentionally unused vars prefixed with `_`.
 - Naming: `camelCase` for variables/functions; `PascalCase` for types/classes. New NIP code goes under `src/nipXX/` and is exported via `src/index.ts`.
 
 ## Testing Guidelines
+
 - Framework: Jest with `ts-jest`, Node environment.
 - Naming: `*.test.ts` or `*.spec.ts`; mirror the `src/` layout.
-- Coverage: keep or improve; use `npm run test:coverage`.
+- Coverage: keep or improve; use `npm run test:coverage:all` before review so slow-lane files remain covered.
 - Use test vectors and the ephemeral relay; never include real credentials.
 
 ## Commit & Pull Request Guidelines
+
 - Commits: Conventional Commits (`feat:`, `fix:`, `refactor:`, `docs:`, `test:`, `chore:`), imperative and concise.
 - Branches: create from `staging` using `feature/<name>` or `fix/<name>`; PRs target `staging`.
-- PR checklist: clear what/why, linked issues (e.g., `#123`), tests and examples updated if behavior changes. Run `npm run lint && npm test && npm run build` before opening.
+- PR checklist: clear what/why, linked issues (e.g., `#123`), tests and examples updated if behavior changes. Run `npm run lint && npm run test:all && npm run build` before opening.
 
 ## Security & Configuration Tips
+
 - Do not commit private keys, secrets, or real credentials.
 - Prefer `.env` files ignored by Git; document required vars in examples or readme.
 
 ## Agent‑Specific Notes
-- This AGENTS.md applies repo‑wide. A deeper `AGENTS.md` overrides within its folder subtree. Follow the structure and style above when adding files and exports.
 
+- This AGENTS.md applies repo‑wide. A deeper `AGENTS.md` overrides within its folder subtree. Follow the structure and style above when adding files and exports.

CHANGELOG.md

@@ -7,6 +7,26 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+- A supported `snstr/testing` subpath now owns the Node-only `NostrRelay` test Relay and framework-neutral Relay test-double types without leaking Jest into published application declarations.
+- Canonical NIP-01 client and Relay wire-message tuple types now provide one authoritative protocol definition.
+- Repository tooling now enforces npm 9.8.1 as the release package manager, Bun as a pinned compatibility runner, and explicit routine, slow, and complete test lanes.
+
+### Changed
+- Relay event storage, Nostr Relay registry management, NIP-47 protocol codecs and dispatch, NIP-46 request machinery, NIP-57 client behavior, and ephemeral Relay transport/session/filter responsibilities now live behind smaller internal modules while preserving their public 0.x facades.
+- Production diagnostics now use one compatible logger policy across Nostr, Relay, RelayPool, NIP-46, NIP-47, NIP-57, and stateless protocol helpers.
+- Structural regression tests now prefer public behavior and owned testing seams over private implementation shapes.
+
+### Fixed
+- NIP-44 decryption now rejects unsupported legacy payload versions and malformed v2 nonce sizes through the public decrypt path.
+- NIP-47 service initialization is idempotent, concurrent-safe, and restartable after disconnect.
+- NIP-57 client flows share cache, filter, invoice, and statistics behavior while preserving explicit limit values, including zero.
+- Ephemeral Relay shutdown now retains runtime error handling, releases transports when session cleanup rejects, and stops session polling without stale routes.
+
+### Security
+- NIP-46 connection secrets, private keys, decrypted payloads, and untrusted error text are excluded from diagnostic output.
+- Generic key, wire-format, and resource-limit validation now has canonical ownership so NIP-specific policies cannot silently drift.
+
 ## [0.5.0] - 2026-07-18
 
 ### Added

CLAUDE.md

@@ -32,9 +32,12 @@ npm run format                   # Format code with Prettier
 
 ### Testing
 ```bash
-npm test                         # Run all tests
-npm run test:watch              # Run tests in watch mode
-npm run test:coverage           # Generate coverage report
+npm test                         # Run the routine feedback lane
+npm run test:slow               # Run security/performance load tests
+npm run test:all                # Run the complete routine + slow inventory
+npm run test:watch              # Run routine tests in watch mode
+npm run test:coverage           # Generate routine coverage
+npm run test:coverage:all       # Generate complete coverage for review/CI
 npm run test:nip01              # Test core NIP-01 functionality
 npm run test:nip04              # Test specific NIP (replace 04 with any NIP number)
 npm run test:crypto             # Test all crypto functionality

CONTRIBUTING.md

@@ -16,8 +16,9 @@ Thank you for your interest in contributing to SNSTR! This document provides gui
 
 1. Fork the repository
 2. Clone your fork: `git clone https://github.com/your-username/snstr.git`
-3. Install dependencies: `npm install`
-4. Build the project: `npm run build`
+3. Activate the canonical npm version: `corepack prepare npm@9.8.1 --activate`
+4. Install dependencies: `npm ci`
+5. Build the project: `npm run build`
 
 ## Development Workflow
 
@@ -91,6 +92,21 @@ The CI pipeline runs tests for both `main` and `staging` branches, but releases
 
 ## Release Process
 
+### Package-manager policy
+
+npm 9.8.1 is the canonical package manager for dependency changes, clean
+installs, scripts, and releases. Use `npm install` when intentionally changing
+dependencies, commit the resulting `package-lock.json`, and use `npm ci` for a
+reproducible clean install. Do not add pnpm, Yarn, or shrinkwrap lockfiles.
+Activate it with `corepack prepare npm@9.8.1 --activate`, then confirm
+`npm --version` prints `9.8.1` before running canonical workflows.
+
+Bun 1.3.9 is a supported compatibility runner, pinned in `.bun-version`.
+When dependencies change, refresh and commit `bun.lock`, then confirm
+`bun install --frozen-lockfile` succeeds. Bun does not own releases or the
+canonical dependency graph. Run `npm run package-manager:verify` before
+submitting dependency or CI changes.
+
 SNSTR releases are currently performed manually from `main` after verified
 changes are promoted from `staging`.