From 82b5caa76df37201e41913be83c5835873979257 Mon Sep 17 00:00:00 2001
From: mstrofnone <mstrofnone@protonmail.com>
Date: Tue, 19 May 2026 23:50:30 +1000
Subject: [PATCH] feat(namecoin): resolve .bit NIP-05 identifiers via Namecoin
 ElectrumX

Adds optional Namecoin .bit verification to the existing NIP-05 path.
Identifiers ending in .bit (and the d/<name> / id/<name> shorthands)
are routed to a small browser-WSS ElectrumX client instead of HTTPS,
giving users a DNS-free option for identity verification.

Wire format follows the parallel ports in Amethyst (Kotlin), Nostur
(Swift), nostr-tools PR #533 / Jumble PR #774 / nostrudel PR #352
(JS), and dart-nostr PR #44 (Dart, merged). Domain names use
"nostr.names[<local>]" with optional "nostr.relays" map; identity
names (id/) use "nostr.pubkey" + array relays; the shorthand
"nostr": "<hex>" form is accepted for root entries.

- Module: src/lib/namecoin/ (cache + electrumx + parser + tests).
- Single hook: src/lib/Nip05.ts wraps nostr-tools queryProfile,
  routing .bit identifiers and falling through for everything else.
- Two call sites updated: NostrAddress.svelte (profile NIP-05 row)
  and the npub route slug-overwrite path.
- No new top-level UI: the existing verified checkmark either lights
  up or stays dark, no extra badges or noise.
- Browser-WSS pool is the 4-of-6 subset of amethyst's
  DEFAULT_ELECTRUMX_SERVERS that operators expose over WSS. Bare-IP
  amethyst entries are deliberately skipped (no IP-SAN cert path in
  browsers). Documented in a comment in electrumx.ts.
- 21 new unit tests, all passing; full suite stays at 103/103.

Try it: `_@mstrofnone.bit` resolves to the same pubkey as the
existing mstrofnone npub.
---
 web/package-lock.json                         |  21 +-
 web/package.json                              |   1 +
 web/src/lib/Nip05.ts                          |  26 ++
 web/src/lib/components/NostrAddress.svelte    |   4 +-
 web/src/lib/namecoin/cache.ts                 |  52 +++
 web/src/lib/namecoin/electrumx.ts             | 333 ++++++++++++++++++
 web/src/lib/namecoin/index.ts                 |  23 ++
 web/src/lib/namecoin/nip05.test.ts            | 313 ++++++++++++++++
 web/src/lib/namecoin/nip05.ts                 | 243 +++++++++++++
 .../(app)/[slug=npub]/(tabs)/+page.svelte     |   4 +-
 10 files changed, 1012 insertions(+), 8 deletions(-)
 create mode 100644 web/src/lib/Nip05.ts
 create mode 100644 web/src/lib/namecoin/cache.ts
 create mode 100644 web/src/lib/namecoin/electrumx.ts
 create mode 100644 web/src/lib/namecoin/index.ts
 create mode 100644 web/src/lib/namecoin/nip05.test.ts
 create mode 100644 web/src/lib/namecoin/nip05.ts

diff --git a/web/package-lock.json b/web/package-lock.json
index d36e6896..c20f7833 100644
--- a/web/package-lock.json
+++ b/web/package-lock.json
@@ -10,6 +10,7 @@
 			"dependencies": {
 				"@emoji-mart/data": "^1.2.1",
 				"@floating-ui/dom": "^1.7.6",
+				"@noble/hashes": "^2.2.0",
 				"@rust-nostr/nostr-sdk": "^0.44.0",
 				"@tabler/icons-svelte": "^3.41.1",
 				"@tabler/icons-webfont": "^3.41.1",
@@ -1806,12 +1807,12 @@
 			}
 		},
 		"node_modules/@noble/hashes": {
-			"version": "1.7.1",
-			"resolved": "https://registry.npmjs.org/@noble/hashes/-/hashes-1.7.1.tgz",
-			"integrity": "sha512-B8XBPsn4vT/KJAGqDzbwztd+6Yte3P4V7iafm24bxgDe/mlRuK6xmWPuCNrKt2vDafZ8MfJLlchDG/vYafQEjQ==",
+			"version": "2.2.0",
+			"resolved": "https://registry.npmjs.org/@noble/hashes/-/hashes-2.2.0.tgz",
+			"integrity": "sha512-IYqDGiTXab6FniAgnSdZwgWbomxpy9FtYvLKs7wCUs2a8RkITG+DFGO1DM9cr+E3/RgADRpFjrKVaJ1z6sjtEg==",
 			"license": "MIT",
 			"engines": {
-				"node": "^14.21.3 || >=16"
+				"node": ">= 20.19.0"
 			},
 			"funding": {
 				"url": "https://paulmillr.com/funding/"
@@ -8402,6 +8403,18 @@
 				}
 			}
 		},
+		"node_modules/rx-nostr-crypto/node_modules/@noble/hashes": {
+			"version": "1.8.0",
+			"resolved": "https://registry.npmjs.org/@noble/hashes/-/hashes-1.8.0.tgz",
+			"integrity": "sha512-jCs9ldd7NwzpgXDIf6P3+NrHh9/sD6CQdxHyjQI+h/6rDNo88ypBxxz45UDuZHz9r3tNz7N/VInSVoVdtXEI4A==",
+			"license": "MIT",
+			"engines": {
+				"node": "^14.21.3 || >=16"
+			},
+			"funding": {
+				"url": "https://paulmillr.com/funding/"
+			}
+		},
 		"node_modules/rx-nostr-crypto/node_modules/nostr-typedef": {
 			"version": "0.9.0",
 			"resolved": "https://registry.npmjs.org/nostr-typedef/-/nostr-typedef-0.9.0.tgz",
diff --git a/web/package.json b/web/package.json
index cc9e701e..a49b188f 100644
--- a/web/package.json
+++ b/web/package.json
@@ -51,6 +51,7 @@
 	"dependencies": {
 		"@emoji-mart/data": "^1.2.1",
 		"@floating-ui/dom": "^1.7.6",
+		"@noble/hashes": "^2.2.0",
 		"@rust-nostr/nostr-sdk": "^0.44.0",
 		"@tabler/icons-svelte": "^3.41.1",
 		"@tabler/icons-webfont": "^3.41.1",
diff --git a/web/src/lib/Nip05.ts b/web/src/lib/Nip05.ts
new file mode 100644
index 00000000..fbb151c3
--- /dev/null
+++ b/web/src/lib/Nip05.ts
@@ -0,0 +1,26 @@
+/**
+ * Thin wrapper around `nostr-tools` NIP-05 lookups that routes
+ * Namecoin `.bit` identifiers to the chain resolver instead of HTTPS.
+ *
+ * All existing call sites use the same `{ pubkey, relays? }` shape, so
+ * the wrapper returns the same `ProfilePointer | null` contract. When
+ * the identifier is not a `.bit`-style name, the call falls through
+ * to `nip05.queryProfile` from `nostr-tools` unchanged.
+ */
+import { nip05 } from 'nostr-tools';
+import type { ProfilePointer } from 'nostr-tools/nip19';
+import { isDotBitIdentifier, queryProfile as queryNamecoin } from './namecoin';
+
+/**
+ * Resolve a NIP-05 identifier. `.bit` (Namecoin) identifiers are
+ * resolved over the Namecoin chain; everything else falls through to
+ * nostr-tools.
+ */
+export async function queryProfile(identifier: string): Promise<ProfilePointer | null> {
+	if (isDotBitIdentifier(identifier)) {
+		const result = await queryNamecoin(identifier);
+		if (!result) return null;
+		return { pubkey: result.pubkey, relays: result.relays ?? [] };
+	}
+	return nip05.queryProfile(identifier);
+}
diff --git a/web/src/lib/components/NostrAddress.svelte b/web/src/lib/components/NostrAddress.svelte
index 8b64ec8a..a87fddc4 100644
--- a/web/src/lib/components/NostrAddress.svelte
+++ b/web/src/lib/components/NostrAddress.svelte
@@ -1,6 +1,6 @@
 <script lang="ts">
 	import { _ } from 'svelte-i18n';
-	import { nip05 } from 'nostr-tools';
+	import { queryProfile } from '$lib/Nip05';
 	import type { Metadata } from '$lib/Items';
 	import IconRosetteDiscountCheck from '@tabler/icons-svelte/icons/rosette-discount-check';
 	import IconAlertTriangle from '@tabler/icons-svelte/icons/alert-triangle';
@@ -17,7 +17,7 @@
 {#if normalizedNip05}
 	<div class="nip05">
 		<span>{normalizedNip05}</span>
-		{#await nip05.queryProfile(normalizedNip05) then pointer}
+		{#await queryProfile(normalizedNip05) then pointer}
 			{#if pointer === null}
 				<IconAlertTriangle color="orange" />
 				<span class="label">{$_('profile.nip05.unknown')}</span>
diff --git a/web/src/lib/namecoin/cache.ts b/web/src/lib/namecoin/cache.ts
new file mode 100644
index 00000000..9aa4b119
--- /dev/null
+++ b/web/src/lib/namecoin/cache.ts
@@ -0,0 +1,52 @@
+/**
+ * Session-level in-memory cache for Namecoin `.bit` NIP-05 resolutions.
+ * Survives across components within a single browser session and dedupes
+ * concurrent lookups. No TTL — entries live for the lifetime of the
+ * runtime; on a hard navigation the cache is rebuilt.
+ */
+import type { NamecoinResolveResult } from './nip05';
+
+const POS_CACHE = new Map<string, NamecoinResolveResult>();
+const NEG_CACHE = new Set<string>();
+const INFLIGHT = new Map<string, Promise<NamecoinResolveResult | null>>();
+
+function normalizeKey(identifier: string): string {
+	return identifier.trim().toLowerCase();
+}
+
+export function getCached(identifier: string): NamecoinResolveResult | null | undefined {
+	const key = normalizeKey(identifier);
+	if (POS_CACHE.has(key)) return POS_CACHE.get(key)!;
+	if (NEG_CACHE.has(key)) return null;
+	return undefined;
+}
+
+export function setCached(identifier: string, result: NamecoinResolveResult | null): void {
+	const key = normalizeKey(identifier);
+	if (result) {
+		POS_CACHE.set(key, result);
+		NEG_CACHE.delete(key);
+	} else {
+		NEG_CACHE.add(key);
+		POS_CACHE.delete(key);
+	}
+}
+
+export function getInflight(identifier: string): Promise<NamecoinResolveResult | null> | undefined {
+	return INFLIGHT.get(normalizeKey(identifier));
+}
+
+export function setInflight(identifier: string, p: Promise<NamecoinResolveResult | null>): void {
+	INFLIGHT.set(normalizeKey(identifier), p);
+}
+
+export function deleteInflight(identifier: string): void {
+	INFLIGHT.delete(normalizeKey(identifier));
+}
+
+/** Test-only helper. Resets cache state. */
+export function _resetCache(): void {
+	POS_CACHE.clear();
+	NEG_CACHE.clear();
+	INFLIGHT.clear();
+}
diff --git a/web/src/lib/namecoin/electrumx.ts b/web/src/lib/namecoin/electrumx.ts
new file mode 100644
index 00000000..35bb1c63
--- /dev/null
+++ b/web/src/lib/namecoin/electrumx.ts
@@ -0,0 +1,333 @@
+/**
+ * Browser-native ElectrumX client for Namecoin `name_show` lookups.
+ *
+ * Queries a small pool of public Namecoin ElectrumX servers over WSS,
+ * locates the most recent `NAME_UPDATE` transaction for `d/<domain>` or
+ * `id/<name>` via the scripthash history, and returns the raw value
+ * string for the caller to parse.
+ *
+ * Wire format mirrors the parallel ports in:
+ *   - Amethyst    (Kotlin, vitorpamplona/amethyst, several merged PRs)
+ *   - Nostur      (Swift, nostur-com/Nostur PR #60)
+ *   - nostr-tools (JS,    nbd-wtf/nostr-tools PR #533, in review)
+ *   - Jumble      (JS,    CodyTseng/jumble PR #774, in review)
+ *   - nostrudel   (JS,    hzrd149/nostrudel PR #352, in review)
+ *   - dart-nostr  (Dart,  ethicnology/dart-nostr PR #44, merged)
+ */
+import { sha256 } from '@noble/hashes/sha2.js';
+import { bytesToHex } from '@noble/hashes/utils.js';
+
+/** A single Namecoin ElectrumX endpoint. */
+export type ElectrumXServer = {
+	/** Hostname, e.g. `electrum.nmc.ethicnology.com`. */
+	host: string;
+	/** Port, e.g. `50004` for the WSS endpoint. */
+	port: number;
+	/** WSS path. Defaults to `/`. */
+	path?: string;
+};
+
+/**
+ * Default Namecoin ElectrumX WSS pool, tried in order.
+ *
+ * This is the browser-WSS subset of amethyst's
+ * `quartz/.../namecoin/ElectrumXServer.kt` `DEFAULT_ELECTRUMX_SERVERS`.
+ * Amethyst additionally carries two bare-IP entries (`23.158.233.10`,
+ * `46.229.238.187`) over its JVM TLS path, but browsers refuse WSS to
+ * bare IPs without an IP-SAN certificate so we intentionally omit them
+ * here. The Let's Encrypt-fronted `electrum.nmc.ethicnology.com` host
+ * is the most browser-friendly; the other three currently serve
+ * self-signed certs and will only succeed if the user has explicitly
+ * trusted them in their browser (TOFU). This matches the calm-failure
+ * UX: `.bit` verification is optional and falls back silently.
+ */
+export const DEFAULT_ELECTRUMX_SERVERS: ElectrumXServer[] = [
+	{ host: 'electrumx.testls.space', port: 50004 },
+	{ host: 'nmc2.bitcoins.sk', port: 57004 },
+	{ host: 'relay.testls.bit', port: 50004 },
+	{ host: 'electrum.nmc.ethicnology.com', port: 50004 }
+];
+
+/** ~250 days, the Namecoin name expiry depth. */
+const NAME_EXPIRE_DEPTH = 36000;
+
+const OP_NAME_UPDATE = 0x53;
+const OP_2DROP = 0x6d;
+const OP_DROP = 0x75;
+const OP_RETURN = 0x6a;
+const OP_PUSHDATA1 = 0x4c;
+const OP_PUSHDATA2 = 0x4d;
+const OP_PUSHDATA4 = 0x4e;
+
+const textEncoder = new TextEncoder();
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+type WebSocketCtor = any;
+let _WebSocket: WebSocketCtor = (globalThis as { WebSocket?: WebSocketCtor }).WebSocket;
+
+/** Inject a WebSocket implementation (useful in Node tests). */
+export function useWebSocketImplementation(impl: WebSocketCtor): void {
+	_WebSocket = impl;
+}
+
+class NameMissError extends Error {}
+
+/** Look up `name` across the configured servers; returns the value string or `null`. */
+export async function nameShow(
+	name: string,
+	servers: ElectrumXServer[] = DEFAULT_ELECTRUMX_SERVERS
+): Promise<string | null> {
+	let definitiveMiss = false;
+	for (const srv of servers) {
+		try {
+			return await nameShowOne(name, srv);
+		} catch (err) {
+			if (err instanceof NameMissError) {
+				definitiveMiss = true;
+				continue;
+			}
+			// Transport error — try next.
+		}
+	}
+	if (definitiveMiss) return null;
+	return null;
+}
+
+async function nameShowOne(name: string, srv: ElectrumXServer): Promise<string | null> {
+	if (!_WebSocket) {
+		throw new Error('namecoin: no WebSocket implementation available');
+	}
+
+	const url = buildWSSUrl(srv);
+	const rpc = new RPC(new _WebSocket(url));
+	try {
+		await rpc.opened;
+		await rpc.call('server.version', ['nostter/namecoin-nip05', '1.4']);
+
+		const script = buildNameIndexScript(textEncoder.encode(name));
+		const scriptHash = electrumScriptHash(script);
+		const history = await rpc.call<Array<{ tx_hash: string; height: number }>>(
+			'blockchain.scripthash.get_history',
+			[scriptHash]
+		);
+		if (!history || history.length === 0) throw new NameMissError();
+		const latest = history[history.length - 1];
+
+		const tx = await rpc.call<{ vout: Array<{ scriptPubKey?: { hex?: string } }> }>(
+			'blockchain.transaction.get',
+			[latest.tx_hash, true]
+		);
+
+		let currentHeight = 0;
+		try {
+			const header = await rpc.call<{ height?: number }>('blockchain.headers.subscribe', []);
+			if (header && typeof header.height === 'number') currentHeight = header.height;
+		} catch {
+			// Non-fatal: skip the expiry guard.
+		}
+		if (
+			currentHeight > 0 &&
+			latest.height > 0 &&
+			currentHeight - latest.height >= NAME_EXPIRE_DEPTH
+		) {
+			return null;
+		}
+
+		return extractNameValue(tx.vout, name);
+	} finally {
+		rpc.close();
+	}
+}
+
+function buildWSSUrl(srv: ElectrumXServer): string {
+	const path = srv.path ?? '/';
+	return `wss://${srv.host}:${srv.port}${path.startsWith('/') ? path : '/' + path}`;
+}
+
+/** Minimal JSON-RPC-2.0 over WebSocket. */
+class RPC {
+	opened: Promise<void>;
+	// eslint-disable-next-line @typescript-eslint/no-explicit-any
+	private ws: any;
+	private id = 0;
+	private pending = new Map<
+		number,
+		{ resolve: (v: unknown) => void; reject: (e: Error) => void }
+	>();
+
+	// eslint-disable-next-line @typescript-eslint/no-explicit-any
+	constructor(ws: any) {
+		this.ws = ws;
+		this.opened = new Promise((resolve, reject) => {
+			ws.addEventListener('open', () => resolve());
+			ws.addEventListener('error', () => reject(new Error('websocket error')));
+			ws.addEventListener('close', () => {
+				for (const p of this.pending.values()) p.reject(new Error('websocket closed'));
+				this.pending.clear();
+			});
+		});
+		ws.addEventListener('message', (ev: { data: unknown }) => this.onMessage(ev));
+	}
+
+	async call<T = unknown>(method: string, params: unknown[]): Promise<T> {
+		const id = ++this.id;
+		const msg = JSON.stringify({ jsonrpc: '2.0', id, method, params });
+		return new Promise<T>((resolve, reject) => {
+			this.pending.set(id, { resolve: (v) => resolve(v as T), reject });
+			try {
+				this.ws.send(msg);
+			} catch (e) {
+				this.pending.delete(id);
+				reject(e instanceof Error ? e : new Error(String(e)));
+			}
+		});
+	}
+
+	private onMessage(ev: { data: unknown }): void {
+		let parsed: { id?: number; result?: unknown; error?: unknown };
+		try {
+			const data =
+				typeof ev.data === 'string'
+					? ev.data
+					: new TextDecoder().decode(ev.data as ArrayBuffer);
+			parsed = JSON.parse(data);
+		} catch {
+			return;
+		}
+		if (typeof parsed.id !== 'number') return;
+		const p = this.pending.get(parsed.id);
+		if (!p) return;
+		this.pending.delete(parsed.id);
+		if (parsed.error) {
+			p.reject(
+				new Error(
+					typeof parsed.error === 'string' ? parsed.error : JSON.stringify(parsed.error)
+				)
+			);
+		} else {
+			p.resolve(parsed.result);
+		}
+	}
+
+	close(): void {
+		try {
+			this.ws.close();
+		} catch {
+			// ignore
+		}
+	}
+}
+
+function buildNameIndexScript(nameBytes: Uint8Array): Uint8Array {
+	const parts: number[] = [];
+	parts.push(OP_NAME_UPDATE);
+	pushData(parts, nameBytes);
+	pushData(parts, new Uint8Array(0));
+	parts.push(OP_2DROP, OP_DROP, OP_RETURN);
+	return new Uint8Array(parts);
+}
+
+function pushData(out: number[], data: Uint8Array): void {
+	const n = data.length;
+	if (n < OP_PUSHDATA1) {
+		out.push(n);
+	} else if (n <= 0xff) {
+		out.push(OP_PUSHDATA1, n);
+	} else {
+		out.push(OP_PUSHDATA2, n & 0xff, (n >> 8) & 0xff);
+	}
+	for (let i = 0; i < n; i++) out.push(data[i]);
+}
+
+/** SHA-256 of `script`, byte-reversed, hex-encoded. */
+function electrumScriptHash(script: Uint8Array): string {
+	const digest = sha256(script);
+	const reversed = new Uint8Array(digest.length);
+	for (let i = 0; i < digest.length; i++) reversed[i] = digest[digest.length - 1 - i];
+	return bytesToHex(reversed);
+}
+
+export function extractNameValue(
+	vouts: Array<{ scriptPubKey?: { hex?: string } }>,
+	name: string
+): string | null {
+	for (const vout of vouts || []) {
+		const hex = vout?.scriptPubKey?.hex;
+		if (!hex || !hex.startsWith('53')) continue;
+		let bytes: Uint8Array;
+		try {
+			bytes = hexToBytes(hex);
+		} catch {
+			continue;
+		}
+		const parsed = parseNameScript(bytes);
+		if (!parsed) continue;
+		if (parsed.name === name) return parsed.value;
+	}
+	return null;
+}
+
+function parseNameScript(script: Uint8Array): { name: string; value: string } | null {
+	if (script.length === 0 || script[0] !== OP_NAME_UPDATE) return null;
+	let pos = 1;
+	const nameRead = readPushData(script, pos);
+	if (!nameRead) return null;
+	pos = nameRead.next;
+	const valueRead = readPushData(script, pos);
+	if (!valueRead) return null;
+	const decoder = new TextDecoder('utf-8', { fatal: false });
+	return { name: decoder.decode(nameRead.data), value: decoder.decode(valueRead.data) };
+}
+
+function readPushData(script: Uint8Array, pos: number): { data: Uint8Array; next: number } | null {
+	if (pos >= script.length) return null;
+	const op = script[pos];
+	if (op === 0x00) return { data: new Uint8Array(0), next: pos + 1 };
+	if (op < OP_PUSHDATA1) {
+		const length = op;
+		const end = pos + 1 + length;
+		if (end > script.length) return null;
+		return { data: script.slice(pos + 1, end), next: end };
+	}
+	if (op === OP_PUSHDATA1) {
+		if (pos + 2 > script.length) return null;
+		const length = script[pos + 1];
+		const end = pos + 2 + length;
+		if (end > script.length) return null;
+		return { data: script.slice(pos + 2, end), next: end };
+	}
+	if (op === OP_PUSHDATA2) {
+		if (pos + 3 > script.length) return null;
+		const length = script[pos + 1] | (script[pos + 2] << 8);
+		const end = pos + 3 + length;
+		if (end > script.length) return null;
+		return { data: script.slice(pos + 3, end), next: end };
+	}
+	if (op === OP_PUSHDATA4) {
+		if (pos + 5 > script.length) return null;
+		const length =
+			script[pos + 1] |
+			(script[pos + 2] << 8) |
+			(script[pos + 3] << 16) |
+			(script[pos + 4] << 24);
+		const end = pos + 5 + length;
+		if (end < 0 || end > script.length) return null;
+		return { data: script.slice(pos + 5, end), next: end };
+	}
+	return null;
+}
+
+function hexToBytes(hex: string): Uint8Array {
+	if (hex.length % 2 !== 0) throw new Error('hex: odd length');
+	const out = new Uint8Array(hex.length / 2);
+	for (let i = 0; i < out.length; i++) {
+		const b = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+		if (Number.isNaN(b)) throw new Error('hex: invalid byte');
+		out[i] = b;
+	}
+	return out;
+}
+
+/** Suppress the unused-variable warning for opcodes kept for readability. */
+void OP_DROP;
+void OP_RETURN;
diff --git a/web/src/lib/namecoin/index.ts b/web/src/lib/namecoin/index.ts
new file mode 100644
index 00000000..18e68e8d
--- /dev/null
+++ b/web/src/lib/namecoin/index.ts
@@ -0,0 +1,23 @@
+/**
+ * Namecoin `.bit` NIP-05 resolution surface.
+ *
+ * Single import point. The `.bit` path is intentionally a drop-in
+ * extension of the existing NIP-05 verification: callers ask the same
+ * "is this pubkey bound to this identifier?" question, the resolver
+ * just routes the lookup over a Namecoin ElectrumX server pool instead
+ * of HTTPS when the identifier ends in `.bit` (or starts with `d/` /
+ * `id/`). Failures fall back silently — the existing checkmark either
+ * shows or it doesn't, no extra UI noise.
+ */
+export {
+	queryProfile,
+	isValid,
+	isDotBitIdentifier,
+	parseIdentifier,
+	extractNostrFromValue,
+	DEFAULT_ELECTRUMX_SERVERS,
+	useWebSocketImplementation,
+	type NamecoinResolveResult,
+	type ElectrumXServer,
+	type ParsedIdentifier
+} from './nip05';
diff --git a/web/src/lib/namecoin/nip05.test.ts b/web/src/lib/namecoin/nip05.test.ts
new file mode 100644
index 00000000..a848ebff
--- /dev/null
+++ b/web/src/lib/namecoin/nip05.test.ts
@@ -0,0 +1,313 @@
+import { describe, it, expect, beforeEach } from 'vitest';
+import {
+	isDotBitIdentifier,
+	parseIdentifier,
+	extractNostrFromValue,
+	queryProfile,
+	isValid,
+	useWebSocketImplementation
+} from './nip05';
+import { _resetCache } from './cache';
+
+describe('namecoin/nip05 — identifier detection', () => {
+	it('accepts .bit shapes', () => {
+		expect(isDotBitIdentifier('alice.bit')).toBe(true);
+		expect(isDotBitIdentifier('ALICE.BIT')).toBe(true);
+		expect(isDotBitIdentifier('alice@example.bit')).toBe(true);
+		expect(isDotBitIdentifier('d/example')).toBe(true);
+		expect(isDotBitIdentifier('id/alice')).toBe(true);
+		expect(isDotBitIdentifier('nostr:d/example')).toBe(true);
+		expect(isDotBitIdentifier('  alice@example.bit  ')).toBe(true);
+	});
+
+	it('rejects DNS NIP-05 and empty input', () => {
+		expect(isDotBitIdentifier('')).toBe(false);
+		expect(isDotBitIdentifier(null)).toBe(false);
+		expect(isDotBitIdentifier(undefined)).toBe(false);
+		expect(isDotBitIdentifier('alice@example.com')).toBe(false);
+		expect(isDotBitIdentifier('example.com')).toBe(false);
+		expect(isDotBitIdentifier('d')).toBe(false);
+		expect(isDotBitIdentifier('d/')).toBe(false);
+		expect(isDotBitIdentifier('.bit')).toBe(false);
+	});
+});
+
+describe('namecoin/nip05 — parseIdentifier', () => {
+	it('parses bare .bit names', () => {
+		expect(parseIdentifier('example.bit')).toEqual({
+			namecoinName: 'd/example',
+			localPart: '_',
+			isDomain: true
+		});
+	});
+
+	it('parses user@example.bit', () => {
+		expect(parseIdentifier('alice@example.bit')).toEqual({
+			namecoinName: 'd/example',
+			localPart: 'alice',
+			isDomain: true
+		});
+	});
+
+	it('parses d/<name> and id/<name>', () => {
+		expect(parseIdentifier('d/testls')).toEqual({
+			namecoinName: 'd/testls',
+			localPart: '_',
+			isDomain: true
+		});
+		expect(parseIdentifier('id/alice')).toEqual({
+			namecoinName: 'id/alice',
+			localPart: '_',
+			isDomain: false
+		});
+	});
+
+	it('tolerates a nostr: NIP-21 prefix', () => {
+		expect(parseIdentifier('nostr:alice@example.bit')).toEqual({
+			namecoinName: 'd/example',
+			localPart: 'alice',
+			isDomain: true
+		});
+	});
+
+	it('lowercases on parse', () => {
+		const p = parseIdentifier('Alice@EXAMPLE.bit');
+		expect(p?.localPart).toBe('alice');
+		expect(p?.namecoinName).toBe('d/example');
+	});
+
+	it('returns null for malformed input', () => {
+		expect(parseIdentifier('')).toBeNull();
+		expect(parseIdentifier('alice@.bit')).toBeNull();
+	});
+});
+
+describe('namecoin/nip05 — extractNostrFromValue', () => {
+	const pk = 'a'.repeat(64);
+	const pkB = 'b'.repeat(64);
+
+	it('handles the simple "nostr": "<hex>" form on the root entry', () => {
+		const v = JSON.stringify({ nostr: pk });
+		const got = extractNostrFromValue(v, {
+			namecoinName: 'd/example',
+			localPart: '_',
+			isDomain: true
+		});
+		expect(got).toEqual({ pubkey: pk });
+	});
+
+	it('rejects the simple form on a non-root local-part', () => {
+		const v = JSON.stringify({ nostr: pk });
+		expect(
+			extractNostrFromValue(v, {
+				namecoinName: 'd/example',
+				localPart: 'alice',
+				isDomain: true
+			})
+		).toBeNull();
+	});
+
+	it('picks the exact local-part from a domain names object', () => {
+		const v = JSON.stringify({ nostr: { names: { alice: pk, bob: pkB } } });
+		const got = extractNostrFromValue(v, {
+			namecoinName: 'd/example',
+			localPart: 'alice',
+			isDomain: true
+		});
+		expect(got).toEqual({ pubkey: pk });
+	});
+
+	it('falls back to the _ root entry', () => {
+		const v = JSON.stringify({ nostr: { names: { _: pk } } });
+		const got = extractNostrFromValue(v, {
+			namecoinName: 'd/example',
+			localPart: '_',
+			isDomain: true
+		});
+		expect(got).toEqual({ pubkey: pk });
+	});
+
+	it('surfaces relays for a domain names object', () => {
+		const v = JSON.stringify({
+			nostr: { names: { alice: pk }, relays: { [pk]: ['wss://r1', 'wss://r2'] } }
+		});
+		const got = extractNostrFromValue(v, {
+			namecoinName: 'd/example',
+			localPart: 'alice',
+			isDomain: true
+		});
+		expect(got).toEqual({ pubkey: pk, relays: ['wss://r1', 'wss://r2'] });
+	});
+
+	it('handles the id/ identity object shape', () => {
+		const v = JSON.stringify({ nostr: { pubkey: pk, relays: ['wss://r1'] } });
+		const got = extractNostrFromValue(v, {
+			namecoinName: 'id/alice',
+			localPart: '_',
+			isDomain: false
+		});
+		expect(got).toEqual({ pubkey: pk, relays: ['wss://r1'] });
+	});
+
+	it('returns null when the value has no nostr field', () => {
+		expect(
+			extractNostrFromValue('{}', {
+				namecoinName: 'd/example',
+				localPart: '_',
+				isDomain: true
+			})
+		).toBeNull();
+	});
+
+	it('returns null when the pubkey is not 64-char hex', () => {
+		const v = JSON.stringify({ nostr: 'not-a-pubkey' });
+		expect(
+			extractNostrFromValue(v, {
+				namecoinName: 'd/example',
+				localPart: '_',
+				isDomain: true
+			})
+		).toBeNull();
+	});
+
+	it('returns null on invalid JSON', () => {
+		expect(
+			extractNostrFromValue('not-json', {
+				namecoinName: 'd/example',
+				localPart: '_',
+				isDomain: true
+			})
+		).toBeNull();
+	});
+});
+
+// ---------------------------------------------------------------------------
+// Resolver integration — uses a mock WebSocket implementation, so no
+// network calls leak out of the test runner.
+// ---------------------------------------------------------------------------
+
+type Listener = (ev: { data: unknown }) => void;
+
+class MockSocket {
+	url: string;
+	private listeners = new Map<string, Set<Listener>>();
+	private responder: (msg: { id: number; method: string; params: unknown[] }) => unknown;
+
+	constructor(url: string, responder: typeof MockSocket.prototype.responder) {
+		this.url = url;
+		this.responder = responder;
+		setTimeout(() => this.emit('open', {}), 0);
+	}
+
+	addEventListener(type: string, fn: Listener): void {
+		if (!this.listeners.has(type)) this.listeners.set(type, new Set());
+		this.listeners.get(type)!.add(fn);
+	}
+
+	send(raw: string): void {
+		const msg = JSON.parse(raw);
+		const result = this.responder(msg);
+		setTimeout(() => {
+			this.emit('message', { data: JSON.stringify({ jsonrpc: '2.0', id: msg.id, result }) });
+		}, 0);
+	}
+
+	close(): void {
+		this.emit('close', {});
+	}
+
+	private emit(type: string, ev: unknown): void {
+		const set = this.listeners.get(type);
+		if (!set) return;
+		for (const fn of set) fn(ev as { data: unknown });
+	}
+}
+
+function installMock(
+	responder: (msg: { id: number; method: string; params: unknown[] }) => unknown
+): void {
+	useWebSocketImplementation(function (this: unknown, url: string) {
+		return new MockSocket(url, responder);
+	} as unknown);
+}
+
+describe('namecoin/nip05 — queryProfile with mock ElectrumX', () => {
+	const pk = 'c'.repeat(64);
+
+	beforeEach(() => {
+		_resetCache();
+	});
+
+	it('resolves a .bit address end-to-end through the mock socket', async () => {
+		// scriptPubKey hex for: OP_NAME_UPDATE PUSH("d/example") PUSH(<value>) OP_2DROP OP_DROP OP_RETURN <pad>
+		// (only the first three pushes are inspected by the parser.)
+		const nameAscii = 'd/example';
+		const value = JSON.stringify({ nostr: pk });
+		const valueBytes = new TextEncoder().encode(value);
+		const nameBytes = new TextEncoder().encode(nameAscii);
+
+		const hex: string[] = [];
+		hex.push('53'); // OP_NAME_UPDATE
+		// PUSH name
+		hex.push(nameBytes.length.toString(16).padStart(2, '0'));
+		for (const b of nameBytes) hex.push(b.toString(16).padStart(2, '0'));
+		// PUSH value (use OP_PUSHDATA1 since value > 0x4b bytes)
+		hex.push('4c');
+		hex.push(valueBytes.length.toString(16).padStart(2, '0'));
+		for (const b of valueBytes) hex.push(b.toString(16).padStart(2, '0'));
+		// Trailing 2drop drop return
+		hex.push('6d', '75', '6a');
+		const scriptHex = hex.join('');
+
+		installMock((msg) => {
+			switch (msg.method) {
+				case 'server.version':
+					return ['ElectrumX 1.4', '1.4'];
+				case 'blockchain.scripthash.get_history':
+					return [{ tx_hash: 'aa'.repeat(32), height: 1000 }];
+				case 'blockchain.transaction.get':
+					return { vout: [{ scriptPubKey: { hex: scriptHex } }] };
+				case 'blockchain.headers.subscribe':
+					return { height: 1001 }; // not expired
+				default:
+					return null;
+			}
+		});
+
+		const got = await queryProfile('example.bit');
+		expect(got).toEqual({ pubkey: pk });
+
+		// Second call hits the positive cache; the responder is not
+		// invoked again. We confirm by clearing the mock first.
+		installMock(() => {
+			throw new Error('should not be called — cache hit expected');
+		});
+		const got2 = await queryProfile('example.bit');
+		expect(got2).toEqual({ pubkey: pk });
+	});
+
+	it('caches negative lookups and short-circuits subsequent calls', async () => {
+		installMock((msg) => {
+			if (msg.method === 'server.version') return ['ElectrumX 1.4', '1.4'];
+			if (msg.method === 'blockchain.scripthash.get_history') return [];
+			return null;
+		});
+		const got = await queryProfile('doesnotexist.bit');
+		expect(got).toBeNull();
+
+		installMock(() => {
+			throw new Error('should not be called — negative cache expected');
+		});
+		const again = await queryProfile('doesnotexist.bit');
+		expect(again).toBeNull();
+	});
+
+	it('isValid returns false for an invalid identifier shape', async () => {
+		expect(await isValid(pk, 'alice@example.com')).toBe(false);
+	});
+
+	it('isValid returns false when required args are missing', async () => {
+		expect(await isValid('', 'example.bit')).toBe(false);
+		expect(await isValid(pk, '')).toBe(false);
+	});
+});
diff --git a/web/src/lib/namecoin/nip05.ts b/web/src/lib/namecoin/nip05.ts
new file mode 100644
index 00000000..f829d238
--- /dev/null
+++ b/web/src/lib/namecoin/nip05.ts
@@ -0,0 +1,243 @@
+/**
+ * NIP-05 resolution for Namecoin `.bit` identifiers.
+ *
+ * Accepted shapes:
+ *   - `alice@example.bit`
+ *   - `example.bit`          (root entry, mapped to `d/example` + `_`)
+ *   - `d/example`            (domain namespace)
+ *   - `id/alice`             (identity namespace)
+ *   - a `nostr:` NIP-21 URI prefix is tolerated
+ *
+ * Value parsing follows the ifa-0001 Domain Name Object semantics used
+ * across the existing Namecoin × Nostr integrations: `nostr.names[<local>]`
+ * for `d/` names, `nostr.pubkey` for `id/` names, with optional relays
+ * surfaced via `nostr.relays`. A bare `"nostr": "<hex>"` value is the
+ * shorthand for the root entry of a single-identity `d/` record.
+ */
+import { nameShow, type ElectrumXServer, DEFAULT_ELECTRUMX_SERVERS } from './electrumx';
+import { getCached, setCached, getInflight, setInflight, deleteInflight } from './cache';
+
+export { DEFAULT_ELECTRUMX_SERVERS, type ElectrumXServer };
+export { useWebSocketImplementation } from './electrumx';
+
+const HEX_PUBKEY_RE = /^[0-9a-fA-F]{64}$/;
+
+export type NamecoinResolveResult = {
+	pubkey: string;
+	relays?: string[];
+};
+
+export type ParsedIdentifier = {
+	/** The underlying Namecoin name, e.g. `d/example` or `id/alice`. */
+	namecoinName: string;
+	/** The local-part within the name value, e.g. `alice` or `_`. */
+	localPart: string;
+	/** True for `d/` names (domain + `names` map), false for `id/`. */
+	isDomain: boolean;
+};
+
+/** Returns true when `identifier` should be routed to the Namecoin path. */
+export function isDotBitIdentifier(identifier?: string | null): boolean {
+	if (!identifier) return false;
+	let s = identifier.trim().toLowerCase();
+	if (s.startsWith('nostr:')) s = s.slice(6);
+	if (s.startsWith('d/') || s.startsWith('id/')) return s.length > 2 + 1;
+	return s.endsWith('.bit') && s.length > 4;
+}
+
+export function parseIdentifier(raw: string): ParsedIdentifier | null {
+	let input = raw.trim();
+	if (input.length >= 6 && input.slice(0, 6).toLowerCase() === 'nostr:') {
+		input = input.slice(6);
+	}
+	const lower = input.toLowerCase();
+
+	if (lower.startsWith('d/')) {
+		const name = lower.slice(2);
+		if (!name) return null;
+		return { namecoinName: lower, localPart: '_', isDomain: true };
+	}
+	if (lower.startsWith('id/')) {
+		const name = lower.slice(3);
+		if (!name) return null;
+		return { namecoinName: lower, localPart: '_', isDomain: false };
+	}
+
+	if (input.includes('@') && lower.endsWith('.bit')) {
+		const atIdx = input.indexOf('@');
+		const local = input.slice(0, atIdx).toLowerCase() || '_';
+		const domain = input
+			.slice(atIdx + 1)
+			.toLowerCase()
+			.replace(/\.bit$/, '');
+		if (!domain) return null;
+		return { namecoinName: 'd/' + domain, localPart: local, isDomain: true };
+	}
+
+	if (lower.endsWith('.bit')) {
+		const domain = lower.replace(/\.bit$/, '');
+		if (!domain) return null;
+		return { namecoinName: 'd/' + domain, localPart: '_', isDomain: true };
+	}
+
+	return null;
+}
+
+/**
+ * Resolve a `.bit` / `d/` / `id/` identifier to a Nostr profile pointer.
+ *
+ * Returns `null` on any failure (invalid shape, unregistered name,
+ * missing `nostr` field, transport error). Caches positive AND negative
+ * results for the lifetime of the runtime; dedupes concurrent lookups.
+ */
+export async function queryProfile(
+	identifier: string,
+	servers?: ElectrumXServer[]
+): Promise<NamecoinResolveResult | null> {
+	const parsed = parseIdentifier(identifier);
+	if (!parsed) return null;
+
+	const cached = getCached(identifier);
+	if (cached !== undefined) return cached;
+
+	const inflight = getInflight(identifier);
+	if (inflight) return inflight;
+
+	const p = (async () => {
+		try {
+			const valueJSON = await nameShow(parsed.namecoinName, servers);
+			if (!valueJSON) {
+				setCached(identifier, null);
+				return null;
+			}
+			const result = extractNostrFromValue(valueJSON, parsed);
+			setCached(identifier, result);
+			return result;
+		} catch {
+			setCached(identifier, null);
+			return null;
+		} finally {
+			deleteInflight(identifier);
+		}
+	})();
+	setInflight(identifier, p);
+	return p;
+}
+
+/** Verify that `pubkeyHex` is bound to `identifier` on the Namecoin chain. */
+export async function isValid(pubkeyHex: string, identifier: string): Promise<boolean> {
+	if (!pubkeyHex || !identifier) return false;
+	const res = await queryProfile(identifier);
+	return res ? res.pubkey.toLowerCase() === pubkeyHex.toLowerCase() : false;
+}
+
+// ---------------------------------------------------------------------------
+// JSON value extraction (pure, easy to test)
+// ---------------------------------------------------------------------------
+
+export function extractNostrFromValue(
+	valueJSON: string,
+	parsed: ParsedIdentifier
+): NamecoinResolveResult | null {
+	let root: Record<string, unknown>;
+	try {
+		root = JSON.parse(valueJSON) as Record<string, unknown>;
+	} catch {
+		return null;
+	}
+	if (typeof root !== 'object' || root === null) return null;
+
+	const nostrField = root['nostr'];
+	if (nostrField === undefined || nostrField === null) return null;
+
+	if (typeof nostrField === 'string') {
+		if (parsed.isDomain && parsed.localPart !== '_') return null;
+		if (!HEX_PUBKEY_RE.test(nostrField)) return null;
+		return { pubkey: nostrField.toLowerCase() };
+	}
+
+	if (typeof nostrField !== 'object') return null;
+	const obj = nostrField as Record<string, unknown>;
+
+	if (parsed.isDomain) return extractFromDomainNamesObject(obj, parsed);
+	return extractFromIdentityObject(obj);
+}
+
+function extractFromDomainNamesObject(
+	obj: Record<string, unknown>,
+	parsed: ParsedIdentifier
+): NamecoinResolveResult | null {
+	const names = obj['names'];
+	if (typeof names !== 'object' || names === null) return null;
+	const namesMap = names as Record<string, unknown>;
+
+	let pickedPubkey: string | null = null;
+	const exact = namesMap[parsed.localPart];
+	if (typeof exact === 'string' && HEX_PUBKEY_RE.test(exact)) {
+		pickedPubkey = exact;
+	} else {
+		const underscore = namesMap['_'];
+		if (typeof underscore === 'string' && HEX_PUBKEY_RE.test(underscore)) {
+			pickedPubkey = underscore;
+		} else if (parsed.localPart === '_') {
+			for (const v of Object.values(namesMap)) {
+				if (typeof v === 'string' && HEX_PUBKEY_RE.test(v)) {
+					pickedPubkey = v;
+					break;
+				}
+			}
+		}
+	}
+
+	if (!pickedPubkey) return null;
+	const relays = extractRelays(obj, pickedPubkey);
+	return relays
+		? { pubkey: pickedPubkey.toLowerCase(), relays }
+		: { pubkey: pickedPubkey.toLowerCase() };
+}
+
+function extractFromIdentityObject(obj: Record<string, unknown>): NamecoinResolveResult | null {
+	const pk = obj['pubkey'];
+	if (typeof pk === 'string' && HEX_PUBKEY_RE.test(pk)) {
+		const relaysRaw = obj['relays'];
+		if (Array.isArray(relaysRaw)) {
+			const relays = relaysRaw.filter((r): r is string => typeof r === 'string');
+			return relays.length > 0
+				? { pubkey: pk.toLowerCase(), relays }
+				: { pubkey: pk.toLowerCase() };
+		}
+		return { pubkey: pk.toLowerCase() };
+	}
+
+	const names = obj['names'];
+	if (typeof names === 'object' && names !== null) {
+		const underscore = (names as Record<string, unknown>)['_'];
+		if (typeof underscore === 'string' && HEX_PUBKEY_RE.test(underscore)) {
+			const relays = extractRelays(obj, underscore);
+			return relays
+				? { pubkey: underscore.toLowerCase(), relays }
+				: { pubkey: underscore.toLowerCase() };
+		}
+	}
+
+	return null;
+}
+
+function extractRelays(obj: Record<string, unknown>, pubkey: string): string[] | null {
+	const raw = obj['relays'];
+	if (!raw) return null;
+	// Domain shape: keyed by pubkey -> array.
+	if (typeof raw === 'object' && !Array.isArray(raw)) {
+		const map = raw as Record<string, unknown>;
+		const candidate = map[pubkey.toLowerCase()] ?? map[pubkey];
+		if (!Array.isArray(candidate)) return null;
+		const relays = candidate.filter((r): r is string => typeof r === 'string');
+		return relays.length > 0 ? relays : null;
+	}
+	// Identity shape: flat array.
+	if (Array.isArray(raw)) {
+		const relays = raw.filter((r): r is string => typeof r === 'string');
+		return relays.length > 0 ? relays : null;
+	}
+	return null;
+}
diff --git a/web/src/routes/(app)/[slug=npub]/(tabs)/+page.svelte b/web/src/routes/(app)/[slug=npub]/(tabs)/+page.svelte
index 379211f6..a7d02901 100644
--- a/web/src/routes/(app)/[slug=npub]/(tabs)/+page.svelte
+++ b/web/src/routes/(app)/[slug=npub]/(tabs)/+page.svelte
@@ -1,6 +1,6 @@
 <script lang="ts">
 	import { page } from '$app/state';
-	import { nip05 } from 'nostr-tools';
+	import { queryProfile as queryNip05Profile } from '$lib/Nip05';
 	import { createRxOneshotReq, now, uniq } from 'rx-nostr';
 	import { tap } from 'rxjs';
 	import { afterNavigate, replaceState } from '$app/navigation';
@@ -58,7 +58,7 @@
 			return;
 		}
 
-		nip05.queryProfile(normalizedNip05).then((pointer) => {
+		queryNip05Profile(normalizedNip05).then((pointer) => {
 			if (pointer !== null) {
 				replaceState(`/${normalizedNip05}`, {});
 				slug = normalizedNip05;