feat: restore reach-by-username with invites and a signed directory

CHANGELOG.md

@@ -15,6 +15,71 @@ archived by series under [docs/changelog/](docs/changelog/); see the
 
 ### Added
 
+- **Username discovery and a self-certifying invite payload.** Two ways to
+  reach a peer you have never spoken to, restoring reach-by-username, which the
+  addressing migration removed.
+
+  `createInvite()` and `parseInvite()` produce and verify a compact base64url
+  blob carrying `{address, pubkey, petname?, sig?}`. It is verifiable offline
+  by anyone and, like `deriveAddress`, needs no protocol instance, so a scanner
+  can check a QR code before `create()`. The optional signature binds the
+  petname to the key; it does not defend against substitution (an attacker's
+  own correctly-signed invite is indistinguishable from a stranger's) but it
+  does stop a forwarded invite saving Alice's key under the name "Bob". Sign
+  when the invite may travel without its issuer. Invites deliberately carry no
+  key package (an MLS init key is single-use, a QR code is static, so pairing
+  them guarantees a collision the moment two people scan the same code) and no
+  expiry.
+
+  `resolveUsername()` looks a name up in a directory published over Nostr
+  (addressable kind 30777, sealed, one record per device). Off by default via
+  `transports.nostr.usernameDiscoveryEnabled`, and it additionally requires
+  cold contact, since a claim points at an address whose key packages are what
+  a resolver fetches next. Default-off is deliberate: publishing binds a
+  human-readable name to an address in a public place, where the mapping *is*
+  the payload, which is materially more disclosure than a key-package record's
+  "an install with this tag exists".
+
+  **The directory is not authoritative, and the API is shaped so you cannot
+  forget it.** Anyone may claim any name, so a resolution returns the whole set
+  of claimants as a single `username_resolved` event: no ranking, no "best"
+  claim, and no per-claim event to race. An app that auto-selects has converted
+  a non-authoritative directory into an authoritative-looking one, and its user
+  then believes the *name* was verified when only a *key* ever was. Present the
+  claims, let the user confirm out of band, and store the address rather than
+  the name. Note that even a single user resolves to a set: a phone and a
+  laptop are two genuine claims, and collapsing them hides the second device.
+
+  `resolveUsername()` resolves `true` if it started the lookup and `false` if
+  it joined one already in flight; **both mean the event is coming.** Every
+  case where no event will ever arrive rejects instead, so awaiting the
+  resolution can never hang on a lookup that was never started.
+
+  Each record binds the Nostr key it is published under, which the key-package
+  record does not. Without that binding a third party could unseal a claim,
+  re-seal the genuinely signed payload under their own key, and republish it,
+  and because addressable replacement is per-author the owner's retraction
+  would never displace the copy. Renaming or switching the feature off retracts
+  the standing claim.
+
+  Discovery events are additionally checked against their own BIP-340
+  signature, with the event id recomputed rather than trusted. This is the one
+  record kind that needs it: a retraction's body is a constant, so nothing
+  inside it is signed and its whole meaning is *who published it*, while the
+  seal key is public by construction. Without the check a single hostile relay
+  could forge a retraction for an honest claimant and erase them from the
+  resolved set even while every other relay served their genuine record —
+  inverting what querying many relays is for, since a claim needs only one
+  honest relay to survive.
+
+  Invite petnames are screened for the control and format characters a
+  username already refuses. A petname is what an app renders in the
+  confirmation dialog after a scan, and on a signed invite a bidi override
+  would otherwise arrive bound to a valid signature.
+
+  Wire format, verification order and threat model:
+  [docs/spec/username-discovery.md](docs/spec/username-discovery.md).
+
 - **Capability bias in mesh forwarding.** Battery level and charging state now
   continuously scale how much of the mesh's traffic a device carries: the delay
   before it transmits a forward, the number of neighbors it fans out to, and

Cargo.toml

@@ -79,6 +79,11 @@ hex = "0.4"
 # Only `alloc` is needed: `std` adds `std::error::Error` impls on bech32's own
 # error types, which never cross this workspace's API surface.
 bech32 = { version = "0.11.1", default-features = false, features = ["alloc"] }
+# NFC normalization for username claims. A discovery tag is a hash of the
+# normalized name, so two implementations that normalize differently derive
+# different tags and silently fail to find each other; the tables are what make
+# "NFC" mean one thing everywhere.
+unicode-normalization = "0.1"
 
 # Crypto
 # `ecdh` backs the NIP-44 v2 conversation key (secp256k1 ECDH, x-coordinate

THIRD-PARTY-NOTICES.md

@@ -25,7 +25,7 @@ upstream source on each crate's page) — the exact versions are listed below.
 
 | License | Crates |
 |---------|--------|
-| MIT License | 159 |
+| MIT License | 162 |
 | Apache License 2.0 | 10 |
 | Mozilla Public License 2.0 | 9 |
 | GNU Affero General Public License v3.0 only | 8 |
@@ -1065,6 +1065,7 @@ DEALINGS IN THE SOFTWARE.
 Used by:
 
 - [heck 0.5.0](https://github.com/withoutboats/heck)
+- [unicode-normalization 0.1.25](https://github.com/unicode-rs/unicode-normalization)
 
 ```
 Copyright (c) 2015 The Rust Project Developers
@@ -3180,6 +3181,39 @@ SOFTWARE.
 
 Used by:
 
+- [tinyvec_macros 0.1.1](https://github.com/Soveu/tinyvec_macros)
+
+```
+MIT License
+
+Copyright (c) 2020 Soveu
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+```
+
+---
+
+### MIT License
+
+Used by:
+
 - [chrono 0.4.42](https://github.com/chronotope/chrono)
 - [openmls 0.7.4](https://github.com/openmls/openmls/)
 - [openmls_basic_credential 0.4.1](https://github.com/openmls/openmls/tree/main/basic_credential)
@@ -3351,6 +3385,23 @@ WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 Used by:
 
+- [tinyvec 1.12.0](https://github.com/Lokathor/tinyvec)
+
+```
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+```
+
+---
+
+### MIT License
+
+Used by:
+
 - [android_system_properties 0.1.5](https://github.com/nical/android_system_properties)
 
 ```

bindings/python/THIRD-PARTY-NOTICES.md

@@ -25,7 +25,7 @@ upstream source on each crate's page) — the exact versions are listed below.
 
 | License | Crates |
 |---------|--------|
-| MIT License | 159 |
+| MIT License | 162 |
 | Apache License 2.0 | 10 |
 | Mozilla Public License 2.0 | 9 |
 | GNU Affero General Public License v3.0 only | 8 |
@@ -1065,6 +1065,7 @@ DEALINGS IN THE SOFTWARE.
 Used by:
 
 - [heck 0.5.0](https://github.com/withoutboats/heck)
+- [unicode-normalization 0.1.25](https://github.com/unicode-rs/unicode-normalization)
 
 ```
 Copyright (c) 2015 The Rust Project Developers
@@ -3180,6 +3181,39 @@ SOFTWARE.
 
 Used by:
 
+- [tinyvec_macros 0.1.1](https://github.com/Soveu/tinyvec_macros)
+
+```
+MIT License
+
+Copyright (c) 2020 Soveu
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+```
+
+---
+
+### MIT License
+
+Used by:
+
 - [chrono 0.4.42](https://github.com/chronotope/chrono)
 - [openmls 0.7.4](https://github.com/openmls/openmls/)
 - [openmls_basic_credential 0.4.1](https://github.com/openmls/openmls/tree/main/basic_credential)
@@ -3351,6 +3385,23 @@ WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 Used by:
 
+- [tinyvec 1.12.0](https://github.com/Lokathor/tinyvec)
+
+```
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+```
+
+---
+
+### MIT License
+
+Used by:
+
 - [android_system_properties 0.1.5](https://github.com/nical/android_system_properties)
 
 ```