Add Namecoin .bit support to NIP-05 resolution

[mstrofnone]

Teach nak to resolve Namecoin .bit NIP-05 identifiers.

Motivation

NIP-05 verification relies on DNS + HTTPS today. That's a known
censorship surface — any DNS registrar or CA in the chain can
unilaterally break a handle. Namecoin is a decentralised alternative
that has been around since 2011 and settles to its own blockchain,
so a .bit identifier is owned by whoever holds the private key,
full stop.

This pattern already ships in production on Amethyst (Android) —
vitorpamplona/amethyst#1937.
It uses the exact same protocol this PR ports: read the d/<name>
Namecoin record via ElectrumX, pull the nostr field out of its
JSON value.

What changes

• New self-contained package nip05nmc/. Pure Go, stdlib-only
  (plus the fiatjaf.com/nostr types that nak already pulls in
  for nostr.PubKey / nostr.ProfilePointer). No new dependencies.

• Four intercept points in existing files (helpers.go,
  fetch.go, decode.go), each gated on
  nip05nmc.IsDotBit(input) before falling through to
  nip05.IsValidIdentifier. Diff is minimal:

   README.md | 12 ++++
   decode.go |  3 +-
   fetch.go  |  4 +-
   go.sum    |  2 -
   helpers.go| 33 ++++++-
  

• Pinned TLS trust for the two public ElectrumX servers
  (electrumx.testls.space, nmc2.bitcoins.sk). Both serve
  self-signed certs. The TLS config tries the system trust store
  first, then the pinned pool, then a raw SHA-256 fingerprint —
  it is deliberately NOT a trust-all.

• Unit and integration tests. Unit tests cover script building,
  Electrum scripthash derivation, NAME_UPDATE parsing, and value-JSON
  shape handling. Integration tests (-tags=integration) hit a real
  server and assert two known-good fixtures.

How it works

IsDotBit(input) accepts example.bit, alice@example.bit,
d/example and id/alice. A matching input is translated to a
canonical d/<domain> (or id/<name>) and the package builds the
Namecoin name-index script, derives the Electrum scripthash
(reversed-SHA-256), and queries blockchain.scripthash.get_history
over a TCP+TLS socket. It fetches the latest NAME_UPDATE transaction,
parses the name value out of the output script, and extracts the
nostr field. Definitive blockchain answers (NameNotFound /
NameExpired) short-circuit the server-fallback loop.

Example

$ nak fetch nostr:m@testls.bit | jq -r .pubkey | head -1
6cdebccabda1dfa058ab85352a79509b592b2bdfa0370325e28ec1cb4f18667d

nak decode testls.bit and nak event --tag p=m@testls.bit work
the same way.

About scope

I know Namecoin is out of left field for nak, and that adding a TLS
client for a sibling blockchain to a Nostr CLI is a real scope
decision — not a trivial one. If you'd rather not carry this, totally
fine: happy to keep it on a fork. I wanted to open the PR primarily
to find out whether it's welcome, and to make the port visible for
anyone else interested.

Either way, a standalone wrapper (nak-nmc) that resolves .bit
and shells out to nak is also being published — so users get the
feature regardless.

— mstrofnone

---

Update (2026-05-24): ifa-0001 import-chain support

Added nip05nmc/import.go + nip05nmc/import_test.go so the resolver
walks the ifa-0001 §"import"
chain before extracting the nostr field. Distribution choice: inline
port, not a library dependency — nip05nmc/ is an own implementation
(no upstream nostrlib-nip05-namecoin import in go.mod), so dropping
a single source-level file in alongside its tests keeps the diff
self-contained and avoids pulling a new module into this repo.

Why this matters

Records like the canonical demo target testls.bit keep their
nostr.names block in a sibling name (dd/testls) and link to it
via "import": "dd/testls" on the apex. Without import support both
the bare lookup (testls.bit) and the named local-part lookup
(m@testls.bit) silently fail: the resolver sees the apex value,
finds no nostr field, and returns nil. The 520-byte per-name
ceiling on Namecoin makes this delegation pattern common; ifa-0001
formalises it.

Behaviour

• Trigger. Records without an import key incur zero extra I/O
  — the expander short-circuits on the root JSON object.
• Shorthand forms. All four ifa-0001 shapes are accepted:
  "d/foo", ["d/foo"], ["d/foo","selector"], and the canonical
  [["d/foo","sel"], ...].
• Selector walk follows ifa-0001 §"map" rules: exact label wins,
  then * wildcard, then "" default, walked right-to-left
  (rightmost DNS label first).
• Importer-wins merge, recursive on nested objects. JSON null
  in the importer suppresses the imported key (semantic delete).
• Recursion + cycle protection. Default depth budget is 4 (the
  spec minimum). Visited (name, selector) pairs are tracked per
  top-level call so A → B → A cycles terminate. When the budget
  is exhausted the partial merge still applies — the importer's own
  fields are never lost.
• Lenient I/O. Missing names, malformed JSON, and panicking
  lookups all collapse to {} so transient ElectrumX hiccups don't
  nuke an otherwise resolvable record.

Wiring

QueryIdentifier is refactored to take a nameValueLookup callback
internally (the public signature is unchanged). The new
queryIdentifierWithLookup makes the resolver unit-testable without
a live ElectrumX — used by 6 integration tests in import_test.go
that exercise the apex+sibling pattern end-to-end.

Test coverage

22 new tests (16 unit + 6 integration), all passing:

$ go test ./nip05nmc/...
ok      github.com/fiatjaf/nak/nip05nmc    1.0s

go vet ./nip05nmc/... is clean.

[fiatjaf]

This should go on https://viewsource.win/fiatjaf.com/nostrlib instead, maybe as a subpackage of nip05.

But I'll have to think about it first.

[mstrofnone]

Done. Published the subpackage three ways so you can pick what works for you:

• GitHub mirror (drop-in shape for fiatjaf.com/nostr/nip05/namecoin):
  https://github.com/mstrofnone/nostrlib-nip05-namecoin
  — a namecoin/ dir that drops directly into nip05/ in nostrlib. Builds clean against fiatjaf.com/nostr@v0.0.0-20260416191442-f50b7b0f8dcb (the version nak currently pins). See PROPOSAL.md for the pitch and tradeoffs.
• NIP-34 git patch event (kind:1617) against nostrlib, parent commit f50b7b0f8dcb, addressed to your npub:
  nostr:nevent1qqs8yepuma694y6saym8ny4wtfzymlgu2htusvweyjzpamc0rgn8pyqpz3mhxue69uhhyetvv9ujumn8d96zuer9wcq3yamnwvaz7tm8d96xummnw3ezucm0d5q3gamnwvaz7tmjv4kxz7fwv3sk6atn9e5k7q3qgvv9ahktvavf9qjtrgm62le7gplmmchd5usp5wpfhr85hf79kncq8jdtz6
  Accepted by relay.ngit.dev, gitnostr.com, relay.damus.io, nos.lol, relay.primal.net, nostr.mom.
• Standalone wrapper for users who want this today without touching nak or nostrlib:
  https://github.com/mstrofnone/nak-nmc

API mirrors nip05.QueryIdentifier so if you decide to land it as nip05/namecoin it's a straight drop-in. Happy to reshape — rename ResolveToJSONValue → Fetch, drop the pinned certs for a caller-supplied servers API, or split into a separate nip05namecoinclient package — whatever you'd prefer.

I'll close this PR if/when the subpackage lands in nostrlib — or now, if you'd rather track discussion over there.