Merge branch 'main' into maintenance-service-factory-tests

Author: cameri

.changeset/brown-bears-pay.md

@@ -0,0 +1,5 @@
+---
+"nostream": patch
+---
+
+fix: maxLimit checks added to subscription message handler

.changeset/dark-places-tickle.md

@@ -0,0 +1,5 @@
+---
+"nostream": patch
+---
+
+Fix root HTML negotiation and subpath-aware template links behind trusted proxies.

.changeset/fix-serialize-javascript-cve.md

@@ -0,0 +1,5 @@
+---
+"nostream": patch
+---
+
+Security: override serialize-javascript to >=7.0.3 (CVE RCE, GHSA-5c6j-r48x-rmvq)

.changeset/geohash-prefix-filters.md

@@ -0,0 +1,9 @@
+---
+"nostream": patch
+---
+
+Implement geohash wildcard/prefix behavior for `#g` filters (closes #265): a
+criterion ending in `*` matches any event `g` tag whose value starts with the
+prefix before `*`; exact matching (no `*`) is unchanged. Only normal geohash
+prefixes are intended as input. This is a Nostream extension, not part of
+NIP-12.

.changeset/huge-trains-nail.md

@@ -0,0 +1,5 @@
+---
+"nostream": patch
+---
+
+Use timingSafeEqual for Nodeless webhook HMAC verification and guard against missing NODELESS_WEBHOOK_SECRET

.changeset/husky-fallback.md

@@ -0,0 +1,5 @@
+---
+"nostream": patch
+---
+
+fix: add husky install fallback for non-dev environments

.changeset/jolly-canyons-glow.md

@@ -0,0 +1,5 @@
+---
+"nostream": minor
+---
+
+perf: added k6 performance tests for connection and message rate limiting

.changeset/marmot-protocol-support.md

@@ -0,0 +1,14 @@
+---
+"nostream": minor
+---
+
+Add relay support for the Marmot Protocol (E2EE group messaging over Nostr).
+
+Supported MIPs: 00 (KeyPackages), 01 (Group Construction), 02 (Welcome Events), 03 (Group Messages).
+
+- kind 443 (legacy KeyPackage): stored as a regular event
+- kind 10051 (KeyPackage relay list): stored as a replaceable event
+- kind 30443 (KeyPackage): stored as a parameterized-replaceable event with `d`-tag deduplication
+- kind 444 (Welcome rumor): blocked from direct publishing; must travel inside a kind 1059 gift wrap
+- kind 445 (Group Event): dedicated strategy validates the required `h` tag (nostr_group_id) before storing; `#h` tag subscriptions work via the existing generic tag index
+- NIP-11 relay info now advertises `supported_mips: [0, 1, 2, 3]`

.changeset/metal-snails-prove.md

@@ -0,0 +1,5 @@
+---
+"nostream": patch
+---
+
+fix: resolve TOCTOU race condition and key collisions in SlidingWindowRateLimiter

.changeset/nip-25-reactions.md

@@ -0,0 +1,5 @@
+---
+"nostream": minor
+---
+
+Add NIP-25 Reactions support for kind 7 and kind 17 events: reaction utility helpers (`isReactionEvent`, `isExternalContentReactionEvent`, `isLikeReaction`, `isDislikeReaction`, `parseReaction`), schema validation enforcing required `e` tag on kind 7 and required `k`/`i` tags on kind 17, unit tests, and integration tests.