feat(pow): apply WoT-distance-based PoW reductions

[Priyanshubhartistm]

Description

nostream now has a Web of Trust graph exposing a distance-lookup API, and a relay-load-aware adaptive PoW pipeline that scales the required eventId difficulty with observed event rate. The two didn't talk to each other every pubkey faced the same computed difficulty regardless of how trusted it is.

This wires the WoT graph into the adaptive PoW pipeline via limits.event.pow.wotThresholds: an ordered list of { maxDistance, difficultyFactor } entries. The eligible threshold with the smallest maxDistance applies, scaling the computed difficulty by difficultyFactor (0 bypasses eventId PoW entirely, 1 requires the full computed difficulty, fractional values in between). A pubkey outside the trust graph, or beyond every configured threshold, always pays the full
computed difficulty. Disabled by default (no thresholds configured), and only ever consults the WoT graph when at least one threshold is configured, so relays not using this stay unaffected.

EventMessageHandler.canAcceptEvent() is now async to support the distance lookup every other check in handleMessage's chain was already async, so this keeps the same style rather than special-casing one synchronous check.

Related Issue

Closes #778

Motivation and Context

A fixed adaptive difficulty treats a well-connected community member the same as a completely unknown pubkey under load. Reducing (or waiving) the PoW requirement for pubkeys inside the operator's trust circle means a trusted author can keep posting instantly during a spam flood, while an unknown pubkey still has to prove it isn't a bot.

[changeset-bot]

🦋 Changeset detected

Latest commit: acc6622

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
nostream	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[coveralls]

coverage: 72.494% (+0.09%) from 72.408% — Priyanshubhartistm:feat/wot-aware-pow-policy into cameri:main

[Copilot]

🟡 Changes recommended

Two unresolved moderate findings affect NIP-11 PoW metadata and malformed threshold validation.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Adds optional WoT-distance-based reductions to adaptive event PoW.

Changes:

• Adds configurable WoT thresholds and policy calculation.
• Integrates asynchronous WoT lookups into event acceptance.
• Adds validation, defaults, documentation, tests, and release notes.

File summaries

File	Summary	Review notes
test/unit/utils/wot-pow-policy.spec.ts	Tests WoT PoW policy behavior.	No final comments.
test/unit/utils/settings-config.spec.ts	Tests threshold configuration validation.	No final comments.
test/unit/handlers/event-message-handler.spec.ts	Tests handler integration and async admission.	No final comments.
src/utils/wot-pow-policy.ts	Applies distance-based difficulty factors.	No final comments.
src/utils/settings-config.ts	Validates WoT threshold settings.	Moderate (3 votes): malformed null or undefined entries can cause validation to throw instead of reporting an issue.
src/handlers/event-message-handler.ts	Integrates WoT-aware PoW checks.	Moderate (1 vote): NIP-11 still advertises floorBits although accepted events may use lower or zero difficulty.
src/factories/message-handler-factory.ts	Injects the WoT service.	No final comments.
src/@types/settings.ts	Defines threshold configuration types.	No final comments.
resources/default-settings.yaml	Adds disabled-by-default configuration.	No final comments.
CONFIGURATION.md	Documents the new settings.	No final comments.
.changeset/wot-aware-pow-policy.md	Records the release change.	No final comments.

Review details

Suppressed comments (1)

src/handlers/event-message-handler.ts:230

• This policy can reduce requiredBits below floorBits (including to 0), but the NIP-11 response still advertises floorBits as limitation.min_pow_difficulty for every event in root-request-handler.ts:115-120. That metadata no longer describes all accepted events, so clients may incorrectly treat the advertised value as mandatory; update the NIP-11 representation/contract and its tests when enabling per-pubkey reductions.

      const requiredBits = applyWotPowPolicy(computedDifficulty, distance, limits.pow.wotThresholds)

• Files reviewed: 11/11 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.