gold.js is a miniature NIP-42 client: it answers a relay's AUTH challenge with a signed kind 22242 event, so members-only relays let you read and publish. When a relay refuses a subscription or an event with auth-required:, gold authenticates once and re-sends it, and xenon never sees the refusal. It composes through xenon's nhy:message event and the nhy:config signing hook, so helium.js, chlorine.js or a NIP-07 extension signs the AUTH event just as it signs posts.
<script src="helium.js"></script>
<script src="gold.js"></script>
<script src="xenon.js"></script>
<ol nhy-relay="wss://private.example" nxe-filter='{"kinds":[1]}'></ol>
<form nhy-relay="wss://private.example" nxe-publish><input name="content"><button>Post</button></form>
The relay refuses the list's subscription until you prove who you are, so gold signs its challenge and asks again, and the notes appear.
| attribute | description |
|---|---|
nau-eager |
On <html> or <body>: authenticate as soon as a relay sends a challenge, not only when it refuses something |
nau-relays |
On any element: space-separated relays that may receive AUTH. Others are never answered. Default any relay that asks |
window.nauCfg = {eager, relays} sets the same options from script.
Dispatched on document.
| event | cancel to | detail |
|---|---|---|
nau:auth |
skip authenticating (the refusal then reaches xenon) | url, challenge, cfg with the unsigned event, before signing. To choose a different signer, set cfg.sign in nhy:config like every nobel signer |
nau:authed |
url, pubkey once the relay says OK |
|
nau:error |
url, error: refused, cancelled, no challenge within 3 s, or (from gold.auth) a relay not in nau-relays |
| function | returns |
|---|---|
gold.auth(url) |
Promise of your pubkey once authenticated on that relay's current connection (connects if needed) |
gold.state[url] |
{challenge, pubkey, ...} for the current connection. A reconnect starts fresh |
Each connection gets at most one AUTH, and each refused subscription or event is retried once. If the relay still refuses, the refusal reaches xenon, so the publish reports ok:false.
Privacy: gold is lazy by default and only authenticates when a relay refuses something. Each AUTH tells that relay which pubkey is connecting, so eager mode tells every relay you connect to. Use nau-relays to limit which relays get it.