notifications/resources/updated is not correlated and is broadcast to all initialized sessions

[Priyanshubhartistm]

Summary

The resources/updated notification is currently not properly correlated. It is being broadcast to all initialized sessions instead of being delivered only to the intended recipient(s).

Impact

• Incorrect clients may receive sensitive resource updates
• Raises serious privacy and data correctness concerns
• Potential security implications due to unintended data leakage

Reproduction Steps

1. Set up multiple client sessions (multi-client environment)
2. Emit a resources/updated notification
3. Observe that the notification is broadcast to all active sessions (fan-out behavior)

Actual Behavior

The notification is sent through a broadcast loop that delivers it to every initialized session, without proper correlation or targeting.

Expected Behavior

The resources/updated notification should be delivered only to the correlated recipient(s) using targeted delivery.

Evidence

• nostr-server-transport.ts:

Acceptance Criteria

• Implement proper correlation path for resources/updated notifications
• Change default broadcast behavior to targeted delivery for this notification type
• Add multi-client test cases to verify that only the intended client(s) receive the update

---

Priority: High
Labels: bug, transport, notification, privacy, nostr-server-transport, correlation

[Priyanshubhartistm]

@gzuuus can i work on this issues