nappup 1.0.0

package/bin/GEMINI.md

@@ -0,0 +1,6 @@
+# bin folder
+
+Place one-off scripts used by package.json's "bin" field.
+
+Each script lives on its own subdirectory and may have its own helpers.js file
+with helper functions.

package/bin/nappup/helpers.js

@@ -0,0 +1,83 @@
+import readline from 'node:readline'
+import fs from 'node:fs'
+import path from 'node:path'
+import { Readable } from 'node:stream'
+import mime from 'mime-types'
+import { fileTypeFromFile } from 'file-type'
+
+export function parseArgs (args) {
+  let dir = null
+  let sk = null
+  let appId = null
+  let channel = null
+
+  for (let i = 0; i < args.length; i++) {
+    if (args[i] === '-s' && args[i + 1]) {
+      sk = args[i + 1]
+      i++ // Skip the next argument as it's part of -k
+    } else if (args[i] === '-i' && args[i + 1]) {
+      appId = args[i + 1]
+      i++
+    } else if (args[i] === '--main' && channel === null) {
+      channel = 'main'
+    } else if (args[i] === '--next' && channel === null) {
+      channel = 'next'
+    } else if (args[i] === '--draft' && channel === null) {
+      channel = 'draft'
+    } else if (!args[i].startsWith('-') && dir === null) {
+      dir = args[i]
+    }
+  }
+
+  return {
+    dir: path.resolve(dir ?? '.'),
+    sk,
+    appId,
+    channel: channel || 'main'
+  }
+}
+
+export async function confirmArgs (args) {
+  const rl = readline.createInterface({
+    input: process.stdin,
+    output: process.stdout
+  })
+  function askQuestion (query) {
+    return new Promise(resolve => rl.question(query, resolve))
+  }
+  const answer = await askQuestion(
+    `Publish app from '${args.dir}' to the ${args.channel} release channel? (y/n) `
+  )
+  if (answer.toLowerCase() !== 'y') {
+    console.log('Operation cancelled by user.')
+    rl.close()
+    process.exit(0)
+  }
+  rl.close()
+}
+
+export async function * getFiles (dir) {
+  const dirents = await fs.promises.readdir(dir, { withFileTypes: true })
+  for (const dirent of dirents) {
+    const res = path.resolve(dir, dirent.name)
+    if (dirent.isDirectory()) {
+      yield * getFiles(res)
+    } else {
+      yield res
+    }
+  }
+}
+
+export async function toFileList (filesIterator, dir) {
+  const fileList = []
+  for await (const f of filesIterator) {
+    const fileType = mime.lookup(f)
+    const file = {
+      stream: () => Readable.toWeb(fs.createReadStream(f)),
+      webkitRelativePath: path.relative(dir.replace(/\/[^/]*$/, ''), f),
+      type: fileType || (await fileTypeFromFile(f))?.mime || ''
+    }
+    fileList.push(file)
+  }
+  return fileList
+}

package/bin/nappup/index.js

@@ -0,0 +1,17 @@
+#!/usr/bin/env node
+import NostrSigner from '#services/nostr-signer.js'
+import {
+  parseArgs,
+  confirmArgs,
+  toFileList,
+  getFiles
+} from './helpers.js'
+import toApp from '#index.js'
+
+const args = parseArgs(process.argv.slice(2))
+await confirmArgs(args)
+
+const { dir, sk, appId, channel } = args
+const fileList = await toFileList(getFiles(dir), dir)
+
+await toApp(fileList, await NostrSigner.create(sk), { log: console.log.bind(console), appId, channel })

package/lib/GEMINI.md

@@ -0,0 +1,4 @@
+# lib folder
+
+This is the place to add third-party libraries that don't have a
+published npm package.

package/lib/base122.js

@@ -0,0 +1,171 @@
+// https://github.com/kevinAlbs/Base122/commit/b62945c2733fa4da8792a1071e40a8b326e8dd1b
+// Provides functions for encoding/decoding data to and from base-122.
+
+const kString = 0
+const kUint8Array = 1
+const kDebug = false
+const kIllegals = [
+  0, // null
+  10, // newline
+  13, // carriage return
+  34, // double quote
+  38, // ampersand
+  92 // backslash
+]
+const kShortened = 0b111 // Uses the illegal index to signify the last two-byte char encodes <= 7 bits.
+
+/**
+ * Encodes raw data into base-122.
+ * @param {Uint8Array|Buffer|Array|String} rawData - The data to be encoded. This can be an array
+ * or Buffer with raw data bytes or a string of bytes (i.e. the type of argument to btoa())
+ * @returns {Array} The base-122 encoded data as a regular array of UTF-8 character byte values.
+ */
+function encode (rawData) {
+  const dataType = typeof (rawData) === 'string' ? kString : kUint8Array
+  let curIndex = 0
+  let curBit = 0 // Points to current bit needed
+  // const curMask = 0b10000000
+  const outData = []
+  let getByte = i => rawData[i]
+
+  if (dataType === kString) {
+    getByte = (i) => {
+      const val = rawData.codePointAt(i)
+      if (val > 255) {
+        throw new Error('Unexpected code point at position: ' + i + '. Expected value [0,255]. Got: ' + val)
+      }
+      return val
+    }
+  }
+
+  // Get seven bits of input data. Returns false if there is no input left.
+  function get7 () {
+    if (curIndex >= rawData.length) return false
+    // Shift, mask, unshift to get first part.
+    const firstByte = getByte(curIndex)
+    let firstPart = ((0b11111110 >>> curBit) & firstByte) << curBit
+    // Align it to a seven bit chunk.
+    firstPart >>= 1
+    // Check if we need to go to the next byte for more bits.
+    curBit += 7
+    if (curBit < 8) return firstPart // Do not need next byte.
+    curBit -= 8
+    curIndex++
+    // Now we want bits [0..curBit] of the next byte if it exists.
+    if (curIndex >= rawData.length) return firstPart
+    const secondByte = getByte(curIndex)
+    let secondPart = ((0xFF00 >>> curBit) & secondByte) & 0xFF
+    // Align it.
+    secondPart >>= 8 - curBit
+    return firstPart | secondPart
+  }
+
+  while (true) {
+    // Grab 7 bits.
+    const bits = get7()
+    if (bits === false) break
+    debugLog('Seven input bits', print7Bits(bits), bits)
+
+    const illegalIndex = kIllegals.indexOf(bits)
+    if (illegalIndex !== -1) {
+      // Since this will be a two-byte character, get the next chunk of seven bits.
+      let nextBits = get7()
+      debugLog('Handle illegal sequence', print7Bits(bits), print7Bits(nextBits))
+
+      let b1 = 0b11000010; let b2 = 0b10000000
+      if (nextBits === false) {
+        debugLog('Last seven bits are an illegal sequence.')
+        b1 |= (0b111 & kShortened) << 2
+        nextBits = bits // Encode these bits after the shortened signifier.
+      } else {
+        b1 |= (0b111 & illegalIndex) << 2
+      }
+
+      // Push first bit onto first byte, remaining 6 onto second.
+      const firstBit = (nextBits & 0b01000000) > 0 ? 1 : 0
+      b1 |= firstBit
+      b2 |= nextBits & 0b00111111
+      outData.push(b1)
+      outData.push(b2)
+    } else {
+      outData.push(bits)
+    }
+  }
+  return outData
+}
+
+/**
+ * Decodes base-122 encoded data back to the original data.
+ * @param {Uint8Array|Buffer|String} rawData - The data to be decoded. This can be a Uint8Array
+ * or Buffer with raw data bytes or a string of bytes (i.e. the type of argument to btoa())
+ * @returns {Array} The data in a regular array representing byte values.
+ */
+function decode (base122Data) {
+  const strData = typeof (base122Data) === 'string' ? base122Data : utf8DataToString(base122Data)
+  const decoded = []
+  // const decodedIndex = 0
+  let curByte = 0
+  let bitOfByte = 0
+
+  function push7 (byte) {
+    byte <<= 1
+    // Align this byte to offset for current byte.
+    curByte |= (byte >>> bitOfByte)
+    bitOfByte += 7
+    if (bitOfByte >= 8) {
+      decoded.push(curByte)
+      bitOfByte -= 8
+      // Now, take the remainder, left shift by what has been taken.
+      curByte = (byte << (7 - bitOfByte)) & 255
+    }
+  }
+
+  for (let i = 0; i < strData.length; i++) {
+    const c = strData.charCodeAt(i)
+    // Check if this is a two-byte character.
+    if (c > 127) {
+      // Note, the charCodeAt will give the codePoint, thus
+      // 0b110xxxxx 0b10yyyyyy will give => xxxxxyyyyyy
+      const illegalIndex = (c >>> 8) & 7 // 7 = 0b111.
+      // We have to first check if this is a shortened two-byte character, i.e. if it only
+      // encodes <= 7 bits.
+      if (illegalIndex !== kShortened) push7(kIllegals[illegalIndex])
+      // Always push the rest.
+      push7(c & 127)
+    } else {
+      // One byte characters can be pushed directly.
+      push7(c)
+    }
+  }
+  return decoded
+}
+
+/**
+ * Converts a sequence of UTF-8 bytes to a string.
+ * @param {Uint8Array|Buffer} data - The UTF-8 data.
+ * @returns {String} A string with each character representing a code point.
+ */
+function utf8DataToString (data) {
+  return Buffer.from(data).toString('utf-8')
+}
+
+// For debugging.
+function debugLog () {
+  if (kDebug) console.log(...arguments)
+}
+
+// For debugging.
+function print7Bits (num) {
+  return '0000000'.substring(num.toString(2).length) + num.toString(2)
+}
+
+// For debugging.
+// eslint-disable-next-line no-unused-vars
+function print8Bits (num) {
+  return '00000000'.substring(num.toString(2).length) + num.toString(2)
+}
+
+export {
+  encode,
+  decode
+}

package/package.json

@@ -0,0 +1,54 @@
+{
+  "name": "nappup",
+  "author": "Arthur França",
+  "repository": "github:44billion/nappup",
+  "version": "1.0.0",
+  "description": "Nostr App Uploader",
+  "main": "index.js",
+  "type": "module",
+  "scripts": {
+    "test": "node --test 'test/**/*.test.js'"
+  },
+  "bin": {
+    "nappup": "./bin/nappup/index.js"
+  },
+  "dependencies": {
+    "dotenv": "^17.2.0",
+    "file-type": "^21.0.0",
+    "mime-types": "^3.0.1",
+    "nmmr": "^1.0.3",
+    "nostr-tools": "^2.15.0"
+  },
+  "devDependencies": {
+    "eslint": "^9.22.0",
+    "eslint-plugin-html": "^8.1.2",
+    "globals": "^15.12.0",
+    "neostandard": "^0.12.1"
+  },
+  "imports": {
+    "#bin/*": "./bin/*",
+    "#lib/*": "./lib/*",
+    "#*": [
+      "./src/*"
+    ],
+    "#helpers/*": "./src/helpers/*",
+    "#services/*": "./src/services/*"
+  },
+  "exports": {
+    ".": "./src/index.js"
+  },
+  "keywords": [
+    "nostr",
+    "app",
+    "uploader",
+    "upload"
+  ],
+  "files": [
+    "src",
+    "src/helpers",
+    "src/services",
+    "lib",
+    "bin",
+    "bin/nappup"
+  ]
+}

package/src/helpers/GEMINI.md

@@ -0,0 +1,12 @@
+# helpers folder
+
+- Place helper functions. A helper function is a single-step functionality to be re-used through out the code base.
+- Each functionality is exported as a single function.
+- These functions are not meant to be used within the test folder or sub-folders, except for being unit-tested themselves.
+
+## General Instructions:
+
+- Prefer grouping functions that deal with the same type of variable within the
+same file, preferably named after the type name. E.g.: use `helpers/string.js` for
+exporting helper functions that handle strings, or e.g.: use helpers/stream.js` to
+deal with streams.

package/src/helpers/stream.js

@@ -0,0 +1,20 @@
+// Receives a stream and yields Uint8Array binary chunks of a given size.
+// The last chunk may be smaller than the chunkSize.
+export async function * streamToChunks (stream, chunkSize) {
+  let buffer = new Uint8Array(0)
+
+  for await (const chunk of stream) {
+    const newBuffer = new Uint8Array(buffer.length + chunk.length)
+    newBuffer.set(buffer)
+    newBuffer.set(chunk, buffer.length)
+    buffer = newBuffer
+
+    while (buffer.length >= chunkSize) {
+      const chunkToYield = buffer.slice(0, chunkSize)
+      buffer = buffer.slice(chunkSize)
+      yield chunkToYield
+    }
+  }
+
+  if (buffer.length > 0) yield buffer
+}

package/src/helpers/timer.js

@@ -0,0 +1,4 @@
+export function maybeUnref (timer) {
+  if (typeof window === 'undefined') timer.unref()
+  return timer
+}

package/src/index.js

@@ -0,0 +1,131 @@
+import NMMR from 'nmmr'
+import { naddrEncode } from 'nostr-tools/nip19'
+import Base122Encoder from '#services/base122-encoder.js'
+import nostrRelays from '#services/nostr-relays.js'
+import NostrSigner from '#services/nostr-signer.js'
+import { streamToChunks } from '#helpers/stream.js'
+
+export default async function (...args) {
+  try {
+    return await toApp(...args)
+  } finally {
+    await nostrRelays.disconnectAll()
+  }
+}
+export async function toApp (fileList, nostrSigner, { log = () => {}, appId, channel = 'main' } = {}) {
+  if (!nostrSigner && typeof window !== 'undefined') nostrSigner = window.nostr
+  if (!nostrSigner) throw new Error('No Nostr signer found')
+  if (typeof window !== 'undefined' && nostrSigner === window.nostr) {
+    nostrSigner.getRelays = NostrSigner.prototype.getRelays
+  }
+
+  appId ||= fileList[0].webkitRelativePath.split('/')[0]
+    .trim().replace(/[\s-]/g, '').toLowerCase().slice(0, 32)
+  let nmmr
+  const fileMetadata = []
+
+  log(`Processing ${fileList.length} files`)
+  for (const file of fileList) {
+    nmmr = new NMMR()
+    const stream = file.stream()
+
+    let chunkLength = 0
+    for await (const chunk of streamToChunks(stream, 54600)) {
+      chunkLength++
+      nmmr.append(chunk)
+    }
+    if (chunkLength) {
+      // remove root dir
+      const filename = file.webkitRelativePath.split('/').slice(1).join('/')
+      log(`Uploading ${chunkLength} file parts of ${filename}`)
+      await uploadBinaryDataChunks(nmmr, nostrSigner, { mimeType: file.type || 'application/octet-stream' })
+      fileMetadata.push({
+        rootHash: nmmr.getRoot(),
+        filename,
+        mimeType: file.type || 'application/octet-stream'
+      })
+    }
+  }
+
+  log(`Uploading bundle #${appId}`)
+  const bundle = await uploadBundle(appId, channel, fileMetadata, nostrSigner)
+
+  const naddr = naddrEncode({
+    identifier: bundle.tags.find(v => v[0] === 'd')[1],
+    pubkey: bundle.pubkey,
+    relays: [],
+    kind: bundle.kind
+  })
+  log(`Visit at https://44billion.net/${naddr}`)
+}
+
+async function uploadBinaryDataChunks (nmmr, signer, { mimeType } = {}) {
+  const writeRelays = (await signer.getRelays()).write
+  for await (const chunk of nmmr.getChunks()) {
+    const dTag = chunk.x
+    const currentCtag = `${chunk.rootX}:${chunk.index}`
+    const prevCTags = await getPreviousCtags(dTag, currentCtag, writeRelays, signer)
+    const binaryDataChunk = {
+      kind: 34600,
+      tags: [
+        ['d', dTag],
+        ...prevCTags,
+        ['c', currentCtag, chunk.length, ...chunk.proof],
+        ...(mimeType ? [['m', mimeType]] : [])
+      ],
+      // These chunks already have the expected size of 54600 bytes
+      content: new Base122Encoder().update(chunk.contentBytes).getEncoded(),
+      created_at: Math.floor(Date.now() / 1000)
+    }
+
+    const event = await signer.signEvent(binaryDataChunk)
+    await nostrRelays.sendEvent(event, writeRelays)
+  }
+}
+
+async function getPreviousCtags (dTagValue, currentCtagValue, writeRelays, signer) {
+  const storedEvents = await nostrRelays.getEvents({
+    kinds: [34600],
+    authors: [await signer.getPublicKey()],
+    '#d': [dTagValue],
+    limit: 1
+  }, writeRelays)
+  if (storedEvents.length === 0) return []
+
+  const cTagValues = { [currentCtagValue]: true }
+  const prevTags = storedEvents.sort((a, b) => b.created_at - a.created_at)[0].tags
+  if (!Array.isArray(prevTags)) return []
+  return prevTags
+    .filter(v => {
+      const isCTag =
+        Array.isArray(v) &&
+        v[0] === 'c' &&
+        typeof v[1] === 'string' &&
+        /^[0-9a-f]{64}:\d+$/.test(v[1])
+      if (!isCTag) return false
+
+      const isntDuplicate = !cTagValues[v[1]]
+      cTagValues[v[1]] = true
+      return isCTag && isntDuplicate
+    })
+}
+
+async function uploadBundle (appId, channel, fileMetadata, signer) {
+  const kind = {
+    main: 37448, // stable
+    next: 37449, // insider
+    draft: 37450 // vibe coded preview
+  }[channel] ?? 37448
+  const appBundle = {
+    kind,
+    tags: [
+      ['d', appId],
+      ...fileMetadata.map(v => ['file', v.rootHash, v.filename, v.mimeType])
+    ],
+    content: '',
+    created_at: Math.floor(Date.now() / 1000)
+  }
+  const event = await signer.signEvent(appBundle)
+  await nostrRelays.sendEvent(event, (await signer.getRelays()).write)
+  return event
+}

package/src/services/GEMINI.md

@@ -0,0 +1,9 @@
+# src/services folder
+
+- Place services here. Services are multi-step functionality that make the code more
+readable than if placing every step together on a single function.
+
+## General Instructions:
+
+- Use object-oriented programming paradigm.
+- Each file default exports one class or singleton.

package/src/services/base122-decoder.js

@@ -0,0 +1,56 @@
+import { decode } from '#lib/base122.js'
+
+// Decodes data from base122.
+export default class Base122Decoder {
+  textEncoder = new TextEncoder()
+
+  constructor (source, { mimeType = '' } = {}) {
+    this.sourceIterator = source?.[Symbol.iterator]?.() || source?.[Symbol.asyncIterator]?.() || source()
+    this.isText = mimeType.startsWith('text/')
+    if (this.isText) this.textDecoder = new TextDecoder()
+  }
+
+  // decoder generator
+  * [Symbol.iterator] (base122String) {
+    let bytes
+    if (this.isText) {
+      while (base122String) {
+        bytes = this.textEncoder.encode(base122String) // from string to UInt8Array
+        // stream=true avoids cutting a multi-byte character
+        base122String = yield this.textDecoder.decode(new Uint8Array(decode(bytes)), { stream: true })
+      }
+    } else {
+      while (base122String) {
+        bytes = this.textEncoder.encode(base122String)
+        base122String = yield new Uint8Array(decode(bytes))
+      }
+    }
+  }
+
+  // Gets the decoded data.
+  getDecoded () { return iteratorToStream(this, this.sourceIterator) }
+}
+
+function iteratorToStream (decoder, sourceIterator) {
+  return new ReadableStream({
+    decoderIterator: null,
+    async start (controller) {
+      const { value: chunk, done } = await sourceIterator.next()
+      if (done) return controller.close()
+
+      // Pass first chunk when instantiating the decoder generator
+      this.decoderIterator = decoder[Symbol.iterator](chunk)
+      const { value } = this.decoderIterator.next()
+      if (value) controller.enqueue(value)
+    },
+    async pull (controller) {
+      if (!this.decoderIterator) return
+
+      const { value: chunk, done: sourceDone } = await sourceIterator.next()
+      const { value, done } = this.decoderIterator.next(chunk)
+
+      if (value) controller.enqueue(value)
+      if (done || sourceDone) controller.close()
+    }
+  })
+}

package/src/services/base122-encoder.js

@@ -0,0 +1,19 @@
+import { encode } from '#lib/base122.js'
+
+// Encodes data using base122.
+export default class Base122Encoder {
+  textDecoder = new TextDecoder()
+  // The encoded data.
+  encoded = ''
+
+  // Updates the encoded data with the given bytes.
+  update (bytes) {
+    this.encoded += this.textDecoder.decode(new Uint8Array(encode(bytes)))
+    return this
+  }
+
+  // Gets the encoded data.
+  getEncoded () {
+    return this.encoded
+  }
+}

package/src/services/nostr-relays.js

@@ -0,0 +1,116 @@
+import { Relay } from 'nostr-tools/relay'
+import { maybeUnref } from '#helpers/timer.js'
+
+export const seedRelays = [
+  'wss://purplepag.es',
+  'wss://user.kindpag.es',
+  'wss://relay.nos.social',
+  'wss://relay.nostr.band',
+  'wss://nostr.land',
+  'wss://indexer.coracle.social'
+]
+export const freeRelays = [
+  'wss://relay.damus.io',
+  'wss://relay.nostr.band',
+  'wss://nos.lol',
+  'wss://relay.primal.net'
+]
+
+// Interacts with Nostr relays.
+export class NostrRelays {
+  #relays = new Map()
+  #relayTimeouts = new Map()
+  #timeout = 30000 // 30 seconds
+
+  // Get a relay connection, creating one if it doesn't exist.
+  async #getRelay (url) {
+    if (this.#relays.has(url)) {
+      clearTimeout(this.#relayTimeouts.get(url))
+      this.#relayTimeouts.set(url, maybeUnref(setTimeout(() => this.disconnect(url), this.#timeout)))
+      return this.#relays.get(url)
+    }
+
+    const relay = new Relay(url)
+    this.#relays.set(url, relay)
+
+    await relay.connect()
+
+    this.#relayTimeouts.set(url, maybeUnref(setTimeout(() => this.disconnect(url), this.#timeout)))
+
+    return relay
+  }
+
+  // Disconnect from a relay.
+  async disconnect (url) {
+    if (this.#relays.has(url)) {
+      await this.#relays.get(url).close()
+      this.#relays.delete(url)
+      clearTimeout(this.#relayTimeouts.get(url))
+      this.#relayTimeouts.delete(url)
+    }
+  }
+
+  // Disconnect from all relays.
+  async disconnectAll () {
+    for (const url of this.#relays.keys()) {
+      await this.disconnect(url)
+    }
+  }
+
+  // Get events from a list of relays
+  async getEvents (filter, relays, timeout = 5000) {
+    const events = []
+    const promises = relays.map(async (url) => {
+      try {
+        const relay = await this.#getRelay(url)
+        return new Promise((resolve) => {
+          const sub = relay.subscribe([filter], {
+            onevent: (event) => {
+              events.push(event)
+            },
+            onclose: () => {
+              clearTimeout(timer)
+              resolve()
+            },
+            oneose: () => {
+              clearTimeout(timer)
+              resolve()
+            }
+          })
+          const timer = maybeUnref(setTimeout(() => {
+            sub.close()
+            resolve()
+          }, timeout))
+        })
+      } catch (error) {
+        console.error(`Failed to get events from ${url}`, error)
+      }
+    })
+
+    const results = await Promise.allSettled(promises)
+    if (results.some(v => v.status === 'rejected')) throw new Error(results[0].reason)
+    return events
+  }
+
+  // Send an event to a list of relays.
+  async sendEvent (event, relays, timeout = 3000) {
+    const promises = relays.map(async (url) => {
+      try {
+        const relay = await this.#getRelay(url)
+        const timer = maybeUnref(setTimeout(() => {
+          throw new Error(`Timeout sending event to ${url}`)
+        }, timeout))
+        await relay.publish(event)
+        clearTimeout(timer)
+      } catch (error) {
+        console.error(`Failed to send event to ${url}`, error)
+      }
+    })
+
+    const results = await Promise.allSettled(promises)
+    if (results.some(v => v.status === 'rejected')) throw new Error(results[0].reason)
+  }
+}
+// Share same connection.
+// Connections aren't authenticated, thus no need to split by authed user.
+export default new NostrRelays()

package/src/services/nostr-signer.js

@@ -0,0 +1,157 @@
+import fs from 'node:fs'
+import { fileURLToPath } from 'node:url'
+import * as dotenv from 'dotenv'
+import { getPublicKey, finalizeEvent } from 'nostr-tools/pure'
+import { getConversationKey, encrypt, decrypt } from 'nostr-tools/nip44'
+import nostrRelays, { seedRelays, freeRelays } from '#services/nostr-relays.js'
+const __dirname = fileURLToPath(new URL('.', import.meta.url))
+
+dotenv.config({
+  path: process.env.DOTENV_CONFIG_PATH ?? `${__dirname}/../../.env`,
+  quiet: true
+})
+
+const nip44 = {
+  getConversationKey,
+  encrypt,
+  decrypt
+}
+
+const createToken = Symbol('createToken')
+
+export default class NostrSigner {
+  #secretKey // bytes
+  #publicKey // hex
+
+  constructor (token, skBytes) {
+    if (token !== createToken) throw new Error('Use NostrSigner.create(?sk) to instantiate this class.')
+    if (!skBytes) throw new Error('Secret key missing.')
+
+    this.#secretKey = skBytes
+  }
+
+  static async create (skHex) {
+    if (skHex) return new this(createToken, hexToBytes(skHex))
+
+    let skBytes
+    let isNewSk = false
+    if (process.env.NOSTR_SECRET_KEY) {
+      skBytes = hexToBytes(process.env.NOSTR_SECRET_KEY)
+    } else {
+      isNewSk = true
+      skHex = generateSecretKey()
+      fs.appendFileSync('.env', `NOSTR_SECRET_KEY=${skHex}\n`)
+      skBytes = hexToBytes(skHex)
+    }
+    const ret = new this(createToken, skBytes)
+    if (isNewSk) await ret.#initSk(skHex)
+    return ret
+  }
+
+  async getRelays () {
+    if (this.relays) return this.relays
+
+    const relayLists = await nostrRelays.getEvents({ authors: [await this.getPublicKey()], kinds: [10002], limit: 1 }, seedRelays)
+    const relayList = relayLists.sort((a, b) => b.created_at - a.created_at)[0]
+    const rTags = relayList.tags.filter(v => v[0] === 'r' && /^wss?:\/\//.test(v[1]))
+    if (rTags.length === 0) return (this.relays = await this.#initRelays())
+
+    let keys
+    const keyAllowList = { read: true, write: true }
+    const relays = rTags.reduce((r, v) => {
+      keys = [v[2]].filter(v2 => keyAllowList[v2])
+      if (keys.length === 0) keys = ['read', 'write']
+      keys.forEach(k => r[k].push(v[1]))
+      return r
+    }, { read: [], write: [] })
+    Object.values(relays).forEach(v => { v.length === 0 && v.push(...freeRelays) })
+    return (this.relays = relays)
+  }
+
+  async #initRelays () {
+    const relays = freeRelays.slice(0, 2)
+    this.relays = {
+      read: relays,
+      write: relays
+    }
+    const relayList = await this.signEvent({
+      kind: 10002,
+      pubkey: await this.getPublicKey(),
+      tags: relays.map(v => ['r', v]),
+      content: '',
+      created_at: Math.floor(Date.now() / 1000)
+    })
+    await nostrRelays.sendEvent(relayList, [...new Set([...seedRelays, ...this.relays.write])])
+    return this.relays
+  }
+
+  async #initSk () {
+    const pubkey = this.getPublicKey()
+    const profile = this.signEvent({
+      kind: 0,
+      pubkey,
+      tags: [],
+      content: JSON.stringify({
+        name: `Publisher #${Math.random().toString(36).slice(2)}`,
+        about: 'An auto-generated https://44billion.net app publisher'
+      }),
+      created_at: Math.floor(Date.now() / 1000)
+    })
+    const writeRelays = (await this.getRelays()).write
+    await nostrRelays.sendEvent(profile, writeRelays)
+  }
+
+  // hex
+  getPublicKey () {
+    if (this.#publicKey) {
+      return this.#publicKey
+    }
+    this.#publicKey = getPublicKey(this.#secretKey)
+    return this.#publicKey
+  }
+
+  signEvent (event) {
+    return finalizeEvent(event, this.#secretKey)
+  }
+
+  nip44 = {
+    encrypt: this.nip44Encrypt.bind(this),
+    decrypt: this.nip44Decrypt.bind(this)
+  }
+
+  nip44Encrypt (pubkey, plaintext) {
+    const conversationKey = nip44.getConversationKey(this.#secretKey, pubkey)
+    return nip44.encrypt(conversationKey, plaintext)
+  }
+
+  nip44Decrypt (pubkey, ciphertext) {
+    const conversationKey = nip44.getConversationKey(this.#secretKey, pubkey)
+    return nip44.decrypt(conversationKey, ciphertext)
+  }
+}
+
+function bytesToHex (uint8aBytes) {
+  return Array.from(uint8aBytes).map(b => b.toString(16).padStart(2, '0')).join('')
+}
+
+function hexToBytes (hexString) {
+  const arr = new Uint8Array(hexString.length / 2) // create result array
+  for (let i = 0; i < arr.length; i++) {
+    const j = i * 2
+    const h = hexString.slice(j, j + 2)
+    const b = Number.parseInt(h, 16) // byte, created from string part
+    if (Number.isNaN(b) || b < 0) throw new Error('invalid hex')
+    arr[i] = b
+  }
+  return arr
+}
+
+function generateSecretKey () {
+  const randomBytes = crypto.getRandomValues(new Uint8Array(40))
+  const B256 = 2n ** 256n // secp256k1 is short weierstrass curve
+  const N = B256 - 0x14551231950b75fc4402da1732fc9bebfn // curve (group) order
+  const bytesToNumber = b => BigInt('0x' + (bytesToHex(b) || '0'))
+  const mod = (a, b) => { const r = a % b; return r >= 0n ? r : b + r } // mod division
+  const num = mod(bytesToNumber(randomBytes), N - 1n) + 1n // takes at least n+8 bytes
+  return num.toString(16).padStart(64, '0')
+}