nappup 2.0.1 → 2.2.0

package/src/services/dotenv.js

@@ -0,0 +1,356 @@
+import fs from 'node:fs'
+import path from 'node:path'
+import { randomUUID } from 'node:crypto'
+import * as dotenv from 'dotenv'
+import { decrypt, derive, encrypt } from '@dotenvx/primitives'
+import { base64ToBytes, bytesToBase64 } from 'libp2r2p/base64'
+import { decodeCliSession } from '#services/bunker-session-codec.js'
+import { validateNostrSecretKey } from '#services/nostr-secret-key.js'
+
+export const DOTENV_PRIVATE_KEY_NAME = 'DOTENV_PRIVATE_KEY_NAPPUP'
+export const DOTENV_PUBLIC_KEY_NAME = 'DOTENV_PUBLIC_KEY_NAPPUP'
+export const LAST_CLI_BUNKER_SESSION = 'LAST_CLI_BUNKER_SESSION'
+export const DEFAULT_DOTENV_PRIVATE_KEY = '0000000000000000000000000000000000000000000000000000000000000001'
+export const dotenvPath = path.resolve(process.env.DOTENV_CONFIG_PATH ?? path.join(process.cwd(), '.env'))
+
+const MANAGED_NAMES = new Set(['NOSTR_SECRET_KEY', LAST_CLI_BUNKER_SESSION])
+const ENCRYPTED_PREFIX = 'encrypted:'
+const MIN_ECIES_PAYLOAD_BYTES = 97
+
+let configuration = {
+  privateKey: DEFAULT_DOTENV_PRIVATE_KEY,
+  privateKeyExplicit: false,
+  externalPublicKey: null,
+  processEnv: process.env,
+  initialized: false
+}
+
+export class DotenvDecryptionError extends Error {
+  constructor (name, cause) {
+    super(`Unable to decrypt ${name} with the selected dotenv private key`, { cause })
+    this.name = 'DotenvDecryptionError'
+    this.code = 'DOTENV_DECRYPTION_FAILED'
+  }
+}
+
+function normalizePrivateKey (value) {
+  const normalized = typeof value === 'string' ? value.toLowerCase() : ''
+  if (!/^[0-9a-f]{64}$/.test(normalized)) throw new Error('Invalid dotenv private key')
+  try {
+    derive(normalized)
+  } catch {
+    throw new Error('Invalid dotenv private key')
+  }
+  return normalized
+}
+
+function normalizePublicKey (value) {
+  const normalized = typeof value === 'string' ? value.toLowerCase() : ''
+  if (!/^(02|03)[0-9a-f]{64}$/.test(normalized)) throw new Error('Invalid dotenv public key')
+  try {
+    encrypt(normalized, '')
+  } catch {
+    throw new Error('Invalid dotenv public key')
+  }
+  return normalized
+}
+
+function isEncrypted (value) {
+  return typeof value === 'string' && value.startsWith(ENCRYPTED_PREFIX)
+}
+
+function validateEncryptedValue (value) {
+  if (!isEncrypted(value)) throw new Error('Invalid encrypted dotenv value')
+  const encoded = value.slice(ENCRYPTED_PREFIX.length)
+  if (!/^[A-Za-z0-9+/]+={0,2}$/.test(encoded)) throw new Error('Invalid encrypted dotenv value')
+  let bytes
+  try {
+    bytes = base64ToBytes(encoded)
+  } catch {
+    throw new Error('Invalid encrypted dotenv value')
+  }
+  if (bytes.length < MIN_ECIES_PAYLOAD_BYTES || bytesToBase64(bytes) !== encoded) {
+    throw new Error('Invalid encrypted dotenv value')
+  }
+}
+
+function validateManagedValue (name, value) {
+  if (name === 'NOSTR_SECRET_KEY') return validateNostrSecretKey(value)
+  if (name === LAST_CLI_BUNKER_SESSION) {
+    decodeCliSession(value)
+    return value
+  }
+  throw new Error(`Unsupported managed dotenv variable: ${name}`)
+}
+
+export function readDotenvValues (filePath = dotenvPath) {
+  try {
+    return dotenv.parse(fs.readFileSync(filePath))
+  } catch (error) {
+    if (error?.code === 'ENOENT') return {}
+    throw error
+  }
+}
+
+function readDotenvFile (filePath) {
+  try {
+    return {
+      contents: fs.readFileSync(filePath, 'utf8'),
+      mode: fs.statSync(filePath).mode & 0o777
+    }
+  } catch (error) {
+    if (error?.code === 'ENOENT') return { contents: '', mode: 0o600 }
+    throw error
+  }
+}
+
+function writeDotenvChanges (changes, { filePath = dotenvPath } = {}) {
+  const { contents, mode } = readDotenvFile(filePath)
+  const eol = contents.includes('\r\n') ? '\r\n' : '\n'
+  const lines = contents ? contents.split(/\r?\n/) : []
+  if (lines.at(-1) === '') lines.pop()
+
+  const names = [...changes.keys()]
+  const assignments = new Map(names.map(name => [
+    name,
+    new RegExp(`^\\s*(?:export\\s+)?${name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\s*=`)
+  ]))
+  const written = new Set()
+  const nextLines = []
+
+  for (const line of lines) {
+    const name = names.find(candidate => assignments.get(candidate).test(line))
+    if (!name) {
+      nextLines.push(line)
+      continue
+    }
+    if (written.has(name)) continue
+    written.add(name)
+    const value = changes.get(name)
+    if (value !== null) nextLines.push(`${name}=${JSON.stringify(value)}`)
+  }
+  for (const [name, value] of changes) {
+    if (!written.has(name) && value !== null) nextLines.push(`${name}=${JSON.stringify(value)}`)
+  }
+
+  const nextContents = `${nextLines.join(eol)}${eol}`
+  const directory = path.dirname(filePath)
+  const temporaryPath = path.join(directory, `.${path.basename(filePath)}.${process.pid}.${randomUUID()}.tmp`)
+  try {
+    fs.writeFileSync(temporaryPath, nextContents, { encoding: 'utf8', flag: 'wx', mode })
+    fs.chmodSync(temporaryPath, mode)
+    fs.renameSync(temporaryPath, filePath)
+  } finally {
+    try {
+      fs.unlinkSync(temporaryPath)
+    } catch {}
+  }
+}
+
+function decryptManagedValue (name, value, privateKey) {
+  try {
+    validateEncryptedValue(value)
+    return decrypt(privateKey, value)
+  } catch (error) {
+    throw new DotenvDecryptionError(name, error)
+  }
+}
+
+function warnKeyMismatch (names, onWarning, replacingName) {
+  const details = []
+  if (replacingName) details.push(`${replacingName} will be replaced by the supplied value`)
+  if (names.includes('NOSTR_SECRET_KEY')) {
+    details.push('a new publisher identity will be generated unless -s or an environment NOSTR_SECRET_KEY is provided')
+  }
+  if (names.includes(LAST_CLI_BUNKER_SESSION)) {
+    details.push('the next CLI bunker connection will generate a new client key and may require authorization')
+  }
+  const discarded = names.length ? ` Inaccessible values reset: ${names.join(', ')}.` : ''
+  const consequences = details.length ? ` ${details.join('; ')}.` : ''
+  onWarning?.(`The explicit dotenv private key does not match the stored public key; adopting the explicit key.${discarded}${consequences}`)
+}
+
+function reconcileExplicitPrivateKey (filePath, onWarning, replacement) {
+  if (!configuration.privateKeyExplicit) return false
+  const values = readDotenvValues(filePath)
+  const derivedPublicKey = derive(configuration.privateKey)
+  const existingPublicValue = values[DOTENV_PUBLIC_KEY_NAME]
+  if (!existingPublicValue) return false
+
+  let existingPublicKey
+  try {
+    existingPublicKey = normalizePublicKey(existingPublicValue)
+  } catch {
+    existingPublicKey = null
+  }
+  if (existingPublicKey === derivedPublicKey) {
+    if (existingPublicValue !== derivedPublicKey) {
+      writeDotenvChanges(new Map([[DOTENV_PUBLIC_KEY_NAME, derivedPublicKey]]), { filePath })
+    }
+    return false
+  }
+
+  const fallbackPublicKey = derive(DEFAULT_DOTENV_PRIVATE_KEY)
+  const fallbackUpgrade = existingPublicKey === fallbackPublicKey
+  const changes = new Map([[DOTENV_PUBLIC_KEY_NAME, derivedPublicKey]])
+  const discarded = []
+
+  for (const name of MANAGED_NAMES) {
+    const stored = values[name]
+    if (stored === undefined) continue
+    if (replacement?.name === name) continue
+    let plaintext
+    try {
+      if (isEncrypted(stored)) {
+        try {
+          plaintext = decryptManagedValue(name, stored, configuration.privateKey)
+        } catch (error) {
+          if (!fallbackUpgrade) throw error
+          plaintext = decryptManagedValue(name, stored, DEFAULT_DOTENV_PRIVATE_KEY)
+        }
+      } else {
+        plaintext = stored
+      }
+      validateManagedValue(name, plaintext)
+      changes.set(name, encrypt(derivedPublicKey, plaintext))
+    } catch (error) {
+      if (fallbackUpgrade) throw error
+      changes.set(name, null)
+      discarded.push(name)
+    }
+  }
+
+  if (replacement) changes.set(replacement.name, encrypt(derivedPublicKey, replacement.value))
+  if (!fallbackUpgrade) warnKeyMismatch(discarded, onWarning, replacement?.name)
+  writeDotenvChanges(changes, { filePath })
+  return true
+}
+
+function getPublicKeyForFile (filePath) {
+  const values = readDotenvValues(filePath)
+  const stored = values[DOTENV_PUBLIC_KEY_NAME]
+  if (stored) return normalizePublicKey(stored)
+  if (configuration.externalPublicKey) return configuration.externalPublicKey
+  return derive(configuration.privateKey)
+}
+
+export function setDotenvValue (name, value, {
+  filePath = dotenvPath,
+  updateProcessEnv = true
+} = {}) {
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) throw new Error('Invalid dotenv variable name')
+  if (MANAGED_NAMES.has(name)) throw new Error(`Use setEncryptedDotenvValue for ${name}`)
+  if (typeof value !== 'string') throw new TypeError('Dotenv value should be a string')
+  writeDotenvChanges(new Map([[name, value]]), { filePath })
+  if (updateProcessEnv) configuration.processEnv[name] = value
+}
+
+export function setEncryptedDotenvValue (name, value, {
+  filePath = dotenvPath,
+  updateProcessEnv = true,
+  onWarning = console.warn
+} = {}) {
+  if (!MANAGED_NAMES.has(name)) throw new Error(`Unsupported managed dotenv variable: ${name}`)
+  if (typeof value !== 'string') throw new TypeError('Dotenv value should be a string')
+  validateManagedValue(name, value)
+  const reconciled = reconcileExplicitPrivateKey(filePath, onWarning, { name, value })
+  if (reconciled) {
+    if (updateProcessEnv) configuration.processEnv[name] = value
+    return
+  }
+  const publicKey = getPublicKeyForFile(filePath)
+  writeDotenvChanges(new Map([
+    [DOTENV_PUBLIC_KEY_NAME, publicKey],
+    [name, encrypt(publicKey, value)]
+  ]), { filePath })
+  if (updateProcessEnv) configuration.processEnv[name] = value
+}
+
+export function readEncryptedDotenvValue (name, {
+  filePath = dotenvPath,
+  migratePlaintext = true,
+  onWarning = console.warn
+} = {}) {
+  if (!MANAGED_NAMES.has(name)) throw new Error(`Unsupported managed dotenv variable: ${name}`)
+  reconcileExplicitPrivateKey(filePath, onWarning)
+  const values = readDotenvValues(filePath)
+  const stored = values[name]
+  if (stored === undefined) return null
+
+  if (!isEncrypted(stored)) {
+    validateManagedValue(name, stored)
+    if (migratePlaintext) {
+      setEncryptedDotenvValue(name, stored, { filePath, updateProcessEnv: false, onWarning })
+    }
+    return stored
+  }
+
+  const publicKey = values[DOTENV_PUBLIC_KEY_NAME]
+    ? normalizePublicKey(values[DOTENV_PUBLIC_KEY_NAME])
+    : derive(configuration.privateKey)
+  if (derive(configuration.privateKey) !== publicKey) {
+    throw new DotenvDecryptionError(name, new Error('The selected private key does not match DOTENV_PUBLIC_KEY_NAPPUP'))
+  }
+  const plaintext = decryptManagedValue(name, stored, configuration.privateKey)
+  validateManagedValue(name, plaintext)
+  return plaintext
+}
+
+export function initializeDotenv ({
+  privateKey,
+  filePath = dotenvPath,
+  processEnv = process.env,
+  loadNostrSecretKey = true,
+  reconcilePrivateKey = true,
+  onWarning = console.warn
+} = {}) {
+  const hadNostrSecretKey = Object.hasOwn(processEnv, 'NOSTR_SECRET_KEY')
+  const environmentPrivateKey = Object.hasOwn(processEnv, DOTENV_PRIVATE_KEY_NAME)
+    ? processEnv[DOTENV_PRIVATE_KEY_NAME]
+    : null
+  const environmentPublicKey = Object.hasOwn(processEnv, DOTENV_PUBLIC_KEY_NAME)
+    ? processEnv[DOTENV_PUBLIC_KEY_NAME]
+    : null
+  const selectedPrivateKey = normalizePrivateKey(privateKey ?? environmentPrivateKey ?? DEFAULT_DOTENV_PRIVATE_KEY)
+
+  const initialValues = readDotenvValues(filePath)
+  if (Object.hasOwn(initialValues, DOTENV_PRIVATE_KEY_NAME)) {
+    throw new Error(`${DOTENV_PRIVATE_KEY_NAME} must not be stored in ${filePath}`)
+  }
+
+  configuration = {
+    privateKey: selectedPrivateKey,
+    privateKeyExplicit: (privateKey !== undefined && privateKey !== null) || environmentPrivateKey !== null,
+    externalPublicKey: environmentPublicKey ? normalizePublicKey(environmentPublicKey) : null,
+    processEnv,
+    initialized: true
+  }
+
+  if (reconcilePrivateKey) reconcileExplicitPrivateKey(filePath, onWarning)
+  const values = readDotenvValues(filePath)
+  for (const [name, value] of Object.entries(values)) {
+    if (name === DOTENV_PRIVATE_KEY_NAME || MANAGED_NAMES.has(name)) continue
+    if (!Object.hasOwn(processEnv, name)) processEnv[name] = value
+  }
+
+  let nostrSecretKeySource = hadNostrSecretKey ? 'process' : null
+  if (!hadNostrSecretKey && loadNostrSecretKey) {
+    const value = readEncryptedDotenvValue('NOSTR_SECRET_KEY', { filePath, onWarning })
+    if (value !== null) {
+      processEnv.NOSTR_SECRET_KEY = value
+      nostrSecretKeySource = 'dotenv'
+    }
+  }
+
+  return {
+    filePath,
+    nostrSecretKeySource,
+    privateKeyExplicit: configuration.privateKeyExplicit,
+    publicKey: getPublicKeyForFile(filePath)
+  }
+}
+
+export function ensureDotenvInitialized (options) {
+  if (!configuration.initialized) return initializeDotenv(options)
+  return null
+}

package/src/services/irfs-upload.js

@@ -1,4 +1,4 @@
-import nostrRelays, { nappRelays } from '#services/nostr-relays.js'
+import nostrRelays, { nappRelays, sendEventReport } from '#services/nostr-relays.js'
 import NMMR from 'nmmr'
 import { decode as base93Decode, encode as base93Encode } from 'libp2r2p/base93'
 import { stringifyEvent } from '#helpers/event.js'
@@ -137,7 +137,7 @@ export async function throttledSendEvent (event, relays, {
   if (pause && leadingPause) await new Promise(resolve => setTimeout(resolve, pause))
   if (retries > 0) log(`Retrying upload to ${relays.length} relays: ${relays.join(', ')}`)
 
-  const { errors } = (await nostrRelays.sendEvent(event, relays, 15000))
+  const { errors } = await sendEventReport(event, relays, { timeout: 15000, timeoutUntilFirstFulfillment: null })
   if (errors.length === 0) {
     if (pause && trailingPause) await new Promise(resolve => setTimeout(resolve, pause))
     return { pause }
@@ -147,8 +147,7 @@ export async function throttledSendEvent (event, relays, {
     errors.reduce((r, v) => {
       const message = v.reason?.message ?? ''
       if (message.startsWith('rate-limited:')) r[0].push(v)
-      // https://github.com/nbd-wtf/nostr-tools/blob/28f7553187d201088c8a1009365db4ecbe03e568/abstract-relay.ts#L311
-      else if (message === 'publish timed out') r[1].push(v)
+      else if (message === 'PUBLISH_TIMEOUT') r[1].push(v)
       else r[2].push(v)
       return r
     }, [[], [], []])
@@ -158,7 +157,7 @@ export async function throttledSendEvent (event, relays, {
     const timedOutRelays = maybeUnretryableErrors.map(v => v.relay)
     log(`${maybeUnretryableErrors.length} timeout errors, retrying once after ${pause}ms:\n${maybeUnretryableErrors.map(v => `${v.relay}: ${v.reason.message}`).join('; ')}`)
     if (pause) await new Promise(resolve => setTimeout(resolve, pause))
-    const { errors: timeoutRetryErrors } = await nostrRelays.sendEvent(event, timedOutRelays, 15000)
+    const { errors: timeoutRetryErrors } = await sendEventReport(event, timedOutRelays, { timeout: 15000, timeoutUntilFirstFulfillment: null })
     unretryableErrors.push(...timeoutRetryErrors)
   }
 
@@ -204,7 +203,7 @@ export async function getPreviousChunks (dTagValues, relays, signer) {
       authors: [pubkey],
       '#d': batch,
       limit: batch.length
-    }, targetRelays)).result
+    }, targetRelays, { timeoutAfterFirstEose: null })).result
 
     for (const event of storedEvents) {
       const dTag = event.tags?.find(tag => tag[0] === 'd')?.[1]

package/src/services/nostr-relays.js

@@ -1,5 +1,4 @@
-import { Relay } from 'nostr-tools/relay'
-import { maybeUnref } from '#helpers/timer.js'
+import { relayPool } from 'libp2r2p/relay'
 
 export const seedRelays = [
   'wss://relay.44billion.net',
@@ -14,145 +13,13 @@ export const freeRelays = [
   'wss://nos.lol',
   'wss://relay.damus.io'
 ]
-export const nappRelays = [
-  'wss://relay.44billion.net'
-]
-
-// Interacts with Nostr relays
-export class NostrRelays {
-  #relays = new Map()
-  #relayTimeouts = new Map()
-  #timeout = 30000 // 30 seconds
-
-  // Get a relay connection, creating one if it doesn't exist
-  async #getRelay (url) {
-    if (this.#relays.has(url)) {
-      clearTimeout(this.#relayTimeouts.get(url))
-      this.#relayTimeouts.set(url, maybeUnref(setTimeout(() => this.disconnect(url), this.#timeout)))
-      const relay = this.#relays.get(url)
-      // Reconnect if needed to avoid SendingOnClosedConnection errors
-      await relay.connect()
-      return relay
-    }
-
-    const relay = new Relay(url)
-    this.#relays.set(url, relay)
-
-    await relay.connect()
-
-    this.#relayTimeouts.set(url, maybeUnref(setTimeout(() => this.disconnect(url), this.#timeout)))
-
-    return relay
-  }
-
-  // Disconnect from a relay
-  async disconnect (url) {
-    if (this.#relays.has(url)) {
-      const relay = this.#relays.get(url)
-      if (relay.ws.readyState < 2) await relay.close()?.catch(console.log)
-      this.#relays.delete(url)
-      clearTimeout(this.#relayTimeouts.get(url))
-      this.#relayTimeouts.delete(url)
-    }
-  }
-
-  // Disconnect from all relays
-  async disconnectAll () {
-    for (const url of this.#relays.keys()) {
-      await this.disconnect(url)
-    }
-  }
-
-  // Get events from a list of relays
-  async getEvents (filter, relays, timeout = 5000) {
-    const events = []
-    const promises = relays.map(async (url) => {
-      let sub
-      const p = Promise.withResolvers()
-      const t = Promise.withResolvers()
-      const timer = maybeUnref(setTimeout(() => {
-        sub?.close()
-        t.reject(new Error(`timeout: ${url}`))
-      }, timeout))
-
-      ;(async () => {
-        try {
-          const relay = await this.#getRelay(url)
-          sub = relay.subscribe([filter], {
-            onevent: (event) => {
-              event.meta = { relay: url }
-              events.push(event)
-            },
-            onclose: err => err ? p.reject(err) : p.resolve(),
-            oneose: () => { sub.close(); p.resolve() }
-          })
-        } catch (err) {
-          p.reject(err)
-        }
-      })()
-
-      try {
-        await Promise.race([p.promise, t.promise])
-      } finally {
-        clearTimeout(timer)
-      }
-    })
-
-    const results = await Promise.allSettled(promises)
-    const rejectedResults = results.filter(v => v.status === 'rejected')
-
-    return {
-      result: events,
-      errors: rejectedResults.map(v => ({ reason: v.reason, relay: relays[results.indexOf(v)] })),
-      success: events.length > 0 || results.length !== rejectedResults.length
-    }
-  }
-
-  // Send an event to a list of relays
-  async sendEvent (event, relays, timeout = 3000) {
-    const eventToSend = event.meta ? { ...event } : event
-    if (eventToSend.meta) delete eventToSend.meta
-
-    const promises = relays.map(async (url) => {
-      const p = Promise.withResolvers()
-      const t = Promise.withResolvers()
-      const timer = maybeUnref(setTimeout(() => {
-        t.reject(new Error(`timeout: ${url}`))
-      }, timeout))
-
-      ;(async () => {
-        try {
-          const relay = await this.#getRelay(url)
-          await relay.publish(eventToSend)
-          p.resolve()
-        } catch (err) {
-          if (err.message?.startsWith('duplicate:')) return p.resolve()
-          if (err.message?.startsWith('mute:')) {
-            console.info(`${url} - ${err.message}`)
-            return p.resolve()
-          }
-          p.reject(err)
-        }
-      })()
-
-      try {
-        await Promise.race([p.promise, t.promise])
-      } finally {
-        clearTimeout(timer)
-      }
-    })
-
-    const results = await Promise.allSettled(promises)
-    const rejectedResults = results.filter(v => v.status === 'rejected')
+export const nappRelays = ['wss://relay.44billion.net']
 
-    return {
-      result: null,
-      errors: rejectedResults.map(v => ({ reason: v.reason, relay: relays[results.indexOf(v)] })),
-      success: results.length !== rejectedResults.length
-    }
-  }
+// sendEvent returns quickly after the first successful publish. Upload flows
+// need the terminal per-relay report so retries and replication stay correct.
+export async function sendEventReport (event, relays, options) {
+  const result = await relayPool.sendEvent(event, relays, options)
+  return await (result?.promise ?? result)
 }
 
-// Share same connection
-// Connections aren't authenticated, thus no need to split by authed user
-export default new NostrRelays()
+export default relayPool

package/src/services/nostr-secret-key.js

@@ -0,0 +1,24 @@
+import { getPublicKey } from 'libp2r2p/key'
+import { base16ToBytes } from 'libp2r2p/base16'
+import { nsecDecode } from 'libp2r2p/nip19'
+import { parseBunkerSessionUrl } from '#services/bunker-url.js'
+
+const HEX_32 = /^[0-9a-f]{64}$/i
+
+export function validateNostrSecretKey (value) {
+  if (typeof value !== 'string' || !value) throw new Error('Invalid NOSTR_SECRET_KEY')
+  if (value.startsWith('bunker://')) {
+    parseBunkerSessionUrl(value)
+    return value
+  }
+
+  let hex = value
+  try {
+    if (value.startsWith('nsec1')) hex = nsecDecode(value)
+    if (!HEX_32.test(hex)) throw new Error()
+    getPublicKey(base16ToBytes(hex))
+  } catch {
+    throw new Error('Invalid NOSTR_SECRET_KEY')
+  }
+  return value
+}

package/src/services/nostr-signer.js

@@ -1,27 +1,11 @@
-import fs from 'node:fs'
-import path from 'node:path'
-import { fileURLToPath } from 'node:url'
-import * as dotenv from 'dotenv'
-import { getPublicKey } from 'nostr-tools/pure'
-import { getConversationKey, encrypt, decrypt } from 'nostr-tools/nip44'
-import nostrRelays, { seedRelays, freeRelays } from '#services/nostr-relays.js'
+import { finalizeEvent } from 'libp2r2p/event'
+import { generateSecretKey, getPublicKey } from 'libp2r2p/key'
+import * as nip44 from 'libp2r2p/nip44'
+import { seedRelays, freeRelays, sendEventReport } from '#services/nostr-relays.js'
 import { getRelays } from '#helpers/signer.js'
 import { bytesToBase16, base16ToBytes } from '#helpers/base16.js'
-import { finalizeEvent } from '#helpers/nip01.js'
 import { nsecDecode, nsecEncode } from 'libp2r2p/nip19'
-const __dirname = fileURLToPath(new URL('.', import.meta.url))
-
-const dotenvPath = process.env.DOTENV_CONFIG_PATH ?? `${__dirname}/../../.env`
-dotenv.config({
-  path: dotenvPath,
-  quiet: true
-})
-
-const nip44 = {
-  getConversationKey,
-  encrypt,
-  decrypt
-}
+import { ensureDotenvInitialized, setEncryptedDotenvValue } from '#services/dotenv.js'
 
 const createToken = Symbol('createToken')
 
@@ -42,6 +26,7 @@ export default class NostrSigner {
       return new this(createToken, base16ToBytes(sk))
     }
 
+    ensureDotenvInitialized()
     let skBytes
     let isNewSk = false
     if (process.env.NOSTR_SECRET_KEY) {
@@ -51,9 +36,8 @@ export default class NostrSigner {
       skBytes = base16ToBytes(envSk)
     } else {
       isNewSk = true
-      sk = generateSecretKey()
-      fs.appendFileSync(path.resolve(dotenvPath), `NOSTR_SECRET_KEY=${nsecEncode(sk)}\n`)
-      skBytes = base16ToBytes(sk)
+      skBytes = generateSecretKey()
+      setEncryptedDotenvValue('NOSTR_SECRET_KEY', nsecEncode(bytesToBase16(skBytes)))
     }
     const ret = new this(createToken, skBytes)
     if (isNewSk) await ret.#initSk(sk)
@@ -74,7 +58,7 @@ export default class NostrSigner {
       content: '',
       created_at: Math.floor(Date.now() / 1000)
     })
-    await nostrRelays.sendEvent(relayList, [...new Set([...seedRelays, ...relays].map(r => r.trim().replace(/\/$/, '')))])
+    await sendEventReport(relayList, [...new Set([...seedRelays, ...relays].map(r => r.trim().replace(/\/$/, '')))])
 
     const profile = await this.signEvent({
       kind: 0,
@@ -86,7 +70,7 @@ export default class NostrSigner {
       }),
       created_at: Math.floor(Date.now() / 1000)
     })
-    await nostrRelays.sendEvent(profile, relays)
+    await sendEventReport(profile, relays)
   }
 
   // hex
@@ -109,21 +93,11 @@ export default class NostrSigner {
 
   nip44Encrypt (pubkey, plaintext) {
     const conversationKey = nip44.getConversationKey(this.#secretKey, pubkey)
-    return nip44.encrypt(conversationKey, plaintext)
+    return nip44.encrypt(plaintext, conversationKey)
   }
 
   nip44Decrypt (pubkey, ciphertext) {
     const conversationKey = nip44.getConversationKey(this.#secretKey, pubkey)
-    return nip44.decrypt(conversationKey, ciphertext)
+    return nip44.decrypt(ciphertext, conversationKey)
   }
 }
-
-function generateSecretKey () {
-  const randomBytes = crypto.getRandomValues(new Uint8Array(40))
-  const B256 = 2n ** 256n // secp256k1 is short weierstrass curve
-  const N = B256 - 0x14551231950b75fc4402da1732fc9bebfn // curve (group) order
-  const bytesToNumber = b => BigInt('0x' + (bytesToBase16(b) || '0'))
-  const mod = (a, b) => { const r = a % b; return r >= 0n ? r : b + r } // mod division
-  const num = mod(bytesToNumber(randomBytes), N - 1n) + 1n // takes at least n+8 bytes
-  return num.toString(16).padStart(64, '0')
-}

package/src/services/site-manifest.js

@@ -10,6 +10,7 @@ const MANAGED_MANIFEST_TAGS = new Set([
 export function normalizeManifestPath (value) {
   if (typeof value !== 'string') throw new TypeError('Manifest path must be a string')
   const path = value.startsWith('/') ? value.slice(1) : value
+  // eslint-disable-next-line no-control-regex
   if (!path || path.includes('\\') || /[\u0000-\u001f\u007f]/.test(path)) {
     throw new Error(`Unsafe manifest path: ${JSON.stringify(value)}`)
   }
@@ -186,7 +187,7 @@ export async function uploadSiteManifest ({
     authors: [await signer.getPublicKey()],
     '#d': [dTag],
     limit: 1
-  }, relays)).result
+  }, relays, { timeoutAfterFirstEose: null })).result
   events.sort(newestFirst)
   const previous = events[0]
   const tags = buildManifestTags({