nappup 2.3.1 → 2.3.3

package/bin/nappup/helpers.js

@@ -153,7 +153,7 @@ export async function readEnvSetValue (args, {
 }
 
 export async function confirmArgs (args) {
-  if (args.yes) return
+  if (args.yes) return true
   const rl = readline.createInterface({
     input: process.stdin,
     output: process.stdout
@@ -162,14 +162,18 @@ export async function confirmArgs (args) {
     return new Promise(resolve => rl.question(query, resolve))
   }
   const answer = await askQuestion(
-    `Publish app from '${args.dir}' as '${args.dTag}' to the ${args.channel} release channel? (y/n) `
+    confirmationPrompt(args)
   )
+  rl.close()
   if (answer.toLowerCase() !== 'y') {
     console.log('Operation cancelled by user.')
-    rl.close()
-    process.exit(0)
+    return false
   }
-  rl.close()
+  return true
+}
+
+export function confirmationPrompt (args) {
+  return `Publish app from '${args.dir}' as '${args.dTag}' to the ${args.channel} release channel using ${args.npub}? (y/n) `
 }
 
 export async function * getFiles (dir) {

package/bin/nappup/index.js

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import path from 'node:path'
+import { npubEncode } from 'libp2r2p/nip19'
 import { GENERIC_BUILD_FOLDER_NAMES } from '#helpers/app.js'
 import {
   parseArgs,
@@ -57,8 +58,6 @@ async function upload (args, dotenvState) {
   }
   args.dTag = dTag
 
-  await confirmArgs(args)
-  const fileList = await toFileList(getFiles(dir), dir)
   const bunkerUrl = sk?.startsWith('bunker://')
     ? sk
     : !sk && process.env.NOSTR_SECRET_KEY?.startsWith('bunker://')
@@ -73,10 +72,17 @@ async function upload (args, dotenvState) {
     })
   } else {
     const { default: NostrSigner } = await import('#services/nostr-signer.js')
-    signer = await NostrSigner.create(sk)
+    signer = await NostrSigner.create(sk, {
+      deferInitialization: true,
+      dotenvFilePath: dotenvState.filePath
+    })
   }
 
   try {
+    args.npub = npubEncode(await signer.getPublicKey())
+    if (!await confirmArgs(args)) return
+    await signer.initialize?.()
+    const fileList = await toFileList(getFiles(dir), dir)
     const { default: toApp } = await import('#index.js')
     await toApp(fileList, signer, { log: console.log.bind(console), dTag, channel, shouldReupload })
   } finally {

package/package.json

@@ -6,7 +6,7 @@
     "url": "git+https://github.com/44billion/nappup.git"
   },
   "license": "MIT",
-  "version": "2.3.1",
+  "version": "2.3.3",
   "description": "Nostr App Uploader",
   "type": "module",
   "scripts": {
@@ -22,7 +22,7 @@
     "@noble/hashes": "^2.0.0",
     "dotenv": "^17.2.0",
     "file-type": "^21.0.0",
-    "libp2r2p": "^0.10.1",
+    "libp2r2p": "^0.10.2",
     "mime-types": "^3.0.1",
     "nmmr": "^2.0.0"
   },

package/src/helpers/app-metadata.js

@@ -1,82 +1,219 @@
-export function extractHtmlMetadata (htmlContent) {
-  let name
-  let description
+const IMAGE_EXTENSIONS = /\.(?:ico|svg|webp|png|jpe?g|gif|avif)(?:[?#].*)?$/i
 
-  try {
-    const titleRegex = /<title[^>]*>([\s\S]*?)<\/title>/i
-    const titleMatch = htmlContent.match(titleRegex)
-    if (titleMatch && titleMatch[1]) {
-      name = titleMatch[1].trim()
-    }
+// Decodes the character references commonly used in metadata attributes.
+function decodeHtml (value) {
+  return String(value || '').replace(/&(#x[0-9a-f]+|#\d+|amp|quot|apos|lt|gt);/gi, (_, entity) => {
+    const lower = entity.toLowerCase()
+    if (lower === 'amp') return '&'
+    if (lower === 'quot') return '"'
+    if (lower === 'apos') return "'"
+    if (lower === 'lt') return '<'
+    if (lower === 'gt') return '>'
+    const codePoint = lower.startsWith('#x')
+      ? Number.parseInt(lower.slice(2), 16)
+      : Number.parseInt(lower.slice(1), 10)
+    return Number.isSafeInteger(codePoint) && codePoint >= 0 && codePoint <= 0x10ffff
+      ? String.fromCodePoint(codePoint)
+      : _
+  })
+}
 
-    if (!name) {
-      const ogTitleRegex = /<meta\s+[^>]*(?:property|name)\s*=\s*["']og:title["'][^>]*content\s*=\s*["']([^"']+)["'][^>]*>/i
-      const ogTitleMatch = htmlContent.match(ogTitleRegex)
-      if (ogTitleMatch && ogTitleMatch[1]) {
-        name = ogTitleMatch[1].trim()
-      } else {
-        const altOgTitleRegex = /<meta\s+[^>]*content\s*=\s*["']([^"']+)["'][^>]*(?:property|name)\s*=\s*["']og:title["'][^>]*>/i
-        const altOgTitleMatch = htmlContent.match(altOgTitleRegex)
-        if (altOgTitleMatch && altOgTitleMatch[1]) {
-          name = altOgTitleMatch[1].trim()
-        }
+// Parses attributes without depending on a browser DOM implementation.
+function parseAttributes (tag) {
+  const attributes = {}
+  const source = tag.replace(/^<\s*[^\s>]+/, '').replace(/\/?\s*>$/, '')
+  const pattern = /([^\s"'<>/=]+)(?:\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'=<>`]+)))?/g
+  for (const match of source.matchAll(pattern)) {
+    const name = match[1].toLowerCase()
+    if (!(name in attributes)) attributes[name] = decodeHtml(match[2] ?? match[3] ?? match[4] ?? '')
+  }
+  return attributes
+}
+
+// Scans selected HTML start tags while respecting quoted greater-than signs.
+function scanTags (htmlContent, names) {
+  const tags = []
+  const start = new RegExp(`<\\s*(${[...names].join('|')})\\b`, 'ig')
+  for (const match of htmlContent.matchAll(start)) {
+    let quote = null
+    let end = match.index + match[0].length
+    for (; end < htmlContent.length; end++) {
+      const char = htmlContent[end]
+      if (quote) {
+        if (char === quote) quote = null
+      } else if (char === '"' || char === "'") {
+        quote = char
+      } else if (char === '>') {
+        break
       }
     }
-
-    const metaDescRegex = /<meta\s+[^>]*name\s*=\s*["']description["'][^>]*content\s*=\s*["']([^"']+)["'][^>]*>/i
-    const metaDescMatch = htmlContent.match(metaDescRegex)
-    if (metaDescMatch && metaDescMatch[1]) {
-      description = metaDescMatch[1].trim()
+    if (end < htmlContent.length) {
+      tags.push({ name: match[1].toLowerCase(), attributes: parseAttributes(htmlContent.slice(match.index, end + 1)), index: match.index })
     }
+  }
+  return tags
+}
+
+// Adds a unique icon source with a stable priority and document order.
+function addIconSource (sources, seen, href, kind, priority, index) {
+  const value = typeof href === 'string' ? href.trim() : ''
+  if (!value || seen.has(value)) return
+  seen.add(value)
+  sources.push({ href: value, kind, priority, index })
+}
 
-    if (!description) {
-      const altMetaDescRegex = /<meta\s+[^>]*content\s*=\s*["']([^"']+)["'][^>]*name\s*=\s*["']description["'][^>]*>/i
-      const altMetaDescMatch = htmlContent.match(altMetaDescRegex)
-      if (altMetaDescMatch && altMetaDescMatch[1]) {
-        description = altMetaDescMatch[1].trim()
+function metadataMarkup (htmlContent) {
+  return String(htmlContent || '')
+    .replace(/<!--[\s\S]*?-->/g, '')
+    .replace(/<(script|style|template)\b[^>]*>[\s\S]*?<\/\1\s*>/gi, '')
+}
+
+// Extracts listing text plus browser, platform and social icon declarations.
+export function extractHtmlMetadata (htmlContent) {
+  const html = metadataMarkup(htmlContent)
+  let name = decodeHtml(html.match(/<title[^>]*>([\s\S]*?)<\/title>/i)?.[1]).trim() || undefined
+  let namePriority = name ? 0 : Infinity
+  let description
+  let descriptionPriority = Infinity
+  let baseHref
+  const iconSources = []
+  const seenIcons = new Set()
+
+  try {
+    const tags = scanTags(html, new Set(['base', 'link', 'meta']))
+    for (const { name: tagName, attributes, index } of tags) {
+      if (tagName === 'base' && !baseHref && attributes.href) {
+        baseHref = attributes.href.trim()
+        continue
+      }
+      if (tagName === 'link') {
+        const rels = new Set((attributes.rel || '').toLowerCase().split(/\s+/).filter(Boolean))
+        if (rels.has('icon')) addIconSource(iconSources, seenIcons, attributes.href, 'icon', 10, index)
+        else if (rels.has('apple-touch-icon')) addIconSource(iconSources, seenIcons, attributes.href, 'apple-touch-icon', 20, index)
+        else if (rels.has('apple-touch-icon-precomposed')) addIconSource(iconSources, seenIcons, attributes.href, 'apple-touch-icon', 21, index)
+        else if (rels.has('mask-icon') || rels.has('fluid-icon')) addIconSource(iconSources, seenIcons, attributes.href, 'mask-icon', 30, index)
+        else if (rels.has('manifest')) addIconSource(iconSources, seenIcons, attributes.href, 'manifest', 40, index)
+        else if (rels.has('image_src')) addIconSource(iconSources, seenIcons, attributes.href, 'social-image', 70, index)
+        continue
       }
-    }
 
-    if (!description) {
-      const ogDescRegex = /<meta\s+[^>]*(?:property|name)\s*=\s*["']og:description["'][^>]*content\s*=\s*["']([^"']+)["'][^>]*>/i
-      const ogDescMatch = htmlContent.match(ogDescRegex)
-      if (ogDescMatch && ogDescMatch[1]) {
-        description = ogDescMatch[1].trim()
-      } else {
-        const altOgDescRegex = /<meta\s+[^>]*content\s*=\s*["']([^"']+)["'][^>]*(?:property|name)\s*=\s*["']og:description["'][^>]*>/i
-        const altOgDescMatch = htmlContent.match(altOgDescRegex)
-        if (altOgDescMatch && altOgDescMatch[1]) {
-          description = altOgDescMatch[1].trim()
-        }
+      const key = (attributes.property || attributes.name || attributes.itemprop || '').toLowerCase()
+      const content = attributes.content?.trim()
+      if (!content) continue
+      const nextNamePriority = key === 'application-name'
+        ? 10
+        : key === 'apple-mobile-web-app-title'
+          ? 20
+          : key === 'og:title' ? 30 : Infinity
+      if (nextNamePriority < namePriority) {
+        name = content
+        namePriority = nextNamePriority
+      }
+      const priority = key === 'description' ? 10 : key === 'og:description' ? 20 : Infinity
+      if (priority < descriptionPriority) {
+        description = content
+        descriptionPriority = priority
       }
+      if (key === 'msapplication-tileimage') addIconSource(iconSources, seenIcons, content, 'tile-image', 60, index)
+      else if (key === 'og:image:secure_url') addIconSource(iconSources, seenIcons, content, 'social-image', 71, index)
+      else if (key === 'og:image' || key === 'og:image:url') addIconSource(iconSources, seenIcons, content, 'social-image', 72, index)
+      else if (key === 'image') addIconSource(iconSources, seenIcons, content, 'social-image', 75, index)
+      else if (key === 'twitter:image' || key === 'twitter:image:src') addIconSource(iconSources, seenIcons, content, 'social-image', 80, index)
     }
+  } catch (_) {}
+
+  iconSources.sort((left, right) => left.priority - right.priority || left.index - right.index)
+  return {
+    name,
+    description,
+    baseHref,
+    iconSources: iconSources.map(({ href, kind }) => ({ href, kind }))
+  }
+}
+
+// Extracts ordered icon references from a parsed Web App Manifest.
+export function extractWebManifestIcons (manifest) {
+  try {
+    const parsed = typeof manifest === 'string' ? JSON.parse(manifest) : manifest
+    return (Array.isArray(parsed?.icons) ? parsed.icons : [])
+      .map((icon, index) => ({
+        href: typeof icon?.src === 'string' ? icon.src.trim() : '',
+        kind: 'web-app-manifest',
+        purpose: typeof icon?.purpose === 'string' ? icon.purpose.toLowerCase().split(/\s+/) : ['any'],
+        index
+      }))
+      .filter(icon => icon.href)
+      .sort((left, right) => {
+        const rank = icon => icon.purpose.includes('any') ? 0 : icon.purpose.includes('maskable') ? 1 : 2
+        return rank(left) - rank(right) || left.index - right.index
+      })
+      .map(({ href, kind }) => ({ href, kind }))
   } catch (_) {
-    // ignore
+    return []
   }
+}
 
-  return { name, description }
+// Returns the path portion of a reference as it would resolve inside the app.
+export function resolveAppPath (reference, basePath = 'index.html', baseHref) {
+  try {
+    const documentUrl = new URL(basePath, 'https://napp.invalid/')
+    const effectiveBase = baseHref ? new URL(baseHref, documentUrl) : documentUrl
+    const url = new URL(reference, effectiveBase)
+    if (!['http:', 'https:'].includes(url.protocol)) return null
+    return decodeURIComponent(url.pathname).replace(/^\/+/, '') || null
+  } catch (_) {
+    return null
+  }
 }
 
+// Returns the bundle-relative path represented by a File-like object.
+function filePath (file) {
+  const path = file?.webkitRelativePath || file?.name || ''
+  return file?.webkitRelativePath ? path.split('/').slice(1).join('/') : path
+}
+
+// Finds a conventional favicon file in a bundle.
 export function findFavicon (fileList) {
-  const faviconExtensions = ['ico', 'svg', 'webp', 'png', 'jpg', 'jpeg', 'gif']
-  for (const file of fileList) {
-    const filename = (file.webkitRelativePath || file.name || '').split('/').pop().toLowerCase()
-    if (filename.startsWith('favicon.')) {
-      const ext = filename.split('.').pop()
-      if (faviconExtensions.includes(ext)) {
-        return file
-      }
+  return fileList.find(file => {
+    const filename = filePath(file).split('/').pop().toLowerCase()
+    return filename.startsWith('favicon.') && IMAGE_EXTENSIONS.test(filename)
+  }) || null
+}
+
+// Finds the best local icon referenced by HTML or its Web App Manifest.
+export async function findAppIcon (fileList, htmlContent, indexFile, readFileText) {
+  const metadata = extractHtmlMetadata(htmlContent)
+  const indexPath = filePath(indexFile) || 'index.html'
+  const byPath = new Map(fileList.map(file => [filePath(file), file]))
+  const findFromSources = async sources => {
+    for (const source of sources) {
+      const path = resolveAppPath(source.href, indexPath, metadata.baseHref)
+      const file = path && byPath.get(path)
+      if (!file) continue
+      if (source.kind !== 'manifest') return file
+
+      try {
+        const manifestText = readFileText ? await readFileText(file) : await file.text()
+        for (const icon of extractWebManifestIcons(manifestText)) {
+          const iconPath = resolveAppPath(icon.href, path)
+          if (iconPath && byPath.has(iconPath)) return byPath.get(iconPath)
+        }
+      } catch (_) {}
     }
+    return null
   }
-  return null
+
+  const specificSources = metadata.iconSources.filter(source => !['tile-image', 'social-image'].includes(source.kind))
+  const socialSources = metadata.iconSources.filter(source => ['tile-image', 'social-image'].includes(source.kind))
+  return (await findFromSources(specificSources)) ||
+    findFavicon(fileList) ||
+    (await findFromSources(socialSources))
 }
 
+// Finds the app entry HTML file.
 export function findIndexFile (fileList) {
-  for (const file of fileList) {
-    const filename = (file.webkitRelativePath || file.name || '').split('/').pop().toLowerCase()
-    if (filename === 'index.html' || filename === 'index.htm') {
-      return file
-    }
-  }
-  return null
+  return fileList.find(file => {
+    const filename = filePath(file).split('/').pop().toLowerCase()
+    return filename === 'index.html' || filename === 'index.htm'
+  }) || null
 }

package/src/index.js

@@ -1,10 +1,10 @@
 import NMMR from 'nmmr'
-import { appEncode, npubEncode } from 'libp2r2p/nip19'
+import { appEncode } from 'libp2r2p/nip19'
 import nostrRelays from '#services/nostr-relays.js'
 import { getRelays } from '#helpers/signer.js'
 import { streamToChunks, streamToText } from '#helpers/stream.js'
 import { isNostrAppDTagSafe, GENERIC_BUILD_FOLDER_NAMES } from '#helpers/app.js'
-import { extractHtmlMetadata, findFavicon, findIndexFile } from '#helpers/app-metadata.js'
+import { extractHtmlMetadata, findAppIcon, findIndexFile } from '#helpers/app-metadata.js'
 import { getBlossomServers, healthCheckServers, uploadFilesToBlossom } from '#services/blossom-upload.js'
 import { uploadBinaryDataChunks } from '#services/irfs-upload.js'
 import { uploadSiteManifest } from '#services/site-manifest.js'
@@ -79,8 +79,7 @@ export async function toApp (fileList, nostrSigner, {
 
   const writeRelays = [...new Set((await nostrSigner.getRelays()).write
     .map(relay => relay.trim().replace(/\/$/, '')))]
-  const npub = npubEncode(await nostrSigner.getPublicKey())
-  log(`Found ${writeRelays.length} outbox relays for pubkey ${npub}:\n${writeRelays.join(', ')}`)
+  log(`Found ${writeRelays.length} outbox relays:\n${writeRelays.join(', ')}`)
   if (!writeRelays.length) throw new Error('No outbox relays found')
 
   if (typeof dTag === 'string') {
@@ -111,9 +110,11 @@ export async function toApp (fileList, nostrSigner, {
   const indexFile = findIndexFile(fileList)
   let manifestName = nappJson.name?.[0]?.[0]
   let manifestSummary = nappJson.summary?.[0]?.[0]
-  if (indexFile && (!manifestName || !manifestSummary)) {
+  let indexHtml = ''
+  if (indexFile) {
     try {
-      const { name, description } = extractHtmlMetadata(await streamToText(indexFile.stream()))
+      indexHtml = await streamToText(indexFile.stream())
+      const { name, description } = extractHtmlMetadata(indexHtml)
       if (!manifestName) manifestName = name
       if (!manifestSummary) manifestSummary = description
     } catch (error) {
@@ -121,7 +122,7 @@ export async function toApp (fileList, nostrSigner, {
     }
   }
 
-  const faviconFile = findFavicon(fileList)
+  const faviconFile = await findAppIcon(fileList, indexHtml, indexFile, file => streamToText(file.stream()))
   let iconMetadata
   let pause = 1000
 

package/src/services/nostr-relays.js

@@ -1,19 +1,5 @@
 import { relayPool } from 'libp2r2p/relay'
-
-export const seedRelays = [
-  'wss://relay.44billion.net',
-  'wss://purplepag.es',
-  'wss://user.kindpag.es',
-  'wss://relay.nos.social',
-  'wss://nostr.land',
-  'wss://indexer.coracle.social'
-]
-export const freeRelays = [
-  'wss://relay.primal.net',
-  'wss://nos.lol',
-  'wss://relay.damus.io'
-]
-export const nappRelays = ['wss://relay.44billion.net']
+export { freeRelays, nappRelays, seedRelays } from 'libp2r2p/relay'
 
 // sendEvent returns quickly after the first successful publish. Upload flows
 // need the terminal per-relay report so retries and replication stay correct.

package/src/services/nostr-signer.js

@@ -12,15 +12,19 @@ const createToken = Symbol('createToken')
 export default class NostrSigner {
   #secretKey // bytes
   #publicKey // hex
+  #needsInitialization
+  #dotenvFilePath
 
-  constructor (token, skBytes) {
+  constructor (token, skBytes, { needsInitialization = false, dotenvFilePath } = {}) {
     if (token !== createToken) throw new Error('Use NostrSigner.create(?sk) to instantiate this class.')
     if (!skBytes) throw new Error('Secret key missing.')
 
     this.#secretKey = skBytes
+    this.#needsInitialization = needsInitialization
+    this.#dotenvFilePath = dotenvFilePath
   }
 
-  static async create (sk) {
+  static async create (sk, { deferInitialization = false, dotenvFilePath } = {}) {
     if (sk) {
       if (sk.startsWith('nsec')) sk = nsecDecode(sk)
       return new this(createToken, base16ToBytes(sk))
@@ -37,13 +41,26 @@ export default class NostrSigner {
     } else {
       isNewSk = true
       skBytes = generateSecretKey()
-      setEncryptedDotenvValue('NOSTR_SECRET_KEY', nsecEncode(bytesToBase16(skBytes)))
     }
-    const ret = new this(createToken, skBytes)
-    if (isNewSk) await ret.#initSk(sk)
+    const ret = new this(createToken, skBytes, {
+      needsInitialization: isNewSk,
+      dotenvFilePath
+    })
+    if (isNewSk && !deferInitialization) await ret.initialize()
     return ret
   }
 
+  async initialize () {
+    if (!this.#needsInitialization) return
+    setEncryptedDotenvValue(
+      'NOSTR_SECRET_KEY',
+      nsecEncode(bytesToBase16(this.#secretKey)),
+      this.#dotenvFilePath ? { filePath: this.#dotenvFilePath } : undefined
+    )
+    this.#needsInitialization = false
+    await this.#initSk()
+  }
+
   async getRelays () {
     return getRelays.call(this)
   }