pakstr 0.13.1 → 0.13.3

package/dist/commands/publish.js

@@ -11,9 +11,10 @@ const zapStore_1 = require("../core/zapStore");
 const blossom_1 = require("../core/blossom");
 const nostr_1 = require("../core/nostr");
 const identityProof_1 = require("../core/identityProof");
+const zapstoreConfig_1 = require("../core/zapstoreConfig");
 /**
- * `pakstr publish` — upload the signed APK to Blossom and publish NIP-82
- * events (32267/30063/3063) to the configured relay. Spec §5.4 / §8.
+ * `pakstr publish` — publish the NIP-82 application event, upload the signed APK
+ * to Blossom, then publish the APK-dependent events. Spec §5.4 / §8.
  *
  * Requires that `pakstr build` + `pakstr sign` have already run (the signed
  * APK at build.out, plus its `.signer-sha256` sidecar).
@@ -34,28 +35,21 @@ async function publishCommand(configPath, options = {}) {
     let blossomUrl;
     let apkSha256;
     let apkSize;
-    let signerCertificateSha256;
-    let filename;
+    let signerCertificateSha256 = "";
+    let filename = "";
     let identityProof;
-    if (options.dryRun) {
-        // No network, no APK required. Synthesize a stub descriptor so the events
-        // can still be built and printed for preview.
-        apkSha256 = "0".repeat(64);
-        apkSize = 0;
-        blossomUrl = `${config.publish.blossom.replace(/\/$/, "")}/${apkSha256}`;
-        signerCertificateSha256 = "0".repeat(64);
-        filename = path_1.default.basename(apkPath);
-        // Stub identity proof so the 30509 event path is exercised end-to-end.
-        identityProof = {
-            certHash: signerCertificateSha256,
-            signature: "dry-run-stub==",
-            createdAt: Math.floor(Date.now() / 1000),
-            expiry: Math.floor(Date.now() / 1000) + 365 * 24 * 3600,
-            pubkeyHex: await (0, nostr_1.getNpubHex)(publishNsec.bytes),
-        };
-        console.log("📦 (dry-run) Blossom URL:", blossomUrl);
-    }
-    else {
+    const transport = options.transport ?? (options.dryRun ? new zapStore_1.MockRelayTransport() : new zapStore_1.WebsocketRelayTransport());
+    const repository = (0, zapstoreConfig_1.loadZapstoreRepository)(config.configDir);
+    const app = {
+        appId: config.app.appId,
+        appName: config.app.appName,
+        versionName: config.app.versionName,
+        versionCode: config.app.versionCode,
+        description: config.app.description,
+        repository,
+    };
+    const target = { relayUrl: config.publish.relay };
+    if (!options.dryRun) {
         if (!fs_1.default.existsSync(apkPath) || !fs_1.default.lstatSync(apkPath).isFile()) {
             throw new Error(`Signed APK not found at ${apkPath}. Run \`pakstr build\` and \`pakstr sign\` first.`);
         }
@@ -64,6 +58,7 @@ async function publishCommand(configPath, options = {}) {
             throw new Error(`Signer certificate sidecar not found: ${certShaPath}. Run \`pakstr sign\` first.`);
         }
         signerCertificateSha256 = fs_1.default.readFileSync(certShaPath, "utf8").trim();
+        filename = path_1.default.basename(apkPath);
         // Read the NIP-C1 identity proof sidecar (optional; generated by
         // `pakstr sign` when a publish nsec is available).
         const proofPath = `${apkPath}.identity-proof`;
@@ -81,8 +76,32 @@ async function publishCommand(configPath, options = {}) {
             // No sidecar found — warn so users can spot a missing 30509 proof
             // in CI output (the sign step may have run without a publish nsec).
             console.log("⚠️  No .identity-proof sidecar found — the kind 30509 identity proof will not be published.");
-            console.log("    Re-run \`pakstr sign\` with a publish nsec available to generate it.");
+            console.log("    Re-run `pakstr sign` with a publish nsec available to generate it.");
         }
+    }
+    // Publish the application event first so Zapstore can verify the repository
+    // and authorize a first-time publisher before the Blossom upload.
+    const appPublish = await (0, zapStore_1.buildAppMetadataEvent)({ app, publishNsec, target });
+    await transport.publish(appPublish.appMetadata, config.publish.relay);
+    if (options.dryRun) {
+        // No network, no APK required. Synthesize a stub descriptor so the events
+        // can still be built and printed for preview.
+        apkSha256 = "0".repeat(64);
+        apkSize = 0;
+        blossomUrl = `${config.publish.blossom.replace(/\/$/, "")}/${apkSha256}`;
+        signerCertificateSha256 = "0".repeat(64);
+        filename = path_1.default.basename(apkPath);
+        // Stub identity proof so the 30509 event path is exercised end-to-end.
+        identityProof = {
+            certHash: signerCertificateSha256,
+            signature: "dry-run-stub==",
+            createdAt: Math.floor(Date.now() / 1000),
+            expiry: Math.floor(Date.now() / 1000) + 365 * 24 * 3600,
+            pubkeyHex: await (0, nostr_1.getNpubHex)(publishNsec.bytes),
+        };
+        console.log("📦 (dry-run) Blossom URL:", blossomUrl);
+    }
+    else {
         const blossom = await (0, blossom_1.uploadToBlossom)({
             serverUrl: config.publish.blossom,
             filePath: apkPath,
@@ -92,20 +111,11 @@ async function publishCommand(configPath, options = {}) {
         blossomUrl = blossom.url;
         apkSha256 = blossom.sha256;
         apkSize = blossom.size;
-        filename = path_1.default.basename(apkPath);
         console.log("📦 Uploaded to Blossom:", blossom.url);
         console.log("   APK SHA-256:", blossom.sha256, "| size:", blossom.size);
     }
-    // Build + publish the NIP-82 events.
-    const transport = options.transport ?? (options.dryRun ? new zapStore_1.MockRelayTransport() : new zapStore_1.WebsocketRelayTransport());
-    const result = await (0, zapStore_1.publishToZapStore)({
-        app: {
-            appId: config.app.appId,
-            appName: config.app.appName,
-            versionName: config.app.versionName,
-            versionCode: config.app.versionCode,
-            description: config.app.description,
-        },
+    const releasePublish = await (0, zapStore_1.buildReleaseEvents)({
+        app,
         apk: {
             apkSha256,
             apkSize,
@@ -114,9 +124,29 @@ async function publishCommand(configPath, options = {}) {
             filename,
         },
         publishNsec,
-        target: { relayUrl: config.publish.relay },
+        target,
         identityProof,
-    }, transport);
+    });
+    await transport.publish(releasePublish.asset, config.publish.relay);
+    await transport.publish(releasePublish.release, config.publish.relay);
+    if (releasePublish.identityProof) {
+        await transport.publish(releasePublish.identityProof, config.publish.relay);
+    }
+    const result = {
+        npub: appPublish.npub,
+        pubkeyHex: appPublish.pubkeyHex,
+        appMetadataEventId: appPublish.appMetadata.id,
+        releaseEventId: releasePublish.release.id,
+        assetEventId: releasePublish.asset.id,
+        identityProofEventId: releasePublish.identityProof?.id,
+        events: {
+            appMetadata: appPublish.appMetadata,
+            release: releasePublish.release,
+            asset: releasePublish.asset,
+            identityProof: releasePublish.identityProof,
+        },
+        relayUrl: config.publish.relay,
+    };
     console.log(options.dryRun ? "✅ PUBLISHED (dry-run — no network)" : "✅ PUBLISHED");
     console.log("🪪 Publisher npub:", result.npub);
     console.log("🧾 Asset event:", result.assetEventId);

package/dist/core/blossom.js

@@ -83,6 +83,7 @@ async function uploadToBlossom(opts) {
         headers: {
             Authorization: authHeader,
             "Content-Type": contentType,
+            "Content-Digest": sha256,
             "X-SHA-256": sha256,
             "Content-Length": String(size),
         },

package/dist/core/zapStore.js

@@ -2,6 +2,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MockRelayTransport = exports.WebsocketRelayTransport = exports.IDENTITY_PROOF_MESSAGE = exports.KIND_IDENTITY_PROOF = exports.KIND_ASSET = exports.KIND_RELEASE = exports.KIND_APP_METADATA = exports.DEFAULT_COMMUNITY = void 0;
 exports.formatIdentityProofMessage = formatIdentityProofMessage;
+exports.buildAppMetadataEvent = buildAppMetadataEvent;
+exports.buildReleaseEvents = buildReleaseEvents;
 exports.buildSignedPublishEvents = buildSignedPublishEvents;
 exports.publishToZapStore = publishToZapStore;
 exports.resolvePublishSecret = resolvePublishSecret;
@@ -36,25 +38,31 @@ function formatIdentityProofMessage(createdAt, expiry, pubkeyHex) {
 const PLATFORM = "android-arm64-v8a";
 const MIN_SDK = 28;
 const TARGET_SDK = 36;
-/** Build the NIP-82 events (unsigned → signed) for an app release.
- * Includes a NIP-C1 identity proof (kind 30509) if `identityProof` is set. */
-async function buildSignedPublishEvents(input) {
+/** Build the kind-32267 application event independently of the APK upload. */
+async function buildAppMetadataEvent(input) {
     const pubkeyHex = await (0, nostr_1.getNpubHex)(input.publishNsec.bytes);
     const npub = (0, nostr_1.pubkeyHexToNpub)(pubkeyHex);
-    const now = Math.floor(Date.now() / 1000);
     const communities = input.communities?.length ? input.communities : [exports.DEFAULT_COMMUNITY];
-    // kind 32267 — Software Application (app metadata)
+    const repositoryTags = input.app.repository ? [["repository", input.app.repository]] : [];
     const appMetadata = await (0, nostr_1.signNostrEvent)({
         kind: exports.KIND_APP_METADATA,
-        created_at: now,
+        created_at: Math.floor(Date.now() / 1000),
         tags: [
             ["d", input.app.appId],
             ["name", input.app.appName],
             ["f", PLATFORM],
             ...communities.map(c => ["h", c]),
+            ...repositoryTags,
         ],
         content: input.app.description ?? "",
     }, input.publishNsec.bytes);
+    return { npub, pubkeyHex, appMetadata };
+}
+/** Build the APK-dependent NIP-82 events after the Blossom upload. */
+async function buildReleaseEvents(input) {
+    const pubkeyHex = await (0, nostr_1.getNpubHex)(input.publishNsec.bytes);
+    const npub = (0, nostr_1.pubkeyHexToNpub)(pubkeyHex);
+    const now = Math.floor(Date.now() / 1000);
     // kind 3063 — Software Asset (the APK)
     const asset = await (0, nostr_1.signNostrEvent)({
         kind: exports.KIND_ASSET,
@@ -112,7 +120,21 @@ async function buildSignedPublishEvents(input) {
             content: formatIdentityProofMessage(input.identityProof.createdAt, input.identityProof.expiry, input.identityProof.pubkeyHex),
         }, input.publishNsec.bytes);
     }
-    return { npub, pubkeyHex, appMetadata, release, asset, identityProof: identityProofEvent ?? undefined };
+    return { npub, pubkeyHex, release, asset, identityProof: identityProofEvent ?? undefined };
+}
+/** Build the NIP-82 events (unsigned → signed) for an app release.
+ * Includes a NIP-C1 identity proof (kind 30509) if `identityProof` is set. */
+async function buildSignedPublishEvents(input) {
+    const app = await buildAppMetadataEvent(input);
+    const release = await buildReleaseEvents(input);
+    return {
+        npub: app.npub,
+        pubkeyHex: app.pubkeyHex,
+        appMetadata: app.appMetadata,
+        release: release.release,
+        asset: release.asset,
+        identityProof: release.identityProof,
+    };
 }
 /** Publish all three events to the relay via the given transport. */
 async function publishToZapStore(input, transport) {

package/dist/core/zapstoreConfig.js

@@ -0,0 +1,22 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ZAPSTORE_CONFIG_FILENAME = void 0;
+exports.loadZapstoreRepository = loadZapstoreRepository;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const js_yaml_1 = __importDefault(require("js-yaml"));
+exports.ZAPSTORE_CONFIG_FILENAME = "zapstore.yaml";
+/** Read the repository URL from the zapstore.yaml beside pakstr.yaml. */
+function loadZapstoreRepository(configDir) {
+    const configPath = path_1.default.join(configDir, exports.ZAPSTORE_CONFIG_FILENAME);
+    if (!fs_1.default.existsSync(configPath))
+        return undefined;
+    const parsed = js_yaml_1.default.load(fs_1.default.readFileSync(configPath, "utf8"));
+    const repository = parsed?.repository;
+    if (typeof repository !== "string" || repository.trim().length === 0)
+        return undefined;
+    return repository.trim();
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pakstr",
-  "version": "0.13.1",
+  "version": "0.13.3",
   "description": "CLI for packaging Nostr web apps into Android APKs",
   "type": "commonjs",
   "main": "dist/index.js",