pakstr 0.13.3 → 0.14.0

package/dist/commands/publish.js

@@ -26,7 +26,15 @@ const zapstoreConfig_1 = require("../core/zapstoreConfig");
 async function publishCommand(configPath, options = {}) {
     const config = (0, pakstrConfig_1.loadPakstrConfig)(configPath);
     const apkPath = path_1.default.resolve(config.build.out);
+    const zapstoreConfig = options.dryRun
+        ? undefined
+        : (0, zapstoreConfig_1.loadZapstorePublisherConfig)(config.configDir);
     const publishNsec = (0, zapStore_1.resolvePublishSecret)(config.publish.publishKey, process.env);
+    const pubkeyHex = await (0, nostr_1.getNpubHex)(publishNsec.bytes);
+    const npub = (0, nostr_1.pubkeyHexToNpub)(pubkeyHex);
+    if (zapstoreConfig && zapstoreConfig.pubkeyHex !== pubkeyHex) {
+        throw new Error(`Publisher npub mismatch: ${zapstoreConfig_1.ZAPSTORE_CONFIG_FILENAME} configures ${zapstoreConfig.pubkey}, but the active Pakstr signer is ${npub}`);
+    }
     console.log("\n📤 pakstr publish" + (options.dryRun ? " (dry-run)" : ""));
     console.log("App:", config.app.appName, `(${config.app.appId})`);
     console.log("Publishing as:", publishNsec.envVar);
@@ -39,7 +47,7 @@ async function publishCommand(configPath, options = {}) {
     let filename = "";
     let identityProof;
     const transport = options.transport ?? (options.dryRun ? new zapStore_1.MockRelayTransport() : new zapStore_1.WebsocketRelayTransport());
-    const repository = (0, zapstoreConfig_1.loadZapstoreRepository)(config.configDir);
+    const repository = zapstoreConfig?.repository ?? (0, zapstoreConfig_1.loadZapstoreRepository)(config.configDir);
     const app = {
         appId: config.app.appId,
         appName: config.app.appName,
@@ -79,10 +87,25 @@ async function publishCommand(configPath, options = {}) {
             console.log("    Re-run `pakstr sign` with a publish nsec available to generate it.");
         }
     }
-    // Publish the application event first so Zapstore can verify the repository
-    // and authorize a first-time publisher before the Blossom upload.
+    // Publish the application event first when Zapstore does not already have
+    // the current metadata, preserving first-publish repository authorization.
     const appPublish = await (0, zapStore_1.buildAppMetadataEvent)({ app, publishNsec, target });
-    await transport.publish(appPublish.appMetadata, config.publish.relay);
+    const existingAppMetadata = options.dryRun
+        ? undefined
+        : await (0, zapStore_1.findAppMetadataEvent)(transport, {
+            appId: app.appId,
+            pubkeyHex,
+            relayUrl: config.publish.relay,
+        });
+    const appMetadata = existingAppMetadata && (0, zapStore_1.isCurrentAppMetadataEvent)(existingAppMetadata, appPublish.appMetadata)
+        ? existingAppMetadata
+        : appPublish.appMetadata;
+    if (appMetadata === appPublish.appMetadata) {
+        await transport.publish(appMetadata, config.publish.relay);
+    }
+    else {
+        console.log("📱 Existing Zapstore application metadata is current; skipping kind 32267 publish.");
+    }
     if (options.dryRun) {
         // No network, no APK required. Synthesize a stub descriptor so the events
         // can still be built and printed for preview.
@@ -97,7 +120,7 @@ async function publishCommand(configPath, options = {}) {
             signature: "dry-run-stub==",
             createdAt: Math.floor(Date.now() / 1000),
             expiry: Math.floor(Date.now() / 1000) + 365 * 24 * 3600,
-            pubkeyHex: await (0, nostr_1.getNpubHex)(publishNsec.bytes),
+            pubkeyHex,
         };
         console.log("📦 (dry-run) Blossom URL:", blossomUrl);
     }
@@ -133,14 +156,14 @@ async function publishCommand(configPath, options = {}) {
         await transport.publish(releasePublish.identityProof, config.publish.relay);
     }
     const result = {
-        npub: appPublish.npub,
-        pubkeyHex: appPublish.pubkeyHex,
-        appMetadataEventId: appPublish.appMetadata.id,
+        npub,
+        pubkeyHex,
+        appMetadataEventId: appMetadata.id,
         releaseEventId: releasePublish.release.id,
         assetEventId: releasePublish.asset.id,
         identityProofEventId: releasePublish.identityProof?.id,
         events: {
-            appMetadata: appPublish.appMetadata,
+            appMetadata,
             release: releasePublish.release,
             asset: releasePublish.asset,
             identityProof: releasePublish.identityProof,

package/dist/core/nostr.js

@@ -3,7 +3,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.NsecError = exports.NPUB_HRP = exports.NSEC_HRP = exports.PAKSTR_PUBLISH_NSEC_ENV = exports.PAKSTR_NSEC_ENV = void 0;
 exports.decodeNsec = decodeNsec;
 exports.encodeNsec = encodeNsec;
+exports.decodeNpub = decodeNpub;
 exports.encodeNpub = encodeNpub;
+exports.npubToPubkeyHex = npubToPubkeyHex;
 exports.requireSigningNsec = requireSigningNsec;
 exports.resolvePublishNsec = resolvePublishNsec;
 exports.isPublishNsecPresent = isPublishNsecPresent;
@@ -23,6 +25,7 @@ exports.PAKSTR_PUBLISH_NSEC_ENV = "PAKSTR_PUBLISH_NSEC";
 exports.NSEC_HRP = "nsec";
 exports.NPUB_HRP = "npub";
 const NSEC_PAYLOAD_BYTES = 32;
+const NPUB_PAYLOAD_BYTES = 32;
 class NsecError extends Error {
     envVar;
     constructor(message, envVar) {
@@ -77,10 +80,37 @@ function encodeNsec(bytes) {
     }
     return base_1.bech32.encodeFromBytes(exports.NSEC_HRP, bytes);
 }
+/** Decode a Bech32 `npub1…` string into 32 raw public-key bytes. */
+function decodeNpub(value) {
+    if (typeof value !== "string" || value.length === 0) {
+        throw new NsecError("npub is missing or empty");
+    }
+    if (value !== value.toLowerCase()) {
+        throw new NsecError("npub must be lowercase bech32");
+    }
+    let decoded;
+    try {
+        decoded = base_1.bech32.decodeToBytes(value);
+    }
+    catch {
+        throw new NsecError("npub is not valid bech32");
+    }
+    if (decoded.prefix !== exports.NPUB_HRP) {
+        throw new NsecError(`npub must use the "${exports.NPUB_HRP}" human-readable part`);
+    }
+    if (decoded.bytes.length !== NPUB_PAYLOAD_BYTES) {
+        throw new NsecError("npub payload must be exactly 32 bytes");
+    }
+    return decoded.bytes;
+}
 /** Encode 32 raw pubkey bytes as `npub1…`. */
 function encodeNpub(pubkey) {
     return base_1.bech32.encodeFromBytes(exports.NPUB_HRP, pubkey);
 }
+/** Convert a bech32 npub to a lowercase hex public key. */
+function npubToPubkeyHex(npub) {
+    return Buffer.from(decodeNpub(npub)).toString("hex");
+}
 /**
  * Read and decode the signing nsec from `PAKSTR_NSEC`. Fails fast with a
  * clear message if unset/empty/malformed. Never echoes the nsec value.

package/dist/core/zapStore.js

@@ -2,12 +2,15 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MockRelayTransport = exports.WebsocketRelayTransport = exports.IDENTITY_PROOF_MESSAGE = exports.KIND_IDENTITY_PROOF = exports.KIND_ASSET = exports.KIND_RELEASE = exports.KIND_APP_METADATA = exports.DEFAULT_COMMUNITY = void 0;
 exports.formatIdentityProofMessage = formatIdentityProofMessage;
+exports.findAppMetadataEvent = findAppMetadataEvent;
+exports.isCurrentAppMetadataEvent = isCurrentAppMetadataEvent;
 exports.buildAppMetadataEvent = buildAppMetadataEvent;
 exports.buildReleaseEvents = buildReleaseEvents;
 exports.buildSignedPublishEvents = buildSignedPublishEvents;
 exports.publishToZapStore = publishToZapStore;
 exports.resolvePublishSecret = resolvePublishSecret;
 exports.publishEventToRelay = publishEventToRelay;
+exports.queryRelayForFilter = queryRelayForFilter;
 exports.verifyPublish = verifyPublish;
 exports.queryRelayForEvent = queryRelayForEvent;
 const nostr_1 = require("./nostr");
@@ -38,6 +41,36 @@ function formatIdentityProofMessage(createdAt, expiry, pubkeyHex) {
 const PLATFORM = "android-arm64-v8a";
 const MIN_SDK = 28;
 const TARGET_SDK = 36;
+/** Query for this publisher's replaceable application event. */
+async function findAppMetadataEvent(transport, input) {
+    if (!transport.query)
+        return undefined;
+    const event = await transport.query({
+        kinds: [exports.KIND_APP_METADATA],
+        authors: [input.pubkeyHex],
+        "#d": [input.appId],
+        limit: 1,
+    }, input.relayUrl);
+    if (!event)
+        return undefined;
+    const dTag = event.tags.find(tag => tag[0] === "d");
+    if (event.kind !== exports.KIND_APP_METADATA
+        || event.pubkey !== input.pubkeyHex
+        || dTag?.[1] !== input.appId) {
+        return undefined;
+    }
+    return event;
+}
+/** Whether an existing replaceable application event contains the current metadata. */
+function isCurrentAppMetadataEvent(existing, expected) {
+    if (existing.kind !== expected.kind
+        || existing.pubkey !== expected.pubkey
+        || existing.content !== expected.content) {
+        return false;
+    }
+    return expected.tags.every(expectedTag => existing.tags.some(existingTag => existingTag.length === expectedTag.length
+        && existingTag.every((value, index) => value === expectedTag[index])));
+}
 /** Build the kind-32267 application event independently of the APK upload. */
 async function buildAppMetadataEvent(input) {
     const pubkeyHex = await (0, nostr_1.getNpubHex)(input.publishNsec.bytes);
@@ -171,6 +204,9 @@ class WebsocketRelayTransport {
     constructor(webSocketCtor) {
         this.WebSocketCtor = (webSocketCtor ?? WebSocket);
     }
+    async query(filter, relayUrl) {
+        return await queryRelayForFilter(this.WebSocketCtor, relayUrl, filter);
+    }
     async publish(event, relayUrl) {
         await publishEventToRelay(this.WebSocketCtor, event, relayUrl);
     }
@@ -179,6 +215,9 @@ exports.WebsocketRelayTransport = WebsocketRelayTransport;
 /** A no-op transport for tests / dry-runs (no network). */
 class MockRelayTransport {
     published = [];
+    async query(_filter, _relayUrl) {
+        return undefined;
+    }
     async publish(event, _relayUrl) {
         this.published.push(event);
     }
@@ -232,6 +271,59 @@ function publishEventToRelay(WebSocketCtor, event, relayUrl, timeoutMs = 30000)
         };
     });
 }
+/** Query a relay for the first event matching a Nostr filter. */
+function queryRelayForFilter(WebSocketCtor, relayUrl, filter, timeoutMs = 30000) {
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        const subscriptionId = `pakstr-app-${Date.now().toString(36)}`;
+        const ws = new WebSocketCtor(relayUrl);
+        const finish = (event, error) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            try {
+                ws.send(JSON.stringify(["CLOSE", subscriptionId]));
+            }
+            catch { /* ignore */ }
+            try {
+                ws.close();
+            }
+            catch { /* ignore */ }
+            if (error)
+                reject(error);
+            else
+                resolve(event);
+        };
+        const timer = setTimeout(() => {
+            finish(undefined, new Error(`Relay query timed out: ${relayUrl}`));
+        }, timeoutMs);
+        ws.onopen = () => {
+            ws.send(JSON.stringify(["REQ", subscriptionId, filter]));
+        };
+        ws.onmessage = (msg) => {
+            let data;
+            try {
+                data = JSON.parse(typeof msg.data === "string" ? msg.data : msg.data.toString());
+            }
+            catch {
+                return;
+            }
+            if (!Array.isArray(data) || data[1] !== subscriptionId)
+                return;
+            if (data[0] === "EVENT" && data[2])
+                finish(data[2]);
+            else if (data[0] === "EOSE")
+                finish(undefined);
+            else if (data[0] === "CLOSED") {
+                finish(undefined, new Error(`Relay closed query: ${relayUrl} ${data[2] ?? "unknown"}`));
+            }
+        };
+        ws.onerror = (error) => {
+            finish(undefined, new Error(`Relay connection error: ${relayUrl} ${error?.message ?? ""}`));
+        };
+    });
+}
 /**
  * Verify a publish by querying the relay for the asset event and confirming
  * the APK is retrievable from Blossom. Returns true if both check out.

package/dist/core/zapstoreConfig.js

@@ -3,12 +3,23 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ZAPSTORE_CONFIG_FILENAME = void 0;
+exports.ZapstoreConfigError = exports.ZAPSTORE_CONFIG_FILENAME = void 0;
 exports.loadZapstoreRepository = loadZapstoreRepository;
+exports.loadZapstorePublisherConfig = loadZapstorePublisherConfig;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const js_yaml_1 = __importDefault(require("js-yaml"));
+const nostr_1 = require("./nostr");
 exports.ZAPSTORE_CONFIG_FILENAME = "zapstore.yaml";
+class ZapstoreConfigError extends Error {
+    configPath;
+    constructor(message, configPath) {
+        super(message);
+        this.configPath = configPath;
+        this.name = "ZapstoreConfigError";
+    }
+}
+exports.ZapstoreConfigError = ZapstoreConfigError;
 /** Read the repository URL from the zapstore.yaml beside pakstr.yaml. */
 function loadZapstoreRepository(configDir) {
     const configPath = path_1.default.join(configDir, exports.ZAPSTORE_CONFIG_FILENAME);
@@ -20,3 +31,50 @@ function loadZapstoreRepository(configDir) {
         return undefined;
     return repository.trim();
 }
+/** Load and validate the Zapstore publisher configuration used for publication. */
+function loadZapstorePublisherConfig(configDir) {
+    const configPath = path_1.default.join(configDir, exports.ZAPSTORE_CONFIG_FILENAME);
+    if (!fs_1.default.existsSync(configPath)) {
+        throw new ZapstoreConfigError(`Zapstore configuration not found: ${configPath}`, configPath);
+    }
+    let parsed;
+    try {
+        parsed = js_yaml_1.default.load(fs_1.default.readFileSync(configPath, "utf8"), { filename: configPath });
+    }
+    catch (error) {
+        throw new ZapstoreConfigError(`Invalid ${exports.ZAPSTORE_CONFIG_FILENAME}: ${error instanceof Error ? error.message : String(error)}`, configPath);
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new ZapstoreConfigError(`${exports.ZAPSTORE_CONFIG_FILENAME} must contain a YAML mapping`, configPath);
+    }
+    const config = parsed;
+    const repository = requireString(config.repository, "repository", configPath);
+    validateRepositoryUrl(repository, configPath);
+    const pubkey = requireString(config.pubkey, "pubkey", configPath);
+    let pubkeyHex;
+    try {
+        pubkeyHex = (0, nostr_1.npubToPubkeyHex)(pubkey);
+    }
+    catch (error) {
+        throw new ZapstoreConfigError(`Invalid publisher npub in ${exports.ZAPSTORE_CONFIG_FILENAME}: ${error instanceof Error ? error.message : String(error)}`, configPath);
+    }
+    return { repository, pubkey, pubkeyHex };
+}
+function requireString(value, field, configPath) {
+    if (typeof value !== "string" || value.trim().length === 0) {
+        throw new ZapstoreConfigError(`${exports.ZAPSTORE_CONFIG_FILENAME} is missing required field: ${field}`, configPath);
+    }
+    return value.trim();
+}
+function validateRepositoryUrl(repository, configPath) {
+    let parsed;
+    try {
+        parsed = new URL(repository);
+    }
+    catch {
+        throw new ZapstoreConfigError(`${exports.ZAPSTORE_CONFIG_FILENAME} repository must be a valid absolute URL`, configPath);
+    }
+    if (!["https:", "http:", "ssh:"].includes(parsed.protocol) || !parsed.hostname) {
+        throw new ZapstoreConfigError(`${exports.ZAPSTORE_CONFIG_FILENAME} repository must use an http, https, or ssh URL with a host`, configPath);
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pakstr",
-  "version": "0.13.3",
+  "version": "0.14.0",
   "description": "CLI for packaging Nostr web apps into Android APKs",
   "type": "commonjs",
   "main": "dist/index.js",