pakstr 0.13.3 → 0.15.0

package/dist/commands/publish.js

@@ -26,10 +26,19 @@ const zapstoreConfig_1 = require("../core/zapstoreConfig");
 async function publishCommand(configPath, options = {}) {
     const config = (0, pakstrConfig_1.loadPakstrConfig)(configPath);
     const apkPath = path_1.default.resolve(config.build.out);
+    const zapstoreConfig = options.dryRun
+        ? undefined
+        : (0, zapstoreConfig_1.loadZapstorePublisherConfig)(config.configDir);
     const publishNsec = (0, zapStore_1.resolvePublishSecret)(config.publish.publishKey, process.env);
+    const pubkeyHex = await (0, nostr_1.getNpubHex)(publishNsec.bytes);
+    const npub = (0, nostr_1.pubkeyHexToNpub)(pubkeyHex);
+    if (zapstoreConfig && zapstoreConfig.pubkeyHex !== pubkeyHex) {
+        throw new Error(`Publisher npub mismatch: ${zapstoreConfig_1.ZAPSTORE_CONFIG_FILENAME} configures ${zapstoreConfig.pubkey}, but the active Pakstr signer is ${npub}`);
+    }
     console.log("\n📤 pakstr publish" + (options.dryRun ? " (dry-run)" : ""));
     console.log("App:", config.app.appName, `(${config.app.appId})`);
     console.log("Publishing as:", publishNsec.envVar);
+    console.log("Publisher npub:", npub);
     console.log("Relay:", config.publish.relay);
     console.log("Blossom:", config.publish.blossom);
     let blossomUrl;
@@ -39,13 +48,18 @@ async function publishCommand(configPath, options = {}) {
     let filename = "";
     let identityProof;
     const transport = options.transport ?? (options.dryRun ? new zapStore_1.MockRelayTransport() : new zapStore_1.WebsocketRelayTransport());
-    const repository = (0, zapstoreConfig_1.loadZapstoreRepository)(config.configDir);
+    const repository = zapstoreConfig?.repository ?? (0, zapstoreConfig_1.loadZapstoreRepository)(config.configDir);
     const app = {
         appId: config.app.appId,
-        appName: config.app.appName,
+        appName: zapstoreConfig?.name ?? config.app.appName,
         versionName: config.app.versionName,
         versionCode: config.app.versionCode,
-        description: config.app.description,
+        description: zapstoreConfig?.description ?? config.app.description,
+        summary: zapstoreConfig?.summary,
+        tags: zapstoreConfig?.tags,
+        license: zapstoreConfig?.license,
+        website: zapstoreConfig?.website,
+        releaseNotes: zapstoreConfig?.releaseNotes,
         repository,
     };
     const target = { relayUrl: config.publish.relay };
@@ -79,10 +93,25 @@ async function publishCommand(configPath, options = {}) {
             console.log("    Re-run `pakstr sign` with a publish nsec available to generate it.");
         }
     }
-    // Publish the application event first so Zapstore can verify the repository
-    // and authorize a first-time publisher before the Blossom upload.
+    // Publish the application event first when Zapstore does not already have
+    // the current metadata, preserving first-publish repository authorization.
     const appPublish = await (0, zapStore_1.buildAppMetadataEvent)({ app, publishNsec, target });
-    await transport.publish(appPublish.appMetadata, config.publish.relay);
+    const existingAppMetadata = options.dryRun
+        ? undefined
+        : await (0, zapStore_1.findAppMetadataEvent)(transport, {
+            appId: app.appId,
+            pubkeyHex,
+            relayUrl: config.publish.relay,
+        });
+    const appMetadata = existingAppMetadata && (0, zapStore_1.isCurrentAppMetadataEvent)(existingAppMetadata, appPublish.appMetadata)
+        ? existingAppMetadata
+        : appPublish.appMetadata;
+    if (appMetadata === appPublish.appMetadata) {
+        await transport.publish(appMetadata, config.publish.relay);
+    }
+    else {
+        console.log("📱 Existing Zapstore application metadata is current; skipping kind 32267 publish.");
+    }
     if (options.dryRun) {
         // No network, no APK required. Synthesize a stub descriptor so the events
         // can still be built and printed for preview.
@@ -97,7 +126,7 @@ async function publishCommand(configPath, options = {}) {
             signature: "dry-run-stub==",
             createdAt: Math.floor(Date.now() / 1000),
             expiry: Math.floor(Date.now() / 1000) + 365 * 24 * 3600,
-            pubkeyHex: await (0, nostr_1.getNpubHex)(publishNsec.bytes),
+            pubkeyHex,
         };
         console.log("📦 (dry-run) Blossom URL:", blossomUrl);
     }
@@ -133,14 +162,14 @@ async function publishCommand(configPath, options = {}) {
         await transport.publish(releasePublish.identityProof, config.publish.relay);
     }
     const result = {
-        npub: appPublish.npub,
-        pubkeyHex: appPublish.pubkeyHex,
-        appMetadataEventId: appPublish.appMetadata.id,
+        npub,
+        pubkeyHex,
+        appMetadataEventId: appMetadata.id,
         releaseEventId: releasePublish.release.id,
         assetEventId: releasePublish.asset.id,
         identityProofEventId: releasePublish.identityProof?.id,
         events: {
-            appMetadata: appPublish.appMetadata,
+            appMetadata,
             release: releasePublish.release,
             asset: releasePublish.asset,
             identityProof: releasePublish.identityProof,

package/dist/core/nostr.js

@@ -3,7 +3,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.NsecError = exports.NPUB_HRP = exports.NSEC_HRP = exports.PAKSTR_PUBLISH_NSEC_ENV = exports.PAKSTR_NSEC_ENV = void 0;
 exports.decodeNsec = decodeNsec;
 exports.encodeNsec = encodeNsec;
+exports.decodeNpub = decodeNpub;
 exports.encodeNpub = encodeNpub;
+exports.npubToPubkeyHex = npubToPubkeyHex;
 exports.requireSigningNsec = requireSigningNsec;
 exports.resolvePublishNsec = resolvePublishNsec;
 exports.isPublishNsecPresent = isPublishNsecPresent;
@@ -23,6 +25,7 @@ exports.PAKSTR_PUBLISH_NSEC_ENV = "PAKSTR_PUBLISH_NSEC";
 exports.NSEC_HRP = "nsec";
 exports.NPUB_HRP = "npub";
 const NSEC_PAYLOAD_BYTES = 32;
+const NPUB_PAYLOAD_BYTES = 32;
 class NsecError extends Error {
     envVar;
     constructor(message, envVar) {
@@ -77,10 +80,37 @@ function encodeNsec(bytes) {
     }
     return base_1.bech32.encodeFromBytes(exports.NSEC_HRP, bytes);
 }
+/** Decode a Bech32 `npub1…` string into 32 raw public-key bytes. */
+function decodeNpub(value) {
+    if (typeof value !== "string" || value.length === 0) {
+        throw new NsecError("npub is missing or empty");
+    }
+    if (value !== value.toLowerCase()) {
+        throw new NsecError("npub must be lowercase bech32");
+    }
+    let decoded;
+    try {
+        decoded = base_1.bech32.decodeToBytes(value);
+    }
+    catch {
+        throw new NsecError("npub is not valid bech32");
+    }
+    if (decoded.prefix !== exports.NPUB_HRP) {
+        throw new NsecError(`npub must use the "${exports.NPUB_HRP}" human-readable part`);
+    }
+    if (decoded.bytes.length !== NPUB_PAYLOAD_BYTES) {
+        throw new NsecError("npub payload must be exactly 32 bytes");
+    }
+    return decoded.bytes;
+}
 /** Encode 32 raw pubkey bytes as `npub1…`. */
 function encodeNpub(pubkey) {
     return base_1.bech32.encodeFromBytes(exports.NPUB_HRP, pubkey);
 }
+/** Convert a bech32 npub to a lowercase hex public key. */
+function npubToPubkeyHex(npub) {
+    return Buffer.from(decodeNpub(npub)).toString("hex");
+}
 /**
  * Read and decode the signing nsec from `PAKSTR_NSEC`. Fails fast with a
  * clear message if unset/empty/malformed. Never echoes the nsec value.

package/dist/core/zapStore.js

@@ -2,12 +2,15 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MockRelayTransport = exports.WebsocketRelayTransport = exports.IDENTITY_PROOF_MESSAGE = exports.KIND_IDENTITY_PROOF = exports.KIND_ASSET = exports.KIND_RELEASE = exports.KIND_APP_METADATA = exports.DEFAULT_COMMUNITY = void 0;
 exports.formatIdentityProofMessage = formatIdentityProofMessage;
+exports.findAppMetadataEvent = findAppMetadataEvent;
+exports.isCurrentAppMetadataEvent = isCurrentAppMetadataEvent;
 exports.buildAppMetadataEvent = buildAppMetadataEvent;
 exports.buildReleaseEvents = buildReleaseEvents;
 exports.buildSignedPublishEvents = buildSignedPublishEvents;
 exports.publishToZapStore = publishToZapStore;
 exports.resolvePublishSecret = resolvePublishSecret;
 exports.publishEventToRelay = publishEventToRelay;
+exports.queryRelayForFilter = queryRelayForFilter;
 exports.verifyPublish = verifyPublish;
 exports.queryRelayForEvent = queryRelayForEvent;
 const nostr_1 = require("./nostr");
@@ -38,11 +41,45 @@ function formatIdentityProofMessage(createdAt, expiry, pubkeyHex) {
 const PLATFORM = "android-arm64-v8a";
 const MIN_SDK = 28;
 const TARGET_SDK = 36;
+/** Query for this publisher's replaceable application event. */
+async function findAppMetadataEvent(transport, input) {
+    if (!transport.query)
+        return undefined;
+    const event = await transport.query({
+        kinds: [exports.KIND_APP_METADATA],
+        authors: [input.pubkeyHex],
+        "#d": [input.appId],
+        limit: 1,
+    }, input.relayUrl);
+    if (!event)
+        return undefined;
+    const dTag = event.tags.find(tag => tag[0] === "d");
+    if (event.kind !== exports.KIND_APP_METADATA
+        || event.pubkey !== input.pubkeyHex
+        || dTag?.[1] !== input.appId) {
+        return undefined;
+    }
+    return event;
+}
+/** Whether an existing replaceable application event contains the current metadata. */
+function isCurrentAppMetadataEvent(existing, expected) {
+    if (existing.kind !== expected.kind
+        || existing.pubkey !== expected.pubkey
+        || existing.content !== expected.content) {
+        return false;
+    }
+    return expected.tags.every(expectedTag => existing.tags.some(existingTag => existingTag.length === expectedTag.length
+        && existingTag.every((value, index) => value === expectedTag[index])));
+}
 /** Build the kind-32267 application event independently of the APK upload. */
 async function buildAppMetadataEvent(input) {
     const pubkeyHex = await (0, nostr_1.getNpubHex)(input.publishNsec.bytes);
     const npub = (0, nostr_1.pubkeyHexToNpub)(pubkeyHex);
     const communities = input.communities?.length ? input.communities : [exports.DEFAULT_COMMUNITY];
+    const summaryTags = input.app.summary !== undefined ? [["summary", input.app.summary]] : [];
+    const topicTags = (input.app.tags ?? []).map(tag => ["t", tag]);
+    const licenseTags = input.app.license !== undefined ? [["license", input.app.license]] : [];
+    const websiteTags = input.app.website !== undefined ? [["url", input.app.website]] : [];
     const repositoryTags = input.app.repository ? [["repository", input.app.repository]] : [];
     const appMetadata = await (0, nostr_1.signNostrEvent)({
         kind: exports.KIND_APP_METADATA,
@@ -50,8 +87,12 @@ async function buildAppMetadataEvent(input) {
         tags: [
             ["d", input.app.appId],
             ["name", input.app.appName],
+            ...summaryTags,
             ["f", PLATFORM],
             ...communities.map(c => ["h", c]),
+            ...topicTags,
+            ...licenseTags,
+            ...websiteTags,
             ...repositoryTags,
         ],
         content: input.app.description ?? "",
@@ -95,7 +136,7 @@ async function buildReleaseEvents(input) {
             ["f", PLATFORM],
             ["e", asset.id, input.target.relayUrl],
         ],
-        content: "",
+        content: input.app.releaseNotes ?? "",
     }, input.publishNsec.bytes);
     // kind 30509 — NIP-C1 Identity Proof (optional, links the APK signing
     // certificate to the publisher Nostr identity). The signature is produced
@@ -171,6 +212,9 @@ class WebsocketRelayTransport {
     constructor(webSocketCtor) {
         this.WebSocketCtor = (webSocketCtor ?? WebSocket);
     }
+    async query(filter, relayUrl) {
+        return await queryRelayForFilter(this.WebSocketCtor, relayUrl, filter);
+    }
     async publish(event, relayUrl) {
         await publishEventToRelay(this.WebSocketCtor, event, relayUrl);
     }
@@ -179,6 +223,9 @@ exports.WebsocketRelayTransport = WebsocketRelayTransport;
 /** A no-op transport for tests / dry-runs (no network). */
 class MockRelayTransport {
     published = [];
+    async query(_filter, _relayUrl) {
+        return undefined;
+    }
     async publish(event, _relayUrl) {
         this.published.push(event);
     }
@@ -232,6 +279,59 @@ function publishEventToRelay(WebSocketCtor, event, relayUrl, timeoutMs = 30000)
         };
     });
 }
+/** Query a relay for the first event matching a Nostr filter. */
+function queryRelayForFilter(WebSocketCtor, relayUrl, filter, timeoutMs = 30000) {
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        const subscriptionId = `pakstr-app-${Date.now().toString(36)}`;
+        const ws = new WebSocketCtor(relayUrl);
+        const finish = (event, error) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            try {
+                ws.send(JSON.stringify(["CLOSE", subscriptionId]));
+            }
+            catch { /* ignore */ }
+            try {
+                ws.close();
+            }
+            catch { /* ignore */ }
+            if (error)
+                reject(error);
+            else
+                resolve(event);
+        };
+        const timer = setTimeout(() => {
+            finish(undefined, new Error(`Relay query timed out: ${relayUrl}`));
+        }, timeoutMs);
+        ws.onopen = () => {
+            ws.send(JSON.stringify(["REQ", subscriptionId, filter]));
+        };
+        ws.onmessage = (msg) => {
+            let data;
+            try {
+                data = JSON.parse(typeof msg.data === "string" ? msg.data : msg.data.toString());
+            }
+            catch {
+                return;
+            }
+            if (!Array.isArray(data) || data[1] !== subscriptionId)
+                return;
+            if (data[0] === "EVENT" && data[2])
+                finish(data[2]);
+            else if (data[0] === "EOSE")
+                finish(undefined);
+            else if (data[0] === "CLOSED") {
+                finish(undefined, new Error(`Relay closed query: ${relayUrl} ${data[2] ?? "unknown"}`));
+            }
+        };
+        ws.onerror = (error) => {
+            finish(undefined, new Error(`Relay connection error: ${relayUrl} ${error?.message ?? ""}`));
+        };
+    });
+}
 /**
  * Verify a publish by querying the relay for the asset event and confirming
  * the APK is retrievable from Blossom. Returns true if both check out.

package/dist/core/zapstoreConfig.js

@@ -3,12 +3,23 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ZAPSTORE_CONFIG_FILENAME = void 0;
+exports.ZapstoreConfigError = exports.ZAPSTORE_CONFIG_FILENAME = void 0;
 exports.loadZapstoreRepository = loadZapstoreRepository;
+exports.loadZapstorePublisherConfig = loadZapstorePublisherConfig;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const js_yaml_1 = __importDefault(require("js-yaml"));
+const nostr_1 = require("./nostr");
 exports.ZAPSTORE_CONFIG_FILENAME = "zapstore.yaml";
+class ZapstoreConfigError extends Error {
+    configPath;
+    constructor(message, configPath) {
+        super(message);
+        this.configPath = configPath;
+        this.name = "ZapstoreConfigError";
+    }
+}
+exports.ZapstoreConfigError = ZapstoreConfigError;
 /** Read the repository URL from the zapstore.yaml beside pakstr.yaml. */
 function loadZapstoreRepository(configDir) {
     const configPath = path_1.default.join(configDir, exports.ZAPSTORE_CONFIG_FILENAME);
@@ -18,5 +29,117 @@ function loadZapstoreRepository(configDir) {
     const repository = parsed?.repository;
     if (typeof repository !== "string" || repository.trim().length === 0)
         return undefined;
-    return repository.trim();
+    return normalizeRepositoryUrl(repository.trim());
+}
+/** Load and validate the Zapstore publisher configuration used for publication. */
+function loadZapstorePublisherConfig(configDir) {
+    const configPath = path_1.default.join(configDir, exports.ZAPSTORE_CONFIG_FILENAME);
+    if (!fs_1.default.existsSync(configPath)) {
+        throw new ZapstoreConfigError(`Zapstore configuration not found: ${configPath}`, configPath);
+    }
+    let parsed;
+    try {
+        parsed = js_yaml_1.default.load(fs_1.default.readFileSync(configPath, "utf8"), { filename: configPath });
+    }
+    catch (error) {
+        throw new ZapstoreConfigError(`Invalid ${exports.ZAPSTORE_CONFIG_FILENAME}: ${error instanceof Error ? error.message : String(error)}`, configPath);
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new ZapstoreConfigError(`${exports.ZAPSTORE_CONFIG_FILENAME} must contain a YAML mapping`, configPath);
+    }
+    const config = parsed;
+    const rawRepository = requireString(config.repository, "repository", configPath);
+    validateRepositoryUrl(rawRepository, configPath);
+    const repository = normalizeRepositoryUrl(rawRepository);
+    const pubkey = requireString(config.pubkey, "pubkey", configPath);
+    const name = optionalString(config.name, "name", configPath);
+    const summary = optionalString(config.summary, "summary", configPath);
+    const description = optionalString(config.description, "description", configPath, false);
+    const tags = optionalTags(config.tags, configPath);
+    const license = optionalString(config.license, "license", configPath);
+    const website = optionalString(config.website, "website", configPath);
+    const releaseNotesPath = optionalString(config.release_notes, "release_notes", configPath);
+    const releaseNotes = releaseNotesPath === undefined
+        ? undefined
+        : readReleaseNotes(releaseNotesPath, configDir, configPath);
+    let pubkeyHex;
+    try {
+        pubkeyHex = (0, nostr_1.npubToPubkeyHex)(pubkey);
+    }
+    catch (error) {
+        throw new ZapstoreConfigError(`Invalid publisher npub in ${exports.ZAPSTORE_CONFIG_FILENAME}: ${error instanceof Error ? error.message : String(error)}`, configPath);
+    }
+    return {
+        repository,
+        pubkey,
+        pubkeyHex,
+        name,
+        summary,
+        description,
+        tags,
+        license,
+        website,
+        releaseNotes,
+    };
+}
+function requireString(value, field, configPath) {
+    if (typeof value !== "string" || value.trim().length === 0) {
+        throw new ZapstoreConfigError(`${exports.ZAPSTORE_CONFIG_FILENAME} is missing required field: ${field}`, configPath);
+    }
+    return value.trim();
+}
+function optionalString(value, field, configPath, trim = true) {
+    if (value === undefined)
+        return undefined;
+    if (typeof value !== "string") {
+        throw new ZapstoreConfigError(`${exports.ZAPSTORE_CONFIG_FILENAME} field ${field} must be a string`, configPath);
+    }
+    if (value.trim().length === 0 && field === "release_notes") {
+        throw new ZapstoreConfigError(`${exports.ZAPSTORE_CONFIG_FILENAME} field ${field} must not be empty`, configPath);
+    }
+    return trim ? value.trim() : value;
+}
+function optionalTags(value, configPath) {
+    if (value === undefined)
+        return undefined;
+    if (!Array.isArray(value)) {
+        throw new ZapstoreConfigError(`${exports.ZAPSTORE_CONFIG_FILENAME} field tags must be an array of non-empty strings`, configPath);
+    }
+    return value.map(tag => {
+        if (typeof tag !== "string" || tag.trim().length === 0) {
+            throw new ZapstoreConfigError(`${exports.ZAPSTORE_CONFIG_FILENAME} field tags must be an array of non-empty strings`, configPath);
+        }
+        return tag.trim();
+    });
+}
+function readReleaseNotes(releaseNotesPath, configDir, configPath) {
+    const resolved = path_1.default.resolve(configDir, releaseNotesPath);
+    if (!fs_1.default.existsSync(resolved) || !fs_1.default.lstatSync(resolved).isFile()) {
+        throw new ZapstoreConfigError(`${exports.ZAPSTORE_CONFIG_FILENAME} release_notes file not found: ${resolved}`, configPath);
+    }
+    try {
+        return fs_1.default.readFileSync(resolved, "utf8");
+    }
+    catch (error) {
+        throw new ZapstoreConfigError(`Could not read ${exports.ZAPSTORE_CONFIG_FILENAME} release_notes file ${resolved}: ${error instanceof Error ? error.message : String(error)}`, configPath);
+    }
+}
+function normalizeRepositoryUrl(repository) {
+    const queryIndex = repository.indexOf("?");
+    const fragmentIndex = repository.indexOf("#");
+    if (queryIndex !== -1 || fragmentIndex !== -1)
+        return repository;
+    return repository.endsWith(".git") ? repository.slice(0, -4) : repository;
+}
+function validateRepositoryUrl(repository, configPath) {
+    let parsed;
+    try {
+        parsed = new URL(repository);
+    }
+    catch {
+        throw new ZapstoreConfigError(`${exports.ZAPSTORE_CONFIG_FILENAME} repository must be a valid absolute URL`, configPath);
+    }
+    if (!["https:", "http:", "ssh:"].includes(parsed.protocol) || !parsed.hostname) {
+        throw new ZapstoreConfigError(`${exports.ZAPSTORE_CONFIG_FILENAME} repository must use an http, https, or ssh URL with a host`, configPath);
+    }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pakstr",
-  "version": "0.13.3",
+  "version": "0.15.0",
   "description": "CLI for packaging Nostr web apps into Android APKs",
   "type": "commonjs",
   "main": "dist/index.js",