pakstr 0.17.0 → 0.18.0

package/dist/commands/init.js

@@ -184,9 +184,29 @@ build:
   builder: docker               # Only "docker" is specified.
 
 publish:
+  upload:
+    provider: blossom
+    server: https://cdn.zapstore.dev
+
   zapstore:
-    enabled: true               # Default true when publish is present.
+    enabled: true               # Set false to upload without Zapstore events.
+    source: upload
+    # source: https://downloads.example.com/my-app.apk  # Or an absolute public APK URL.
+
+  relay: wss://relay.zapstore.dev
   # publishKey: PAKSTR_PUBLISH_NSEC  # OPTIONAL. Omit to reuse ${nostr_1.PAKSTR_NSEC_ENV} for publishing.
+
+  # Gitea Release alternative: replace the active Blossom upload block above
+  # with this block. Keep the token itself in the environment, never this file.
+  # upload:
+  #   provider: gitea-release
+  #   baseUrl: https://git.example.com
+  #   owner: your-org
+  #   repo: your-app
+  #   tokenEnv: PAKSTR_GITEA_TOKEN
+  #   tag: "v{versionName}"
+  #   assetName: "{appId}-{versionName}.apk"
+  #   prerelease: false
 `;
 }
 function escapeYamlScalar(value) {

package/dist/commands/publish.js

@@ -6,224 +6,265 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.publishCommand = publishCommand;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
-const pakstrConfig_1 = require("../core/pakstrConfig");
-const zapStore_1 = require("../core/zapStore");
+const artifactUpload_1 = require("../core/artifactUpload");
 const blossom_1 = require("../core/blossom");
-const nostr_1 = require("../core/nostr");
+const giteaRelease_1 = require("../core/giteaRelease");
 const identityProof_1 = require("../core/identityProof");
+const nostr_1 = require("../core/nostr");
+const pakstrConfig_1 = require("../core/pakstrConfig");
+const zapStore_1 = require("../core/zapStore");
 const zapstoreConfig_1 = require("../core/zapstoreConfig");
-/**
- * `pakstr publish` — publish the NIP-82 application event, upload the signed APK
- * to Blossom, then publish the APK-dependent events. Spec §5.4 / §8.
- *
- * Requires that `pakstr build` + `pakstr sign` have already run (the signed
- * APK at build.out, plus its `.signer-sha256` sidecar).
- *
- * `--dry-run` skips network + disk: it builds the events with a stub blossom
- * descriptor and a mock relay transport, so you can preview exactly what would
- * be published without an APK or network.
- */
+/** `pakstr publish` — optionally upload the signed APK and publish its Zapstore events. */
 async function publishCommand(configPath, options = {}) {
+    if (options.blossomFetch && options.fetchImpl) {
+        throw new Error("Specify only one of blossomFetch or fetchImpl");
+    }
     const config = (0, pakstrConfig_1.loadPakstrConfig)(configPath);
     const apkPath = path_1.default.resolve(config.build.out);
-    const zapstoreConfig = options.dryRun
-        ? undefined
-        : (0, zapstoreConfig_1.loadZapstorePublisherConfig)(config.configDir);
-    const publishNsec = (0, zapStore_1.resolvePublishSecret)(config.publish.publishKey, process.env);
-    const pubkeyHex = await (0, nostr_1.getNpubHex)(publishNsec.bytes);
-    const npub = (0, nostr_1.pubkeyHexToNpub)(pubkeyHex);
-    if (zapstoreConfig && zapstoreConfig.pubkeyHex !== pubkeyHex) {
-        throw new Error(`Publisher npub mismatch: ${zapstoreConfig_1.ZAPSTORE_CONFIG_FILENAME} configures ${zapstoreConfig.pubkey}, but the active Pakstr signer is ${npub}`);
+    const uploadEnabled = config.publish.upload.enabled;
+    const zapstoreEnabled = config.publish.zapstoreEnabled;
+    const fetchImpl = options.fetchImpl ?? options.blossomFetch;
+    if (!uploadEnabled && !zapstoreEnabled) {
+        throw new Error("Nothing to publish: both publish.upload and publish.zapstore are disabled");
     }
     console.log("\n📤 pakstr publish" + (options.dryRun ? " (dry-run)" : ""));
     console.log("App:", config.app.appName, `(${config.app.appId})`);
-    console.log("Publishing as:", publishNsec.envVar);
-    console.log("Publisher npub:", npub);
-    console.log("Relay:", config.publish.relay);
-    console.log("Blossom:", config.publish.blossom);
-    let blossomUrl;
-    let apkSha256;
-    let apkSize;
+    console.log("Upload:", uploadEnabled ? config.publish.upload.provider : "disabled");
+    console.log("Zapstore:", zapstoreEnabled ? `enabled (${config.publish.zapstoreSource})` : "disabled");
+    let artifact;
     let signerCertificateSha256 = "";
-    let filename = "";
     let identityProof;
-    const transport = options.transport ?? (options.dryRun ? new zapStore_1.MockRelayTransport() : new zapStore_1.WebsocketRelayTransport());
-    const repository = zapstoreConfig?.repository ?? (0, zapstoreConfig_1.loadZapstoreRepository)(config.configDir);
-    const app = {
-        appId: config.app.appId,
-        appName: zapstoreConfig?.name ?? config.app.appName,
-        versionName: config.app.versionName,
-        versionCode: config.app.versionCode,
-        description: zapstoreConfig?.description ?? config.app.description,
-        summary: zapstoreConfig?.summary,
-        tags: zapstoreConfig?.tags,
-        license: zapstoreConfig?.license,
-        website: zapstoreConfig?.website,
-        releaseNotes: zapstoreConfig?.releaseNotes,
-        repository,
-    };
-    const target = { relayUrl: config.publish.relay };
-    if (!options.dryRun) {
-        if (!fs_1.default.existsSync(apkPath) || !fs_1.default.lstatSync(apkPath).isFile()) {
-            throw new Error(`Signed APK not found at ${apkPath}. Run \`pakstr build\` and \`pakstr sign\` first.`);
-        }
+    if (options.dryRun) {
+        artifact = {
+            filePath: apkPath,
+            filename: path_1.default.basename(apkPath),
+            contentType: "application/vnd.android.package-archive",
+            sha256: "0".repeat(64),
+            size: 0,
+        };
+        signerCertificateSha256 = "0".repeat(64);
+    }
+    else {
+        artifact = (0, artifactUpload_1.inspectArtifact)(apkPath);
         const certShaPath = `${apkPath}.signer-sha256`;
         if (!fs_1.default.existsSync(certShaPath)) {
             throw new Error(`Signer certificate sidecar not found: ${certShaPath}. Run \`pakstr sign\` first.`);
         }
         signerCertificateSha256 = fs_1.default.readFileSync(certShaPath, "utf8").trim();
-        filename = path_1.default.basename(apkPath);
-        // Read the NIP-C1 identity proof sidecar (optional; generated by
-        // `pakstr sign` when a publish nsec is available).
         const proofPath = `${apkPath}.identity-proof`;
-        if (fs_1.default.existsSync(proofPath)) {
-            let raw;
-            try {
-                raw = fs_1.default.readFileSync(proofPath, "utf8").trim();
-            }
-            catch (e) {
-                throw new Error(`Failed to read identity proof sidecar ${proofPath}: ${e instanceof Error ? e.message : String(e)}`);
-            }
-            identityProof = (0, identityProof_1.parseIdentityProofSidecar)(raw, proofPath, signerCertificateSha256);
+        if (zapstoreEnabled && fs_1.default.existsSync(proofPath)) {
+            identityProof = (0, identityProof_1.parseIdentityProofSidecar)(fs_1.default.readFileSync(proofPath, "utf8").trim(), proofPath, signerCertificateSha256);
         }
-        else {
-            // No sidecar found — warn so users can spot a missing 30509 proof
-            // in CI output (the sign step may have run without a publish nsec).
-            console.log("⚠️  No .identity-proof sidecar found — the kind 30509 identity proof will not be published.");
-            console.log("    Re-run `pakstr sign` with a publish nsec available to generate it.");
+        else if (zapstoreEnabled) {
+            console.log("⚠️  No .identity-proof sidecar found — kind 30509 will not be published.");
         }
     }
-    // Publish the application event first when Zapstore does not already have
-    // the current metadata, preserving first-publish repository authorization.
-    const appPublish = await (0, zapStore_1.buildAppMetadataEvent)({ app, publishNsec, target });
-    const existingAppMetadata = options.dryRun
-        ? undefined
-        : await (0, zapStore_1.findAppMetadataEvent)(transport, {
+    const transport = options.transport ?? (options.dryRun ? new zapStore_1.MockRelayTransport() : new zapStore_1.WebsocketRelayTransport());
+    let zapstoreConfig;
+    let publishNsec;
+    let npub;
+    let pubkeyHex;
+    let appMetadata;
+    let app;
+    if (zapstoreEnabled) {
+        zapstoreConfig = options.dryRun ? undefined : (0, zapstoreConfig_1.loadZapstorePublisherConfig)(config.configDir);
+        publishNsec = (0, zapStore_1.resolvePublishSecret)(config.publish.publishKey, process.env);
+        pubkeyHex = await (0, nostr_1.getNpubHex)(publishNsec.bytes);
+        npub = (0, nostr_1.pubkeyHexToNpub)(pubkeyHex);
+        if (zapstoreConfig && zapstoreConfig.pubkeyHex !== pubkeyHex) {
+            throw new Error(`Publisher npub mismatch: ${zapstoreConfig_1.ZAPSTORE_CONFIG_FILENAME} configures ${zapstoreConfig.pubkey}, but the active Pakstr signer is ${npub}`);
+        }
+        console.log("Publishing as:", publishNsec.envVar);
+        console.log("Publisher npub:", npub);
+        console.log("Relay:", config.publish.relay);
+        app = {
+            appId: config.app.appId,
+            appName: zapstoreConfig?.name ?? config.app.appName,
+            versionName: config.app.versionName,
+            versionCode: config.app.versionCode,
+            description: zapstoreConfig?.description ?? config.app.description,
+            summary: zapstoreConfig?.summary,
+            tags: zapstoreConfig?.tags,
+            license: zapstoreConfig?.license,
+            website: zapstoreConfig?.website,
+            releaseNotes: zapstoreConfig?.releaseNotes,
+            repository: zapstoreConfig?.repository ?? (0, zapstoreConfig_1.loadZapstoreRepository)(config.configDir),
+        };
+        const expected = await (0, zapStore_1.buildAppMetadataEvent)({ app, publishNsec, target: { relayUrl: config.publish.relay } });
+        const existing = options.dryRun ? undefined : await (0, zapStore_1.findAppMetadataEvent)(transport, {
             appId: app.appId,
             pubkeyHex,
             relayUrl: config.publish.relay,
         });
-    console.log(`📋 Existing kind-32267: ${existingAppMetadata?.id ?? "none"}`);
-    const appMetadata = existingAppMetadata && (0, zapStore_1.isCurrentAppMetadataEvent)(existingAppMetadata, appPublish.appMetadata)
-        ? existingAppMetadata
-        : appPublish.appMetadata;
-    if (appMetadata === appPublish.appMetadata) {
-        console.log("📤 Publishing kind-32267...");
-        await transport.publish(appMetadata, config.publish.relay);
-        console.log(`✅ Published kind-32267: ${appMetadata.id}`);
+        console.log(`📋 Existing kind-32267: ${existing?.id ?? "none"}`);
+        appMetadata = existing && (0, zapStore_1.isCurrentAppMetadataEvent)(existing, expected.appMetadata)
+            ? existing
+            : expected.appMetadata;
+        if (appMetadata === expected.appMetadata) {
+            console.log("📤 Publishing kind-32267...");
+            await transport.publish(appMetadata, config.publish.relay);
+            console.log(`✅ Published kind-32267: ${appMetadata.id}`);
+        }
+        else {
+            console.log("✅ kind-32267 already up to date, skipping publish");
+        }
     }
-    else {
-        console.log("✅ kind-32267 already up to date, skipping publish");
+    let artifactUrl;
+    let uploadProvider = null;
+    if (config.publish.zapstoreSource !== "upload") {
+        artifactUrl = config.publish.zapstoreSource;
     }
-    if (options.dryRun) {
-        // No network, no APK required. Synthesize a stub descriptor so the events
-        // can still be built and printed for preview.
-        apkSha256 = "0".repeat(64);
-        apkSize = 0;
-        blossomUrl = `${config.publish.blossom.replace(/\/$/, "")}/${apkSha256}`;
-        signerCertificateSha256 = "0".repeat(64);
-        filename = path_1.default.basename(apkPath);
-        // Stub identity proof so the 30509 event path is exercised end-to-end.
-        identityProof = {
-            certHash: signerCertificateSha256,
-            signature: "dry-run-stub==",
-            createdAt: Math.floor(Date.now() / 1000),
-            expiry: Math.floor(Date.now() / 1000) + 365 * 24 * 3600,
-            pubkeyHex,
-        };
-        console.log("📦 (dry-run) Blossom URL:", blossomUrl);
+    else if (options.dryRun) {
+        uploadProvider = config.publish.upload.provider;
+        artifactUrl = config.publish.upload.provider === "blossom"
+            ? `${config.publish.upload.server.replace(/\/$/, "")}/${artifact.sha256}`
+            : `${config.publish.upload.baseUrl}/dry-run/${encodeURIComponent(artifact.filename)}`;
     }
     else {
-        const blossom = await (0, blossom_1.uploadToBlossom)({
-            serverUrl: config.publish.blossom,
-            filePath: apkPath,
-            secret: publishNsec.bytes,
-            fetchImpl: options.blossomFetch,
-        });
-        blossomUrl = blossom.url;
-        apkSha256 = blossom.sha256;
-        apkSize = blossom.size;
-        console.log("📦 Uploaded to Blossom:", blossom.url);
-        console.log("   APK SHA-256:", blossom.sha256, "| size:", blossom.size);
-    }
-    const releasePublish = await (0, zapStore_1.buildReleaseEvents)({
-        app,
-        apk: {
-            apkSha256,
-            apkSize,
-            blossomUrl,
-            signerCertificateSha256,
-            filename,
-        },
-        publishNsec,
-        target,
-        identityProof,
-    });
-    await transport.publish(releasePublish.asset, config.publish.relay);
-    await transport.publish(releasePublish.release, config.publish.relay);
-    if (releasePublish.identityProof) {
-        await transport.publish(releasePublish.identityProof, config.publish.relay);
-    }
-    const result = {
-        npub,
-        pubkeyHex,
-        appMetadataEventId: appMetadata.id,
-        releaseEventId: releasePublish.release.id,
-        assetEventId: releasePublish.asset.id,
-        identityProofEventId: releasePublish.identityProof?.id,
-        events: {
-            appMetadata,
-            release: releasePublish.release,
-            asset: releasePublish.asset,
-            identityProof: releasePublish.identityProof,
-        },
-        relayUrl: config.publish.relay,
-    };
-    console.log(options.dryRun ? "✅ PUBLISHED (dry-run — no network)" : "✅ PUBLISHED");
-    console.log("🪪 Publisher npub:", result.npub);
-    console.log("🧾 Asset event:", result.assetEventId);
-    console.log("🧾 Release event:", result.releaseEventId);
-    console.log("🧾 App metadata event:", result.appMetadataEventId);
-    if (result.identityProofEventId) {
-        console.log("🧾 Identity proof event:", result.identityProofEventId);
+        if (!uploadEnabled)
+            throw new Error("Zapstore source is upload, but artifact upload is disabled");
+        let uploaded;
+        if (config.publish.upload.provider === "blossom") {
+            const blossomSecret = publishNsec ?? (0, zapStore_1.resolvePublishSecret)(config.publish.publishKey, process.env);
+            const result = await (0, blossom_1.uploadToBlossom)({
+                serverUrl: config.publish.upload.server,
+                artifact,
+                secret: blossomSecret.bytes,
+                fetchImpl,
+            });
+            uploaded = { ...artifact, provider: "blossom", downloadUrl: result.url };
+        }
+        else {
+            const token = process.env[config.publish.upload.tokenEnv];
+            if (!token)
+                throw new Error(`${config.publish.upload.tokenEnv} is required for Gitea Release upload`);
+            uploaded = await new giteaRelease_1.GiteaReleaseUploader({
+                ...config.publish.upload,
+                token,
+                fetchImpl,
+            }).upload(artifact, {
+                appId: config.app.appId,
+                appName: config.app.appName,
+                versionName: config.app.versionName,
+                versionCode: config.app.versionCode,
+                releaseNotes: zapstoreConfig?.releaseNotes,
+            });
+        }
+        uploadProvider = uploaded.provider;
+        artifactUrl = uploaded.downloadUrl;
+        console.log(`📦 Uploaded via ${uploaded.provider}:`, artifactUrl);
     }
-    console.log("🔗 Blossom URL:", blossomUrl);
-    console.log("📡 Relay:", config.publish.relay);
-    if (options.verify && !options.dryRun) {
-        const { eventFound, apkDownloadable } = await (0, zapStore_1.verifyPublish)({
-            app: {
+    // An explicitly enabled uploader still runs when Zapstore uses an external URL or is disabled.
+    if (uploadEnabled && config.publish.zapstoreSource !== "upload" && !options.dryRun) {
+        if (config.publish.upload.provider === "blossom") {
+            const secret = (0, zapStore_1.resolvePublishSecret)(config.publish.publishKey, process.env);
+            const uploaded = await (0, blossom_1.uploadToBlossom)({ serverUrl: config.publish.upload.server, artifact, secret: secret.bytes, fetchImpl });
+            uploadProvider = "blossom";
+            console.log("📦 Uploaded via blossom:", uploaded.url);
+        }
+        else {
+            const token = process.env[config.publish.upload.tokenEnv];
+            if (!token)
+                throw new Error(`${config.publish.upload.tokenEnv} is required for Gitea Release upload`);
+            const uploaded = await new giteaRelease_1.GiteaReleaseUploader({ ...config.publish.upload, token, fetchImpl }).upload(artifact, {
                 appId: config.app.appId,
                 appName: config.app.appName,
                 versionName: config.app.versionName,
                 versionCode: config.app.versionCode,
+                releaseNotes: zapstoreConfig?.releaseNotes,
+            });
+            uploadProvider = uploaded.provider;
+            console.log("📦 Uploaded via gitea-release:", uploaded.downloadUrl);
+        }
+    }
+    let zapstoreResult;
+    if (zapstoreEnabled) {
+        if (!app || !publishNsec || !npub || !pubkeyHex || !appMetadata)
+            throw new Error("Zapstore publish context was not initialized");
+        if (options.dryRun) {
+            identityProof = {
+                certHash: signerCertificateSha256,
+                signature: "dry-run-stub==",
+                createdAt: Math.floor(Date.now() / 1000),
+                expiry: Math.floor(Date.now() / 1000) + 365 * 24 * 3600,
+                pubkeyHex,
+            };
+        }
+        const built = await (0, zapStore_1.buildReleaseEvents)({
+            app,
+            apk: {
+                apkSha256: artifact.sha256,
+                apkSize: artifact.size,
+                downloadUrl: artifactUrl,
+                signerCertificateSha256,
+                filename: artifact.filename,
             },
-            assetEventId: result.assetEventId,
-            relayUrl: config.publish.relay,
-            blossomUrl,
+            publishNsec,
+            target: { relayUrl: config.publish.relay },
+            identityProof,
         });
-        console.log(`🔎 Verify: event on relay=${eventFound}, apk on blossom=${apkDownloadable}`);
-        if (!eventFound || !apkDownloadable) {
-            throw new Error("Publish verification failed");
+        await transport.publish(built.asset, config.publish.relay);
+        await transport.publish(built.release, config.publish.relay);
+        if (built.identityProof)
+            await transport.publish(built.identityProof, config.publish.relay);
+        zapstoreResult = {
+            npub,
+            pubkeyHex,
+            appMetadataEventId: appMetadata.id,
+            releaseEventId: built.release.id,
+            assetEventId: built.asset.id,
+            identityProofEventId: built.identityProof?.id,
+            events: { appMetadata, release: built.release, asset: built.asset, identityProof: built.identityProof },
+            relayUrl: config.publish.relay,
+        };
+    }
+    if (options.verify && !options.dryRun) {
+        if (zapstoreResult) {
+            const verified = await (0, zapStore_1.verifyPublish)({
+                app: app,
+                assetEventId: zapstoreResult.assetEventId,
+                relayUrl: config.publish.relay,
+                downloadUrl: artifactUrl,
+                fetchImpl,
+            });
+            if (!verified.eventFound || !verified.apkDownloadable)
+                throw new Error("Publish verification failed");
+        }
+        else {
+            const response = await (fetchImpl ?? fetch)(artifactUrl, { method: "HEAD" });
+            if (!response.ok)
+                throw new Error(`Artifact verification failed: HTTP ${response.status}`);
         }
     }
+    const result = {
+        artifactUrl,
+        uploadProvider,
+        zapstore: zapstoreResult,
+        ...(zapstoreResult ?? {}),
+    };
+    console.log("🔗 Artifact URL:", artifactUrl);
     if (options.outJson) {
+        const blossomServer = config.publish.upload.provider === "blossom" ? config.publish.upload.server : null;
         const summary = {
             appId: config.app.appId,
             appName: config.app.appName,
             versionName: config.app.versionName,
             versionCode: config.app.versionCode,
-            npub: result.npub,
-            pubkeyHex: result.pubkeyHex,
-            relayUrl: config.publish.relay,
-            blossomServer: config.publish.blossom,
-            blossomUrl,
-            apkSha256,
-            apkSize,
+            npub,
+            pubkeyHex,
+            relayUrl: zapstoreEnabled ? config.publish.relay : null,
+            artifactUrl,
+            source: config.publish.zapstoreSource === "upload" ? "upload" : "url",
+            uploadProvider,
+            blossomServer,
+            blossomUrl: artifactUrl,
+            apkSha256: artifact.sha256,
+            apkSize: artifact.size,
             signerCertificateSha256,
-            assetEventId: result.assetEventId,
-            releaseEventId: result.releaseEventId,
-            appMetadataEventId: result.appMetadataEventId,
-            identityProofEventId: result.identityProofEventId,
+            assetEventId: zapstoreResult?.assetEventId,
+            releaseEventId: zapstoreResult?.releaseEventId,
+            appMetadataEventId: zapstoreResult?.appMetadataEventId,
+            identityProofEventId: zapstoreResult?.identityProofEventId,
             publishedAt: new Date().toISOString(),
             dryRun: !!options.dryRun,
         };

package/dist/commands/run.js

@@ -27,8 +27,8 @@ async function runCommand(configPath, options = {}) {
     const config = (0, pakstrConfig_1.loadPakstrConfig)(configPath);
     // Verify PAKSTR_NSEC present (fail fast before any work).
     (0, nostr_1.requireSigningNsec)(process.env);
-    // Pre-validate the publish nsec if publishing is enabled (§6 step 1).
-    if (config.publish.zapstoreEnabled) {
+    // Pre-validate the Nostr publish nsec when Zapstore or Blossom needs it.
+    if (config.publish.zapstoreEnabled || (config.publish.upload.enabled && config.publish.upload.provider === "blossom")) {
         if (!(0, nostr_1.isPublishNsecPresent)(config.publish.publishKey, process.env)) {
             const envVar = config.publish.publishKey === undefined
                 ? "PAKSTR_NSEC"
@@ -44,11 +44,12 @@ async function runCommand(configPath, options = {}) {
     console.log("Version:", config.app.versionName, `(${config.app.versionCode})`);
     console.log("Web:", config.build.web);
     console.log("Out:", path_1.default.resolve(config.build.out));
-    console.log("Publish:", config.publish.zapstoreEnabled ? "enabled" : "disabled");
+    const publishingEnabled = config.publish.zapstoreEnabled || config.publish.upload.enabled;
+    console.log("Publish:", publishingEnabled ? "enabled" : "disabled");
     if (options.dryRun) {
         // Skip build + sign — no Docker, no APK. Only exercise the publish
         // event-signing path with stub values and a mock relay.
-        if (config.publish.zapstoreEnabled) {
+        if (publishingEnabled) {
             console.log("\n— Dry run: skipping build + sign, publish only —");
             await (0, publish_1.publishCommand)(config.configPath || undefined, {
                 dryRun: true,
@@ -67,8 +68,8 @@ async function runCommand(configPath, options = {}) {
     // Step 4: sign the APK.
     console.log("\n— Step 2/3: sign —");
     await (0, sign_1.signCommand)(config.configPath || undefined);
-    // Step 5: publish to Zap Store (unless disabled).
-    if (config.publish.zapstoreEnabled) {
+    // Step 5: upload and/or publish to Zapstore (unless both are disabled).
+    if (publishingEnabled) {
         console.log("\n— Step 3/3: publish —");
         await (0, publish_1.publishCommand)(config.configPath || undefined, {
             verify: options.verifyPublish,
@@ -76,7 +77,7 @@ async function runCommand(configPath, options = {}) {
         });
     }
     else {
-        console.log("\nPublish disabled (publish.zapstore.enabled: false). Stopping after sign.");
+        console.log("\nArtifact upload and Zapstore publishing are disabled. Stopping after sign.");
     }
     // Step 6: cleanup. The signed APK at build.out is the artifact and is kept.
     // Derived signing material is cleaned up inside the sign runner (tmpfs).

package/dist/core/androidProject.js

@@ -13,6 +13,7 @@ const branding_1 = require("../android/branding");
 const icon_1 = require("../android/icon");
 const permissions_1 = require("../android/permissions");
 const splash_1 = require("../android/splash");
+const iconResolver_1 = require("./iconResolver");
 const DEFAULT_ICON_PATH = path_1.default.resolve(__dirname, "../../assets/logo.png");
 /**
  * Copy built web assets into the Android template and patch identity/branding.
@@ -31,7 +32,13 @@ async function prepareAndroidProject(opts) {
     generateRuntimeConfig(assetsTarget);
     (0, gradle_1.patchGradle)(androidRoot, app);
     (0, branding_1.patchAppName)(androidRoot, app.appName);
-    await (0, icon_1.patchIcon)(androidRoot, app.icon ?? DEFAULT_ICON_PATH, app.backgroundColor ?? "#FFFFFF", configDir);
+    const icon = await (0, iconResolver_1.resolveAppIcon)({
+        configDir,
+        configuredIcon: app.icon,
+        defaultIcon: DEFAULT_ICON_PATH,
+    });
+    console.log(`🖼️ Launcher icon source: ${icon.source} (${icon.path})`);
+    await (0, icon_1.patchIcon)(androidRoot, icon.path, app.backgroundColor ?? "#FFFFFF", configDir);
     if (app.splash?.image) {
         await (0, splash_1.patchSplash)(androidRoot, app.splash.image, app.splash.background ?? "#FFFFFF", configDir);
     }

package/dist/core/artifactUpload.js

@@ -0,0 +1,57 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.APK_CONTENT_TYPE = void 0;
+exports.inspectArtifact = inspectArtifact;
+exports.expandArtifactTemplate = expandArtifactTemplate;
+exports.validateDownloadUrl = validateDownloadUrl;
+const crypto_1 = require("crypto");
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+exports.APK_CONTENT_TYPE = "application/vnd.android.package-archive";
+function inspectArtifact(filePath) {
+    if (!fs_1.default.existsSync(filePath) || !fs_1.default.lstatSync(filePath).isFile()) {
+        throw new Error(`Signed APK not found at ${filePath}. Run \`pakstr build\` and \`pakstr sign\` first.`);
+    }
+    const hash = (0, crypto_1.createHash)("sha256");
+    const fd = fs_1.default.openSync(filePath, "r");
+    try {
+        const buffer = Buffer.alloc(64 * 1024);
+        let bytesRead = 0;
+        while ((bytesRead = fs_1.default.readSync(fd, buffer, 0, buffer.length, null)) !== 0) {
+            hash.update(buffer.subarray(0, bytesRead));
+        }
+    }
+    finally {
+        fs_1.default.closeSync(fd);
+    }
+    return {
+        filePath,
+        filename: path_1.default.basename(filePath),
+        contentType: exports.APK_CONTENT_TYPE,
+        sha256: hash.digest("hex"),
+        size: fs_1.default.statSync(filePath).size,
+    };
+}
+function expandArtifactTemplate(template, artifact, release) {
+    return template
+        .replaceAll("{appId}", release.appId)
+        .replaceAll("{versionName}", release.versionName)
+        .replaceAll("{versionCode}", String(release.versionCode))
+        .replaceAll("{filename}", artifact.filename);
+}
+function validateDownloadUrl(value, provider) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new Error(`${provider} did not return a valid artifact download URL`);
+    }
+    if ((url.protocol !== "https:" && url.protocol !== "http:") || !url.hostname) {
+        throw new Error(`${provider} did not return an HTTP(S) artifact download URL`);
+    }
+    return url.toString();
+}

package/dist/core/blossom.js

@@ -7,8 +7,8 @@ exports.BlossomError = void 0;
 exports.hashFile = hashFile;
 exports.uploadToBlossom = uploadToBlossom;
 exports.npubHexToBech32 = npubHexToBech32;
-const crypto_1 = require("crypto");
 const fs_1 = __importDefault(require("fs"));
+const artifactUpload_1 = require("./artifactUpload");
 const nostr_1 = require("./nostr");
 /**
  * Blossom (BUD-02 / BUD-11) blob upload.
@@ -19,7 +19,7 @@ const nostr_1 = require("./nostr");
  *
  * Reference: https://github.com/hzrd149/blossom (BUD-02 upload, BUD-11 auth).
  */
-const DEFAULT_CONTENT_TYPE = "application/vnd.android.package-archive";
+const DEFAULT_CONTENT_TYPE = artifactUpload_1.APK_CONTENT_TYPE;
 const AUTH_TTL_SECONDS = 5 * 60;
 class BlossomError extends Error {
     status;
@@ -32,26 +32,17 @@ class BlossomError extends Error {
 exports.BlossomError = BlossomError;
 /** Compute the SHA-256 of a file (hex). */
 function hashFile(filePath) {
-    const size = fs_1.default.statSync(filePath).size;
-    const hash = (0, crypto_1.createHash)("sha256");
-    const fd = fs_1.default.openSync(filePath, "r");
-    try {
-        const buf = Buffer.alloc(64 * 1024);
-        let bytes = 0;
-        while ((bytes = fs_1.default.readSync(fd, buf, 0, buf.length, null)) !== 0) {
-            hash.update(buf.subarray(0, bytes));
-        }
-    }
-    finally {
-        fs_1.default.closeSync(fd);
-    }
-    return { sha256: hash.digest("hex"), size };
+    const artifact = (0, artifactUpload_1.inspectArtifact)(filePath);
+    return { sha256: artifact.sha256, size: artifact.size };
 }
 async function uploadToBlossom(opts) {
     const fetchFn = opts.fetchImpl ?? fetch;
-    const contentType = opts.contentType ?? DEFAULT_CONTENT_TYPE;
+    const artifact = opts.artifact ?? (opts.filePath ? (0, artifactUpload_1.inspectArtifact)(opts.filePath) : undefined);
+    if (!artifact)
+        throw new BlossomError("Blossom upload requires a local artifact");
+    const contentType = opts.contentType ?? artifact.contentType ?? DEFAULT_CONTENT_TYPE;
     const serverUrl = opts.serverUrl.replace(/\/$/, "");
-    const { sha256, size } = hashFile(opts.filePath);
+    const { sha256, size } = artifact;
     // 1. HEAD /<sha256> — skip upload if the blob already exists.
     const head = await fetchFn(`${serverUrl}/${sha256}`, { method: "HEAD" });
     if (head.status === 200) {
@@ -77,7 +68,7 @@ async function uploadToBlossom(opts) {
     }, opts.secret);
     // 3. PUT /upload with the signed auth event in the Authorization header.
     const authHeader = "Nostr " + Buffer.from(JSON.stringify(authEvent)).toString("base64url");
-    const body = fs_1.default.readFileSync(opts.filePath);
+    const body = fs_1.default.readFileSync(artifact.filePath);
     const res = await fetchFn(`${serverUrl}/upload`, {
         method: "PUT",
         headers: {
@@ -103,12 +94,16 @@ async function uploadToBlossom(opts) {
     const text = await res.text();
     try {
         const descriptor = JSON.parse(text);
+        if (descriptor.sha256 && descriptor.sha256 !== sha256) {
+            throw new BlossomError("Blossom response SHA-256 does not match the uploaded APK");
+        }
+        if (descriptor.size !== undefined && descriptor.size !== size) {
+            throw new BlossomError("Blossom response size does not match the uploaded APK");
+        }
         if (!descriptor.url)
             descriptor.url = `${serverUrl}/${sha256}`;
-        if (!descriptor.sha256)
-            descriptor.sha256 = sha256;
-        if (!descriptor.size)
-            descriptor.size = size;
+        descriptor.sha256 = sha256;
+        descriptor.size = size;
         if (!descriptor.type)
             descriptor.type = contentType;
         return descriptor;

package/dist/core/giteaRelease.js

@@ -0,0 +1,134 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GiteaReleaseUploader = exports.GiteaReleaseError = void 0;
+const fs_1 = __importDefault(require("fs"));
+const artifactUpload_1 = require("./artifactUpload");
+class GiteaReleaseError extends Error {
+    status;
+    constructor(message, status) {
+        super(message);
+        this.status = status;
+        this.name = "GiteaReleaseError";
+    }
+}
+exports.GiteaReleaseError = GiteaReleaseError;
+class GiteaReleaseUploader {
+    options;
+    provider = "gitea-release";
+    constructor(options) {
+        this.options = options;
+    }
+    async upload(artifact, context) {
+        const fetchFn = this.options.fetchImpl ?? fetch;
+        const repositoryUrl = `${this.options.baseUrl}/api/v1/repos/${encodeURIComponent(this.options.owner)}/${encodeURIComponent(this.options.repo)}`;
+        const tag = (0, artifactUpload_1.expandArtifactTemplate)(this.options.tag, artifact, context);
+        const assetName = (0, artifactUpload_1.expandArtifactTemplate)(this.options.assetName, artifact, context);
+        if (!tag || /[\\\x00-\x1f\x7f]/.test(tag) || tag.includes("..")) {
+            throw new GiteaReleaseError("Expanded Gitea release tag is invalid");
+        }
+        if (!assetName || /[\\/\x00-\x1f\x7f]/.test(assetName) || assetName.includes("..")) {
+            throw new GiteaReleaseError("Expanded Gitea asset name must be a single safe filename");
+        }
+        let release = await this.fetchRelease(fetchFn, repositoryUrl, tag);
+        if (!release) {
+            const response = await fetchFn(`${repositoryUrl}/releases`, {
+                method: "POST",
+                headers: this.headers({ "Content-Type": "application/json" }),
+                body: JSON.stringify({
+                    tag_name: tag,
+                    name: `${context.appName} ${context.versionName}`,
+                    body: context.releaseNotes ?? "",
+                    draft: false,
+                    prerelease: this.options.prerelease,
+                }),
+            });
+            if (response.status === 409 || response.status === 422) {
+                release = await this.fetchRelease(fetchFn, repositoryUrl, tag);
+            }
+            else if (response.ok) {
+                release = await this.readRelease(response, "create release");
+            }
+            else {
+                throw await this.httpError(response, "create release");
+            }
+            if (!release)
+                throw new GiteaReleaseError("Gitea release creation raced but the release could not be found");
+        }
+        const assets = release.assets ?? await this.fetchAssets(fetchFn, repositoryUrl, release.id);
+        for (const existing of assets.filter(asset => asset.name === assetName)) {
+            const response = await fetchFn(`${repositoryUrl}/releases/assets/${existing.id}`, {
+                method: "DELETE",
+                headers: this.headers(),
+            });
+            if (!response.ok && response.status !== 404)
+                throw await this.httpError(response, "delete existing asset");
+        }
+        const form = new FormData();
+        form.append("attachment", new Blob([fs_1.default.readFileSync(artifact.filePath)], { type: artifact.contentType }), assetName);
+        const response = await fetchFn(`${repositoryUrl}/releases/${release.id}/assets?name=${encodeURIComponent(assetName)}`, {
+            method: "POST",
+            headers: this.headers(),
+            body: form,
+        });
+        if (!response.ok)
+            throw await this.httpError(response, "upload release asset");
+        const uploaded = await this.readJson(response, "upload release asset");
+        if (!uploaded.id || uploaded.name !== assetName || !uploaded.browser_download_url) {
+            throw new GiteaReleaseError("Gitea upload response is missing the expected asset fields");
+        }
+        return {
+            ...artifact,
+            provider: this.provider,
+            downloadUrl: (0, artifactUpload_1.validateDownloadUrl)(uploaded.browser_download_url, "Gitea"),
+        };
+    }
+    async fetchRelease(fetchFn, repositoryUrl, tag) {
+        const response = await fetchFn(`${repositoryUrl}/releases/tags/${encodeURIComponent(tag)}`, { headers: this.headers() });
+        if (response.status === 404)
+            return undefined;
+        if (!response.ok)
+            throw await this.httpError(response, "find release");
+        return await this.readRelease(response, "find release");
+    }
+    async fetchAssets(fetchFn, repositoryUrl, releaseId) {
+        const response = await fetchFn(`${repositoryUrl}/releases/${releaseId}/assets`, { headers: this.headers() });
+        if (!response.ok)
+            throw await this.httpError(response, "list release assets");
+        const assets = await this.readJson(response, "list release assets");
+        if (!Array.isArray(assets))
+            throw new GiteaReleaseError("Gitea list-assets response is not an array");
+        return assets;
+    }
+    async readRelease(response, operation) {
+        const release = await this.readJson(response, operation);
+        if (!Number.isInteger(release.id) || release.id <= 0) {
+            throw new GiteaReleaseError(`Gitea ${operation} response is missing a release id`);
+        }
+        return release;
+    }
+    async readJson(response, operation) {
+        try {
+            return await response.json();
+        }
+        catch {
+            throw new GiteaReleaseError(`Gitea ${operation} returned invalid JSON`, response.status);
+        }
+    }
+    headers(extra = {}) {
+        return { Authorization: `token ${this.options.token}`, Accept: "application/json", ...extra };
+    }
+    async httpError(response, operation) {
+        let detail = "";
+        try {
+            detail = (await response.text()).slice(0, 200);
+        }
+        catch { /* ignore */ }
+        if (this.options.token)
+            detail = detail.replaceAll(this.options.token, "[REDACTED]");
+        return new GiteaReleaseError(`Gitea ${operation} failed for ${this.options.owner}/${this.options.repo} using ${this.options.tokenEnv}: HTTP ${response.status}${detail ? ` — ${detail}` : ""}`, response.status);
+    }
+}
+exports.GiteaReleaseUploader = GiteaReleaseUploader;

package/dist/core/iconResolver.js

@@ -0,0 +1,74 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveAppIcon = resolveAppIcon;
+const child_process_1 = require("child_process");
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const sharp_1 = __importDefault(require("sharp"));
+const assetPath_1 = require("./assetPath");
+async function resolveAppIcon(input) {
+    const configDir = fs_1.default.realpathSync(input.configDir);
+    const repositoryRoot = findRepositoryRoot(configDir);
+    const candidates = [
+        { path: path_1.default.join(configDir, "logo.png"), source: "app-logo", root: configDir },
+    ];
+    if (repositoryRoot && repositoryRoot !== configDir) {
+        candidates.push({ path: path_1.default.join(repositoryRoot, "logo.png"), source: "repository-logo", root: repositoryRoot });
+    }
+    for (const candidate of candidates) {
+        if (!fs_1.default.existsSync(candidate.path))
+            continue;
+        try {
+            const resolved = fs_1.default.realpathSync(candidate.path);
+            if (!isContained(candidate.root, resolved) || !fs_1.default.statSync(resolved).isFile()) {
+                throw new Error("not a regular file inside the application repository");
+            }
+            const metadata = await (0, sharp_1.default)(resolved).metadata();
+            if (metadata.format !== "png" || !metadata.width || !metadata.height) {
+                throw new Error("not a non-empty PNG image");
+            }
+            return { path: resolved, source: candidate.source };
+        }
+        catch (error) {
+            console.warn(`⚠️  Ignoring unsuitable automatic logo ${candidate.path}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    if (input.configuredIcon !== undefined) {
+        const configured = (0, assetPath_1.resolveAssetPath)(input.configuredIcon, configDir);
+        if (!fs_1.default.existsSync(configured) || !fs_1.default.lstatSync(configured).isFile()) {
+            throw new Error(`❌ Icon not found or not a regular file: ${configured}`);
+        }
+        try {
+            const metadata = await (0, sharp_1.default)(configured).metadata();
+            if (!metadata.width || !metadata.height)
+                throw new Error("image has no dimensions");
+        }
+        catch (error) {
+            throw new Error(`❌ Invalid configured icon ${configured}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        return { path: configured, source: "configured" };
+    }
+    return { path: input.defaultIcon, source: "default" };
+}
+function findRepositoryRoot(configDir) {
+    try {
+        const output = (0, child_process_1.execFileSync)("git", ["-C", configDir, "rev-parse", "--show-toplevel"], {
+            encoding: "utf8",
+            stdio: ["ignore", "pipe", "ignore"],
+        }).trim();
+        if (!output)
+            return undefined;
+        const root = fs_1.default.realpathSync(output);
+        return isContained(root, configDir) ? root : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function isContained(root, candidate) {
+    const relative = path_1.default.relative(root, candidate);
+    return relative === "" || (!relative.startsWith(".." + path_1.default.sep) && relative !== "..");
+}

package/dist/core/pakstrConfig.js

@@ -130,6 +130,9 @@ function resolveAndValidate(config, configPath) {
     if (app.description !== undefined && typeof app.description !== "string") {
         fail(`${where("app.description")} must be a string`, configPath);
     }
+    if (app.icon !== undefined && (typeof app.icon !== "string" || app.icon.trim().length === 0)) {
+        fail(`${where("app.icon")} must be a non-empty string`, configPath);
+    }
     // Optional color fields
     if (app.backgroundColor !== undefined) {
         assertHexColor(app.backgroundColor, "app.backgroundColor", configPath);
@@ -178,20 +181,29 @@ function resolveAndValidate(config, configPath) {
     // publish section
     const publish = config.publish;
     let zapstoreEnabled = true;
+    let zapstoreSource = "upload";
     let publishKey = undefined;
     if (publish !== undefined) {
         if (publish.zapstore !== undefined) {
+            if (typeof publish.zapstore !== "object" || Array.isArray(publish.zapstore)) {
+                fail(`${where("publish.zapstore")} must be a mapping`, configPath);
+            }
             if (publish.zapstore.enabled !== undefined && typeof publish.zapstore.enabled !== "boolean") {
                 fail(`${where("publish.zapstore.enabled")} must be a boolean`, configPath);
             }
             zapstoreEnabled = publish.zapstore.enabled ?? true;
+            if (publish.zapstore.source !== undefined) {
+                requireString(publish.zapstore.source, "publish.zapstore.source", configPath);
+                zapstoreSource = publish.zapstore.source === "upload"
+                    ? "upload"
+                    : validatePublicUrl(publish.zapstore.source, "publish.zapstore.source", configPath);
+            }
         }
         if (publish.publishKey !== undefined) {
             if (publish.publishKey !== null && typeof publish.publishKey !== "string") {
                 fail(`${where("publish.publishKey")} must be a string or empty (bare key)`, configPath);
             }
             if (typeof publish.publishKey === "string" && publish.publishKey.trim().length === 0) {
-                // Treat empty string like a bare key.
                 publishKey = null;
             }
             else {
@@ -200,13 +212,72 @@ function resolveAndValidate(config, configPath) {
         }
     }
     const relay = publish?.relay ?? "wss://relay.zapstore.dev";
-    const blossom = publish?.blossom ?? "https://cdn.zapstore.dev";
+    if (publish?.blossom !== undefined && publish.upload !== undefined) {
+        fail(`${where("publish.blossom")} cannot be combined with publish.upload`, configPath);
+    }
+    const defaultBlossom = publish?.blossom ?? "https://cdn.zapstore.dev";
+    let upload;
+    if (publish?.upload === undefined) {
+        upload = {
+            enabled: publish?.blossom !== undefined || (zapstoreEnabled && zapstoreSource === "upload"),
+            provider: "blossom",
+            server: validatePublicUrl(defaultBlossom, "publish.blossom", configPath),
+        };
+    }
+    else {
+        const rawUpload = publish.upload;
+        if (typeof rawUpload !== "object" || Array.isArray(rawUpload)) {
+            fail(`${where("publish.upload")} must be a mapping`, configPath);
+        }
+        if (rawUpload.enabled !== undefined && typeof rawUpload.enabled !== "boolean") {
+            fail(`${where("publish.upload.enabled")} must be a boolean`, configPath);
+        }
+        if (rawUpload.provider === "blossom") {
+            upload = {
+                enabled: rawUpload.enabled ?? true,
+                provider: "blossom",
+                server: validatePublicUrl(rawUpload.server ?? "https://cdn.zapstore.dev", "publish.upload.server", configPath),
+            };
+        }
+        else if (rawUpload.provider === "gitea-release") {
+            requireString(rawUpload.baseUrl, "publish.upload.baseUrl", configPath);
+            requireSafeSegment(rawUpload.owner, "publish.upload.owner", configPath);
+            requireSafeSegment(rawUpload.repo, "publish.upload.repo", configPath);
+            const tokenEnv = rawUpload.tokenEnv ?? "PAKSTR_GITEA_TOKEN";
+            requireEnvName(tokenEnv, "publish.upload.tokenEnv", configPath);
+            const tag = rawUpload.tag ?? "v{versionName}";
+            const assetName = rawUpload.assetName ?? "{appId}-{versionName}.apk";
+            validateTemplate(tag, "publish.upload.tag", configPath);
+            validateTemplate(assetName, "publish.upload.assetName", configPath);
+            if (rawUpload.prerelease !== undefined && typeof rawUpload.prerelease !== "boolean") {
+                fail(`${where("publish.upload.prerelease")} must be a boolean`, configPath);
+            }
+            upload = {
+                enabled: rawUpload.enabled ?? true,
+                provider: "gitea-release",
+                baseUrl: validatePublicUrl(rawUpload.baseUrl, "publish.upload.baseUrl", configPath).replace(/\/$/, ""),
+                owner: rawUpload.owner,
+                repo: rawUpload.repo,
+                tokenEnv,
+                tag,
+                assetName,
+                prerelease: rawUpload.prerelease ?? false,
+            };
+        }
+        else {
+            fail(`${where("publish.upload.provider")} must be "blossom" or "gitea-release"`, configPath);
+        }
+    }
+    if (zapstoreEnabled && zapstoreSource === "upload" && !upload.enabled) {
+        fail(`${where("publish.zapstore.source")} is "upload" but publish.upload is disabled`, configPath);
+    }
+    const blossom = upload.provider === "blossom" ? upload.server : defaultBlossom;
     return {
         configDir,
         configPath,
         app: resolvedApp,
         build: { web: webAbs, out, builder },
-        publish: { zapstoreEnabled, publishKey, relay, blossom },
+        publish: { zapstoreEnabled, zapstoreSource, upload, publishKey, relay, blossom },
     };
 }
 function requireString(value, field, configPath) {
@@ -224,3 +295,41 @@ function assertHexColor(value, field, configPath) {
         fail(`${field} must be a hex color of the form #RRGGBB`, configPath);
     }
 }
+function validatePublicUrl(value, field, configPath) {
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch {
+        fail(`${field} must be an absolute HTTP(S) URL`, configPath);
+    }
+    if ((parsed.protocol !== "https:" && parsed.protocol !== "http:") || !parsed.hostname) {
+        fail(`${field} must be an absolute HTTP(S) URL`, configPath);
+    }
+    if (parsed.username || parsed.password) {
+        fail(`${field} must not contain credentials`, configPath);
+    }
+    return parsed.toString().replace(/\/$/, value.endsWith("/") ? "/" : "");
+}
+function requireSafeSegment(value, field, configPath) {
+    requireString(value, field, configPath);
+    if (value === "." || value === ".." || /[\\/\x00-\x1f\x7f]/.test(value)) {
+        fail(`${field} must be a single non-empty path segment`, configPath);
+    }
+}
+function requireEnvName(value, field, configPath) {
+    requireString(value, field, configPath);
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(value)) {
+        fail(`${field} must be a valid environment variable name`, configPath);
+    }
+}
+function validateTemplate(value, field, configPath) {
+    requireString(value, field, configPath);
+    const stripped = value.replace(/\{(appId|versionName|versionCode|filename)\}/g, "");
+    if (/[{}]/.test(stripped)) {
+        fail(`${field} contains an unknown or malformed placeholder`, configPath);
+    }
+    if (/[\\\x00-\x1f\x7f]/.test(value) || value.includes("..")) {
+        fail(`${field} must not contain traversal, backslashes, or control characters`, configPath);
+    }
+}

package/dist/core/zapStore.js

@@ -112,7 +112,7 @@ async function buildReleaseEvents(input) {
             ["i", input.app.appId],
             ["x", input.apk.apkSha256],
             ["version", input.app.versionName],
-            ["url", input.apk.blossomUrl],
+            ["url", input.apk.downloadUrl ?? input.apk.blossomUrl ?? ""],
             ["m", "application/vnd.android.package-archive"],
             ["size", String(input.apk.apkSize)],
             ["f", PLATFORM],
@@ -334,13 +334,16 @@ function queryRelayForFilter(WebSocketCtor, relayUrl, filter, timeoutMs = 30000)
 }
 /**
  * Verify a publish by querying the relay for the asset event and confirming
- * the APK is retrievable from Blossom. Returns true if both check out.
+ * the APK is retrievable from its artifact URL. Returns true if both check out.
  */
 async function verifyPublish(input) {
     const WebSocketCtor = input.WebSocketCtor ?? WebSocket;
     const fetchFn = input.fetchImpl ?? fetch;
     const eventFound = await queryRelayForEvent(WebSocketCtor, input.relayUrl, input.assetEventId);
-    const head = await fetchFn(input.blossomUrl, { method: "HEAD" });
+    const artifactUrl = input.downloadUrl ?? input.blossomUrl;
+    if (!artifactUrl)
+        throw new Error("Publish verification requires an artifact URL");
+    const head = await fetchFn(artifactUrl, { method: "HEAD" });
     return { eventFound, apkDownloadable: head.status === 200 };
 }
 /** Open a relay, send a REQ for a single event id, wait for it. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pakstr",
-  "version": "0.17.0",
+  "version": "0.18.0",
   "description": "CLI for packaging Nostr web apps into Android APKs",
   "type": "commonjs",
   "main": "dist/index.js",