pakstr 0.19.2 → 0.20.0

package/android-template/app/src/androidTest/java/com/pakstr/app/Nip98ProxyOriginTest.kt

@@ -0,0 +1,208 @@
+package com.pakstr.app
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+import java.net.URL
+import java.util.Base64
+
+class Nip98ProxyOriginTest {
+
+    private val localUrl = URL("http://127.0.0.1:${Config.PORT}/api/auth/login")
+
+    @Test
+    fun validLocalNip98EventGeneratesForwardingOrigin() {
+        assertEquals(
+            ProxyOrigin("127.0.0.1:${Config.PORT}", "http"),
+            localNip98ProxyOrigin(nip98Header(), "POST", localUrl)
+        )
+    }
+
+    @Test
+    fun bodylessNip98RequestAddsOriginWithoutEntityHeadersOrBody() {
+        val authorization = nip98Header()
+        val headers = prepareProxyRequestHeaders(
+            mapOf(
+                "authorization" to authorization,
+                "content-type" to "",
+                "content-length" to "0",
+                "transfer-encoding" to "chunked"
+            ),
+            "POST",
+            localUrl,
+            "https://api.example.com"
+        )
+        val request = bodylessProxyRequestBytes(
+            "POST",
+            URL("https://api.example.com/api/auth/login"),
+            headers
+        ).toString(Charsets.ISO_8859_1)
+
+        assertTrue(request.contains("authorization: $authorization\r\n"))
+        assertTrue(request.contains("X-Forwarded-Host: 127.0.0.1:${Config.PORT}\r\n"))
+        assertTrue(request.contains("X-Forwarded-Proto: http\r\n"))
+        assertFalse(request.contains("Content-Type", ignoreCase = true))
+        assertFalse(request.contains("Content-Length", ignoreCase = true))
+        assertFalse(request.contains("Transfer-Encoding", ignoreCase = true))
+        assertTrue(request.endsWith("Connection: close\r\n\r\n"))
+    }
+
+    @Test
+    fun bodyBearingNip98RequestAddsOriginAndPreservesBodyHeaders() {
+        val authorization = nip98Header()
+        val headers = prepareProxyRequestHeaders(
+            mapOf(
+                "authorization" to authorization,
+                "content-type" to "application/json",
+                "content-length" to "11"
+            ),
+            "POST",
+            localUrl,
+            "https://api.example.com"
+        )
+        val policy = proxyRequestBodyPolicy(
+            mapOf(
+                "content-type" to "application/json",
+                "content-length" to "11"
+            )
+        )
+
+        assertEquals(authorization, headers["authorization"])
+        assertEquals("application/json", headers["content-type"])
+        assertEquals("127.0.0.1:${Config.PORT}", headers["X-Forwarded-Host"])
+        assertEquals("http", headers["X-Forwarded-Proto"])
+        assertTrue(policy.shouldWriteBody)
+        assertEquals("application/json", policy.contentType)
+    }
+
+    @Test
+    fun noAuthorizationIsUnchanged() {
+        val input = mapOf("accept" to "application/json")
+
+        assertEquals(
+            input,
+            prepareProxyRequestHeaders(input, "GET", localUrl, "https://api.example.com")
+        )
+    }
+
+    @Test
+    fun bearerAuthorizationIsUnchanged() {
+        val input = mapOf("authorization" to "Bearer token")
+
+        assertEquals(
+            input,
+            prepareProxyRequestHeaders(input, "POST", localUrl, "https://api.example.com")
+        )
+    }
+
+    @Test
+    fun malformedNostrAuthorizationFailsClosed() {
+        assertNull(localNip98ProxyOrigin("Nostr not-base64", "POST", localUrl))
+        assertNull(localNip98ProxyOrigin("Nostr e30=", "POST", localUrl))
+    }
+
+    @Test
+    fun wrongKindFailsClosed() {
+        assertNull(localNip98ProxyOrigin(nip98Header(kind = 1), "POST", localUrl))
+    }
+
+    @Test
+    fun wrongMethodFailsClosed() {
+        assertNull(localNip98ProxyOrigin(nip98Header(method = "GET"), "POST", localUrl))
+    }
+
+    @Test
+    fun wrongPathFailsClosed() {
+        assertNull(localNip98ProxyOrigin(
+            nip98Header(url = "http://127.0.0.1:${Config.PORT}/api/other"),
+            "POST",
+            localUrl
+        ))
+    }
+
+    @Test
+    fun wrongQueryFailsClosed() {
+        val requestUrl = URL("http://127.0.0.1:${Config.PORT}/api/auth/login?next=one")
+
+        assertNull(localNip98ProxyOrigin(
+            nip98Header(url = "http://127.0.0.1:${Config.PORT}/api/auth/login?next=two"),
+            "POST",
+            requestUrl
+        ))
+    }
+
+    @Test
+    fun nonLocalHostFailsClosed() {
+        assertNull(localNip98ProxyOrigin(
+            nip98Header(url = "http://localhost:${Config.PORT}/api/auth/login"),
+            "POST",
+            localUrl
+        ))
+    }
+
+    @Test
+    fun upstreamUrlFailsClosed() {
+        assertNull(localNip98ProxyOrigin(
+            nip98Header(url = "https://api.example.com/api/auth/login"),
+            "POST",
+            localUrl
+        ))
+    }
+
+    @Test
+    fun ambiguousOrUnusableTagsFailClosed() {
+        assertNull(localNip98ProxyOrigin(
+            nip98Header(extraTags = ",[\"u\",\"http://127.0.0.1:${Config.PORT}/api/auth/login\"]"),
+            "POST",
+            localUrl
+        ))
+        assertNull(localNip98ProxyOrigin(
+            nip98Header(extraTags = ",[\"method\",\"POST\"]"),
+            "POST",
+            localUrl
+        ))
+        assertNull(localNip98ProxyOrigin(nip98Header(url = ""), "POST", localUrl))
+        assertNull(localNip98ProxyOrigin(nip98Header(method = ""), "POST", localUrl))
+    }
+
+    @Test
+    fun spoofedForwardingHeadersCannotOverrideDerivedValues() {
+        val headers = prepareProxyRequestHeaders(
+            mapOf(
+                "authorization" to nip98Header(),
+                "Forwarded" to "host=attacker.example;proto=https",
+                "X-Forwarded-Host" to "attacker.example",
+                "X-Forwarded-Proto" to "https"
+            ),
+            "POST",
+            localUrl,
+            "https://api.example.com"
+        )
+
+        assertFalse(headers.keys.any { it.equals("Forwarded", ignoreCase = true) })
+        assertEquals("127.0.0.1:${Config.PORT}", headers["X-Forwarded-Host"])
+        assertEquals("http", headers["X-Forwarded-Proto"])
+    }
+
+    @Test
+    fun missingApiBaseReturnsExistingHeadersUnchanged() {
+        val input = mapOf(
+            "authorization" to nip98Header(),
+            "X-Forwarded-Host" to "caller.example"
+        )
+
+        assertEquals(input, prepareProxyRequestHeaders(input, "POST", localUrl, null))
+    }
+
+    private fun nip98Header(
+        kind: Int = 27235,
+        url: String = localUrl.toString(),
+        method: String = "POST",
+        extraTags: String = ""
+    ): String {
+        val event = """{"kind":$kind,"tags":[["u","$url"],["method","$method"]$extraTags]}"""
+        return "Nostr ${Base64.getEncoder().encodeToString(event.toByteArray())}"
+    }
+}

package/android-template/app/src/main/java/com/pakstr/app/LocalServer.kt

@@ -6,10 +6,219 @@ import android.webkit.MimeTypeMap
 import com.pakstr.app.debug.AppDebugLogger
 
 import fi.iki.elonen.NanoHTTPD
+import java.io.BufferedInputStream
+import java.io.ByteArrayOutputStream
 import java.io.IOException
 import java.net.HttpURLConnection
+import java.net.InetSocketAddress
+import java.net.Socket
 import java.net.URL
+import java.nio.charset.StandardCharsets
 import java.util.Locale
+import javax.net.ssl.HttpsURLConnection
+import javax.net.ssl.SSLSocketFactory
+
+internal data class ProxyRequestBodyPolicy(
+    val shouldWriteBody: Boolean,
+    val contentType: String?
+)
+
+internal class InvalidContentLengthException : IllegalArgumentException()
+
+internal class UnsupportedTransferEncodingException : IllegalArgumentException()
+
+internal fun proxyRequestBodyPolicy(
+    headers: Map<String, String>
+): ProxyRequestBodyPolicy {
+    if (headers.containsKey("transfer-encoding")) {
+        throw UnsupportedTransferEncodingException()
+    }
+
+    val contentLengthHeader = headers["content-length"]
+    val contentLength = when {
+        contentLengthHeader == null -> 0L
+        !contentLengthHeader.matches(Regex("[0-9]+")) -> {
+            throw InvalidContentLengthException()
+        }
+        else -> contentLengthHeader.toLongOrNull()
+            ?: throw InvalidContentLengthException()
+    }
+
+    return ProxyRequestBodyPolicy(
+        shouldWriteBody = contentLength > 0,
+        contentType = headers["content-type"]
+    )
+}
+
+internal fun shouldForwardProxyRequestHeader(
+    name: String
+): Boolean = name.lowercase() !in setOf(
+    "host",
+    "content-length",
+    "connection",
+    "accept-encoding",
+    "transfer-encoding",
+    "forwarded",
+    "x-forwarded-host",
+    "x-forwarded-proto"
+)
+
+internal data class ProxyHttpResponse(
+    val code: Int,
+    val contentType: String?,
+    val body: ByteArray
+)
+
+internal fun bodylessProxyRequestBytes(
+    method: String,
+    url: URL,
+    headers: Map<String, String>
+): ByteArray {
+    val defaultPort = if (url.protocol == "https") 443 else 80
+    val hostHeader = if (url.port == -1 || url.port == defaultPort) {
+        url.host
+    } else {
+        "${url.host}:${url.port}"
+    }
+    val path = buildString {
+        append(url.path.ifEmpty { "/" })
+        url.query?.let {
+            append('?')
+            append(it)
+        }
+    }
+
+    return buildString {
+        append("$method $path HTTP/1.1\r\n")
+        append("Host: $hostHeader\r\n")
+        headers.forEach { (name, value) ->
+            if (shouldForwardProxyRequestHeader(name) &&
+                !name.equals("content-type", ignoreCase = true)
+            ) {
+                append("$name: $value\r\n")
+            }
+        }
+        append("Connection: close\r\n\r\n")
+    }.toByteArray(StandardCharsets.ISO_8859_1)
+}
+
+internal fun executeBodylessProxyRequest(
+    method: String,
+    url: URL,
+    headers: Map<String, String>
+): ProxyHttpResponse {
+    val port = when {
+        url.port != -1 -> url.port
+        url.protocol == "https" -> 443
+        else -> 80
+    }
+    if (url.protocol != "http" && url.protocol != "https") {
+        throw IOException("Unsupported API URL protocol: ${url.protocol}")
+    }
+
+    val transport = Socket().apply {
+        connect(InetSocketAddress(url.host, port), 15000)
+        soTimeout = 30000
+    }
+    val socket = if (url.protocol == "https") {
+        (SSLSocketFactory.getDefault() as SSLSocketFactory).createSocket(
+            transport,
+            url.host,
+            port,
+            true
+        )
+    } else {
+        transport
+    }
+
+    socket.use {
+        if (url.protocol == "https") {
+            val sslSocket = it as javax.net.ssl.SSLSocket
+            sslSocket.startHandshake()
+            if (!HttpsURLConnection.getDefaultHostnameVerifier()
+                    .verify(url.host, sslSocket.session)
+            ) {
+                throw IOException("Hostname verification failed for ${url.host}")
+            }
+        }
+
+        it.getOutputStream().apply {
+            write(bodylessProxyRequestBytes(method, url, headers))
+            flush()
+        }
+
+        return readProxyHttpResponse(BufferedInputStream(it.getInputStream()))
+    }
+}
+
+private fun readProxyHttpResponse(input: BufferedInputStream): ProxyHttpResponse {
+    val statusLine = readHttpLine(input)
+    val code = statusLine.split(' ', limit = 3).getOrNull(1)?.toIntOrNull()
+        ?: throw IOException("Invalid HTTP status line")
+    val headers = mutableMapOf<String, String>()
+
+    while (true) {
+        val line = readHttpLine(input)
+        if (line.isEmpty()) break
+        val separator = line.indexOf(':')
+        if (separator <= 0) throw IOException("Invalid HTTP response header")
+        headers[line.substring(0, separator).lowercase()] =
+            line.substring(separator + 1).trim()
+    }
+
+    val body = when {
+        headers["transfer-encoding"]?.equals("chunked", ignoreCase = true) == true -> {
+            readChunkedBody(input)
+        }
+        headers["content-length"] != null -> {
+            readFixedLengthBody(input, headers.getValue("content-length").toLong())
+        }
+        else -> input.readBytes()
+    }
+
+    return ProxyHttpResponse(code, headers["content-type"], body)
+}
+
+private fun readHttpLine(input: BufferedInputStream): String {
+    val bytes = ByteArrayOutputStream()
+    while (true) {
+        val value = input.read()
+        if (value == -1) throw IOException("Unexpected end of HTTP response")
+        if (value == '\r'.code) {
+            if (input.read() != '\n'.code) throw IOException("Invalid HTTP line ending")
+            return bytes.toString(StandardCharsets.ISO_8859_1.name())
+        }
+        bytes.write(value)
+    }
+}
+
+private fun readChunkedBody(input: BufferedInputStream): ByteArray {
+    val body = ByteArrayOutputStream()
+    while (true) {
+        val size = readHttpLine(input).substringBefore(';').trim().toLong(16)
+        if (size == 0L) {
+            while (readHttpLine(input).isNotEmpty()) Unit
+            return body.toByteArray()
+        }
+        body.write(readFixedLengthBody(input, size))
+        if (readHttpLine(input).isNotEmpty()) throw IOException("Invalid chunk ending")
+    }
+}
+
+private fun readFixedLengthBody(
+    input: BufferedInputStream,
+    length: Long
+): ByteArray {
+    if (length > Int.MAX_VALUE) throw IOException("HTTP response body too large")
+    val body = ByteArray(length.toInt())
+    var offset = 0
+    while (offset < body.size) {
+        val read = input.read(body, offset, body.size - offset)
+        if (read == -1) throw IOException("Unexpected end of HTTP response body")
+        offset += read
+    }
+    return body
+}
 
 class LocalServer(
 
@@ -182,13 +391,51 @@ class LocalServer(
             }
 
             val finalUrl = apiBase.removeSuffix("/") + uri
+            val url = URL(finalUrl)
+            val method = session?.method?.name ?: "GET"
+            val requestHeaders = session?.headers ?: emptyMap()
+            val query = session?.queryParameterString
+            val localRequestUrl = URL(
+                "http://127.0.0.1:${Config.PORT}$uri" +
+                        if (query.isNullOrEmpty()) "" else "?$query"
+            )
+            val preparedHeaders = prepareProxyRequestHeaders(
+                headers = requestHeaders,
+                method = method,
+                requestUrl = localRequestUrl,
+                apiBase = apiBase
+            )
+            val bodyPolicy = if (
+                method == "POST" || method == "PUT" || method == "PATCH"
+            ) {
+                proxyRequestBodyPolicy(requestHeaders)
+            } else {
+                null
+            }
 
-            val connection = URL(finalUrl).openConnection() as HttpURLConnection
+            if (bodyPolicy?.shouldWriteBody == false) {
+                val response = executeBodylessProxyRequest(
+                    method,
+                    url,
+                    preparedHeaders
+                )
+                if (AppDebugLogger.isNetworkLoggingEnabled(context)) {
+                    AppDebugLogger.network(
+                        context,
+                        "Response: ${response.code} $finalUrl"
+                    )
+                }
+                return newFixedLengthResponse(
+                    Response.Status.lookup(response.code) ?: Response.Status.OK,
+                    response.contentType ?: "application/json",
+                    response.body.inputStream(),
+                    response.body.size.toLong()
+                )
+            }
+
+            val connection = url.openConnection() as HttpURLConnection
             connection.doInput = true
             connection.instanceFollowRedirects = false
-
-            val method = session?.method?.name ?: "GET"
-
             connection.requestMethod = method
 
             connection.connectTimeout = 15000
@@ -198,30 +445,14 @@ class LocalServer(
              * Forward headers
              */
 
-            session?.headers?.forEach { (key, value) ->
-
-                val skip = setOf(
-                    "host", "content-length", "connection", "accept-encoding"
+            preparedHeaders.forEach { (key, value) ->
+                connection.setRequestProperty(
+                    key, value
                 )
-
-
-                if (!skip.contains(key.lowercase())) {
-
-                    connection.setRequestProperty(
-                        key, value
-                    )
-                }
             }
-            session?.headers?.get("authorization")
-                ?.let { auth ->
-                    connection.setRequestProperty(
-                        "Authorization", auth
-                    )
-                }
-
 
-            if (method == "POST" || method == "PUT" || method == "PATCH") {
 
+            if (bodyPolicy?.shouldWriteBody == true) {
                 val files = HashMap<String, String>()
 
                 session?.parseBody(files)
@@ -231,7 +462,7 @@ class LocalServer(
                 val bytes = body.toByteArray(Charsets.UTF_8)
 
                 connection.doOutput = true
-                session?.headers?.get("content-type")
+                bodyPolicy.contentType
                     ?.let {
                         connection.setRequestProperty(
                             "Content-Type", it
@@ -280,6 +511,18 @@ class LocalServer(
 
             )
 
+        } catch (e: InvalidContentLengthException) {
+            return newFixedLengthResponse(
+                Response.Status.BAD_REQUEST,
+                "application/json",
+                """{"error":"invalid_content_length"}"""
+            )
+        } catch (e: UnsupportedTransferEncodingException) {
+            return newFixedLengthResponse(
+                Response.Status.BAD_REQUEST,
+                "application/json",
+                """{"error":"unsupported_transfer_encoding"}"""
+            )
         } catch (e: Exception) {
             AppDebugLogger.error(
 

package/android-template/app/src/main/java/com/pakstr/app/Nip98ProxyOrigin.kt

@@ -0,0 +1,90 @@
+package com.pakstr.app
+
+import org.json.JSONArray
+import org.json.JSONObject
+import java.net.URL
+import java.util.Base64
+
+internal data class ProxyOrigin(
+    val host: String,
+    val proto: String
+)
+
+internal fun localNip98ProxyOrigin(
+    authorization: String?,
+    method: String,
+    requestUrl: URL
+): ProxyOrigin? {
+    val encodedEvent = authorization
+        ?.takeIf { it.startsWith("Nostr ") }
+        ?.removePrefix("Nostr ")
+        ?.takeIf { it.isNotBlank() }
+        ?: return null
+
+    return runCatching {
+        val event = JSONObject(
+            String(Base64.getDecoder().decode(encodedEvent), Charsets.UTF_8)
+        )
+        val kind = event.opt("kind")
+        if (kind !is Number || kind.toInt() != 27235 || kind.toDouble() != 27235.0) {
+            return null
+        }
+
+        val tags = event.optJSONArray("tags") ?: return null
+        val signedUrlValue = uniqueUsableTagValue(tags, "u") ?: return null
+        val signedMethod = uniqueUsableTagValue(tags, "method") ?: return null
+        if (!signedMethod.equals(method, ignoreCase = true)) return null
+
+        val signedUrl = URL(signedUrlValue)
+        if (signedUrl.protocol != "http" ||
+            signedUrl.host != "127.0.0.1" ||
+            signedUrl.port != Config.PORT ||
+            signedUrl.userInfo != null ||
+            signedUrl.ref != null ||
+            signedUrl.path != requestUrl.path ||
+            signedUrl.query != requestUrl.query
+        ) {
+            return null
+        }
+
+        ProxyOrigin(
+            host = "127.0.0.1:${Config.PORT}",
+            proto = "http"
+        )
+    }.getOrNull()
+}
+
+internal fun prepareProxyRequestHeaders(
+    headers: Map<String, String>,
+    method: String,
+    requestUrl: URL,
+    apiBase: String?
+): Map<String, String> {
+    if (apiBase.isNullOrBlank()) return headers
+
+    val prepared = headers.filterKeys(::shouldForwardProxyRequestHeader).toMutableMap()
+    localNip98ProxyOrigin(
+        authorization = headers.entries.firstOrNull {
+            it.key.equals("authorization", ignoreCase = true)
+        }?.value,
+        method = method,
+        requestUrl = requestUrl
+    )?.let { origin ->
+        prepared["X-Forwarded-Host"] = origin.host
+        prepared["X-Forwarded-Proto"] = origin.proto
+    }
+    return prepared
+}
+
+private fun uniqueUsableTagValue(tags: JSONArray, name: String): String? {
+    var value: String? = null
+    var matchingTags = 0
+    for (index in 0 until tags.length()) {
+        val tag = tags.optJSONArray(index) ?: continue
+        if (tag.optString(0) != name) continue
+        matchingTags++
+        if (tag.length() != 2 || tag.opt(1) !is String) return null
+        value = tag.optString(1).takeIf { it.isNotBlank() } ?: return null
+    }
+    return value.takeIf { matchingTags == 1 }
+}

package/android-template/app/src/test/java/com/pakstr/app/ProxyRequestPolicyTest.kt

@@ -0,0 +1,97 @@
+package com.pakstr.app
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertThrows
+import org.junit.Assert.assertTrue
+import org.junit.Test
+import java.net.URL
+
+class ProxyRequestPolicyTest {
+
+    @Test
+    fun bodylessPostDoesNotWriteBodyOrManufactureContentType() {
+        val policy = proxyRequestBodyPolicy(emptyMap())
+
+        assertFalse(policy.shouldWriteBody)
+        assertNull(policy.contentType)
+    }
+
+    @Test
+    fun zeroLengthPostDoesNotWriteBodyOrManufactureContentType() {
+        val policy = proxyRequestBodyPolicy(
+            mapOf("content-length" to "0")
+        )
+
+        assertFalse(policy.shouldWriteBody)
+        assertNull(policy.contentType)
+    }
+
+    @Test
+    fun bodylessRequestOmitsEntityHeadersAndBody() {
+        val request = bodylessProxyRequestBytes(
+            "POST",
+            URL("https://example.com/api/auth/login"),
+            mapOf(
+                "authorization" to "Nostr event",
+                "content-type" to "",
+                "content-length" to "0",
+                "transfer-encoding" to "chunked"
+            )
+        ).toString(Charsets.ISO_8859_1)
+
+        assertTrue(request.startsWith("POST /api/auth/login HTTP/1.1\r\n"))
+        assertTrue(request.contains("authorization: Nostr event\r\n"))
+        assertFalse(request.contains("Content-Type", ignoreCase = true))
+        assertFalse(request.contains("Content-Length", ignoreCase = true))
+        assertFalse(request.contains("Transfer-Encoding", ignoreCase = true))
+        assertTrue(request.endsWith("Connection: close\r\n\r\n"))
+    }
+
+    @Test
+    fun jsonPostWritesBodyAndPreservesContentType() {
+        val policy = proxyRequestBodyPolicy(
+            mapOf(
+                "content-length" to "11",
+                "content-type" to "application/json"
+            )
+        )
+
+        assertTrue(policy.shouldWriteBody)
+        assertEquals("application/json", policy.contentType)
+    }
+
+    @Test
+    fun authorizationIsForwardedButTransferEncodingIsNot() {
+        assertTrue(shouldForwardProxyRequestHeader("authorization"))
+        assertFalse(shouldForwardProxyRequestHeader("transfer-encoding"))
+    }
+
+    @Test
+    fun transferEncodedBodyIsRejected() {
+        assertThrows(UnsupportedTransferEncodingException::class.java) {
+            proxyRequestBodyPolicy(
+                mapOf("transfer-encoding" to "chunked")
+            )
+        }
+    }
+
+    @Test
+    fun malformedContentLengthIsRejected() {
+        assertThrows(InvalidContentLengthException::class.java) {
+            proxyRequestBodyPolicy(
+                mapOf("content-length" to "invalid")
+            )
+        }
+    }
+
+    @Test
+    fun negativeContentLengthIsRejected() {
+        assertThrows(InvalidContentLengthException::class.java) {
+            proxyRequestBodyPolicy(
+                mapOf("content-length" to "-1")
+            )
+        }
+    }
+}

package/dist/cli.js

@@ -9,6 +9,7 @@ const sign_1 = require("./commands/sign");
 const publish_1 = require("./commands/publish");
 const run_1 = require("./commands/run");
 const init_1 = require("./commands/init");
+const nsite_1 = require("./commands/nsite");
 const dotenv_1 = require("./core/dotenv");
 const package_json_1 = __importDefault(require("../package.json"));
 async function runCLI(argv) {
@@ -40,6 +41,12 @@ async function runCLI(argv) {
         case "sign":
             await (0, sign_1.signCommand)(configFlag ?? undefined);
             return;
+        case "nsite":
+            await (0, nsite_1.nsiteCommand)(configFlag ?? undefined, {
+                dir: extractFlag(args, "--dir"),
+                dryRun: args.includes("--dry-run"),
+            });
+            return;
         case "publish":
             await (0, publish_1.publishCommand)(configFlag ?? undefined, {
                 dryRun: args.includes("--dry-run"),
@@ -75,6 +82,7 @@ Usage:
   pakstr init [--force] [--config <path>]
   pakstr build [--config <path>]
   pakstr sign [--config <path>]
+  pakstr nsite [--config <path>] [--dir <path>] [--dry-run]
   pakstr publish [--config <path>] [--dry-run] [--verify] [--out-json <path>]
   pakstr run [--config <path>] [--dry-run] [--verify-publish] [--publish-out-json <path>]
 

package/dist/commands/init.js

@@ -196,6 +196,22 @@ publish:
     source: upload
     # source: https://downloads.example.com/my-app.apk  # Or an absolute public APK URL.
 
+  nsite:
+    enabled: true
+    relays:
+      - wss://nostr.cercatrova.me
+      - wss://relay.primal.net
+      - wss://nos.lol
+      - wss://relay.damus.io
+    servers:
+      - https://cdn.hzrd149.com
+      - https://cdn.sovbit.host
+      - https://cdn.nostrcheck.me
+      - https://nostr.download
+    publishProfile: true        # Publishes only when explicit profile data is added.
+    publishRelayList: true
+    publishServerList: true
+
   relay: wss://relay.zapstore.dev
   # publishKey: PAKSTR_PUBLISH_NSEC  # OPTIONAL. Omit to reuse ${nostr_1.PAKSTR_NSEC_ENV} for publishing.
 

package/dist/commands/nsite.js

@@ -0,0 +1,38 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.nsiteCommand = nsiteCommand;
+const path_1 = __importDefault(require("path"));
+const nsite_1 = require("../core/nsite");
+const nostr_1 = require("../core/nostr");
+const pakstrConfig_1 = require("../core/pakstrConfig");
+const zapStore_1 = require("../core/zapStore");
+async function nsiteCommand(configPath, options = {}) {
+    const directoryOverride = options.dir ? path_1.default.resolve(options.dir) : undefined;
+    const config = (0, pakstrConfig_1.loadPakstrConfig)(configPath, { webOverride: directoryOverride });
+    const directory = directoryOverride ?? config.build.web;
+    const publishNsec = (0, nostr_1.resolvePublishNsec)(config.publish.publishKey, process.env);
+    const transport = options.transport ?? (options.dryRun ? new zapStore_1.MockRelayTransport() : new zapStore_1.WebsocketRelayTransport());
+    console.log("\n🌐 pakstr nsite" + (options.dryRun ? " (dry-run)" : ""));
+    console.log("Directory:", directory);
+    console.log("Publishing as:", publishNsec.envVar);
+    console.log("Blossom servers:", config.publish.nsite.servers.join(", "));
+    console.log("Relays:", config.publish.nsite.relays.join(", "));
+    const result = await (0, nsite_1.publishNsite)({
+        directory,
+        config: config.publish.nsite,
+        secret: publishNsec.bytes,
+        transport,
+        dryRun: options.dryRun,
+        fetchImpl: options.fetchImpl,
+    });
+    console.log(`Files: ${result.files.length} (${result.totalBytes} bytes)`);
+    console.log(`Events: ${result.events.map(item => item.event.kind).join(", ")}`);
+    if (result.partialFailures > 0)
+        console.log(`⚠️  Nsite published with ${result.partialFailures} target failure(s)`);
+    else
+        console.log(options.dryRun ? "✅ Nsite dry run complete" : "✅ Nsite published");
+    return result;
+}

package/dist/commands/publish.js

@@ -12,6 +12,7 @@ const giteaRelease_1 = require("../core/giteaRelease");
 const identityProof_1 = require("../core/identityProof");
 const nostr_1 = require("../core/nostr");
 const pakstrConfig_1 = require("../core/pakstrConfig");
+const nsite_1 = require("../core/nsite");
 const zapStore_1 = require("../core/zapStore");
 const zapstoreConfig_1 = require("../core/zapstoreConfig");
 /** `pakstr publish` — optionally upload the signed APK and publish its Zapstore events. */
@@ -23,9 +24,40 @@ async function publishCommand(configPath, options = {}) {
     const apkPath = path_1.default.resolve(config.build.out);
     const uploadEnabled = config.publish.upload.enabled;
     const zapstoreEnabled = config.publish.zapstoreEnabled;
+    const nsiteEnabled = config.publish.nsite.enabled;
     const fetchImpl = options.fetchImpl ?? options.blossomFetch;
+    if (!uploadEnabled && !zapstoreEnabled && !nsiteEnabled) {
+        throw new Error("Nothing to publish: publish.upload, publish.zapstore, and publish.nsite are disabled");
+    }
+    const transport = options.transport ?? (options.dryRun ? new zapStore_1.MockRelayTransport() : new zapStore_1.WebsocketRelayTransport());
     if (!uploadEnabled && !zapstoreEnabled) {
-        throw new Error("Nothing to publish: both publish.upload and publish.zapstore are disabled");
+        console.log("\n📤 pakstr publish" + (options.dryRun ? " (dry-run)" : ""));
+        console.log("App:", config.app.appName, `(${config.app.appId})`);
+        console.log("Upload: disabled");
+        console.log("Zapstore: disabled");
+        const publishNsec = (0, zapStore_1.resolvePublishSecret)(config.publish.publishKey, process.env);
+        const nsite = await (0, nsite_1.publishNsite)({
+            directory: config.build.web,
+            config: config.publish.nsite,
+            secret: publishNsec.bytes,
+            transport,
+            dryRun: options.dryRun,
+            fetchImpl,
+        });
+        const result = { artifactUrl: "", uploadProvider: null, nsite };
+        if (options.outJson) {
+            fs_1.default.writeFileSync(options.outJson, JSON.stringify({
+                appId: config.app.appId,
+                appName: config.app.appName,
+                versionName: config.app.versionName,
+                versionCode: config.app.versionCode,
+                nsite,
+                publishedAt: new Date().toISOString(),
+                dryRun: !!options.dryRun,
+            }, null, 2) + "\n", "utf8");
+            console.log("📝 Publish summary written to:", options.outJson);
+        }
+        return result;
     }
     console.log("\n📤 pakstr publish" + (options.dryRun ? " (dry-run)" : ""));
     console.log("App:", config.app.appName, `(${config.app.appId})`);
@@ -59,7 +91,6 @@ async function publishCommand(configPath, options = {}) {
             console.log("⚠️  No .identity-proof sidecar found — kind 30509 will not be published.");
         }
     }
-    const transport = options.transport ?? (options.dryRun ? new zapStore_1.MockRelayTransport() : new zapStore_1.WebsocketRelayTransport());
     let zapstoreConfig;
     let publishNsec;
     let npub;
@@ -236,11 +267,27 @@ async function publishCommand(configPath, options = {}) {
                 throw new Error(`Artifact verification failed: HTTP ${response.status}`);
         }
     }
+    let nsiteResult;
+    if (nsiteEnabled) {
+        const nsiteSecret = publishNsec ?? (0, zapStore_1.resolvePublishSecret)(config.publish.publishKey, process.env);
+        nsiteResult = await (0, nsite_1.publishNsite)({
+            directory: config.build.web,
+            config: config.publish.nsite,
+            secret: nsiteSecret.bytes,
+            transport,
+            dryRun: options.dryRun,
+            fetchImpl,
+        });
+        if (nsiteResult.partialFailures > 0) {
+            console.log(`⚠️  Nsite published with ${nsiteResult.partialFailures} target failure(s)`);
+        }
+    }
     const result = {
         artifactUrl,
         uploadProvider,
         zapstore: zapstoreResult,
         ...(zapstoreResult ?? {}),
+        ...(nsiteResult ? { nsite: nsiteResult } : {}),
     };
     console.log("🔗 Artifact URL:", artifactUrl);
     if (options.outJson) {
@@ -267,6 +314,7 @@ async function publishCommand(configPath, options = {}) {
             identityProofEventId: zapstoreResult?.identityProofEventId,
             publishedAt: new Date().toISOString(),
             dryRun: !!options.dryRun,
+            ...(nsiteResult ? { nsite: nsiteResult } : {}),
         };
         fs_1.default.writeFileSync(options.outJson, JSON.stringify(summary, null, 2) + "\n", "utf8");
         console.log("📝 Publish summary written to:", options.outJson);

package/dist/commands/run.js

@@ -27,16 +27,16 @@ async function runCommand(configPath, options = {}) {
     const config = (0, pakstrConfig_1.loadPakstrConfig)(configPath);
     // Verify PAKSTR_NSEC present (fail fast before any work).
     (0, nostr_1.requireSigningNsec)(process.env);
-    // Pre-validate the Nostr publish nsec when Zapstore or Blossom needs it.
-    if (config.publish.zapstoreEnabled || (config.publish.upload.enabled && config.publish.upload.provider === "blossom")) {
+    // Pre-validate the Nostr publish nsec when Zapstore, Blossom, or nsite needs it.
+    if (config.publish.zapstoreEnabled || config.publish.nsite.enabled || (config.publish.upload.enabled && config.publish.upload.provider === "blossom")) {
         if (!(0, nostr_1.isPublishNsecPresent)(config.publish.publishKey, process.env)) {
             const envVar = config.publish.publishKey === undefined
                 ? "PAKSTR_NSEC"
                 : config.publish.publishKey === null
                     ? "PAKSTR_PUBLISH_NSEC"
                     : config.publish.publishKey;
-            throw new Error(`${envVar} is required for publishing and must not be empty ` +
-                `(publish.zapstore.enabled is true). Pre-validation failed before any build work.`);
+            throw new Error(`${envVar} is required for publishing and must not be empty. ` +
+                `Pre-validation failed before any build work.`);
         }
     }
     console.log("\n🚀 pakstr run");
@@ -44,7 +44,7 @@ async function runCommand(configPath, options = {}) {
     console.log("Version:", config.app.versionName, `(${config.app.versionCode})`);
     console.log("Web:", config.build.web);
     console.log("Out:", path_1.default.resolve(config.build.out));
-    const publishingEnabled = config.publish.zapstoreEnabled || config.publish.upload.enabled;
+    const publishingEnabled = config.publish.zapstoreEnabled || config.publish.upload.enabled || config.publish.nsite.enabled;
     console.log("Publish:", publishingEnabled ? "enabled" : "disabled");
     if (options.dryRun) {
         // Skip build + sign — no Docker, no APK. Only exercise the publish

package/dist/core/blossom.js

@@ -95,10 +95,10 @@ async function uploadToBlossom(opts) {
     try {
         const descriptor = JSON.parse(text);
         if (descriptor.sha256 && descriptor.sha256 !== sha256) {
-            throw new BlossomError("Blossom response SHA-256 does not match the uploaded APK");
+            throw new BlossomError("Blossom response SHA-256 does not match the uploaded file");
         }
         if (descriptor.size !== undefined && descriptor.size !== size) {
-            throw new BlossomError("Blossom response size does not match the uploaded APK");
+            throw new BlossomError("Blossom response size does not match the uploaded file");
         }
         if (!descriptor.url)
             descriptor.url = `${serverUrl}/${sha256}`;

package/dist/core/nsite.js

@@ -0,0 +1,176 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NSITE_MANIFEST_KIND = void 0;
+exports.publishNsite = publishNsite;
+exports.inspectNsiteDirectory = inspectNsiteDirectory;
+exports.buildNsiteEventTemplates = buildNsiteEventTemplates;
+const crypto_1 = require("crypto");
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const blossom_1 = require("./blossom");
+const nostr_1 = require("./nostr");
+exports.NSITE_MANIFEST_KIND = 15128;
+async function publishNsite(options) {
+    const files = inspectNsiteDirectory(options.directory);
+    const fileResults = [];
+    let partialFailures = 0;
+    for (const file of files) {
+        const servers = [];
+        if (options.dryRun) {
+            servers.push(...options.config.servers.map(target => ({ target, success: true, skipped: true })));
+        }
+        else {
+            const artifact = {
+                filePath: file.filePath,
+                filename: path_1.default.basename(file.filePath),
+                contentType: file.contentType,
+                sha256: file.sha256,
+                size: file.size,
+            };
+            for (const serverUrl of options.config.servers) {
+                try {
+                    await (0, blossom_1.uploadToBlossom)({
+                        serverUrl,
+                        artifact,
+                        secret: options.secret,
+                        contentType: file.contentType,
+                        fetchImpl: options.fetchImpl,
+                    });
+                    servers.push({ target: serverUrl, success: true });
+                }
+                catch (error) {
+                    partialFailures++;
+                    const status = typeof error === "object" && error !== null && "status" in error
+                        ? Number(error.status)
+                        : undefined;
+                    servers.push({ target: serverUrl, success: false, ...(Number.isFinite(status) ? { status } : {}) });
+                }
+            }
+            if (!servers.some(result => result.success)) {
+                throw new Error(`Nsite upload failed for ${file.path} on every configured Blossom server`);
+            }
+        }
+        fileResults.push({ ...file, servers });
+    }
+    const createdAt = Math.floor((options.now?.() ?? Date.now()) / 1000);
+    const eventTemplates = buildNsiteEventTemplates(files, options.config, createdAt);
+    const events = [];
+    for (const template of eventTemplates) {
+        const event = await (0, nostr_1.signNostrEvent)(template, options.secret);
+        const relays = [];
+        if (options.dryRun) {
+            relays.push(...options.config.relays.map(target => ({ target, success: true, skipped: true })));
+        }
+        else {
+            for (const relayUrl of options.config.relays) {
+                try {
+                    await options.transport.publish(event, relayUrl);
+                    relays.push({ target: relayUrl, success: true });
+                }
+                catch {
+                    partialFailures++;
+                    relays.push({ target: relayUrl, success: false });
+                }
+            }
+            if (event.kind === exports.NSITE_MANIFEST_KIND && !relays.some(result => result.success)) {
+                throw new Error("Nsite manifest was rejected by every configured relay");
+            }
+        }
+        events.push({ event, relays });
+    }
+    return {
+        dryRun: !!options.dryRun,
+        directory: path_1.default.resolve(options.directory),
+        totalBytes: files.reduce((sum, file) => sum + file.size, 0),
+        files: fileResults,
+        events,
+        partialFailures,
+    };
+}
+function inspectNsiteDirectory(directory) {
+    const root = path_1.default.resolve(directory);
+    if (!fs_1.default.existsSync(root) || !fs_1.default.lstatSync(root).isDirectory()) {
+        throw new Error(`Nsite directory does not exist or is not a directory: ${root}`);
+    }
+    const indexPath = path_1.default.join(root, "index.html");
+    if (!fs_1.default.existsSync(indexPath) || !fs_1.default.lstatSync(indexPath).isFile()) {
+        throw new Error(`Nsite directory must contain index.html: ${root}`);
+    }
+    const files = [];
+    const walk = (current) => {
+        const entries = fs_1.default.readdirSync(current, { withFileTypes: true })
+            .sort((a, b) => a.name.localeCompare(b.name));
+        for (const entry of entries) {
+            const filePath = path_1.default.join(current, entry.name);
+            if (entry.isSymbolicLink())
+                continue;
+            if (entry.isDirectory()) {
+                walk(filePath);
+            }
+            else if (entry.isFile()) {
+                const bytes = fs_1.default.readFileSync(filePath);
+                const relative = path_1.default.relative(root, filePath).split(path_1.default.sep).join("/");
+                files.push({
+                    filePath,
+                    path: `/${relative}`,
+                    sha256: (0, crypto_1.createHash)("sha256").update(bytes).digest("hex"),
+                    size: bytes.length,
+                    contentType: contentTypeFor(filePath),
+                });
+            }
+        }
+    };
+    walk(root);
+    return files.sort((a, b) => a.path.localeCompare(b.path));
+}
+function buildNsiteEventTemplates(files, config, createdAt) {
+    const templates = [{
+            kind: exports.NSITE_MANIFEST_KIND,
+            created_at: createdAt,
+            tags: [
+                ...files.map(file => ["path", file.path, file.sha256]),
+                ...config.servers.map(server => ["server", server]),
+                ...config.relays.map(relay => ["relay", relay]),
+                ["client", "pakstr"],
+            ],
+            content: "",
+        }];
+    if (config.publishRelayList) {
+        templates.push({ kind: 10002, created_at: createdAt, tags: config.relays.map(relay => ["r", relay, "write"]), content: "" });
+    }
+    if (config.publishServerList) {
+        templates.push({ kind: 10063, created_at: createdAt, tags: config.servers.map(server => ["server", server]), content: "" });
+    }
+    if (config.publishProfile && config.profile && Object.keys(config.profile).length > 0) {
+        templates.push({ kind: 0, created_at: createdAt, tags: [], content: JSON.stringify(config.profile) });
+    }
+    return templates;
+}
+function contentTypeFor(filePath) {
+    const types = {
+        ".css": "text/css; charset=utf-8",
+        ".gif": "image/gif",
+        ".html": "text/html; charset=utf-8",
+        ".ico": "image/x-icon",
+        ".jpeg": "image/jpeg",
+        ".jpg": "image/jpeg",
+        ".js": "text/javascript; charset=utf-8",
+        ".json": "application/json; charset=utf-8",
+        ".map": "application/json; charset=utf-8",
+        ".mjs": "text/javascript; charset=utf-8",
+        ".otf": "font/otf",
+        ".png": "image/png",
+        ".svg": "image/svg+xml",
+        ".txt": "text/plain; charset=utf-8",
+        ".wasm": "application/wasm",
+        ".webmanifest": "application/manifest+json",
+        ".webp": "image/webp",
+        ".woff": "font/woff",
+        ".woff2": "font/woff2",
+        ".xml": "application/xml",
+    };
+    return types[path_1.default.extname(filePath).toLowerCase()] ?? "application/octet-stream";
+}

package/dist/core/pakstrConfig.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ConfigError = exports.APP_ID_PATTERN = exports.PERMISSION_ALIASES = exports.PAKSTR_CONFIG_FILENAME = void 0;
+exports.ConfigError = exports.DEFAULT_NSITE_SERVERS = exports.DEFAULT_NSITE_RELAYS = exports.APP_ID_PATTERN = exports.PERMISSION_ALIASES = exports.PAKSTR_CONFIG_FILENAME = void 0;
 exports.sanitizeAppIdSegment = sanitizeAppIdSegment;
 exports.loadPakstrConfig = loadPakstrConfig;
 exports.validatePakstrConfig = validatePakstrConfig;
@@ -43,6 +43,18 @@ function sanitizeAppIdSegment(input) {
     s = s.replace(/^[^a-z]+/, ""); // drop leading non-letters (digits, underscores)
     return s.length > 0 ? s : null;
 }
+exports.DEFAULT_NSITE_RELAYS = [
+    "wss://nostr.cercatrova.me",
+    "wss://relay.primal.net",
+    "wss://nos.lol",
+    "wss://relay.damus.io",
+];
+exports.DEFAULT_NSITE_SERVERS = [
+    "https://cdn.hzrd149.com",
+    "https://cdn.sovbit.host",
+    "https://cdn.nostrcheck.me",
+    "https://nostr.download",
+];
 class ConfigError extends Error {
     configPath;
     constructor(message, configPath) {
@@ -59,7 +71,7 @@ function fail(message, configPath) {
  * Load and fully validate `pakstr.yaml` from `configPath` (defaults to
  * `pakstr.yaml` in `cwd`). Returns paths resolved relative to the yaml file.
  */
-function loadPakstrConfig(configPath) {
+function loadPakstrConfig(configPath, options = {}) {
     const resolvedPath = path_1.default.resolve(configPath ?? path_1.default.join(process.cwd(), exports.PAKSTR_CONFIG_FILENAME));
     if (!fs_1.default.existsSync(resolvedPath) || !fs_1.default.lstatSync(resolvedPath).isFile()) {
         fail(`pakstr.yaml not found: ${resolvedPath}`);
@@ -76,7 +88,7 @@ function loadPakstrConfig(configPath) {
     if (raw === null || raw === undefined || typeof raw !== "object" || Array.isArray(raw)) {
         fail("pakstr.yaml must be a mapping with `app`, `build`, and optionally `publish` sections", resolvedPath);
     }
-    return resolveAndValidate(raw, resolvedPath);
+    return resolveAndValidate(raw, resolvedPath, options);
 }
 /**
  * Validate an in-memory Pakstr configuration through `resolveAndValidate`.
@@ -86,7 +98,7 @@ function loadPakstrConfig(configPath) {
 function validatePakstrConfig(config, configPath) {
     resolveAndValidate(config, configPath ?? "");
 }
-function resolveAndValidate(config, configPath) {
+function resolveAndValidate(config, configPath, options = {}) {
     const configDir = configPath ? path_1.default.dirname(configPath) : process.cwd();
     const where = (field) => configPath ? `${field} (in ${configPath})` : field;
     const app = config.app;
@@ -160,7 +172,7 @@ function resolveAndValidate(config, configPath) {
     if (!build || typeof build !== "object")
         fail(`Missing required section: build`, configPath);
     requireString(build.web, "build.web", configPath);
-    const webAbs = path_1.default.resolve(configDir, build.web);
+    const webAbs = options.webOverride ? path_1.default.resolve(options.webOverride) : path_1.default.resolve(configDir, build.web);
     if (!fs_1.default.existsSync(webAbs) || !fs_1.default.lstatSync(webAbs).isDirectory()) {
         fail(`${where("build.web")} does not exist or is not a directory: ${webAbs}`, configPath);
     }
@@ -226,6 +238,31 @@ function resolveAndValidate(config, configPath) {
         }
     }
     const relay = publish?.relay ?? "wss://relay.zapstore.dev";
+    const rawNsite = publish?.nsite;
+    if (rawNsite !== undefined && (rawNsite === null || typeof rawNsite !== "object" || Array.isArray(rawNsite))) {
+        fail(`${where("publish.nsite")} must be a mapping`, configPath);
+    }
+    if (rawNsite?.enabled !== undefined && typeof rawNsite.enabled !== "boolean") {
+        fail(`${where("publish.nsite.enabled")} must be a boolean`, configPath);
+    }
+    const booleanNsiteFields = ["publishProfile", "publishRelayList", "publishServerList"];
+    for (const field of booleanNsiteFields) {
+        if (rawNsite?.[field] !== undefined && typeof rawNsite[field] !== "boolean") {
+            fail(`${where(`publish.nsite.${field}`)} must be a boolean`, configPath);
+        }
+    }
+    const nsiteRelays = resolveUrlList(rawNsite?.relays, exports.DEFAULT_NSITE_RELAYS, "publish.nsite.relays", ["ws:", "wss:"], configPath);
+    const nsiteServers = resolveUrlList(rawNsite?.servers, exports.DEFAULT_NSITE_SERVERS, "publish.nsite.servers", ["http:", "https:"], configPath).map(value => value.replace(/\/$/, ""));
+    const nsiteProfile = resolveNsiteProfile(rawNsite?.profile, configPath);
+    const nsite = {
+        enabled: rawNsite === undefined ? false : rawNsite.enabled ?? true,
+        relays: nsiteRelays,
+        servers: nsiteServers,
+        publishProfile: rawNsite?.publishProfile ?? true,
+        publishRelayList: rawNsite?.publishRelayList ?? true,
+        publishServerList: rawNsite?.publishServerList ?? true,
+        ...(nsiteProfile ? { profile: nsiteProfile } : {}),
+    };
     if (publish?.blossom !== undefined && publish.upload !== undefined) {
         fail(`${where("publish.blossom")} cannot be combined with publish.upload`, configPath);
     }
@@ -292,9 +329,51 @@ function resolveAndValidate(config, configPath) {
         app: resolvedApp,
         build: { web: webAbs, out, builder },
         runtime: resolvedRuntime,
-        publish: { zapstoreEnabled, zapstoreSource, upload, publishKey, relay, blossom },
+        publish: { zapstoreEnabled, zapstoreSource, upload, nsite, publishKey, relay, blossom },
     };
 }
+function resolveUrlList(value, defaults, field, protocols, configPath) {
+    const values = value === undefined ? defaults : value;
+    if (!Array.isArray(values) || values.length === 0 || values.some(item => typeof item !== "string" || item.length === 0)) {
+        fail(`${field} must be a non-empty list of URLs`, configPath);
+    }
+    const resolved = [];
+    for (const item of values) {
+        let parsed;
+        try {
+            parsed = new URL(item);
+        }
+        catch {
+            fail(`${field} entries must be absolute ${protocols.join("/")} URLs`, configPath);
+        }
+        if (!protocols.includes(parsed.protocol) || !parsed.hostname || parsed.username || parsed.password) {
+            fail(`${field} entries must be absolute ${protocols.join("/")} URLs without credentials`, configPath);
+        }
+        const normalized = parsed.toString().replace(/\/$/, "");
+        if (!resolved.includes(normalized))
+            resolved.push(normalized);
+    }
+    return resolved;
+}
+function resolveNsiteProfile(value, configPath) {
+    if (value === undefined)
+        return undefined;
+    if (value === null || typeof value !== "object" || Array.isArray(value)) {
+        fail("publish.nsite.profile must be a mapping", configPath);
+    }
+    const fields = ["name", "display_name", "about", "picture", "banner", "website", "nip05", "lud16", "lud06"];
+    const entries = [];
+    for (const field of fields) {
+        const fieldValue = value[field];
+        if (fieldValue !== undefined) {
+            if (typeof fieldValue !== "string" || fieldValue.length === 0) {
+                fail(`publish.nsite.profile.${field} must be a non-empty string`, configPath);
+            }
+            entries.push([field, fieldValue]);
+        }
+    }
+    return entries.length > 0 ? Object.fromEntries(entries) : undefined;
+}
 function requireString(value, field, configPath) {
     if (typeof value !== "string" || value.length === 0) {
         fail(`Missing required field: ${field}`, configPath);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pakstr",
-  "version": "0.19.2",
+  "version": "0.20.0",
   "description": "CLI for packaging Nostr web apps into Android APKs",
   "type": "commonjs",
   "main": "dist/index.js",