pakstr 0.25.4 → 0.27.0

package/README.md

@@ -63,8 +63,12 @@ npx pakstr run
 *   `npx pakstr init` — Initialize a Pakstr project.
 *   `npx pakstr sign` — Sign the APK using the key derived from your `nsec`.
 *   `npx pakstr publish` — Publish the signed APK to Zap Store.
+*   `npx pakstr delete --app <appId>` — Inventory app-scoped Zapstore deletion; add `--execute` to submit NIP-09 requests, and `--delete-blobs` to include eligible Blossom release blobs.
+*   `npx pakstr delete --publisher` — Inventory every event authored by the configured publish nsec; add `--execute` for the publisher-wide NIP-09 deletion request.
 *   `npx pakstr run` — Execute the full pipeline at once (**build** + **sign** + **publish**).
 
+Delete commands are non-destructive by default. `--app` and `--publisher` are mutually exclusive, and Blossom HTTP deletion requires `--app --execute --delete-blobs`. NIP-09 is best-effort: relay acceptance does not prove physical erasure, and discovery is limited to events retained and returned by the configured relay.
+
 ---
 
 ## CI/CD

package/dist/cli.js

@@ -10,6 +10,8 @@ const publish_1 = require("./commands/publish");
 const run_1 = require("./commands/run");
 const init_1 = require("./commands/init");
 const nsite_1 = require("./commands/nsite");
+const delete_1 = require("./commands/delete");
+const deletePublisher_1 = require("./commands/deletePublisher");
 const dotenv_1 = require("./core/dotenv");
 const package_json_1 = __importDefault(require("../package.json"));
 async function runCLI(argv) {
@@ -54,6 +56,29 @@ async function runCLI(argv) {
                 outJson: extractFlag(args, "--out-json"),
             });
             return;
+        case "delete": {
+            const appId = extractFlag(args, "--app");
+            const publisher = args.includes("--publisher");
+            if (appId && publisher)
+                throw new Error("pakstr delete requires exactly one of --app or --publisher");
+            if (!appId && !publisher)
+                throw new Error("pakstr delete requires exactly one of --app or --publisher");
+            if (publisher) {
+                if (args.includes("--delete-blobs"))
+                    throw new Error("--delete-blobs is only available with --app");
+                await (0, deletePublisher_1.deletePublisherCommand)(configFlag ?? undefined, { execute: args.includes("--execute") });
+            }
+            else {
+                if (appId.startsWith("--"))
+                    throw new Error("pakstr delete requires --app <appId>");
+                await (0, delete_1.deleteCommand)(configFlag ?? undefined, {
+                    appId: appId,
+                    execute: args.includes("--execute"),
+                    deleteBlobs: args.includes("--delete-blobs"),
+                });
+            }
+            return;
+        }
         case "run":
             await (0, run_1.runCommand)(configFlag ?? undefined, {
                 verifyPublish: args.includes("--verify-publish"),
@@ -84,8 +109,14 @@ Usage:
   pakstr sign [--config <path>]
   pakstr nsite [--config <path>] [--dir <path>] [--dry-run]
   pakstr publish [--config <path>] [--dry-run] [--verify] [--out-json <path>]
+  pakstr delete --app <appId> [--config <path>] [--execute] [--delete-blobs]
+  pakstr delete --publisher [--config <path>] [--execute]
   pakstr run [--config <path>] [--dry-run] [--verify-publish] [--publish-out-json <path>]
 
+  delete inventories app-scoped Zapstore events by default; --execute submits NIP-09 requests.
+  --delete-blobs inventories release blobs; HTTP DELETE requires --execute --delete-blobs.
+  --publisher inventories all configured-publisher events; --execute submits NIP-09 requests only.
+
   pakstr --version
   pakstr --help
 

package/dist/commands/delete.js

@@ -0,0 +1,98 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deleteCommand = deleteCommand;
+const blossom_1 = require("../core/blossom");
+const nostr_1 = require("../core/nostr");
+const pakstrConfig_1 = require("../core/pakstrConfig");
+const zapStore_1 = require("../core/zapStore");
+const zapstoreConfig_1 = require("../core/zapstoreConfig");
+async function deleteCommand(configPath, options) {
+    const appId = options.appId;
+    if (appId !== appId.trim() || Buffer.byteLength(appId, "utf8") > 255 || !pakstrConfig_1.APP_ID_PATTERN.test(appId)) {
+        throw new Error(`Invalid app ID: "${appId}"`);
+    }
+    const config = (0, pakstrConfig_1.loadPakstrConfig)(configPath);
+    const publishNsec = (0, zapStore_1.resolvePublishSecret)(config.publish.publishKey, process.env);
+    const pubkeyHex = await (0, nostr_1.getNpubHex)(publishNsec.bytes);
+    const npub = (0, nostr_1.pubkeyHexToNpub)(pubkeyHex);
+    const zapstoreConfig = (0, zapstoreConfig_1.loadZapstorePublisherConfig)(config.configDir);
+    if (zapstoreConfig.pubkeyHex !== pubkeyHex) {
+        throw new Error(`Publisher npub mismatch: zapstore.yaml configures ${zapstoreConfig.pubkey}, but the active Pakstr signer is ${npub}`);
+    }
+    const relayUrl = config.publish.relay;
+    const transport = options.transport ?? new zapStore_1.WebsocketRelayTransport();
+    const inventory = await (0, zapStore_1.discoverZapStoreAppEvents)(transport, { appId, pubkeyHex, relayUrl });
+    const plan = await (0, zapStore_1.buildZapStoreDeletionPlan)(inventory, publishNsec.bytes);
+    const blobPlan = options.deleteBlobs
+        ? await (0, zapStore_1.buildBlossomDeletionPlan)(inventory, transport, config.publish.blossom)
+        : undefined;
+    console.log(`\n🗑️  pakstr delete${options.execute ? " --execute" : " (inventory only)"}`);
+    console.log("App:", appId);
+    console.log("Publisher:", npub);
+    console.log("Relay:", relayUrl);
+    printTargets(plan);
+    if (inventory.rejected.length > 0) {
+        console.log(`Rejected candidates (${inventory.rejected.length}):`);
+        for (const rejected of inventory.rejected) {
+            console.log(`  - ${rejected.id ?? "unknown"}: ${rejected.reason}`);
+        }
+    }
+    console.log(`Deletion request batches: ${plan.requests.length}`);
+    if (blobPlan)
+        printBlobTargets(blobPlan);
+    const acceptedRequestIds = [];
+    const blobResults = [];
+    if (!options.execute) {
+        console.log("Inventory only: no deletion requests were published. Re-run with --execute to submit this plan.");
+    }
+    else if (plan.requests.length === 0) {
+        console.log("No validated app events were found; no deletion requests were published.");
+    }
+    else {
+        for (const request of plan.requests) {
+            await transport.publish(request, relayUrl);
+            acceptedRequestIds.push(request.id);
+            console.log(`Relay accepted NIP-09 request: ${request.id}`);
+        }
+        console.log("Relay acceptance is not proof of physical deletion. NIP-09 is best-effort and copies may remain on relays or clients.");
+    }
+    if (options.execute && options.deleteBlobs && blobPlan) {
+        for (const blob of blobPlan.blobs.filter(item => item.eligible)) {
+            const result = await (0, blossom_1.deleteFromBlossom)({
+                serverUrl: blob.serverUrl,
+                sha256: blob.sha256,
+                secret: publishNsec.bytes,
+                fetchImpl: options.fetchImpl,
+            });
+            blobResults.push({ sha256: blob.sha256, result });
+            console.log(`Blossom blob ${blob.sha256}: ${result === "deleted" ? "deleted" : "already absent/not found"}`);
+        }
+    }
+    else if (blobPlan && !options.execute) {
+        console.log("Blossom inventory only: HTTP DELETE requires both --execute and --delete-blobs.");
+    }
+    return { appId, npub, pubkeyHex, relayUrl, executed: !!options.execute, inventory, plan, acceptedRequestIds, blobPlan, blobResults };
+}
+function printBlobTargets(plan) {
+    console.log("Blossom release blobs:");
+    if (plan.blobs.length === 0)
+        console.log("  (none)");
+    for (const blob of plan.blobs) {
+        if (blob.eligible)
+            console.log(`  DELETE ${blob.serverUrl}/${blob.sha256}`);
+        else
+            console.log(`  SKIP ${blob.url ?? blob.sha256 ?? blob.assetEventIds.join(",")}: ${blob.reason}`);
+    }
+}
+function printTargets(plan) {
+    console.log("Concrete event IDs (NIP-09 e tags):");
+    if (plan.eventIds.length === 0)
+        console.log("  (none)");
+    for (const target of plan.eventIds)
+        console.log(`  kind ${target.kind}: ${target.id}`);
+    console.log("Addressable coordinates (NIP-09 a tags):");
+    if (plan.coordinates.length === 0)
+        console.log("  (none)");
+    for (const target of plan.coordinates)
+        console.log(`  kind ${target.kind}: ${target.coordinate}`);
+}

package/dist/commands/deletePublisher.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deletePublisherCommand = deletePublisherCommand;
+const nostr_1 = require("../core/nostr");
+const pakstrConfig_1 = require("../core/pakstrConfig");
+const zapStore_1 = require("../core/zapStore");
+async function deletePublisherCommand(configPath, options = {}) {
+    const config = (0, pakstrConfig_1.loadPakstrConfig)(configPath);
+    const publishNsec = (0, zapStore_1.resolvePublishSecret)(config.publish.publishKey, process.env);
+    const pubkeyHex = await (0, nostr_1.getNpubHex)(publishNsec.bytes);
+    const npub = (0, nostr_1.pubkeyHexToNpub)(pubkeyHex);
+    const relayUrl = config.publish.relay;
+    const transport = options.transport ?? new zapStore_1.WebsocketRelayTransport();
+    const inventory = await (0, zapStore_1.discoverPublisherEvents)(transport, { pubkeyHex, relayUrl });
+    const plan = await (0, zapStore_1.buildPublisherDeletionPlan)(inventory, publishNsec.bytes);
+    console.log(`\n🗑️  pakstr delete --publisher${options.execute ? " --execute" : " (inventory only)"}`);
+    console.log("Publisher:", npub);
+    console.log("Relay:", relayUrl);
+    console.log("Concrete event IDs (NIP-09 e tags):");
+    if (plan.eventIds.length === 0)
+        console.log("  (none)");
+    for (const target of plan.eventIds)
+        console.log(`  kind ${target.kind}: ${target.id}`);
+    console.log("Replaceable/addressable coordinates (NIP-09 a tags; covers all versions through this request):");
+    if (plan.coordinates.length === 0)
+        console.log("  (none)");
+    for (const target of plan.coordinates)
+        console.log(`  kind ${target.kind}: ${target.coordinate}`);
+    if (inventory.rejected.length > 0) {
+        console.log(`Rejected candidates (${inventory.rejected.length}):`);
+        for (const rejected of inventory.rejected)
+            console.log(`  - ${rejected.id ?? "unknown"}: ${rejected.reason}`);
+    }
+    console.log(`Deletion request batches: ${plan.requests.length}`);
+    const acceptedRequestIds = [];
+    if (!options.execute) {
+        console.log("Inventory only: no deletion requests were published. Re-run with --execute to submit this plan.");
+    }
+    else {
+        for (const request of plan.requests) {
+            try {
+                await transport.publish(request, relayUrl);
+            }
+            catch (error) {
+                throw new Error(`Publisher deletion partially completed: ${acceptedRequestIds.length}/${plan.requests.length} NIP-09 request(s) accepted; request ${request.id} failed: ${error instanceof Error ? error.message : String(error)}`);
+            }
+            acceptedRequestIds.push(request.id);
+            console.log(`Relay accepted NIP-09 request: ${request.id}`);
+        }
+        console.log("Relay acceptance is not proof of physical deletion. NIP-09 is best-effort and copies may remain on relays or clients.");
+    }
+    return { npub, pubkeyHex, relayUrl, executed: !!options.execute, inventory, plan, acceptedRequestIds };
+}

package/dist/commands/init.js

@@ -7,6 +7,7 @@ exports.initCommand = initCommand;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const crypto_1 = require("crypto");
+const promises_1 = require("readline/promises");
 const pakstrConfig_1 = require("../core/pakstrConfig");
 const nostr_1 = require("../core/nostr");
 /**
@@ -29,8 +30,9 @@ async function initCommand(options = {}) {
         throw new Error(`${configPath} already exists. Use --force to overwrite, or remove it first.`);
     }
     const pkg = readPackageJson();
-    const { appId, sanitized: appIdSanitized } = inferAppId(pkg);
-    const appName = inferAppName(pkg) ?? appNameFromAppId(appId);
+    const { appId: inferredAppId, sanitized: appIdSanitized } = inferAppId(pkg);
+    const { appId, overridden: appIdOverridden } = await confirmAppId(inferredAppId, options);
+    const appName = inferAppName(pkg) ?? appNameFromAppId(inferredAppId);
     const versionName = (pkg && typeof pkg.version === "string" ? pkg.version : "1.0.0");
     const versionCode = 1;
     const web = inferWebDir();
@@ -46,7 +48,7 @@ async function initCommand(options = {}) {
     });
     fs_1.default.writeFileSync(configPath, yaml, "utf8");
     console.log(`✅ Wrote ${configPath}`);
-    if (appIdSanitized) {
+    if (appIdSanitized && !appIdOverridden) {
         console.log(`⚠️  Your package.json name contains characters that aren't valid in an Android package`);
         console.log(`    name (e.g. hyphens). pakstr sanitized it to appId "${appId}". Edit`);
         console.log(`    ${pakstrConfig_1.PAKSTR_CONFIG_FILENAME} if you'd prefer a different value.`);
@@ -235,6 +237,40 @@ function escapeYamlScalar(value) {
     }
     return value;
 }
+async function confirmAppId(inferredAppId, options) {
+    const prompt = options.promptAppId ?? (isInteractive() ? promptForAppId : null);
+    if (!prompt)
+        return { appId: inferredAppId, overridden: false };
+    const response = await prompt(inferredAppId);
+    if (response === "")
+        return { appId: inferredAppId, overridden: false };
+    validateAppId(response);
+    return { appId: response, overridden: response !== inferredAppId };
+}
+function isInteractive() {
+    return process.stdin.isTTY === true && process.stdout.isTTY === true;
+}
+async function promptForAppId(defaultAppId) {
+    const readline = (0, promises_1.createInterface)({ input: process.stdin, output: process.stdout });
+    try {
+        return await readline.question(`App ID [${defaultAppId}]: `);
+    }
+    finally {
+        readline.close();
+    }
+}
+function validateAppId(appId) {
+    if (appId !== appId.trim()) {
+        throw new Error("App ID must not have leading or trailing whitespace");
+    }
+    if (Buffer.byteLength(appId, "utf8") > 255) {
+        throw new Error("App ID must be ≤ 255 UTF-8 bytes");
+    }
+    if (!pakstrConfig_1.APP_ID_PATTERN.test(appId)) {
+        throw new Error("App ID must be a valid Android package name: dot-separated segments of" +
+            ` lower-case letters, digits, and underscores (no hyphens). Got: "${appId}"`);
+    }
+}
 function readPackageJson() {
     const p = path_1.default.join(process.cwd(), "package.json");
     if (!fs_1.default.existsSync(p))

package/dist/core/blossom.js

@@ -6,6 +6,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.BlossomError = void 0;
 exports.hashFile = hashFile;
 exports.uploadToBlossom = uploadToBlossom;
+exports.deleteFromBlossom = deleteFromBlossom;
 exports.npubHexToBech32 = npubHexToBech32;
 const fs_1 = __importDefault(require("fs"));
 const artifactUpload_1 = require("./artifactUpload");
@@ -35,13 +36,31 @@ function hashFile(filePath) {
     const artifact = (0, artifactUpload_1.inspectArtifact)(filePath);
     return { sha256: artifact.sha256, size: artifact.size };
 }
+function normalizeServerUrl(serverUrl) {
+    return serverUrl.replace(/\/$/, "");
+}
+async function buildAuthorizationHeader(secret, action, sha256, server) {
+    const expiration = Math.floor(Date.now() / 1000) + AUTH_TTL_SECONDS;
+    const authEvent = await (0, nostr_1.signNostrEvent)({
+        kind: 24242,
+        created_at: Math.floor(Date.now() / 1000),
+        tags: [
+            ["t", action],
+            ["x", sha256],
+            ...(server ? [["server", server]] : []),
+            ["expiration", String(expiration)],
+        ],
+        content: `${action === "upload" ? "Upload" : "Delete"} ${sha256}`,
+    }, secret);
+    return "Nostr " + Buffer.from(JSON.stringify(authEvent)).toString("base64url");
+}
 async function uploadToBlossom(opts) {
     const fetchFn = opts.fetchImpl ?? fetch;
     const artifact = opts.artifact ?? (opts.filePath ? (0, artifactUpload_1.inspectArtifact)(opts.filePath) : undefined);
     if (!artifact)
         throw new BlossomError("Blossom upload requires a local artifact");
     const contentType = opts.contentType ?? artifact.contentType ?? DEFAULT_CONTENT_TYPE;
-    const serverUrl = opts.serverUrl.replace(/\/$/, "");
+    const serverUrl = normalizeServerUrl(opts.serverUrl);
     const { sha256, size } = artifact;
     // 1. HEAD /<sha256> — skip upload if the blob already exists.
     const head = await fetchFn(`${serverUrl}/${sha256}`, { method: "HEAD" });
@@ -54,20 +73,8 @@ async function uploadToBlossom(opts) {
         };
     }
     // 2. Build + sign the kind-24242 Blossom auth event.
-    const npubHex = await (0, nostr_1.getNpubHex)(opts.secret);
-    const expiration = Math.floor(Date.now() / 1000) + AUTH_TTL_SECONDS;
-    const authEvent = await (0, nostr_1.signNostrEvent)({
-        kind: 24242,
-        created_at: Math.floor(Date.now() / 1000),
-        tags: [
-            ["t", "upload"],
-            ["x", sha256],
-            ["expiration", String(expiration)],
-        ],
-        content: `Upload ${sha256}`,
-    }, opts.secret);
+    const authHeader = await buildAuthorizationHeader(opts.secret, "upload", sha256);
     // 3. PUT /upload with the signed auth event in the Authorization header.
-    const authHeader = "Nostr " + Buffer.from(JSON.stringify(authEvent)).toString("base64url");
     const body = fs_1.default.readFileSync(artifact.filePath);
     const res = await fetchFn(`${serverUrl}/upload`, {
         method: "PUT",
@@ -112,6 +119,39 @@ async function uploadToBlossom(opts) {
         return { url: `${serverUrl}/${sha256}`, sha256, size, type: contentType };
     }
 }
+/** Delete one content-addressed blob using BUD-11 authorization and BUD-12. */
+async function deleteFromBlossom(opts) {
+    if (!/^[0-9a-f]{64}$/.test(opts.sha256)) {
+        throw new BlossomError("Blossom delete requires a lowercase hex SHA-256");
+    }
+    const fetchFn = opts.fetchImpl ?? fetch;
+    const serverUrl = normalizeServerUrl(opts.serverUrl);
+    let server;
+    try {
+        server = new URL(serverUrl);
+    }
+    catch {
+        throw new BlossomError(`Invalid Blossom server URL: ${opts.serverUrl}`);
+    }
+    if (!/^https?:$/.test(server.protocol) || !server.hostname || server.username || server.password || server.search || server.hash) {
+        throw new BlossomError(`Invalid Blossom server URL: ${opts.serverUrl}`);
+    }
+    const authHeader = await buildAuthorizationHeader(opts.secret, "delete", opts.sha256, server.hostname.toLowerCase());
+    const res = await fetchFn(`${serverUrl}/${opts.sha256}`, {
+        method: "DELETE",
+        headers: { Authorization: authHeader },
+    });
+    if (res.status === 200 || res.status === 204)
+        return "deleted";
+    if (res.status === 404)
+        return "absent";
+    let detail = "";
+    try {
+        detail = await res.text();
+    }
+    catch { /* ignore */ }
+    throw new BlossomError(`Blossom delete failed: HTTP ${res.status}${detail ? ` — ${detail.slice(0, 200)}` : ""}`, res.status);
+}
 /** Convenience: hex npub → bech32 npub string for display. */
 function npubHexToBech32(npubHex) {
     return (0, nostr_1.pubkeyHexToNpub)(npubHex);

package/dist/core/zapStore.js

@@ -4,15 +4,22 @@ exports.MockRelayTransport = exports.WebsocketRelayTransport = exports.IDENTITY_
 exports.formatIdentityProofMessage = formatIdentityProofMessage;
 exports.findAppMetadataEvent = findAppMetadataEvent;
 exports.isCurrentAppMetadataEvent = isCurrentAppMetadataEvent;
+exports.discoverPublisherEvents = discoverPublisherEvents;
+exports.buildPublisherDeletionPlan = buildPublisherDeletionPlan;
+exports.discoverZapStoreAppEvents = discoverZapStoreAppEvents;
+exports.buildZapStoreDeletionPlan = buildZapStoreDeletionPlan;
+exports.buildBlossomDeletionPlan = buildBlossomDeletionPlan;
 exports.buildAppMetadataEvent = buildAppMetadataEvent;
 exports.buildReleaseEvents = buildReleaseEvents;
 exports.buildSignedPublishEvents = buildSignedPublishEvents;
 exports.publishToZapStore = publishToZapStore;
 exports.resolvePublishSecret = resolvePublishSecret;
 exports.publishEventToRelay = publishEventToRelay;
+exports.queryRelayForEvents = queryRelayForEvents;
 exports.queryRelayForFilter = queryRelayForFilter;
 exports.verifyPublish = verifyPublish;
 exports.queryRelayForEvent = queryRelayForEvent;
+const helpers_1 = require("applesauce-core/helpers");
 const nostr_1 = require("./nostr");
 /** Default Zap Store catalog community (h tag). */
 exports.DEFAULT_COMMUNITY = "acfeaea6e51420e8068fac446ca9d17d7a9ef6a5d20d93894e50fee3d4902a84";
@@ -41,6 +48,8 @@ function formatIdentityProofMessage(createdAt, expiry, pubkeyHex) {
 const PLATFORM = "android-arm64-v8a";
 const MIN_SDK = 28;
 const TARGET_SDK = 36;
+const DELETE_BATCH_SIZE = 100;
+const HEX_EVENT_ID = /^[0-9a-f]{64}$/;
 /** Query for this publisher's replaceable application event. */
 async function findAppMetadataEvent(transport, input) {
     if (!transport.query)
@@ -71,6 +80,302 @@ function isCurrentAppMetadataEvent(existing, expected) {
     return expected.tags.every(expectedTag => existing.tags.some(existingTag => existingTag.length === expectedTag.length
         && existingTag.every((value, index) => value === expectedTag[index])));
 }
+function exactTagValue(event, name) {
+    const tags = event.tags.filter(tag => tag[0] === name);
+    return tags.length === 1 && tags[0].length >= 2 ? tags[0][1] : undefined;
+}
+function validateCandidate(event, expected) {
+    if (!HEX_EVENT_ID.test(event.id))
+        return "invalid event id";
+    if (event.kind !== expected.kind)
+        return `unexpected kind ${event.kind}`;
+    if (event.pubkey !== expected.pubkeyHex)
+        return "unexpected publisher";
+    try {
+        if (!(0, helpers_1.verifyEvent)(event))
+            return "invalid event signature or id";
+    }
+    catch {
+        return "invalid event signature or id";
+    }
+    return undefined;
+}
+function validatePublisherCandidate(event, pubkeyHex) {
+    if (!event || typeof event !== "object")
+        return "invalid event structure";
+    if (!HEX_EVENT_ID.test(event.id) || !HEX_EVENT_ID.test(event.pubkey))
+        return "invalid event id or pubkey";
+    if (!Number.isSafeInteger(event.kind) || event.kind < 0)
+        return "invalid event kind";
+    if (!Number.isSafeInteger(event.created_at) || event.created_at < 0)
+        return "invalid event timestamp";
+    if (typeof event.content !== "string" || !Array.isArray(event.tags)
+        || event.tags.some(tag => !Array.isArray(tag) || tag.some(value => typeof value !== "string"))) {
+        return "invalid event structure";
+    }
+    if (event.pubkey !== pubkeyHex)
+        return "unexpected publisher";
+    try {
+        if (!(0, helpers_1.verifyEvent)(event))
+            return "invalid event signature or id";
+    }
+    catch {
+        return "invalid event signature or id";
+    }
+    return undefined;
+}
+/** Discover and validate every event authored by a publisher through EOSE. */
+async function discoverPublisherEvents(transport, input) {
+    if (!transport.queryAll)
+        throw new Error("Relay transport does not support exhaustive queries");
+    const candidates = await transport.queryAll({ authors: [input.pubkeyHex] }, input.relayUrl);
+    const events = [];
+    const rejected = [];
+    const validIds = new Set();
+    for (const event of candidates) {
+        const invalid = validatePublisherCandidate(event, input.pubkeyHex);
+        if (invalid) {
+            rejected.push({ ...(typeof event?.id === "string" ? { id: event.id } : {}), reason: invalid });
+        }
+        else if (!validIds.has(event.id)) {
+            validIds.add(event.id);
+            events.push(event);
+        }
+    }
+    return { ...input, events, rejected };
+}
+/** Build bounded NIP-09 requests for every validated publisher event. */
+async function buildPublisherDeletionPlan(inventory, secret, options = {}) {
+    const eventIds = inventory.events.map(event => ({ kind: event.kind, id: event.id }));
+    const coordinateById = new Map();
+    for (const event of inventory.events) {
+        if (!(0, helpers_1.isReplaceableKind)(event.kind) && !(0, helpers_1.isAddressableKind)(event.kind))
+            continue;
+        if ((0, helpers_1.isAddressableKind)(event.kind) && exactTagValue(event, "d") === undefined)
+            continue;
+        const coordinate = (0, helpers_1.getReplaceableAddressForEvent)(event);
+        if (coordinate)
+            coordinateById.set(event.id, coordinate);
+    }
+    const coordinates = [...new Set(coordinateById.values())].map(coordinate => ({
+        kind: Number(coordinate.slice(0, coordinate.indexOf(":"))),
+        coordinate,
+    }));
+    const batchSize = options.batchSize ?? DELETE_BATCH_SIZE;
+    if (!Number.isInteger(batchSize) || batchSize <= 0)
+        throw new Error("Deletion batch size must be a positive integer");
+    const requests = [];
+    for (let offset = 0; offset < inventory.events.length; offset += batchSize) {
+        const batch = inventory.events.slice(offset, offset + batchSize);
+        const batchCoordinates = [...new Set(batch.map(event => coordinateById.get(event.id)).filter((value) => !!value))];
+        const kinds = [...new Set(batch.map(event => event.kind))];
+        requests.push(await (0, nostr_1.signNostrEvent)({
+            kind: 5,
+            created_at: Math.floor((options.now?.() ?? Date.now()) / 1000),
+            tags: [
+                ...batch.map(event => ["e", event.id]),
+                ...batchCoordinates.map(coordinate => ["a", coordinate]),
+                ...kinds.map(kind => ["k", String(kind)]),
+            ],
+            content: "Deleted by pakstr for publisher",
+        }, secret));
+    }
+    return { eventIds, coordinates, requests };
+}
+/** Discover and validate every app-scoped Zapstore event returned through EOSE. */
+async function discoverZapStoreAppEvents(transport, input) {
+    if (!transport.queryAll)
+        throw new Error("Relay transport does not support exhaustive queries");
+    const [appCandidates, releaseCandidates, assetCandidates] = await Promise.all([
+        transport.queryAll({ kinds: [exports.KIND_APP_METADATA], authors: [input.pubkeyHex], "#d": [input.appId] }, input.relayUrl),
+        transport.queryAll({ kinds: [exports.KIND_RELEASE], authors: [input.pubkeyHex], "#i": [input.appId] }, input.relayUrl),
+        transport.queryAll({ kinds: [exports.KIND_ASSET], authors: [input.pubkeyHex], "#i": [input.appId] }, input.relayUrl),
+    ]);
+    const rejected = [];
+    const reject = (event, reason) => {
+        rejected.push({ ...(typeof event.id === "string" ? { id: event.id } : {}), reason });
+    };
+    const unique = (events) => [...new Map(events.map(event => [event.id, event])).values()];
+    const appMetadata = unique(appCandidates).filter(event => {
+        const invalid = validateCandidate(event, { kind: exports.KIND_APP_METADATA, pubkeyHex: input.pubkeyHex });
+        if (invalid) {
+            reject(event, invalid);
+            return false;
+        }
+        if (exactTagValue(event, "d") !== input.appId) {
+            reject(event, "invalid app metadata d tag");
+            return false;
+        }
+        return true;
+    });
+    const assets = unique(assetCandidates).filter(event => {
+        const invalid = validateCandidate(event, { kind: exports.KIND_ASSET, pubkeyHex: input.pubkeyHex });
+        if (invalid) {
+            reject(event, invalid);
+            return false;
+        }
+        if (exactTagValue(event, "i") !== input.appId) {
+            reject(event, "invalid asset i tag");
+            return false;
+        }
+        return true;
+    });
+    const assetIds = new Set(assets.map(event => event.id));
+    const releases = unique(releaseCandidates).filter(event => {
+        const invalid = validateCandidate(event, { kind: exports.KIND_RELEASE, pubkeyHex: input.pubkeyHex });
+        if (invalid) {
+            reject(event, invalid);
+            return false;
+        }
+        if (exactTagValue(event, "i") !== input.appId) {
+            reject(event, "invalid release i tag");
+            return false;
+        }
+        const d = exactTagValue(event, "d");
+        if (!d || !d.startsWith(`${input.appId}@`) || d.length === input.appId.length + 1) {
+            reject(event, "invalid release d tag");
+            return false;
+        }
+        const linkedAssets = event.tags
+            .filter(tag => tag[0] === "e" && typeof tag[1] === "string" && HEX_EVENT_ID.test(tag[1]))
+            .map(tag => tag[1]);
+        if (!linkedAssets.some(id => assetIds.has(id))) {
+            reject(event, "release does not reference a validated app asset");
+            return false;
+        }
+        return true;
+    });
+    return { ...input, appMetadata, releases, assets, rejected };
+}
+/** Build signed, bounded NIP-09 deletion requests for a validated inventory. */
+async function buildZapStoreDeletionPlan(inventory, secret, options = {}) {
+    const targets = [...inventory.appMetadata, ...inventory.releases, ...inventory.assets];
+    const eventIds = targets.map(event => ({ kind: event.kind, id: event.id }));
+    const coordinates = [];
+    const seenCoordinates = new Set();
+    for (const event of [...inventory.appMetadata, ...inventory.releases]) {
+        const d = exactTagValue(event, "d");
+        if (!d)
+            continue;
+        const coordinate = `${event.kind}:${inventory.pubkeyHex}:${d}`;
+        if (!seenCoordinates.has(coordinate)) {
+            seenCoordinates.add(coordinate);
+            coordinates.push({ kind: event.kind, coordinate });
+        }
+    }
+    const batchSize = options.batchSize ?? DELETE_BATCH_SIZE;
+    if (!Number.isInteger(batchSize) || batchSize <= 0)
+        throw new Error("Deletion batch size must be a positive integer");
+    const requests = [];
+    for (let offset = 0; offset < targets.length; offset += batchSize) {
+        const batch = targets.slice(offset, offset + batchSize);
+        const kinds = [...new Set(batch.map(event => event.kind))];
+        const batchCoordinates = [...new Set(batch
+                .filter(event => event.kind === exports.KIND_APP_METADATA || event.kind === exports.KIND_RELEASE)
+                .map(event => `${event.kind}:${inventory.pubkeyHex}:${exactTagValue(event, "d")}`))];
+        const tags = [
+            ...batch.map(event => ["e", event.id]),
+            ...batchCoordinates.map(coordinate => ["a", coordinate]),
+            ...kinds.map(kind => ["k", String(kind)]),
+        ];
+        requests.push(await (0, nostr_1.signNostrEvent)({
+            kind: 5,
+            created_at: Math.floor((options.now?.() ?? Date.now()) / 1000),
+            tags,
+            content: `Deleted by pakstr for app ${inventory.appId}`,
+        }, secret));
+    }
+    return { eventIds, coordinates, requests };
+}
+function validateBlobUrl(value, sha256) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        return { reason: "asset url is not an absolute URL" };
+    }
+    if (!/^https?:$/.test(url.protocol) || !url.hostname || url.username || url.password || url.search || url.hash) {
+        return { reason: "asset url is not a safe HTTP(S) Blossom URL" };
+    }
+    const suffix = `/${sha256}`;
+    if (!url.pathname.endsWith(suffix) || url.pathname.slice(0, -suffix.length).endsWith("/")) {
+        return { reason: "asset url does not end with its x hash" };
+    }
+    url.pathname = url.pathname.slice(0, -suffix.length) || "/";
+    url.hostname = url.hostname.toLowerCase();
+    return { serverUrl: url.toString().replace(/\/$/, "") };
+}
+/** Build a conservative Blossom plan, proving each hash is not referenced outside the selected app. */
+async function buildBlossomDeletionPlan(inventory, transport, configuredServerUrl) {
+    if (!transport.queryAll)
+        throw new Error("Relay transport does not support exhaustive queries");
+    let configuredServer;
+    try {
+        const parsedConfiguredServer = new URL(configuredServerUrl);
+        parsedConfiguredServer.hostname = parsedConfiguredServer.hostname.toLowerCase();
+        configuredServer = parsedConfiguredServer.toString().replace(/\/$/, "");
+    }
+    catch {
+        throw new Error(`Invalid configured Blossom server URL: ${configuredServerUrl}`);
+    }
+    const blobs = [];
+    const candidates = new Map();
+    for (const asset of inventory.assets) {
+        const sha256 = exactTagValue(asset, "x");
+        const url = exactTagValue(asset, "url");
+        if (!sha256 || !HEX_EVENT_ID.test(sha256)) {
+            blobs.push({ sha256, url, assetEventIds: [asset.id], eligible: false, reason: "asset has no unique lowercase hex x hash" });
+            continue;
+        }
+        if (!url) {
+            blobs.push({ sha256, assetEventIds: [asset.id], eligible: false, reason: "asset has no unique url tag" });
+            continue;
+        }
+        const parsed = validateBlobUrl(url, sha256);
+        if ("reason" in parsed) {
+            blobs.push({ sha256, url, assetEventIds: [asset.id], eligible: false, reason: parsed.reason });
+            continue;
+        }
+        if (parsed.serverUrl !== configuredServer) {
+            blobs.push({ sha256, url, serverUrl: parsed.serverUrl, assetEventIds: [asset.id], eligible: false, reason: "asset url does not use the configured Blossom server" });
+            continue;
+        }
+        const key = `${parsed.serverUrl}/${sha256}`;
+        const existing = candidates.get(key);
+        if (existing)
+            existing.assetEventIds.push(asset.id);
+        else
+            candidates.set(key, { sha256, url, serverUrl: parsed.serverUrl, assetEventIds: [asset.id], eligible: false });
+    }
+    const checked = await Promise.all([...candidates.values()].map(async (blob) => {
+        const references = await transport.queryAll({ kinds: [exports.KIND_ASSET], "#x": [blob.sha256] }, inventory.relayUrl);
+        const validReferences = [];
+        let invalidCount = 0;
+        for (const reference of references) {
+            if (validateCandidate(reference, { kind: exports.KIND_ASSET, pubkeyHex: reference.pubkey }) || exactTagValue(reference, "x") !== blob.sha256) {
+                invalidCount++;
+                continue;
+            }
+            validReferences.push(reference);
+        }
+        const returnedIds = new Set(validReferences.map(reference => reference.id));
+        if (!blob.assetEventIds.every(id => returnedIds.has(id))) {
+            return { ...blob, reason: "shared-reference query did not return every source asset" };
+        }
+        const unsafe = validReferences.find(reference => reference.pubkey !== inventory.pubkeyHex || exactTagValue(reference, "i") !== inventory.appId);
+        if (unsafe) {
+            const appId = exactTagValue(unsafe, "i");
+            return { ...blob, reason: appId ? `hash is also referenced by app ${appId}` : "hash reference has ambiguous app ownership" };
+        }
+        if (invalidCount > 0) {
+            return { ...blob, reason: "relay returned invalid or ambiguous hash references" };
+        }
+        return { ...blob, eligible: true };
+    }));
+    blobs.push(...checked);
+    return { blobs };
+}
 /** Build the kind-32267 application event independently of the APK upload. */
 async function buildAppMetadataEvent(input) {
     const pubkeyHex = await (0, nostr_1.getNpubHex)(input.publishNsec.bytes);
@@ -217,6 +522,9 @@ class WebsocketRelayTransport {
     async query(filter, relayUrl) {
         return await queryRelayForFilter(this.WebSocketCtor, relayUrl, filter);
     }
+    async queryAll(filter, relayUrl) {
+        return await queryRelayForEvents(this.WebSocketCtor, relayUrl, filter);
+    }
     async publish(event, relayUrl) {
         await publishEventToRelay(this.WebSocketCtor, event, relayUrl);
     }
@@ -228,6 +536,9 @@ class MockRelayTransport {
     async query(_filter, _relayUrl) {
         return undefined;
     }
+    async queryAll(_filter, _relayUrl) {
+        return [];
+    }
     async publish(event, _relayUrl) {
         this.published.push(event);
     }
@@ -286,6 +597,56 @@ function publishEventToRelay(WebSocketCtor, event, relayUrl, timeoutMs = 30000)
         };
     });
 }
+/** Query a relay for every event through EOSE. Partial results are never returned. */
+function queryRelayForEvents(WebSocketCtor, relayUrl, filter, timeoutMs = 30000) {
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        const events = [];
+        const subscriptionId = `pakstr-all-${Date.now().toString(36)}`;
+        const ws = new WebSocketCtor(relayUrl);
+        const finish = (error) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            try {
+                ws.send(JSON.stringify(["CLOSE", subscriptionId]));
+            }
+            catch { /* ignore */ }
+            try {
+                ws.close();
+            }
+            catch { /* ignore */ }
+            if (error)
+                reject(error);
+            else
+                resolve(events);
+        };
+        const timer = setTimeout(() => finish(new Error(`Relay query timed out: ${relayUrl}`)), timeoutMs);
+        ws.onopen = () => ws.send(JSON.stringify(["REQ", subscriptionId, filter]));
+        ws.onmessage = (msg) => {
+            let data;
+            try {
+                data = JSON.parse(typeof msg.data === "string" ? msg.data : msg.data.toString());
+            }
+            catch {
+                return;
+            }
+            if (!Array.isArray(data) || data[1] !== subscriptionId)
+                return;
+            if (data[0] === "EVENT") {
+                events.push(data[2]);
+            }
+            else if (data[0] === "EOSE") {
+                finish();
+            }
+            else if (data[0] === "CLOSED") {
+                finish(new Error(`Relay closed query: ${relayUrl} ${data[2] ?? "unknown"}`));
+            }
+        };
+        ws.onerror = (error) => finish(new Error(`Relay connection error: ${relayUrl} ${error?.message ?? ""}`));
+    });
+}
 /** Query a relay for the first event matching a Nostr filter. */
 function queryRelayForFilter(WebSocketCtor, relayUrl, filter, timeoutMs = 30000) {
     return new Promise((resolve, reject) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pakstr",
-  "version": "0.25.4",
+  "version": "0.27.0",
   "description": "CLI for packaging Nostr web apps into Android APKs",
   "type": "commonjs",
   "main": "dist/index.js",