pakstr 0.29.1 → 0.31.0

package/dist/shared/nip46Pairing.js

@@ -0,0 +1,278 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Nip46PairingClient = exports.NIP46_EVENT_KIND = void 0;
+exports.generatePairingSecret = generatePairingSecret;
+exports.createNostrConnectPairingUri = createNostrConnectPairingUri;
+exports.createPairedNostrConnectSigner = createPairedNostrConnectSigner;
+const event_1 = require("applesauce-core/helpers/event");
+const applesauce_signers_1 = require("applesauce-signers");
+/**
+ * Strict client-initiated NIP-46 pairing (`nostrconnect://`).
+ *
+ * A TypeScript port of the Android `Nip46PairingClient` security rules, for
+ * runtimes without the Android template (e.g. a desktop shell). It has no
+ * Node, Electron, or Android dependencies.
+ *
+ * Why this exists: applesauce-signers 6.2.2 `NostrConnectSigner` accepts a
+ * bare `"ack"` from ANY pubkey while no remote signer is known yet, so anyone
+ * who learns the client pubkey (e.g. a relay that sees the `#p` filter) can
+ * complete pairing without the secret. This module performs the pairing
+ * itself, accepting only an exact secret match, and hands the paired remote to
+ * `NostrConnectSigner`, whose own author check then drops other pubkeys.
+ */
+exports.NIP46_EVENT_KIND = 24133;
+const HEX_PUBKEY = /^[0-9a-f]{64}$/;
+const SECRET_BYTES = 32;
+const MAX_SECRET_LENGTH = 256;
+const MAX_PERMISSIONS_LENGTH = 4096;
+const MAX_NAME_LENGTH = 256;
+/** 32 random bytes, lowercase hex (same shape as Android's generateSecret). */
+function generatePairingSecret() {
+    const bytes = new Uint8Array(SECRET_BYTES);
+    globalThis.crypto.getRandomValues(bytes);
+    try {
+        return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+    }
+    finally {
+        bytes.fill(0);
+    }
+}
+/**
+ * Build a `nostrconnect://` URI with the same parameters and order as
+ * Android's `Nip46PairingUri`: relay..., perms, name, secret.
+ */
+function createNostrConnectPairingUri(options) {
+    const { clientPubkey, relays, secret, permissions, name } = options;
+    if (!HEX_PUBKEY.test(clientPubkey))
+        throw new Error("Invalid client public key");
+    if (relays.length === 0)
+        throw new Error("At least one relay is required");
+    relays.forEach(assertRelayUrl);
+    if (!isBoundedNonBlank(secret, MAX_SECRET_LENGTH))
+        throw new Error("Invalid pairing secret");
+    if (permissions !== undefined && !isBoundedNonBlank(permissions, MAX_PERMISSIONS_LENGTH)) {
+        throw new Error("Invalid requested permissions");
+    }
+    if (name !== undefined && !isBoundedNonBlank(name, MAX_NAME_LENGTH))
+        throw new Error("Invalid client name");
+    const params = new URLSearchParams();
+    for (const relay of relays)
+        params.append("relay", relay);
+    if (permissions !== undefined)
+        params.append("perms", permissions);
+    if (name !== undefined)
+        params.append("name", name);
+    params.append("secret", secret);
+    return `nostrconnect://${clientPubkey}?${params.toString()}`;
+}
+/**
+ * Listens for the remote signer's `connect` response. Pairing completes only
+ * for a kind-24133 event that is addressed to the client (`p` tag), carries a
+ * valid signature, NIP-44-decrypts with the client key, and whose response has
+ * `result` exactly equal to the secret and no `error`. The first such author
+ * wins; everything else is ignored.
+ */
+class Nip46PairingClient {
+    relays;
+    clientSigner;
+    clientPubkey;
+    secret;
+    remote = null;
+    closed = false;
+    ready = false;
+    subscription;
+    readyWaiters = [];
+    pairingWaiters = [];
+    constructor(relays, clientSigner, clientPubkey, secret) {
+        this.relays = relays;
+        this.clientSigner = clientSigner;
+        this.clientPubkey = clientPubkey;
+        this.secret = secret;
+    }
+    /** Subscribe for pairing responses. Expose the pairing URI only after this resolves. */
+    static async start(options) {
+        if (options.relays.length === 0)
+            throw new Error("At least one relay is required");
+        if (!isBoundedNonBlank(options.secret, MAX_SECRET_LENGTH))
+            throw new Error("Invalid pairing secret");
+        const subscriptionMethod = options.subscriptionMethod ?? options.pool?.subscription.bind(options.pool);
+        if (!subscriptionMethod)
+            throw new Error("A subscriptionMethod or pool is required");
+        const clientPubkey = await options.clientSigner.getPublicKey();
+        const client = new Nip46PairingClient([...options.relays], options.clientSigner, clientPubkey, options.secret);
+        const source = subscriptionMethod(client.relays, [{ kinds: [exports.NIP46_EVENT_KIND], "#p": [clientPubkey] }]);
+        if (!isSubscribable(source)) {
+            throw new TypeError("subscriptionMethod must return a subscribable (e.g. an rxjs Observable)");
+        }
+        client.subscription = source.subscribe({
+            next: (value) => {
+                if (value === "EOSE")
+                    client.markReady();
+                else if (value && typeof value === "object")
+                    void client.handleEvent(value);
+            },
+            // Fail closed: a dead subscription can never deliver the response.
+            error: () => client.close(),
+            complete: () => client.close(),
+        });
+        return client;
+    }
+    /**
+     * Resolves true once a relay confirms the subscription (EOSE), so a
+     * response to a just-exposed URI cannot be missed. False on timeout, close,
+     * or subscription failure. Pools that never emit "EOSE" cannot signal this.
+     */
+    awaitRelayReady(timeoutMs) {
+        if (this.ready)
+            return Promise.resolve(true);
+        if (this.closed)
+            return Promise.resolve(false);
+        return waitFor(this.readyWaiters, timeoutMs, false);
+    }
+    /** The remote signer pubkey, or null on timeout or close. */
+    waitForSigner(timeoutMs) {
+        if (this.remote)
+            return Promise.resolve(this.remote);
+        if (this.closed)
+            return Promise.resolve(null);
+        return waitFor(this.pairingWaiters, timeoutMs, null);
+    }
+    /** Feed one candidate event. Resolves true only if it completed pairing. */
+    async handleEvent(event) {
+        if (this.closed || this.remote)
+            return false;
+        if (!event || typeof event !== "object")
+            return false;
+        const e = event;
+        const author = e.pubkey;
+        if (typeof author !== "string" || !HEX_PUBKEY.test(author))
+            return false;
+        if (e.kind !== exports.NIP46_EVENT_KIND || !this.isAddressedToClient(e.tags) || typeof e.content !== "string")
+            return false;
+        if (!hasValidSignature(e))
+            return false;
+        let response;
+        try {
+            response = JSON.parse(await this.clientSigner.nip44.decrypt(author, e.content));
+        }
+        catch {
+            return false;
+        }
+        if (!response || typeof response !== "object" || Array.isArray(response))
+            return false;
+        const { result, error } = response;
+        if (typeof result !== "string" || !constantTimeEqual(result, this.secret))
+            return false;
+        if (error !== undefined && error !== null)
+            return false;
+        // Re-check after the async decrypt: the first valid author wins.
+        if (this.closed || this.remote)
+            return false;
+        this.remote = author;
+        this.unsubscribe();
+        for (const resolve of this.pairingWaiters.splice(0))
+            resolve(author);
+        return true;
+    }
+    /** Idempotent; unblocks any waiter with a negative result. */
+    close() {
+        if (this.closed)
+            return;
+        this.closed = true;
+        this.unsubscribe();
+        for (const resolve of this.readyWaiters.splice(0))
+            resolve(false);
+        for (const resolve of this.pairingWaiters.splice(0))
+            resolve(null);
+    }
+    markReady() {
+        if (this.ready || this.closed)
+            return;
+        this.ready = true;
+        for (const resolve of this.readyWaiters.splice(0))
+            resolve(true);
+    }
+    unsubscribe() {
+        const subscription = this.subscription;
+        this.subscription = undefined;
+        subscription?.unsubscribe();
+    }
+    isAddressedToClient(tags) {
+        return Array.isArray(tags) && tags.some((tag) => Array.isArray(tag) && tag.length >= 2 && tag[0] === "p" && tag[1] === this.clientPubkey);
+    }
+}
+exports.Nip46PairingClient = Nip46PairingClient;
+/**
+ * A `NostrConnectSigner` bound to an already-paired remote. Because `remote`
+ * is set before any event arrives, the library ignores responses from every
+ * other pubkey and never takes its lenient `"ack"` pairing path.
+ */
+async function createPairedNostrConnectSigner(options) {
+    if (!HEX_PUBKEY.test(options.remote))
+        throw new Error("Invalid remote signer public key");
+    const signer = new applesauce_signers_1.NostrConnectSigner({
+        relays: [...options.relays],
+        remote: options.remote,
+        signer: options.clientSigner,
+        pool: options.pool,
+        subscriptionMethod: options.subscriptionMethod,
+        publishMethod: options.publishMethod,
+        onAuth: options.onAuth,
+    });
+    await signer.open();
+    // The state the library itself reaches after pairing, without an extra
+    // `connect` round trip that some signers would prompt for again.
+    signer.isConnected = true;
+    return signer;
+}
+function hasValidSignature(e) {
+    // Verify a fresh copy: nostr-tools caches the verdict on the object itself.
+    const copy = { id: e.id, pubkey: e.pubkey, created_at: e.created_at, kind: e.kind, tags: e.tags, content: e.content, sig: e.sig };
+    try {
+        return (0, event_1.verifyEvent)(copy);
+    }
+    catch {
+        return false;
+    }
+}
+function constantTimeEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++)
+        diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    return diff === 0;
+}
+function isBoundedNonBlank(value, max) {
+    return typeof value === "string" && value.trim().length > 0 && value.length <= max;
+}
+function assertRelayUrl(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new Error("Invalid relay URL");
+    }
+    if (url.protocol !== "wss:" || !url.hostname || url.username || url.password || value.includes("#")) {
+        throw new Error("Invalid relay URL");
+    }
+}
+function isSubscribable(value) {
+    return !!value && typeof value.subscribe === "function";
+}
+function waitFor(waiters, timeoutMs, onTimeout) {
+    return new Promise((resolve) => {
+        const timer = setTimeout(() => {
+            const index = waiters.indexOf(settle);
+            if (index !== -1)
+                waiters.splice(index, 1);
+            resolve(onTimeout);
+        }, timeoutMs);
+        function settle(value) {
+            clearTimeout(timer);
+            resolve(value);
+        }
+        waiters.push(settle);
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pakstr",
-  "version": "0.29.1",
+  "version": "0.31.0",
   "description": "CLI for packaging Nostr web apps into Android APKs",
   "type": "commonjs",
   "main": "dist/index.js",
@@ -11,7 +11,7 @@
     "access": "public"
   },
   "engines": {
-    "node": ">=22"
+    "node": ">=22.12.0"
   },
   "files": [
     "dist",
@@ -24,11 +24,14 @@
     "android-template/build.gradle.kts",
     "android-template/settings.gradle.kts",
     "android-template/gradle.properties",
+    "desktop-runtime/dist/main.js",
+    "desktop-runtime/dist/preload.js",
     "README.md"
   ],
   "scripts": {
     "prebuild": "node -e \"require('fs').rmSync('dist', { recursive: true, force: true })\"",
-    "build": "tsc",
+    "build": "tsc && node desktop-runtime/build.js",
+    "prepack": "node -e \"for (const f of ['main.js', 'preload.js']) if (!require('fs').statSync('desktop-runtime/dist/' + f, { throwIfNoEntry: false })?.isFile()) { console.error('desktop-runtime/dist/' + f + ' is missing: run npm run build before packing'); process.exit(1); }\"",
     "type-test": "tsc -p tsconfig.type-tests.json",
     "test": "npm run build && npm run type-test && node --test test/*.test.js",
     "start": "node dist/index.js",
@@ -48,6 +51,7 @@
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^26.1.0",
     "@types/unzipper": "^0.10.11",
+    "esbuild": "^0.28.2",
     "typescript": "^6.0.3"
   },
   "dependencies": {
@@ -63,5 +67,12 @@
   "repository": {
     "type": "git",
     "url": "https://git.nostrdev.com/stuff/pakstr.git"
+  },
+  "optionalDependencies": {
+    "@electron/asar": "^4.3.1",
+    "@electron/fuses": "^2.1.3",
+    "@electron/get": "^5.1.0",
+    "@electron/packager": "^20.3.0",
+    "resedit": "^2.0.3"
   }
 }