pakstr 0.8.6 → 0.9.0

package/dist/commands/init.js

@@ -0,0 +1,191 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.initCommand = initCommand;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const crypto_1 = require("crypto");
+const pakstrConfig_1 = require("../core/pakstrConfig");
+const nostr_1 = require("../core/nostr");
+/**
+ * `pakstr init` — generate `pakstr.yaml` in the current directory.
+ * Spec §5.1. Infers defaults from `package.json`. Never silently overwrites.
+ */
+const HEADER = `# pakstr.yaml — one file, one command, one APK.
+# Generated by \`pakstr init\`. Edit freely.
+#
+# ⚠️  Keep your nsec OUT of this file. \`pakstr init\` wrote a local dev nsec
+# to .env (gitignored). For real releases, put ${nostr_1.PAKSTR_NSEC_ENV} in your CI
+# secret manager — reuse the same nsec so updates install over prior APKs.
+# WARNING: ${nostr_1.PAKSTR_NSEC_ENV} is a production release-signing root secret. Anyone who
+# has it can derive every app identity for every known appId. Losing it breaks
+# update continuity. It cannot rotate the signer of an already-published app.
+`;
+function initCommand(options = {}) {
+    const configPath = path_1.default.resolve(options.out ?? path_1.default.join(process.cwd(), pakstrConfig_1.PAKSTR_CONFIG_FILENAME));
+    if (fs_1.default.existsSync(configPath) && !options.force) {
+        throw new Error(`${configPath} already exists. Use --force to overwrite, or remove it first.`);
+    }
+    const pkg = readPackageJson();
+    const { appId, sanitized: appIdSanitized } = inferAppId(pkg);
+    const appName = inferAppName(pkg) ?? appNameFromAppId(appId);
+    const versionName = (pkg && typeof pkg.version === "string" ? pkg.version : "1.0.0");
+    const versionCode = 1;
+    const web = inferWebDir();
+    const out = `./build/${appId}.apk`;
+    const yaml = renderConfig({
+        appId,
+        appName,
+        versionName,
+        versionCode,
+        description: pkg && typeof pkg.description === "string" ? pkg.description : "",
+        web,
+        out,
+    });
+    fs_1.default.writeFileSync(configPath, yaml, "utf8");
+    console.log(`✅ Wrote ${configPath}`);
+    if (appIdSanitized) {
+        console.log(`⚠️  Your package.json name contains characters that aren't valid in an Android package`);
+        console.log(`    name (e.g. hyphens). pakstr sanitized it to appId "${appId}". Edit`);
+        console.log(`    ${pakstrConfig_1.PAKSTR_CONFIG_FILENAME} if you'd prefer a different value.`);
+    }
+    // Generate a fresh dev nsec into a gitignored `.env` so `pakstr run` works
+    // locally with no manual setup. Never overwrites an existing PAKSTR_NSEC.
+    const nsecStatus = ensureDevNsec();
+    ensureGitIgnoresEnv();
+    console.log("");
+    console.log("➡️  Next: run pakstr run");
+    if (nsecStatus === "generated") {
+        console.log(`    A fresh ${nostr_1.PAKSTR_NSEC_ENV} was written to .env (gitignored) for local dev.`);
+    }
+    else if (nsecStatus === "present") {
+        console.log(`    ${nostr_1.PAKSTR_NSEC_ENV} already in .env — left untouched.`);
+    }
+    console.log("");
+    console.log(`    For real releases, put the SAME ${nostr_1.PAKSTR_NSEC_ENV} in your CI secret manager`);
+    console.log("    (reusing it is what lets an update install over the previous APK).");
+    console.log(`    ${nostr_1.PAKSTR_NSEC_ENV} is a release-signing root secret: anyone who has it can`);
+    console.log("    sign updates for every app whose appId they know. Keep it safe.");
+}
+/** Generate a dev nsec into .env if none is present there. Returns what happened. */
+function ensureDevNsec() {
+    const envPath = path_1.default.join(process.cwd(), ".env");
+    const existing = fs_1.default.existsSync(envPath)
+        ? fs_1.default.readFileSync(envPath, "utf8")
+        : "";
+    if (containsPakstrNsec(existing))
+        return "present";
+    const nsec = (0, nostr_1.encodeNsec)((0, crypto_1.randomBytes)(32));
+    const line = `${nostr_1.PAKSTR_NSEC_ENV}=${nsec}\n`;
+    const header = existing.length === 0 ? "# Local development secrets — never commit this file.\n" : "";
+    fs_1.default.writeFileSync(envPath, header + (existing.length ? "\n" + line : line), {
+        flag: existing.length === 0 ? "wx" : "a",
+    });
+    return "generated";
+}
+function containsPakstrNsec(envText) {
+    return new RegExp(`^${nostr_1.PAKSTR_NSEC_ENV}=`, "m").test(envText);
+}
+/** Ensure `.env` is listed in `.gitignore` so the nsec is never committed. */
+function ensureGitIgnoresEnv() {
+    const gitignorePath = path_1.default.join(process.cwd(), ".gitignore");
+    const existing = fs_1.default.existsSync(gitignorePath)
+        ? fs_1.default.readFileSync(gitignorePath, "utf8")
+        : "";
+    if (containsEnvEntry(existing))
+        return;
+    const addition = existing.length === 0 || existing.endsWith("\n")
+        ? ".env\n"
+        : "\n.env\n";
+    fs_1.default.writeFileSync(gitignorePath, existing + addition, {
+        flag: existing.length === 0 ? "wx" : "a",
+    });
+}
+function containsEnvEntry(gitignoreText) {
+    return gitignoreText
+        .split(/\r?\n/)
+        .some(line => line.trim() === ".env" || line.trim().startsWith(".env"));
+}
+function renderConfig(c) {
+    const perms = `    [${pakstrConfig_1.PERMISSION_ALIASES.map(p => `"${p}"`).join(", ")}]`;
+    return `${HEADER}
+app:
+  appId: ${c.appId}        # REQUIRED. Java package id; also feeds key derivation.
+  appName: ${escapeYamlScalar(c.appName)}                  # REQUIRED. Launcher label.
+  versionName: "${c.versionName}"           # REQUIRED. Human-readable version.
+  versionCode: ${c.versionCode}                 # REQUIRED. Monotonic integer.
+  description: ${c.description === "" ? '""' : escapeYamlScalar(c.description)}                # OPTIONAL.
+  # icon: ./icon.png               # OPTIONAL. Resolved relative to this file.
+  # splash:                          # OPTIONAL.
+  #   image: ./splash.png
+  #   background: "#0f0f17"
+  # backgroundColor: "#0f0f17"    # OPTIONAL. Launcher icon background.
+  # permissions: ${perms}   # OPTIONAL. Aliases (case-insensitive): ${pakstrConfig_1.PERMISSION_ALIASES.join(", ")}.
+
+build:
+  web: ${c.web}                    # REQUIRED. Built web assets (must contain index.html).
+  out: ${c.out}          # OPTIONAL. Default ./build/<appId>.apk
+  builder: docker               # Only "docker" is specified.
+
+publish:
+  zapstore:
+    enabled: true               # Default true when publish is present.
+  # publishKey: PAKSTR_PUBLISH_NSEC  # OPTIONAL. Omit to reuse ${nostr_1.PAKSTR_NSEC_ENV} for publishing.
+`;
+}
+function escapeYamlScalar(value) {
+    // Keep it simple: quote if it contains anything that looks YAML-special.
+    if (value === "" || /[:#\-?*&!|>'"%@\`\[\]{}]/.test(value) || /^\s|\s$/.test(value)) {
+        return `"${value.replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`;
+    }
+    return value;
+}
+function readPackageJson() {
+    const p = path_1.default.join(process.cwd(), "package.json");
+    if (!fs_1.default.existsSync(p))
+        return null;
+    try {
+        return JSON.parse(fs_1.default.readFileSync(p, "utf8"));
+    }
+    catch {
+        return null;
+    }
+}
+function inferAppId(pkg) {
+    const name = pkg && typeof pkg.name === "string" ? pkg.name : null;
+    if (!name)
+        return { appId: "dev.pakstr.myapp", sanitized: false };
+    // Split the npm name into segments (handling @scope/name), sanitize each,
+    // and track whether any segment changed so we can warn the user.
+    const raw = name.startsWith("@") ? name.slice(1).split("/") : [name];
+    const segments = raw.map(s => s.toLowerCase());
+    const sanitized = segments.map(s => (0, pakstrConfig_1.sanitizeAppIdSegment)(s) ?? "");
+    const changed = segments.some((orig, i) => sanitized[i] !== orig);
+    const valid = sanitized.filter(s => s.length > 0);
+    const appId = valid.length > 0 ? `dev.pakstr.${valid.join(".")}` : "dev.pakstr.myapp";
+    // Final guard: if it still doesn't match the pattern, fall back.
+    return pakstrConfig_1.APP_ID_PATTERN.test(appId)
+        ? { appId, sanitized: changed }
+        : { appId: "dev.pakstr.myapp", sanitized: true };
+}
+function inferAppName(pkg) {
+    const name = pkg && typeof pkg.name === "string" ? pkg.name : null;
+    if (!name)
+        return null;
+    const unscoped = name.replace(/^@[^/]+\//, "");
+    return unscoped || null;
+}
+function appNameFromAppId(appId) {
+    const last = appId.split(".").pop() ?? appId;
+    return last.charAt(0).toUpperCase() + last.slice(1);
+}
+function inferWebDir() {
+    const cwd = process.cwd();
+    if (fs_1.default.existsSync(path_1.default.join(cwd, "dist", "index.html")))
+        return "./dist";
+    if (fs_1.default.existsSync(path_1.default.join(cwd, "build", "index.html")))
+        return "./build";
+    return "./dist";
+}

package/dist/commands/publish.js

@@ -0,0 +1,137 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.publishCommand = publishCommand;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const pakstrConfig_1 = require("../core/pakstrConfig");
+const zapStore_1 = require("../core/zapStore");
+const blossom_1 = require("../core/blossom");
+/**
+ * `pakstr publish` — upload the signed APK to Blossom and publish NIP-82
+ * events (32267/30063/3063) to the configured relay. Spec §5.4 / §8.
+ *
+ * Requires that `pakstr build` + `pakstr sign` have already run (the signed
+ * APK at build.out, plus its `.signer-sha256` sidecar).
+ *
+ * `--dry-run` skips network + disk: it builds the events with a stub blossom
+ * descriptor and a mock relay transport, so you can preview exactly what would
+ * be published without an APK or network.
+ */
+async function publishCommand(configPath, options = {}) {
+    const config = (0, pakstrConfig_1.loadPakstrConfig)(configPath);
+    const apkPath = path_1.default.resolve(config.build.out);
+    const publishNsec = (0, zapStore_1.resolvePublishSecret)(config.publish.publishKey, process.env);
+    console.log("\n📤 pakstr publish" + (options.dryRun ? " (dry-run)" : ""));
+    console.log("App:", config.app.appName, `(${config.app.appId})`);
+    console.log("Publishing as:", publishNsec.envVar);
+    console.log("Relay:", config.publish.relay);
+    console.log("Blossom:", config.publish.blossom);
+    let blossomUrl;
+    let apkSha256;
+    let apkSize;
+    let signerCertificateSha256;
+    let filename;
+    if (options.dryRun) {
+        // No network, no APK required. Synthesize a stub descriptor so the events
+        // can still be built and printed for preview.
+        apkSha256 = "0".repeat(64);
+        apkSize = 0;
+        blossomUrl = `${config.publish.blossom.replace(/\/$/, "")}/${apkSha256}`;
+        signerCertificateSha256 = "0".repeat(64);
+        filename = path_1.default.basename(apkPath);
+        console.log("📦 (dry-run) Blossom URL:", blossomUrl);
+    }
+    else {
+        if (!fs_1.default.existsSync(apkPath) || !fs_1.default.lstatSync(apkPath).isFile()) {
+            throw new Error(`Signed APK not found at ${apkPath}. Run \`pakstr build\` and \`pakstr sign\` first.`);
+        }
+        const certShaPath = `${apkPath}.signer-sha256`;
+        if (!fs_1.default.existsSync(certShaPath)) {
+            throw new Error(`Signer certificate sidecar not found: ${certShaPath}. Run \`pakstr sign\` first.`);
+        }
+        signerCertificateSha256 = fs_1.default.readFileSync(certShaPath, "utf8").trim();
+        const blossom = await (0, blossom_1.uploadToBlossom)({
+            serverUrl: config.publish.blossom,
+            filePath: apkPath,
+            secret: publishNsec.bytes,
+            fetchImpl: options.blossomFetch,
+        });
+        blossomUrl = blossom.url;
+        apkSha256 = blossom.sha256;
+        apkSize = blossom.size;
+        filename = path_1.default.basename(apkPath);
+        console.log("📦 Uploaded to Blossom:", blossom.url);
+        console.log("   APK SHA-256:", blossom.sha256, "| size:", blossom.size);
+    }
+    // Build + publish the NIP-82 events.
+    const transport = options.transport ?? (options.dryRun ? new zapStore_1.MockRelayTransport() : new zapStore_1.WebsocketRelayTransport());
+    const result = await (0, zapStore_1.publishToZapStore)({
+        app: {
+            appId: config.app.appId,
+            appName: config.app.appName,
+            versionName: config.app.versionName,
+            versionCode: config.app.versionCode,
+            description: config.app.description,
+        },
+        apk: {
+            apkSha256,
+            apkSize,
+            blossomUrl,
+            signerCertificateSha256,
+            filename,
+        },
+        publishNsec,
+        target: { relayUrl: config.publish.relay },
+    }, transport);
+    console.log(options.dryRun ? "✅ PUBLISHED (dry-run — no network)" : "✅ PUBLISHED");
+    console.log("🪪 Publisher npub:", result.npub);
+    console.log("🧾 Asset event:", result.assetEventId);
+    console.log("🧾 Release event:", result.releaseEventId);
+    console.log("🧾 App metadata event:", result.appMetadataEventId);
+    console.log("🔗 Blossom URL:", blossomUrl);
+    console.log("📡 Relay:", config.publish.relay);
+    if (options.verify && !options.dryRun) {
+        const { eventFound, apkDownloadable } = await (0, zapStore_1.verifyPublish)({
+            app: {
+                appId: config.app.appId,
+                appName: config.app.appName,
+                versionName: config.app.versionName,
+                versionCode: config.app.versionCode,
+            },
+            assetEventId: result.assetEventId,
+            relayUrl: config.publish.relay,
+            blossomUrl,
+        });
+        console.log(`🔎 Verify: event on relay=${eventFound}, apk on blossom=${apkDownloadable}`);
+        if (!eventFound || !apkDownloadable) {
+            throw new Error("Publish verification failed");
+        }
+    }
+    if (options.outJson) {
+        const summary = {
+            appId: config.app.appId,
+            appName: config.app.appName,
+            versionName: config.app.versionName,
+            versionCode: config.app.versionCode,
+            npub: result.npub,
+            pubkeyHex: result.pubkeyHex,
+            relayUrl: config.publish.relay,
+            blossomServer: config.publish.blossom,
+            blossomUrl,
+            apkSha256,
+            apkSize,
+            signerCertificateSha256,
+            assetEventId: result.assetEventId,
+            releaseEventId: result.releaseEventId,
+            appMetadataEventId: result.appMetadataEventId,
+            publishedAt: new Date().toISOString(),
+            dryRun: !!options.dryRun,
+        };
+        fs_1.default.writeFileSync(options.outJson, JSON.stringify(summary, null, 2) + "\n", "utf8");
+        console.log("📝 Publish summary written to:", options.outJson);
+    }
+    return result;
+}

package/dist/commands/run.js

@@ -0,0 +1,95 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runCommand = runCommand;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const pakstrConfig_1 = require("../core/pakstrConfig");
+const nostr_1 = require("../core/nostr");
+const build_1 = require("./build");
+const sign_1 = require("./sign");
+const publish_1 = require("./publish");
+/**
+ * `pakstr run` — build → sign → publish. Spec §5.5 / §6.
+ *
+ * Each step is atomic and fail-fast (§7). The signed APK at build.out is
+ * preserved on a publish failure; only ephemeral/derived material is cleaned
+ * up. `init` is NOT part of `run`.
+ */
+async function runCommand(configPath, options = {}) {
+    // Step 1: load & validate config, pre-validate nsecs.
+    const config = (0, pakstrConfig_1.loadPakstrConfig)(configPath);
+    // Verify PAKSTR_NSEC present (fail fast before any work).
+    (0, nostr_1.requireSigningNsec)(process.env);
+    // Pre-validate the publish nsec if publishing is enabled (§6 step 1).
+    if (config.publish.zapstoreEnabled) {
+        if (!(0, nostr_1.isPublishNsecPresent)(config.publish.publishKey, process.env)) {
+            const envVar = config.publish.publishKey === undefined
+                ? "PAKSTR_NSEC"
+                : config.publish.publishKey === null
+                    ? "PAKSTR_PUBLISH_NSEC"
+                    : config.publish.publishKey;
+            throw new Error(`${envVar} is required for publishing and must not be empty ` +
+                `(publish.zapstore.enabled is true). Pre-validation failed before any build work.`);
+        }
+    }
+    console.log("\n🚀 pakstr run");
+    console.log("App:", config.app.appName, `(${config.app.appId})`);
+    console.log("Version:", config.app.versionName, `(${config.app.versionCode})`);
+    console.log("Web:", config.build.web);
+    console.log("Out:", path_1.default.resolve(config.build.out));
+    console.log("Publish:", config.publish.zapstoreEnabled ? "enabled" : "disabled");
+    // Step 3: build the unsigned APK.
+    console.log("\n— Step 1/3: build —");
+    await (0, build_1.buildCommand)(config.configPath || undefined);
+    // Step 4: sign the APK.
+    console.log("\n— Step 2/3: sign —");
+    await (0, sign_1.signCommand)(config.configPath || undefined);
+    // Step 5: publish to Zap Store (unless disabled).
+    if (config.publish.zapstoreEnabled) {
+        console.log("\n— Step 3/3: publish —");
+        await (0, publish_1.publishCommand)(config.configPath || undefined, {
+            verify: options.verifyPublish,
+            outJson: options.publishOutJson,
+        });
+    }
+    else {
+        console.log("\nPublish disabled (publish.zapstore.enabled: false). Stopping after sign.");
+    }
+    // Step 6: cleanup. The signed APK at build.out is the artifact and is kept.
+    // Derived signing material is cleaned up inside the sign runner (tmpfs).
+    verifyNoLeakedKeystores(config);
+    console.log("\n✅ pakstr run complete");
+    console.log("Signed APK:", path_1.default.resolve(config.build.out));
+}
+/** Best-effort: ensure no derived .p12 keystore leaked onto disk (§7). */
+function verifyNoLeakedKeystores(config) {
+    const buildDir = path_1.default.join(config.configDir, "build");
+    if (!fs_1.default.existsSync(buildDir))
+        return;
+    const walk = (dir) => {
+        const found = [];
+        for (const entry of fs_1.default.readdirSync(dir, { withFileTypes: true })) {
+            const p = path_1.default.join(dir, entry.name);
+            if (entry.isDirectory())
+                found.push(...walk(p));
+            else if (entry.name.endsWith(".p12") || entry.name.endsWith(".keystore"))
+                found.push(p);
+        }
+        return found;
+    };
+    const leaked = walk(buildDir);
+    if (leaked.length > 0) {
+        for (const f of leaked) {
+            try {
+                fs_1.default.rmSync(f, { force: true });
+            }
+            catch {
+                /* ignore */
+            }
+        }
+        throw new Error(`Derived keystore material leaked onto disk: ${leaked.join(", ")}`);
+    }
+}

package/dist/commands/sign.js

@@ -0,0 +1,41 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.signCommand = signCommand;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const pakstrConfig_1 = require("../core/pakstrConfig");
+const nostr_1 = require("../core/nostr");
+const DockerSignRunner_1 = require("../runners/DockerSignRunner");
+/**
+ * `pakstr sign` — sign the unsigned APK at `build.out` with the key derived
+ * from `PAKSTR_NSEC` + `app.appId`. Overwrites `build.out` with the signed APK.
+ * Spec §5.3.
+ */
+async function signCommand(configPath) {
+    const config = (0, pakstrConfig_1.loadPakstrConfig)(configPath);
+    const unsignedApkPath = path_1.default.resolve(config.build.out);
+    if (!fs_1.default.existsSync(unsignedApkPath) || !fs_1.default.lstatSync(unsignedApkPath).isFile()) {
+        throw new Error(`Unsigned APK not found at ${unsignedApkPath}. Run \`pakstr build\` first.`);
+    }
+    const nsec = (0, nostr_1.requireSigningNsec)(process.env);
+    console.log("\n🔐 pakstr sign");
+    console.log("📦 Unsigned:", unsignedApkPath);
+    console.log("🔑 Deriving signing key from PAKSTR_NSEC +", config.app.appId);
+    const runner = new DockerSignRunner_1.DockerSignRunner();
+    const result = await runner.sign({
+        unsignedApkPath,
+        signedApkPath: unsignedApkPath,
+        appId: config.app.appId,
+        nsec: nsec.bytes,
+    });
+    // Write the signer certificate SHA-256 to a sidecar so `pakstr publish`/`run`
+    // can include it in the Zap Store asset event (apk_certificate_hash).
+    fs_1.default.writeFileSync(`${unsignedApkPath}.signer-sha256`, result.signerSha256, "utf8");
+    console.log("✅ SIGNED");
+    console.log("📦 Signed APK:", result.signedApkPath);
+    console.log("🧾 Signer certificate SHA-256:", result.signerSha256);
+    return result;
+}

package/dist/core/androidProject.js

@@ -0,0 +1,70 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.prepareAndroidProject = prepareAndroidProject;
+exports.generateRuntimeConfig = generateRuntimeConfig;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const generatedProjectVerification_1 = require("../android/generatedProjectVerification");
+const gradle_1 = require("../android/gradle");
+const branding_1 = require("../android/branding");
+const icon_1 = require("../android/icon");
+const permissions_1 = require("../android/permissions");
+const splash_1 = require("../android/splash");
+/**
+ * Copy built web assets into the Android template and patch identity/branding.
+ * Spec §5.2. Creates `assets/www/` from `webDir`, patches Gradle, app name,
+ * icon, splash, and permissions, then verifies the generated project.
+ */
+async function prepareAndroidProject(opts) {
+    const { androidRoot, webDir, app, configDir } = opts;
+    const assetsTarget = path_1.default.join(androidRoot, "app/src/main/assets/www");
+    if (!fs_1.default.existsSync(webDir)) {
+        throw new Error(`Web assets not found: ${webDir}`);
+    }
+    fs_1.default.rmSync(assetsTarget, { recursive: true, force: true });
+    fs_1.default.mkdirSync(assetsTarget, { recursive: true });
+    copyFolder(webDir, assetsTarget);
+    generateRuntimeConfig(assetsTarget);
+    (0, gradle_1.patchGradle)(androidRoot, app);
+    (0, branding_1.patchAppName)(androidRoot, app.appName);
+    if (app.icon) {
+        await (0, icon_1.patchIcon)(androidRoot, app.icon, app.backgroundColor ?? "#FFFFFF", configDir);
+    }
+    if (app.splash?.image) {
+        await (0, splash_1.patchSplash)(androidRoot, app.splash.image, app.splash.background ?? "#FFFFFF", configDir);
+    }
+    (0, permissions_1.patchPermissions)(androidRoot, app);
+    (0, generatedProjectVerification_1.verifyGeneratedAndroidProject)(androidRoot, {
+        applicationId: app.appId,
+        versionCode: app.versionCode,
+        versionName: app.versionName,
+        appLabel: app.appName,
+    });
+}
+/**
+ * Generate the runtime config written into the packaged web assets.
+ * Pakstr's config model has no runtime/debug fields, so this emits an empty
+ * config (kept for template compatibility).
+ */
+function generateRuntimeConfig(webRoot) {
+    const runtime = {};
+    const jsContent = `window.PAKSTR_CONFIG = ${JSON.stringify(runtime, null, 2)};\n`;
+    fs_1.default.writeFileSync(path_1.default.join(webRoot, "pakstr-config.js"), jsContent.trim());
+    fs_1.default.writeFileSync(path_1.default.join(webRoot, "pakstr-runtime.json"), JSON.stringify(runtime, null, 2));
+}
+function copyFolder(src, dest) {
+    for (const entry of fs_1.default.readdirSync(src, { withFileTypes: true })) {
+        const srcPath = path_1.default.join(src, entry.name);
+        const destPath = path_1.default.join(dest, entry.name);
+        if (entry.isDirectory()) {
+            fs_1.default.mkdirSync(destPath, { recursive: true });
+            copyFolder(srcPath, destPath);
+        }
+        else {
+            fs_1.default.copyFileSync(srcPath, destPath);
+        }
+    }
+}

package/dist/core/appIdentity.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.asAndroidAppIdentity = asAndroidAppIdentity;
+/** A `PakstrApp` is structurally an `AndroidAppIdentity`. */
+function asAndroidAppIdentity(app) {
+    return app;
+}

package/dist/core/blossom.js

@@ -0,0 +1,122 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BlossomError = void 0;
+exports.hashFile = hashFile;
+exports.uploadToBlossom = uploadToBlossom;
+exports.npubHexToBech32 = npubHexToBech32;
+const crypto_1 = require("crypto");
+const fs_1 = __importDefault(require("fs"));
+const nostr_1 = require("./nostr");
+/**
+ * Blossom (BUD-02 / BUD-11) blob upload.
+ *
+ * Uploads a file to a Blossom server with a Nostr kind-24242 authorization
+ * event signed by the supplied secret key. Returns the blob descriptor
+ * (`url`, `sha256`, `size`, `type`).
+ *
+ * Reference: https://github.com/hzrd149/blossom (BUD-02 upload, BUD-11 auth).
+ */
+const DEFAULT_CONTENT_TYPE = "application/vnd.android.package-archive";
+const AUTH_TTL_SECONDS = 5 * 60;
+class BlossomError extends Error {
+    status;
+    constructor(message, status) {
+        super(message);
+        this.status = status;
+        this.name = "BlossomError";
+    }
+}
+exports.BlossomError = BlossomError;
+/** Compute the SHA-256 of a file (hex). */
+function hashFile(filePath) {
+    const size = fs_1.default.statSync(filePath).size;
+    const hash = (0, crypto_1.createHash)("sha256");
+    const fd = fs_1.default.openSync(filePath, "r");
+    try {
+        const buf = Buffer.alloc(64 * 1024);
+        let bytes = 0;
+        while ((bytes = fs_1.default.readSync(fd, buf, 0, buf.length, null)) !== 0) {
+            hash.update(buf.subarray(0, bytes));
+        }
+    }
+    finally {
+        fs_1.default.closeSync(fd);
+    }
+    return { sha256: hash.digest("hex"), size };
+}
+async function uploadToBlossom(opts) {
+    const fetchFn = opts.fetchImpl ?? fetch;
+    const contentType = opts.contentType ?? DEFAULT_CONTENT_TYPE;
+    const serverUrl = opts.serverUrl.replace(/\/$/, "");
+    const { sha256, size } = hashFile(opts.filePath);
+    // 1. HEAD /<sha256> — skip upload if the blob already exists.
+    const head = await fetchFn(`${serverUrl}/${sha256}`, { method: "HEAD" });
+    if (head.status === 200) {
+        return {
+            url: `${serverUrl}/${sha256}`,
+            sha256,
+            size,
+            type: contentType,
+        };
+    }
+    // 2. Build + sign the kind-24242 Blossom auth event.
+    const npubHex = await (0, nostr_1.getNpubHex)(opts.secret);
+    const expiration = Math.floor(Date.now() / 1000) + AUTH_TTL_SECONDS;
+    const authEvent = await (0, nostr_1.signNostrEvent)({
+        kind: 24242,
+        created_at: Math.floor(Date.now() / 1000),
+        tags: [
+            ["t", "upload"],
+            ["x", sha256],
+            ["expiration", String(expiration)],
+        ],
+        content: `Upload ${sha256}`,
+    }, opts.secret);
+    // 3. PUT /upload with the signed auth event in the Authorization header.
+    const authHeader = "Nostr " + Buffer.from(JSON.stringify(authEvent)).toString("base64");
+    const body = fs_1.default.readFileSync(opts.filePath);
+    const res = await fetchFn(`${serverUrl}/upload`, {
+        method: "PUT",
+        headers: {
+            Authorization: authHeader,
+            "Content-Type": contentType,
+            "X-SHA-256": sha256,
+            "Content-Length": String(size),
+        },
+        body,
+    });
+    if (res.status !== 200 && res.status !== 201) {
+        let detail = "";
+        try {
+            detail = await res.text();
+        }
+        catch {
+            /* ignore */
+        }
+        throw new BlossomError(`Blossom upload failed: HTTP ${res.status}${detail ? ` — ${detail.slice(0, 200)}` : ""}`, res.status);
+    }
+    // 4. Parse the blob descriptor (fall back to a constructed one).
+    const text = await res.text();
+    try {
+        const descriptor = JSON.parse(text);
+        if (!descriptor.url)
+            descriptor.url = `${serverUrl}/${sha256}`;
+        if (!descriptor.sha256)
+            descriptor.sha256 = sha256;
+        if (!descriptor.size)
+            descriptor.size = size;
+        if (!descriptor.type)
+            descriptor.type = contentType;
+        return descriptor;
+    }
+    catch {
+        return { url: `${serverUrl}/${sha256}`, sha256, size, type: contentType };
+    }
+}
+/** Convenience: hex npub → bech32 npub string for display. */
+function npubHexToBech32(npubHex) {
+    return (0, nostr_1.pubkeyHexToNpub)(npubHex);
+}