pakstr 0.8.6 → 0.9.0

package/dist/core/dotenv.js

@@ -0,0 +1,51 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadDotEnv = loadDotEnv;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+/**
+ * Minimal `.env` loader for local development convenience.
+ *
+ * Parses a `.env` file (simple `KEY=VALUE` lines) and merges values into
+ * `process.env` WITHOUT overriding variables that are already set, so CI
+ * secret-manager values and explicit exports always win.
+ *
+ * This is purely a local-dev ergonomic: pakstr still reads secrets only from
+ * `process.env`. The `.env` file is gitignored (see `pakstr init`).
+ *
+ * Silently no-ops when the file is missing.
+ */
+function loadDotEnv(dir = process.cwd()) {
+    const envPath = path_1.default.join(dir, ".env");
+    if (!fs_1.default.existsSync(envPath) || !fs_1.default.lstatSync(envPath).isFile()) {
+        return [];
+    }
+    const loaded = [];
+    const text = fs_1.default.readFileSync(envPath, "utf8");
+    for (const rawLine of text.split(/\r?\n/)) {
+        const line = rawLine.trim();
+        if (line.length === 0 || line.startsWith("#"))
+            continue;
+        const eq = line.indexOf("=");
+        if (eq <= 0)
+            continue;
+        const key = line.slice(0, eq).trim();
+        if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key))
+            continue;
+        let value = line.slice(eq + 1).trim();
+        // Strip surrounding matching quotes.
+        if ((value.startsWith('"') && value.endsWith('"')) ||
+            (value.startsWith("'") && value.endsWith("'"))) {
+            value = value.slice(1, -1);
+        }
+        // Never override an existing env var (CI secrets / explicit exports win).
+        if (process.env[key] === undefined) {
+            process.env[key] = value;
+            loaded.push(key);
+        }
+    }
+    return loaded;
+}

package/dist/core/nostr.js

@@ -0,0 +1,153 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NsecError = exports.NPUB_HRP = exports.NSEC_HRP = exports.PAKSTR_PUBLISH_NSEC_ENV = exports.PAKSTR_NSEC_ENV = void 0;
+exports.decodeNsec = decodeNsec;
+exports.encodeNsec = encodeNsec;
+exports.encodeNpub = encodeNpub;
+exports.requireSigningNsec = requireSigningNsec;
+exports.resolvePublishNsec = resolvePublishNsec;
+exports.isPublishNsecPresent = isPublishNsecPresent;
+exports.signNostrEvent = signNostrEvent;
+exports.getNpubHex = getNpubHex;
+exports.pubkeyHexToNpub = pubkeyHexToNpub;
+const base_1 = require("@scure/base");
+const applesauce_signers_1 = require("applesauce-signers");
+/**
+ * nsec + Nostr publish helpers.
+ *
+ * Uses applesauce (`PrivateKeySigner`) for secp256k1 event signing and
+ * `@scure/base` for Bech32 (nsec/npub) encode/decode. Never nostr-tools.
+ */
+exports.PAKSTR_NSEC_ENV = "PAKSTR_NSEC";
+exports.PAKSTR_PUBLISH_NSEC_ENV = "PAKSTR_PUBLISH_NSEC";
+exports.NSEC_HRP = "nsec";
+exports.NPUB_HRP = "npub";
+const NSEC_PAYLOAD_BYTES = 32;
+class NsecError extends Error {
+    envVar;
+    constructor(message, envVar) {
+        super(message);
+        this.envVar = envVar;
+        this.name = "NsecError";
+    }
+}
+exports.NsecError = NsecError;
+/**
+ * Decode a Bech32 `nsec1…` string into 32 raw bytes.
+ * Validates: lowercase, HRP `nsec`, 32-byte payload, nonzero secp256k1 scalar.
+ */
+function decodeNsec(value) {
+    if (typeof value !== "string" || value.length === 0) {
+        throw new NsecError("nsec is missing or empty");
+    }
+    if (value !== value.toLowerCase()) {
+        throw new NsecError("nsec must be lowercase bech32");
+    }
+    let decoded;
+    try {
+        decoded = base_1.bech32.decodeToBytes(value);
+    }
+    catch {
+        throw new NsecError("nsec is not valid bech32");
+    }
+    if (decoded.prefix !== exports.NSEC_HRP) {
+        throw new NsecError(`nsec must use the "${exports.NSEC_HRP}" human-readable part`);
+    }
+    const bytes = decoded.bytes;
+    if (bytes.length !== NSEC_PAYLOAD_BYTES) {
+        throw new NsecError("nsec payload must be exactly 32 bytes");
+    }
+    if (bytes.every(b => b === 0)) {
+        throw new NsecError("nsec must be a nonzero secret key");
+    }
+    // secp256k1 group order
+    const order = BigInt("0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141");
+    let scalar = 0n;
+    for (const b of bytes)
+        scalar = (scalar << 8n) | BigInt(b);
+    if (scalar === 0n || scalar >= order) {
+        throw new NsecError("nsec is not a valid secp256k1 private scalar");
+    }
+    return bytes;
+}
+/** Encode 32 raw bytes as a lowercase bech32 `nsec1…` string. */
+function encodeNsec(bytes) {
+    if (bytes.length !== NSEC_PAYLOAD_BYTES) {
+        throw new NsecError("secret key must be exactly 32 bytes");
+    }
+    return base_1.bech32.encodeFromBytes(exports.NSEC_HRP, bytes);
+}
+/** Encode 32 raw pubkey bytes as `npub1…`. */
+function encodeNpub(pubkey) {
+    return base_1.bech32.encodeFromBytes(exports.NPUB_HRP, pubkey);
+}
+/**
+ * Read and decode the signing nsec from `PAKSTR_NSEC`. Fails fast with a
+ * clear message if unset/empty/malformed. Never echoes the nsec value.
+ */
+function requireSigningNsec(env = process.env) {
+    const value = env[exports.PAKSTR_NSEC_ENV];
+    if (value === undefined || value.length === 0) {
+        throw new NsecError(`${exports.PAKSTR_NSEC_ENV} is required and must not be empty`, exports.PAKSTR_NSEC_ENV);
+    }
+    const bytes = decodeNsec(value);
+    return { bytes, envVar: exports.PAKSTR_NSEC_ENV };
+}
+/**
+ * Resolve the publish nsec per SPEC §4.1.
+ *
+ * @param publishKey  - value of `publish.publishKey` from pakstr.yaml:
+ *                      undefined → omitted entirely → reuse PAKSTR_NSEC;
+ *                      string (explicit) → read env var named by that string;
+ *                      null (bare key) → read PAKSTR_PUBLISH_NSEC.
+ * @param env         - environment (defaults to process.env).
+ *
+ * Returns the resolved env-var name and decoded secret. Throws NsecError
+ * (fail fast) if the resolved env var is unset/empty/malformed.
+ */
+function resolvePublishNsec(publishKey, env = process.env) {
+    if (publishKey === undefined) {
+        return requireSigningNsec(env);
+    }
+    const envVar = publishKey === null ? exports.PAKSTR_PUBLISH_NSEC_ENV : publishKey;
+    const value = env[envVar];
+    if (value === undefined || value.length === 0) {
+        throw new NsecError(`${envVar} is required for publishing and must not be empty`, envVar);
+    }
+    const bytes = decodeNsec(value);
+    return { bytes, envVar };
+}
+/** Only checks whether the resolved publish nsec env var is present & non-empty. */
+function isPublishNsecPresent(publishKey, env = process.env) {
+    if (publishKey === undefined) {
+        const v = env[exports.PAKSTR_NSEC_ENV];
+        return v !== undefined && v.length > 0;
+    }
+    const envVar = publishKey === null ? exports.PAKSTR_PUBLISH_NSEC_ENV : publishKey;
+    const v = env[envVar];
+    return v !== undefined && v.length > 0;
+}
+/** Sign a Nostr event with a secret key (32 raw bytes). Uses applesauce. */
+async function signNostrEvent(template, secret) {
+    const signer = new applesauce_signers_1.PrivateKeySigner(secret);
+    const event = await signer.signEvent({
+        kind: template.kind,
+        created_at: template.created_at,
+        tags: template.tags,
+        content: template.content,
+    });
+    return event;
+}
+/** Derive the hex npub (publisher identity) for a secret key. */
+async function getNpubHex(secret) {
+    const signer = new applesauce_signers_1.PrivateKeySigner(secret);
+    return await signer.getPublicKey();
+}
+/** Convert a hex pubkey to bech32 npub. */
+function pubkeyHexToNpub(hexPubkey) {
+    if (!/^[0-9a-f]{64}$/.test(hexPubkey)) {
+        throw new NsecError("pubkey must be 64 hex characters");
+    }
+    const bytes = Buffer.from(hexPubkey, "hex");
+    return encodeNpub(bytes);
+}

package/dist/core/pakstrConfig.js

@@ -0,0 +1,206 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ConfigError = exports.APP_ID_PATTERN = exports.PERMISSION_ALIASES = exports.PAKSTR_CONFIG_FILENAME = void 0;
+exports.sanitizeAppIdSegment = sanitizeAppIdSegment;
+exports.loadPakstrConfig = loadPakstrConfig;
+exports.validatePakstrConfig = validatePakstrConfig;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const js_yaml_1 = __importDefault(require("js-yaml"));
+/**
+ * Pakstr configuration model — the single `pakstr.yaml` file.
+ * Spec: docs/SPEC.md §3. Secrets are NEVER placed in this file.
+ */
+exports.PAKSTR_CONFIG_FILENAME = "pakstr.yaml";
+exports.PERMISSION_ALIASES = [
+    "INTERNET",
+    "CAMERA",
+    "NOTIFICATIONS",
+    "VIBRATE",
+];
+const HEX_COLOR_RE = /^#[0-9A-Fa-f]{6}$/;
+/**
+ * A valid Android / Java package name: dot-separated segments, each starting
+ * with a lower-case letter and containing only lower-case letters, digits, and
+ * underscores. Hyphens are NOT allowed (AAPT rejects them in `<manifest
+ * package>`). Used by both `pakstr init` (to sanitize inferred names) and
+ * config validation (to reject bad values).
+ */
+exports.APP_ID_PATTERN = /^[a-z][a-z0-9_]*(\.[a-z][a-z0-9_]*)*$/;
+/**
+ * Sanitize an arbitrary string (e.g. an npm package name like `my-pakstr-app`)
+ * into a valid Android package-name segment: lower-case, hyphens → underscores,
+ * strip anything other than [a-z0-9_], and prefix with `x` if it starts with a
+ * digit. Returns `null` if nothing usable remains.
+ */
+function sanitizeAppIdSegment(input) {
+    let s = input.toLowerCase().replace(/[^a-z0-9_-]/g, "");
+    s = s.replace(/-/g, "_");
+    s = s.replace(/^[^a-z]+/, ""); // drop leading non-letters (digits, underscores)
+    return s.length > 0 ? s : null;
+}
+class ConfigError extends Error {
+    configPath;
+    constructor(message, configPath) {
+        super(message);
+        this.configPath = configPath;
+        this.name = "ConfigError";
+    }
+}
+exports.ConfigError = ConfigError;
+function fail(message, configPath) {
+    throw new ConfigError(message, configPath);
+}
+/**
+ * Load and fully validate `pakstr.yaml` from `configPath` (defaults to
+ * `pakstr.yaml` in `cwd`). Returns paths resolved relative to the yaml file.
+ */
+function loadPakstrConfig(configPath) {
+    const resolvedPath = path_1.default.resolve(configPath ?? path_1.default.join(process.cwd(), exports.PAKSTR_CONFIG_FILENAME));
+    if (!fs_1.default.existsSync(resolvedPath) || !fs_1.default.lstatSync(resolvedPath).isFile()) {
+        fail(`pakstr.yaml not found: ${resolvedPath}`);
+    }
+    let raw;
+    try {
+        raw = js_yaml_1.default.load(fs_1.default.readFileSync(resolvedPath, "utf8"), {
+            filename: resolvedPath,
+        });
+    }
+    catch (error) {
+        fail(`pakstr.yaml is not valid YAML: ${error instanceof Error ? error.message : "parse error"}`, resolvedPath);
+    }
+    if (raw === null || raw === undefined || typeof raw !== "object" || Array.isArray(raw)) {
+        fail("pakstr.yaml must be a mapping with `app`, `build`, and optionally `publish` sections", resolvedPath);
+    }
+    return resolveAndValidate(raw, resolvedPath);
+}
+function validatePakstrConfig(config, configPath) {
+    resolveAndValidate(config, configPath ?? "");
+}
+function resolveAndValidate(config, configPath) {
+    const configDir = path_1.default.dirname(configPath);
+    const where = (field) => configPath ? `${field} (in ${configPath})` : field;
+    const app = config.app;
+    if (!app || typeof app !== "object")
+        fail(`Missing required section: app`, configPath);
+    // Required app fields
+    requireString(app.appId, "app.appId", configPath);
+    requireString(app.appName, "app.appName", configPath);
+    requireString(app.versionName, "app.versionName", configPath);
+    requirePositiveInt(app.versionCode, "app.versionCode", configPath);
+    // appId rules (§3.3): non-empty, ≤255 UTF-8 bytes, equals trimmed form,
+    // and must be a valid Android/Java package name (segments of lower-case
+    // alphanumerics + underscores separated by dots; no hyphens). AAPT rejects
+    // hyphens in the `package` attribute with "not a valid Android package name".
+    if (app.appId !== app.appId.trim()) {
+        fail(`${where("app.appId")} must not have leading or trailing whitespace`, configPath);
+    }
+    if (Buffer.byteLength(app.appId, "utf8") > 255) {
+        fail(`${where("app.appId")} must be ≤ 255 UTF-8 bytes`, configPath);
+    }
+    if (!exports.APP_ID_PATTERN.test(app.appId)) {
+        fail(`${where("app.appId")} must be a valid Android package name: dot-separated segments of` +
+            ` lower-case letters, digits, and underscores (no hyphens). Got: "${app.appId}"`, configPath);
+    }
+    // appName / versionName basic sanity
+    if (/[\r\n]/.test(app.appName)) {
+        fail(`${where("app.appName")} must not contain line breaks`, configPath);
+    }
+    if (/[\r\n"\\]/.test(app.versionName)) {
+        fail(`${where("app.versionName")} must not contain line breaks, quotes, or backslashes`, configPath);
+    }
+    if (app.description !== undefined && typeof app.description !== "string") {
+        fail(`${where("app.description")} must be a string`, configPath);
+    }
+    // Optional color fields
+    if (app.backgroundColor !== undefined) {
+        assertHexColor(app.backgroundColor, "app.backgroundColor", configPath);
+    }
+    if (app.splash?.background !== undefined) {
+        assertHexColor(app.splash.background, "app.splash.background", configPath);
+    }
+    if (app.splash && !app.splash.image) {
+        fail(`${where("app.splash.image")} is required when splash is configured`, configPath);
+    }
+    // Permissions
+    if (app.permissions !== undefined) {
+        if (!Array.isArray(app.permissions) || app.permissions.some(p => typeof p !== "string")) {
+            fail(`${where("app.permissions")} must be a list of strings`, configPath);
+        }
+        for (const perm of app.permissions) {
+            const normalized = perm.trim().toUpperCase();
+            if (!exports.PERMISSION_ALIASES.includes(normalized)) {
+                fail(`${where("app.permissions")} has unknown entry "${perm}"; allowed: ${exports.PERMISSION_ALIASES.join(", ")}`, configPath);
+            }
+        }
+    }
+    // build section
+    const build = config.build;
+    if (!build || typeof build !== "object")
+        fail(`Missing required section: build`, configPath);
+    requireString(build.web, "build.web", configPath);
+    const webAbs = path_1.default.resolve(configDir, build.web);
+    if (!fs_1.default.existsSync(webAbs) || !fs_1.default.lstatSync(webAbs).isDirectory()) {
+        fail(`${where("build.web")} does not exist or is not a directory: ${webAbs}`, configPath);
+    }
+    if (!fs_1.default.existsSync(path_1.default.join(webAbs, "index.html"))) {
+        fail(`${where("build.web")} must contain index.html: ${webAbs}`, configPath);
+    }
+    if (build.builder !== undefined && build.builder !== "docker") {
+        fail(`${where("build.builder")} must be "docker" (only the docker builder is specified)`, configPath);
+    }
+    const builder = build.builder ?? "docker";
+    const outDefault = path_1.default.join(configDir, "build", `${app.appId}.apk`);
+    const out = build.out ? path_1.default.resolve(configDir, build.out) : outDefault;
+    // publish section
+    const publish = config.publish;
+    let zapstoreEnabled = true;
+    let publishKey = undefined;
+    if (publish !== undefined) {
+        if (publish.zapstore !== undefined) {
+            if (publish.zapstore.enabled !== undefined && typeof publish.zapstore.enabled !== "boolean") {
+                fail(`${where("publish.zapstore.enabled")} must be a boolean`, configPath);
+            }
+            zapstoreEnabled = publish.zapstore.enabled ?? true;
+        }
+        if (publish.publishKey !== undefined) {
+            if (publish.publishKey !== null && typeof publish.publishKey !== "string") {
+                fail(`${where("publish.publishKey")} must be a string or empty (bare key)`, configPath);
+            }
+            if (typeof publish.publishKey === "string" && publish.publishKey.trim().length === 0) {
+                // Treat empty string like a bare key.
+                publishKey = null;
+            }
+            else {
+                publishKey = publish.publishKey;
+            }
+        }
+    }
+    const relay = publish?.relay ?? "wss://relay.zapstore.dev";
+    const blossom = publish?.blossom ?? "https://cdn.zapstore.dev";
+    return {
+        configDir,
+        configPath,
+        app,
+        build: { web: webAbs, out, builder },
+        publish: { zapstoreEnabled, publishKey, relay, blossom },
+    };
+}
+function requireString(value, field, configPath) {
+    if (typeof value !== "string" || value.length === 0) {
+        fail(`Missing required field: ${field}`, configPath);
+    }
+}
+function requirePositiveInt(value, field, configPath) {
+    if (typeof value !== "number" || !Number.isInteger(value) || value <= 0) {
+        fail(`${field} must be a positive integer`, configPath);
+    }
+}
+function assertHexColor(value, field, configPath) {
+    if (typeof value !== "string" || !HEX_COLOR_RE.test(value)) {
+        fail(`${field} must be a hex color of the form #RRGGBB`, configPath);
+    }
+}

package/dist/core/zapStore.js

@@ -0,0 +1,221 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MockRelayTransport = exports.WebsocketRelayTransport = exports.KIND_ASSET = exports.KIND_RELEASE = exports.KIND_APP_METADATA = exports.DEFAULT_COMMUNITY = void 0;
+exports.buildSignedPublishEvents = buildSignedPublishEvents;
+exports.publishToZapStore = publishToZapStore;
+exports.resolvePublishSecret = resolvePublishSecret;
+exports.publishEventToRelay = publishEventToRelay;
+exports.verifyPublish = verifyPublish;
+exports.queryRelayForEvent = queryRelayForEvent;
+const nostr_1 = require("./nostr");
+/** Default Zap Store catalog community (h tag). */
+exports.DEFAULT_COMMUNITY = "acfeaea6e51420e8068fac446ca9d17d7a9ef6a5d20d93894e50fee3d4902a84";
+/** NIP-82 event kinds. */
+exports.KIND_APP_METADATA = 32267;
+exports.KIND_RELEASE = 30063;
+exports.KIND_ASSET = 3063;
+/** Android platform identifier for the template's generic APK. */
+const PLATFORM = "android-arm64-v8a";
+const MIN_SDK = 28;
+const TARGET_SDK = 36;
+/** Build the three NIP-82 events (unsigned → signed) for an app release. */
+async function buildSignedPublishEvents(input) {
+    const pubkeyHex = await (0, nostr_1.getNpubHex)(input.publishNsec.bytes);
+    const npub = (0, nostr_1.pubkeyHexToNpub)(pubkeyHex);
+    const now = Math.floor(Date.now() / 1000);
+    const communities = input.communities?.length ? input.communities : [exports.DEFAULT_COMMUNITY];
+    // kind 32267 — Software Application (app metadata)
+    const appMetadata = await (0, nostr_1.signNostrEvent)({
+        kind: exports.KIND_APP_METADATA,
+        created_at: now,
+        tags: [
+            ["d", input.app.appId],
+            ["name", input.app.appName],
+            ["f", PLATFORM],
+            ...communities.map(c => ["h", c]),
+        ],
+        content: input.app.description ?? "",
+    }, input.publishNsec.bytes);
+    // kind 3063 — Software Asset (the APK)
+    const asset = await (0, nostr_1.signNostrEvent)({
+        kind: exports.KIND_ASSET,
+        created_at: now,
+        tags: [
+            ["i", input.app.appId],
+            ["x", input.apk.apkSha256],
+            ["version", input.app.versionName],
+            ["url", input.apk.blossomUrl],
+            ["m", "application/vnd.android.package-archive"],
+            ["size", String(input.apk.apkSize)],
+            ["f", PLATFORM],
+            ["min_platform_version", String(MIN_SDK)],
+            ["target_platform_version", String(TARGET_SDK)],
+            ["filename", input.apk.filename],
+            ["version_code", String(input.app.versionCode)],
+            ["apk_certificate_hash", input.apk.signerCertificateSha256],
+        ],
+        content: "",
+    }, input.publishNsec.bytes);
+    // kind 30063 — Software Release (references the asset event)
+    const release = await (0, nostr_1.signNostrEvent)({
+        kind: exports.KIND_RELEASE,
+        created_at: now,
+        tags: [
+            ["i", input.app.appId],
+            ["version", input.app.versionName],
+            ["d", `${input.app.appId}@${input.app.versionName}`],
+            ["c", "main"],
+            ["f", PLATFORM],
+            ["e", asset.id, input.target.relayUrl],
+        ],
+        content: "",
+    }, input.publishNsec.bytes);
+    return { npub, pubkeyHex, appMetadata, release, asset };
+}
+/** Publish all three events to the relay via the given transport. */
+async function publishToZapStore(input, transport) {
+    const built = await buildSignedPublishEvents(input);
+    await transport.publish(built.asset, input.target.relayUrl);
+    await transport.publish(built.release, input.target.relayUrl);
+    await transport.publish(built.appMetadata, input.target.relayUrl);
+    return {
+        npub: built.npub,
+        pubkeyHex: built.pubkeyHex,
+        appMetadataEventId: built.appMetadata.id,
+        releaseEventId: built.release.id,
+        assetEventId: built.asset.id,
+        events: {
+            appMetadata: built.appMetadata,
+            release: built.release,
+            asset: built.asset,
+        },
+        relayUrl: input.target.relayUrl,
+    };
+}
+/** Resolve the publish nsec for a loaded pakstr config per §4.1. */
+function resolvePublishSecret(publishKey, env = process.env) {
+    return (0, nostr_1.resolvePublishNsec)(publishKey, env);
+}
+/** Real websocket transport: sends ["EVENT", e] and expects ["OK", id, true, …]. */
+class WebsocketRelayTransport {
+    WebSocketCtor;
+    constructor(webSocketCtor) {
+        this.WebSocketCtor = (webSocketCtor ?? WebSocket);
+    }
+    async publish(event, relayUrl) {
+        await publishEventToRelay(this.WebSocketCtor, event, relayUrl);
+    }
+}
+exports.WebsocketRelayTransport = WebsocketRelayTransport;
+/** A no-op transport for tests / dry-runs (no network). */
+class MockRelayTransport {
+    published = [];
+    async publish(event, _relayUrl) {
+        this.published.push(event);
+    }
+}
+exports.MockRelayTransport = MockRelayTransport;
+/** Low-level: publish one event to a relay over websocket, awaiting OK. */
+function publishEventToRelay(WebSocketCtor, event, relayUrl, timeoutMs = 30000) {
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        const ws = new WebSocketCtor(relayUrl);
+        const timer = setTimeout(() => {
+            if (settled)
+                return;
+            settled = true;
+            try {
+                ws.close();
+            }
+            catch { /* ignore */ }
+            reject(new Error(`Relay publish timed out: ${relayUrl}`));
+        }, timeoutMs);
+        ws.onopen = () => {
+            ws.send(JSON.stringify(["EVENT", event]));
+        };
+        ws.onmessage = (msg) => {
+            let data;
+            try {
+                data = JSON.parse(typeof msg.data === "string" ? msg.data : msg.data.toString());
+            }
+            catch {
+                return;
+            }
+            if (Array.isArray(data) && data[0] === "OK" && data[1] === event.id) {
+                settled = true;
+                clearTimeout(timer);
+                try {
+                    ws.close();
+                }
+                catch { /* ignore */ }
+                if (data[2] === true)
+                    resolve();
+                else
+                    reject(new Error(`Relay rejected event ${event.id}: ${data[3] ?? "unknown"}`));
+            }
+        };
+        ws.onerror = (err) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            reject(new Error(`Relay connection error: ${relayUrl} ${err?.message ?? ""}`));
+        };
+    });
+}
+/**
+ * Verify a publish by querying the relay for the asset event and confirming
+ * the APK is retrievable from Blossom. Returns true if both check out.
+ */
+async function verifyPublish(input) {
+    const WebSocketCtor = input.WebSocketCtor ?? WebSocket;
+    const fetchFn = input.fetchImpl ?? fetch;
+    const eventFound = await queryRelayForEvent(WebSocketCtor, input.relayUrl, input.assetEventId);
+    const head = await fetchFn(input.blossomUrl, { method: "HEAD" });
+    return { eventFound, apkDownloadable: head.status === 200 };
+}
+/** Open a relay, send a REQ for a single event id, wait for it. */
+function queryRelayForEvent(WebSocketCtor, relayUrl, eventId, timeoutMs = 30000) {
+    return new Promise((resolve) => {
+        let settled = false;
+        const ws = new WebSocketCtor(relayUrl);
+        const timer = setTimeout(() => {
+            if (settled)
+                return;
+            settled = true;
+            try {
+                ws.close();
+            }
+            catch { /* ignore */ }
+            resolve(false);
+        }, timeoutMs);
+        ws.onopen = () => {
+            ws.send(JSON.stringify(["REQ", "verify-" + eventId.slice(0, 8), { ids: [eventId] }]));
+        };
+        ws.onmessage = (msg) => {
+            let data;
+            try {
+                data = JSON.parse(typeof msg.data === "string" ? msg.data : msg.data.toString());
+            }
+            catch {
+                return;
+            }
+            if (Array.isArray(data) && data[0] === "EVENT" && data[2]?.id === eventId) {
+                settled = true;
+                clearTimeout(timer);
+                try {
+                    ws.close();
+                }
+                catch { /* ignore */ }
+                resolve(true);
+            }
+        };
+        ws.onerror = () => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            resolve(false);
+        };
+    });
+}