pakstr 0.8.7 → 0.10.0

package/android-template/app/build.gradle.kts

@@ -21,8 +21,11 @@ android {
 
     signingConfigs {
         create("release") {
-            if (releaseRequested) {
-                val keystorePath = requireReleaseSigningValue("PAKSTR_ANDROID_KEYSTORE_PATH")
+            // Signing is optional: pakstr build produces an UNSIGNED release APK and
+            // pakstr sign signs it with apksigner afterwards. Only wire up the
+            // Gradle signingConfig when PAKSTR_ANDROID_KEYSTORE_PATH is present.
+            val keystorePath = System.getenv("PAKSTR_ANDROID_KEYSTORE_PATH")
+            if (releaseRequested && keystorePath != null && keystorePath.isNotEmpty()) {
                 val keystoreFile = File(keystorePath)
                 if (!keystoreFile.isFile) {
                     throw GradleException("Release signing keystore path is not a file")
@@ -53,7 +56,12 @@ android {
         }
 
         release {
-            signingConfig = signingConfigs.getByName("release")
+            // Only attach the signing config when a keystore was provided;
+            // otherwise emit an unsigned release APK for pakstr sign to sign.
+            val keystorePath = System.getenv("PAKSTR_ANDROID_KEYSTORE_PATH")
+            if (keystorePath != null && keystorePath.isNotEmpty()) {
+                signingConfig = signingConfigs.getByName("release")
+            }
             isMinifyEnabled = true
             isShrinkResources = true
             proguardFiles(

package/bin/cli.js

@@ -3,11 +3,16 @@
 const { runCLI } = require("../dist/cli.js");
 
 runCLI(process.argv.slice(2))
-
+  .then(() => {
+    // runCLI sets process.exitCode on user-facing errors; nothing to do here.
+  })
   .catch((err) => {
-
-    console.error("❌ CLI crashed:", err);
-
+    // Known, human-readable errors: print just the message.
+    const name = err && err.name;
+    if (name === "ConfigError" || name === "NsecError" || err && err.envVar !== undefined) {
+      console.error("Error:", err.message);
+    } else {
+      console.error("Error:", err && err.message ? err.message : err);
+    }
     process.exit(1);
-
-  });
+  });

package/dist/cli.js

@@ -5,8 +5,16 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.runCLI = runCLI;
 const build_1 = require("./commands/build");
+const sign_1 = require("./commands/sign");
+const publish_1 = require("./commands/publish");
+const run_1 = require("./commands/run");
+const init_1 = require("./commands/init");
+const dotenv_1 = require("./core/dotenv");
 const package_json_1 = __importDefault(require("../package.json"));
 async function runCLI(argv) {
+    // Auto-load a local `.env` (gitignored) so `pakstr run` works out of the box
+    // after `pakstr init`. Existing env vars (e.g. CI secrets) always win.
+    (0, dotenv_1.loadDotEnv)();
     if (argv.includes("--help") || argv.includes("-h")) {
         printHelp();
         return;
@@ -16,41 +24,70 @@ async function runCLI(argv) {
         return;
     }
     const command = argv[0];
-    const subcommand = argv[1];
-    const args = argv.slice(2);
+    const args = argv.slice(1);
     if (!command) {
         printHelp();
         return;
     }
+    const configFlag = extractFlag(args, "--config");
     switch (command) {
+        case "init":
+            (0, init_1.initCommand)({ force: args.includes("--force"), out: configFlag });
+            return;
         case "build":
-            if (subcommand === "apk") {
-                console.log("🚀 Running: build apk");
-                return await (0, build_1.buildCommand)(args);
-            }
-            console.error("❌ Missing subcommand. Use: build apk");
-            process.exitCode = 1;
+            await (0, build_1.buildCommand)(configFlag ?? undefined);
+            return;
+        case "sign":
+            await (0, sign_1.signCommand)(configFlag ?? undefined);
+            return;
+        case "publish":
+            await (0, publish_1.publishCommand)(configFlag ?? undefined, {
+                dryRun: args.includes("--dry-run"),
+                verify: args.includes("--verify"),
+                outJson: extractFlag(args, "--out-json"),
+            });
+            return;
+        case "run":
+            await (0, run_1.runCommand)(configFlag ?? undefined, {
+                verifyPublish: args.includes("--verify-publish"),
+                publishOutJson: extractFlag(args, "--publish-out-json"),
+            });
             return;
         default:
-            console.error(`❌ Unknown command: ${command}`);
+            console.error(`Unknown command: ${command}`);
             printHelp();
             process.exitCode = 1;
             return;
     }
 }
+function extractFlag(args, flag) {
+    const i = args.indexOf(flag);
+    if (i === -1)
+        return undefined;
+    return args[i + 1];
+}
 function printHelp() {
     console.log(`
-🚀 Pakstr CLI
+Pakstr — one-step nsec -> build -> sign -> publish.
 
 Usage:
+  pakstr init [--force] [--config <path>]
+  pakstr build [--config <path>]
+  pakstr sign [--config <path>]
+  pakstr publish [--config <path>] [--dry-run] [--verify] [--out-json <path>]
+  pakstr run [--config <path>] [--verify-publish] [--publish-out-json <path>]
 
-  pakstr build apk --manifest <path> --web <path> --out <path>
+  pakstr --version
+  pakstr --help
 
-Example:
+Config:
+  pakstr.yaml is the single source of truth (see docs/SPEC.md §3).
+  Secrets live in env vars, never in the config file:
+    PAKSTR_NSEC          nsec that derives the APK signing key (and publish auth by default)
+    PAKSTR_PUBLISH_NSEC  optional separate publish nsec (see publish.publishKey)
 
-  pakstr build apk \
-    --manifest app.manifest.json \
-    --web ./dist \
-    --out ./build/app.apk
+Example:
+  pakstr init
+  PAKSTR_NSEC=nsec1... pakstr run
 `);
 }

package/dist/commands/build.js

@@ -6,95 +6,70 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.buildCommand = buildCommand;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
-const child_process_1 = require("child_process");
-const generatedProjectVerification_1 = require("../android/generatedProjectVerification");
-const gradle_1 = require("../android/gradle");
-const branding_1 = require("../android/branding");
-const icon_1 = require("../android/icon");
-const permissions_1 = require("../android/permissions");
-const releaseWorkspace_1 = require("../android/releaseWorkspace");
-const splash_1 = require("../android/splash");
 const template_1 = require("../android/template");
-const buildContext_1 = require("../core/buildContext");
-const config_1 = require("../core/config");
-const releaseSigning_1 = require("../core/releaseSigning");
-const validateProject_1 = require("../core/validateProject");
+const releaseWorkspace_1 = require("../android/releaseWorkspace");
+const pakstrConfig_1 = require("../core/pakstrConfig");
+const androidProject_1 = require("../core/androidProject");
 const createRunner_1 = require("../runners/createRunner");
-const runtimeConfig_1 = require("../runtime/runtimeConfig");
-async function buildCommand(args) {
-    const ctx = (0, buildContext_1.createBuildContext)(args);
-    const config = (0, config_1.loadConfig)(process.cwd());
-    const manifest = ctx.manifest;
-    const mode = ctx.mode;
-    const appName = manifest.appName;
-    const finalPath = path_1.default.resolve(ctx.out);
-    console.log("\n🚀 Pakstr CLI");
-    console.log("📦 App:", appName);
-    console.log("🌐 Web:", ctx.dist);
+/**
+ * `pakstr build` — produce an UNSIGNED release APK at `build.out`.
+ * Spec §5.2. No nsec required.
+ */
+async function buildCommand(configPath) {
+    const config = (0, pakstrConfig_1.loadPakstrConfig)(configPath);
+    const finalPath = path_1.default.resolve(config.build.out);
+    console.log("\n🚀 pakstr build");
+    console.log("📦 App:", config.app.appName);
+    console.log("🌐 Web:", config.build.web);
     console.log("📱 Out:", finalPath);
-    console.log("🏗️ Builder:", config.builder);
-    console.log("🚀 BUILD MODE:", mode.toUpperCase());
-    (0, validateProject_1.validateProject)(ctx.dist, manifest);
+    console.log("🏗️  Builder:", config.build.builder);
     validateOutputParent(finalPath);
-    if (mode === "release") {
-        removeExistingOutput(finalPath);
-    }
-    const signingInput = mode === "release" ? (0, releaseSigning_1.readReleaseSigningInput)() : undefined;
+    removeExistingOutput(finalPath);
     const templateRoot = await (0, template_1.ensureTemplate)();
-    let workspace;
-    let signing;
+    const workspace = (0, releaseWorkspace_1.createReleaseWorkspace)(templateRoot);
     let stagedPath;
     let primaryError;
-    let cleanupError;
     try {
-        const androidRoot = mode === "release"
-            ? (workspace = (0, releaseWorkspace_1.createReleaseWorkspace)(templateRoot)).androidRoot
-            : templateRoot;
+        const androidRoot = workspace.androidRoot;
         console.log("📱 Android:", androidRoot);
-        await prepareAndroidProject(androidRoot, ctx.dist, manifest, appName, ctx.manifestDir);
-        if (signingInput) {
-            signing = (0, releaseSigning_1.createReleaseSigningContext)(signingInput);
-            signingInput.keystoreBase64 = "";
-        }
-        console.log("\n⚙️ Running build runner...");
-        const result = await (0, createRunner_1.createRunner)(config).build({
+        await (0, androidProject_1.prepareAndroidProject)({
             androidRoot,
-            mode,
+            webDir: config.build.web,
+            app: config.app,
+            configDir: config.configDir,
+        });
+        console.log("\n⚙️  Running build runner...");
+        const result = await (0, createRunner_1.createRunner)(config.build.builder).build({
+            androidRoot,
+            mode: "release",
             expectedMetadata: {
-                applicationId: manifest.appId,
-                versionCode: manifest.versionCode,
-                versionName: manifest.versionName,
-                appLabel: appName,
+                applicationId: config.app.appId,
+                versionCode: config.app.versionCode,
+                versionName: config.app.versionName,
+                appLabel: config.app.appName,
             },
-            signing,
         });
-        if (mode === "release" && !result.verification) {
-            console.warn("⚠️ Release verification evidence unavailable locally.");
-            console.warn("ℹ️ CI/Docker release verification will be used.");
+        if (!result.unsigned) {
+            throw new Error("Build runner did not produce an unsigned release APK");
         }
         stagedPath = stageArtifact(result.artifactPath, finalPath);
     }
     catch (error) {
         primaryError = error;
     }
+    let cleanupError;
     try {
-        signing?.cleanup();
+        workspace.cleanup();
     }
     catch (error) {
         cleanupError = error;
     }
-    try {
-        workspace?.cleanup();
-    }
-    catch (error) {
-        cleanupError ??= error;
-    }
     if (primaryError || cleanupError) {
         removeStagedArtifact(stagedPath);
         removeExistingOutput(finalPath);
         if (primaryError) {
             if (cleanupError) {
-                console.error("Cleanup also failed:", safeErrorMessage(cleanupError));
+                console.error("Workspace cleanup also failed:", safeErrorMessage(cleanupError));
             }
             throw primaryError;
         }
@@ -104,41 +79,17 @@ async function buildCommand(args) {
         throw new Error("Build completed without a staged APK");
     }
     publishArtifact(stagedPath, finalPath);
-    console.log("\n🚀 BUILD COMPLETE");
-    console.log("App:", appName);
-    console.log("Mode:", mode.toUpperCase());
+    console.log("\n✅ BUILD COMPLETE (unsigned)");
     console.log("📦 Output:", finalPath);
-    openFolder(finalPath);
-}
-async function prepareAndroidProject(androidRoot, distPath, manifest, appName, manifestDir) {
-    const assetsTarget = path_1.default.join(androidRoot, "app/src/main/assets/www");
-    if (!fs_1.default.existsSync(distPath)) {
-        throw new Error("Web assets not found");
-    }
-    fs_1.default.rmSync(assetsTarget, { recursive: true, force: true });
-    fs_1.default.mkdirSync(assetsTarget, { recursive: true });
-    copyFolder(distPath, assetsTarget);
-    (0, runtimeConfig_1.generateRuntimeConfig)(assetsTarget, manifest);
-    (0, gradle_1.patchGradle)(androidRoot, manifest);
-    (0, branding_1.patchAppName)(androidRoot, appName);
-    if (manifest.ui?.icon) {
-        await (0, icon_1.patchIcon)(androidRoot, manifest.ui.icon, manifest.backgroundColor ?? "#FFFFFF", manifestDir);
-    }
-    if (manifest.ui?.splash) {
-        await (0, splash_1.patchSplash)(androidRoot, manifest.ui.splash.image, manifest.ui.splash.background ?? "#FFFFFF", manifestDir);
-    }
-    (0, permissions_1.patchPermissions)(androidRoot, manifest);
-    (0, generatedProjectVerification_1.verifyGeneratedAndroidProject)(androidRoot, {
-        applicationId: manifest.appId,
-        versionCode: manifest.versionCode,
-        versionName: manifest.versionName,
-        appLabel: appName,
-    });
+    console.log("➡️  Next: pakstr sign");
+    return finalPath;
 }
 function validateOutputParent(finalPath) {
     const parent = path_1.default.dirname(finalPath);
     if (!fs_1.default.existsSync(parent) || !fs_1.default.lstatSync(parent).isDirectory()) {
-        throw new Error(`Output directory must already exist: ${parent}`);
+        // Create it per spec §5.2 ("Create the parent directory of build.out if missing").
+        fs_1.default.mkdirSync(parent, { recursive: true });
+        return;
     }
     if (fs_1.default.lstatSync(parent).isSymbolicLink()) {
         throw new Error(`Output directory must not be a symbolic link: ${parent}`);
@@ -157,7 +108,7 @@ function stageArtifact(artifactPath, finalPath) {
     fs_1.default.copyFileSync(artifactPath, stagedPath, fs_1.default.constants.COPYFILE_EXCL);
     if (fs_1.default.statSync(stagedPath).size !== fs_1.default.statSync(artifactPath).size) {
         fs_1.default.rmSync(stageDir, { recursive: true, force: true });
-        throw new Error("Staged APK size does not match verified artifact");
+        throw new Error("Staged APK size does not match built artifact");
     }
     return stagedPath;
 }
@@ -183,29 +134,6 @@ function removeStagedArtifact(stagedPath) {
         return;
     fs_1.default.rmSync(path_1.default.dirname(stagedPath), { recursive: true, force: true });
 }
-function copyFolder(src, dest) {
-    for (const entry of fs_1.default.readdirSync(src, { withFileTypes: true })) {
-        const srcPath = path_1.default.join(src, entry.name);
-        const destPath = path_1.default.join(dest, entry.name);
-        if (entry.isDirectory()) {
-            fs_1.default.mkdirSync(destPath, { recursive: true });
-            copyFolder(srcPath, destPath);
-        }
-        else {
-            fs_1.default.copyFileSync(srcPath, destPath);
-        }
-    }
-}
-function openFolder(filePath) {
-    if (process.platform !== "darwin" || process.env.CI)
-        return;
-    try {
-        (0, child_process_1.execFileSync)("open", [path_1.default.dirname(filePath)], { stdio: "ignore" });
-    }
-    catch {
-        // Opening the output folder is optional.
-    }
-}
 function safeErrorMessage(error) {
     return error instanceof Error ? error.message : "unknown cleanup error";
 }

package/dist/commands/init.js

@@ -0,0 +1,238 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.initCommand = initCommand;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const crypto_1 = require("crypto");
+const pakstrConfig_1 = require("../core/pakstrConfig");
+const nostr_1 = require("../core/nostr");
+/**
+ * `pakstr init` — generate `pakstr.yaml` in the current directory.
+ * Spec §5.1. Infers defaults from `package.json`. Never silently overwrites.
+ */
+const HEADER = `# pakstr.yaml — one file, one command, one APK.
+# Generated by \`pakstr init\`. Edit freely.
+#
+# ⚠️  Keep your nsec OUT of this file. \`pakstr init\` wrote a local dev nsec
+# to .env (gitignored). For real releases, put ${nostr_1.PAKSTR_NSEC_ENV} in your CI
+# secret manager — reuse the same nsec so updates install over prior APKs.
+# WARNING: ${nostr_1.PAKSTR_NSEC_ENV} is a production release-signing root secret. Anyone who
+# has it can derive every app identity for every known appId. Losing it breaks
+# update continuity. It cannot rotate the signer of an already-published app.
+`;
+async function initCommand(options = {}) {
+    const configPath = path_1.default.resolve(options.out ?? path_1.default.join(process.cwd(), pakstrConfig_1.PAKSTR_CONFIG_FILENAME));
+    if (fs_1.default.existsSync(configPath) && !options.force) {
+        throw new Error(`${configPath} already exists. Use --force to overwrite, or remove it first.`);
+    }
+    const pkg = readPackageJson();
+    const { appId, sanitized: appIdSanitized } = inferAppId(pkg);
+    const appName = inferAppName(pkg) ?? appNameFromAppId(appId);
+    const versionName = (pkg && typeof pkg.version === "string" ? pkg.version : "1.0.0");
+    const versionCode = 1;
+    const web = inferWebDir();
+    const out = `./build/${appId}.apk`;
+    const yaml = renderConfig({
+        appId,
+        appName,
+        versionName,
+        versionCode,
+        description: pkg && typeof pkg.description === "string" ? pkg.description : "",
+        web,
+        out,
+    });
+    fs_1.default.writeFileSync(configPath, yaml, "utf8");
+    console.log(`✅ Wrote ${configPath}`);
+    if (appIdSanitized) {
+        console.log(`⚠️  Your package.json name contains characters that aren't valid in an Android package`);
+        console.log(`    name (e.g. hyphens). pakstr sanitized it to appId "${appId}". Edit`);
+        console.log(`    ${pakstrConfig_1.PAKSTR_CONFIG_FILENAME} if you'd prefer a different value.`);
+    }
+    // Generate a fresh dev nsec into a gitignored `.env` so `pakstr run` works
+    // locally with no manual setup. Never overwrites an existing PAKSTR_NSEC.
+    const { nsec: devNsec, status: nsecStatus } = ensureDevNsec();
+    ensureGitIgnoresEnv();
+    // Write zapstore.yaml (relay-side publisher whitelist) with the publisher
+    // npub derived from the dev nsec. Never overwrites an existing one.
+    const zapstoreStatus = await ensureZapstoreYaml(devNsec);
+    console.log("");
+    console.log("➡️  Next: run pakstr run");
+    if (nsecStatus === "generated") {
+        console.log(`    A fresh ${nostr_1.PAKSTR_NSEC_ENV} was written to .env (gitignored) for local dev.`);
+    }
+    else if (nsecStatus === "present") {
+        console.log(`    ${nostr_1.PAKSTR_NSEC_ENV} already in .env — left untouched.`);
+    }
+    if (zapstoreStatus === "generated") {
+        console.log("    zapstore.yaml written (relay-side publisher whitelist). Commit it.");
+    }
+    else if (zapstoreStatus === "present") {
+        console.log("    zapstore.yaml already exists — left untouched.");
+    }
+    console.log("");
+    console.log(`    For real releases, put the SAME ${nostr_1.PAKSTR_NSEC_ENV} in your CI secret manager`);
+    console.log("    (reusing it is what lets an update install over the previous APK).");
+    console.log(`    ${nostr_1.PAKSTR_NSEC_ENV} is a release-signing root secret: anyone who has it can`);
+    console.log("    sign updates for every app whose appId they know. Keep it safe.");
+}
+/** Generate a dev nsec into .env if none is present there. Returns the nsec string. */
+function ensureDevNsec() {
+    const envPath = path_1.default.join(process.cwd(), ".env");
+    const existing = fs_1.default.existsSync(envPath)
+        ? fs_1.default.readFileSync(envPath, "utf8")
+        : "";
+    if (containsPakstrNsec(existing)) {
+        const m = existing.match(new RegExp(`^${nostr_1.PAKSTR_NSEC_ENV}=(\\S+)`, "m"));
+        return { nsec: m?.[1] ?? "", status: "present" };
+    }
+    const nsec = (0, nostr_1.encodeNsec)((0, crypto_1.randomBytes)(32));
+    const line = `${nostr_1.PAKSTR_NSEC_ENV}=${nsec}\n`;
+    const header = existing.length === 0 ? "# Local development secrets — never commit this file.\n" : "";
+    fs_1.default.writeFileSync(envPath, header + (existing.length ? "\n" + line : line), {
+        flag: existing.length === 0 ? "wx" : "a",
+    });
+    return { nsec, status: "generated" };
+}
+function containsPakstrNsec(envText) {
+    return new RegExp(`^${nostr_1.PAKSTR_NSEC_ENV}=`, "m").test(envText);
+}
+/** Ensure `.env` is listed in `.gitignore` so the nsec is never committed. */
+function ensureGitIgnoresEnv() {
+    const gitignorePath = path_1.default.join(process.cwd(), ".gitignore");
+    const existing = fs_1.default.existsSync(gitignorePath)
+        ? fs_1.default.readFileSync(gitignorePath, "utf8")
+        : "";
+    if (containsEnvEntry(existing))
+        return;
+    const addition = existing.length === 0 || existing.endsWith("\n")
+        ? ".env\n"
+        : "\n.env\n";
+    fs_1.default.writeFileSync(gitignorePath, existing + addition, {
+        flag: existing.length === 0 ? "wx" : "a",
+    });
+}
+function containsEnvEntry(gitignoreText) {
+    return gitignoreText
+        .split(/\r?\n/)
+        .some(line => line.trim() === ".env" || line.trim().startsWith(".env"));
+}
+/**
+ * Write `zapstore.yaml` (relay-side publisher whitelist) with the publisher
+ * npub derived from the dev nsec. Never overwrites an existing file.
+ * Returns what happened.
+ */
+async function ensureZapstoreYaml(devNsec) {
+    const zapstorePath = path_1.default.join(process.cwd(), "zapstore.yaml");
+    if (fs_1.default.existsSync(zapstorePath))
+        return "present";
+    let npub = "";
+    if (devNsec) {
+        try {
+            const secret = (0, nostr_1.decodeNsec)(devNsec);
+            const hex = await (0, nostr_1.getNpubHex)(secret);
+            npub = (0, nostr_1.pubkeyHexToNpub)(hex);
+        }
+        catch {
+            // If we can't derive the npub, write the file with a placeholder so the
+            // user knows to fill it in.
+            npub = "";
+        }
+    }
+    const content = `# zapstore.yaml — relay-side publisher whitelist (NIP-82 / Zap Store).
+# The relay fetches this file from your repo to verify the publisher's pubkey
+# is authorized for this repository. Generated by \`pakstr init\`.
+#
+# \`pubkey\` is the npub matching the nsec used to publish (PAKSTR_NSEC, or
+# PAKSTR_PUBLISH_NSEC if you set publish.publishKey). Replace it with your
+# real publisher npub for production releases if different from your dev nsec.
+
+repository: # TODO: set to your app's source code repository URL
+pubkey: ${npub || "# TODO: set to your publisher npub (npub1...)"}
+`;
+    fs_1.default.writeFileSync(zapstorePath, content, "utf8");
+    return "generated";
+}
+function renderConfig(c) {
+    const perms = `    [${pakstrConfig_1.PERMISSION_ALIASES.map(p => `"${p}"`).join(", ")}]`;
+    return `${HEADER}
+app:
+  appId: ${c.appId}        # REQUIRED. Java package id; also feeds key derivation.
+  appName: ${escapeYamlScalar(c.appName)}                  # REQUIRED. Launcher label.
+  versionName: "${c.versionName}"           # REQUIRED. Human-readable version.
+  versionCode: ${c.versionCode}                 # REQUIRED. Monotonic integer.
+  description: ${c.description === "" ? '""' : escapeYamlScalar(c.description)}                # OPTIONAL.
+  # icon: ./icon.png               # OPTIONAL. Resolved relative to this file.
+  # splash:                          # OPTIONAL.
+  #   image: ./splash.png
+  #   background: "#0f0f17"
+  # backgroundColor: "#0f0f17"    # OPTIONAL. Launcher icon background.
+  # permissions: ${perms}   # OPTIONAL. Aliases (case-insensitive): ${pakstrConfig_1.PERMISSION_ALIASES.join(", ")}.
+
+build:
+  web: ${c.web}                    # REQUIRED. Built web assets (must contain index.html).
+  out: ${c.out}          # OPTIONAL. Default ./build/<appId>.apk
+  builder: docker               # Only "docker" is specified.
+
+publish:
+  zapstore:
+    enabled: true               # Default true when publish is present.
+  # publishKey: PAKSTR_PUBLISH_NSEC  # OPTIONAL. Omit to reuse ${nostr_1.PAKSTR_NSEC_ENV} for publishing.
+`;
+}
+function escapeYamlScalar(value) {
+    // Keep it simple: quote if it contains anything that looks YAML-special.
+    if (value === "" || /[:#\-?*&!|>'"%@\`\[\]{}]/.test(value) || /^\s|\s$/.test(value)) {
+        return `"${value.replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`;
+    }
+    return value;
+}
+function readPackageJson() {
+    const p = path_1.default.join(process.cwd(), "package.json");
+    if (!fs_1.default.existsSync(p))
+        return null;
+    try {
+        return JSON.parse(fs_1.default.readFileSync(p, "utf8"));
+    }
+    catch {
+        return null;
+    }
+}
+function inferAppId(pkg) {
+    const name = pkg && typeof pkg.name === "string" ? pkg.name : null;
+    if (!name)
+        return { appId: "dev.pakstr.myapp", sanitized: false };
+    // Split the npm name into segments (handling @scope/name), sanitize each,
+    // and track whether any segment changed so we can warn the user.
+    const raw = name.startsWith("@") ? name.slice(1).split("/") : [name];
+    const segments = raw.map(s => s.toLowerCase());
+    const sanitized = segments.map(s => (0, pakstrConfig_1.sanitizeAppIdSegment)(s) ?? "");
+    const changed = segments.some((orig, i) => sanitized[i] !== orig);
+    const valid = sanitized.filter(s => s.length > 0);
+    const appId = valid.length > 0 ? `dev.pakstr.${valid.join(".")}` : "dev.pakstr.myapp";
+    // Final guard: if it still doesn't match the pattern, fall back.
+    return pakstrConfig_1.APP_ID_PATTERN.test(appId)
+        ? { appId, sanitized: changed }
+        : { appId: "dev.pakstr.myapp", sanitized: true };
+}
+function inferAppName(pkg) {
+    const name = pkg && typeof pkg.name === "string" ? pkg.name : null;
+    if (!name)
+        return null;
+    const unscoped = name.replace(/^@[^/]+\//, "");
+    return unscoped || null;
+}
+function appNameFromAppId(appId) {
+    const last = appId.split(".").pop() ?? appId;
+    return last.charAt(0).toUpperCase() + last.slice(1);
+}
+function inferWebDir() {
+    const cwd = process.cwd();
+    if (fs_1.default.existsSync(path_1.default.join(cwd, "dist", "index.html")))
+        return "./dist";
+    if (fs_1.default.existsSync(path_1.default.join(cwd, "build", "index.html")))
+        return "./build";
+    return "./dist";
+}