pakstr 0.8.7 → 0.9.0

package/dist/commands/publish.js

@@ -0,0 +1,137 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.publishCommand = publishCommand;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const pakstrConfig_1 = require("../core/pakstrConfig");
+const zapStore_1 = require("../core/zapStore");
+const blossom_1 = require("../core/blossom");
+/**
+ * `pakstr publish` — upload the signed APK to Blossom and publish NIP-82
+ * events (32267/30063/3063) to the configured relay. Spec §5.4 / §8.
+ *
+ * Requires that `pakstr build` + `pakstr sign` have already run (the signed
+ * APK at build.out, plus its `.signer-sha256` sidecar).
+ *
+ * `--dry-run` skips network + disk: it builds the events with a stub blossom
+ * descriptor and a mock relay transport, so you can preview exactly what would
+ * be published without an APK or network.
+ */
+async function publishCommand(configPath, options = {}) {
+    const config = (0, pakstrConfig_1.loadPakstrConfig)(configPath);
+    const apkPath = path_1.default.resolve(config.build.out);
+    const publishNsec = (0, zapStore_1.resolvePublishSecret)(config.publish.publishKey, process.env);
+    console.log("\n📤 pakstr publish" + (options.dryRun ? " (dry-run)" : ""));
+    console.log("App:", config.app.appName, `(${config.app.appId})`);
+    console.log("Publishing as:", publishNsec.envVar);
+    console.log("Relay:", config.publish.relay);
+    console.log("Blossom:", config.publish.blossom);
+    let blossomUrl;
+    let apkSha256;
+    let apkSize;
+    let signerCertificateSha256;
+    let filename;
+    if (options.dryRun) {
+        // No network, no APK required. Synthesize a stub descriptor so the events
+        // can still be built and printed for preview.
+        apkSha256 = "0".repeat(64);
+        apkSize = 0;
+        blossomUrl = `${config.publish.blossom.replace(/\/$/, "")}/${apkSha256}`;
+        signerCertificateSha256 = "0".repeat(64);
+        filename = path_1.default.basename(apkPath);
+        console.log("📦 (dry-run) Blossom URL:", blossomUrl);
+    }
+    else {
+        if (!fs_1.default.existsSync(apkPath) || !fs_1.default.lstatSync(apkPath).isFile()) {
+            throw new Error(`Signed APK not found at ${apkPath}. Run \`pakstr build\` and \`pakstr sign\` first.`);
+        }
+        const certShaPath = `${apkPath}.signer-sha256`;
+        if (!fs_1.default.existsSync(certShaPath)) {
+            throw new Error(`Signer certificate sidecar not found: ${certShaPath}. Run \`pakstr sign\` first.`);
+        }
+        signerCertificateSha256 = fs_1.default.readFileSync(certShaPath, "utf8").trim();
+        const blossom = await (0, blossom_1.uploadToBlossom)({
+            serverUrl: config.publish.blossom,
+            filePath: apkPath,
+            secret: publishNsec.bytes,
+            fetchImpl: options.blossomFetch,
+        });
+        blossomUrl = blossom.url;
+        apkSha256 = blossom.sha256;
+        apkSize = blossom.size;
+        filename = path_1.default.basename(apkPath);
+        console.log("📦 Uploaded to Blossom:", blossom.url);
+        console.log("   APK SHA-256:", blossom.sha256, "| size:", blossom.size);
+    }
+    // Build + publish the NIP-82 events.
+    const transport = options.transport ?? (options.dryRun ? new zapStore_1.MockRelayTransport() : new zapStore_1.WebsocketRelayTransport());
+    const result = await (0, zapStore_1.publishToZapStore)({
+        app: {
+            appId: config.app.appId,
+            appName: config.app.appName,
+            versionName: config.app.versionName,
+            versionCode: config.app.versionCode,
+            description: config.app.description,
+        },
+        apk: {
+            apkSha256,
+            apkSize,
+            blossomUrl,
+            signerCertificateSha256,
+            filename,
+        },
+        publishNsec,
+        target: { relayUrl: config.publish.relay },
+    }, transport);
+    console.log(options.dryRun ? "✅ PUBLISHED (dry-run — no network)" : "✅ PUBLISHED");
+    console.log("🪪 Publisher npub:", result.npub);
+    console.log("🧾 Asset event:", result.assetEventId);
+    console.log("🧾 Release event:", result.releaseEventId);
+    console.log("🧾 App metadata event:", result.appMetadataEventId);
+    console.log("🔗 Blossom URL:", blossomUrl);
+    console.log("📡 Relay:", config.publish.relay);
+    if (options.verify && !options.dryRun) {
+        const { eventFound, apkDownloadable } = await (0, zapStore_1.verifyPublish)({
+            app: {
+                appId: config.app.appId,
+                appName: config.app.appName,
+                versionName: config.app.versionName,
+                versionCode: config.app.versionCode,
+            },
+            assetEventId: result.assetEventId,
+            relayUrl: config.publish.relay,
+            blossomUrl,
+        });
+        console.log(`🔎 Verify: event on relay=${eventFound}, apk on blossom=${apkDownloadable}`);
+        if (!eventFound || !apkDownloadable) {
+            throw new Error("Publish verification failed");
+        }
+    }
+    if (options.outJson) {
+        const summary = {
+            appId: config.app.appId,
+            appName: config.app.appName,
+            versionName: config.app.versionName,
+            versionCode: config.app.versionCode,
+            npub: result.npub,
+            pubkeyHex: result.pubkeyHex,
+            relayUrl: config.publish.relay,
+            blossomServer: config.publish.blossom,
+            blossomUrl,
+            apkSha256,
+            apkSize,
+            signerCertificateSha256,
+            assetEventId: result.assetEventId,
+            releaseEventId: result.releaseEventId,
+            appMetadataEventId: result.appMetadataEventId,
+            publishedAt: new Date().toISOString(),
+            dryRun: !!options.dryRun,
+        };
+        fs_1.default.writeFileSync(options.outJson, JSON.stringify(summary, null, 2) + "\n", "utf8");
+        console.log("📝 Publish summary written to:", options.outJson);
+    }
+    return result;
+}

package/dist/commands/run.js

@@ -0,0 +1,95 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runCommand = runCommand;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const pakstrConfig_1 = require("../core/pakstrConfig");
+const nostr_1 = require("../core/nostr");
+const build_1 = require("./build");
+const sign_1 = require("./sign");
+const publish_1 = require("./publish");
+/**
+ * `pakstr run` — build → sign → publish. Spec §5.5 / §6.
+ *
+ * Each step is atomic and fail-fast (§7). The signed APK at build.out is
+ * preserved on a publish failure; only ephemeral/derived material is cleaned
+ * up. `init` is NOT part of `run`.
+ */
+async function runCommand(configPath, options = {}) {
+    // Step 1: load & validate config, pre-validate nsecs.
+    const config = (0, pakstrConfig_1.loadPakstrConfig)(configPath);
+    // Verify PAKSTR_NSEC present (fail fast before any work).
+    (0, nostr_1.requireSigningNsec)(process.env);
+    // Pre-validate the publish nsec if publishing is enabled (§6 step 1).
+    if (config.publish.zapstoreEnabled) {
+        if (!(0, nostr_1.isPublishNsecPresent)(config.publish.publishKey, process.env)) {
+            const envVar = config.publish.publishKey === undefined
+                ? "PAKSTR_NSEC"
+                : config.publish.publishKey === null
+                    ? "PAKSTR_PUBLISH_NSEC"
+                    : config.publish.publishKey;
+            throw new Error(`${envVar} is required for publishing and must not be empty ` +
+                `(publish.zapstore.enabled is true). Pre-validation failed before any build work.`);
+        }
+    }
+    console.log("\n🚀 pakstr run");
+    console.log("App:", config.app.appName, `(${config.app.appId})`);
+    console.log("Version:", config.app.versionName, `(${config.app.versionCode})`);
+    console.log("Web:", config.build.web);
+    console.log("Out:", path_1.default.resolve(config.build.out));
+    console.log("Publish:", config.publish.zapstoreEnabled ? "enabled" : "disabled");
+    // Step 3: build the unsigned APK.
+    console.log("\n— Step 1/3: build —");
+    await (0, build_1.buildCommand)(config.configPath || undefined);
+    // Step 4: sign the APK.
+    console.log("\n— Step 2/3: sign —");
+    await (0, sign_1.signCommand)(config.configPath || undefined);
+    // Step 5: publish to Zap Store (unless disabled).
+    if (config.publish.zapstoreEnabled) {
+        console.log("\n— Step 3/3: publish —");
+        await (0, publish_1.publishCommand)(config.configPath || undefined, {
+            verify: options.verifyPublish,
+            outJson: options.publishOutJson,
+        });
+    }
+    else {
+        console.log("\nPublish disabled (publish.zapstore.enabled: false). Stopping after sign.");
+    }
+    // Step 6: cleanup. The signed APK at build.out is the artifact and is kept.
+    // Derived signing material is cleaned up inside the sign runner (tmpfs).
+    verifyNoLeakedKeystores(config);
+    console.log("\n✅ pakstr run complete");
+    console.log("Signed APK:", path_1.default.resolve(config.build.out));
+}
+/** Best-effort: ensure no derived .p12 keystore leaked onto disk (§7). */
+function verifyNoLeakedKeystores(config) {
+    const buildDir = path_1.default.join(config.configDir, "build");
+    if (!fs_1.default.existsSync(buildDir))
+        return;
+    const walk = (dir) => {
+        const found = [];
+        for (const entry of fs_1.default.readdirSync(dir, { withFileTypes: true })) {
+            const p = path_1.default.join(dir, entry.name);
+            if (entry.isDirectory())
+                found.push(...walk(p));
+            else if (entry.name.endsWith(".p12") || entry.name.endsWith(".keystore"))
+                found.push(p);
+        }
+        return found;
+    };
+    const leaked = walk(buildDir);
+    if (leaked.length > 0) {
+        for (const f of leaked) {
+            try {
+                fs_1.default.rmSync(f, { force: true });
+            }
+            catch {
+                /* ignore */
+            }
+        }
+        throw new Error(`Derived keystore material leaked onto disk: ${leaked.join(", ")}`);
+    }
+}

package/dist/commands/sign.js

@@ -0,0 +1,41 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.signCommand = signCommand;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const pakstrConfig_1 = require("../core/pakstrConfig");
+const nostr_1 = require("../core/nostr");
+const DockerSignRunner_1 = require("../runners/DockerSignRunner");
+/**
+ * `pakstr sign` — sign the unsigned APK at `build.out` with the key derived
+ * from `PAKSTR_NSEC` + `app.appId`. Overwrites `build.out` with the signed APK.
+ * Spec §5.3.
+ */
+async function signCommand(configPath) {
+    const config = (0, pakstrConfig_1.loadPakstrConfig)(configPath);
+    const unsignedApkPath = path_1.default.resolve(config.build.out);
+    if (!fs_1.default.existsSync(unsignedApkPath) || !fs_1.default.lstatSync(unsignedApkPath).isFile()) {
+        throw new Error(`Unsigned APK not found at ${unsignedApkPath}. Run \`pakstr build\` first.`);
+    }
+    const nsec = (0, nostr_1.requireSigningNsec)(process.env);
+    console.log("\n🔐 pakstr sign");
+    console.log("📦 Unsigned:", unsignedApkPath);
+    console.log("🔑 Deriving signing key from PAKSTR_NSEC +", config.app.appId);
+    const runner = new DockerSignRunner_1.DockerSignRunner();
+    const result = await runner.sign({
+        unsignedApkPath,
+        signedApkPath: unsignedApkPath,
+        appId: config.app.appId,
+        nsec: nsec.bytes,
+    });
+    // Write the signer certificate SHA-256 to a sidecar so `pakstr publish`/`run`
+    // can include it in the Zap Store asset event (apk_certificate_hash).
+    fs_1.default.writeFileSync(`${unsignedApkPath}.signer-sha256`, result.signerSha256, "utf8");
+    console.log("✅ SIGNED");
+    console.log("📦 Signed APK:", result.signedApkPath);
+    console.log("🧾 Signer certificate SHA-256:", result.signerSha256);
+    return result;
+}

package/dist/core/androidProject.js

@@ -0,0 +1,70 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.prepareAndroidProject = prepareAndroidProject;
+exports.generateRuntimeConfig = generateRuntimeConfig;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const generatedProjectVerification_1 = require("../android/generatedProjectVerification");
+const gradle_1 = require("../android/gradle");
+const branding_1 = require("../android/branding");
+const icon_1 = require("../android/icon");
+const permissions_1 = require("../android/permissions");
+const splash_1 = require("../android/splash");
+/**
+ * Copy built web assets into the Android template and patch identity/branding.
+ * Spec §5.2. Creates `assets/www/` from `webDir`, patches Gradle, app name,
+ * icon, splash, and permissions, then verifies the generated project.
+ */
+async function prepareAndroidProject(opts) {
+    const { androidRoot, webDir, app, configDir } = opts;
+    const assetsTarget = path_1.default.join(androidRoot, "app/src/main/assets/www");
+    if (!fs_1.default.existsSync(webDir)) {
+        throw new Error(`Web assets not found: ${webDir}`);
+    }
+    fs_1.default.rmSync(assetsTarget, { recursive: true, force: true });
+    fs_1.default.mkdirSync(assetsTarget, { recursive: true });
+    copyFolder(webDir, assetsTarget);
+    generateRuntimeConfig(assetsTarget);
+    (0, gradle_1.patchGradle)(androidRoot, app);
+    (0, branding_1.patchAppName)(androidRoot, app.appName);
+    if (app.icon) {
+        await (0, icon_1.patchIcon)(androidRoot, app.icon, app.backgroundColor ?? "#FFFFFF", configDir);
+    }
+    if (app.splash?.image) {
+        await (0, splash_1.patchSplash)(androidRoot, app.splash.image, app.splash.background ?? "#FFFFFF", configDir);
+    }
+    (0, permissions_1.patchPermissions)(androidRoot, app);
+    (0, generatedProjectVerification_1.verifyGeneratedAndroidProject)(androidRoot, {
+        applicationId: app.appId,
+        versionCode: app.versionCode,
+        versionName: app.versionName,
+        appLabel: app.appName,
+    });
+}
+/**
+ * Generate the runtime config written into the packaged web assets.
+ * Pakstr's config model has no runtime/debug fields, so this emits an empty
+ * config (kept for template compatibility).
+ */
+function generateRuntimeConfig(webRoot) {
+    const runtime = {};
+    const jsContent = `window.PAKSTR_CONFIG = ${JSON.stringify(runtime, null, 2)};\n`;
+    fs_1.default.writeFileSync(path_1.default.join(webRoot, "pakstr-config.js"), jsContent.trim());
+    fs_1.default.writeFileSync(path_1.default.join(webRoot, "pakstr-runtime.json"), JSON.stringify(runtime, null, 2));
+}
+function copyFolder(src, dest) {
+    for (const entry of fs_1.default.readdirSync(src, { withFileTypes: true })) {
+        const srcPath = path_1.default.join(src, entry.name);
+        const destPath = path_1.default.join(dest, entry.name);
+        if (entry.isDirectory()) {
+            fs_1.default.mkdirSync(destPath, { recursive: true });
+            copyFolder(srcPath, destPath);
+        }
+        else {
+            fs_1.default.copyFileSync(srcPath, destPath);
+        }
+    }
+}

package/dist/core/appIdentity.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.asAndroidAppIdentity = asAndroidAppIdentity;
+/** A `PakstrApp` is structurally an `AndroidAppIdentity`. */
+function asAndroidAppIdentity(app) {
+    return app;
+}

package/dist/core/blossom.js

@@ -0,0 +1,122 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BlossomError = void 0;
+exports.hashFile = hashFile;
+exports.uploadToBlossom = uploadToBlossom;
+exports.npubHexToBech32 = npubHexToBech32;
+const crypto_1 = require("crypto");
+const fs_1 = __importDefault(require("fs"));
+const nostr_1 = require("./nostr");
+/**
+ * Blossom (BUD-02 / BUD-11) blob upload.
+ *
+ * Uploads a file to a Blossom server with a Nostr kind-24242 authorization
+ * event signed by the supplied secret key. Returns the blob descriptor
+ * (`url`, `sha256`, `size`, `type`).
+ *
+ * Reference: https://github.com/hzrd149/blossom (BUD-02 upload, BUD-11 auth).
+ */
+const DEFAULT_CONTENT_TYPE = "application/vnd.android.package-archive";
+const AUTH_TTL_SECONDS = 5 * 60;
+class BlossomError extends Error {
+    status;
+    constructor(message, status) {
+        super(message);
+        this.status = status;
+        this.name = "BlossomError";
+    }
+}
+exports.BlossomError = BlossomError;
+/** Compute the SHA-256 of a file (hex). */
+function hashFile(filePath) {
+    const size = fs_1.default.statSync(filePath).size;
+    const hash = (0, crypto_1.createHash)("sha256");
+    const fd = fs_1.default.openSync(filePath, "r");
+    try {
+        const buf = Buffer.alloc(64 * 1024);
+        let bytes = 0;
+        while ((bytes = fs_1.default.readSync(fd, buf, 0, buf.length, null)) !== 0) {
+            hash.update(buf.subarray(0, bytes));
+        }
+    }
+    finally {
+        fs_1.default.closeSync(fd);
+    }
+    return { sha256: hash.digest("hex"), size };
+}
+async function uploadToBlossom(opts) {
+    const fetchFn = opts.fetchImpl ?? fetch;
+    const contentType = opts.contentType ?? DEFAULT_CONTENT_TYPE;
+    const serverUrl = opts.serverUrl.replace(/\/$/, "");
+    const { sha256, size } = hashFile(opts.filePath);
+    // 1. HEAD /<sha256> — skip upload if the blob already exists.
+    const head = await fetchFn(`${serverUrl}/${sha256}`, { method: "HEAD" });
+    if (head.status === 200) {
+        return {
+            url: `${serverUrl}/${sha256}`,
+            sha256,
+            size,
+            type: contentType,
+        };
+    }
+    // 2. Build + sign the kind-24242 Blossom auth event.
+    const npubHex = await (0, nostr_1.getNpubHex)(opts.secret);
+    const expiration = Math.floor(Date.now() / 1000) + AUTH_TTL_SECONDS;
+    const authEvent = await (0, nostr_1.signNostrEvent)({
+        kind: 24242,
+        created_at: Math.floor(Date.now() / 1000),
+        tags: [
+            ["t", "upload"],
+            ["x", sha256],
+            ["expiration", String(expiration)],
+        ],
+        content: `Upload ${sha256}`,
+    }, opts.secret);
+    // 3. PUT /upload with the signed auth event in the Authorization header.
+    const authHeader = "Nostr " + Buffer.from(JSON.stringify(authEvent)).toString("base64");
+    const body = fs_1.default.readFileSync(opts.filePath);
+    const res = await fetchFn(`${serverUrl}/upload`, {
+        method: "PUT",
+        headers: {
+            Authorization: authHeader,
+            "Content-Type": contentType,
+            "X-SHA-256": sha256,
+            "Content-Length": String(size),
+        },
+        body,
+    });
+    if (res.status !== 200 && res.status !== 201) {
+        let detail = "";
+        try {
+            detail = await res.text();
+        }
+        catch {
+            /* ignore */
+        }
+        throw new BlossomError(`Blossom upload failed: HTTP ${res.status}${detail ? ` — ${detail.slice(0, 200)}` : ""}`, res.status);
+    }
+    // 4. Parse the blob descriptor (fall back to a constructed one).
+    const text = await res.text();
+    try {
+        const descriptor = JSON.parse(text);
+        if (!descriptor.url)
+            descriptor.url = `${serverUrl}/${sha256}`;
+        if (!descriptor.sha256)
+            descriptor.sha256 = sha256;
+        if (!descriptor.size)
+            descriptor.size = size;
+        if (!descriptor.type)
+            descriptor.type = contentType;
+        return descriptor;
+    }
+    catch {
+        return { url: `${serverUrl}/${sha256}`, sha256, size, type: contentType };
+    }
+}
+/** Convenience: hex npub → bech32 npub string for display. */
+function npubHexToBech32(npubHex) {
+    return (0, nostr_1.pubkeyHexToNpub)(npubHex);
+}

package/dist/core/dotenv.js

@@ -0,0 +1,51 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadDotEnv = loadDotEnv;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+/**
+ * Minimal `.env` loader for local development convenience.
+ *
+ * Parses a `.env` file (simple `KEY=VALUE` lines) and merges values into
+ * `process.env` WITHOUT overriding variables that are already set, so CI
+ * secret-manager values and explicit exports always win.
+ *
+ * This is purely a local-dev ergonomic: pakstr still reads secrets only from
+ * `process.env`. The `.env` file is gitignored (see `pakstr init`).
+ *
+ * Silently no-ops when the file is missing.
+ */
+function loadDotEnv(dir = process.cwd()) {
+    const envPath = path_1.default.join(dir, ".env");
+    if (!fs_1.default.existsSync(envPath) || !fs_1.default.lstatSync(envPath).isFile()) {
+        return [];
+    }
+    const loaded = [];
+    const text = fs_1.default.readFileSync(envPath, "utf8");
+    for (const rawLine of text.split(/\r?\n/)) {
+        const line = rawLine.trim();
+        if (line.length === 0 || line.startsWith("#"))
+            continue;
+        const eq = line.indexOf("=");
+        if (eq <= 0)
+            continue;
+        const key = line.slice(0, eq).trim();
+        if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key))
+            continue;
+        let value = line.slice(eq + 1).trim();
+        // Strip surrounding matching quotes.
+        if ((value.startsWith('"') && value.endsWith('"')) ||
+            (value.startsWith("'") && value.endsWith("'"))) {
+            value = value.slice(1, -1);
+        }
+        // Never override an existing env var (CI secrets / explicit exports win).
+        if (process.env[key] === undefined) {
+            process.env[key] = value;
+            loaded.push(key);
+        }
+    }
+    return loaded;
+}

package/dist/core/nostr.js

@@ -0,0 +1,153 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NsecError = exports.NPUB_HRP = exports.NSEC_HRP = exports.PAKSTR_PUBLISH_NSEC_ENV = exports.PAKSTR_NSEC_ENV = void 0;
+exports.decodeNsec = decodeNsec;
+exports.encodeNsec = encodeNsec;
+exports.encodeNpub = encodeNpub;
+exports.requireSigningNsec = requireSigningNsec;
+exports.resolvePublishNsec = resolvePublishNsec;
+exports.isPublishNsecPresent = isPublishNsecPresent;
+exports.signNostrEvent = signNostrEvent;
+exports.getNpubHex = getNpubHex;
+exports.pubkeyHexToNpub = pubkeyHexToNpub;
+const base_1 = require("@scure/base");
+const applesauce_signers_1 = require("applesauce-signers");
+/**
+ * nsec + Nostr publish helpers.
+ *
+ * Uses applesauce (`PrivateKeySigner`) for secp256k1 event signing and
+ * `@scure/base` for Bech32 (nsec/npub) encode/decode. Never nostr-tools.
+ */
+exports.PAKSTR_NSEC_ENV = "PAKSTR_NSEC";
+exports.PAKSTR_PUBLISH_NSEC_ENV = "PAKSTR_PUBLISH_NSEC";
+exports.NSEC_HRP = "nsec";
+exports.NPUB_HRP = "npub";
+const NSEC_PAYLOAD_BYTES = 32;
+class NsecError extends Error {
+    envVar;
+    constructor(message, envVar) {
+        super(message);
+        this.envVar = envVar;
+        this.name = "NsecError";
+    }
+}
+exports.NsecError = NsecError;
+/**
+ * Decode a Bech32 `nsec1…` string into 32 raw bytes.
+ * Validates: lowercase, HRP `nsec`, 32-byte payload, nonzero secp256k1 scalar.
+ */
+function decodeNsec(value) {
+    if (typeof value !== "string" || value.length === 0) {
+        throw new NsecError("nsec is missing or empty");
+    }
+    if (value !== value.toLowerCase()) {
+        throw new NsecError("nsec must be lowercase bech32");
+    }
+    let decoded;
+    try {
+        decoded = base_1.bech32.decodeToBytes(value);
+    }
+    catch {
+        throw new NsecError("nsec is not valid bech32");
+    }
+    if (decoded.prefix !== exports.NSEC_HRP) {
+        throw new NsecError(`nsec must use the "${exports.NSEC_HRP}" human-readable part`);
+    }
+    const bytes = decoded.bytes;
+    if (bytes.length !== NSEC_PAYLOAD_BYTES) {
+        throw new NsecError("nsec payload must be exactly 32 bytes");
+    }
+    if (bytes.every(b => b === 0)) {
+        throw new NsecError("nsec must be a nonzero secret key");
+    }
+    // secp256k1 group order
+    const order = BigInt("0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141");
+    let scalar = 0n;
+    for (const b of bytes)
+        scalar = (scalar << 8n) | BigInt(b);
+    if (scalar === 0n || scalar >= order) {
+        throw new NsecError("nsec is not a valid secp256k1 private scalar");
+    }
+    return bytes;
+}
+/** Encode 32 raw bytes as a lowercase bech32 `nsec1…` string. */
+function encodeNsec(bytes) {
+    if (bytes.length !== NSEC_PAYLOAD_BYTES) {
+        throw new NsecError("secret key must be exactly 32 bytes");
+    }
+    return base_1.bech32.encodeFromBytes(exports.NSEC_HRP, bytes);
+}
+/** Encode 32 raw pubkey bytes as `npub1…`. */
+function encodeNpub(pubkey) {
+    return base_1.bech32.encodeFromBytes(exports.NPUB_HRP, pubkey);
+}
+/**
+ * Read and decode the signing nsec from `PAKSTR_NSEC`. Fails fast with a
+ * clear message if unset/empty/malformed. Never echoes the nsec value.
+ */
+function requireSigningNsec(env = process.env) {
+    const value = env[exports.PAKSTR_NSEC_ENV];
+    if (value === undefined || value.length === 0) {
+        throw new NsecError(`${exports.PAKSTR_NSEC_ENV} is required and must not be empty`, exports.PAKSTR_NSEC_ENV);
+    }
+    const bytes = decodeNsec(value);
+    return { bytes, envVar: exports.PAKSTR_NSEC_ENV };
+}
+/**
+ * Resolve the publish nsec per SPEC §4.1.
+ *
+ * @param publishKey  - value of `publish.publishKey` from pakstr.yaml:
+ *                      undefined → omitted entirely → reuse PAKSTR_NSEC;
+ *                      string (explicit) → read env var named by that string;
+ *                      null (bare key) → read PAKSTR_PUBLISH_NSEC.
+ * @param env         - environment (defaults to process.env).
+ *
+ * Returns the resolved env-var name and decoded secret. Throws NsecError
+ * (fail fast) if the resolved env var is unset/empty/malformed.
+ */
+function resolvePublishNsec(publishKey, env = process.env) {
+    if (publishKey === undefined) {
+        return requireSigningNsec(env);
+    }
+    const envVar = publishKey === null ? exports.PAKSTR_PUBLISH_NSEC_ENV : publishKey;
+    const value = env[envVar];
+    if (value === undefined || value.length === 0) {
+        throw new NsecError(`${envVar} is required for publishing and must not be empty`, envVar);
+    }
+    const bytes = decodeNsec(value);
+    return { bytes, envVar };
+}
+/** Only checks whether the resolved publish nsec env var is present & non-empty. */
+function isPublishNsecPresent(publishKey, env = process.env) {
+    if (publishKey === undefined) {
+        const v = env[exports.PAKSTR_NSEC_ENV];
+        return v !== undefined && v.length > 0;
+    }
+    const envVar = publishKey === null ? exports.PAKSTR_PUBLISH_NSEC_ENV : publishKey;
+    const v = env[envVar];
+    return v !== undefined && v.length > 0;
+}
+/** Sign a Nostr event with a secret key (32 raw bytes). Uses applesauce. */
+async function signNostrEvent(template, secret) {
+    const signer = new applesauce_signers_1.PrivateKeySigner(secret);
+    const event = await signer.signEvent({
+        kind: template.kind,
+        created_at: template.created_at,
+        tags: template.tags,
+        content: template.content,
+    });
+    return event;
+}
+/** Derive the hex npub (publisher identity) for a secret key. */
+async function getNpubHex(secret) {
+    const signer = new applesauce_signers_1.PrivateKeySigner(secret);
+    return await signer.getPublicKey();
+}
+/** Convert a hex pubkey to bech32 npub. */
+function pubkeyHexToNpub(hexPubkey) {
+    if (!/^[0-9a-f]{64}$/.test(hexPubkey)) {
+        throw new NsecError("pubkey must be 64 hex characters");
+    }
+    const bytes = Buffer.from(hexPubkey, "hex");
+    return encodeNpub(bytes);
+}