pakstr 0.8.7 → 0.9.0

package/dist/core/pakstrConfig.js

@@ -0,0 +1,206 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ConfigError = exports.APP_ID_PATTERN = exports.PERMISSION_ALIASES = exports.PAKSTR_CONFIG_FILENAME = void 0;
+exports.sanitizeAppIdSegment = sanitizeAppIdSegment;
+exports.loadPakstrConfig = loadPakstrConfig;
+exports.validatePakstrConfig = validatePakstrConfig;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const js_yaml_1 = __importDefault(require("js-yaml"));
+/**
+ * Pakstr configuration model — the single `pakstr.yaml` file.
+ * Spec: docs/SPEC.md §3. Secrets are NEVER placed in this file.
+ */
+exports.PAKSTR_CONFIG_FILENAME = "pakstr.yaml";
+exports.PERMISSION_ALIASES = [
+    "INTERNET",
+    "CAMERA",
+    "NOTIFICATIONS",
+    "VIBRATE",
+];
+const HEX_COLOR_RE = /^#[0-9A-Fa-f]{6}$/;
+/**
+ * A valid Android / Java package name: dot-separated segments, each starting
+ * with a lower-case letter and containing only lower-case letters, digits, and
+ * underscores. Hyphens are NOT allowed (AAPT rejects them in `<manifest
+ * package>`). Used by both `pakstr init` (to sanitize inferred names) and
+ * config validation (to reject bad values).
+ */
+exports.APP_ID_PATTERN = /^[a-z][a-z0-9_]*(\.[a-z][a-z0-9_]*)*$/;
+/**
+ * Sanitize an arbitrary string (e.g. an npm package name like `my-pakstr-app`)
+ * into a valid Android package-name segment: lower-case, hyphens → underscores,
+ * strip anything other than [a-z0-9_], and prefix with `x` if it starts with a
+ * digit. Returns `null` if nothing usable remains.
+ */
+function sanitizeAppIdSegment(input) {
+    let s = input.toLowerCase().replace(/[^a-z0-9_-]/g, "");
+    s = s.replace(/-/g, "_");
+    s = s.replace(/^[^a-z]+/, ""); // drop leading non-letters (digits, underscores)
+    return s.length > 0 ? s : null;
+}
+class ConfigError extends Error {
+    configPath;
+    constructor(message, configPath) {
+        super(message);
+        this.configPath = configPath;
+        this.name = "ConfigError";
+    }
+}
+exports.ConfigError = ConfigError;
+function fail(message, configPath) {
+    throw new ConfigError(message, configPath);
+}
+/**
+ * Load and fully validate `pakstr.yaml` from `configPath` (defaults to
+ * `pakstr.yaml` in `cwd`). Returns paths resolved relative to the yaml file.
+ */
+function loadPakstrConfig(configPath) {
+    const resolvedPath = path_1.default.resolve(configPath ?? path_1.default.join(process.cwd(), exports.PAKSTR_CONFIG_FILENAME));
+    if (!fs_1.default.existsSync(resolvedPath) || !fs_1.default.lstatSync(resolvedPath).isFile()) {
+        fail(`pakstr.yaml not found: ${resolvedPath}`);
+    }
+    let raw;
+    try {
+        raw = js_yaml_1.default.load(fs_1.default.readFileSync(resolvedPath, "utf8"), {
+            filename: resolvedPath,
+        });
+    }
+    catch (error) {
+        fail(`pakstr.yaml is not valid YAML: ${error instanceof Error ? error.message : "parse error"}`, resolvedPath);
+    }
+    if (raw === null || raw === undefined || typeof raw !== "object" || Array.isArray(raw)) {
+        fail("pakstr.yaml must be a mapping with `app`, `build`, and optionally `publish` sections", resolvedPath);
+    }
+    return resolveAndValidate(raw, resolvedPath);
+}
+function validatePakstrConfig(config, configPath) {
+    resolveAndValidate(config, configPath ?? "");
+}
+function resolveAndValidate(config, configPath) {
+    const configDir = path_1.default.dirname(configPath);
+    const where = (field) => configPath ? `${field} (in ${configPath})` : field;
+    const app = config.app;
+    if (!app || typeof app !== "object")
+        fail(`Missing required section: app`, configPath);
+    // Required app fields
+    requireString(app.appId, "app.appId", configPath);
+    requireString(app.appName, "app.appName", configPath);
+    requireString(app.versionName, "app.versionName", configPath);
+    requirePositiveInt(app.versionCode, "app.versionCode", configPath);
+    // appId rules (§3.3): non-empty, ≤255 UTF-8 bytes, equals trimmed form,
+    // and must be a valid Android/Java package name (segments of lower-case
+    // alphanumerics + underscores separated by dots; no hyphens). AAPT rejects
+    // hyphens in the `package` attribute with "not a valid Android package name".
+    if (app.appId !== app.appId.trim()) {
+        fail(`${where("app.appId")} must not have leading or trailing whitespace`, configPath);
+    }
+    if (Buffer.byteLength(app.appId, "utf8") > 255) {
+        fail(`${where("app.appId")} must be ≤ 255 UTF-8 bytes`, configPath);
+    }
+    if (!exports.APP_ID_PATTERN.test(app.appId)) {
+        fail(`${where("app.appId")} must be a valid Android package name: dot-separated segments of` +
+            ` lower-case letters, digits, and underscores (no hyphens). Got: "${app.appId}"`, configPath);
+    }
+    // appName / versionName basic sanity
+    if (/[\r\n]/.test(app.appName)) {
+        fail(`${where("app.appName")} must not contain line breaks`, configPath);
+    }
+    if (/[\r\n"\\]/.test(app.versionName)) {
+        fail(`${where("app.versionName")} must not contain line breaks, quotes, or backslashes`, configPath);
+    }
+    if (app.description !== undefined && typeof app.description !== "string") {
+        fail(`${where("app.description")} must be a string`, configPath);
+    }
+    // Optional color fields
+    if (app.backgroundColor !== undefined) {
+        assertHexColor(app.backgroundColor, "app.backgroundColor", configPath);
+    }
+    if (app.splash?.background !== undefined) {
+        assertHexColor(app.splash.background, "app.splash.background", configPath);
+    }
+    if (app.splash && !app.splash.image) {
+        fail(`${where("app.splash.image")} is required when splash is configured`, configPath);
+    }
+    // Permissions
+    if (app.permissions !== undefined) {
+        if (!Array.isArray(app.permissions) || app.permissions.some(p => typeof p !== "string")) {
+            fail(`${where("app.permissions")} must be a list of strings`, configPath);
+        }
+        for (const perm of app.permissions) {
+            const normalized = perm.trim().toUpperCase();
+            if (!exports.PERMISSION_ALIASES.includes(normalized)) {
+                fail(`${where("app.permissions")} has unknown entry "${perm}"; allowed: ${exports.PERMISSION_ALIASES.join(", ")}`, configPath);
+            }
+        }
+    }
+    // build section
+    const build = config.build;
+    if (!build || typeof build !== "object")
+        fail(`Missing required section: build`, configPath);
+    requireString(build.web, "build.web", configPath);
+    const webAbs = path_1.default.resolve(configDir, build.web);
+    if (!fs_1.default.existsSync(webAbs) || !fs_1.default.lstatSync(webAbs).isDirectory()) {
+        fail(`${where("build.web")} does not exist or is not a directory: ${webAbs}`, configPath);
+    }
+    if (!fs_1.default.existsSync(path_1.default.join(webAbs, "index.html"))) {
+        fail(`${where("build.web")} must contain index.html: ${webAbs}`, configPath);
+    }
+    if (build.builder !== undefined && build.builder !== "docker") {
+        fail(`${where("build.builder")} must be "docker" (only the docker builder is specified)`, configPath);
+    }
+    const builder = build.builder ?? "docker";
+    const outDefault = path_1.default.join(configDir, "build", `${app.appId}.apk`);
+    const out = build.out ? path_1.default.resolve(configDir, build.out) : outDefault;
+    // publish section
+    const publish = config.publish;
+    let zapstoreEnabled = true;
+    let publishKey = undefined;
+    if (publish !== undefined) {
+        if (publish.zapstore !== undefined) {
+            if (publish.zapstore.enabled !== undefined && typeof publish.zapstore.enabled !== "boolean") {
+                fail(`${where("publish.zapstore.enabled")} must be a boolean`, configPath);
+            }
+            zapstoreEnabled = publish.zapstore.enabled ?? true;
+        }
+        if (publish.publishKey !== undefined) {
+            if (publish.publishKey !== null && typeof publish.publishKey !== "string") {
+                fail(`${where("publish.publishKey")} must be a string or empty (bare key)`, configPath);
+            }
+            if (typeof publish.publishKey === "string" && publish.publishKey.trim().length === 0) {
+                // Treat empty string like a bare key.
+                publishKey = null;
+            }
+            else {
+                publishKey = publish.publishKey;
+            }
+        }
+    }
+    const relay = publish?.relay ?? "wss://relay.zapstore.dev";
+    const blossom = publish?.blossom ?? "https://cdn.zapstore.dev";
+    return {
+        configDir,
+        configPath,
+        app,
+        build: { web: webAbs, out, builder },
+        publish: { zapstoreEnabled, publishKey, relay, blossom },
+    };
+}
+function requireString(value, field, configPath) {
+    if (typeof value !== "string" || value.length === 0) {
+        fail(`Missing required field: ${field}`, configPath);
+    }
+}
+function requirePositiveInt(value, field, configPath) {
+    if (typeof value !== "number" || !Number.isInteger(value) || value <= 0) {
+        fail(`${field} must be a positive integer`, configPath);
+    }
+}
+function assertHexColor(value, field, configPath) {
+    if (typeof value !== "string" || !HEX_COLOR_RE.test(value)) {
+        fail(`${field} must be a hex color of the form #RRGGBB`, configPath);
+    }
+}

package/dist/core/zapStore.js

@@ -0,0 +1,221 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MockRelayTransport = exports.WebsocketRelayTransport = exports.KIND_ASSET = exports.KIND_RELEASE = exports.KIND_APP_METADATA = exports.DEFAULT_COMMUNITY = void 0;
+exports.buildSignedPublishEvents = buildSignedPublishEvents;
+exports.publishToZapStore = publishToZapStore;
+exports.resolvePublishSecret = resolvePublishSecret;
+exports.publishEventToRelay = publishEventToRelay;
+exports.verifyPublish = verifyPublish;
+exports.queryRelayForEvent = queryRelayForEvent;
+const nostr_1 = require("./nostr");
+/** Default Zap Store catalog community (h tag). */
+exports.DEFAULT_COMMUNITY = "acfeaea6e51420e8068fac446ca9d17d7a9ef6a5d20d93894e50fee3d4902a84";
+/** NIP-82 event kinds. */
+exports.KIND_APP_METADATA = 32267;
+exports.KIND_RELEASE = 30063;
+exports.KIND_ASSET = 3063;
+/** Android platform identifier for the template's generic APK. */
+const PLATFORM = "android-arm64-v8a";
+const MIN_SDK = 28;
+const TARGET_SDK = 36;
+/** Build the three NIP-82 events (unsigned → signed) for an app release. */
+async function buildSignedPublishEvents(input) {
+    const pubkeyHex = await (0, nostr_1.getNpubHex)(input.publishNsec.bytes);
+    const npub = (0, nostr_1.pubkeyHexToNpub)(pubkeyHex);
+    const now = Math.floor(Date.now() / 1000);
+    const communities = input.communities?.length ? input.communities : [exports.DEFAULT_COMMUNITY];
+    // kind 32267 — Software Application (app metadata)
+    const appMetadata = await (0, nostr_1.signNostrEvent)({
+        kind: exports.KIND_APP_METADATA,
+        created_at: now,
+        tags: [
+            ["d", input.app.appId],
+            ["name", input.app.appName],
+            ["f", PLATFORM],
+            ...communities.map(c => ["h", c]),
+        ],
+        content: input.app.description ?? "",
+    }, input.publishNsec.bytes);
+    // kind 3063 — Software Asset (the APK)
+    const asset = await (0, nostr_1.signNostrEvent)({
+        kind: exports.KIND_ASSET,
+        created_at: now,
+        tags: [
+            ["i", input.app.appId],
+            ["x", input.apk.apkSha256],
+            ["version", input.app.versionName],
+            ["url", input.apk.blossomUrl],
+            ["m", "application/vnd.android.package-archive"],
+            ["size", String(input.apk.apkSize)],
+            ["f", PLATFORM],
+            ["min_platform_version", String(MIN_SDK)],
+            ["target_platform_version", String(TARGET_SDK)],
+            ["filename", input.apk.filename],
+            ["version_code", String(input.app.versionCode)],
+            ["apk_certificate_hash", input.apk.signerCertificateSha256],
+        ],
+        content: "",
+    }, input.publishNsec.bytes);
+    // kind 30063 — Software Release (references the asset event)
+    const release = await (0, nostr_1.signNostrEvent)({
+        kind: exports.KIND_RELEASE,
+        created_at: now,
+        tags: [
+            ["i", input.app.appId],
+            ["version", input.app.versionName],
+            ["d", `${input.app.appId}@${input.app.versionName}`],
+            ["c", "main"],
+            ["f", PLATFORM],
+            ["e", asset.id, input.target.relayUrl],
+        ],
+        content: "",
+    }, input.publishNsec.bytes);
+    return { npub, pubkeyHex, appMetadata, release, asset };
+}
+/** Publish all three events to the relay via the given transport. */
+async function publishToZapStore(input, transport) {
+    const built = await buildSignedPublishEvents(input);
+    await transport.publish(built.asset, input.target.relayUrl);
+    await transport.publish(built.release, input.target.relayUrl);
+    await transport.publish(built.appMetadata, input.target.relayUrl);
+    return {
+        npub: built.npub,
+        pubkeyHex: built.pubkeyHex,
+        appMetadataEventId: built.appMetadata.id,
+        releaseEventId: built.release.id,
+        assetEventId: built.asset.id,
+        events: {
+            appMetadata: built.appMetadata,
+            release: built.release,
+            asset: built.asset,
+        },
+        relayUrl: input.target.relayUrl,
+    };
+}
+/** Resolve the publish nsec for a loaded pakstr config per §4.1. */
+function resolvePublishSecret(publishKey, env = process.env) {
+    return (0, nostr_1.resolvePublishNsec)(publishKey, env);
+}
+/** Real websocket transport: sends ["EVENT", e] and expects ["OK", id, true, …]. */
+class WebsocketRelayTransport {
+    WebSocketCtor;
+    constructor(webSocketCtor) {
+        this.WebSocketCtor = (webSocketCtor ?? WebSocket);
+    }
+    async publish(event, relayUrl) {
+        await publishEventToRelay(this.WebSocketCtor, event, relayUrl);
+    }
+}
+exports.WebsocketRelayTransport = WebsocketRelayTransport;
+/** A no-op transport for tests / dry-runs (no network). */
+class MockRelayTransport {
+    published = [];
+    async publish(event, _relayUrl) {
+        this.published.push(event);
+    }
+}
+exports.MockRelayTransport = MockRelayTransport;
+/** Low-level: publish one event to a relay over websocket, awaiting OK. */
+function publishEventToRelay(WebSocketCtor, event, relayUrl, timeoutMs = 30000) {
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        const ws = new WebSocketCtor(relayUrl);
+        const timer = setTimeout(() => {
+            if (settled)
+                return;
+            settled = true;
+            try {
+                ws.close();
+            }
+            catch { /* ignore */ }
+            reject(new Error(`Relay publish timed out: ${relayUrl}`));
+        }, timeoutMs);
+        ws.onopen = () => {
+            ws.send(JSON.stringify(["EVENT", event]));
+        };
+        ws.onmessage = (msg) => {
+            let data;
+            try {
+                data = JSON.parse(typeof msg.data === "string" ? msg.data : msg.data.toString());
+            }
+            catch {
+                return;
+            }
+            if (Array.isArray(data) && data[0] === "OK" && data[1] === event.id) {
+                settled = true;
+                clearTimeout(timer);
+                try {
+                    ws.close();
+                }
+                catch { /* ignore */ }
+                if (data[2] === true)
+                    resolve();
+                else
+                    reject(new Error(`Relay rejected event ${event.id}: ${data[3] ?? "unknown"}`));
+            }
+        };
+        ws.onerror = (err) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            reject(new Error(`Relay connection error: ${relayUrl} ${err?.message ?? ""}`));
+        };
+    });
+}
+/**
+ * Verify a publish by querying the relay for the asset event and confirming
+ * the APK is retrievable from Blossom. Returns true if both check out.
+ */
+async function verifyPublish(input) {
+    const WebSocketCtor = input.WebSocketCtor ?? WebSocket;
+    const fetchFn = input.fetchImpl ?? fetch;
+    const eventFound = await queryRelayForEvent(WebSocketCtor, input.relayUrl, input.assetEventId);
+    const head = await fetchFn(input.blossomUrl, { method: "HEAD" });
+    return { eventFound, apkDownloadable: head.status === 200 };
+}
+/** Open a relay, send a REQ for a single event id, wait for it. */
+function queryRelayForEvent(WebSocketCtor, relayUrl, eventId, timeoutMs = 30000) {
+    return new Promise((resolve) => {
+        let settled = false;
+        const ws = new WebSocketCtor(relayUrl);
+        const timer = setTimeout(() => {
+            if (settled)
+                return;
+            settled = true;
+            try {
+                ws.close();
+            }
+            catch { /* ignore */ }
+            resolve(false);
+        }, timeoutMs);
+        ws.onopen = () => {
+            ws.send(JSON.stringify(["REQ", "verify-" + eventId.slice(0, 8), { ids: [eventId] }]));
+        };
+        ws.onmessage = (msg) => {
+            let data;
+            try {
+                data = JSON.parse(typeof msg.data === "string" ? msg.data : msg.data.toString());
+            }
+            catch {
+                return;
+            }
+            if (Array.isArray(data) && data[0] === "EVENT" && data[2]?.id === eventId) {
+                settled = true;
+                clearTimeout(timer);
+                try {
+                    ws.close();
+                }
+                catch { /* ignore */ }
+                resolve(true);
+            }
+        };
+        ws.onerror = () => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            resolve(false);
+        };
+    });
+}