pakstr 0.9.0 → 0.10.0

package/dist/commands/init.js

@@ -23,7 +23,7 @@ const HEADER = `# pakstr.yaml — one file, one command, one APK.
 # has it can derive every app identity for every known appId. Losing it breaks
 # update continuity. It cannot rotate the signer of an already-published app.
 `;
-function initCommand(options = {}) {
+async function initCommand(options = {}) {
     const configPath = path_1.default.resolve(options.out ?? path_1.default.join(process.cwd(), pakstrConfig_1.PAKSTR_CONFIG_FILENAME));
     if (fs_1.default.existsSync(configPath) && !options.force) {
         throw new Error(`${configPath} already exists. Use --force to overwrite, or remove it first.`);
@@ -53,8 +53,11 @@ function initCommand(options = {}) {
     }
     // Generate a fresh dev nsec into a gitignored `.env` so `pakstr run` works
     // locally with no manual setup. Never overwrites an existing PAKSTR_NSEC.
-    const nsecStatus = ensureDevNsec();
+    const { nsec: devNsec, status: nsecStatus } = ensureDevNsec();
     ensureGitIgnoresEnv();
+    // Write zapstore.yaml (relay-side publisher whitelist) with the publisher
+    // npub derived from the dev nsec. Never overwrites an existing one.
+    const zapstoreStatus = await ensureZapstoreYaml(devNsec);
     console.log("");
     console.log("➡️  Next: run pakstr run");
     if (nsecStatus === "generated") {
@@ -63,27 +66,35 @@ function initCommand(options = {}) {
     else if (nsecStatus === "present") {
         console.log(`    ${nostr_1.PAKSTR_NSEC_ENV} already in .env — left untouched.`);
     }
+    if (zapstoreStatus === "generated") {
+        console.log("    zapstore.yaml written (relay-side publisher whitelist). Commit it.");
+    }
+    else if (zapstoreStatus === "present") {
+        console.log("    zapstore.yaml already exists — left untouched.");
+    }
     console.log("");
     console.log(`    For real releases, put the SAME ${nostr_1.PAKSTR_NSEC_ENV} in your CI secret manager`);
     console.log("    (reusing it is what lets an update install over the previous APK).");
     console.log(`    ${nostr_1.PAKSTR_NSEC_ENV} is a release-signing root secret: anyone who has it can`);
     console.log("    sign updates for every app whose appId they know. Keep it safe.");
 }
-/** Generate a dev nsec into .env if none is present there. Returns what happened. */
+/** Generate a dev nsec into .env if none is present there. Returns the nsec string. */
 function ensureDevNsec() {
     const envPath = path_1.default.join(process.cwd(), ".env");
     const existing = fs_1.default.existsSync(envPath)
         ? fs_1.default.readFileSync(envPath, "utf8")
         : "";
-    if (containsPakstrNsec(existing))
-        return "present";
+    if (containsPakstrNsec(existing)) {
+        const m = existing.match(new RegExp(`^${nostr_1.PAKSTR_NSEC_ENV}=(\\S+)`, "m"));
+        return { nsec: m?.[1] ?? "", status: "present" };
+    }
     const nsec = (0, nostr_1.encodeNsec)((0, crypto_1.randomBytes)(32));
     const line = `${nostr_1.PAKSTR_NSEC_ENV}=${nsec}\n`;
     const header = existing.length === 0 ? "# Local development secrets — never commit this file.\n" : "";
     fs_1.default.writeFileSync(envPath, header + (existing.length ? "\n" + line : line), {
         flag: existing.length === 0 ? "wx" : "a",
     });
-    return "generated";
+    return { nsec, status: "generated" };
 }
 function containsPakstrNsec(envText) {
     return new RegExp(`^${nostr_1.PAKSTR_NSEC_ENV}=`, "m").test(envText);
@@ -108,6 +119,42 @@ function containsEnvEntry(gitignoreText) {
         .split(/\r?\n/)
         .some(line => line.trim() === ".env" || line.trim().startsWith(".env"));
 }
+/**
+ * Write `zapstore.yaml` (relay-side publisher whitelist) with the publisher
+ * npub derived from the dev nsec. Never overwrites an existing file.
+ * Returns what happened.
+ */
+async function ensureZapstoreYaml(devNsec) {
+    const zapstorePath = path_1.default.join(process.cwd(), "zapstore.yaml");
+    if (fs_1.default.existsSync(zapstorePath))
+        return "present";
+    let npub = "";
+    if (devNsec) {
+        try {
+            const secret = (0, nostr_1.decodeNsec)(devNsec);
+            const hex = await (0, nostr_1.getNpubHex)(secret);
+            npub = (0, nostr_1.pubkeyHexToNpub)(hex);
+        }
+        catch {
+            // If we can't derive the npub, write the file with a placeholder so the
+            // user knows to fill it in.
+            npub = "";
+        }
+    }
+    const content = `# zapstore.yaml — relay-side publisher whitelist (NIP-82 / Zap Store).
+# The relay fetches this file from your repo to verify the publisher's pubkey
+# is authorized for this repository. Generated by \`pakstr init\`.
+#
+# \`pubkey\` is the npub matching the nsec used to publish (PAKSTR_NSEC, or
+# PAKSTR_PUBLISH_NSEC if you set publish.publishKey). Replace it with your
+# real publisher npub for production releases if different from your dev nsec.
+
+repository: # TODO: set to your app's source code repository URL
+pubkey: ${npub || "# TODO: set to your publisher npub (npub1...)"}
+`;
+    fs_1.default.writeFileSync(zapstorePath, content, "utf8");
+    return "generated";
+}
 function renderConfig(c) {
     const perms = `    [${pakstrConfig_1.PERMISSION_ALIASES.map(p => `"${p}"`).join(", ")}]`;
     return `${HEADER}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pakstr",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "CLI for packaging Nostr web apps into Android APKs",
   "type": "commonjs",
   "main": "dist/index.js",