Post. That's all: inside Postr
Post. That’s all: inside Postr
Postr is a one-screen Android app with one job: compose a kind-1 note and send it to your relays. Feeds, DMs, zaps, and wallets already have excellent homes in other clients. Cutting scope this hard made room to build the remaining path with unusual care.
Download on @78ce6...6307d
https://zapstore.dev/apps/naddr1qqykzurs9ecx7um5wgq3samnwvaz7tmjv4kxz7fw0fshqum5daex2tnyv4mqygqr4ndrsj27ps8896akzre5ewt0kt958l8qg20srwmdudfrkf0y7ypsgqqq0c9sv59fsw
Keys stay in Amber
Postr stores no private key and has no field that accepts one. Signing is delegated to Amber through its Android intent interface. Login requests only two signing capabilities: kind-1 text notes and kind-24242 Blossom upload authorizations. A build guard fails if that list grows. An account in Postr is only a public key and the package name of the signer that returned it.
From tap to relay
A relay’s acknowledgement is not enough. Postr counts a note as published on a relay only after the relay returns the identical event and its signature verifies on the device.
The composer builds the event, including NIP-27 mention references and NIP-92 imeta tags for attachments. Amber signs it. Before any socket opens, Postr commits the signed event and its immutable relay targets to a durable outbox. A background worker publishes to every target concurrently and asks each relay for the event. Every attempt ends as verified, rejected, or unverified with a bounded reason. The result sheet shows the verified count, per-relay outcomes, and a link to the exact nevent.
Ambiguous outcomes retry with bounded backoff. A resend cannot create a duplicate because the event id never changes. If every relay explicitly rejects the event, the draft remains intact. Process recreation is covered at each stage: stale signer results are ignored, queued work resumes, and a successful result clears only the exact draft revision that produced it.
NIP-65, read only
Postr publishes to the author’s advertised NIP-65 write relays plus a small bootstrap set, or to a custom per-account list. It never signs or publishes a kind-10002 relay list. Publishing accepts only encrypted wss:// relay URLs. Profile and relay-list discovery use bounded subscriptions, and incoming events must pass Quartz signature verification before entering a cache.
After public relay verification, Postr can make one best-effort mirror attempt to a Citrine relay on device loopback. That single cleartext exception cannot delay or change the visible result.
Bounded input and output
An upload is spooled once into a private cache and capped at 25 MiB even when a document provider reports no size. Amber signs a short-lived authorization tied to the file hash. Postr accepts the response only when it uses HTTPS and names the blob with its verified SHA-256. The resulting metadata becomes the note’s NIP-92 tags.
Typing @ plus two characters starts bounded NIP-50 profile searches in parallel. One responsive relay is enough. Selecting a result keeps a visible name token in the editor while event construction turns it into a nostr:npub reference and one deduplicated p tag.
Link previews load only after an explicit tap. Fetches constrain DNS results, redirects, response size, content type, and private or reserved address ranges. Incoming shares accept plain text or validated nostr: references, and shared content can never publish without a deliberate action in the composer.
Zero blue at night
The default theme keeps the blue channel of app-controlled pixels at zero. The Material colour scheme derives from three chosen colours through per-channel blending, so blue-free inputs yield a blue-free scheme. A colour-matrix filter applies the same rule to remote images and animated media. Choosing a theme that contains blue disables the filter.
The trade
Postr will not show a feed, read DMs, or import a key. In exchange, it opens quickly, requests narrowly scoped authority, publishes a note durably, and gets out of the way.
At publication, the owner will sign the NIP-34 repository announcement, release event, profile, announcement, and this article with the same verified Nostr identity. The source remains ordinary Git, licensed under MIT, and the release can be installed through Zapstore.
Write a comment