I think this is it:
```
let Κ¬h;
fetch("https://newtribal.org/hpb.txt")
.then((resp) =>
resp.text().then((pubhex) => {
globalThis.crypto.subtle.importKey( "raw", Uint8Array.fromHex(pubhex),
{ name: "Ed25519" }, true, ["verify"],).then((pb) => {
fetch("heptapp-20260524T161314406Z.png", { cache: "force-cache" })
.then((resp) => { resp.arrayBuffer().then((ab) => {
new Response( new Blob([ab.slice(41, -16)], {
type: "application/zlib",
}).stream().pipeThrough(new DecompressionStream("deflate")),
).arrayBuffer().then((abb) => {
let f = 0, p = 0, r = 0;
l = new Uint8Array(abb), u = new Uint8Array(l.length);
do { if (r == 4140 || f == 0) { f++; r = 0; }
else { u[p] = l[f]; r++; f++; p++; }
} while (f < l.length);
const s = document.createElement("script");
Κ¬h = JSON.parse(
new TextDecoder().decode(u).split( "endofheptappdata",)[0],
);
crypto.subtle.verify( { name: "Ed25519", }, pb,
Uint8Array.fromHex(Κ¬h[0][2]),
new TextEncoder().encode( JSON.stringify([ Κ¬h[0][0], Κ¬h[0][1], ...Κ¬h[0].slice(3), ]),),
).then((res) => { if (res && Κ¬h[0][1]==pubhex ) {
s.appendChild(document.createTextNode(Κ¬h[0][6]));
document.body.appendChild(s);
} }); }); }); }); }); }));
```
It provides a bootstrap via heptads. It triangulates the pub (in addition to the event) and verifies the code bootstrap heptad before applying. It runs in a browser or Deno (Bun with some mods). The PNG provides OK compression, but it is really more of a bot barrier. I use the Κ¬ because I pollute the global variables.
