@makefully/adaptfully 4.0.0 → 4.2.0

package/lib/node/choreCrypto.js

@@ -0,0 +1,197 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import {Readable, PassThrough} from 'node:stream';
+import {pipeline} from 'node:stream/promises';
+import archiver from 'archiver';
+import unzipper from 'unzip-stream';
+import {
+    WRAPFULLY_DEFAULT_KID,
+    WRAPFULLY_DEFAULT_PUBLIC_KEY,
+} from './wrapfullyDefaultPublicKey.js';
+
+const
+    ENVELOPE_DATA = 'wrapfully.enc',
+    ENVELOPE_KEY = 'wrapfully.key.enc',
+    ENVELOPE_META = 'wrapfully-crypto.json',
+    RESULT_DATA = 'result.enc',
+    RESULT_KEY = 'result.key.enc',
+    ALG = 'RSA-OAEP-SHA256+AES-256-GCM';
+
+function aesEncrypt (plaintext) {
+    const key = crypto.randomBytes(32);
+    const iv = crypto.randomBytes(12);
+    const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
+    const enc = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+    const tag = cipher.getAuthTag();
+
+    return {key, ciphertext: Buffer.concat([iv, tag, enc])};
+}
+
+function aesDecrypt (key, blob) {
+    const iv = blob.subarray(0, 12);
+    const tag = blob.subarray(12, 28);
+    const data = blob.subarray(28);
+    const decipher = crypto.createDecipheriv('aes-256-gcm', key, iv);
+
+    decipher.setAuthTag(tag);
+
+    return Buffer.concat([decipher.update(data), decipher.final()]);
+}
+
+function wrapKey (aesKey, publicKeyPem) {
+    return crypto.publicEncrypt(
+        {
+            key: publicKeyPem,
+            padding: crypto.constants.RSA_PKCS1_OAEP_PADDING,
+            oaepHash: 'sha256',
+        },
+        aesKey,
+    );
+}
+
+function unwrapKey (wrapped, privateKeyPem) {
+    return crypto.privateDecrypt(
+        {
+            key: privateKeyPem,
+            padding: crypto.constants.RSA_PKCS1_OAEP_PADDING,
+            oaepHash: 'sha256',
+        },
+        wrapped,
+    );
+}
+
+export function generateResultKeyPair () {
+    const {publicKey, privateKey} = crypto.generateKeyPairSync('rsa', {
+        modulusLength: 2048,
+        publicKeyEncoding: {type: 'spki', format: 'pem'},
+        privateKeyEncoding: {type: 'pkcs8', format: 'pem'},
+    });
+
+    return {publicKey, privateKey};
+}
+
+export function resolveEncryptPublicKey (wrapfullyConfig = {}, cliPublicKey) {
+    if (cliPublicKey) {
+        if (cliPublicKey.includes('BEGIN PUBLIC KEY')) {
+            return {pem: cliPublicKey.trim(), kid: wrapfullyConfig.encryptKid || 'override'};
+        }
+        return {
+            pem: fs.readFileSync(cliPublicKey, 'utf8').trim(),
+            kid: wrapfullyConfig.encryptKid || 'override',
+        };
+    }
+    if (wrapfullyConfig.encryptPublicKey) {
+        const value = wrapfullyConfig.encryptPublicKey;
+
+        if (String(value).includes('BEGIN PUBLIC KEY')) {
+            return {pem: String(value).trim(), kid: wrapfullyConfig.encryptKid || 'override'};
+        }
+        return {
+            pem: fs.readFileSync(value, 'utf8').trim(),
+            kid: wrapfullyConfig.encryptKid || 'override',
+        };
+    }
+
+    return {pem: WRAPFULLY_DEFAULT_PUBLIC_KEY.trim(), kid: WRAPFULLY_DEFAULT_KID};
+}
+
+async function bufferFromStream (stream) {
+    const chunks = [];
+
+    for await (const chunk of stream) {
+        chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+    }
+
+    return Buffer.concat(chunks);
+}
+
+async function zipToBuffer (appendFn) {
+    const archive = archiver('zip', {zlib: {level: 0}});
+    const pass = new PassThrough();
+    const chunks = [];
+
+    archive.pipe(pass);
+    pass.on('data', (c) => chunks.push(c));
+
+    const done = new Promise((resolve, reject) => {
+        pass.on('end', resolve);
+        pass.on('error', reject);
+        archive.on('error', reject);
+    });
+
+    await appendFn(archive);
+    await archive.finalize();
+    await done;
+
+    return Buffer.concat(chunks);
+}
+
+/**
+ * Wrap an inner zip stream/buffer in a Yap-safe envelope for Wrapfully workers.
+ */
+export async function createEnvelopeFromInnerZip (innerZip, {publicKeyPem, kid, resultKeyPair}) {
+    const innerBuf = Buffer.isBuffer(innerZip) ? innerZip : await bufferFromStream(innerZip);
+    const {key, ciphertext} = aesEncrypt(innerBuf);
+    const wrapped = wrapKey(key, publicKeyPem);
+    const meta = {
+        kid,
+        alg: ALG,
+        resultPub: resultKeyPair.publicKey,
+    };
+
+    const zip = await zipToBuffer(async (archive) => {
+        archive.append(ciphertext, {name: ENVELOPE_DATA});
+        archive.append(wrapped, {name: ENVELOPE_KEY});
+        archive.append(JSON.stringify(meta, null, 2), {name: ENVELOPE_META});
+        archive.append(resultKeyPair.publicKey, {name: 'resultPub.pem'});
+    });
+
+    return {zip, resultPriv: resultKeyPair.privateKey, kid};
+}
+
+/**
+ * Decrypt a completed Yap result envelope into a plaintext zip Buffer.
+ */
+export async function decryptResultEnvelope (resultZipBuf, resultPrivPem) {
+    if (!resultPrivPem) {
+        throw new Error('Missing resultPriv for encrypted Wrapfully chore download.');
+    }
+
+    const tmp = path.join(os.tmpdir(), `adaptfully-result-${Date.now().toString(16)}`);
+
+    fs.mkdirSync(tmp, {recursive: true});
+    try {
+        await pipeline(Readable.from(resultZipBuf), unzipper.Extract({path: tmp}));
+        if (!fs.existsSync(path.join(tmp, RESULT_DATA))) {
+            // Not an envelope — return as-is
+            return resultZipBuf;
+        }
+        const ciphertext = fs.readFileSync(path.join(tmp, RESULT_DATA));
+        const wrapped = fs.readFileSync(path.join(tmp, RESULT_KEY));
+        const aesKey = unwrapKey(wrapped, resultPrivPem);
+
+        return aesDecrypt(aesKey, ciphertext);
+    } finally {
+        fs.rmSync(tmp, {recursive: true, force: true});
+    }
+}
+
+export function isResultEnvelopeBuffer (buf) {
+    // Weak check — PK zip; decryptResultEnvelope falls back if members missing
+    return Buffer.isBuffer(buf) && buf.length > 4 && buf[0] === 0x50 && buf[1] === 0x4b;
+}
+
+export {
+    ENVELOPE_DATA,
+    ENVELOPE_KEY,
+    ENVELOPE_META,
+    RESULT_DATA,
+    RESULT_KEY,
+    ALG,
+    aesEncrypt,
+    aesDecrypt,
+    wrapKey,
+    unwrapKey,
+};

package/lib/node/config.js

@@ -1,6 +1,8 @@
 import fs from 'node:fs/promises';
 
-const DEFAULT_SERVER = 'http://localhost:9633/';
+const DEFAULT_SHOWFULLY_SERVER = process.env.SHOWFULLY_DEV
+    ? 'http://localhost:9630/'
+    : 'https://make.makefullystudios.com/';
 
 /**
  * @param {string} [projectRoot='.']
@@ -29,14 +31,53 @@ export async function loadProjectConfig(projectRoot = '.') {
 }
 
 /**
- * @param {{ server?: string }} wrapfullyConfig
+ * Showfully Yap base URL (not Wrapfully HTTP).
+ * @param {{ server?: string, showfullyServer?: string }} wrapfullyConfig
  * @param {string} [cliServer]
  */
 export function resolveServerUrl(wrapfullyConfig, cliServer) {
     return (
         cliServer
-        || process.env.WRAPFULLY_SERVER
+        || process.env.SHOWFULLY_SERVER
+        || wrapfullyConfig.showfullyServer
         || wrapfullyConfig.server
-        || DEFAULT_SERVER
+        || process.env.WRAPFULLY_SERVER
+        || DEFAULT_SHOWFULLY_SERVER
     ).replace(/\/?$/, '/');
 }
+
+/**
+ * Required PAT for Yap submit/poll/download.
+ * @param {{ accessToken?: string, showfullyPat?: string }} wrapfullyConfig
+ * @param {string} [cliToken]
+ */
+export function resolveAccessToken(wrapfullyConfig = {}, cliToken) {
+    const token = (
+        cliToken
+        || process.env.SHOWFULLY_PAT
+        || process.env.WRAPFULLY_ACCESS_TOKEN
+        || wrapfullyConfig.accessToken
+        || wrapfullyConfig.showfullyPat
+        || ''
+    ).trim();
+
+    if (!token) {
+        throw new Error(
+            'Showfully PAT required. Set SHOWFULLY_PAT or wrapfully.json "accessToken" '
+            + '(Settings → API tokens on play.makefullystudios.com).',
+        );
+    }
+
+    return token;
+}
+
+/**
+ * @param {{ encrypt?: boolean }} wrapfullyConfig
+ * @param {boolean} [cliEncrypt]
+ */
+export function resolveEncryptFlag(wrapfullyConfig = {}, cliEncrypt) {
+    if (typeof cliEncrypt === 'boolean') {
+        return cliEncrypt;
+    }
+    return !!wrapfullyConfig.encrypt;
+}

package/lib/node/deploy.js

@@ -1,37 +1,150 @@
 import axios from 'axios';
 import fs from 'node:fs';
 import path from 'node:path';
-import { pipeline } from 'node:stream/promises';
+import {Readable} from 'node:stream';
+import {pipeline} from 'node:stream/promises';
 import unzipper from 'unzip-stream';
-import { createDeployArchive, createReleaseArchive, createSourceArchive } from './archive.js';
-import { clearStaleBuildExtract } from './artifacts.js';
-import { listHtmlFilesRecursive } from './fs-utils.js';
-import { printBuildReport } from './report.js';
+import {createDeployArchive, createReleaseArchive, createSourceArchive} from './archive.js';
+import {clearStaleBuildExtract} from './artifacts.js';
+import {listHtmlFilesRecursive} from './fs-utils.js';
+import {printBuildReport} from './report.js';
+import {
+    createEnvelopeFromInnerZip,
+    decryptResultEnvelope,
+    generateResultKeyPair,
+    resolveEncryptPublicKey,
+} from './choreCrypto.js';
+
+const POLL_MS = 5000;
 
 /**
  * @param {string} gameId
  * @param {string} platformKey
  */
-function buildInfoParam(gameId, platformKey) {
+export function buildInfoParam (gameId, platformKey) {
     return platformKey && platformKey !== gameId ? `${gameId}_${platformKey}` : gameId;
 }
 
 /**
- * @param {string} server
- * @param {'build' | 'deploy' | 'release'} stage
- * @param {string} family
- * @param {string} gameId
- * @param {string} platformKey
- * @param {string} [deploymentKey]
+ * Build wrapfully.json routing config appended to the Yap zip.
  */
-function resolveWrapfullyUrl(server, stage, family, gameId, platformKey, deploymentKey) {
-    const info = buildInfoParam(gameId, platformKey);
+export function buildWrapfullyJobConfig (stage, family, gameId, platformKey, deploymentKey) {
+    /** @type {Record<string, string>} */
+    const job = {
+        stage,
+        route: family,
+        platformKey,
+        gameId,
+    };
 
     if (stage === 'deploy') {
-        return `${server}deploy/${deploymentKey}/${info}`;
+        if (!deploymentKey) {
+            throw new Error('deploy stage requires deploymentKey');
+        }
+        job.deploymentKey = deploymentKey;
+    }
+
+    return job;
+}
+
+async function streamToBuffer (stream) {
+    const chunks = [];
+
+    for await (const chunk of stream) {
+        chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+    }
+
+    return Buffer.concat(chunks);
+}
+
+async function sleep (ms) {
+    await new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+/**
+ * Submit zip to Showfully Yap, poll until complete, return result zip Buffer.
+ */
+export async function submitWrapfullyChore ({
+    server,
+    accessToken,
+    zipBuffer,
+    log = console.log,
+}) {
+    const base = server.replace(/\/?$/, '/');
+    const submitUrl = `${base}yap/wrapfully`;
+    const headers = {
+        Authorization: `Bearer ${accessToken}`,
+        'Content-Type': 'application/zip',
+    };
+
+    log(`adaptfully: POST ${submitUrl}`);
+
+    let submitJson;
+
+    try {
+        const {data} = await axios.post(submitUrl, zipBuffer, {
+            maxRedirects: 0,
+            headers,
+            maxBodyLength: Infinity,
+            maxContentLength: Infinity,
+            validateStatus: () => true,
+        });
+
+        submitJson = data;
+    } catch (err) {
+        if (/** @type {NodeJS.ErrnoException} */ (err).code === 'ECONNREFUSED') {
+            throw new Error(`Cannot connect to Showfully server "${server}"`);
+        }
+        throw err;
+    }
+
+    if (submitJson?.errors?.length) {
+        throw new Error(submitJson.errors[0]);
+    }
+    if (!submitJson?.choreId) {
+        throw new Error('Showfully did not return a choreId');
+    }
+
+    const {choreId} = submitJson;
+
+    log(`adaptfully: chore ${choreId} submitted; waiting…`);
+
+    for (;;) {
+        const statusUrl = `${base}yap/wrapfully/${encodeURIComponent(choreId)}/status`;
+        const {data: status} = await axios.get(statusUrl, {
+            headers: {Authorization: `Bearer ${accessToken}`},
+            validateStatus: () => true,
+        });
+
+        if (status?.state === 'complete') {
+            break;
+        }
+        if (status?.state === 'error' || status?.errors?.length) {
+            throw new Error(status.errors?.[0] || `Chore ${choreId} failed`);
+        }
+
+        log(`adaptfully: ${status?.status || status?.state || 'waiting'}…`);
+        await sleep(POLL_MS);
+    }
+
+    log(`adaptfully: downloading chore ${choreId}`);
+    const downloadUrl = `${base}yap/wrapfully/${encodeURIComponent(choreId)}`;
+    const {data, headers: resHeaders} = await axios.get(downloadUrl, {
+        headers: {Authorization: `Bearer ${accessToken}`},
+        responseType: 'arraybuffer',
+        maxContentLength: Infinity,
+        validateStatus: () => true,
+    });
+
+    const ctype = resHeaders['content-type'] || '';
+
+    if (ctype.includes('application/json')) {
+        const json = JSON.parse(Buffer.from(data).toString('utf8'));
+
+        throw new Error(json.errors?.[0] || 'Chore download returned JSON');
     }
 
-    return `${server}${family}/${stage}/${info}`;
+    return Buffer.from(data);
 }
 
 /**
@@ -41,23 +154,45 @@ function resolveWrapfullyUrl(server, stage, family, gameId, platformKey, deploym
  * @param {'build' | 'deploy' | 'release'} stage
  * @param {string} family
  * @param {string} deployFolder
- * @param {{ name: string, version: string }} pkg
+ * @param {{ name: string, version: string, config?: object }} pkg
  * @param {'extract' | string} mode
- * @param {{ log?: (message: string) => void, publishDir?: string, deploymentDirs?: string[], platformKey?: string, deploymentKey?: string, artifactPath?: string }} [options]
+ * @param {{
+ *   log?: (message: string) => void,
+ *   publishDir?: string,
+ *   deploymentDirs?: string[],
+ *   platformKey?: string,
+ *   deploymentKey?: string,
+ *   artifactPath?: string,
+ *   accessToken?: string,
+ *   encrypt?: boolean,
+ *   encryptPublicKey?: string,
+ *   wrapfullyConfig?: object,
+ * }} [options]
  */
-export async function send(gameId, contents, server, stage, family, deployFolder, pkg, mode = 'extract', options = {}) {
+export async function send (
+    gameId,
+    contents,
+    server,
+    stage,
+    family,
+    deployFolder,
+    pkg,
+    mode = 'extract',
+    options = {},
+) {
     const log = options.log ?? console.log;
     const platformKey = options.platformKey ?? family;
     const outputRoot = pkg.config?.outputFolder || 'output';
+    const accessToken = options.accessToken;
+
+    if (!accessToken) {
+        throw new Error('accessToken (Showfully PAT) is required for Yap wrapfully chores');
+    }
 
     if (mode === 'extract') {
         clearStaleBuildExtract(outputRoot);
     }
 
-    const destination = mode === 'extract'
-        ? unzipper.Extract({ path: `${outputRoot}/`, concurrency: 1 })
-        : fs.createWriteStream(`${outputRoot}/${pkg.name}-${pkg.version}-${stage}-${family}.zip`);
-
     let archiveStream;
 
     if (stage === 'deploy') {
@@ -67,9 +202,9 @@ export async function send(gameId, contents, server, stage, family, deployFolder
         if (!options.deploymentKey) {
             throw new Error('deploy stage requires options.deploymentKey');
         }
-        archiveStream = createDeployArchive(options.artifactPath, options.publishDir, contents, { log });
+        archiveStream = createDeployArchive(options.artifactPath, options.publishDir, contents, {log});
     } else if (stage === 'release') {
-        archiveStream = createReleaseArchive(deployFolder, contents, options.deploymentDirs ?? [], { log });
+        archiveStream = createReleaseArchive(deployFolder, contents, options.deploymentDirs ?? [], {log});
     } else {
         archiveStream = createSourceArchive(deployFolder, contents, {
             log,
@@ -78,33 +213,95 @@ export async function send(gameId, contents, server, stage, family, deployFolder
         });
     }
 
-    const url = resolveWrapfullyUrl(server, stage, family, gameId, platformKey, options.deploymentKey);
-    log(`adaptfully: POST ${url}`);
-
     if (stage !== 'deploy') {
         const htmlFiles = listHtmlFilesRecursive(deployFolder);
+
         log(`adaptfully: sending ${htmlFiles.length} HTML file(s) from ${path.resolve(deployFolder)}`);
     }
 
-    const { data } = await axios.post(url, archiveStream, {
-        maxRedirects: 0,
-        responseType: 'stream',
-    });
+    // Append wrapfully.json routing into the archive by rebuilding into a buffer.
+    const job = buildWrapfullyJobConfig(stage, family, gameId, platformKey, options.deploymentKey);
+    const innerChunks = [];
 
-    archiveStream.on('close', () => {
-        log('adaptfully: upload complete');
-    });
+    // Re-pack: read archiveStream into zip, add wrapfully.json
+    // Archiver streams aren't easily mutable — collect then use yazl-free approach:
+    // pipe archive to buffer, unzip to tmp, add file, rezip is heavy.
+    // Simpler: createSourceArchive already finalized as stream — append via second archiver
+    // that copies entries is complex. Instead append wrapfully.json by concatenating
+    // a sidecar zip is wrong. Best: write wrapfully.json into deploy folder meta before
+    // archive... but that mutates disk.
+    //
+    // Practical approach matching Dutifully: build archive, buffer it, then use a new
+    // archiver that includes the buffer as... no that's nested.
+    //
+    // Use jszip-like: buffer the created archive by consuming stream, then use
+    // adm-zip equivalent — we have unzipper. Extract to tmp, write wrapfully.json, rezip.
+
+    const tmpRoot = path.join(outputRoot, `.adaptfully-yap-${Date.now().toString(16)}`);
 
+    fs.mkdirSync(tmpRoot, {recursive: true});
     try {
-        await pipeline(data, destination);
-    } catch (err) {
-        if (/** @type {NodeJS.ErrnoException} */ (err).code === 'ECONNREFUSED') {
-            console.error(`Cannot connect to Wrapfully server "${server}"`);
-            process.exit(1);
-        }
-        throw err;
+        await pipeline(archiveStream, unzipper.Extract({path: tmpRoot, concurrency: 1}));
+        fs.writeFileSync(path.join(tmpRoot, 'wrapfully.json'), JSON.stringify(job, null, 2));
+
+        const {default: archiver} = await import('archiver');
+        const {PassThrough} = await import('node:stream');
+        const archive = archiver('zip', {zlib: {level: 0}});
+        const pass = new PassThrough();
+
+        archive.pipe(pass);
+        pass.on('data', (c) => innerChunks.push(c));
+
+        const done = new Promise((resolve, reject) => {
+            pass.on('end', resolve);
+            pass.on('error', reject);
+            archive.on('error', reject);
+        });
+
+        archive.directory(tmpRoot, false);
+        await archive.finalize();
+        await done;
+    } finally {
+        fs.rmSync(tmpRoot, {recursive: true, force: true});
+    }
+
+    let uploadBuffer = Buffer.concat(innerChunks);
+    let resultPriv = null;
+
+    if (options.encrypt) {
+        const {pem, kid} = resolveEncryptPublicKey(
+            options.wrapfullyConfig || {},
+            options.encryptPublicKey,
+        );
+        const resultKeyPair = generateResultKeyPair();
+        const envelope = await createEnvelopeFromInnerZip(uploadBuffer, {
+            publicKeyPem: pem,
+            kid,
+            resultKeyPair,
+        });
+
+        uploadBuffer = envelope.zip;
+        resultPriv = envelope.resultPriv;
+        log(`adaptfully: encrypting chore with kid "${kid}"`);
+    }
+
+    let resultBuffer = await submitWrapfullyChore({
+        server,
+        accessToken,
+        zipBuffer: uploadBuffer,
+        log,
+    });
+
+    if (resultPriv) {
+        resultBuffer = await decryptResultEnvelope(resultBuffer, resultPriv);
     }
 
+    const destination = mode === 'extract'
+        ? unzipper.Extract({path: `${outputRoot}/`, concurrency: 1})
+        : fs.createWriteStream(`${outputRoot}/${pkg.name}-${pkg.version}-${stage}-${family}.zip`);
+
+    await pipeline(Readable.from(resultBuffer), destination);
+
     if (mode === 'extract') {
         printBuildReport(`${stage}-${family}`, pkg);
     }

package/lib/node/index.js

@@ -62,6 +62,7 @@ export {
     ensurePublishCredentialsGitignore,
     normalizeUserPath,
     parsePublishCredentialArgv,
+    promptConfirm,
     promptRequired,
     PUBLISH_CREDENTIAL_GITIGNORE_PATTERNS,
     resolveUserPath,
@@ -90,3 +91,22 @@ export {
     runApplePublish,
     validateApplePublishJson,
 } from './apple-publish.js';
+export {
+    androidKeystoreFromCli,
+    buildAndroidBuildJson,
+    defaultAndroidDeploymentDir,
+    generateKeystore,
+    runAndroidKeystore,
+    runKeytool,
+} from './android-keystore.js';
+export {
+    appleSigningFilenames,
+    appleSigningFromCli,
+    defaultAppleSigningDir,
+    exportAppleP12,
+    generateAppleCsr,
+    mergeAppleP12PasswordBuildJson,
+    normalizeAppleSigningKind,
+    runAppleSigning,
+    runOpenssl,
+} from './apple-signing.js';