@protobase/server 0.57.1 → 0.57.3

package/dist/better-auth/auth-settings.d.ts

@@ -1008,7 +1008,7 @@ export declare const buildAppAuth: (settings: AuthSettings, input: AppAuthInput)
           $Infer: {
             body: {
               permissions: {
-                readonly user?: ("create" | "update" | "delete" | "list" | "set-role" | "ban" | "impersonate" | "set-password" | "set-email" | "get" | "impersonate-admins")[] | undefined;
+                readonly user?: ("get" | "create" | "update" | "delete" | "list" | "set-role" | "ban" | "impersonate" | "set-password" | "set-email" | "impersonate-admins")[] | undefined;
                 readonly session?: ("delete" | "list" | "revoke")[] | undefined;
               };
             } & {

package/dist/better-auth/create-auth.d.ts

@@ -1133,7 +1133,7 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
           $Infer: {
             body: {
               permissions: {
-                readonly user?: ("create" | "update" | "delete" | "list" | "set-role" | "ban" | "impersonate" | "set-password" | "set-email" | "get" | "impersonate-admins")[] | undefined;
+                readonly user?: ("get" | "create" | "update" | "delete" | "list" | "set-role" | "ban" | "impersonate" | "set-password" | "set-email" | "impersonate-admins")[] | undefined;
                 readonly session?: ("delete" | "list" | "revoke")[] | undefined;
               };
             } & {

package/dist/mobile-release/release-statement.js

@@ -0,0 +1,24 @@
+import { releaseStatementContext } from "@protobase/schema/internal";
+import { sign } from "node:crypto";
+//#region src/mobile-release/release-statement.ts
+/**
+* The statement file of a release bound to `binding`, signed with `signingKey` (see `releaseStatementFile`). The
+* device verifies the signature over the payload's decoded bytes as they are, then parses those same bytes.
+*/
+const releaseStatement = (binding, signingKey) => {
+	const { manifest, order, appId, fingerprint, shellVersion } = binding;
+	const payload = Buffer.from(JSON.stringify({
+		manifest,
+		order,
+		appId,
+		fingerprint,
+		shellVersion
+	}));
+	const signature = sign("sha256", Buffer.concat([Buffer.from(releaseStatementContext), payload]), signingKey);
+	return new TextEncoder().encode(JSON.stringify({
+		payload: payload.toString("hex"),
+		signature: signature.toString("hex")
+	}));
+};
+//#endregion
+export { releaseStatement };

package/dist/mobile-release/release.d.ts

@@ -1,3 +1,4 @@
+import { ReleaseBinding } from "@protobase/schema/internal";
 import { KeyObject } from "node:crypto";
 //#region src/mobile-release/release.d.ts
 /** A file of a release: its path inside the app's files, such as `assets/index-abc123.js`, and its bytes. */
@@ -12,13 +13,18 @@ export type ServedReleaseFile = {
   signature?: string;
 };
 /**
- * A release of the app's files: its bundle id, a hash of its manifest and of the signing key's public key, and every
- * file by `href`, the manifest included.
+ * A release of the app's files: its bundle id, a hash of what binds it and of the signing key's public key, and every
+ * file by `href`, the manifest and, signed, the statement included.
  */
 export type MobileRelease = {
   bundleId: string;
   files: Map<string, ServedReleaseFile>;
 };
+/** How a release is signed: the key, and what its statement binds it to beside the manifest. */
+export type ReleaseSigning = {
+  key: KeyObject;
+  binding: Omit<ReleaseBinding, 'manifest'>;
+};
 /** The updater's manifest of `files`: each one's `href`, sha256 in hex and size, in the order of their hrefs. */
 export declare const releaseManifest: (files: ReleaseFile[]) => {
   href: string;
@@ -26,8 +32,9 @@ export declare const releaseManifest: (files: ReleaseFile[]) => {
   sizeInBytes: number;
 }[];
 /**
- * The release of `files`, each hashed and, with `signingKey`, signed once here. Its manifest is served as a file of
- * its own, so a file of the app may not have the manifest's name.
+ * The release of `files`, each hashed and, with `signing`, signed once here. Its manifest is served as a file of its
+ * own and, signed, so is its statement, so a file of the app may not have their names. Signed, the id hashes the
+ * statement, which holds the manifest's hash, so the same files released in another order get another id.
  */
-export declare const composeRelease: (files: ReleaseFile[], signingKey?: KeyObject) => MobileRelease;
+export declare const composeRelease: (files: ReleaseFile[], signing?: ReleaseSigning) => MobileRelease;
 //#endregion

package/dist/mobile-release/release.js

@@ -1,4 +1,5 @@
-import { releaseManifestFile } from "@protobase/schema/internal";
+import { releaseStatement } from "./release-statement.js";
+import { releaseManifestFile, releaseStatementContext, releaseStatementFile } from "@protobase/schema/internal";
 import { createHash, createPublicKey, sign } from "node:crypto";
 //#region src/mobile-release/release.ts
 const sha256 = (content) => createHash("sha256").update(content).digest("hex");
@@ -13,21 +14,34 @@ const signer = (signingKey) => signingKey ? createPublicKey(signingKey).export({
 	type: "spki",
 	format: "der"
 }) : /* @__PURE__ */ new Uint8Array();
+const context = new TextEncoder().encode(releaseStatementContext);
+const startsWithContext = (content) => content.byteLength >= context.byteLength && context.every((byte, i) => content[i] === byte);
 /**
-* The release of `files`, each hashed and, with `signingKey`, signed once here. Its manifest is served as a file of
-* its own, so a file of the app may not have the manifest's name.
+* The release of `files`, each hashed and, with `signing`, signed once here. Its manifest is served as a file of its
+* own and, signed, so is its statement, so a file of the app may not have their names. Signed, the id hashes the
+* statement, which holds the manifest's hash, so the same files released in another order get another id.
 */
-const composeRelease = (files, signingKey) => {
-	if (files.some((file) => file.href === releaseManifestFile)) throw new Error(`The app's files have a ${releaseManifestFile}, the name of the updater's manifest: rename it`);
+const composeRelease = (files, signing) => {
+	for (const name of [releaseManifestFile, releaseStatementFile]) if (files.some((file) => file.href === name)) throw new Error(`The app's files have a ${name}, the name of a file of the updater's: rename it`);
+	const signed = files.find((file) => startsWithContext(file.content));
+	if (signed) throw new Error(`The app's file ${signed.href} starts as a release statement's signed bytes do: change its first line`);
 	const manifest = new TextEncoder().encode(JSON.stringify(releaseManifest(files)));
+	const statement = signing && releaseStatement({
+		manifest: sha256(manifest),
+		...signing.binding
+	}, signing.key);
 	const served = (content) => ({
 		content,
 		checksum: sha256(content),
-		...signingKey && { signature: signature(content, signingKey) }
+		...signing && { signature: signature(content, signing.key) }
 	});
 	return {
-		bundleId: createHash("sha256").update(manifest).update(signer(signingKey)).digest("hex").slice(0, 16),
-		files: new Map([...files.map(({ href, content }) => [href, served(content)]), [releaseManifestFile, served(manifest)]])
+		bundleId: createHash("sha256").update(statement ?? manifest).update(signer(signing?.key)).digest("hex").slice(0, 16),
+		files: new Map([
+			...files.map(({ href, content }) => [href, served(content)]),
+			[releaseManifestFile, served(manifest)],
+			...statement ? [[releaseStatementFile, served(statement)]] : []
+		])
 	};
 };
 //#endregion

package/dist/mobile-release.d.ts

@@ -1,6 +1,6 @@
-import { MobileRelease, ReleaseFile, ServedReleaseFile, composeRelease, releaseManifest } from "./mobile-release/release.js";
+import { MobileRelease, ReleaseFile, ReleaseSigning, ServedReleaseFile, composeRelease, releaseManifest } from "./mobile-release/release.js";
 import { MobileReleaseAppInput, OfferedRelease, mobileReleaseApp } from "./mobile-release/release-app.js";
 import { mobileSigningKeyVariable, readSigningKey } from "./mobile-release/signing-key.js";
 import { nativeFingerprint } from "./mobile-release/fingerprint.js";
 import { withApiOrigin } from "./mobile-release/api-origin-page.js";
-export { type MobileRelease, type MobileReleaseAppInput, type OfferedRelease, type ReleaseFile, type ServedReleaseFile, composeRelease, mobileReleaseApp, mobileSigningKeyVariable, nativeFingerprint, readSigningKey, releaseManifest, withApiOrigin };
+export { type MobileRelease, type MobileReleaseAppInput, type OfferedRelease, type ReleaseFile, type ReleaseSigning, type ServedReleaseFile, composeRelease, mobileReleaseApp, mobileSigningKeyVariable, nativeFingerprint, readSigningKey, releaseManifest, withApiOrigin };

package/dist/package.js

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.57.1";
+var version = "0.57.3";
 //#endregion
 export { version };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.57.1",
+  "version": "0.57.3",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -41,9 +41,9 @@
     "@better-auth/passkey": "^1.7.12",
     "@better-auth/sso": "^1.7.12",
     "@modelcontextprotocol/server": "^2.3.1",
-    "@protobase/layout": "0.57.1",
-    "@protobase/query": "0.57.1",
-    "@protobase/schema": "0.57.1",
+    "@protobase/layout": "0.57.3",
+    "@protobase/query": "0.57.3",
+    "@protobase/schema": "0.57.3",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",