@protobase/server 0.57.2 → 0.57.4

package/dist/mobile-config.d.ts

@@ -5,5 +5,10 @@ export type MobileConfig = {
   appId: string;
   /** Extra native Capacitor plugins the app needs, as npm name → version range, such as `{ '@capacitor/camera': '^8.0.0' }`. */
   plugins?: Record<string, string>;
+  /**
+   * The public key, PEM, of the RSA key in `PROTOBASE_MOBILE_SIGNING_KEY`, which `protobase mobile keys`
+   * prints: with it the Android app updates itself, taking only releases signed with that key.
+   */
+  publicKey?: string;
 };
 //#endregion

package/dist/mobile-release/release-order.d.ts

@@ -0,0 +1,17 @@
+//#region src/mobile-release/release-order.d.ts
+/** What a release's order is computed from: when its bundle was built, and the shell served in place of the bundle's copy. */
+export type ReleaseOrderInput = {
+  builtAt?: number;
+  shell?: {
+    builtAt?: number;
+  };
+};
+/**
+ * The order of a release: when its bundle was built, then when the server's own shell it serves instead of the
+ * bundle's copy was built, 0 with the copy. `undefined` when the bundle or that shell names no build time. The mobile
+ * app's built-in files are a bundle's copy, so their order is `[builtAt, 0]`.
+ */
+export declare const releaseOrder: ({ builtAt, shell }: ReleaseOrderInput) => number[] | undefined;
+/** An order as the Android live updater reads it, such as `1800000000000,0`. */
+export declare const formatReleaseOrder: (order: number[]) => string;
+//#endregion

package/dist/mobile-release/release-order.js

@@ -0,0 +1,16 @@
+//#region src/mobile-release/release-order.ts
+/**
+* The order of a release: when its bundle was built, then when the server's own shell it serves instead of the
+* bundle's copy was built, 0 with the copy. `undefined` when the bundle or that shell names no build time. The mobile
+* app's built-in files are a bundle's copy, so their order is `[builtAt, 0]`.
+*/
+const releaseOrder = ({ builtAt, shell }) => {
+	if (builtAt === void 0) return;
+	if (!shell) return [builtAt, 0];
+	if (shell.builtAt === void 0) return;
+	return [builtAt, shell.builtAt];
+};
+/** An order as the Android live updater reads it, such as `1800000000000,0`. */
+const formatReleaseOrder = (order) => order.join(",");
+//#endregion
+export { formatReleaseOrder, releaseOrder };

package/dist/mobile-release/release-statement.js

@@ -0,0 +1,24 @@
+import { releaseStatementContext } from "@protobase/schema/internal";
+import { sign } from "node:crypto";
+//#region src/mobile-release/release-statement.ts
+/**
+* The statement file of a release bound to `binding`, signed with `signingKey` (see `releaseStatementFile`). The
+* device verifies the signature over the payload's decoded bytes as they are, then parses those same bytes.
+*/
+const releaseStatement = (binding, signingKey) => {
+	const { manifest, order, appId, fingerprint, shellVersion } = binding;
+	const payload = Buffer.from(JSON.stringify({
+		manifest,
+		order,
+		appId,
+		fingerprint,
+		shellVersion
+	}));
+	const signature = sign("sha256", Buffer.concat([Buffer.from(releaseStatementContext), payload]), signingKey);
+	return new TextEncoder().encode(JSON.stringify({
+		payload: payload.toString("hex"),
+		signature: signature.toString("hex")
+	}));
+};
+//#endregion
+export { releaseStatement };

package/dist/mobile-release/release.d.ts

@@ -1,3 +1,4 @@
+import { ReleaseBinding } from "@protobase/schema/internal";
 import { KeyObject } from "node:crypto";
 //#region src/mobile-release/release.d.ts
 /** A file of a release: its path inside the app's files, such as `assets/index-abc123.js`, and its bytes. */
@@ -12,13 +13,18 @@ export type ServedReleaseFile = {
   signature?: string;
 };
 /**
- * A release of the app's files: its bundle id, a hash of its manifest and of the signing key's public key, and every
- * file by `href`, the manifest included.
+ * A release of the app's files: its bundle id, a hash of what binds it and of the signing key's public key, and every
+ * file by `href`, the manifest and, signed, the statement included.
  */
 export type MobileRelease = {
   bundleId: string;
   files: Map<string, ServedReleaseFile>;
 };
+/** How a release is signed: the key, and what its statement binds it to beside the manifest. */
+export type ReleaseSigning = {
+  key: KeyObject;
+  binding: Omit<ReleaseBinding, 'manifest'>;
+};
 /** The updater's manifest of `files`: each one's `href`, sha256 in hex and size, in the order of their hrefs. */
 export declare const releaseManifest: (files: ReleaseFile[]) => {
   href: string;
@@ -26,8 +32,9 @@ export declare const releaseManifest: (files: ReleaseFile[]) => {
   sizeInBytes: number;
 }[];
 /**
- * The release of `files`, each hashed and, with `signingKey`, signed once here. Its manifest is served as a file of
- * its own, so a file of the app may not have the manifest's name.
+ * The release of `files`, each hashed and, with `signing`, signed once here. Its manifest is served as a file of its
+ * own and, signed, so is its statement, so a file of the app may not have their names. Signed, the id hashes the
+ * statement, which holds the manifest's hash, so the same files released in another order get another id.
  */
-export declare const composeRelease: (files: ReleaseFile[], signingKey?: KeyObject) => MobileRelease;
+export declare const composeRelease: (files: ReleaseFile[], signing?: ReleaseSigning) => MobileRelease;
 //#endregion

package/dist/mobile-release/release.js

@@ -1,4 +1,5 @@
-import { releaseManifestFile } from "@protobase/schema/internal";
+import { releaseStatement } from "./release-statement.js";
+import { releaseManifestFile, releaseStatementContext, releaseStatementFile } from "@protobase/schema/internal";
 import { createHash, createPublicKey, sign } from "node:crypto";
 //#region src/mobile-release/release.ts
 const sha256 = (content) => createHash("sha256").update(content).digest("hex");
@@ -13,21 +14,34 @@ const signer = (signingKey) => signingKey ? createPublicKey(signingKey).export({
 	type: "spki",
 	format: "der"
 }) : /* @__PURE__ */ new Uint8Array();
+const context = new TextEncoder().encode(releaseStatementContext);
+const startsWithContext = (content) => content.byteLength >= context.byteLength && context.every((byte, i) => content[i] === byte);
 /**
-* The release of `files`, each hashed and, with `signingKey`, signed once here. Its manifest is served as a file of
-* its own, so a file of the app may not have the manifest's name.
+* The release of `files`, each hashed and, with `signing`, signed once here. Its manifest is served as a file of its
+* own and, signed, so is its statement, so a file of the app may not have their names. Signed, the id hashes the
+* statement, which holds the manifest's hash, so the same files released in another order get another id.
 */
-const composeRelease = (files, signingKey) => {
-	if (files.some((file) => file.href === releaseManifestFile)) throw new Error(`The app's files have a ${releaseManifestFile}, the name of the updater's manifest: rename it`);
+const composeRelease = (files, signing) => {
+	for (const name of [releaseManifestFile, releaseStatementFile]) if (files.some((file) => file.href === name)) throw new Error(`The app's files have a ${name}, the name of a file of the updater's: rename it`);
+	const signed = files.find((file) => startsWithContext(file.content));
+	if (signed) throw new Error(`The app's file ${signed.href} starts as a release statement's signed bytes do: change its first line`);
 	const manifest = new TextEncoder().encode(JSON.stringify(releaseManifest(files)));
+	const statement = signing && releaseStatement({
+		manifest: sha256(manifest),
+		...signing.binding
+	}, signing.key);
 	const served = (content) => ({
 		content,
 		checksum: sha256(content),
-		...signingKey && { signature: signature(content, signingKey) }
+		...signing && { signature: signature(content, signing.key) }
 	});
 	return {
-		bundleId: createHash("sha256").update(manifest).update(signer(signingKey)).digest("hex").slice(0, 16),
-		files: new Map([...files.map(({ href, content }) => [href, served(content)]), [releaseManifestFile, served(manifest)]])
+		bundleId: createHash("sha256").update(statement ?? manifest).update(signer(signing?.key)).digest("hex").slice(0, 16),
+		files: new Map([
+			...files.map(({ href, content }) => [href, served(content)]),
+			[releaseManifestFile, served(manifest)],
+			...statement ? [[releaseStatementFile, served(statement)]] : []
+		])
 	};
 };
 //#endregion

package/dist/mobile-release.d.ts

@@ -1,6 +1,7 @@
-import { MobileRelease, ReleaseFile, ServedReleaseFile, composeRelease, releaseManifest } from "./mobile-release/release.js";
+import { MobileRelease, ReleaseFile, ReleaseSigning, ServedReleaseFile, composeRelease, releaseManifest } from "./mobile-release/release.js";
 import { MobileReleaseAppInput, OfferedRelease, mobileReleaseApp } from "./mobile-release/release-app.js";
 import { mobileSigningKeyVariable, readSigningKey } from "./mobile-release/signing-key.js";
 import { nativeFingerprint } from "./mobile-release/fingerprint.js";
+import { ReleaseOrderInput, formatReleaseOrder, releaseOrder } from "./mobile-release/release-order.js";
 import { withApiOrigin } from "./mobile-release/api-origin-page.js";
-export { type MobileRelease, type MobileReleaseAppInput, type OfferedRelease, type ReleaseFile, type ServedReleaseFile, composeRelease, mobileReleaseApp, mobileSigningKeyVariable, nativeFingerprint, readSigningKey, releaseManifest, withApiOrigin };
+export { type MobileRelease, type MobileReleaseAppInput, type OfferedRelease, type ReleaseFile, type ReleaseOrderInput, type ReleaseSigning, type ServedReleaseFile, composeRelease, formatReleaseOrder, mobileReleaseApp, mobileSigningKeyVariable, nativeFingerprint, readSigningKey, releaseManifest, releaseOrder, withApiOrigin };

package/dist/mobile-release.js

@@ -2,5 +2,6 @@ import { composeRelease, releaseManifest } from "./mobile-release/release.js";
 import { mobileReleaseApp } from "./mobile-release/release-app.js";
 import { mobileSigningKeyVariable, readSigningKey } from "./mobile-release/signing-key.js";
 import { nativeFingerprint } from "./mobile-release/fingerprint.js";
+import { formatReleaseOrder, releaseOrder } from "./mobile-release/release-order.js";
 import { withApiOrigin } from "./mobile-release/api-origin-page.js";
-export { composeRelease, mobileReleaseApp, mobileSigningKeyVariable, nativeFingerprint, readSigningKey, releaseManifest, withApiOrigin };
+export { composeRelease, formatReleaseOrder, mobileReleaseApp, mobileSigningKeyVariable, nativeFingerprint, readSigningKey, releaseManifest, releaseOrder, withApiOrigin };

package/dist/package.js

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.57.2";
+var version = "0.57.4";
 //#endregion
 export { version };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.57.2",
+  "version": "0.57.4",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -41,9 +41,9 @@
     "@better-auth/passkey": "^1.7.12",
     "@better-auth/sso": "^1.7.12",
     "@modelcontextprotocol/server": "^2.3.1",
-    "@protobase/layout": "0.57.2",
-    "@protobase/query": "0.57.2",
-    "@protobase/schema": "0.57.2",
+    "@protobase/layout": "0.57.4",
+    "@protobase/query": "0.57.4",
+    "@protobase/schema": "0.57.4",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",