@shipvo/cli 0.1.4 → 0.1.6

package/dist/report-md.js

@@ -0,0 +1,58 @@
+const one = (s) => s.replace(/\s+/g, " ").trim();
+/** Inline code that survives backticks in the text. */
+function code(s) {
+    const t = one(s);
+    const fence = "`".repeat(Math.max(0, ...[...t.matchAll(/`+/g)].map((m) => m[0].length)) + 1);
+    return `${fence}${t.startsWith("`") || t.endsWith("`") ? ` ${t} ` : t}${fence}`;
+}
+export function stepText(s) {
+    const kind = s.kind ?? "step";
+    if (kind === "tap")
+        return `tap "${s.target ?? ""}"`;
+    if (kind === "type")
+        return `type "${s.text ?? ""}" into "${s.target ?? ""}"${s.enter ? " and press enter" : ""}`;
+    const arg = s.text ?? s.target;
+    return arg !== undefined ? `${kind} "${arg}"` : kind;
+}
+function block(s) {
+    const fence = "`".repeat(Math.max(2, ...[...s.matchAll(/`+/g)].map((m) => m[0].length)) + 1);
+    return `${fence}\n${s}\n${fence}`;
+}
+export function renderReportMarkdown(report) {
+    const flows = Array.isArray(report.flows) ? report.flows : [];
+    const failed = flows.filter((f) => f.status === "failed");
+    const out = [`# Shipvo test report: ${failed.length ? "failed" : "all flows passed"}`, ""];
+    const meta = [];
+    if (report.app)
+        meta.push(`- App: ${code(report.app)}`);
+    meta.push(`- Release: ${report.release ? code(report.release) : "not set"}`);
+    meta.push(`- Commit: ${report.commit ? code(report.commit) : "unknown"}`);
+    if (report.time)
+        meta.push(`- Time: ${report.time}`);
+    meta.push(`- Flows: ${flows.length - failed.length} passed, ${failed.length} failed`);
+    out.push(...meta, "");
+    if (!failed.length)
+        out.push(flows.length ? `All ${flows.length} flow${flows.length === 1 ? "" : "s"} passed.` : "No flows were run.", "");
+    for (const f of failed) {
+        out.push(`## Failing flow: ${code(f.name ?? "unnamed flow")}`, "");
+        const bad = f.failedStep;
+        if (bad)
+            out.push(`Failed step${bad.line ? ` (line ${bad.line})` : ""}: ${code(stepText(bad))}`, "");
+        if (f.message)
+            out.push("Error:", "", block(f.message), "");
+        const shots = [...(f.screenshots ?? []), ...(f.screenshot ? [f.screenshot] : [])];
+        if (shots.length)
+            out.push(`Screenshots: ${shots.map(code).join(", ")}`, "");
+        if (f.steps?.length) {
+            out.push("Steps:", "");
+            f.steps.forEach((s, i) => {
+                const mark = bad && s.line !== undefined && s.line === bad.line ? " ← failed" : "";
+                out.push(`${i + 1}. ${code(stepText(s))}${mark}`);
+            });
+            out.push("");
+        }
+    }
+    if (report.parityLimits?.length)
+        out.push("## Parity limits", "", ...report.parityLimits.map((l) => `- ${one(l)}`), "");
+    return out.join("\n");
+}

package/dist/rotation.d.ts

@@ -0,0 +1,57 @@
+export type RotationEnvelope = {
+    body: string;
+    signature: string;
+};
+export type RotationStatement = {
+    type: "key-rotation";
+    appId: string;
+    sequence: number;
+    newKey: string;
+    validFrom: string;
+};
+export type RotationFailure = "bad_envelope" | "bad_signature" | "bad_body" | "wrong_type" | "wrong_app" | "bad_sequence" | "replay" | "too_far" | "bad_key";
+export type RotationResult = {
+    ok: true;
+    statement: RotationStatement;
+} | {
+    ok: false;
+    reason: RotationFailure;
+};
+export declare const MAX_BODY_BYTES = 1024;
+export declare const MAX_PENDING_DAYS = 90;
+/** The body string. Key order is fixed; the signer keeps these exact bytes. */
+export declare function buildStatementBody(s: {
+    appId: string;
+    sequence: number;
+    newKey: string;
+    validFrom: string;
+}): string;
+/** Sign the exact UTF-8 bytes of `body` with the root seed. */
+export declare function signStatement(s: {
+    appId: string;
+    sequence: number;
+    newKey: string;
+    validFrom: string;
+}, rootSeedB64: string): RotationEnvelope;
+/**
+ * Check one envelope in the order of design section 8, then section 3.
+ * `effectiveSequence` is max(stored sequence, build minimum). `now` is the runtime clock.
+ */
+export declare function verifyStatement(env: unknown, rootPublicKeyB64: string, ctx: {
+    appId: string;
+    effectiveSequence: number;
+    now: Date;
+}): RotationResult;
+export declare class RotateError extends Error {
+}
+type Cfg = {
+    appId: string;
+    controlPlane: string;
+};
+export declare const ROTATE_HELP = "Usage:\n  shipvo keys rotate sign --root-seed-file <file> --new-key <public key> --sequence <n> [--valid-from <ISO time>] [--json]\n  shipvo keys rotate upload <envelope.json> [--json]\n\nsign works offline. It reads the ROOT seed from a file (never the release seed) and prints the signed envelope.\n--valid-from defaults to now (an emergency rotation). It may be at most 90 days ahead.\nPick a sequence above every statement you signed before. To override a planned statement, use a higher one.\nupload needs a signed-in owner session (shipvo login). Tokens are refused by the control plane.\n";
+/** Runs `shipvo keys rotate ...`. Throws RotateError for user mistakes; the caller prints it and exits 1. */
+export declare function rotate(argv: string[], cfg: Cfg, deps?: {
+    fetchFn?: typeof fetch;
+    now?: () => Date;
+}): Promise<void>;
+export {};

package/dist/rotation.js

@@ -0,0 +1,157 @@
+// Root-signed key rotation statements (docs/design/key-rotation.md, sections 3, 6 and 8).
+// `signStatement` and `verifyStatement` follow the wire format that the Android and iOS runtimes will check.
+import * as ed from "@noble/ed25519";
+import { readFileSync } from "node:fs";
+import { b64, keyFromSeed, unb64 } from "./index.js";
+import { args } from "./config.js";
+import { savedCreds } from "./login.js";
+export const MAX_BODY_BYTES = 1024;
+export const MAX_PENDING_DAYS = 90;
+const enc = new TextEncoder();
+/** The body string. Key order is fixed; the signer keeps these exact bytes. */
+export function buildStatementBody(s) {
+    if (!Number.isSafeInteger(s.sequence) || s.sequence < 1)
+        throw new Error("sequence must be an integer, at least 1 and at most 9007199254740991");
+    if (unb64(s.newKey).length !== 32)
+        throw new Error("the new release key must be a 32-byte Ed25519 public key (base64)");
+    const t = Date.parse(s.validFrom);
+    if (Number.isNaN(t))
+        throw new Error("validFrom must be an ISO 8601 UTC time");
+    return JSON.stringify({ type: "key-rotation", appId: s.appId, sequence: s.sequence, newKey: s.newKey, validFrom: new Date(t).toISOString() });
+}
+/** Sign the exact UTF-8 bytes of `body` with the root seed. */
+export function signStatement(s, rootSeedB64) {
+    const body = buildStatementBody(s);
+    const { seed } = keyFromSeed(rootSeedB64);
+    return { body, signature: b64(ed.sign(enc.encode(body), seed)) };
+}
+/**
+ * Check one envelope in the order of design section 8, then section 3.
+ * `effectiveSequence` is max(stored sequence, build minimum). `now` is the runtime clock.
+ */
+export function verifyStatement(env, rootPublicKeyB64, ctx) {
+    const e = env;
+    if (!e || typeof e.body !== "string" || typeof e.signature !== "string" || enc.encode(e.body).length > MAX_BODY_BYTES)
+        return { ok: false, reason: "bad_envelope" };
+    let good = false;
+    try {
+        good = ed.verify(unb64(e.signature), enc.encode(e.body), unb64(rootPublicKeyB64));
+    }
+    catch {
+        good = false;
+    }
+    if (!good)
+        return { ok: false, reason: "bad_signature" };
+    let s;
+    try {
+        s = JSON.parse(e.body);
+    }
+    catch {
+        return { ok: false, reason: "bad_body" };
+    }
+    if (!s || typeof s !== "object" || Array.isArray(s))
+        return { ok: false, reason: "bad_body" };
+    if (s.type !== "key-rotation")
+        return { ok: false, reason: "wrong_type" };
+    if (s.appId !== ctx.appId)
+        return { ok: false, reason: "wrong_app" };
+    if (!Number.isSafeInteger(s.sequence) || s.sequence < 1)
+        return { ok: false, reason: "bad_sequence" };
+    if (s.sequence <= ctx.effectiveSequence)
+        return { ok: false, reason: "replay" };
+    const from = typeof s.validFrom === "string" ? Date.parse(s.validFrom) : NaN;
+    if (Number.isNaN(from))
+        return { ok: false, reason: "bad_body" };
+    if (from > ctx.now.getTime() + MAX_PENDING_DAYS * 86_400_000)
+        return { ok: false, reason: "too_far" };
+    if (typeof s.newKey !== "string" || unb64(s.newKey).length !== 32)
+        return { ok: false, reason: "bad_key" };
+    return { ok: true, statement: s };
+}
+export class RotateError extends Error {
+}
+export const ROTATE_HELP = `Usage:
+  shipvo keys rotate sign --root-seed-file <file> --new-key <public key> --sequence <n> [--valid-from <ISO time>] [--json]
+  shipvo keys rotate upload <envelope.json> [--json]
+
+sign works offline. It reads the ROOT seed from a file (never the release seed) and prints the signed envelope.
+--valid-from defaults to now (an emergency rotation). It may be at most ${MAX_PENDING_DAYS} days ahead.
+Pick a sequence above every statement you signed before. To override a planned statement, use a higher one.
+upload needs a signed-in owner session (shipvo login). Tokens are refused by the control plane.
+`;
+/** Runs `shipvo keys rotate ...`. Throws RotateError for user mistakes; the caller prints it and exits 1. */
+export async function rotate(argv, cfg, deps = {}) {
+    const [sub, ...rest] = argv, a = args(rest), json = a.json === "true";
+    const now = (deps.now ?? (() => new Date()))();
+    if (sub === "sign") {
+        const file = a["root-seed-file"], newKey = a["new-key"], seq = a.sequence;
+        if (!file || file === "true" || !newKey || newKey === "true" || !seq || seq === "true")
+            throw new RotateError(ROTATE_HELP);
+        let rootSeed;
+        try {
+            rootSeed = readFileSync(file, "utf8").trim();
+        }
+        catch {
+            throw new RotateError(`Cannot read the root seed file ${file}.`);
+        }
+        try {
+            keyFromSeed(rootSeed);
+        }
+        catch {
+            throw new RotateError("The root seed is not valid: it must be a 32-byte value in base64.");
+        }
+        if (!/^\d+$/.test(seq) || !Number.isSafeInteger(Number(seq)) || Number(seq) < 1)
+            throw new RotateError("--sequence must be a whole number from 1 to 9007199254740991.");
+        const validFrom = a["valid-from"] && a["valid-from"] !== "true" ? a["valid-from"] : now.toISOString();
+        const t = Date.parse(validFrom);
+        if (Number.isNaN(t))
+            throw new RotateError("--valid-from must be an ISO 8601 UTC time, such as 2026-11-06T00:00:00Z.");
+        if (t > now.getTime() + MAX_PENDING_DAYS * 86_400_000)
+            throw new RotateError(`--valid-from is more than ${MAX_PENDING_DAYS} days ahead. Phones would reject it.`);
+        let env;
+        try {
+            env = signStatement({ appId: cfg.appId, sequence: Number(seq), newKey, validFrom }, rootSeed);
+        }
+        catch (e) {
+            throw new RotateError(e instanceof Error ? e.message : String(e));
+        }
+        console.log(JSON.stringify(env, null, json ? 0 : 2));
+        if (!json)
+            console.error(`Signed rotation statement ${seq} for "${cfg.appId}". Confirm ${seq} is above every statement you signed before; this offline tool cannot check. Then run: shipvo keys rotate upload <file>`);
+        return;
+    }
+    if (sub === "upload") {
+        const file = rest.find((x) => !x.startsWith("--"));
+        if (!file)
+            throw new RotateError(ROTATE_HELP);
+        let env;
+        try {
+            env = JSON.parse(readFileSync(file === "-" ? 0 : file, "utf8"));
+        }
+        catch {
+            throw new RotateError(`${file} is not a readable JSON envelope.`);
+        }
+        if (typeof env?.body !== "string" || typeof env?.signature !== "string")
+            throw new RotateError("The envelope needs a string \"body\" and a string \"signature\".");
+        const creds = savedCreds();
+        if (!creds?.key)
+            throw new RotateError("Not signed in. Run `shipvo login` as the app owner. Tokens cannot upload rotation statements.");
+        const norm = (u) => u.replace(/\/$/, "");
+        if (norm(creds.control ?? "") !== norm(cfg.controlPlane))
+            throw new RotateError(`shipvo.json controlPlane is ${cfg.controlPlane}, but you signed in at ${creds.control || "another host"}. Not sending your session key there. Fix controlPlane or run \`shipvo login\` for that host.`);
+        const url = `${cfg.controlPlane.replace(/\/$/, "")}/rotation/${encodeURIComponent(cfg.appId)}`;
+        let r;
+        try {
+            r = await (deps.fetchFn ?? fetch)(url, { method: "POST", headers: { authorization: `Bearer ${creds.key}`, "content-type": "application/json" }, body: JSON.stringify({ body: env.body, signature: env.signature }) });
+        }
+        catch (e) {
+            throw new RotateError(`Could not reach the control plane at ${cfg.controlPlane} (${e instanceof Error ? e.message : String(e)}).`);
+        }
+        const out = await r.json().catch(() => ({}));
+        if (!r.ok)
+            throw new RotateError(`The control plane refused the statement (HTTP ${r.status}): ${out.message ?? out.reason ?? out.error ?? "no reason given"}`);
+        console.log(json ? JSON.stringify({ ok: true, ...out }) : `Uploaded. Phones switch when they next fetch it.`);
+        return;
+    }
+    throw new RotateError(ROTATE_HELP);
+}

package/dist/run-bridge.d.ts

@@ -0,0 +1,7 @@
+/**
+ * The shared screen rules (`@shipvo/sim`), as source that the page can run. Same copy the simulator uses.
+ * Only plain `export function` / `export const` lines are supported: `export default` and `export {…}` would not be stripped.
+ */
+export declare function screenRulesSource(): string;
+/** The script text served at `/__shipvo/bridge.js`. It reads the session token from its own `data-token` attribute and then removes the attribute. */
+export declare function bridgeScript(rules?: string): string;