@tokamakdev/platform-ios-simulator-arm64 0.1.1-beta.38

package/ios-simulator-arm64/build/entrypoint

@@ -0,0 +1,219 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [[ $# -ne 3 || $1 != build ]]; then
+  echo "usage: entrypoint build INPUT OUTPUT" >&2
+  exit 2
+fi
+
+input=$2
+output=$3
+metadata=$input/metadata
+native_shell=$input/native-shell
+framework_root=$input/runtime/frameworks
+app_slug=$(cat "$metadata/app-slug")
+identifier=$(cat "$metadata/identifier")
+platform=$(cat "$metadata/platform")
+target=$(cat "$metadata/target")
+project_dir=$(cat "$metadata/project-dir")
+output_parent=$(dirname "$output")
+module_cache=$output_parent/.tokamak/module-cache
+temporary=$(mktemp -d "${TMPDIR:-/tmp}/tokamak-apple.XXXXXX")
+trap 'rm -rf "$temporary"' EXIT
+apple_tool=$PWD/tools/tokamak-apple-signing
+if [[ ! -x "$apple_tool" ]]; then
+  echo "Apple platform pack is missing its Apple helper: $apple_tool" >&2
+  exit 1
+fi
+
+case "$target" in
+  macos-arm64)
+    sdk=macosx
+    triple=arm64-apple-macos14.0
+    ;;
+  macos-x64)
+    sdk=macosx
+    triple=x86_64-apple-macos14.0
+    ;;
+  ios-arm64)
+    sdk=iphoneos
+    triple=arm64-apple-ios17.0
+    ;;
+  ios-simulator-arm64)
+    sdk=iphonesimulator
+    triple=arm64-apple-ios17.0-simulator
+    ;;
+  ios-simulator-x64)
+    sdk=iphonesimulator
+    triple=x86_64-apple-ios17.0-simulator
+    ;;
+  *)
+    echo "unsupported Apple target: $target" >&2
+    exit 1
+    ;;
+esac
+
+if [[ "$platform" == macos ]]; then
+  bundle=$output
+  contents=$bundle/Contents
+  executable_dir=$contents/MacOS
+  app_dir=$contents/Resources/app
+else
+  bundle=$output
+  contents=$bundle
+  executable_dir=$bundle
+  app_dir=$bundle/app
+fi
+icons=$input/icons/$platform
+icon_info_plist=$temporary/icon-info.plist
+
+sign_bundle() {
+  if [[ "$platform" == ios ]]; then
+    signing_args=(
+      sign
+      --project "$project_dir"
+      --bundle "$bundle"
+      --bundle-id "$identifier"
+    )
+    if [[ -f "$metadata/device-id" ]]; then
+      signing_args+=(--device-id "$(cat "$metadata/device-id")")
+    fi
+    "$apple_tool" "${signing_args[@]}"
+  else
+    codesign --force --timestamp=none --sign - "$bundle"
+  fi
+}
+
+bundle_key_file=$output_parent/.tokamak/$(basename "$output").input-key
+if [[ -f "$metadata/input-key" ]]; then
+  plist_path=
+  case "$platform" in
+    ios|ios-simulator) plist_path=${TOKAMAK_IOS_PLIST:-} ;;
+    macos) plist_path=${TOKAMAK_MACOS_PLIST:-} ;;
+  esac
+  if [[ -n "$plist_path" && "$plist_path" != /* ]]; then
+    plist_path=$project_dir/$plist_path
+  fi
+  bundle_key=$(
+    {
+      cat "$metadata/input-key"
+      shasum -a 256 "$0" "$apple_tool"
+      if [[ -n "$plist_path" ]]; then
+        shasum -a 256 "$plist_path"
+      fi
+      env | LC_ALL=C sort | sed -n '/^TOKAMAK_/p' |
+        sed '/^TOKAMAK_IOS_TEAM_ID=/d; /^TOKAMAK_IOS_SIGNING_IDENTITY=/d; /^TOKAMAK_IOS_PROVISIONING_PROFILE=/d'
+      printf '%s\n' "${DEVELOPER_DIR:-}" "$PATH"
+      xcodebuild -version
+    } | shasum -a 256 | cut -d ' ' -f 1
+  )
+  if [[ -d "$bundle" && -f "$bundle_key_file" && $(cat "$bundle_key_file") == "$bundle_key" ]]; then
+    cp "$input/app/worker-environment.json" "$app_dir/worker-environment.json"
+    sign_bundle
+    exit 0
+  fi
+fi
+
+rm -f "$bundle_key_file"
+rm -rf "$bundle"
+mkdir -p "$executable_dir" "$app_dir" "$module_cache"
+cp -R "$input/app/." "$app_dir/"
+
+if [[ ( "$platform" == macos || "$platform" == ios || "$platform" == ios-simulator ) && -d "$icons/AppIcon.icon" ]]; then
+  if [[ "$platform" == macos ]]; then
+    icon_output=$contents/Resources
+    icon_minimum=14.0
+    icon_targets=(--target-device mac)
+  else
+    icon_output=$bundle
+    icon_minimum=17.0
+    icon_targets=(--target-device iphone --target-device ipad)
+  fi
+  xcrun --sdk "$sdk" actool \
+    --compile "$icon_output" \
+    --platform "$sdk" \
+    --minimum-deployment-target "$icon_minimum" \
+    --app-icon AppIcon \
+    "${icon_targets[@]}" \
+    --output-partial-info-plist "$icon_info_plist" \
+    --output-format human-readable-text \
+    "$icons/AppIcon.icon"
+fi
+
+shopt -s nullglob
+swift_sources=()
+for source in "$native_shell"/*.swift; do
+  [[ -f "$source" ]] || continue
+  swift_sources+=("$source")
+done
+
+if [[ ! -f "$native_shell/TokamakShell.swift" ]]; then
+  echo "Apple native shell source is missing: $native_shell/TokamakShell.swift" >&2
+  exit 1
+fi
+
+for plugin in "$input/plugins"/*; do
+  [[ -d "$plugin" ]] || continue
+  for source in "$plugin/sources"/*; do
+    [[ -f "$source" ]] || continue
+    case "$source" in
+      *.swift) swift_sources+=("$source") ;;
+      *)
+        echo "Apple plugin source must be Swift: $source" >&2
+        exit 1
+        ;;
+    esac
+  done
+done
+
+registry=$temporary/TokamakPluginRegistry.swift
+{
+  printf '%s\n\n' 'import Foundation'
+  printf '%s\n' 'func tokamakPlugins() -> [any TokamakPlugin] {'
+  printf '%s\n' '  ['
+  for plugin in "$input/plugins"/*; do
+    [[ -d "$plugin" ]] || continue
+    printf '    %s(),\n' "$(cat "$plugin/class")"
+  done
+  printf '%s\n' '  ]'
+  printf '%s\n' '}'
+} > "$registry"
+
+swift_args=(
+  "${swift_sources[@]}"
+  "$registry"
+  -target "$triple"
+  -swift-version 5
+  -Osize
+  -whole-module-optimization
+  -module-cache-path "$module_cache"
+  -F "$framework_root"
+  -framework TokamakRuntime
+  -framework CoreFoundation
+  -lc++
+  -lresolv
+  -Xlinker -dead_strip
+  -Xlinker -no_exported_symbols
+)
+for plugin in "$input/plugins"/*; do
+  [[ -d "$plugin" ]] || continue
+  for framework_file in "$plugin/frameworks"/*; do
+    [[ -f "$framework_file" ]] || continue
+    swift_args+=(-framework "$(cat "$framework_file")")
+  done
+done
+
+xcrun --sdk "$sdk" swiftc "${swift_args[@]}" -o "$executable_dir/$app_slug"
+xcrun --sdk "$sdk" strip "$executable_dir/$app_slug"
+
+plist_args=(plist --input "$input" --output "$contents/Info.plist")
+if [[ -f "$icon_info_plist" ]]; then
+  plist_args+=(--icon-info-plist "$icon_info_plist")
+fi
+"$apple_tool" "${plist_args[@]}"
+
+sign_bundle
+if [[ -n "${bundle_key:-}" ]]; then
+  mkdir -p "$(dirname "$bundle_key_file")"
+  printf '%s' "$bundle_key" > "$bundle_key_file"
+fi

package/ios-simulator-arm64/frameworks/TokamakRuntime.framework/Headers/TokamakRuntime.h

@@ -0,0 +1,45 @@
+#ifndef TOKAMAK_RUNTIME_H
+#define TOKAMAK_RUNTIME_H
+
+#include <stdbool.h>
+#include <stddef.h>
+#include <stdint.h>
+
+enum {
+  TOKAMAK_DECISION_DEFAULT = 0,
+  TOKAMAK_DECISION_CANCEL = 1,
+  TOKAMAK_DECISION_USE = 2,
+};
+
+typedef struct {
+  uint8_t *data;
+  size_t len;
+} TokamakBytes;
+
+typedef struct {
+  TokamakBytes certificate;
+  TokamakBytes private_key;
+} TokamakIdentity;
+
+void *tokamak_runtime_start(const char *packaged_dir, const char *state_dir,
+                         const char *host, char *error, size_t error_len);
+void *tokamak_runtime_start_development(const char *state_dir, const char *host,
+                                     const char *endpoint,
+                                     const char *session_token, char *error,
+                                     size_t error_len);
+uint16_t tokamak_runtime_port(const void *runtime);
+uint16_t tokamak_runtime_restore_gateway(const void *runtime, char *error,
+                                      size_t error_len);
+bool tokamak_runtime_suspend(const void *runtime);
+bool tokamak_runtime_resume(const void *runtime);
+void tokamak_runtime_stop(void *runtime);
+
+int32_t tokamak_runtime_server_authority(const void *runtime, const char *host,
+                                      TokamakBytes *authority);
+int32_t tokamak_runtime_client_identity(const void *runtime, const char *host,
+                                     size_t previous_failures,
+                                     TokamakIdentity *identity);
+void tokamak_bytes_free(TokamakBytes bytes);
+void tokamak_identity_free(TokamakIdentity identity);
+
+#endif

package/ios-simulator-arm64/frameworks/TokamakRuntime.framework/Modules/module.modulemap

@@ -0,0 +1,4 @@
+framework module TokamakRuntime {
+  umbrella header "TokamakRuntime.h"
+  export *
+}

package/ios-simulator-arm64/native-shell/TokamakPlugins.swift

@@ -0,0 +1,216 @@
+import Foundation
+import WebKit
+
+struct TokamakPluginError: Error {
+  let name: String
+  let message: String
+
+  static func notSupported(_ message: String) -> Self {
+    Self(name: "NotSupportedError", message: message)
+  }
+}
+
+typealias TokamakPluginReply = (Result<Any?, TokamakPluginError>) -> Void
+
+protocol TokamakPlugin: AnyObject {
+  var id: String { get }
+
+  func call(
+    method: String,
+    arguments: Any,
+    reply: @escaping TokamakPluginReply
+  )
+
+  func subscribe(
+    method: String,
+    arguments: Any,
+    reply: @escaping TokamakPluginReply
+  ) -> (() -> Void)
+}
+
+extension TokamakPlugin {
+  func call(
+    method: String,
+    arguments: Any,
+    reply: @escaping TokamakPluginReply
+  ) {
+    reply(.failure(.notSupported("\(id).\(method) is not supported")))
+  }
+
+  func subscribe(
+    method: String,
+    arguments: Any,
+    reply: @escaping TokamakPluginReply
+  ) -> (() -> Void) {
+    reply(.failure(.notSupported("\(id).\(method) is not supported")))
+    return {}
+  }
+}
+
+final class TokamakPluginBridge: NSObject, WKScriptMessageHandler {
+  private struct RequestKey: Hashable {
+    let session: String
+    let id: Int
+  }
+
+  private let host: String
+  private let plugins: [String: any TokamakPlugin]
+  private var cancellations: [RequestKey: () -> Void] = [:]
+  weak var webView: WKWebView?
+
+  init(host: String, plugins: [any TokamakPlugin]) {
+    self.host = host
+    var pluginsById: [String: any TokamakPlugin] = [:]
+    for plugin in plugins {
+      precondition(pluginsById[plugin.id] == nil, "Duplicate plugin ID")
+      pluginsById[plugin.id] = plugin
+    }
+    self.plugins = pluginsById
+  }
+
+  func install(in controller: WKUserContentController) {
+    controller.add(self, name: "tokamak")
+    controller.addUserScript(
+      WKUserScript(
+        source: Self.bootstrap(host: host),
+        injectionTime: .atDocumentStart,
+        forMainFrameOnly: true
+      )
+    )
+  }
+
+  func close() {
+    let cancelAll = Array(cancellations.values)
+    cancellations.removeAll()
+    for cancel in cancelAll {
+      cancel()
+    }
+  }
+
+  func userContentController(
+    _ userContentController: WKUserContentController,
+    didReceive message: WKScriptMessage
+  ) {
+    let origin = message.frameInfo.securityOrigin
+    guard
+      message.frameInfo.isMainFrame,
+      origin.protocol == "https",
+      origin.host == host,
+      origin.port == 0 || origin.port == 443,
+      let encoded = message.body as? String,
+      let data = encoded.data(using: .utf8),
+      let request = try? JSONSerialization.jsonObject(with: data)
+        as? [String: Any],
+      let type = request["type"] as? String,
+      let session = request["session"] as? String
+    else {
+      return
+    }
+
+    if type == "reset" {
+      close()
+      return
+    }
+    guard let id = request["id"] as? Int else { return }
+    let key = RequestKey(session: session, id: id)
+    if type == "cancel" {
+      cancellations.removeValue(forKey: key)?()
+      return
+    }
+    dispatch(type: type, key: key, request: request)
+  }
+
+  private func dispatch(
+    type: String,
+    key: RequestKey,
+    request: [String: Any]
+  ) {
+    guard
+      let pluginId = request["plugin"] as? String,
+      let method = request["method"] as? String,
+      let plugin = plugins[pluginId]
+    else {
+      send(
+        key: key,
+        result: .failure(.notSupported("Plugin is not supported")),
+        done: true
+      )
+      return
+    }
+    let arguments = request["arguments"] ?? NSNull()
+    let reply: TokamakPluginReply = { [weak self] result in
+      self?.send(key: key, result: result, done: type == "call")
+    }
+    switch type {
+    case "call":
+      plugin.call(method: method, arguments: arguments, reply: reply)
+    case "subscribe":
+      let cancellation = plugin.subscribe(
+        method: method,
+        arguments: arguments,
+        reply: reply
+      )
+      cancellations[key] = cancellation
+    default:
+      send(
+        key: key,
+        result: .failure(.notSupported("Plugin operation is not supported")),
+        done: true
+      )
+    }
+  }
+
+  private func send(
+    key: RequestKey,
+    result: Result<Any?, TokamakPluginError>,
+    done: Bool
+  ) {
+    if done {
+      cancellations.removeValue(forKey: key)?()
+    }
+    var response: [String: Any] = [
+      "session": key.session,
+      "id": key.id,
+      "done": done,
+    ]
+    switch result {
+    case .success(let value):
+      response["value"] = value ?? NSNull()
+    case .failure(let error):
+      response["error"] = ["name": error.name, "message": error.message]
+    }
+    guard
+      JSONSerialization.isValidJSONObject(response),
+      let data = try? JSONSerialization.data(withJSONObject: response),
+      let json = String(data: data, encoding: .utf8)
+    else {
+      return
+    }
+    DispatchQueue.main.async { [weak self] in
+      guard
+        let self,
+        self.webView?.url?.scheme == "https",
+        self.webView?.url?.host == self.host,
+        self.webView?.url?.port == nil || self.webView?.url?.port == 443
+      else {
+        return
+      }
+      self.webView?.evaluateJavaScript(
+        "globalThis.__tokamakReceive?.(\(json))"
+      )
+    }
+  }
+
+  private static func bootstrap(host: String) -> String {
+    """
+    if (globalThis.location.origin === "https://\(host)") {
+      globalThis.__tokamakNative = {
+        onmessage: null,
+        postMessage(message) {
+          globalThis.webkit.messageHandlers.tokamak.postMessage(message);
+        }
+      };
+    }
+    """
+  }
+}

package/ios-simulator-arm64/native-shell/TokamakShell.swift

@@ -0,0 +1,645 @@
+import Foundation
+import Network
+import Security
+import TokamakRuntime
+import WebKit
+
+#if os(macOS)
+  import AppKit
+#else
+  import UIKit
+#endif
+
+private let startupErrorFile = "startup-error.log"
+private let failurePage =
+  "<h1>App failed to start</h1><p>Check startup-error.log for details.</p>"
+
+private enum ShellError: Error, CustomStringConvertible {
+  case configuration(String)
+  case runtime(String)
+
+  var description: String {
+    switch self {
+    case .configuration(let message), .runtime(let message):
+      return message
+    }
+  }
+}
+
+private enum AuthenticationMaterial<Value> {
+  case defaultHandling
+  case cancel
+  case use(Value)
+}
+
+private final class RuntimeHost {
+  let host: String
+  private var handle: UnsafeMutableRawPointer?
+
+  init() throws {
+    guard
+      let host = Bundle.main.object(forInfoDictionaryKey: "TokamakHost") as? String,
+      !host.isEmpty
+    else {
+      throw ShellError.configuration("TokamakHost is required")
+    }
+    self.host = host
+
+    let state = try Self.stateDirectory()
+    var error = [CChar](repeating: 0, count: 512)
+    if let endpoint = Bundle.main.object(forInfoDictionaryKey: "TokamakDevEndpoint") as? String,
+      let sessionToken = Bundle.main.object(forInfoDictionaryKey: "TokamakDevSessionToken")
+        as? String
+    {
+      handle = state.path.withCString { statePath in
+        host.withCString { host in
+          endpoint.withCString { endpoint in
+            sessionToken.withCString { sessionToken in
+              error.withUnsafeMutableBufferPointer { error in
+                tokamak_runtime_start_development(
+                  statePath,
+                  host,
+                  endpoint,
+                  sessionToken,
+                  error.baseAddress,
+                  error.count
+                )
+              }
+            }
+          }
+        }
+      }
+    } else {
+      let bundle = Bundle.main.resourceURL?.appendingPathComponent("app")
+      guard let bundle else {
+        throw ShellError.configuration("app bundle resources are unavailable")
+      }
+      handle = bundle.path.withCString { bundlePath in
+        state.path.withCString { statePath in
+          host.withCString { host in
+            error.withUnsafeMutableBufferPointer { error in
+              tokamak_runtime_start(
+                bundlePath,
+                statePath,
+                host,
+                error.baseAddress,
+                error.count
+              )
+            }
+          }
+        }
+      }
+    }
+    guard handle != nil else {
+      throw ShellError.runtime(String(cString: error))
+    }
+    try? FileManager.default.removeItem(
+      at: state.appendingPathComponent(startupErrorFile)
+    )
+  }
+
+  deinit {
+    if let handle {
+      tokamak_runtime_stop(handle)
+    }
+  }
+
+  var port: UInt16 {
+    tokamak_runtime_port(handle)
+  }
+
+  func restoreGateway() throws -> UInt16 {
+    var error = [CChar](repeating: 0, count: 512)
+    let port = error.withUnsafeMutableBufferPointer { error in
+      tokamak_runtime_restore_gateway(
+        handle,
+        error.baseAddress,
+        error.count
+      )
+    }
+    guard port != 0 else {
+      throw ShellError.runtime(String(cString: error))
+    }
+    return port
+  }
+
+  func serverAuthority(
+    host: String
+  ) -> AuthenticationMaterial<Data> {
+    var bytes = TokamakBytes(data: nil, len: 0)
+    let decision = host.withCString {
+      tokamak_runtime_server_authority(handle, $0, &bytes)
+    }
+    switch decision {
+    case Int32(TOKAMAK_DECISION_DEFAULT):
+      return .defaultHandling
+    case Int32(TOKAMAK_DECISION_USE):
+      defer { tokamak_bytes_free(bytes) }
+      guard let data = bytes.data else { return .cancel }
+      return .use(Data(bytes: data, count: bytes.len))
+    default:
+      return .cancel
+    }
+  }
+
+  func clientIdentity(
+    host: String,
+    previousFailures: Int
+  ) -> AuthenticationMaterial<(Data, Data)> {
+    var identity = TokamakIdentity(
+      certificate: TokamakBytes(data: nil, len: 0),
+      private_key: TokamakBytes(data: nil, len: 0)
+    )
+    let decision = host.withCString {
+      tokamak_runtime_client_identity(
+        handle,
+        $0,
+        max(previousFailures, 0),
+        &identity
+      )
+    }
+    switch decision {
+    case Int32(TOKAMAK_DECISION_DEFAULT):
+      return .defaultHandling
+    case Int32(TOKAMAK_DECISION_USE):
+      defer { tokamak_identity_free(identity) }
+      guard
+        let certificate = identity.certificate.data,
+        let privateKey = identity.private_key.data
+      else {
+        return .cancel
+      }
+      return .use(
+        (
+          Data(bytes: certificate, count: identity.certificate.len),
+          Data(bytes: privateKey, count: identity.private_key.len)
+        ))
+    default:
+      return .cancel
+    }
+  }
+
+  static func recordStartupFailure(_ error: Error) {
+    print("tokamak runtime startup failed: \(error)")
+    guard let state = try? stateDirectory() else { return }
+    try? String(describing: error).write(
+      to: state.appendingPathComponent(startupErrorFile),
+      atomically: true,
+      encoding: .utf8
+    )
+  }
+
+  private static func stateDirectory() throws -> URL {
+    guard let identifier = Bundle.main.bundleIdentifier else {
+      throw ShellError.configuration("CFBundleIdentifier is required")
+    }
+    let root = try FileManager.default.url(
+      for: .cachesDirectory,
+      in: .userDomainMask,
+      appropriateFor: nil,
+      create: true
+    )
+    let state = root.appendingPathComponent(identifier, isDirectory: true)
+    try FileManager.default.createDirectory(
+      at: state,
+      withIntermediateDirectories: true
+    )
+    return state
+  }
+}
+
+private final class NavigationDelegate: NSObject, WKNavigationDelegate, WKUIDelegate {
+  private let runtime: RuntimeHost
+  private let pluginBridge: TokamakPluginBridge
+
+  init(runtime: RuntimeHost, pluginBridge: TokamakPluginBridge) {
+    self.runtime = runtime
+    self.pluginBridge = pluginBridge
+  }
+
+  func webView(
+    _ webView: WKWebView,
+    didStartProvisionalNavigation navigation: WKNavigation?
+  ) {
+    pluginBridge.close()
+  }
+
+  func webView(
+    _ webView: WKWebView,
+    decidePolicyFor navigationAction: WKNavigationAction,
+    decisionHandler: @escaping (WKNavigationActionPolicy) -> Void
+  ) {
+    guard let url = navigationAction.request.url else {
+      decisionHandler(.cancel)
+      return
+    }
+
+    if navigationAction.targetFrame?.isMainFrame == false {
+      decisionHandler(.allow)
+      return
+    }
+
+    if isAppOrigin(url) {
+      if navigationAction.targetFrame == nil {
+        webView.load(navigationAction.request)
+        decisionHandler(.cancel)
+      } else {
+        decisionHandler(.allow)
+      }
+      return
+    }
+
+    openExternal(url)
+    decisionHandler(.cancel)
+  }
+
+  func webView(
+    _ webView: WKWebView,
+    decidePolicyFor navigationResponse: WKNavigationResponse,
+    decisionHandler: @escaping (WKNavigationResponsePolicy) -> Void
+  ) {
+    guard
+      navigationResponse.isForMainFrame,
+      let url = navigationResponse.response.url
+    else {
+      decisionHandler(.allow)
+      return
+    }
+
+    if isAppOrigin(url) {
+      decisionHandler(.allow)
+    } else {
+      openExternal(url)
+      decisionHandler(.cancel)
+    }
+  }
+
+  func webView(
+    _ webView: WKWebView,
+    createWebViewWith configuration: WKWebViewConfiguration,
+    for navigationAction: WKNavigationAction,
+    windowFeatures: WKWindowFeatures
+  ) -> WKWebView? {
+    _ = (configuration, windowFeatures)
+    guard let url = navigationAction.request.url else { return nil }
+    if isAppOrigin(url) {
+      webView.load(navigationAction.request)
+    } else {
+      openExternal(url)
+    }
+    return nil
+  }
+
+  func webView(
+    _ webView: WKWebView,
+    didReceive challenge: URLAuthenticationChallenge,
+    completionHandler:
+      @escaping (
+        URLSession.AuthChallengeDisposition,
+        URLCredential?
+      ) -> Void
+  ) {
+    let space = challenge.protectionSpace
+    switch space.authenticationMethod {
+    case NSURLAuthenticationMethodServerTrust:
+      answer(
+        runtime.serverAuthority(host: space.host),
+        trust: space.serverTrust,
+        completion: completionHandler
+      )
+    case NSURLAuthenticationMethodClientCertificate:
+      answer(
+        runtime.clientIdentity(
+          host: space.host,
+          previousFailures: challenge.previousFailureCount
+        ),
+        completion: completionHandler
+      )
+    default:
+      completionHandler(.performDefaultHandling, nil)
+    }
+  }
+
+  func webView(
+    _ webView: WKWebView,
+    didFailProvisionalNavigation navigation: WKNavigation?,
+    withError error: Error
+  ) {
+    print("tokamak WebView navigation failed: \(error)")
+  }
+
+  private func isAppOrigin(_ url: URL) -> Bool {
+    guard
+      url.scheme?.caseInsensitiveCompare("https") == .orderedSame,
+      url.host?.caseInsensitiveCompare(runtime.host) == .orderedSame
+    else {
+      return false
+    }
+    return url.port == nil || url.port == 443
+  }
+
+  private func openExternal(_ url: URL) {
+    #if os(iOS)
+      UIApplication.shared.open(url)
+    #else
+      NSWorkspace.shared.open(url)
+    #endif
+  }
+
+  private func answer(
+    _ material: AuthenticationMaterial<Data>,
+    trust: SecTrust?,
+    completion:
+      @escaping (
+        URLSession.AuthChallengeDisposition,
+        URLCredential?
+      ) -> Void
+  ) {
+    switch material {
+    case .defaultHandling:
+      completion(.performDefaultHandling, nil)
+    case .cancel:
+      completion(.cancelAuthenticationChallenge, nil)
+    case .use(let authority):
+      guard
+        let trust,
+        let certificate = SecCertificateCreateWithData(
+          nil,
+          authority as CFData
+        ),
+        SecTrustSetAnchorCertificates(
+          trust,
+          [certificate] as CFArray
+        ) == errSecSuccess,
+        SecTrustSetAnchorCertificatesOnly(trust, true) == errSecSuccess
+      else {
+        completion(.cancelAuthenticationChallenge, nil)
+        return
+      }
+      let queue = DispatchQueue.global(qos: .userInitiated)
+      queue.async {
+        SecTrustEvaluateAsyncWithError(trust, queue) { trust, trusted, _ in
+          DispatchQueue.main.async {
+            guard trusted else {
+              completion(.cancelAuthenticationChallenge, nil)
+              return
+            }
+            completion(.useCredential, URLCredential(trust: trust))
+          }
+        }
+      }
+    }
+  }
+
+  private func answer(
+    _ material: AuthenticationMaterial<(Data, Data)>,
+    completion: (
+      URLSession.AuthChallengeDisposition,
+      URLCredential?
+    ) -> Void
+  ) {
+    switch material {
+    case .defaultHandling:
+      completion(.performDefaultHandling, nil)
+    case .cancel:
+      completion(.cancelAuthenticationChallenge, nil)
+    case .use(let value):
+      guard
+        let identity = identity(
+          certificate: value.0,
+          privateKey: value.1
+        )
+      else {
+        completion(.cancelAuthenticationChallenge, nil)
+        return
+      }
+      completion(
+        .useCredential,
+        URLCredential(
+          identity: identity,
+          certificates: nil,
+          persistence: .none
+        )
+      )
+    }
+  }
+
+  private func identity(
+    certificate: Data,
+    privateKey: Data
+  ) -> SecIdentity? {
+    guard
+      let certificate = SecCertificateCreateWithData(
+        nil,
+        certificate as CFData
+      )
+    else {
+      return nil
+    }
+    let attributes: [CFString: Any] = [
+      kSecAttrKeyType: kSecAttrKeyTypeECSECPrimeRandom,
+      kSecAttrKeyClass: kSecAttrKeyClassPrivate,
+      kSecAttrKeySizeInBits: 256,
+    ]
+    guard
+      let key = SecKeyCreateWithData(
+        privateKey as CFData,
+        attributes as CFDictionary,
+        nil
+      )
+    else {
+      return nil
+    }
+    return SecIdentityCreate(nil, certificate, key)
+  }
+}
+
+private final class TokamakController {
+  private var runtime: RuntimeHost?
+  private var navigation: NavigationDelegate?
+  private var pluginBridge: TokamakPluginBridge?
+  private weak var activeWebView: WKWebView?
+  private var dataStore: WKWebsiteDataStore?
+  private var proxyPort: UInt16?
+
+  func start(
+    frame: CGRect,
+    completion: @escaping (WKWebView) -> Void
+  ) {
+    DispatchQueue.global(qos: .userInitiated).async {
+      let result = Result { try RuntimeHost() }
+      DispatchQueue.main.async {
+        switch result {
+        case .success(let runtime):
+          self.runtime = runtime
+          completion(self.webView(frame: frame, runtime: runtime))
+        case .failure(let error):
+          RuntimeHost.recordStartupFailure(error)
+          completion(self.failureWebView(frame: frame))
+        }
+      }
+    }
+  }
+
+  func restoreGateway() {
+    guard let runtime, let dataStore else { return }
+    do {
+      let port = try runtime.restoreGateway()
+      guard port != proxyPort else { return }
+      setProxy(port: port, host: runtime.host, dataStore: dataStore)
+      proxyPort = port
+      activeWebView?.reload()
+    } catch {
+      print("tokamak gateway could not recover: \(error)")
+    }
+  }
+
+  private func webView(frame: CGRect, runtime: RuntimeHost) -> WKWebView {
+    let configuration = WKWebViewConfiguration()
+    let dataStore = WKWebsiteDataStore.default()
+    let port = runtime.port
+    setProxy(port: port, host: runtime.host, dataStore: dataStore)
+    self.dataStore = dataStore
+    self.proxyPort = port
+    configuration.websiteDataStore = dataStore
+
+    let pluginBridge = TokamakPluginBridge(
+      host: runtime.host,
+      plugins: tokamakPlugins()
+    )
+    pluginBridge.install(in: configuration.userContentController)
+    let navigation = NavigationDelegate(
+      runtime: runtime,
+      pluginBridge: pluginBridge
+    )
+    self.navigation = navigation
+    let webView = WKWebView(frame: frame, configuration: configuration)
+    #if os(iOS)
+      webView.scrollView.bounces = false
+    #endif
+    webView.allowsLinkPreview = false
+    activeWebView = webView
+    pluginBridge.webView = webView
+    self.pluginBridge = pluginBridge
+    webView.navigationDelegate = navigation
+    webView.uiDelegate = navigation
+    webView.load(URLRequest(url: URL(string: "https://\(runtime.host)/")!))
+    return webView
+  }
+
+  private func setProxy(
+    port: UInt16,
+    host: String,
+    dataStore: WKWebsiteDataStore
+  ) {
+    var proxy = ProxyConfiguration(
+      httpCONNECTProxy: .hostPort(
+        host: "127.0.0.1",
+        port: NWEndpoint.Port(rawValue: port)!
+      )
+    )
+    proxy.matchDomains = [host]
+    proxy.allowFailover = false
+    dataStore.proxyConfigurations = [proxy]
+  }
+
+  private func failureWebView(frame: CGRect) -> WKWebView {
+    let webView = WKWebView(frame: frame)
+    webView.loadHTMLString(failurePage, baseURL: nil)
+    return webView
+  }
+}
+
+#if os(macOS)
+  private final class TokamakMacApplicationDelegate: NSObject, NSApplicationDelegate {
+    private let controller = TokamakController()
+    private var window: NSWindow?
+
+    func applicationDidFinishLaunching(_ notification: Notification) {
+      let window = NSWindow(
+        contentRect: NSRect(x: 0, y: 0, width: 1024, height: 768),
+        styleMask: [
+          .titled,
+          .closable,
+          .miniaturizable,
+          .resizable,
+        ],
+        backing: .buffered,
+        defer: false
+      )
+      window.title =
+        Bundle.main.object(
+          forInfoDictionaryKey: "CFBundleName"
+        ) as? String ?? "tokamak"
+      window.center()
+      window.makeKeyAndOrderFront(nil)
+      NSApplication.shared.activate(ignoringOtherApps: true)
+      self.window = window
+
+      guard let content = window.contentView else { return }
+      controller.start(frame: content.bounds) { webView in
+        webView.autoresizingMask = [.width, .height]
+        content.addSubview(webView)
+      }
+    }
+
+    func applicationShouldTerminateAfterLastWindowClosed(
+      _ sender: NSApplication
+    ) -> Bool {
+      true
+    }
+  }
+
+  @main
+  private enum TokamakApplication {
+    static func main() {
+      let application = NSApplication.shared
+      let delegate = TokamakMacApplicationDelegate()
+      application.setActivationPolicy(.regular)
+      application.delegate = delegate
+      application.run()
+    }
+  }
+#else
+  private final class TokamakIOSApplicationDelegate: UIResponder, UIApplicationDelegate {
+    private let controller = TokamakController()
+    var window: UIWindow?
+
+    func application(
+      _ application: UIApplication,
+      didFinishLaunchingWithOptions launchOptions: [UIApplication.LaunchOptionsKey: Any]?
+    ) -> Bool {
+      let window = UIWindow(frame: UIScreen.main.bounds)
+      let viewController = UIViewController()
+      window.rootViewController = viewController
+      window.makeKeyAndVisible()
+      self.window = window
+
+      controller.start(frame: viewController.view.bounds) { webView in
+        webView.autoresizingMask = [
+          .flexibleWidth,
+          .flexibleHeight,
+        ]
+        viewController.view.addSubview(webView)
+      }
+      return true
+    }
+
+    func applicationWillEnterForeground(_ application: UIApplication) {
+      controller.restoreGateway()
+    }
+
+  }
+
+  @main
+  private enum TokamakApplication {
+    static func main() {
+      UIApplicationMain(
+        CommandLine.argc,
+        CommandLine.unsafeArgv,
+        nil,
+        NSStringFromClass(TokamakIOSApplicationDelegate.self)
+      )
+    }
+  }
+#endif

package/ios-simulator-arm64/platform-pack.json

@@ -0,0 +1,21 @@
+{
+  "tokamakVersion": "0.1.1",
+  "target": "ios-simulator-arm64",
+  "artifacts": [
+    {
+      "kind": "runtimeLibrary",
+      "path": "frameworks/TokamakRuntime.framework"
+    },
+    {
+      "kind": "nativeShellDirectory",
+      "path": "native-shell"
+    },
+    {
+      "kind": "esbuildExecutable",
+      "path": "tools/runtime/node_modules/esbuild/bin/esbuild"
+    }
+  ],
+  "requiredTools": [
+    "xcrun"
+  ]
+}

package/ios-simulator-arm64/tools/runtime/node_modules/@esbuild/darwin-arm64/README.md

@@ -0,0 +1,3 @@
+# esbuild
+
+This is the macOS ARM 64-bit binary for esbuild, a JavaScript bundler and minifier. See https://github.com/evanw/esbuild for details.

package/ios-simulator-arm64/tools/runtime/node_modules/@esbuild/darwin-arm64/package.json

@@ -0,0 +1,20 @@
+{
+  "name": "@esbuild/darwin-arm64",
+  "version": "0.28.1",
+  "description": "The macOS ARM 64-bit binary for esbuild, a JavaScript bundler.",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/evanw/esbuild.git"
+  },
+  "license": "MIT",
+  "preferUnplugged": true,
+  "engines": {
+    "node": ">=18"
+  },
+  "os": [
+    "darwin"
+  ],
+  "cpu": [
+    "arm64"
+  ]
+}

package/ios-simulator-arm64/tools/runtime/node_modules/@esbuild/darwin-x64/README.md

@@ -0,0 +1,3 @@
+# esbuild
+
+This is the macOS 64-bit binary for esbuild, a JavaScript bundler and minifier. See https://github.com/evanw/esbuild for details.

package/ios-simulator-arm64/tools/runtime/node_modules/@esbuild/darwin-x64/package.json

@@ -0,0 +1,20 @@
+{
+  "name": "@esbuild/darwin-x64",
+  "version": "0.28.1",
+  "description": "The macOS 64-bit binary for esbuild, a JavaScript bundler.",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/evanw/esbuild.git"
+  },
+  "license": "MIT",
+  "preferUnplugged": true,
+  "engines": {
+    "node": ">=18"
+  },
+  "os": [
+    "darwin"
+  ],
+  "cpu": [
+    "x64"
+  ]
+}

package/ios-simulator-arm64/tools/runtime/node_modules/@esbuild/linux-x64/README.md

@@ -0,0 +1,3 @@
+# esbuild
+
+This is the Linux 64-bit binary for esbuild, a JavaScript bundler and minifier. See https://github.com/evanw/esbuild for details.

package/ios-simulator-arm64/tools/runtime/node_modules/@esbuild/linux-x64/package.json

@@ -0,0 +1,20 @@
+{
+  "name": "@esbuild/linux-x64",
+  "version": "0.28.1",
+  "description": "The Linux 64-bit binary for esbuild, a JavaScript bundler.",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/evanw/esbuild.git"
+  },
+  "license": "MIT",
+  "preferUnplugged": true,
+  "engines": {
+    "node": ">=18"
+  },
+  "os": [
+    "linux"
+  ],
+  "cpu": [
+    "x64"
+  ]
+}

package/ios-simulator-arm64/tools/runtime/node_modules/@esbuild/win32-x64/README.md

@@ -0,0 +1,3 @@
+# esbuild
+
+This is the Windows 64-bit binary for esbuild, a JavaScript bundler and minifier. See https://github.com/evanw/esbuild for details.

package/ios-simulator-arm64/tools/runtime/node_modules/@esbuild/win32-x64/package.json

@@ -0,0 +1,20 @@
+{
+  "name": "@esbuild/win32-x64",
+  "version": "0.28.1",
+  "description": "The Windows 64-bit binary for esbuild, a JavaScript bundler.",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/evanw/esbuild.git"
+  },
+  "license": "MIT",
+  "preferUnplugged": true,
+  "engines": {
+    "node": ">=18"
+  },
+  "os": [
+    "win32"
+  ],
+  "cpu": [
+    "x64"
+  ]
+}

package/ios-simulator-arm64/tools/runtime/node_modules/esbuild/LICENSE.md

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2020 Evan Wallace
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/ios-simulator-arm64/tools/runtime/node_modules/esbuild/bin/esbuild

@@ -0,0 +1,24 @@
+const { spawnSync } = require("node:child_process");
+const path = require("node:path");
+
+function esbuildPath(platform, arch) {
+  const hosts = ["darwin-arm64", "darwin-x64", "linux-x64", "win32-x64"];
+  const host = `${platform}-${arch}`;
+  if (!hosts.includes(host)) {
+    throw new Error(`tokamak does not provide esbuild for ${host}`);
+  }
+  const executable = platform === "win32" ? "esbuild.exe" : "bin/esbuild";
+  return path.resolve(__dirname, "../..", "@esbuild", host, executable);
+}
+
+if (require.main === module) {
+  const result = spawnSync(esbuildPath(process.platform, process.arch), process.argv.slice(2), {
+    stdio: "inherit",
+  });
+  if (result.error) {
+    throw result.error;
+  }
+  process.exit(result.status ?? 1);
+}
+
+module.exports = { esbuildPath };

package/package.json

@@ -0,0 +1,23 @@
+{
+  "name": "@tokamakdev/platform-ios-simulator-arm64",
+  "version": "0.1.1-beta.38",
+  "description": "The tokamak platform pack for ios-simulator-arm64",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/mantty/tokamak.git",
+    "directory": "tokamak-cli/npm/platform-packs/ios-simulator-arm64"
+  },
+  "os": [
+    "darwin"
+  ],
+  "cpu": [
+    "arm64"
+  ],
+  "preferUnplugged": true,
+  "files": [
+    "ios-simulator-arm64"
+  ],
+  "publishConfig": {
+    "access": "public"
+  }
+}