akanjs 3.0.0-beta.20 → 3.0.0-beta.21

package/vendor/@akanjs/native/packages/cli/src/lib/root.ts

@@ -0,0 +1,18 @@
+import { existsSync } from "node:fs";
+import { dirname, join } from "node:path";
+
+/**
+ * The package's own folder, where the native shells (native/), the Maven lock, the Rust toolchain
+ * file and the builtin plugins (plugins/) are. Found by walking up from this file to a file that
+ * ships with the package, not by counting folders or reading package.json: akanjs copies the
+ * package into its dist vendor/ folder without package.json, tsconfig.json or tests.
+ */
+function findRoot(): string {
+  for (let dir = import.meta.dir; ; dir = dirname(dir)) {
+    if (existsSync(join(dir, "native", "android", "maven.lock.json")) && existsSync(join(dir, "plugins"))) return dir;
+    if (dirname(dir) === dir)
+      throw new Error(`the package root (native/android/maven.lock.json) is not above ${import.meta.dir}`);
+  }
+}
+
+export const PACKAGE_ROOT = findRoot();

package/vendor/@akanjs/native/packages/cli/src/lib/routes.ts

@@ -0,0 +1,3 @@
+
+
+export { isHostPath, type Route, route as routeRequest } from "../../../core/src/kernel.ts";

package/vendor/@akanjs/native/packages/cli/src/lib/serve.ts

@@ -0,0 +1,83 @@
+
+
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { routeRequest } from "./routes.ts";
+
+export interface ServeOptions {
+  dir: string;
+  port: number;
+  hostname?: string;
+  /** Replaces the built __akan_native/init.js (runtime env overrides). */
+  initScript?: () => string;
+  /** akan-native dev: serve a reload channel and append its client to init.js. */
+  liveReload?: LiveReload;
+}
+
+/** Server-sent events that tell open pages to reload (akan-native dev web). */
+export class LiveReload {
+  private clients = new Set<ReadableStreamDefaultController<string>>();
+
+  response(): Response {
+    let self: ReadableStreamDefaultController<string>;
+    const stream = new ReadableStream<string>({
+      start: (controller) => {
+        self = controller;
+        this.clients.add(controller);
+        controller.enqueue(": connected\n\n");
+      },
+      cancel: () => {
+        this.clients.delete(self);
+      },
+    });
+    return new Response(stream, { headers: { "content-type": "text/event-stream", "cache-control": "no-cache" } });
+  }
+
+  reload(): void {
+    for (const client of this.clients) {
+      try {
+        client.enqueue("data: reload\n\n");
+      } catch {
+        this.clients.delete(client);
+      }
+    }
+  }
+
+  static readonly CLIENT =
+    ";(function(){try{var s=new EventSource('/__akan_native/dev/events');s.onmessage=function(){location.reload()}}catch(e){}})();\n";
+}
+
+export function serveApp({ dir, port, hostname = "localhost", initScript, liveReload }: ServeOptions) {
+  const exists = (rel: string) => {
+    const path = join(dir, rel);
+    return existsSync(path) && statSync(path).isFile();
+  };
+  const noCache = { "cache-control": "no-cache" };
+
+  return Bun.serve({
+    port,
+    hostname,
+    fetch(req) {
+      const url = new URL(req.url);
+      if (req.method !== "GET" && req.method !== "HEAD") return new Response("method not allowed", { status: 405 });
+      
+      if (liveReload && url.pathname === "/__akan_native/dev/events") return liveReload.response();
+      const route = routeRequest(url.pathname, exists);
+      switch (route.kind) {
+        case "init": {
+          const base = initScript ? initScript() : readFileSync(join(dir, "__akan_native", "init.js"), "utf8");
+          return new Response(liveReload ? base + LiveReload.CLIENT : base, {
+            headers: { ...noCache, "content-type": "text/javascript; charset=utf-8" },
+          });
+        }
+        case "asset": {
+          const file = Bun.file(join(dir, route.path));
+          return new Response(file, { headers: route.path === "index.html" ? noCache : {} });
+        }
+        default:
+          
+          return new Response("not found", { status: 404 });
+      }
+    },
+  });
+}

package/vendor/@akanjs/native/packages/cli/src/lib/signing.ts

@@ -0,0 +1,117 @@
+
+
+import { randomBytes } from "node:crypto";
+import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir, userInfo } from "node:os";
+import { join } from "node:path";
+import { exec, execOrThrow } from "./exec.ts";
+import { CliError } from "./log.ts";
+import { akanNativeHome } from "./toolchains.ts";
+
+export interface SigningIdentity {
+  /** SHA-1 of the certificate, what `codesign --sign` takes. */
+  hash: string;
+  name: string;
+}
+
+const LOGIN_KEYCHAIN = join(userInfo().homedir, "Library", "Keychains", "login.keychain-db");
+export const identityName = () => `akan-native dev: ${userInfo().username}`;
+const recordPath = (env = process.env) => join(akanNativeHome(env), "signing.json");
+
+/** Valid (trusted) code-signing identities in the keychains. */
+export async function validIdentities(): Promise<SigningIdentity[]> {
+  const out = (await exec(["/usr/bin/security", "find-identity", "-v", "-p", "codesigning"], { echo: false })).stdout;
+  return [...out.matchAll(/\d+\) ([0-9A-F]{40}) "([^"]+)"/g)].map((m) => ({ hash: m[1]!, name: m[2]! }));
+}
+
+/** The identity `akan-native signing setup` made, if it is still valid; null means ad-hoc signing. */
+export async function devIdentity(env = process.env): Promise<SigningIdentity | null> {
+  if (env.AKAN_NATIVE_SIGNING === "adhoc" || !existsSync(recordPath(env))) return null;
+  const record = JSON.parse(readFileSync(recordPath(env), "utf8")) as SigningIdentity;
+  return (await validIdentities()).find((i) => i.hash === record.hash) ?? null;
+}
+
+export async function setupSigning(): Promise<{ identity: SigningIdentity; created: boolean }> {
+  if (process.platform !== "darwin") throw new CliError("akan-native signing setup is for macOS");
+  const name = identityName();
+  const existing = (await validIdentities()).find((i) => i.name === name);
+  if (existing) {
+    writeFileSync(recordPath(), `${JSON.stringify(existing, null, 2)}\n`);
+    return { identity: existing, created: false };
+  }
+  const dir = mkdtempSync(join(tmpdir(), "akan-native-signing-"));
+  try {
+    const cnf = join(dir, "cert.cnf");
+    writeFileSync(
+      cnf,
+      `[req]
+distinguished_name = dn
+x509_extensions = ext
+prompt = no
+[dn]
+CN = ${name}
+[ext]
+basicConstraints = critical,CA:false
+keyUsage = critical,digitalSignature
+extendedKeyUsage = critical,codeSigning
+`,
+    );
+    const key = join(dir, "key.pem");
+    const cert = join(dir, "cert.pem");
+    const p12 = join(dir, "identity.p12");
+    const pass = randomBytes(16).toString("hex");
+    await execOrThrow(
+      [
+        "/usr/bin/openssl",
+        "req",
+        "-x509",
+        "-newkey",
+        "rsa:2048",
+        "-nodes",
+        "-keyout",
+        key,
+        "-out",
+        cert,
+        "-days",
+        "3650",
+        "-config",
+        cnf,
+      ],
+      { echo: false },
+    );
+    await execOrThrow(
+      [
+        "/usr/bin/openssl",
+        "pkcs12",
+        "-export",
+        "-inkey",
+        key,
+        "-in",
+        cert,
+        "-out",
+        p12,
+        "-passout",
+        `pass:${pass}`,
+        "-name",
+        name,
+      ],
+      { echo: false },
+    );
+    await execOrThrow(
+      ["/usr/bin/security", "import", p12, "-k", LOGIN_KEYCHAIN, "-P", pass, "-T", "/usr/bin/codesign"],
+      { echo: false },
+    );
+    
+    await execOrThrow(
+      ["/usr/bin/security", "add-trusted-cert", "-r", "trustRoot", "-p", "codeSign", "-k", LOGIN_KEYCHAIN, cert],
+      { echo: false, inherit: true },
+    );
+    const identity = (await validIdentities()).find((i) => i.name === name);
+    if (!identity)
+      throw new CliError(`the certificate "${name}" was imported but is not a valid code-signing identity`);
+    writeFileSync(recordPath(), `${JSON.stringify(identity, null, 2)}\n`);
+    return { identity, created: true };
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+}