akanjs 3.0.0-beta.20 → 3.0.0-beta.21

package/vendor/@akanjs/native/packages/cli/src/lib/updates.ts

@@ -0,0 +1,160 @@
+
+
+import { createHash, createPrivateKey, createPublicKey, generateKeyPairSync, sign, verify } from "node:crypto";
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import type { Platform } from "../../../core/src/index.ts";
+import { CliError } from "./log.ts";
+import { akanNativeHome } from "./toolchains.ts";
+
+export interface UpdatesConfig {
+  /** Base URL of the update files, e.g. "https://example.com/updates". http:// only for localhost / 10.0.2.2 in dev builds. */
+  url: string;
+  /** Raw 32-byte Ed25519 public key, base64 (`akan-native update keygen` prints it). */
+  publicKey: string;
+  /** Manifest name under <platform>/. Default "production". */
+  channel: string;
+  /** How long a newly applied bundle has to call notifyReady() before it is rolled back, ms. Default 10000. */
+  readyTimeout: number;
+}
+
+export interface UpdateFile {
+  /** Relative path inside the bundle ("index.html", "icons/a.png", "env.runtime.json"). */
+  path: string;
+  sha256: string;
+  size: number;
+}
+
+export type DesktopArch = "arm64" | "x64";
+
+/** The CPU of the desktop apps this machine builds (cargo and bun build for the host). */
+export function hostArch(): DesktopArch {
+  if (process.arch === "arm64" || process.arch === "x64") return process.arch;
+  throw new CliError(`desktop apps are built for arm64 or x64, not ${process.arch}`);
+}
+
+export interface UpdateManifest {
+  schema: 1;
+  kind: "web" | "app";
+  app: string;
+  platform: Platform;
+  channel: string;
+  /** Web bundles: the native API the bundle needs (UP-3); the app ignores bundles for another one. */
+  nativeApi?: string;
+  /** Grows with every release (seconds since the epoch at publish time); older or equal ones are ignored. */
+  sequence: number;
+  /** Directory-safe id of this release. */
+  bundle: string;
+  runtimeVersion: string;
+  /** The app version (app updates) or the version the bundle was built with (web bundles). */
+  version: string;
+  files: UpdateFile[];
+  /** App updates: embeddedSequence of the release's app (updates.json), so it knows it is that release. */
+  build?: number;
+  /** App updates: the CPU the app is built for. Releases live in `<os>-<arch>/`, and an app takes only its own. */
+  arch?: DesktopArch;
+  /** App updates: the .app as a gzip tar; `sha256` is the tar's (what deltas produce), `gzSha256` the download's. */
+  archive?: { sha256: string; url: string; size: number; gzSha256: string };
+  /** App updates: gzip deltas from earlier releases' tars (`from` = that tar's sha256). */
+  patches?: { from: string; url: string; sha256: string; size: number }[];
+}
+
+export function validateUpdates(raw: unknown, problems: string[]): UpdatesConfig | null {
+  if (raw === undefined) return null;
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    problems.push("updates must be an object like { url, publicKey }");
+    return null;
+  }
+  const r = raw as Record<string, unknown>;
+  if (typeof r.url !== "string" || !/^https?:\/\/[^/]+/.test(r.url))
+    problems.push("updates.url must be an http(s) URL");
+  if (typeof r.publicKey !== "string" || Buffer.from(r.publicKey, "base64").length !== 32)
+    problems.push("updates.publicKey must be a base64 Ed25519 public key (akan-native update keygen)");
+  if (r.channel !== undefined && (typeof r.channel !== "string" || !/^[a-z0-9][a-z0-9._-]{0,40}$/.test(r.channel)))
+    problems.push('updates.channel must be a short name like "production"');
+  if (r.readyTimeout !== undefined && (typeof r.readyTimeout !== "number" || r.readyTimeout < 1000))
+    problems.push("updates.readyTimeout must be a number of milliseconds >= 1000");
+  for (const key of Object.keys(r))
+    if (!["url", "publicKey", "channel", "readyTimeout"].includes(key))
+      problems.push(`updates.${key} is not supported`);
+  if (typeof r.url !== "string" || typeof r.publicKey !== "string") return null;
+  return {
+    url: r.url.replace(/\/+$/, ""),
+    publicKey: r.publicKey,
+    channel: (r.channel as string | undefined) ?? "production",
+    readyTimeout: (r.readyTimeout as number | undefined) ?? 10_000,
+  };
+}
+
+/** Where the signing key of an app lives: AKAN_NATIVE_UPDATE_KEY (a file path), else ~/.akan/native/keys/<app id>.update.key. */
+export function updateKeyPath(appId: string, env: Record<string, string | undefined> = process.env): string {
+  return env.AKAN_NATIVE_UPDATE_KEY ?? join(akanNativeHome(env), "keys", `${appId}.update.key`);
+}
+
+/** Creates the Ed25519 key pair; returns the public key for akan-native.config.ts. Never overwrites a key. */
+export function generateUpdateKey(path: string): { publicKey: string; created: boolean } {
+  if (existsSync(path)) return { publicKey: publicKeyOf(readPrivateKey(path)), created: false };
+  const { privateKey } = generateKeyPairSync("ed25519");
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, privateKey.export({ type: "pkcs8", format: "pem" }), { mode: 0o600 });
+  chmodSync(path, 0o600);
+  return { publicKey: publicKeyOf(privateKey), created: true };
+}
+
+function readPrivateKey(path: string) {
+  if (!existsSync(path)) throw new CliError(`no update signing key at ${path} (run \`akan-native update keygen\`)`);
+  return createPrivateKey(readFileSync(path, "utf8"));
+}
+
+/** Raw 32 bytes, base64: the last 32 bytes of the SPKI DER. */
+function publicKeyOf(privateKey: ReturnType<typeof createPrivateKey>): string {
+  const der = createPublicKey(privateKey).export({ type: "spki", format: "der" });
+  return der.subarray(der.length - 32).toString("base64");
+}
+
+export function signManifest(bytes: Uint8Array, keyPath: string, expectedPublicKey: string): string {
+  const key = readPrivateKey(keyPath);
+  if (publicKeyOf(key) !== expectedPublicKey)
+    throw new CliError(`the key at ${keyPath} does not match updates.publicKey in akan-native.config.ts`);
+  return sign(null, bytes, key).toString("base64");
+}
+
+/** Verifies like the apps do: raw public key, base64 signature over the exact manifest bytes. */
+export function verifyManifest(bytes: Uint8Array, signature: string, publicKey: string): boolean {
+  const spki = Buffer.concat([Buffer.from("302a300506032b6570032100", "hex"), Buffer.from(publicKey, "base64")]);
+  return verify(
+    null,
+    bytes,
+    createPublicKey({ key: spki, format: "der", type: "spki" }),
+    Buffer.from(signature, "base64"),
+  );
+}
+
+export const sha256 = (data: Uint8Array | string) => createHash("sha256").update(data).digest("hex");
+
+/**
+ * updates.json in a native build (next to boot.json), read by the shell at launch and by the
+ * updates plugin. `embeddedSequence` is the build time: a downloaded bundle older than the
+ * binary's own is dropped when a new binary is installed (Capacitor drops its live-update path on
+ * every new binary: capacitor/android/.../Bridge.java:429-455; here only when it is older).
+ */
+export function updatesResource(
+  updates: UpdatesConfig,
+  app: { id: string; version: string },
+  platform: Platform,
+  nativeApi: string | undefined,
+  dev: boolean,
+): string {
+  return JSON.stringify({
+    app: app.id,
+    version: app.version,
+    platform,
+    nativeApi: nativeApi ?? null,
+    embeddedSequence: Math.floor(Date.now() / 1000),
+    dev,
+    url: updates.url,
+    publicKey: updates.publicKey,
+    channel: updates.channel,
+    readyTimeout: updates.readyTimeout,
+  });
+}

package/vendor/@akanjs/native/packages/cli/src/lib/vectors.ts

@@ -0,0 +1,121 @@
+
+
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { PACKAGE_ROOT } from "./root.ts";
+
+export const VECTOR_FILES = [
+  "scope",
+  "routes",
+  "ranges",
+  "ids",
+  "bridge",
+  "navigation",
+  "acl",
+  "retained",
+  "ed25519",
+] as const;
+
+/**
+ * How many checks each file holds: the runners fail when a file is missing or ran another number,
+ * so an empty or truncated file cannot pass as zero checks.
+ */
+export function vectorCounts(): Record<string, number> {
+  const v = vectors() as Record<string, any>;
+  const n = (a: unknown) => (Array.isArray(a) ? a.length : 0);
+  return {
+    scope: n(v.scope.glob) + n(v.scope.url) + n(v.scope.permits),
+    routes: n(v.routes.cases) + n(v.routes.hostPaths),
+    ranges: n(v.ranges.cases),
+    ids: n(v.ids.cases) + n(v.ids.mime?.cases),
+    bridge: n(v.bridge.requests) + n(v.bridge.declarations) + n(v.bridge.documents),
+    navigation: n(v.navigation.cases) + n(v.navigation.fileRefSandbox),
+    acl: (v.acl.cases as { checks: unknown[] }[]).reduce((sum, c) => sum + 1 + c.checks.length, 0),
+    retained: n(v.retained.cases),
+    ed25519: n(v.ed25519.cases),
+  };
+}
+
+function vectors(): Record<string, unknown> {
+  return Object.fromEntries(
+    VECTOR_FILES.map((name) => [
+      name,
+      JSON.parse(readFileSync(join(PACKAGE_ROOT, "packages/core/vectors", `${name}.json`), "utf8")),
+    ]),
+  );
+}
+
+/** AkanNativeVectorData.swift: the vector files as JSON text (empty for release builds). */
+export function swiftVectorData(withVectors: boolean): string {
+  const entries = withVectors
+    ? Object.entries(vectors()).map(([name, value]) => `        "${name}": ##"${JSON.stringify(value)}"##,`)
+    : [];
+  const counts = withVectors
+    ? Object.entries(vectorCounts()).map(([name, count]) => `        "${name}": ${count},`)
+    : [];
+  return [
+    "// Generated by akan-native (packages/cli/src/lib/vectors.ts) from packages/core/vectors. Do not edit.",
+    "",
+    "enum AkanNativeVectorData {",
+    `    static let files: [String: String] = [${entries.length ? "" : ":"}`,
+    ...entries,
+    "    ]",
+    "    /// The checks each file holds; the runner fails when another number ran.",
+    `    static let counts: [String: Int] = [${counts.length ? "" : ":"}`,
+    ...counts,
+    "    ]",
+    "}",
+    "",
+  ].join("\n");
+}
+
+function kotlinString(text: string): string {
+  let out = "";
+  for (const ch of text) {
+    const code = ch.codePointAt(0)!;
+    if (ch === "\\" || ch === '"' || ch === "$") out += `\\${ch}`;
+    else if (code < 0x20 || code === 0x2028 || code === 0x2029) out += `\\u${code.toString(16).padStart(4, "0")}`;
+    else out += ch;
+  }
+  return `"${out}"`;
+}
+
+function kotlinValue(value: unknown): string {
+  if (value === null) return "null";
+  if (typeof value === "boolean") return String(value);
+  if (typeof value === "number") return Number.isInteger(value) ? `${value}L` : String(value);
+  if (typeof value === "string") return kotlinString(value);
+  if (Array.isArray(value)) return `listOf<Any?>(${value.map(kotlinValue).join(", ")})`;
+  return `mapOf<String, Any?>(${Object.entries(value as Record<string, unknown>)
+    .map(([k, v]) => `${kotlinString(k)} to ${kotlinValue(v)}`)
+    .join(", ")})`;
+}
+
+/**
+ * AkanNativeVectorData.kt: each vector file as a function returning Kotlin values (Map, List, String,
+ * Long, Double, Boolean, null); one function per file keeps each under the JVM's method size limit.
+ */
+export function kotlinVectorData(withVectors: boolean): string {
+  const all = withVectors ? Object.entries(vectors()) : [];
+  return [
+    "// Generated by akan-native (packages/cli/src/lib/vectors.ts) from packages/core/vectors. Do not edit.",
+    "package com.akanjs.runtime",
+    "",
+    "object AkanNativeVectorData {",
+    "    /** The checks each file holds; the runner fails when another number ran. */",
+    `    val counts: Map<String, Int> = mapOf(${
+      withVectors
+        ? Object.entries(vectorCounts())
+            .map(([name, count]) => `${kotlinString(name)} to ${count}`)
+            .join(", ")
+        : ""
+    })`,
+    `    fun file(name: String): Map<String, Any?>? = when (name) {`,
+    ...all.map(([name]) => `        ${kotlinString(name)} -> ${name}()`),
+    "        else -> null",
+    "    }",
+    ...all.flatMap(([name, value]) => ["", `    private fun ${name}(): Map<String, Any?> = ${kotlinValue(value)}`]),
+    "}",
+    "",
+  ].join("\n");
+}

package/vendor/@akanjs/native/packages/cli/src/lib/xml.ts

@@ -0,0 +1,72 @@
+
+
+export interface XmlElement {
+  name: string;
+  /** In source order; names keep their prefix ("android:name"). */
+  attrs: [name: string, value: string][];
+  children: XmlElement[];
+}
+
+const unescape = (text: string) =>
+  text.replace(/&(lt|gt|amp|quot|apos|#\d+|#x[0-9a-f]+);/gi, (_, e: string) =>
+    e === "lt"
+      ? "<"
+      : e === "gt"
+        ? ">"
+        : e === "amp"
+          ? "&"
+          : e === "quot"
+            ? '"'
+            : e === "apos"
+              ? "'"
+              : String.fromCodePoint(e[1] === "x" || e[1] === "X" ? parseInt(e.slice(2), 16) : Number(e.slice(1))),
+  );
+
+export const escapeXml = (text: string) =>
+  text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+
+/** Parses a document's root element. Text between elements is ignored (manifests have none that matters). */
+export function parseXml(source: string): XmlElement {
+  const text = source.replace(/<\?[\s\S]*?\?>|<!--[\s\S]*?-->|<!DOCTYPE[^>]*>/g, "");
+  const tag = /<(\/?)([\w:.-]+)((?:\s+[\w:.-]+\s*=\s*(?:"[^"]*"|'[^']*'))*)\s*(\/?)>/g;
+  const stack: XmlElement[] = [];
+  let root: XmlElement | null = null;
+  for (let m = tag.exec(text); m; m = tag.exec(text)) {
+    const [, closing, name, attrText, selfClosing] = m;
+    if (closing) {
+      const open = stack.pop();
+      if (!open || open.name !== name) throw new Error(`XML: </${name}> does not close <${open?.name ?? "nothing"}>`);
+      continue;
+    }
+    const attrs: [string, string][] = [...attrText!.matchAll(/([\w:.-]+)\s*=\s*(?:"([^"]*)"|'([^']*)')/g)].map((a) => [
+      a[1]!,
+      unescape(a[2] ?? a[3] ?? ""),
+    ]);
+    const element: XmlElement = { name: name!, attrs, children: [] };
+    if (stack.length) stack[stack.length - 1]!.children.push(element);
+    else if (!root) root = element;
+    else throw new Error("XML: more than one root element");
+    if (!selfClosing) stack.push(element);
+  }
+  if (stack.length) throw new Error(`XML: <${stack[stack.length - 1]!.name}> is not closed`);
+  if (!root) throw new Error("XML: no element");
+  return root;
+}
+
+export function attr(element: XmlElement, name: string): string | undefined {
+  return element.attrs.find(([n]) => n === name)?.[1];
+}
+
+export function setAttr(element: XmlElement, name: string, value: string): void {
+  const found = element.attrs.find(([n]) => n === name);
+  if (found) found[1] = value;
+  else element.attrs.push([name, value]);
+}
+
+/** The element as XML text, indented by `indent`. */
+export function serializeXml(element: XmlElement, indent = "", step = "    "): string {
+  const attrs = element.attrs.map(([n, v]) => ` ${n}="${escapeXml(v)}"`).join("");
+  if (!element.children.length) return `${indent}<${element.name}${attrs} />`;
+  const inner = element.children.map((c) => serializeXml(c, indent + step, step)).join("\n");
+  return `${indent}<${element.name}${attrs}>\n${inner}\n${indent}</${element.name}>`;
+}