akanjs 3.0.2 → 3.1.0-rc.0

package/vendor/@akanjs/native/native/android/src/com/akanjs/runtime/AkanNativeUpdates.kt

@@ -1,13 +1,13 @@
-// Web bundle updates (UP-2): which bundle the shell serves, and the trial / confirm / rollback
+// Web bundle updates (UP-2, protocol v2): which bundle the shell serves, and the trial / confirm / rollback
 // state (the Android twin of native/ios/Sources/AkanNativeUpdates.swift, same rules and file format).
 // @akanjs/native/plugins/updates downloads and verifies bundles and calls stage/applyPending/confirm; the
 // activity picks the bundle at launch and rolls back a trial that never confirms.
 //
-// Layout: noBackupFilesDir/akan-native-updates/{state.json, bundles/<bundle>/{…, manifest.json,
-// manifest.json.sig}}: outside filesDir, which the filesystem plugin's `data` base exposes to the
-// page, and out of backups (bundles download again; state.json belongs to this install). A bundle
-// is served only while its signed manifest still verifies and its files are all there with their
-// sizes (checked at every launch). Main thread only.
+// Layout: noBackupFilesDir/akan-native-updates/{state.json, bundles/<bundle>/{…, manifest.signed.json}}: outside
+// filesDir, which the filesystem plugin's `data` base exposes to the page, and out of backups (bundles download again;
+// state.json belongs to this install). A bundle is served only while its envelope still verifies under a key of
+// updates.publicKeys that is not revoked, and its files are all there with their sizes (checked at every launch).
+// state.json's revokedKeys outlive reset(): a revocation is for good. Main thread only.
 package com.akanjs.runtime
 
 import android.content.Context
@@ -22,15 +22,18 @@ import java.security.spec.X509EncodedKeySpec
 import org.json.JSONArray
 import org.json.JSONObject
 
-data class AkanNativeUpdateEntry(val bundle: String, val sequence: Double, val nativeApi: String, val attempts: Int = 0) {
-    fun toJson(): JSONObject = JSONObject().put("bundle", bundle).put("sequence", sequence).put("nativeApi", nativeApi).put("attempts", attempts)
+/** [keyId]: the key whose envelope the bundle came in. */
+data class AkanNativeUpdateEntry(val bundle: String, val sequence: Double, val nativeApi: String, val keyId: String, val attempts: Int = 0) {
+    fun toJson(): JSONObject =
+        JSONObject().put("bundle", bundle).put("sequence", sequence).put("nativeApi", nativeApi).put("keyId", keyId).put("attempts", attempts)
 
     companion object {
         fun from(json: Any?): AkanNativeUpdateEntry? {
             val o = json as? JSONObject ?: return null
             val bundle = o.optString("bundle")
-            if (!AkanNativeUpdates.isBundleId(bundle) || !o.has("sequence") || !o.has("nativeApi")) return null
-            return AkanNativeUpdateEntry(bundle, o.optDouble("sequence"), o.optString("nativeApi"), o.optInt("attempts"))
+            val keyId = o.optString("keyId")
+            if (!AkanNativeUpdates.isBundleId(bundle) || !o.has("sequence") || !o.has("nativeApi") || !AkanNativeKernel.isUpdateKeyId(keyId)) return null
+            return AkanNativeUpdateEntry(bundle, o.optDouble("sequence"), o.optString("nativeApi"), keyId, o.optInt("attempts"))
         }
     }
 }
@@ -41,9 +44,10 @@ class AkanNativeUpdateState(
     var trial: AkanNativeUpdateEntry? = null,
     val failed: MutableList<String> = mutableListOf(),
     var rolledBack: String? = null,
+    val revokedKeys: MutableList<String> = mutableListOf(),
 ) {
     fun toJson(): JSONObject {
-        val o = JSONObject().put("failed", JSONArray(failed.takeLast(20)))
+        val o = JSONObject().put("failed", JSONArray(failed.takeLast(20))).put("revokedKeys", JSONArray(revokedKeys))
         current?.let { o.put("current", it.toJson()) }
         pending?.let { o.put("pending", it.toJson()) }
         trial?.let { o.put("trial", it.toJson()) }
@@ -54,12 +58,14 @@ class AkanNativeUpdateState(
     companion object {
         fun from(o: JSONObject): AkanNativeUpdateState {
             val failed = o.optJSONArray("failed")
+            val revoked = o.optJSONArray("revokedKeys")
             return AkanNativeUpdateState(
                 current = AkanNativeUpdateEntry.from(o.opt("current")),
                 pending = AkanNativeUpdateEntry.from(o.opt("pending")),
                 trial = AkanNativeUpdateEntry.from(o.opt("trial")),
                 failed = MutableList(failed?.length() ?: 0) { failed!!.optString(it) }.filter(AkanNativeUpdates::isBundleId).toMutableList(),
                 rolledBack = o.optString("rolledBack").ifEmpty { null },
+                revokedKeys = MutableList(revoked?.length() ?: 0) { revoked!!.optString(it) }.filter(AkanNativeKernel::isUpdateKeyId).toMutableList(),
             )
         }
     }
@@ -68,15 +74,23 @@ class AkanNativeUpdateState(
 /** updates.json from the build (akan-native.config.ts `updates`), null when the app has no updates. */
 class AkanNativeUpdateConfig(
     val app: String,
+    val version: String,
     val platform: String,
     val nativeApi: String,
     val embeddedSequence: Double,
     val url: String,
-    val publicKey: ByteArray,
+    /** updates.publicKeys in order: the order decides which key may revoke which (AkanNativeKernel.updateDecision). */
+    val keys: List<Pair<String, ByteArray>>,
     val channel: String,
     val readyTimeoutMs: Long,
     val dev: Boolean,
+    /** updates.report.url: where AkanNativeUpdateReports posts what became of each release; null sends nothing. */
+    val reportUrl: String?,
 ) {
+    val ring: List<String> get() = keys.map { it.first }
+
+    fun key(keyId: String): ByteArray? = keys.firstOrNull { it.first == keyId }?.second
+
     companion object {
         fun load(context: Context): AkanNativeUpdateConfig? {
             val o = try {
@@ -84,33 +98,57 @@ class AkanNativeUpdateConfig(
             } catch (e: Exception) {
                 return null
             }
-            val key = try {
-                Base64.decode(o.optString("publicKey"), Base64.DEFAULT)
+            val listed = o.optJSONArray("publicKeys")
+            val encoded = if (listed != null) List(listed.length()) { listed.optString(it) } else listOfNotNull(o.optString("publicKey").ifEmpty { null })
+            val raw = try {
+                encoded.map { Base64.decode(it, Base64.DEFAULT) }
             } catch (e: IllegalArgumentException) {
                 return null
             }
-            if (key.size != 32 || o.optString("url").isEmpty() || o.optString("nativeApi").isEmpty()) return null
+            if (raw.isEmpty() || raw.any { it.size != 32 } || o.optString("url").isEmpty() || o.optString("nativeApi").isEmpty()) return null
             return AkanNativeUpdateConfig(
                 app = o.optString("app"),
+                version = o.optString("version"),
                 platform = o.optString("platform", "android"),
                 nativeApi = o.optString("nativeApi"),
                 embeddedSequence = o.optDouble("embeddedSequence", 0.0),
                 url = o.optString("url"),
-                publicKey = key,
+                keys = raw.map { AkanNativeKernel.updateKeyId(it) to it },
                 channel = o.optString("channel", "production"),
                 readyTimeoutMs = o.optLong("readyTimeout", 10_000),
                 dev = o.optBoolean("dev"),
+                reportUrl = o.optString("reportUrl").ifEmpty { null },
             )
         }
     }
 }
 
+/** A `<channel>/<nativeApi>.json` envelope, checked as far as its signature: what the manifest says is read after. */
+class AkanNativeUpdateEnvelope(val manifest: ByteArray, val keyId: String) {
+    companion object {
+        /** null: not an envelope, or signed by a key this binary does not trust or has revoked. */
+        fun open(data: ByteArray, config: AkanNativeUpdateConfig, revoked: List<String>): AkanNativeUpdateEnvelope? = try {
+            val o = JSONObject(String(data))
+            val keyId = o.getString("keyId")
+            val key = config.key(keyId)
+            val manifest = Base64.decode(o.getString("manifest"), Base64.DEFAULT)
+            val signature = Base64.decode(o.getString("signature"), Base64.DEFAULT)
+            if (!AkanNativeKernel.isUpdateKeyId(keyId) || keyId in revoked || key == null || manifest.size > (1 shl 20) ||
+                !AkanNativeUpdates.signed(manifest, signature, key)) null
+            else AkanNativeUpdateEnvelope(manifest, keyId)
+        } catch (e: Exception) {
+            null
+        }
+    }
+}
+
 object AkanNativeUpdates {
     private const val TAG = "AkanNativeUpdates"
 
     var config: AkanNativeUpdateConfig? = null
         private set
-    private lateinit var directory: File
+    internal lateinit var directory: File
+        private set
 
     /** The bundle served in this session (null: the one inside the APK). */
     var active: AkanNativeUpdateEntry? = null
@@ -150,16 +188,15 @@ object AkanNativeUpdates {
     }
 
     /**
-     * The bundle's signed manifest (kept next to it by the plugin) verifies, describes this entry,
+     * The bundle's envelope (kept next to it by the plugin) verifies, describes this entry,
      * and every file it lists is there with its size. The hashes were checked at the download.
      */
-    private fun verified(entry: AkanNativeUpdateEntry, config: AkanNativeUpdateConfig): Boolean {
+    private fun verified(entry: AkanNativeUpdateEntry, config: AkanNativeUpdateConfig, revoked: List<String>): Boolean {
         val dir = bundleDirectory(entry.bundle)
         return try {
-            val manifest = File(dir, "manifest.json").readBytes()
-            val signature = Base64.decode(File(dir, "manifest.json.sig").readText().trim(), Base64.DEFAULT)
-            if (!signed(manifest, signature, config.publicKey)) return false
-            val o = JSONObject(String(manifest))
+            val envelope = AkanNativeUpdateEnvelope.open(File(dir, "manifest.signed.json").readBytes(), config, revoked) ?: return false
+            if (envelope.keyId != entry.keyId) return false
+            val o = JSONObject(String(envelope.manifest))
             val files = o.getJSONArray("files")
             o.optString("bundle") == entry.bundle && o.optDouble("sequence") == entry.sequence && o.optString("nativeApi") == entry.nativeApi &&
                 o.optString("app") == config.app && o.optString("platform") == config.platform &&
@@ -207,23 +244,42 @@ object AkanNativeUpdates {
         }
     }
 
-    fun usable(entry: AkanNativeUpdateEntry?, config: AkanNativeUpdateConfig): Boolean =
-        entry != null && entry.nativeApi == config.nativeApi && entry.sequence > config.embeddedSequence &&
-            File(bundleDirectory(entry.bundle), "index.html").isFile && verified(entry, config)
+    /** Whether a bundle may run in this binary: one it still takes, whose files are intact. */
+    fun usable(entry: AkanNativeUpdateEntry?, config: AkanNativeUpdateConfig, revoked: List<String>): Boolean =
+        entry != null && takes(entry, config, revoked) && intact(entry, config, revoked)
+
+    /**
+     * Built for this native API, newer than the APK's own bundle, and signed by a key it trusts and has not revoked: a
+     * bundle a new binary or a revocation left behind is dropped as expected, not reported as a failure.
+     */
+    private fun takes(entry: AkanNativeUpdateEntry, config: AkanNativeUpdateConfig, revoked: List<String>): Boolean =
+        entry.nativeApi == config.nativeApi && entry.sequence > config.embeddedSequence && entry.keyId in config.ring && entry.keyId !in revoked
+
+    private fun intact(entry: AkanNativeUpdateEntry, config: AkanNativeUpdateConfig, revoked: List<String>): Boolean =
+        File(bundleDirectory(entry.bundle), "index.html").isFile && verified(entry, config, revoked)
+
+    /** Drops an entry this launch cannot serve, reporting [event] (reason verify) when its files were the reason. */
+    private fun drop(entry: AkanNativeUpdateEntry?, config: AkanNativeUpdateConfig, revoked: List<String>, event: String): AkanNativeUpdateEntry? {
+        if (entry == null || !takes(entry, config, revoked)) return null
+        if (intact(entry, config, revoked)) return entry
+        AkanNativeUpdateReports.record(event, entry, "verify")
+        return null
+    }
 
     /** Picks the bundle for this launch; returns its folder, or null for the APK's own bundle. */
     fun launch(): File? {
         val config = config ?: return null
         val state = readState()
-        if (!usable(state.current, config)) state.current = null
-        if (!usable(state.pending, config)) state.pending = null
-        if (!usable(state.trial, config)) state.trial = null
+        state.current = drop(state.current, config, state.revokedKeys, "rolledBack")
+        state.pending = drop(state.pending, config, state.revokedKeys, "failed")
+        state.trial = drop(state.trial, config, state.revokedKeys, "rolledBack")
         state.trial?.let {
             // Launched again without notifyReady(): the trial crashed or hung.
             state.failed.add(it.bundle)
             state.rolledBack = it.bundle
             state.trial = null
             Log.w(TAG, "bundle ${it.bundle} did not confirm; rolled back")
+            AkanNativeUpdateReports.record("rolledBack", it, "relaunch")
         }
         state.pending?.let {
             if (!state.failed.contains(it.bundle)) {
@@ -233,6 +289,7 @@ object AkanNativeUpdates {
         }
         // Not on record: the pending bundle waits for a launch that can record it.
         if (!writeState(state)) state.trial = null
+        state.trial?.let { AkanNativeUpdateReports.record("applied", it) }
         active = state.trial ?: state.current
         onTrial = state.trial != null
         return active?.let { bundleDirectory(it.bundle) }
@@ -243,19 +300,20 @@ object AkanNativeUpdates {
         val state = readState()
         state.pending = entry
         state.failed.remove(entry.bundle)
-        writeState(state)
+        if (writeState(state)) AkanNativeUpdateReports.record("downloaded", entry)
     }
 
     /** apply(): makes the pending bundle the trial now; returns its folder for the reload. */
     fun applyPending(): File? {
         val config = config ?: return null
         val state = readState()
-        val pending = state.pending?.takeIf { usable(it, config) } ?: return null
+        val pending = state.pending?.takeIf { usable(it, config, state.revokedKeys) } ?: return null
         state.trial = pending.copy(attempts = 1)
         state.pending = null
         if (!writeState(state)) return null
         active = pending
         onTrial = true
+        AkanNativeUpdateReports.record("applied", pending)
         return bundleDirectory(pending.bundle)
     }
 
@@ -270,13 +328,17 @@ object AkanNativeUpdates {
         state.rolledBack = null
         writeState(state)
         onTrial = false
+        AkanNativeUpdateReports.record("confirmed", trial)
         prune(listOfNotNull(state.current?.bundle, state.pending?.bundle))
     }
 
-    /** The trial did not confirm in time: back to the previous bundle (null: the APK's own). */
-    fun rollback(): File? {
+    /**
+     * The trial did not confirm in time: back to the previous bundle. Returns its folder (null: the APK's own) and the
+     * trial it ended, whose report waits for the renderer probe to say whether the page timed out or hung.
+     */
+    fun rollback(): Pair<File?, AkanNativeUpdateEntry?> {
         val trial = active
-        if (!onTrial || trial == null) return active?.let { bundleDirectory(it.bundle) }
+        if (!onTrial || trial == null) return active?.let { bundleDirectory(it.bundle) } to null
         val state = readState()
         state.trial = null
         state.failed.add(trial.bundle)
@@ -284,17 +346,27 @@ object AkanNativeUpdates {
         writeState(state)
         onTrial = false
         val config = config
-        active = if (config != null && usable(state.current, config)) state.current else null
+        active = if (config != null && usable(state.current, config, state.revokedKeys)) state.current else null
         Log.w(TAG, "bundle ${trial.bundle} did not call notifyReady() in time; rolled back")
-        return active?.let { bundleDirectory(it.bundle) }
+        return active?.let { bundleDirectory(it.bundle) } to trial
     }
 
-    /** reset(): the APK's own bundle from the next launch on. */
+    /** reset(): the APK's own bundle from the next launch on. Revocations stay. */
     fun reset() {
-        writeState(AkanNativeUpdateState())
+        writeState(AkanNativeUpdateState(revokedKeys = readState().revokedKeys))
         prune(listOfNotNull(active?.bundle))
     }
 
+    /** Keys a verified manifest revoked: no bundle they signed is served again, from the next launch on. */
+    fun revoke(keyIds: List<String>) {
+        val state = readState()
+        val added = keyIds.filter { it !in state.revokedKeys }
+        if (added.isEmpty()) return
+        state.revokedKeys.addAll(added)
+        writeState(state)
+        Log.w(TAG, "revoked keys ${added.joinToString(", ")}")
+    }
+
     /** A download in progress (bundles/<bundle>.partial) is the plugin's, which removes it. */
     private fun prune(keep: List<String>) {
         val folder = File(directory, "bundles")

package/vendor/@akanjs/native/native/android/src/com/akanjs/runtime/AkanNativeVectors.kt

@@ -121,6 +121,26 @@ object AkanNativeVectors {
             check(AkanNativeEd25519.verify(bytes(c[1] as String), bytes(c[2] as String), bytes(c[0] as String)) == c[3]) { "ed25519 ${c[4]}" }
         }
 
+        // Updates protocol v2 (AkanNativeUpdates, AkanNativeKernel.updateDecision).
+        val updates = load("updates")
+        for (c in rows(updates, "keyIds")) {
+            val key = java.util.Base64.getDecoder().decode(c[0] as String)
+            check(AkanNativeKernel.updateKeyId(key) == c[1]) { "update keyId ${c[0]}" }
+        }
+        for (c in rows(updates, "decisions")) {
+            fun strings(v: Any?) = (v as List<*>).map { it as String }
+            val running = (c[7] as List<*>?)?.let { (it[0] as Number).toDouble() to it[1] as String }
+            val got = AkanNativeKernel.updateDecision(
+                strings(c[0]), strings(c[1]), c[2] as String, strings(c[3]), c[4] as Boolean,
+                (c[5] as Number).toDouble(), (c[6] as Number).toDouble(), running,
+            )
+            check(got.wire == c[8]) { "update decision ${c[9]}: ${got.wire}" }
+        }
+        for (c in rows(updates, "urls")) {
+            val got = AkanNativeKernel.updateManifestUrl(c[0] as String, c[1] as String, c[2] as String, c[3] as String)
+            check(got == c[4]) { "update url $got" }
+        }
+
         // A missing or truncated file must not pass as fewer checks.
         for ((name, count) in AkanNativeVectorData.counts) if ((ran[name] ?: 0) != count) failures.add("$name: ${ran[name] ?: 0} of $count checks ran")
         if (AkanNativeVectorData.counts.isEmpty()) failures.add("no vectors in this build")

package/vendor/@akanjs/native/native/desktop/Cargo.lock

@@ -2,6 +2,22 @@
 # It is not intended for manual editing.
 version = 4
 
+[[package]]
+name = "akan_native_desktop"
+version = "0.1.0"
+dependencies = [
+ "block2",
+ "gtk",
+ "objc2",
+ "objc2-app-kit",
+ "objc2-foundation",
+ "tao",
+ "webkit2gtk",
+ "webview2-com",
+ "windows",
+ "wry",
+]
+
 [[package]]
 name = "atk"
 version = "0.18.2"
@@ -1310,22 +1326,6 @@ dependencies = [
  "objc2-foundation",
 ]
 
-[[package]]
-name = "akan_native_desktop"
-version = "0.1.0"
-dependencies = [
- "block2",
- "gtk",
- "objc2",
- "objc2-app-kit",
- "objc2-foundation",
- "tao",
- "webkit2gtk",
- "webview2-com",
- "windows",
- "wry",
-]
-
 [[package]]
 name = "once_cell"
 version = "1.21.4"