crossbind 2.0.0-beta.67 → 2.0.0-beta.69

package/src/utils/hermes.js

@@ -3,6 +3,7 @@ import os from 'node:os';
 import path from 'node:path';
 import withDirLock from './dirLock.js';
 import downloadAndExtractFile from './downloadAndExtractFile.js';
+import logger from './logger.js';
 
 // The Hermes React Native publishes on Maven Central for Apple platforms: the macOS framework, the iOS xcframework,
 // hermesc and the headers. A new version also moves third_party/jsi of @crossbind/core-app-host to its tag, and the
@@ -25,6 +26,29 @@ export default async function resolveHermes() {
     return `${dir}/source/destroot`;
 }
 
+// The dSYMs of the release's frameworks, with which App Store Connect shows Hermes' frames in an iOS app's crash reports
+// as functions and lines.
+export const HERMES_DSYM = {
+    url: `https://repo1.maven.org/maven2/com/facebook/hermes/hermes-ios/${HERMES.version}/hermes-ios-${HERMES.version}-hermes-framework-dSYM-release.tar.gz`,
+    sha256: '5cea3dd57ecadb42c40d1cc8acf2e178dbfbe6a230410742d997ff3fe313a9c0',
+};
+
+// The dSYM of the device's framework, downloaded once and checked against the pinned sha256. The release's 360 MB hold
+// every Apple platform's, of which only the device's 80 MB are kept.
+export async function resolveHermesDsym() {
+    const dir = `${hermesDir()}-dsym`;
+    const dsym = `${dir}/source/iphoneos/hermesvm.framework.dSYM`;
+    if (!fs.existsSync(dsym)) logger.info(`crossbind: downloading the dSYM of Hermes ${HERMES.version} once, 360 MB of which 80 MB stay, for crash reports.`);
+    fs.mkdirSync(path.dirname(dir), { recursive: true });
+    await withDirLock(`${dir}.lock`, async () => {
+        await downloadAndExtractFile(HERMES_DSYM.url, dir, HERMES_DSYM.sha256);
+        fs.rmSync(`${dir}/${path.basename(HERMES_DSYM.url)}`, { force: true });
+        fs.readdirSync(`${dir}/source`).filter((entry) => entry !== 'iphoneos')
+            .forEach((entry) => fs.rmSync(`${dir}/source/${entry}`, { recursive: true, force: true }));
+    });
+    return dsym;
+}
+
 // Linux and Windows have no published Hermes, so crossbind's linux and windows images build the release's source, with
 // their static libc++: JSI hands std types across, and the host and the project's archives build there too.
 export const HERMES_SOURCE = {

package/src/utils/keychain.js

@@ -0,0 +1,54 @@
+import { spawnSync } from 'node:child_process';
+
+// The keychain names a secret by a service and an account: an upload key's password by this service, with the key's own
+// path as the account.
+const SERVICE = 'crossbind upload key';
+// security -i reads a command line whose quoted words take a backslash before a quote or a backslash.
+const quoted = (word) => `"${word.replace(/[\\"]/g, '\\$&')}"`;
+// Windows PowerShell, which imports its core modules from its own home: a pwsh 7 parent's PSModulePath hides them.
+const powershell = (script) => ['-NoProfile', '-NonInteractive', '-Command', `Import-Module (Join-Path $PSHOME 'Modules\\Microsoft.PowerShell.Security'); ${script}`];
+const STORE_DPAPI = 'ConvertTo-SecureString -String $env:CROSSBIND_KEYCHAIN_SECRET -AsPlainText -Force | ConvertFrom-SecureString | Set-Content -LiteralPath $env:CROSSBIND_KEYCHAIN_FILE -NoNewline';
+const READ_DPAPI = "$secret = Get-Content -LiteralPath $env:CROSSBIND_KEYCHAIN_FILE -Raw | ConvertTo-SecureString; [Console]::Out.Write([System.Net.NetworkCredential]::new('', $secret).Password)";
+
+const run = (program, args, options = {}) => spawnSync(program, args, { encoding: 'utf8', ...options });
+
+// Each system's keychain, given the secret on stdin or in the environment, never on a command line. On Windows it is the
+// user's DPAPI, in a file beside the key that only that user on that machine can read, so the path alone names it.
+const KEYCHAINS = {
+    darwin: {
+        store: (service, key, secret) => run('security', ['-i'], { input: `add-generic-password -U -s ${quoted(service)} -a ${quoted(key)} -w ${quoted(secret)}\n` }),
+        read: (service, key) => run('security', ['find-generic-password', '-s', service, '-a', key, '-w']),
+    },
+    win32: {
+        store: (service, key, secret) => run('powershell.exe', powershell(STORE_DPAPI), {
+            env: { ...process.env, CROSSBIND_KEYCHAIN_SECRET: secret, CROSSBIND_KEYCHAIN_FILE: `${key}.dpapi` },
+        }),
+        read: (service, key) => run('powershell.exe', powershell(READ_DPAPI), { env: { ...process.env, CROSSBIND_KEYCHAIN_FILE: `${key}.dpapi` } }),
+    },
+    linux: {
+        store: (service, key, secret) => run('secret-tool', ['store', '--label', service, 'service', service, 'account', key], { input: secret }),
+        read: (service, key) => run('secret-tool', ['lookup', 'service', service, 'account', key]),
+    },
+};
+
+const keychainOf = (platform) => KEYCHAINS[platform] ?? KEYCHAINS.linux;
+
+// Whether the system has a keychain to keep a password in: macOS and Windows always, Linux where secret-tool is.
+export const hasKeychain = ({ platform = process.platform } = {}) => ['darwin', 'win32'].includes(platform) || !run('secret-tool', ['--help']).error;
+
+// An upload key's password, or another service's secret, from the system's keychain, or null when it keeps none or there
+// is no keychain.
+export function readSecret(key, { platform = process.platform, service = SERVICE } = {}) {
+    const result = keychainOf(platform).read(service, key);
+    if (result.error || result.status !== 0) return null;
+    // security ends what it prints with a newline.
+    return result.stdout.replace(/\n$/, '') || null;
+}
+
+// Keeps an upload key's password, or another service's secret, in the system's keychain, and says whether it did: Linux
+// without secret-tool and its service has none. A secret counts as kept once it reads back, as security -i fails without
+// an exit code.
+export function storeSecret(key, secret, { platform = process.platform, service = SERVICE } = {}) {
+    keychainOf(platform).store(service, key, secret);
+    return readSecret(key, { platform, service }) === secret;
+}

package/src/utils/openUrl.js

@@ -0,0 +1,12 @@
+import { spawn } from 'node:child_process';
+
+// Windows opens it without a shell, whose & would end the command inside the address.
+const OPENERS = { darwin: ['open'], win32: ['rundll32', 'url.dll,FileProtocolHandler'] };
+
+// Opens an address in the user's browser where the system can; whoever calls it prints the address too.
+export default function openUrl(url) {
+    const [program, ...args] = OPENERS[process.platform] ?? ['xdg-open'];
+    const opener = spawn(program, [...args, url], { stdio: 'ignore', detached: true });
+    opener.on('error', () => {});
+    opener.unref();
+}

package/src/utils/password.js

@@ -0,0 +1,34 @@
+import { randomBytes } from 'node:crypto';
+
+// NIST SP 800-63B-4's least length for a password that alone guards what it locks, as an upload key's does.
+export const MIN_PASSWORD_LENGTH = 15;
+// Rows a password can run along, either way and around: the alphabet, the digits, and a keyboard's.
+const ROWS = ['abcdefghijklmnopqrstuvwxyz', '0123456789', 'qwertyuiopasdfghjklzxcvbnm', '1qaz2wsx3edc4rfv5tgb6yhn7ujm8ik9ol0p', 'q1w2e3r4t5y6u7i8o9p0'];
+// Long passwords others try first, which the rules above let through.
+const GUESSED = ['correcthorsebatterystaple', 'thequickbrownfoxjumpsoverthelazydog', 'crossbinduploadkey', 'androiduploadkey'];
+
+// What the user reads before typing an upload key's password.
+export const PASSWORD_RULES = [
+    `${MIN_PASSWORD_LENGTH} characters or more; spaces and any characters are welcome, so a few words make a good one`,
+    'not one part repeated, not a run as 1234, abcd or qwerty, and not a well-known password',
+];
+
+const runsAlong = (text, row) => {
+    const around = row.repeat(Math.ceil(text.length / row.length) + 1);
+    return around.includes(text) || [...around].reverse().join('').includes(text);
+};
+
+// Why a password is too weak to lock an upload key, or null when it is not. NIST asks for no mix of kinds of characters.
+export function passwordProblem(password) {
+    const length = [...password].length;
+    if (length < MIN_PASSWORD_LENGTH) return `it has ${length} characters and needs at least ${MIN_PASSWORD_LENGTH}`;
+    if (/\p{Cc}/u.test(password)) return 'it has a control character, which no terminal types';
+    const plain = password.toLowerCase();
+    if (/^(.+?)\1+$/su.test(plain)) return 'it repeats one part';
+    if (ROWS.some((row) => runsAlong(plain, row))) return 'it runs along a row, as 1234, abcd and qwerty do';
+    if (GUESSED.includes(plain.replace(/\s+/g, ''))) return 'it is a password others guess first';
+    return null;
+}
+
+// A password crossbind makes: 18 random bytes, 144 bits, as 24 characters any terminal and keytool take.
+export const makePassword = () => randomBytes(18).toString('base64url');

package/src/utils/plist.js

@@ -5,6 +5,11 @@ const escapeXml = (text) => String(text).replace(/&/g, '&amp;').replace(/</g, '&
 
 function xmlLines(value, indent) {
     if (typeof value === 'boolean') return [`${indent}<${value}/>`];
+    if (typeof value === 'number') {
+        // An integer an integer element reads back the same, and any other number a real.
+        const type = Number.isSafeInteger(value) ? 'integer' : 'real';
+        return [`${indent}<${type}>${value}</${type}>`];
+    }
     const inner = indent + XML_INDENT;
     if (Array.isArray(value)) return [`${indent}<array>`, ...value.flatMap((item) => xmlLines(item, inner)), `${indent}</array>`];
     if (typeof value === 'object') {

package/src/utils/requiredReasonApis.js

@@ -0,0 +1,77 @@
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+
+// The C symbols of Apple's required reason API an iOS archive can import, each with its categories; getattrlist and its
+// kin are in two. A selector, as systemUptime or activeInputModes is, is no symbol, so nm finds none of those.
+const SYMBOLS = {
+    _stat: ['fileTimestamp'],
+    _fstat: ['fileTimestamp'],
+    _fstatat: ['fileTimestamp'],
+    _lstat: ['fileTimestamp'],
+    _getattrlistbulk: ['fileTimestamp'],
+    _getattrlist: ['fileTimestamp', 'diskSpace'],
+    _fgetattrlist: ['fileTimestamp', 'diskSpace'],
+    _getattrlistat: ['fileTimestamp', 'diskSpace'],
+    _statfs: ['diskSpace'],
+    _statvfs: ['diskSpace'],
+    _fstatfs: ['diskSpace'],
+    _fstatvfs: ['diskSpace'],
+    _mach_absolute_time: ['systemBootTime'],
+    '_OBJC_CLASS_$_NSUserDefaults': ['userDefaults'],
+};
+// nm's list of a large library, as GDAL's, runs to megabytes.
+const NM_OUTPUT_LIMIT = 256 * 1024 * 1024;
+
+// The categories that the symbols of `nm -u -j` output call, each with those symbols.
+export function reasonCategories(output) {
+    const categories = new Map();
+    output.split('\n').map((line) => line.trim()).filter((symbol) => Object.hasOwn(SYMBOLS, symbol)).forEach((symbol) => {
+        SYMBOLS[symbol].forEach((category) => categories.set(category, (categories.get(category) ?? new Set()).add(symbol)));
+    });
+    return categories;
+}
+
+// The categories an archive or a linked binary imports, as Xcode's nm lists them, whatever nm comes first on the PATH.
+// Its LLVM bitcode reader stays off: the symbol table tells all, and the bitcode Rust's standard library embeds comes
+// from a newer LLVM than an older Xcode reads.
+function importedCategories(file) {
+    const result = spawnSync('xcrun', ['nm', '--no-llvm-bc', '-u', '-j', file], { encoding: 'utf8', maxBuffer: NM_OUTPUT_LIMIT });
+    if (result.status !== 0) throw new Error(`crossbind: cannot list what ${file} calls: ${result.stderr || result.error?.message}`);
+    return reasonCategories(result.stdout);
+}
+
+// What the archives an iOS app links call of required reason API with no reason in app.privacy: each library, by the
+// name its archive has, with each such category and its symbols.
+export function unreasonedApis(archives, privacy) {
+    const found = new Map();
+    archives.forEach((archive) => {
+        const library = path.basename(archive).replace(/^\d+-/, '').replace(/^lib/, '').replace(/\.a$/, '');
+        importedCategories(archive).forEach((symbols, category) => {
+            if (Object.hasOwn(privacy, category)) return;
+            const key = `${library}\0${category}`;
+            found.set(key, new Set([...(found.get(key) ?? []), ...symbols]));
+        });
+    });
+    return [...found].map(([key, symbols]) => {
+        const [library, category] = key.split('\0');
+        return { library, category, symbols: [...symbols].sort() };
+    }).sort((a, b) => a.library.localeCompare(b.library) || a.category.localeCompare(b.category));
+}
+
+// What an iOS app's linked binary calls of required reason API with no reason in app.privacy, each category with its
+// symbols: what the linker kept of its archives, which App Store Connect checks.
+export const unreasonedImports = (binary, privacy) => [...importedCategories(binary)]
+    .filter(([category]) => !Object.hasOwn(privacy, category))
+    .map(([category, symbols]) => ({ category, symbols: [...symbols].sort() }))
+    .sort((a, b) => a.category.localeCompare(b.category));
+
+// The warning of what the archives of an iOS app reference of required reason API without its reasons, or none. The
+// linker may leave some of it out of the app, as it left _stat, _lstat and _fstatat out of the conformance app, whose
+// Rust references them; the app keeps what it calls.
+export function unreasonedWarning(found) {
+    if (found.length === 0) return null;
+    const uses = new Map();
+    found.forEach(({ library, category, symbols }) => uses.set(library, [...(uses.get(library) ?? []), `${category} (${symbols.join(', ')})`]));
+    const references = [...uses].map(([library, list]) => `${library} references ${list.join(' and ')}`).join('; ');
+    return `crossbind: App Store Connect refuses an iOS app that calls required reason API without its reasons (ITMS-91053), and the archives this app links reference some with no reason in app.privacy: ${references}. The linker may leave some out. Give app.privacy Apple's reasons for what the app calls, as { fileTimestamp: ['C617.1'] }; Apple's "Describing use of required reason API" says what each covers.`;
+}

package/src/utils/resolveAppHost.js

@@ -19,3 +19,10 @@ export function resolveAppEmbindJsiRoot() {
     const req = createRequire(path.join(resolveAppHostRoot(), 'package.json'));
     return path.dirname(fs.realpathSync(req.resolve('@crossbind/core-embind-jsi/package.json')));
 }
+
+// crossbind/app as an app's page imports it, which the app host assembles with what crossbind's own extensions give the page.
+export function resolveAppPageApi() {
+    const file = path.join(resolveAppHostRoot(), 'js', 'app.js');
+    if (!fs.existsSync(file)) throw new Error(`crossbind: the app host at ${resolveAppHostRoot()} has no crossbind/app for an app's page: update ${PKG} to match crossbind.`);
+    return fs.realpathSync(file);
+}

package/src/utils/secretFile.js

@@ -0,0 +1,23 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+let folder = null;
+
+// Removes the folder of the secrets written, as crossbind does when it exits.
+export function removeSecretFiles() {
+    if (folder) fs.rmSync(folder, { recursive: true, force: true });
+    folder = null;
+}
+
+// A secret the environment holds as its text, as CI's secrets come, written to a file of a folder only this user opens,
+// as the tools that take it read files. The folder goes when crossbind exits.
+export function secretFile(name, data) {
+    if (!folder) {
+        folder = fs.mkdtempSync(path.join(os.tmpdir(), 'crossbind-secrets-'));
+        process.once('exit', removeSecretFiles);
+    }
+    const file = path.join(folder, name);
+    fs.writeFileSync(file, data, { mode: 0o600 });
+    return file;
+}

package/src/utils/systemConfig.js

@@ -1,6 +1,7 @@
 import os from 'node:os';
 import loadJson from './loadJson.js';
 import systemKeys from './systemKeys.js';
+import writeJson from './writeJson.js';
 
 export const systemConfigPath = () => `${os.homedir()}/.crossbind.json`;
 
@@ -11,3 +12,21 @@ export default function loadSystemConfig() {
         .map(([key, value]) => [key, value.default]);
     return { ...system, ...Object.fromEntries(defaults) };
 }
+
+const isObject = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
+
+// The settings of an extension's own, which ~/.crossbind.json keeps apart from crossbind's, under extensions by the
+// extension's name.
+export function extensionSettingsOf(system, name) {
+    const own = system.extensions === undefined ? {} : isObject(system.extensions) && (system.extensions[name] ?? {});
+    if (!isObject(own)) throw new Error(`crossbind: ${systemConfigPath()} keeps the settings of the extension ${name} as no object of them, under extensions: fix it.`);
+    return own;
+}
+
+// Sets keys of ~/.crossbind.json, as `crossbind config set` does, keeping the others, and with { name, values } settings
+// of that extension's own.
+export function updateSystemConfig(values, extension = null) {
+    const system = loadSystemConfig();
+    const own = extension && { extensions: { ...system.extensions, [extension.name]: { ...extensionSettingsOf(system, extension.name), ...extension.values } } };
+    writeJson(systemConfigPath(), { ...system, ...values, ...own });
+}

package/src/utils/systemKeys.js

@@ -3,6 +3,22 @@ const systemKeys = {
         description: 'The unique identifier of the development team used for code signing and app distribution in Xcode.',
         default: '',
     },
+    ANDROID_KEYSTORE: {
+        description: "This machine's upload key, which signs an Android app's release and its bundle for Google Play; crossbind app upload-key sets it. The CROSSBIND_ANDROID_KEYSTORE environment variable overrides it.",
+        default: '',
+    },
+    ANDROID_KEY_ALIAS: {
+        description: 'The alias of the upload key in ANDROID_KEYSTORE. The CROSSBIND_ANDROID_KEY_ALIAS environment variable overrides it.',
+        default: '',
+    },
+    GOOGLE_PLAY_SERVICE_ACCOUNT: {
+        description: "The e-mail of the service account crossbind app publish uploads to Google Play as, through this machine's gcloud login, so no key of it exists. The CROSSBIND_GOOGLE_PLAY_SERVICE_ACCOUNT environment variable overrides it.",
+        default: '',
+    },
+    GOOGLE_PLAY_KEY: {
+        description: 'The JSON key of the service account crossbind app publish uploads to Google Play as, where gcloud is not, as in CI. The CROSSBIND_GOOGLE_PLAY_KEY environment variable overrides it.',
+        default: '',
+    },
     RUNNER: {
         description: 'Where toolchain steps run: DOCKER_RUN, DOCKER_EXEC, LOCAL, or REMOTE on the runners REMOTE_URL and REMOTE_URL_<IMAGE> name; a machine that names none builds on crossbind cloud once signed in with crossbind login. The CROSSBIND_RUNNER environment variable overrides it.',
         options: ['DOCKER_RUN', 'DOCKER_EXEC', 'LOCAL', 'REMOTE'],

package/vitest.config.js

@@ -52,7 +52,12 @@ export default defineConfig({
             // exercised a machine without that image already cached, and android builds shipped
             // broken to every Apple Silicon user. Which command line these actions build IS the
             // behaviour, so the layer is measured.
-            include: ['src/utils/**/*.js', 'src/state/**/*.js', 'src/assets/**/*.js', 'src/actions/**/*.js'],
+            // crossbind's own extensions' build-side code, which left src/ as packages of their own, is measured with it.
+            include: [
+                'src/utils/**/*.js', 'src/state/**/*.js', 'src/assets/**/*.js', 'src/actions/**/*.js',
+                '../../extensions/*/crossbind.extension.js', '../../extensions/*/src/**/*.js', '../../core/store-kit/*.js',
+            ],
+            allowExternal: true,
             all: true,
             // A floor with a one-point band, not a ratchet. Coverage is not identical across
             // environments - resolveEmbindRust walks the real node_modules layout, so which of its

package/src/actions/appUpdate.js

@@ -1,68 +0,0 @@
-import crypto from 'node:crypto';
-import fs from 'node:fs';
-import path from 'node:path';
-import run from './run.js';
-import state from '../state/index.js';
-import { appId, appUpdater } from '../utils/appOptions.js';
-
-// The private key that signs a desktop app's updates, named by the environment alone so that no secret reaches a file.
-export const UPDATER_KEY = 'CROSSBIND_UPDATER_PRIVATE_KEY';
-// The fixed DER around an Ed25519 key's 32 bytes, private and public.
-const PRIVATE_DER = Buffer.from('302e020100300506032b657004220420', 'hex');
-const PUBLIC_DER = Buffer.from('302a300506032b6570032100', 'hex');
-
-const publicKeyOf = (privateKey) => crypto.createPublicKey(privateKey).export({ format: 'der', type: 'spki' }).subarray(PUBLIC_DER.length);
-
-// A new key pair: the public key for app.updater.publicKey, the private one for CROSSBIND_UPDATER_PRIVATE_KEY.
-export function newUpdaterKey() {
-    const { privateKey } = crypto.generateKeyPairSync('ed25519');
-    return {
-        publicKey: publicKeyOf(privateKey).toString('base64'),
-        privateKey: privateKey.export({ format: 'der', type: 'pkcs8' }).subarray(PRIVATE_DER.length).toString('base64'),
-    };
-}
-
-// The key a build signs updates with, or null without CROSSBIND_UPDATER_PRIVATE_KEY. It has to be the private half of
-// app.updater.publicKey, or the app would refuse what it signs.
-export function updaterSigning(env = process.env) {
-    if (!env[UPDATER_KEY]) return null;
-    const updater = appUpdater(state.config);
-    if (!updater) throw new Error(`crossbind: ${UPDATER_KEY} is set, but crossbind.config.js has no app.updater, which tells an app where its updates are.`);
-    const seed = Buffer.from(env[UPDATER_KEY], 'base64');
-    if (seed.length !== 32) throw new Error(`crossbind: ${UPDATER_KEY} is no Ed25519 private key, which \`crossbind app updater-key\` prints.`);
-    const privateKey = crypto.createPrivateKey({ key: Buffer.concat([PRIVATE_DER, seed]), format: 'der', type: 'pkcs8' });
-    if (!publicKeyOf(privateKey).equals(updater.publicKey)) {
-        throw new Error(`crossbind: ${UPDATER_KEY} is not the private key of app.updater.publicKey, so the app would refuse the updates it signs.`);
-    }
-    return { privateKey, version: updater.version };
-}
-
-// What an update's signature covers: the app's id, the platform and arch it is for, its version and its file's SHA-512,
-// so that no file passes for another app's, platform's or version's. The host checks the same text.
-export function signedText(id, target, version, file) {
-    const hash = crypto.createHash('sha512').update(fs.readFileSync(file)).digest('hex');
-    return `crossbind update\n${id}\n${target}\n${version}\n${hash}\n`;
-}
-
-// The file a desktop app updates itself from, beside it: a macOS app as a zip, which keeps its signature and Apple's
-// ticket, a Windows app's setup program and a Linux app's tar.gz.
-function updateFile(app, target) {
-    if (target.platform === 'win32') return `${app}-setup.exe`;
-    if (target.platform === 'linux') return `${app}.tar.gz`;
-    const zip = path.join(path.dirname(app), `${state.config.general.name}-darwin-${target.arch}.app.zip`);
-    fs.rmSync(zip, { force: true });
-    run(null, ['ditto', '-c', '-k', '--keepParent', app, zip], null, target);
-    return zip;
-}
-
-// With a key in the environment, the update a desktop app finds at app.updater.url, beside the app: its file, and the
-// manifest that gives its version, the file's name and its signature, <name>-<platform>-<arch>.update.json.
-export default function writeUpdate(app, target) {
-    const signing = updaterSigning();
-    if (!signing) return;
-    const file = updateFile(app, target);
-    const name = `${target.platform}-${target.arch}`;
-    const signature = crypto.sign(null, Buffer.from(signedText(appId(state.config), name, signing.version, file)), signing.privateKey).toString('base64');
-    const manifest = { version: signing.version, file: path.basename(file), signature };
-    fs.writeFileSync(path.join(path.dirname(app), `${state.config.general.name}-${name}.update.json`), `${JSON.stringify(manifest, null, 2)}\n`);
-}

package/src/actions/extensions.js

@@ -1,7 +0,0 @@
-import state from '../state/index.js';
-
-export default function triggerExtensions(fileName, hook, params = []) {
-    state.config.extensions?.forEach(e => {
-        e?.[fileName]?.[hook](state, ...params);
-    });
-}