hane 1.0.0

package/README.md

@@ -0,0 +1,32 @@
+# Hane
+
+```ts
+import { sign } from "hane";
+
+await sign({
+  input: "/path/to/MyApp.ipa",
+  privateKey: "/path/to/key.p12",
+  provisioningProfile: "/path/to/profile.mobileprovision",
+  password: process.env.P12_PASSWORD,
+  output: "/tmp/MyApp-signed.ipa",
+  force: true,
+});
+```
+
+## Build prerequisites
+
+- A C++17 compiler toolchain compatible with Node.js
+- OpenSSL headers and libraries discoverable via `pkg-config`
+- zlib (normally available on macOS and Linux)
+
+Run `bun install` to compile. To rebuild only the native target use:
+
+```sh
+bun build:native
+```
+
+### Windows (x64) notes
+
+- Install the **Visual Studio 2022 Build Tools** with the “Desktop development with C++” workload.
+- Use Node.js 20+ and run installs from a Developer PowerShell so MSVC is on `PATH`.
+- The repository bundles the required OpenSSL static libraries under `vendor/[lib]/build/windows/vs2022/lib` (currently x64 only).

package/binding.gyp

@@ -0,0 +1,87 @@
+{
+	"targets": [
+		{
+			"target_name": "zsign",
+			"sources": [
+				"src/native/addon.cc",
+				"src/native/zsign_driver.cc",
+				"vendor/zsign/src/archo.cpp",
+				"vendor/zsign/src/bundle.cpp",
+				"vendor/zsign/src/macho.cpp",
+				"vendor/zsign/src/openssl.cpp",
+				"vendor/zsign/src/signing.cpp",
+				"vendor/zsign/src/zsign.cpp",
+				"vendor/zsign/src/common/archive.cpp",
+				"vendor/zsign/src/common/base64.cpp",
+				"vendor/zsign/src/common/fs.cpp",
+				"vendor/zsign/src/common/json.cpp",
+				"vendor/zsign/src/common/log.cpp",
+				"vendor/zsign/src/common/sha.cpp",
+				"vendor/zsign/src/common/timer.cpp",
+				"vendor/zsign/src/common/util.cpp",
+				"vendor/zlib/contrib/minizip/ioapi.c",
+				"vendor/zlib/contrib/minizip/unzip.c",
+				"vendor/zlib/contrib/minizip/zip.c"
+			],
+			"include_dirs": [
+				"<!@(node -p \"require('node-addon-api').include\")",
+				"vendor/zsign/src",
+				"vendor/zsign/src/common",
+				"vendor/zlib",
+				"vendor/zlib/contrib/minizip"
+			],
+			"defines": [
+				"NAPI_VERSION=8",
+				"NAPI_DISABLE_CPP_EXCEPTIONS",
+				"main=zsign_cli_main"
+			],
+			"dependencies": [
+				"<!@(node -p \"require('node-addon-api').gyp\")"
+			],
+			"cflags_cc": [],
+			"conditions": [
+				[
+					"OS!='win'",
+					{
+						"cflags_cc": [
+							"-std=c++17",
+							"-fexceptions",
+							"<!@(pkg-config --cflags openssl)"
+						],
+						"libraries": [
+							"<!@(pkg-config --libs openssl)",
+							"-lz"
+						]
+					}
+				],
+				[
+					"OS=='win'",
+					{
+						"sources": [
+							"vendor/zlib/contrib/minizip/iowin32.c",
+							"vendor/zsign/build/windows/vs2022/zsign/src/iconv.cpp",
+							"vendor/zsign/build/windows/vs2022/zsign/src/getopt.cpp"
+						],
+						"include_dirs": [
+							"vendor/zsign/build/windows/vs2022/zsign/src"
+						],
+						"libraries": [
+							"<(module_root_dir)/vendor/zsign/build/windows/vs2022/lib/openssl/x64/mt/libssl.lib",
+							"<(module_root_dir)/vendor/zsign/build/windows/vs2022/lib/openssl/x64/mt/libcrypto.lib",
+							"Shlwapi.lib",
+							"Ws2_32.lib",
+							"Crypt32.lib"
+						],
+						"msvs_settings": {
+							"VCCLCompilerTool": {
+								"AdditionalOptions": [
+									"/std:c++17"
+								]
+							}
+						}
+					}
+				]
+			]
+		}
+	]
+}

package/dist/index.d.ts

@@ -0,0 +1,34 @@
+//#region lib/index.d.ts
+interface SignOptions {
+  input: string;
+  certificate?: string;
+  privateKey?: string;
+  provisioningProfile?: string;
+  password?: string;
+  bundleId?: string;
+  bundleVersion?: string;
+  bundleDisplayName?: string;
+  entitlements?: string;
+  output?: string;
+  tempDirectory?: string;
+  dylibs?: string[];
+  debug?: boolean;
+  force?: boolean;
+  adhoc?: boolean;
+  weakInject?: boolean;
+  install?: boolean;
+  quiet?: boolean;
+  check?: boolean;
+  sha256Only?: boolean;
+  zipLevel?: number;
+}
+interface SignResult {
+  exitCode: number;
+  success: boolean;
+  outputPath?: string;
+  installRequested: boolean;
+  checkRequested: boolean;
+}
+declare function sign(options: SignOptions): Promise<SignResult>;
+//#endregion
+export { SignOptions, SignResult, sign };

package/dist/index.js

@@ -0,0 +1 @@
+import{createRequire as e}from"node:module";import{fileURLToPath as t}from"node:url";const n=e(import.meta.url)(`node-gyp-build`)(t(new URL(`..`,import.meta.url)));function r(e){if(!e||typeof e!=`object`)throw TypeError(`sign options must be an object`);if(!e.input||e.input.trim().length===0)throw TypeError(`sign options must include a non-empty "input" path`)}async function i(e){return r(e),n.sign(e)}export{i as sign};

package/package.json

@@ -0,0 +1,33 @@
+{
+	"name": "hane",
+	"version": "1.0.0",
+	"main": "./dist/index.js",
+	"types": "./dist/index.d.ts",
+	"type": "module",
+	"files": [
+		"dist/",
+		"binding.gyp",
+		"src/native/",
+		"vendor/zsign/",
+		"vendor/zlib/",
+		"README.md"
+	],
+	"scripts": {
+		"build": "tsdown && node-gyp rebuild",
+		"build:ts": "tsdown",
+		"build:native": "node-gyp rebuild",
+		"dev": "bun test --watch",
+		"prepare": "node-gyp rebuild"
+	},
+	"devDependencies": {
+		"@biomejs/biome": "2.3.5",
+		"@types/bun": "1.3.2",
+		"node-gyp": "12.0.0",
+		"tsdown": "0.16.3",
+		"typescript": "5.9.3"
+	},
+	"dependencies": {
+		"node-addon-api": "8.5.0",
+		"node-gyp-build": "4.8.4"
+	}
+}

package/src/native/addon.cc

@@ -0,0 +1,231 @@
+#include <napi.h>
+
+#include <optional>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "zsign_driver.h"
+
+namespace {
+
+std::optional<std::string> ReadOptionalString(const Napi::Env& env, const Napi::Object& obj, const char* key) {
+	if (!obj.Has(key)) {
+		return std::nullopt;
+	}
+
+	Napi::Value value = obj.Get(key);
+	if (value.IsUndefined() || value.IsNull()) {
+		return std::nullopt;
+	}
+
+	if (!value.IsString()) {
+		Napi::TypeError::New(env, std::string("Expected string for option \"") + key + "\"").ThrowAsJavaScriptException();
+		return std::nullopt;
+	}
+
+	return value.As<Napi::String>().Utf8Value();
+}
+
+bool ReadOptionalBool(const Napi::Env& env, const Napi::Object& obj, const char* key) {
+	if (!obj.Has(key)) {
+		return false;
+	}
+
+	Napi::Value value = obj.Get(key);
+	if (value.IsUndefined() || value.IsNull()) {
+		return false;
+	}
+
+	if (!value.IsBoolean()) {
+		Napi::TypeError::New(env, std::string("Expected boolean for option \"") + key + "\"").ThrowAsJavaScriptException();
+		return false;
+	}
+
+	return value.As<Napi::Boolean>().Value();
+}
+
+std::vector<std::string> ReadStringArray(const Napi::Env& env, const Napi::Object& obj, const char* key) {
+	std::vector<std::string> values;
+	if (!obj.Has(key)) {
+		return values;
+	}
+
+	Napi::Value value = obj.Get(key);
+	if (value.IsUndefined() || value.IsNull()) {
+		return values;
+	}
+
+	if (!value.IsArray()) {
+		Napi::TypeError::New(env, std::string("Expected array for option \"") + key + "\"").ThrowAsJavaScriptException();
+		return values;
+	}
+
+	Napi::Array arr = value.As<Napi::Array>();
+	values.reserve(arr.Length());
+	for (uint32_t i = 0; i < arr.Length(); i++) {
+		Napi::Value entry = arr.Get(i);
+		if (entry.IsUndefined() || entry.IsNull()) {
+			continue;
+		}
+		if (!entry.IsString()) {
+			Napi::TypeError::New(env, std::string("Expected string in \"") + key + "\" array").ThrowAsJavaScriptException();
+			return {};
+		}
+		values.push_back(entry.As<Napi::String>().Utf8Value());
+	}
+
+	return values;
+}
+
+int ReadZipLevel(const Napi::Env& env, const Napi::Object& obj) {
+	if (!obj.Has("zipLevel")) {
+		return -1;
+	}
+
+	Napi::Value value = obj.Get("zipLevel");
+	if (value.IsUndefined() || value.IsNull()) {
+		return -1;
+	}
+
+	if (!value.IsNumber()) {
+		Napi::TypeError::New(env, "Expected number for option \"zipLevel\"").ThrowAsJavaScriptException();
+		return -1;
+	}
+
+	int32_t level = value.As<Napi::Number>().Int32Value();
+	if (level < 0 || level > 9) {
+		Napi::RangeError::New(env, "\"zipLevel\" must be between 0 and 9").ThrowAsJavaScriptException();
+		return -1;
+	}
+
+	return level;
+}
+
+bool ParseOptions(const Napi::Env& env, const Napi::Object& optionsObject, ZSignBindingOptions& options) {
+	auto inputOpt = ReadOptionalString(env, optionsObject, "input");
+	if (!inputOpt || inputOpt->empty()) {
+		Napi::TypeError::New(env, "\"input\" must be a non-empty string").ThrowAsJavaScriptException();
+		return false;
+	}
+
+	options.input = *inputOpt;
+	if (auto cert = ReadOptionalString(env, optionsObject, "certificate")) {
+		options.certificate = *cert;
+	}
+	if (auto key = ReadOptionalString(env, optionsObject, "privateKey")) {
+		options.privateKey = *key;
+	}
+	if (auto prov = ReadOptionalString(env, optionsObject, "provisioningProfile")) {
+		options.provisioningProfile = *prov;
+	}
+	if (auto password = ReadOptionalString(env, optionsObject, "password")) {
+		options.password = *password;
+	}
+	if (auto bundleId = ReadOptionalString(env, optionsObject, "bundleId")) {
+		options.bundleId = *bundleId;
+	}
+	if (auto bundleVersion = ReadOptionalString(env, optionsObject, "bundleVersion")) {
+		options.bundleVersion = *bundleVersion;
+	}
+	if (auto displayName = ReadOptionalString(env, optionsObject, "bundleDisplayName")) {
+		options.bundleDisplayName = *displayName;
+	}
+	if (auto entitlements = ReadOptionalString(env, optionsObject, "entitlements")) {
+		options.entitlements = *entitlements;
+	}
+	if (auto output = ReadOptionalString(env, optionsObject, "output")) {
+		options.output = *output;
+	}
+	if (auto tempDir = ReadOptionalString(env, optionsObject, "tempDirectory")) {
+		options.tempDir = *tempDir;
+	}
+
+	options.dylibs = ReadStringArray(env, optionsObject, "dylibs");
+	if (env.IsExceptionPending()) {
+		return false;
+	}
+	options.debug = ReadOptionalBool(env, optionsObject, "debug");
+	options.force = ReadOptionalBool(env, optionsObject, "force");
+	options.adhoc = ReadOptionalBool(env, optionsObject, "adhoc");
+	options.weakInject = ReadOptionalBool(env, optionsObject, "weakInject");
+	options.install = ReadOptionalBool(env, optionsObject, "install");
+	options.quiet = ReadOptionalBool(env, optionsObject, "quiet");
+	options.check = ReadOptionalBool(env, optionsObject, "check");
+	options.sha256Only = ReadOptionalBool(env, optionsObject, "sha256Only");
+	options.zipLevel = ReadZipLevel(env, optionsObject);
+
+	if (env.IsExceptionPending()) {
+		return false;
+	}
+
+	return true;
+}
+
+Napi::Object BuildResultObject(const Napi::Env& env, const ZSignBindingResult& result) {
+	Napi::Object payload = Napi::Object::New(env);
+	payload.Set("exitCode", Napi::Number::New(env, result.exit_code));
+	payload.Set("success", Napi::Boolean::New(env, result.success));
+	payload.Set("installRequested", Napi::Boolean::New(env, result.install_requested));
+	payload.Set("checkRequested", Napi::Boolean::New(env, result.check_requested));
+	if (!result.output_path.empty()) {
+		payload.Set("outputPath", Napi::String::New(env, result.output_path));
+	}
+	return payload;
+}
+
+class SignWorker final : public Napi::AsyncWorker {
+public:
+	explicit SignWorker(Napi::Env env, ZSignBindingOptions options)
+		: Napi::AsyncWorker(env), deferred_(Napi::Promise::Deferred::New(env)), options_(std::move(options)) {}
+
+	void Execute() override {
+		result_ = RunZSignWithOptions(options_);
+	}
+
+	void OnOK() override {
+		deferred_.Resolve(BuildResultObject(Env(), result_));
+	}
+
+	void OnError(const Napi::Error& error) override {
+		deferred_.Reject(error.Value());
+	}
+
+	Napi::Promise GetPromise() {
+		return deferred_.Promise();
+	}
+
+private:
+	Napi::Promise::Deferred deferred_;
+	ZSignBindingOptions options_;
+	ZSignBindingResult result_;
+};
+
+} // namespace
+
+Napi::Value Sign(const Napi::CallbackInfo& info) {
+	Napi::Env env = info.Env();
+
+	if (info.Length() == 0 || !info[0].IsObject()) {
+		Napi::TypeError::New(env, "Options object is required").ThrowAsJavaScriptException();
+		return env.Undefined();
+	}
+
+	Napi::Object optionsObject = info[0].As<Napi::Object>();
+	ZSignBindingOptions options;
+	if (!ParseOptions(env, optionsObject, options)) {
+		return env.Undefined();
+	}
+
+	auto* worker = new SignWorker(env, std::move(options));
+	auto promise = worker->GetPromise();
+	worker->Queue();
+	return promise;
+}
+
+Napi::Object Init(Napi::Env env, Napi::Object exports) {
+	exports.Set(Napi::String::New(env, "sign"), Napi::Function::New(env, Sign));
+	return exports;
+}
+
+NODE_API_MODULE(zsign, Init)

package/src/native/zsign_driver.cc

@@ -0,0 +1,87 @@
+#include "zsign_driver.h"
+
+#include <string>
+#include <vector>
+
+extern int zsign_cli_main(int argc, char** argv);
+extern int optind;
+#if defined(__APPLE__) || defined(__FreeBSD__) || defined(__NetBSD__) || defined(__OpenBSD__)
+extern int optreset;
+#endif
+
+namespace {
+
+void PushFlag(std::vector<std::string>& args, const char* flag, bool enabled) {
+	if (enabled) {
+		args.emplace_back(flag);
+	}
+}
+
+void PushOption(std::vector<std::string>& args, const char* flag, const std::string& value) {
+	if (!value.empty()) {
+		args.emplace_back(flag);
+		args.emplace_back(value);
+	}
+}
+
+} // namespace
+
+ZSignBindingResult RunZSignWithOptions(const ZSignBindingOptions& options) {
+	std::vector<std::string> args;
+	args.emplace_back("zsign");
+
+	PushFlag(args, "-d", options.debug);
+	PushFlag(args, "-f", options.force);
+	PushFlag(args, "-a", options.adhoc);
+	PushFlag(args, "-w", options.weakInject);
+	PushFlag(args, "-i", options.install);
+	PushFlag(args, "-q", options.quiet);
+	PushFlag(args, "-C", options.check);
+	PushFlag(args, "-2", options.sha256Only);
+
+	PushOption(args, "-c", options.certificate);
+	PushOption(args, "-k", options.privateKey);
+	PushOption(args, "-m", options.provisioningProfile);
+	PushOption(args, "-p", options.password);
+	PushOption(args, "-b", options.bundleId);
+	PushOption(args, "-r", options.bundleVersion);
+	PushOption(args, "-n", options.bundleDisplayName);
+	PushOption(args, "-e", options.entitlements);
+	PushOption(args, "-o", options.output);
+	PushOption(args, "-t", options.tempDir);
+
+	if (options.zipLevel >= 0) {
+		args.emplace_back("-z");
+		args.emplace_back(std::to_string(options.zipLevel));
+	}
+
+	for (const auto& dylib : options.dylibs) {
+		if (!dylib.empty()) {
+			args.emplace_back("-l");
+			args.emplace_back(dylib);
+		}
+	}
+
+	args.emplace_back(options.input);
+
+	std::vector<char*> argv;
+	argv.reserve(args.size());
+	for (auto& arg : args) {
+		argv.push_back(const_cast<char*>(arg.c_str()));
+	}
+
+	optind = 1;
+#if defined(__APPLE__) || defined(__FreeBSD__) || defined(__NetBSD__) || defined(__OpenBSD__)
+	optreset = 1;
+#endif
+
+	const int exitCode = zsign_cli_main(static_cast<int>(argv.size()), argv.data());
+
+	ZSignBindingResult result;
+	result.exit_code = exitCode;
+	result.success = (exitCode == 0);
+	result.output_path = options.output;
+	result.install_requested = options.install;
+	result.check_requested = options.check;
+	return result;
+}

package/src/native/zsign_driver.h

@@ -0,0 +1,38 @@
+#pragma once
+
+#include <string>
+#include <vector>
+
+struct ZSignBindingOptions {
+	std::string input;
+	std::string certificate;
+	std::string privateKey;
+	std::string provisioningProfile;
+	std::string password;
+	std::string bundleId;
+	std::string bundleVersion;
+	std::string bundleDisplayName;
+	std::string entitlements;
+	std::string output;
+	std::string tempDir;
+	std::vector<std::string> dylibs;
+	bool debug = false;
+	bool force = false;
+	bool adhoc = false;
+	bool weakInject = false;
+	bool install = false;
+	bool quiet = false;
+	bool check = false;
+	bool sha256Only = false;
+	int zipLevel = -1;
+};
+
+struct ZSignBindingResult {
+	int exit_code = -1;
+	std::string output_path;
+	bool success = false;
+	bool install_requested = false;
+	bool check_requested = false;
+};
+
+ZSignBindingResult RunZSignWithOptions(const ZSignBindingOptions& options);