native-update 1.4.4 → 1.4.6

package/dist/esm/security/crypto.js

@@ -1,6 +1,15 @@
 /**
- * Cryptographic utilities for bundle verification
+ * Cryptographic utilities for bundle verification and encryption
  */
+/**
+ * Default encryption configuration
+ */
+const DEFAULT_ENCRYPTION_CONFIG = {
+    algorithm: 'AES-GCM',
+    keyLength: 256,
+    ivLength: 12, // Recommended for GCM
+    tagLength: 128, // 128-bit authentication tag
+};
 export class CryptoUtils {
     /**
      * Calculate SHA-256 checksum of data
@@ -66,5 +75,153 @@ export class CryptoUtils {
         const hexPattern = /^[a-f0-9]+$/i;
         return checksum.length === expectedLength && hexPattern.test(checksum);
     }
+    // ============================================
+    // AES-256-GCM Encryption/Decryption
+    // ============================================
+    /**
+     * Derive an encryption key from a password/secret
+     * Uses PBKDF2 for secure key derivation
+     */
+    static async deriveKey(password, salt, keyLength = 256) {
+        const encoder = new TextEncoder();
+        const passwordBuffer = encoder.encode(password);
+        // Import password as raw key material
+        const passwordKey = await crypto.subtle.importKey('raw', passwordBuffer, 'PBKDF2', false, ['deriveKey']);
+        // Derive AES key using PBKDF2
+        return crypto.subtle.deriveKey({
+            name: 'PBKDF2',
+            salt,
+            iterations: 100000, // High iteration count for security
+            hash: 'SHA-256',
+        }, passwordKey, {
+            name: 'AES-GCM',
+            length: keyLength,
+        }, false, // Not extractable
+        ['encrypt', 'decrypt']);
+    }
+    /**
+     * Import a raw encryption key
+     */
+    static async importKey(keyData, keyLength = 256) {
+        const keyBuffer = typeof keyData === 'string'
+            ? this.base64ToArrayBuffer(keyData)
+            : keyData;
+        return crypto.subtle.importKey('raw', keyBuffer, {
+            name: 'AES-GCM',
+            length: keyLength,
+        }, false, ['encrypt', 'decrypt']);
+    }
+    /**
+     * Encrypt data using AES-256-GCM
+     */
+    static async encrypt(data, key, config = {}) {
+        const finalConfig = Object.assign(Object.assign({}, DEFAULT_ENCRYPTION_CONFIG), config);
+        // Generate random IV
+        const iv = crypto.getRandomValues(new Uint8Array(finalConfig.ivLength));
+        // Convert to Uint8Array view for consistent handling
+        let dataArray;
+        if (data instanceof Uint8Array) {
+            dataArray = data;
+        }
+        else {
+            dataArray = new Uint8Array(data);
+        }
+        // Encrypt the data (cast to BufferSource to satisfy TypeScript)
+        const ciphertext = await crypto.subtle.encrypt({
+            name: 'AES-GCM',
+            iv,
+            tagLength: finalConfig.tagLength,
+        }, key, dataArray);
+        // Convert IV buffer to proper ArrayBuffer
+        const ivArray = new Uint8Array(iv);
+        const ivBuffer = new ArrayBuffer(ivArray.length);
+        new Uint8Array(ivBuffer).set(ivArray);
+        return {
+            iv: this.arrayBufferToBase64(ivBuffer),
+            data: this.arrayBufferToBase64(ciphertext),
+            algorithm: `AES-${finalConfig.keyLength}-GCM`,
+        };
+    }
+    /**
+     * Decrypt data using AES-256-GCM
+     */
+    static async decrypt(encryptedBundle, key, config = {}) {
+        const finalConfig = Object.assign(Object.assign({}, DEFAULT_ENCRYPTION_CONFIG), config);
+        // Decode IV and ciphertext
+        const iv = new Uint8Array(this.base64ToArrayBuffer(encryptedBundle.iv));
+        const ciphertext = this.base64ToArrayBuffer(encryptedBundle.data);
+        // Decrypt the data
+        return crypto.subtle.decrypt({
+            name: 'AES-GCM',
+            iv,
+            tagLength: finalConfig.tagLength,
+        }, key, ciphertext);
+    }
+    /**
+     * Encrypt a bundle file (convenience method for typical use case)
+     */
+    static async encryptBundle(bundleData, encryptionKey, salt) {
+        // Generate salt if not provided
+        const saltArray = salt ? new Uint8Array(salt) : crypto.getRandomValues(new Uint8Array(16));
+        const actualSalt = saltArray.buffer.slice(saltArray.byteOffset, saltArray.byteOffset + saltArray.byteLength);
+        // Derive key from password
+        const key = await this.deriveKey(encryptionKey, actualSalt);
+        // Encrypt the bundle
+        const encrypted = await this.encrypt(bundleData, key);
+        return {
+            encrypted,
+            salt: this.arrayBufferToBase64(actualSalt),
+        };
+    }
+    /**
+     * Decrypt a bundle file (convenience method for typical use case)
+     */
+    static async decryptBundle(encryptedBundle, encryptionKey, salt) {
+        // Decode salt
+        const saltBuffer = this.base64ToArrayBuffer(salt);
+        // Derive key from password
+        const key = await this.deriveKey(encryptionKey, saltBuffer);
+        // Decrypt the bundle
+        return this.decrypt(encryptedBundle, key);
+    }
+    /**
+     * Check if a bundle is encrypted
+     */
+    static isEncryptedBundle(data) {
+        return (typeof data === 'object' &&
+            data !== null &&
+            'iv' in data &&
+            'data' in data &&
+            'algorithm' in data &&
+            typeof data.iv === 'string' &&
+            typeof data.data === 'string' &&
+            typeof data.algorithm === 'string');
+    }
+    /**
+     * Generate a random encryption key
+     */
+    static generateEncryptionKey(length = 256) {
+        const keyBytes = length / 8;
+        const key = crypto.getRandomValues(new Uint8Array(keyBytes));
+        return this.arrayBufferToBase64(key.buffer);
+    }
+    /**
+     * Generate a random salt
+     */
+    static generateSalt(length = 16) {
+        const salt = crypto.getRandomValues(new Uint8Array(length));
+        return this.arrayBufferToBase64(salt.buffer);
+    }
+    /**
+     * Convert ArrayBuffer to base64 string
+     */
+    static arrayBufferToBase64(buffer) {
+        const bytes = new Uint8Array(buffer);
+        let binary = '';
+        for (let i = 0; i < bytes.length; i++) {
+            binary += String.fromCharCode(bytes[i]);
+        }
+        return btoa(binary);
+    }
 }
 //# sourceMappingURL=crypto.js.map

package/dist/esm/security/crypto.js.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../../src/security/crypto.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,OAAO,WAAW;IACtB;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAA0B;QACvD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,MAAM,UAAU,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAE1E,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QACrE,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;QACzD,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxE,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,eAAe,CAC1B,IAA0B,EAC1B,SAAiB,EACjB,SAAiB;QAEjB,IAAI,CAAC;YACH,wCAAwC;YACxC,MAAM,eAAe,GAAG,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;YAC5D,MAAM,eAAe,GAAG,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;YAE5D,oBAAoB;YACpB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,MAAM,EACN,eAAe,EACf;gBACE,IAAI,EAAE,SAAS;gBACf,IAAI,EAAE,SAAS;aAChB,EACD,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;YAEF,eAAe;YACf,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;YAClC,MAAM,UAAU,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAE1E,mBAAmB;YACnB,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAC/B;gBACE,IAAI,EAAE,SAAS;gBACf,UAAU,EAAE,EAAE;aACf,EACD,GAAG,EACH,eAAe,EACf,UAAU,CACX,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;YACvD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,mBAAmB,CAAC,MAAc;QAC/C,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAClD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7C,KAAK,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,KAAK,CAAC,MAAM,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,aAAa,CAAC,SAAiB,EAAE;QACtC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CACzE,EAAE,CACH,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,eAAe,CACpB,QAAgB,EAChB,YAAmC,SAAS;QAE5C,MAAM,cAAc,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QAC1D,MAAM,UAAU,GAAG,cAAc,CAAC;QAElC,OAAO,QAAQ,CAAC,MAAM,KAAK,cAAc,IAAI,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzE,CAAC;CACF"}
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../../src/security/crypto.ts"],"names":[],"mappings":"AAAA;;GAEG;AAuBH;;GAEG;AACH,MAAM,yBAAyB,GAAqB;IAClD,SAAS,EAAE,SAAS;IACpB,SAAS,EAAE,GAAG;IACd,QAAQ,EAAE,EAAE,EAAE,sBAAsB;IACpC,SAAS,EAAE,GAAG,EAAE,6BAA6B;CAC9C,CAAC;AAEF,MAAM,OAAO,WAAW;IACtB;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAA0B;QACvD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,MAAM,UAAU,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAE1E,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QACrE,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;QACzD,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxE,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,eAAe,CAC1B,IAA0B,EAC1B,SAAiB,EACjB,SAAiB;QAEjB,IAAI,CAAC;YACH,wCAAwC;YACxC,MAAM,eAAe,GAAG,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;YAC5D,MAAM,eAAe,GAAG,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;YAE5D,oBAAoB;YACpB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,MAAM,EACN,eAAe,EACf;gBACE,IAAI,EAAE,SAAS;gBACf,IAAI,EAAE,SAAS;aAChB,EACD,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;YAEF,eAAe;YACf,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;YAClC,MAAM,UAAU,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAE1E,mBAAmB;YACnB,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAC/B;gBACE,IAAI,EAAE,SAAS;gBACf,UAAU,EAAE,EAAE;aACf,EACD,GAAG,EACH,eAAe,EACf,UAAU,CACX,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;YACvD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,mBAAmB,CAAC,MAAc;QAC/C,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAClD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7C,KAAK,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,KAAK,CAAC,MAAM,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,aAAa,CAAC,SAAiB,EAAE;QACtC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CACzE,EAAE,CACH,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,eAAe,CACpB,QAAgB,EAChB,YAAmC,SAAS;QAE5C,MAAM,cAAc,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QAC1D,MAAM,UAAU,GAAG,cAAc,CAAC;QAElC,OAAO,QAAQ,CAAC,MAAM,KAAK,cAAc,IAAI,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzE,CAAC;IAED,+CAA+C;IAC/C,oCAAoC;IACpC,+CAA+C;IAE/C;;;OAGG;IACH,MAAM,CAAC,KAAK,CAAC,SAAS,CACpB,QAAgB,EAChB,IAAiB,EACjB,YAA6B,GAAG;QAEhC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAEhD,sCAAsC;QACtC,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC/C,KAAK,EACL,cAAc,EACd,QAAQ,EACR,KAAK,EACL,CAAC,WAAW,CAAC,CACd,CAAC;QAEF,8BAA8B;QAC9B,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B;YACE,IAAI,EAAE,QAAQ;YACd,IAAI;YACJ,UAAU,EAAE,MAAM,EAAE,oCAAoC;YACxD,IAAI,EAAE,SAAS;SAChB,EACD,WAAW,EACX;YACE,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,SAAS;SAClB,EACD,KAAK,EAAE,kBAAkB;QACzB,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,SAAS,CACpB,OAA6B,EAC7B,YAA6B,GAAG;QAEhC,MAAM,SAAS,GAAG,OAAO,OAAO,KAAK,QAAQ;YAC3C,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC;YACnC,CAAC,CAAC,OAAO,CAAC;QAEZ,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B,KAAK,EACL,SAAS,EACT;YACE,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,SAAS;SAClB,EACD,KAAK,EACL,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,OAAO,CAClB,IAA8B,EAC9B,GAAc,EACd,SAAoC,EAAE;QAEtC,MAAM,WAAW,mCAAQ,yBAAyB,GAAK,MAAM,CAAE,CAAC;QAEhE,qBAAqB;QACrB,MAAM,EAAE,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;QAExE,qDAAqD;QACrD,IAAI,SAAqB,CAAC;QAC1B,IAAI,IAAI,YAAY,UAAU,EAAE,CAAC;YAC/B,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,SAAS,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QAED,gEAAgE;QAChE,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAC5C;YACE,IAAI,EAAE,SAAS;YACf,EAAE;YACF,SAAS,EAAE,WAAW,CAAC,SAAS;SACjC,EACD,GAAG,EACH,SAAoC,CACrC,CAAC;QAEF,0CAA0C;QAC1C,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;QACnC,MAAM,QAAQ,GAAG,IAAI,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAEtC,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC;YACtC,IAAI,EAAE,IAAI,CAAC,mBAAmB,CAAC,UAAU,CAAC;YAC1C,SAAS,EAAE,OAAO,WAAW,CAAC,SAAS,MAAM;SAC9C,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,OAAO,CAClB,eAAgC,EAChC,GAAc,EACd,SAAoC,EAAE;QAEtC,MAAM,WAAW,mCAAQ,yBAAyB,GAAK,MAAM,CAAE,CAAC;QAEhE,2BAA2B;QAC3B,MAAM,EAAE,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC;QACxE,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAElE,mBAAmB;QACnB,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAC1B;YACE,IAAI,EAAE,SAAS;YACf,EAAE;YACF,SAAS,EAAE,WAAW,CAAC,SAAS;SACjC,EACD,GAAG,EACH,UAAU,CACX,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,aAAa,CACxB,UAAuB,EACvB,aAAqB,EACrB,IAAkB;QAElB,gCAAgC;QAChC,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3F,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAgB,CAAC;QAE5H,2BAA2B;QAC3B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;QAE5D,qBAAqB;QACrB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QAEtD,OAAO;YACL,SAAS;YACT,IAAI,EAAE,IAAI,CAAC,mBAAmB,CAAC,UAAU,CAAC;SAC3C,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,aAAa,CACxB,eAAgC,EAChC,aAAqB,EACrB,IAAY;QAEZ,cAAc;QACd,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAElD,2BAA2B;QAC3B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;QAE5D,qBAAqB;QACrB,OAAO,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,iBAAiB,CAAC,IAAa;QACpC,OAAO,CACL,OAAO,IAAI,KAAK,QAAQ;YACxB,IAAI,KAAK,IAAI;YACb,IAAI,IAAI,IAAI;YACZ,MAAM,IAAI,IAAI;YACd,WAAW,IAAI,IAAI;YACnB,OAAQ,IAAwB,CAAC,EAAE,KAAK,QAAQ;YAChD,OAAQ,IAAwB,CAAC,IAAI,KAAK,QAAQ;YAClD,OAAQ,IAAwB,CAAC,SAAS,KAAK,QAAQ,CACxD,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,qBAAqB,CAAC,SAA0B,GAAG;QACxD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,CAAC;QAC5B,MAAM,GAAG,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,YAAY,CAAC,SAAiB,EAAE;QACrC,MAAM,IAAI,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5D,OAAO,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,mBAAmB,CAAC,MAAmB;QAC5C,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;CACF"}

package/dist/esm/web.d.ts

@@ -1,5 +1,5 @@
 import { WebPlugin } from '@capacitor/core';
-import type { NativeUpdateCombinedPlugin, SecurityInfo, SyncOptions, SyncResult, DownloadOptions, BundleInfo, DeleteOptions, LatestVersion, ValidateOptions, ValidationResult, AppUpdateInfo, OpenAppStoreOptions, ReviewResult, CanRequestReviewResult, BackgroundUpdateConfig, BackgroundUpdateStatus, BackgroundCheckResult, NotificationPreferences, NotificationPermissionStatus } from './definitions';
+import type { NativeUpdateCombinedPlugin, SecurityInfo, SyncOptions, SyncResult, DownloadOptions, BundleInfo, DeleteOptions, LatestVersion, ValidateOptions, ValidationResult, AppUpdateInfo, OpenAppStoreOptions, ReviewResult, CanRequestReviewResult, BackgroundUpdateConfig, BackgroundUpdateStatus, BackgroundCheckResult, NotificationPreferences, NotificationPermissionStatus, CheckForUpdateResult, DownloadUpdateOptions } from './definitions';
 import type { PluginInitConfig } from './definitions';
 export declare class NativeUpdateWeb extends WebPlugin implements NativeUpdateCombinedPlugin {
     private config;
@@ -9,6 +9,8 @@ export declare class NativeUpdateWeb extends WebPlugin implements NativeUpdateCo
     private launchCount;
     private backgroundUpdateStatus;
     private backgroundCheckInterval;
+    private configManager;
+    private isConfigured;
     constructor();
     /**
      * Configuration and Core Methods
@@ -33,6 +35,16 @@ export declare class NativeUpdateWeb extends WebPlugin implements NativeUpdateCo
     setChannel(channel: string): Promise<void>;
     setUpdateUrl(url: string): Promise<void>;
     validateUpdate(options: ValidateOptions): Promise<ValidationResult>;
+    /**
+     * Convenience Methods
+     */
+    checkForUpdate(): Promise<CheckForUpdateResult>;
+    downloadUpdate(options?: DownloadUpdateOptions): Promise<BundleInfo>;
+    applyUpdate(bundleId?: string): Promise<void>;
+    cancelDownload(bundleId: string): Promise<void>;
+    cancelAllDownloads(): Promise<void>;
+    isDownloading(bundleId: string): Promise<boolean>;
+    getActiveDownloadCount(): Promise<number>;
     /**
      * App Update Methods
      */
@@ -63,11 +75,38 @@ export declare class NativeUpdateWeb extends WebPlugin implements NativeUpdateCo
      */
     private createError;
     private createDefaultBundle;
+    /**
+     * Validate checksum using SHA-256
+     * @param data - The data to validate (as string path or ArrayBuffer)
+     * @param expectedChecksum - Expected SHA-256 hash (hex string)
+     */
     private validateChecksum;
+    /**
+     * Validate digital signature using RSA-PSS or ECDSA
+     * @param data - The data that was signed (as string path or ArrayBuffer)
+     * @param signature - The signature to verify (base64 encoded)
+     */
     private validateSignature;
+    /**
+     * Fallback signature validation using ECDSA
+     */
+    private validateSignatureECDSA;
+    /**
+     * Import RSA public key from PEM format
+     */
+    private importPublicKey;
+    /**
+     * Import ECDSA public key from PEM format
+     */
+    private importPublicKeyECDSA;
     private loadStoredData;
     private saveStoredData;
     private saveConfiguration;
     private getInstallDate;
     private incrementLaunchCount;
+    /**
+     * Get configured review URL from plugin config
+     * Returns Play Store, App Store, or custom web review URL based on platform/config
+     */
+    private getConfiguredReviewUrl;
 }

package/dist/esm/web.js

@@ -1,5 +1,6 @@
 import { WebPlugin } from '@capacitor/core';
 import { SyncStatus, BundleStatus, UpdateErrorCode } from './definitions';
+import { ConfigManager } from './core/config';
 export class NativeUpdateWeb extends WebPlugin {
     constructor() {
         super();
@@ -15,6 +16,8 @@ export class NativeUpdateWeb extends WebPlugin {
             failureCount: 0,
         };
         this.backgroundCheckInterval = null;
+        this.isConfigured = false;
+        this.configManager = ConfigManager.getInstance();
         this.loadStoredData();
         this.incrementLaunchCount();
     }
@@ -22,12 +25,13 @@ export class NativeUpdateWeb extends WebPlugin {
      * Configuration and Core Methods
      */
     async configure(options) {
-        // Store the plugin config
-        // In a real implementation, this would configure the plugin properly
+        // Validate and store the plugin config using ConfigManager
+        // This will throw if baseUrl is not HTTPS
         if (options.config) {
+            this.configManager.configure(options.config);
+            this.isConfigured = true;
             this.saveConfiguration();
         }
-        // console.log('NativeUpdate configured:', options.config);
     }
     async getSecurityInfo() {
         var _a, _b, _c, _d, _e, _f, _g;
@@ -45,8 +49,11 @@ export class NativeUpdateWeb extends WebPlugin {
      * Live Update Methods
      */
     async sync(_options) {
-        // console.log('Web: Checking for updates...', options);
         var _a;
+        // Require configuration before sync
+        if (!this.isConfigured) {
+            throw this.createError(UpdateErrorCode.NOT_CONFIGURED, 'Plugin not configured. Call configure() first.');
+        }
         try {
             // In web, we can check for service worker updates
             if ('serviceWorker' in navigator) {
@@ -106,9 +113,27 @@ export class NativeUpdateWeb extends WebPlugin {
             });
             await new Promise((resolve) => setTimeout(resolve, 100));
         }
+        // Verify bundle integrity if checksum/signature provided
+        let verified = true;
+        if (options.checksum) {
+            const checksumValid = await this.validateChecksum(bundleId, options.checksum);
+            if (!checksumValid) {
+                bundle.status = BundleStatus.FAILED;
+                this.bundles.delete(bundleId);
+                throw this.createError(UpdateErrorCode.CHECKSUM_ERROR, 'Bundle checksum verification failed');
+            }
+        }
+        if (options.signature) {
+            const signatureValid = await this.validateSignature(bundleId, options.signature);
+            if (!signatureValid) {
+                bundle.status = BundleStatus.FAILED;
+                this.bundles.delete(bundleId);
+                throw this.createError(UpdateErrorCode.SIGNATURE_ERROR, 'Bundle signature verification failed');
+            }
+        }
         // Update bundle status
         bundle.status = BundleStatus.READY;
-        bundle.verified = true; // In real implementation, would verify checksum/signature
+        bundle.verified = verified;
         this.saveStoredData();
         await this.notifyListeners('updateStateChanged', {
             status: bundle.status,
@@ -232,6 +257,94 @@ export class NativeUpdateWeb extends WebPlugin {
             },
         };
     }
+    /**
+     * Convenience Methods
+     */
+    async checkForUpdate() {
+        var _a;
+        const currentVersion = ((_a = this.currentBundle) === null || _a === void 0 ? void 0 : _a.version) || '1.0.0';
+        // Check for service worker updates or server updates
+        const latest = await this.getLatest();
+        return {
+            available: latest.available,
+            currentVersion,
+            latestVersion: latest.version,
+            url: latest.url,
+            mandatory: latest.mandatory,
+            notes: latest.notes,
+            size: latest.size,
+            checksum: latest.checksum,
+        };
+    }
+    async downloadUpdate(options) {
+        // Check for update first if no options provided
+        let url = options === null || options === void 0 ? void 0 : options.url;
+        let version = options === null || options === void 0 ? void 0 : options.version;
+        let checksum = (options === null || options === void 0 ? void 0 : options.checksum) || '';
+        if (!url || !version) {
+            const updateInfo = await this.checkForUpdate();
+            if (!updateInfo.available || !updateInfo.url) {
+                throw this.createError(UpdateErrorCode.UPDATE_NOT_AVAILABLE, 'No update available to download');
+            }
+            url = url || updateInfo.url;
+            version = version || updateInfo.latestVersion || 'latest';
+            checksum = checksum || updateInfo.checksum || '';
+        }
+        // Download using the standard download method
+        return this.download({
+            url,
+            version,
+            checksum,
+        });
+    }
+    async applyUpdate(bundleId) {
+        // Find the bundle to apply
+        let bundle;
+        if (bundleId) {
+            bundle = this.bundles.get(bundleId);
+        }
+        else {
+            // Find the most recent ready bundle
+            const readyBundles = Array.from(this.bundles.values())
+                .filter(b => b.status === BundleStatus.READY)
+                .sort((a, b) => b.downloadTime - a.downloadTime);
+            bundle = readyBundles[0];
+        }
+        if (!bundle) {
+            throw this.createError(UpdateErrorCode.UNKNOWN_ERROR, 'No ready bundle found to apply');
+        }
+        // Set the bundle as active and reload
+        await this.set(bundle);
+        await this.reload();
+    }
+    async cancelDownload(bundleId) {
+        // In web implementation, we can't truly cancel an ongoing fetch
+        // But we can remove the bundle from tracking
+        const bundle = this.bundles.get(bundleId);
+        if (bundle && bundle.status === BundleStatus.DOWNLOADING) {
+            bundle.status = BundleStatus.FAILED;
+            this.bundles.delete(bundleId);
+            this.saveStoredData();
+        }
+    }
+    async cancelAllDownloads() {
+        const downloadingBundles = Array.from(this.bundles.values())
+            .filter(b => b.status === BundleStatus.DOWNLOADING);
+        for (const bundle of downloadingBundles) {
+            bundle.status = BundleStatus.FAILED;
+            this.bundles.delete(bundle.bundleId);
+        }
+        this.saveStoredData();
+    }
+    async isDownloading(bundleId) {
+        const bundle = this.bundles.get(bundleId);
+        return (bundle === null || bundle === void 0 ? void 0 : bundle.status) === BundleStatus.DOWNLOADING;
+    }
+    async getActiveDownloadCount() {
+        return Array.from(this.bundles.values())
+            .filter(b => b.status === BundleStatus.DOWNLOADING)
+            .length;
+    }
     /**
      * App Update Methods
      */
@@ -254,13 +367,15 @@ export class NativeUpdateWeb extends WebPlugin {
         throw this.createError(UpdateErrorCode.PLATFORM_NOT_SUPPORTED, 'App updates are not supported on web platform');
     }
     async openAppStore(_options) {
-        // console.log('Web: Opening app store fallback URL', options);
         var _a, _b, _c, _d;
-        // Fallback to website or app landing page
-        const fallbackUrl = ((_b = (_a = this.config.appUpdate) === null || _a === void 0 ? void 0 : _a.storeUrl) === null || _b === void 0 ? void 0 : _b.android) ||
+        // Get configured store URL
+        const storeUrl = ((_b = (_a = this.config.appUpdate) === null || _a === void 0 ? void 0 : _a.storeUrl) === null || _b === void 0 ? void 0 : _b.android) ||
             ((_d = (_c = this.config.appUpdate) === null || _c === void 0 ? void 0 : _c.storeUrl) === null || _d === void 0 ? void 0 : _d.ios) ||
-            'https://example.com/download';
-        window.open(fallbackUrl, '_blank');
+            this.getConfiguredReviewUrl();
+        if (!storeUrl) {
+            throw this.createError(UpdateErrorCode.INVALID_CONFIG, 'No app store URL configured. Set appUpdate.storeUrl.ios or appUpdate.storeUrl.android in plugin config.');
+        }
+        window.open(storeUrl, '_blank');
     }
     /**
      * App Review Methods
@@ -278,13 +393,19 @@ export class NativeUpdateWeb extends WebPlugin {
         this.lastReviewRequest = Date.now();
         localStorage.setItem('native-update-last-review', this.lastReviewRequest.toString());
         // In web, we could show a custom modal or redirect to a review page
-        const reviewUrl = 'https://example.com/review';
-        const shouldRedirect = confirm('Would you like to leave a review for our app?');
-        if (shouldRedirect) {
-            window.open(reviewUrl, '_blank');
+        // Note: Web platform cannot display native in-app review dialogs
+        // We can offer a fallback redirect, but `displayed` reflects native capability
+        const reviewUrl = this.getConfiguredReviewUrl();
+        // Guard against environments where confirm is not available (e.g., test environments)
+        if (typeof confirm === 'function' && reviewUrl) {
+            const shouldRedirect = confirm('Would you like to leave a review for our app?');
+            if (shouldRedirect && typeof window !== 'undefined' && window.open) {
+                window.open(reviewUrl, '_blank');
+            }
         }
+        // Web platform returns displayed: false because we cannot show native review dialog
         return {
-            displayed: true,
+            displayed: false,
         };
     }
     async canRequestReview() {
@@ -529,15 +650,151 @@ export class NativeUpdateWeb extends WebPlugin {
             verified: true,
         };
     }
-    async validateChecksum(_data, _expectedChecksum) {
-        // In a real implementation, would calculate actual checksum
-        // console.log('Web: Validating checksum...', expectedChecksum);
-        return true;
+    /**
+     * Validate checksum using SHA-256
+     * @param data - The data to validate (as string path or ArrayBuffer)
+     * @param expectedChecksum - Expected SHA-256 hash (hex string)
+     */
+    async validateChecksum(data, expectedChecksum) {
+        if (!expectedChecksum) {
+            // If no checksum provided, skip validation
+            return true;
+        }
+        try {
+            let dataBuffer;
+            if (typeof data === 'string') {
+                // If data is a path/URL, we need to fetch it
+                // For local validation, convert string to buffer
+                dataBuffer = new TextEncoder().encode(data).buffer;
+            }
+            else {
+                dataBuffer = data;
+            }
+            // Calculate SHA-256 hash using Web Crypto API
+            const hashBuffer = await crypto.subtle.digest('SHA-256', dataBuffer);
+            const hashArray = Array.from(new Uint8Array(hashBuffer));
+            const hashHex = hashArray.map(b => b.toString(16).padStart(2, '0')).join('');
+            // Compare checksums (case-insensitive)
+            const isValid = hashHex.toLowerCase() === expectedChecksum.toLowerCase();
+            if (!isValid) {
+                console.warn('Checksum validation failed', {
+                    expected: expectedChecksum.toLowerCase(),
+                    actual: hashHex.toLowerCase(),
+                });
+            }
+            return isValid;
+        }
+        catch (error) {
+            console.error('Checksum validation error:', error);
+            return false;
+        }
+    }
+    /**
+     * Validate digital signature using RSA-PSS or ECDSA
+     * @param data - The data that was signed (as string path or ArrayBuffer)
+     * @param signature - The signature to verify (base64 encoded)
+     */
+    async validateSignature(data, signature) {
+        var _a;
+        if (!signature) {
+            // If no signature provided, skip validation
+            return true;
+        }
+        // Get public key from config (can be in liveUpdate.publicKey or top-level config)
+        const publicKeyPem = ((_a = this.config.liveUpdate) === null || _a === void 0 ? void 0 : _a.publicKey) ||
+            this.config.publicKey;
+        if (!publicKeyPem) {
+            // If no public key configured, skip signature validation
+            console.warn('No public key configured for signature validation');
+            return true;
+        }
+        try {
+            let dataBuffer;
+            if (typeof data === 'string') {
+                dataBuffer = new TextEncoder().encode(data).buffer;
+            }
+            else {
+                dataBuffer = data;
+            }
+            // Decode base64 signature
+            const signatureBuffer = Uint8Array.from(atob(signature), c => c.charCodeAt(0));
+            // Import public key
+            const publicKey = await this.importPublicKey(publicKeyPem);
+            // Verify signature using RSA-PSS
+            const isValid = await crypto.subtle.verify({
+                name: 'RSA-PSS',
+                saltLength: 32,
+            }, publicKey, signatureBuffer, dataBuffer);
+            if (!isValid) {
+                console.warn('Signature validation failed');
+            }
+            return isValid;
+        }
+        catch (error) {
+            console.error('Signature validation error:', error);
+            // Try ECDSA as fallback
+            return this.validateSignatureECDSA(data, signature);
+        }
+    }
+    /**
+     * Fallback signature validation using ECDSA
+     */
+    async validateSignatureECDSA(data, signature) {
+        var _a;
+        const publicKeyPem = ((_a = this.config.liveUpdate) === null || _a === void 0 ? void 0 : _a.publicKey) ||
+            this.config.publicKey;
+        if (!publicKeyPem) {
+            return true;
+        }
+        try {
+            let dataBuffer;
+            if (typeof data === 'string') {
+                dataBuffer = new TextEncoder().encode(data).buffer;
+            }
+            else {
+                dataBuffer = data;
+            }
+            const signatureBuffer = Uint8Array.from(atob(signature), c => c.charCodeAt(0));
+            const publicKey = await this.importPublicKeyECDSA(publicKeyPem);
+            const isValid = await crypto.subtle.verify({
+                name: 'ECDSA',
+                hash: 'SHA-256',
+            }, publicKey, signatureBuffer, dataBuffer);
+            return isValid;
+        }
+        catch (error) {
+            console.error('ECDSA signature validation error:', error);
+            return false;
+        }
+    }
+    /**
+     * Import RSA public key from PEM format
+     */
+    async importPublicKey(pem) {
+        // Remove PEM headers and decode
+        const pemContents = pem
+            .replace(/-----BEGIN PUBLIC KEY-----/, '')
+            .replace(/-----END PUBLIC KEY-----/, '')
+            .replace(/\s/g, '');
+        const binaryDer = Uint8Array.from(atob(pemContents), c => c.charCodeAt(0));
+        return crypto.subtle.importKey('spki', binaryDer, {
+            name: 'RSA-PSS',
+            hash: 'SHA-256',
+        }, false, ['verify']);
     }
-    async validateSignature(_data, _signature) {
-        // In a real implementation, would verify signature
-        // console.log('Web: Validating signature...', signature);
-        return true;
+    /**
+     * Import ECDSA public key from PEM format
+     */
+    async importPublicKeyECDSA(pem) {
+        const pemContents = pem
+            .replace(/-----BEGIN PUBLIC KEY-----/, '')
+            .replace(/-----END PUBLIC KEY-----/, '')
+            .replace(/\s/g, '');
+        const binaryDer = Uint8Array.from(atob(pemContents), c => c.charCodeAt(0));
+        return crypto.subtle.importKey('spki', binaryDer, {
+            name: 'ECDSA',
+            namedCurve: 'P-256',
+        }, false, ['verify']);
     }
     loadStoredData() {
         // Load configuration
@@ -589,6 +846,43 @@ export class NativeUpdateWeb extends WebPlugin {
         this.launchCount++;
         localStorage.setItem('native-update-launch-count', this.launchCount.toString());
     }
+    /**
+     * Get configured review URL from plugin config
+     * Returns Play Store, App Store, or custom web review URL based on platform/config
+     */
+    getConfiguredReviewUrl() {
+        var _a;
+        // Check for platform-specific store URLs from config
+        const storeUrls = (_a = this.config.appUpdate) === null || _a === void 0 ? void 0 : _a.storeUrl;
+        // Try to get iOS App Store URL
+        if (storeUrls === null || storeUrls === void 0 ? void 0 : storeUrls.ios) {
+            return storeUrls.ios;
+        }
+        // Try to get Android Play Store URL
+        if (storeUrls === null || storeUrls === void 0 ? void 0 : storeUrls.android) {
+            return storeUrls.android;
+        }
+        // Try custom web review URL from config (may be in extended config)
+        const extendedConfig = this.config;
+        const appReviewConfig = this.config.appReview;
+        if (appReviewConfig === null || appReviewConfig === void 0 ? void 0 : appReviewConfig.webReviewUrl) {
+            return appReviewConfig.webReviewUrl;
+        }
+        // Try to construct URL from app store IDs
+        const appStoreId = extendedConfig.appStoreId;
+        if (appStoreId) {
+            return `https://apps.apple.com/app/id${appStoreId}?action=write-review`;
+        }
+        // Check for package name for Play Store
+        const packageName = extendedConfig.packageName;
+        if (packageName) {
+            return `https://play.google.com/store/apps/details?id=${packageName}&showAllReviews=true`;
+        }
+        // No review URL configured - return null to indicate review not available
+        console.warn('No review URL configured. Set appUpdate.storeUrl.ios, appUpdate.storeUrl.android, ' +
+            'appReview.webReviewUrl, appStoreId, or packageName in plugin config.');
+        return null;
+    }
 }
 // Alias for backward compatibility with tests
 // Already exported above