pakstr 0.7.0 → 0.8.0

package/android-template/app/build.gradle.kts

@@ -1,5 +1,4 @@
 import org.jetbrains.kotlin.gradle.tasks.KotlinCompile
-import java.util.Properties
 import java.io.File
 
 plugins {
@@ -7,49 +6,32 @@ plugins {
     alias(libs.plugins.kotlin.compose)
 }
 
-val keystoreProperties =
-
-    Properties()
-
-val keystorePath =
-    providers.gradleProperty(
-        "releaseKeystoreConfig"
-    ).orNull
-
-val keystorePropertiesFile =
-    keystorePath?.let { rootProject.file(it) }
-if (keystorePropertiesFile?.exists() == true) {
-
-    keystorePropertiesFile.inputStream()
-        .use {
-            keystoreProperties.load(it)
-        }
+val releaseRequested = gradle.startParameter.taskNames.any {
+    it.contains("release", ignoreCase = true)
 }
 
+fun requireReleaseSigningValue(name: String): String =
+    System.getenv(name)
+        ?.takeIf { it.isNotEmpty() }
+        ?: throw GradleException("Missing required release signing environment variable: $name")
+
 android {
     namespace = "com.pakstr.app"
     compileSdk = 36
 
     signingConfigs {
-
         create("release") {
-
-            if (keystorePropertiesFile?.exists() == true) {
-
-                storeFile =
-                    File(
-                        keystorePropertiesFile.parentFile,
-                        keystoreProperties["storeFile"] as String
-                    )
-
-                storePassword =
-                    keystoreProperties["storePassword"] as String
-
-                keyAlias =
-                    keystoreProperties["keyAlias"] as String
-
-                keyPassword =
-                    keystoreProperties["keyPassword"] as String
+            if (releaseRequested) {
+                val keystorePath = requireReleaseSigningValue("PAKSTR_ANDROID_KEYSTORE_PATH")
+                val keystoreFile = File(keystorePath)
+                if (!keystoreFile.isFile) {
+                    throw GradleException("Release signing keystore path is not a file")
+                }
+
+                storeFile = keystoreFile
+                storePassword = requireReleaseSigningValue("PAKSTR_ANDROID_KEYSTORE_PASSWORD")
+                keyAlias = requireReleaseSigningValue("PAKSTR_ANDROID_KEY_ALIAS")
+                keyPassword = requireReleaseSigningValue("PAKSTR_ANDROID_KEY_PASSWORD")
             }
         }
     }
@@ -65,25 +47,22 @@ android {
     }
 
     buildTypes {
-
         debug {
             applicationIdSuffix = ".debug"
             versionNameSuffix = "-debug"
         }
 
         release {
-            signingConfig =
-                signingConfigs.getByName("release")
+            signingConfig = signingConfigs.getByName("release")
             isMinifyEnabled = true
             isShrinkResources = true
             proguardFiles(
-                getDefaultProguardFile(
-                    "proguard-android-optimize.txt"
-                ),
+                getDefaultProguardFile("proguard-android-optimize.txt"),
                 "proguard-rules.pro"
             )
         }
     }
+
     compileOptions {
         sourceCompatibility = JavaVersion.VERSION_17
         targetCompatibility = JavaVersion.VERSION_17
@@ -94,6 +73,7 @@ android {
         buildConfig = true
     }
 }
+
 tasks.withType<KotlinCompile>()
     .configureEach {
         compilerOptions {
@@ -121,9 +101,7 @@ dependencies {
     debugImplementation(libs.androidx.compose.ui.test.manifest)
     implementation(libs.nanohttpd)
     implementation(libs.androidx.appcompat)
-
     implementation(libs.material)
     implementation(libs.androidx.core.splashscreen)
-
     implementation("org.bouncycastle:bcprov-jdk18on:1.78.1")
-}
+}

package/android-template/gradle.properties

@@ -12,5 +12,4 @@ org.gradle.jvmargs=-Xmx2048m -Dfile.encoding=UTF-8
 # https://developer.android.com/r/tools/gradle-multi-project-decoupled-projects
 # org.gradle.parallel=true
 # Kotlin code style for this project: "official" or "obsolete":
-kotlin.code.style=official
-releaseKeystoreConfig=../../../keystore.properties
+kotlin.code.style=official

package/dist/android/releaseVerification.js

@@ -0,0 +1,83 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyReleaseApk = verifyReleaseApk;
+exports.parseApkSignerFingerprints = parseApkSignerFingerprints;
+exports.parseKeystoreFingerprints = parseKeystoreFingerprints;
+const crypto_1 = require("crypto");
+const releaseSigning_1 = require("../core/releaseSigning");
+function verifyReleaseApk(input) {
+    const signerResult = input.executor.run("apksigner", [
+        "verify",
+        "--print-certs",
+        input.artifactPath,
+    ]);
+    const signerFingerprints = parseApkSignerFingerprints(signerResult.stdout);
+    if (signerFingerprints.length !== 1) {
+        throw new Error(`Release APK must have exactly one current signer; found ${signerFingerprints.length}`);
+    }
+    const keytoolEnv = {
+        [releaseSigning_1.PUBLIC_SIGNING_ENV.keystorePassword]: input.signing.storePassword,
+    };
+    const keytoolResult = input.executor.run("keytool", [
+        "-list",
+        "-rfc",
+        "-keystore",
+        input.toolKeystorePath ?? input.signing.keystorePath,
+        `-storepass:env`,
+        releaseSigning_1.PUBLIC_SIGNING_ENV.keystorePassword,
+    ], keytoolEnv);
+    const keystoreFingerprints = parseKeystoreFingerprints(keytoolResult.stdout);
+    const signerFingerprint = signerFingerprints[0];
+    const matchingEntries = keystoreFingerprints.filter(fingerprint => fingerprint === signerFingerprint);
+    if (matchingEntries.length !== 1) {
+        throw new Error(`Release APK signer must match exactly one certificate in the supplied keystore; found ${matchingEntries.length}`);
+    }
+    const identityResult = input.executor.run("apkanalyzer", [
+        "manifest",
+        "application-id",
+        input.artifactPath,
+    ]);
+    const applicationIds = identityResult.stdout
+        .split(/\r?\n/)
+        .map(value => value.trim())
+        .filter(Boolean);
+    if (applicationIds.length !== 1) {
+        throw new Error("Unable to derive one unambiguous Application ID from release APK");
+    }
+    const actualApplicationId = applicationIds[0];
+    if (actualApplicationId !== input.expectedApplicationId) {
+        throw new Error(`Release APK Application ID mismatch: expected ${input.expectedApplicationId}, received ${actualApplicationId}`);
+    }
+    return {
+        signatureVerified: true,
+        signerMatched: true,
+        expectedApplicationId: input.expectedApplicationId,
+        actualApplicationId,
+        tools: {
+            signature: "apksigner",
+            signer: "keytool",
+            identity: "apkanalyzer",
+        },
+    };
+}
+function parseApkSignerFingerprints(output) {
+    const fingerprints = output
+        .split(/\r?\n/)
+        .map(line => line.match(/Signer #\d+ certificate SHA-256 digest:\s*([0-9a-fA-F]+)/)?.[1])
+        .filter((value) => value !== undefined)
+        .map(normalizeFingerprint);
+    return [...new Set(fingerprints)];
+}
+function parseKeystoreFingerprints(output) {
+    const certificates = output.match(/-----BEGIN CERTIFICATE-----[\s\S]+?-----END CERTIFICATE-----/g);
+    if (!certificates?.length) {
+        throw new Error("No certificate-bearing entries found in supplied keystore");
+    }
+    return certificates.map(pem => {
+        const certificate = new crypto_1.X509Certificate(pem);
+        return (0, crypto_1.createHash)("sha256").update(certificate.raw).digest("hex");
+    });
+}
+function normalizeFingerprint(value) {
+    return value.replace(/[^0-9a-fA-F]/g, "").toLowerCase();
+}

package/dist/android/releaseWorkspace.js

@@ -0,0 +1,44 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createReleaseWorkspace = createReleaseWorkspace;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const template_1 = require("./template");
+function createReleaseWorkspace(templateRoot) {
+    const workspaceRoot = path_1.default.join((0, template_1.getCacheDir)(), "workspaces");
+    fs_1.default.mkdirSync(workspaceRoot, { recursive: true, mode: 0o700 });
+    const workspaceParent = fs_1.default.mkdtempSync(path_1.default.join(workspaceRoot, "pakstr-release-workspace-"));
+    const androidRoot = path_1.default.join(workspaceParent, "android");
+    let cleaned = false;
+    try {
+        fs_1.default.chmodSync(workspaceParent, 0o700);
+        fs_1.default.cpSync(templateRoot, androidRoot, { recursive: true });
+        const gradlewPath = path_1.default.join(androidRoot, "gradlew");
+        if (fs_1.default.existsSync(gradlewPath)) {
+            fs_1.default.chmodSync(gradlewPath, 0o755);
+        }
+    }
+    catch (error) {
+        fs_1.default.rmSync(workspaceParent, { recursive: true, force: true });
+        throw error;
+    }
+    return {
+        androidRoot,
+        cleanup() {
+            if (cleaned)
+                return;
+            fs_1.default.rmSync(workspaceParent, {
+                recursive: true,
+                force: true,
+                maxRetries: 2,
+            });
+            if (fs_1.default.existsSync(workspaceParent)) {
+                throw new Error(`Failed to remove temporary release workspace: ${workspaceParent}`);
+            }
+            cleaned = true;
+        },
+    };
+}

package/dist/android/template.js

@@ -3,6 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.getCacheDir = getCacheDir;
 exports.ensureTemplate = ensureTemplate;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
@@ -54,10 +55,14 @@ function fixGradlewPermissions(root) {
 // -----------------------------
 function createLocalProperties(root) {
     const sdkPath = process.env.ANDROID_HOME ??
+        process.env.ANDROID_SDK_ROOT ??
         path_1.default.join(os_1.default.homedir(), "Library", "Android", "sdk");
-    const content = `sdk.dir=${sdkPath}\n`;
     const file = path_1.default.join(root, "local.properties");
-    fs_1.default.writeFileSync(file, content);
+    if (!fs_1.default.existsSync(sdkPath)) {
+        fs_1.default.rmSync(file, { force: true });
+        return;
+    }
+    fs_1.default.writeFileSync(file, `sdk.dir=${sdkPath}\n`);
     console.log("📍 local.properties created:", sdkPath);
 }
 async function ensureTemplate() {

package/dist/commands/build.js

@@ -8,140 +8,177 @@ const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const child_process_1 = require("child_process");
 const gradle_1 = require("../android/gradle");
-const validateProject_1 = require("../core/validateProject");
-const buildContext_1 = require("../core/buildContext");
-const template_1 = require("../android/template");
-const createRunner_1 = require("../runners/createRunner");
-const config_1 = require("../core/config");
 const branding_1 = require("../android/branding");
-const version_1 = require("../android/version");
 const icon_1 = require("../android/icon");
-const splash_1 = require("../android/splash");
 const permissions_1 = require("../android/permissions");
+const releaseWorkspace_1 = require("../android/releaseWorkspace");
+const splash_1 = require("../android/splash");
+const template_1 = require("../android/template");
+const version_1 = require("../android/version");
+const buildContext_1 = require("../core/buildContext");
+const config_1 = require("../core/config");
+const releaseSigning_1 = require("../core/releaseSigning");
+const validateProject_1 = require("../core/validateProject");
+const createRunner_1 = require("../runners/createRunner");
 const runtimeConfig_1 = require("../runtime/runtimeConfig");
 async function buildCommand(args) {
     const ctx = (0, buildContext_1.createBuildContext)(args);
     const config = (0, config_1.loadConfig)(process.cwd());
     const manifest = ctx.manifest;
-    console.log("📄 Manifest loaded");
-    const distPath = ctx.dist;
-    const androidRoot = await (0, template_1.ensureTemplate)();
     const mode = ctx.mode;
-    const apkOutput = ctx.out;
-    const assetsTarget = path_1.default.join(androidRoot, "app/src/main/assets/www");
     const appName = manifest?.app?.name || manifest?.appName || "Pakstr App";
+    const finalPath = path_1.default.resolve(ctx.out);
     console.log("\n🚀 Pakstr CLI");
     console.log("📦 App:", appName);
-    console.log("🌐 Web:", distPath);
-    console.log("📱 Out:", apkOutput);
-    console.log("📱 Android:", androidRoot);
+    console.log("🌐 Web:", ctx.dist);
+    console.log("📱 Out:", finalPath);
     console.log("🏗️ Builder:", config.builder);
     console.log("🚀 BUILD MODE:", mode.toUpperCase());
-    // -----------------------------
-    // 1. VALIDATE PROJECT
-    // -----------------------------
-    (0, validateProject_1.validateProject)(distPath, manifest);
+    (0, validateProject_1.validateProject)(ctx.dist, manifest);
+    validateOutputParent(finalPath);
+    if (mode === "release") {
+        removeExistingOutput(finalPath);
+    }
+    const signingInput = mode === "release" ? (0, releaseSigning_1.readReleaseSigningInput)() : undefined;
+    const templateRoot = await (0, template_1.ensureTemplate)();
+    let workspace;
+    let signing;
+    let stagedPath;
+    let primaryError;
+    let cleanupError;
+    try {
+        const androidRoot = mode === "release"
+            ? (workspace = (0, releaseWorkspace_1.createReleaseWorkspace)(templateRoot)).androidRoot
+            : templateRoot;
+        console.log("📱 Android:", androidRoot);
+        await prepareAndroidProject(androidRoot, ctx.dist, manifest, appName);
+        if (signingInput) {
+            signing = (0, releaseSigning_1.createReleaseSigningContext)(signingInput);
+            signingInput.keystoreBase64 = "";
+        }
+        console.log("\n⚙️ Running build runner...");
+        const result = await (0, createRunner_1.createRunner)(config).build({
+            androidRoot,
+            mode,
+            expectedApplicationId: manifest.appId,
+            signing,
+        });
+        if (mode === "release" && !result.verification) {
+            throw new Error("Release runner returned no verification evidence");
+        }
+        stagedPath = stageArtifact(result.artifactPath, finalPath);
+    }
+    catch (error) {
+        primaryError = error;
+    }
+    try {
+        signing?.cleanup();
+    }
+    catch (error) {
+        cleanupError = error;
+    }
+    try {
+        workspace?.cleanup();
+    }
+    catch (error) {
+        cleanupError ??= error;
+    }
+    if (primaryError || cleanupError) {
+        removeStagedArtifact(stagedPath);
+        removeExistingOutput(finalPath);
+        if (primaryError) {
+            if (cleanupError) {
+                console.error("Cleanup also failed:", safeErrorMessage(cleanupError));
+            }
+            throw primaryError;
+        }
+        throw cleanupError;
+    }
+    if (!stagedPath) {
+        throw new Error("Build completed without a staged APK");
+    }
+    publishArtifact(stagedPath, finalPath);
+    console.log("\n🚀 BUILD COMPLETE");
+    console.log("App:", appName);
+    console.log("Mode:", mode.toUpperCase());
+    console.log("📦 Output:", finalPath);
+    openFolder(finalPath);
+}
+async function prepareAndroidProject(androidRoot, distPath, manifest, appName) {
+    const assetsTarget = path_1.default.join(androidRoot, "app/src/main/assets/www");
     if (!fs_1.default.existsSync(distPath)) {
-        throw new Error("❌ Web assets not found");
-    }
-    // -----------------------------
-    // 2. COPY WEB → ANDROID ASSETS
-    // -----------------------------
-    console.log("\n📦 Copying web → Android assets...");
-    fs_1.default.rmSync(assetsTarget, {
-        recursive: true,
-        force: true,
-    });
-    fs_1.default.mkdirSync(assetsTarget, {
-        recursive: true,
-    });
+        throw new Error("Web assets not found");
+    }
+    fs_1.default.rmSync(assetsTarget, { recursive: true, force: true });
+    fs_1.default.mkdirSync(assetsTarget, { recursive: true });
     copyFolder(distPath, assetsTarget);
-    console.log("📦 Web assets copied successfully");
     (0, runtimeConfig_1.generateRuntimeConfig)(assetsTarget, manifest);
-    console.log("runtime files:", fs_1.default.readdirSync(assetsTarget)
-        .filter(f => f.includes("pakstr")));
-    console.log(fs_1.default.existsSync(path_1.default.join(assetsTarget, "pakstr-runtime.json")));
-    console.log(fs_1.default.readdirSync(assetsTarget));
-    // -----------------------------
-    // 3. PATCH ANDROID PROJECT
-    // -----------------------------
     (0, gradle_1.patchGradle)(androidRoot, manifest);
-    console.log("⚙️ Gradle patched");
-    // -----------------------------
-    // 3.1 PATCH BRANDING
-    // -----------------------------
     (0, branding_1.patchAppName)(androidRoot, appName);
     (0, branding_1.patchPackageName)(androidRoot, manifest.appId);
     (0, version_1.patchVersion)(androidRoot, manifest.versionCode, manifest.versionName);
-    const iconPath = manifest.ui?.icon;
-    if (iconPath) {
-        await (0, icon_1.patchIcon)(androidRoot, iconPath, manifest.backgroundColor ?? "#FFFFFF");
+    if (manifest.ui?.icon) {
+        await (0, icon_1.patchIcon)(androidRoot, manifest.ui.icon, manifest.backgroundColor ?? "#FFFFFF");
     }
-    const splash = manifest.ui?.splash;
-    if (splash) {
-        console.log("SPLASH IMAGE:", splash.image);
-        console.log("SPLASH BACKGROUND:", splash.background);
-        await (0, splash_1.patchSplash)(androidRoot, splash.image, splash.background ?? "#FFFFFF");
+    if (manifest.ui?.splash) {
+        await (0, splash_1.patchSplash)(androidRoot, manifest.ui.splash.image, manifest.ui.splash.background ?? "#FFFFFF");
     }
     (0, permissions_1.patchPermissions)(androidRoot, manifest);
-    // -----------------------------
-    // 4. RUN BUILD RUNNER
-    // -----------------------------
-    let apkPath;
-    try {
-        console.log("\n⚙️ Running build runner...");
-        const runner = (0, createRunner_1.createRunner)(config);
-        apkPath = await runner.build(androidRoot, mode);
-        console.log("✅ APK build successful");
-        console.log("\n📦 APK GENERATED:");
-        console.log(apkPath);
-    }
-    catch (err) {
-        console.error("❌ Build failed");
-        console.error(err);
-        throw err;
-    }
-    // -----------------------------
-    // 5. COPY APK TO OUTPUT
-    // -----------------------------
-    const finalPath = path_1.default.resolve(apkOutput);
-    fs_1.default.mkdirSync(path_1.default.dirname(finalPath), {
-        recursive: true,
-    });
+}
+function validateOutputParent(finalPath) {
+    const parent = path_1.default.dirname(finalPath);
+    if (!fs_1.default.existsSync(parent) || !fs_1.default.lstatSync(parent).isDirectory()) {
+        throw new Error(`Output directory must already exist: ${parent}`);
+    }
+    if (fs_1.default.lstatSync(parent).isSymbolicLink()) {
+        throw new Error(`Output directory must not be a symbolic link: ${parent}`);
+    }
     if (fs_1.default.existsSync(finalPath)) {
         const stat = fs_1.default.lstatSync(finalPath);
-        if (stat.isDirectory()) {
-            fs_1.default.rmSync(finalPath, {
-                recursive: true,
-                force: true,
-            });
+        if (!stat.isFile() || stat.isSymbolicLink()) {
+            throw new Error(`Output path must be a regular file: ${finalPath}`);
         }
     }
-    fs_1.default.copyFileSync(apkPath, finalPath);
-    console.log("\n📦 CLEAN OUTPUT:");
-    console.log(finalPath);
-    openFolder(finalPath);
-    // -----------------------------
-    // 6. FINAL OUTPUT
-    // -----------------------------
-    console.log("\n🚀 BUILD COMPLETE");
-    console.log("App:", appName);
-    console.log("Mode:", mode.toUpperCase());
 }
-// -----------------------------
-// COPY FOLDER
-// -----------------------------
+function stageArtifact(artifactPath, finalPath) {
+    const parent = path_1.default.dirname(finalPath);
+    const stageDir = fs_1.default.mkdtempSync(path_1.default.join(parent, ".pakstr-stage-"));
+    const stagedPath = path_1.default.join(stageDir, "app.apk");
+    fs_1.default.copyFileSync(artifactPath, stagedPath, fs_1.default.constants.COPYFILE_EXCL);
+    if (fs_1.default.statSync(stagedPath).size !== fs_1.default.statSync(artifactPath).size) {
+        fs_1.default.rmSync(stageDir, { recursive: true, force: true });
+        throw new Error("Staged APK size does not match verified artifact");
+    }
+    return stagedPath;
+}
+function publishArtifact(stagedPath, finalPath) {
+    removeExistingOutput(finalPath);
+    fs_1.default.renameSync(stagedPath, finalPath);
+    fs_1.default.rmSync(path_1.default.dirname(stagedPath), { recursive: true, force: true });
+    if (!fs_1.default.existsSync(finalPath) || !fs_1.default.lstatSync(finalPath).isFile()) {
+        throw new Error("Final APK publication failed");
+    }
+}
+function removeExistingOutput(finalPath) {
+    if (!fs_1.default.existsSync(finalPath))
+        return;
+    const stat = fs_1.default.lstatSync(finalPath);
+    if (!stat.isFile() || stat.isSymbolicLink()) {
+        throw new Error(`Refusing to remove non-regular output path: ${finalPath}`);
+    }
+    fs_1.default.unlinkSync(finalPath);
+}
+function removeStagedArtifact(stagedPath) {
+    if (!stagedPath)
+        return;
+    fs_1.default.rmSync(path_1.default.dirname(stagedPath), { recursive: true, force: true });
+}
 function copyFolder(src, dest) {
-    const entries = fs_1.default.readdirSync(src, {
-        withFileTypes: true,
-    });
-    for (const entry of entries) {
+    for (const entry of fs_1.default.readdirSync(src, { withFileTypes: true })) {
         const srcPath = path_1.default.join(src, entry.name);
         const destPath = path_1.default.join(dest, entry.name);
         if (entry.isDirectory()) {
-            fs_1.default.mkdirSync(destPath, {
-                recursive: true,
-            });
+            fs_1.default.mkdirSync(destPath, { recursive: true });
             copyFolder(srcPath, destPath);
         }
         else {
@@ -149,17 +186,16 @@ function copyFolder(src, dest) {
         }
     }
 }
-// -----------------------------
-// OPEN FOLDER (macOS)
-// -----------------------------
 function openFolder(filePath) {
-    if (process.platform !== "darwin") {
+    if (process.platform !== "darwin" || process.env.CI)
         return;
-    }
     try {
-        (0, child_process_1.execSync)(`open "${path_1.default.dirname(filePath)}"`);
+        (0, child_process_1.execFileSync)("open", [path_1.default.dirname(filePath)], { stdio: "ignore" });
     }
     catch {
-        // ignore
+        // Opening the output folder is optional.
     }
 }
+function safeErrorMessage(error) {
+    return error instanceof Error ? error.message : "unknown cleanup error";
+}

package/dist/core/manifest.js

@@ -16,6 +16,16 @@ function loadManifest(path) {
 function validateManifest(m) {
     if (!m.appId)
         throw new Error("❌ appId is required");
+    const appIdPattern = /^[a-z][a-z0-9_]*(\.[a-z][a-z0-9_]*)+$/;
+    if (m.appId.length < 3 ||
+        m.appId.length > 255 ||
+        !appIdPattern.test(m.appId)) {
+        throw new Error("❌ appId must be a lowercase reverse-domain Android Application ID");
+    }
+    const debugAppId = `${m.appId}.debug`;
+    if (debugAppId.length > 255 || !appIdPattern.test(debugAppId)) {
+        throw new Error("❌ appId is too long to derive the debug Application ID");
+    }
     if (!m.appName)
         throw new Error("❌ appName is required");
     if (!m.versionName)

package/dist/core/releaseSigning.js

@@ -0,0 +1,134 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.INTERNAL_KEYSTORE_PATH_ENV = exports.PUBLIC_SIGNING_ENV = void 0;
+exports.readReleaseSigningInput = readReleaseSigningInput;
+exports.createReleaseSigningContext = createReleaseSigningContext;
+exports.removeSigningVariables = removeSigningVariables;
+exports.createGradleSigningEnvironment = createGradleSigningEnvironment;
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+exports.PUBLIC_SIGNING_ENV = {
+    keystoreBase64: "PAKSTR_ANDROID_KEYSTORE_BASE64",
+    keystorePassword: "PAKSTR_ANDROID_KEYSTORE_PASSWORD",
+    keyAlias: "PAKSTR_ANDROID_KEY_ALIAS",
+    keyPassword: "PAKSTR_ANDROID_KEY_PASSWORD",
+};
+exports.INTERNAL_KEYSTORE_PATH_ENV = "PAKSTR_ANDROID_KEYSTORE_PATH";
+const MAX_KEYSTORE_BYTES = 16 * 1024 * 1024;
+const CANONICAL_BASE64 = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/;
+function readReleaseSigningInput(env = process.env) {
+    const keystoreBase64 = requireValue(env, exports.PUBLIC_SIGNING_ENV.keystoreBase64);
+    const storePassword = requireValue(env, exports.PUBLIC_SIGNING_ENV.keystorePassword);
+    const keyAlias = requireValue(env, exports.PUBLIC_SIGNING_ENV.keyAlias);
+    const keyPassword = requireValue(env, exports.PUBLIC_SIGNING_ENV.keyPassword);
+    validateCanonicalBase64(keystoreBase64);
+    return {
+        keystoreBase64,
+        storePassword,
+        keyAlias,
+        keyPassword,
+    };
+}
+function createReleaseSigningContext(input, temporaryRoot = os_1.default.tmpdir()) {
+    let decoded = decodeKeystore(input.keystoreBase64);
+    fs_1.default.mkdirSync(temporaryRoot, { recursive: true, mode: 0o700 });
+    const signingDir = fs_1.default.mkdtempSync(path_1.default.join(temporaryRoot, "pakstr-signing-"));
+    const keystorePath = path_1.default.join(signingDir, "release.keystore");
+    let cleaned = false;
+    try {
+        fs_1.default.chmodSync(signingDir, 0o700);
+        fs_1.default.writeFileSync(keystorePath, decoded, {
+            flag: "wx",
+            mode: 0o600,
+        });
+        verifyProtectedKeystore(signingDir, keystorePath, decoded.length);
+    }
+    catch (error) {
+        fs_1.default.rmSync(signingDir, { recursive: true, force: true });
+        throw error;
+    }
+    finally {
+        decoded.fill(0);
+        decoded = Buffer.alloc(0);
+    }
+    return Object.freeze({
+        keystorePath,
+        storePassword: input.storePassword,
+        keyAlias: input.keyAlias,
+        keyPassword: input.keyPassword,
+        cleanup() {
+            if (cleaned)
+                return;
+            fs_1.default.rmSync(signingDir, { recursive: true, force: true, maxRetries: 2 });
+            if (fs_1.default.existsSync(signingDir)) {
+                throw new Error(`Failed to remove temporary signing directory: ${signingDir}`);
+            }
+            cleaned = true;
+        },
+    });
+}
+function removeSigningVariables(env) {
+    const sanitized = { ...env };
+    delete sanitized[exports.PUBLIC_SIGNING_ENV.keystoreBase64];
+    delete sanitized[exports.PUBLIC_SIGNING_ENV.keystorePassword];
+    delete sanitized[exports.PUBLIC_SIGNING_ENV.keyAlias];
+    delete sanitized[exports.PUBLIC_SIGNING_ENV.keyPassword];
+    delete sanitized[exports.INTERNAL_KEYSTORE_PATH_ENV];
+    return sanitized;
+}
+function createGradleSigningEnvironment(context, env = process.env, keystorePath = context.keystorePath) {
+    return {
+        ...removeSigningVariables(env),
+        [exports.INTERNAL_KEYSTORE_PATH_ENV]: keystorePath,
+        [exports.PUBLIC_SIGNING_ENV.keystorePassword]: context.storePassword,
+        [exports.PUBLIC_SIGNING_ENV.keyAlias]: context.keyAlias,
+        [exports.PUBLIC_SIGNING_ENV.keyPassword]: context.keyPassword,
+    };
+}
+function requireValue(env, name) {
+    const value = env[name];
+    if (value === undefined || value.length === 0) {
+        throw new Error(`${name} is required and must not be empty for release builds`);
+    }
+    return value;
+}
+function validateCanonicalBase64(value) {
+    if (!CANONICAL_BASE64.test(value)) {
+        throw new Error(`${exports.PUBLIC_SIGNING_ENV.keystoreBase64} must be canonical single-line RFC 4648 base64`);
+    }
+    const decodedLength = Buffer.byteLength(value, "base64");
+    if (decodedLength === 0) {
+        throw new Error(`${exports.PUBLIC_SIGNING_ENV.keystoreBase64} decodes to an empty keystore`);
+    }
+    if (decodedLength > MAX_KEYSTORE_BYTES) {
+        throw new Error(`${exports.PUBLIC_SIGNING_ENV.keystoreBase64} exceeds the 16 MiB decoded size limit`);
+    }
+}
+function decodeKeystore(value) {
+    const decoded = Buffer.from(value, "base64");
+    if (decoded.toString("base64") !== value) {
+        decoded.fill(0);
+        throw new Error(`${exports.PUBLIC_SIGNING_ENV.keystoreBase64} is not canonical base64`);
+    }
+    return decoded;
+}
+function verifyProtectedKeystore(signingDir, keystorePath, expectedSize) {
+    const dirStat = fs_1.default.lstatSync(signingDir);
+    const fileStat = fs_1.default.lstatSync(keystorePath);
+    if (!dirStat.isDirectory() || dirStat.isSymbolicLink()) {
+        throw new Error("Temporary signing directory is not a real directory");
+    }
+    if (!fileStat.isFile() || fileStat.isSymbolicLink()) {
+        throw new Error("Temporary keystore is not a regular file");
+    }
+    if ((dirStat.mode & 0o777) !== 0o700 || (fileStat.mode & 0o777) !== 0o600) {
+        throw new Error("Temporary signing storage does not have owner-only permissions");
+    }
+    if (fileStat.size !== expectedSize) {
+        throw new Error("Temporary keystore size does not match decoded input");
+    }
+}

package/dist/runners/DockerGradleRunner.js

@@ -4,57 +4,311 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DockerGradleRunner = void 0;
-const child_process_1 = require("child_process");
-const path_1 = __importDefault(require("path"));
 const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const crypto_1 = require("crypto");
+const releaseVerification_1 = require("../android/releaseVerification");
+const releaseSigning_1 = require("../core/releaseSigning");
+const process_1 = require("./process");
+const CONTAINER_KEYSTORE_PATH = "/run/secrets/pakstr/release.keystore";
+const CONTAINER_RELEASE_APK = "/workspace/app/build/outputs/apk/release/app-release.apk";
+const CONTAINER_DEBUG_APK = "/workspace/app/build/outputs/apk/debug/app-debug.apk";
 class DockerGradleRunner {
     image;
+    execute;
     constructor(image = process.env.PAKSTR_DOCKER_IMAGE ??
-        "git.nostrdev.com/stuff/pakstr/android-builder:latest") {
+        "git.nostrdev.com/stuff/pakstr/android-builder:latest", execute = process_1.runProcess) {
         this.image = image;
+        this.execute = execute;
+    }
+    async build(request) {
+        this.checkDockerAvailable();
+        this.ensureDockerImage();
+        const signing = request.mode === "release" ? requireSigning(request.signing) : undefined;
+        const storage = this.createBuildStorage(request.androidRoot, signing);
+        let primaryError;
+        let result;
+        try {
+            result =
+                request.mode === "release"
+                    ? this.buildRelease(request, signing, storage)
+                    : this.buildDebug(request, storage);
+        }
+        catch (error) {
+            primaryError = error;
+        }
+        let cleanupError;
+        try {
+            this.removeBuildStorage(storage);
+        }
+        catch (error) {
+            cleanupError = error;
+        }
+        if (primaryError) {
+            if (cleanupError) {
+                console.error("Docker signing storage cleanup also failed:", safeErrorMessage(cleanupError));
+            }
+            throw primaryError;
+        }
+        if (cleanupError)
+            throw cleanupError;
+        if (!result)
+            throw new Error("Docker build completed without a result");
+        return result;
+    }
+    buildDebug(request, storage) {
+        this.execute("docker", [
+            "run",
+            "--rm",
+            "-v",
+            `${storage.workspaceVolume}:/workspace`,
+            this.image,
+            "./gradlew",
+            "assembleDebug",
+            "-Dorg.gradle.vfs.watch=false",
+        ], {
+            env: (0, releaseSigning_1.removeSigningVariables)(process.env),
+            streamOutput: true,
+        });
+        const artifactPath = hostArtifactPath(request.androidRoot, "debug");
+        this.copyFromVolume(storage.workspaceVolume, CONTAINER_DEBUG_APK, artifactPath);
+        return { artifactPath: requireApk(artifactPath) };
     }
-    async build(androidRoot, mode) {
-        console.log("🐳 Using Docker Gradle");
-        checkDockerAvailable();
-        ensureDockerImage(this.image);
-        const task = mode === "release" ? "assembleRelease" : "assembleDebug";
-        (0, child_process_1.execSync)(`docker run --rm \
-      --platform linux/amd64 \
-      -v "${androidRoot}:/workspace" \
-      ${this.image} \
-      ./gradlew ${task} -Dorg.gradle.vfs.watch=false`, {
-            stdio: "inherit",
+    buildRelease(request, signing, storage) {
+        if (!storage.signingVolume) {
+            throw new Error("Docker release build requires signing storage");
+        }
+        const secrets = signingSecrets(signing);
+        const dockerEnv = (0, releaseSigning_1.createGradleSigningEnvironment)(signing, process.env, CONTAINER_KEYSTORE_PATH);
+        const environmentNames = [
+            releaseSigning_1.INTERNAL_KEYSTORE_PATH_ENV,
+            releaseSigning_1.PUBLIC_SIGNING_ENV.keystorePassword,
+            releaseSigning_1.PUBLIC_SIGNING_ENV.keyAlias,
+            releaseSigning_1.PUBLIC_SIGNING_ENV.keyPassword,
+        ];
+        this.execute("docker", [
+            "run",
+            "--rm",
+            "-v",
+            `${storage.workspaceVolume}:/workspace`,
+            "-v",
+            `${storage.signingVolume}:/run/secrets/pakstr:ro`,
+            ...environmentNames.flatMap(name => ["--env", name]),
+            this.image,
+            "./gradlew",
+            "assembleRelease",
+            "--no-daemon",
+            "-Dorg.gradle.vfs.watch=false",
+        ], {
+            env: dockerEnv,
+            secrets,
+            streamOutput: true,
+        });
+        const verification = (0, releaseVerification_1.verifyReleaseApk)({
+            artifactPath: CONTAINER_RELEASE_APK,
+            expectedApplicationId: request.expectedApplicationId,
+            signing,
+            toolKeystorePath: CONTAINER_KEYSTORE_PATH,
+            executor: this.createVerificationExecutor(storage, signing),
         });
-        const apkPath = path_1.default.join(androidRoot, "app", "build", "outputs", "apk", mode, mode === "debug" ? "app-debug.apk" : "app-release.apk");
-        if (!fs_1.default.existsSync(apkPath)) {
-            throw new Error(`APK not found: ${apkPath}`);
+        const artifactPath = hostArtifactPath(request.androidRoot, "release");
+        this.copyFromVolume(storage.workspaceVolume, CONTAINER_RELEASE_APK, artifactPath);
+        return { artifactPath: requireApk(artifactPath), verification };
+    }
+    createBuildStorage(androidRoot, signing) {
+        const suffix = (0, crypto_1.randomUUID)();
+        const storage = {
+            workspaceVolume: `pakstr-workspace-${suffix}`,
+            signingVolume: signing ? `pakstr-signing-${suffix}` : undefined,
+        };
+        assertRegularAbsolutePath(androidRoot, "Android workspace");
+        if (signing) {
+            assertRegularAbsolutePath(signing.keystorePath, "Temporary keystore", true);
+        }
+        try {
+            this.execute("docker", ["volume", "create", storage.workspaceVolume]);
+            if (storage.signingVolume) {
+                this.execute("docker", ["volume", "create", storage.signingVolume]);
+            }
+            this.copyDirectoryToVolume(androidRoot, storage.workspaceVolume);
+            if (signing && storage.signingVolume) {
+                this.copyFileToVolume(signing.keystorePath, storage.signingVolume, "/run/secrets/pakstr/release.keystore", signingSecrets(signing));
+            }
+            return storage;
+        }
+        catch (error) {
+            try {
+                this.removeBuildStorage(storage);
+            }
+            catch (cleanupError) {
+                console.error("Docker signing storage cleanup also failed:", safeErrorMessage(cleanupError));
+            }
+            throw error;
+        }
+    }
+    copyDirectoryToVolume(source, volume) {
+        const container = `pakstr-workspace-copy-${(0, crypto_1.randomUUID)()}`;
+        try {
+            this.execute("docker", [
+                "create",
+                "--name",
+                container,
+                "-v",
+                `${volume}:/workspace`,
+                this.image,
+                "true",
+            ]);
+            this.execute("docker", ["cp", `${source}${path_1.default.sep}.`, `${container}:/workspace`]);
+        }
+        finally {
+            this.removeContainer(container);
+        }
+    }
+    copyFileToVolume(source, volume, destination, secrets) {
+        const container = `pakstr-signing-copy-${(0, crypto_1.randomUUID)()}`;
+        try {
+            this.execute("docker", [
+                "create",
+                "--name",
+                container,
+                "-v",
+                `${volume}:/run/secrets/pakstr`,
+                this.image,
+                "true",
+            ]);
+            this.execute("docker", ["cp", "-a", source, `${container}:${destination}`], {
+                secrets,
+            });
+        }
+        finally {
+            this.removeContainer(container);
+        }
+    }
+    copyFromVolume(volume, source, destination) {
+        const container = `pakstr-output-copy-${(0, crypto_1.randomUUID)()}`;
+        fs_1.default.mkdirSync(path_1.default.dirname(destination), { recursive: true });
+        fs_1.default.rmSync(destination, { force: true });
+        try {
+            this.execute("docker", [
+                "create",
+                "--name",
+                container,
+                "-v",
+                `${volume}:/workspace:ro`,
+                this.image,
+                "true",
+            ]);
+            this.execute("docker", ["cp", `${container}:${source}`, destination]);
+        }
+        finally {
+            this.removeContainer(container);
+        }
+    }
+    createVerificationExecutor(storage, signing) {
+        const secrets = signingSecrets(signing);
+        return {
+            run: (tool, args, env = {}) => {
+                const volumeArgs = ["-v", `${storage.workspaceVolume}:/workspace:ro`];
+                if (tool === "keytool") {
+                    if (!storage.signingVolume) {
+                        throw new Error("Signer verification requires Docker signing storage");
+                    }
+                    volumeArgs.push("-v", `${storage.signingVolume}:/run/secrets/pakstr:ro`);
+                }
+                return this.execute("docker", [
+                    "run",
+                    "--rm",
+                    ...volumeArgs,
+                    ...Object.keys(env).flatMap(name => ["--env", name]),
+                    this.image,
+                    tool,
+                    ...args,
+                ], { env: { ...(0, releaseSigning_1.removeSigningVariables)(process.env), ...env }, secrets });
+            },
+        };
+    }
+    removeBuildStorage(storage) {
+        const failures = [];
+        for (const volume of [storage.signingVolume, storage.workspaceVolume]) {
+            if (!volume)
+                continue;
+            try {
+                this.execute("docker", ["volume", "rm", "--force", volume]);
+            }
+            catch {
+                failures.push(volume);
+            }
+        }
+        if (failures.length) {
+            throw new Error(`Failed to remove temporary Docker volume(s): ${failures.join(", ")}`);
+        }
+    }
+    removeContainer(container) {
+        try {
+            this.execute("docker", ["rm", "--force", container]);
+        }
+        catch {
+            // A failed docker create leaves no container to remove.
+        }
+    }
+    checkDockerAvailable() {
+        try {
+            this.execute("docker", ["--version"]);
+        }
+        catch {
+            throw new Error("Docker is not installed or not running. Please install Docker Desktop first.");
+        }
+    }
+    ensureDockerImage() {
+        try {
+            this.execute("docker", ["image", "inspect", this.image]);
+            console.log(`🐳 Docker image ready: ${this.image}`);
+        }
+        catch {
+            console.log(`⬇️ Pulling Docker image: ${this.image}`);
+            this.execute("docker", ["pull", this.image], { streamOutput: true });
         }
-        return apkPath;
     }
 }
 exports.DockerGradleRunner = DockerGradleRunner;
-function checkDockerAvailable() {
-    try {
-        (0, child_process_1.execSync)("docker --version", {
-            stdio: "ignore",
-        });
+function hostArtifactPath(androidRoot, mode) {
+    return path_1.default.join(androidRoot, "app", "build", "outputs", "apk", mode, `app-${mode}.apk`);
+}
+function requireApk(artifactPath) {
+    if (!fs_1.default.existsSync(artifactPath) || !fs_1.default.lstatSync(artifactPath).isFile()) {
+        throw new Error(`APK not found after Docker build: ${artifactPath}`);
     }
-    catch (err) {
-        throw new Error("🐳 Docker is not installed or not running. Please install Docker Desktop first.");
+    return artifactPath;
+}
+function requireSigning(signing) {
+    if (!signing) {
+        throw new Error("Release build requires an internal signing context");
     }
+    return signing;
 }
-function ensureDockerImage(image) {
-    try {
-        (0, child_process_1.execSync)(`docker image inspect ${image}`, {
-            stdio: "ignore",
-        });
-        console.log(`🐳 Docker image ready: ${image}`);
+function signingSecrets(signing) {
+    return [
+        signing.storePassword,
+        signing.keyAlias,
+        signing.keyPassword,
+        signing.keystorePath,
+    ];
+}
+function assertRegularAbsolutePath(candidate, label, requireFile = false) {
+    if (!path_1.default.isAbsolute(candidate)) {
+        throw new Error(`${label} path must be absolute`);
     }
-    catch {
-        console.log(`📦 Docker image missing: ${image}`);
-        console.log(`⬇️ Pulling ${image}...`);
-        (0, child_process_1.execSync)(`docker pull ${image}`, {
-            stdio: "inherit",
-        });
+    if (!fs_1.default.existsSync(candidate)) {
+        throw new Error(`${label} path does not exist`);
+    }
+    const stat = fs_1.default.lstatSync(candidate);
+    if (stat.isSymbolicLink()) {
+        throw new Error(`${label} path must not be a symbolic link`);
     }
+    if (requireFile ? !stat.isFile() : !stat.isDirectory()) {
+        throw new Error(`${label} path has an unexpected filesystem type`);
+    }
+}
+function safeErrorMessage(error) {
+    return error instanceof Error ? error.message : "unknown Docker cleanup error";
 }

package/dist/runners/LocalGradleRunner.js

@@ -4,47 +4,108 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.LocalGradleRunner = void 0;
-const child_process_1 = require("child_process");
-const path_1 = __importDefault(require("path"));
 const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const releaseVerification_1 = require("../android/releaseVerification");
+const releaseSigning_1 = require("../core/releaseSigning");
+const process_1 = require("./process");
 class LocalGradleRunner {
-    async build(androidRoot, mode) {
-        const gradleTask = mode === "release" ? "assembleRelease" : "assembleDebug";
+    async build(request) {
+        const { androidRoot, mode } = request;
+        const gradlewPath = path_1.default.join(androidRoot, "gradlew");
+        if (!fs_1.default.existsSync(gradlewPath)) {
+            throw new Error("gradlew not found in Android project root");
+        }
         console.log("⚙️ Local Gradle build");
         console.log("📂 Android:", androidRoot);
-        const gradlewFile = path_1.default.join(androidRoot, "gradlew");
-        if (!fsExists(gradlewFile)) {
-            throw new Error("❌ gradlew not found in Android project root");
+        if (mode === "debug") {
+            (0, process_1.runProcess)(gradlewPath, ["assembleDebug"], {
+                cwd: androidRoot,
+                env: (0, releaseSigning_1.removeSigningVariables)(process.env),
+                streamOutput: true,
+            });
+            return { artifactPath: requireApk(androidRoot, "debug") };
         }
-        const gradlewPath = "./gradlew";
-        console.log("📍 Using:", gradlewPath);
-        (0, child_process_1.execSync)(`bash "${gradlewPath}" ${gradleTask}`, {
+        const signing = requireSigning(request.signing);
+        const secrets = signingSecrets(signing);
+        const gradleEnv = (0, releaseSigning_1.createGradleSigningEnvironment)(signing);
+        (0, process_1.runProcess)(gradlewPath, ["assembleRelease", "--no-daemon"], {
             cwd: androidRoot,
-            stdio: "inherit",
+            env: gradleEnv,
+            secrets,
+            streamOutput: true,
         });
-        const apkPath = findApk(androidRoot, mode);
-        if (!apkPath) {
-            throw new Error("❌ APK not found after Gradle build");
-        }
-        console.log("✅ APK created:", apkPath);
-        return apkPath;
+        const artifactPath = requireApk(androidRoot, "release");
+        const executor = createLocalVerificationExecutor(signing);
+        const verification = (0, releaseVerification_1.verifyReleaseApk)({
+            artifactPath,
+            expectedApplicationId: request.expectedApplicationId,
+            signing,
+            executor,
+        });
+        return { artifactPath, verification };
     }
 }
 exports.LocalGradleRunner = LocalGradleRunner;
-function findApk(androidRoot, mode) {
-    const apkDir = path_1.default.join(androidRoot, "app", "build", "outputs", "apk", mode);
-    if (!fs_1.default.existsSync(apkDir)) {
-        return null;
+function createLocalVerificationExecutor(signing) {
+    const androidHome = process.env.ANDROID_HOME ??
+        process.env.ANDROID_SDK_ROOT ??
+        path_1.default.join(os_1.default.homedir(), "Library", "Android", "sdk");
+    const secrets = signingSecrets(signing);
+    return {
+        run(tool, args, env = {}) {
+            const command = resolveTool(tool, androidHome);
+            return (0, process_1.runProcess)(command, args, {
+                env: { ...process.env, ...env },
+                secrets,
+            });
+        },
+    };
+}
+function resolveTool(tool, androidHome) {
+    if (tool === "keytool")
+        return "keytool";
+    if (tool === "apkanalyzer") {
+        const analyzer = path_1.default.join(androidHome, "cmdline-tools", "latest", "bin", "apkanalyzer");
+        if (!fs_1.default.existsSync(analyzer)) {
+            throw new Error(`Required Android verification tool not found: ${analyzer}`);
+        }
+        return analyzer;
+    }
+    const buildToolsDir = path_1.default.join(androidHome, "build-tools");
+    if (!fs_1.default.existsSync(buildToolsDir)) {
+        throw new Error(`Android build-tools directory not found: ${buildToolsDir}`);
+    }
+    const versions = fs_1.default
+        .readdirSync(buildToolsDir)
+        .sort((a, b) => b.localeCompare(a, undefined, { numeric: true }));
+    const signer = versions
+        .map(version => path_1.default.join(buildToolsDir, version, "apksigner"))
+        .find(candidate => fs_1.default.existsSync(candidate));
+    if (!signer) {
+        throw new Error(`Required Android verification tool apksigner not found under ${buildToolsDir}`);
     }
-    const files = fs_1.default.readdirSync(apkDir);
-    const apk = files.find(file => file.endsWith(".apk") &&
-        !file.includes("metadata"));
-    if (!apk) {
-        return null;
+    return signer;
+}
+function requireApk(androidRoot, mode) {
+    const artifactPath = path_1.default.join(androidRoot, "app", "build", "outputs", "apk", mode, `app-${mode}.apk`);
+    if (!fs_1.default.existsSync(artifactPath) || !fs_1.default.lstatSync(artifactPath).isFile()) {
+        throw new Error(`APK not found after Gradle build: ${artifactPath}`);
+    }
+    return artifactPath;
+}
+function requireSigning(signing) {
+    if (!signing) {
+        throw new Error("Release build requires an internal signing context");
     }
-    return path_1.default.join(apkDir, apk);
+    return signing;
 }
-function fsExists(file) {
-    const fs = require("fs");
-    return fs.existsSync(file);
+function signingSecrets(signing) {
+    return [
+        signing.storePassword,
+        signing.keyAlias,
+        signing.keyPassword,
+        signing.keystorePath,
+    ];
 }

package/dist/runners/process.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runProcess = runProcess;
+exports.redact = redact;
+const child_process_1 = require("child_process");
+const MAX_DIAGNOSTIC_LENGTH = 32 * 1024;
+function runProcess(command, args, options = {}) {
+    const result = (0, child_process_1.spawnSync)(command, args, {
+        cwd: options.cwd,
+        env: options.env,
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "pipe"],
+    });
+    const stdout = redact(result.stdout ?? "", options.secrets ?? []);
+    const stderr = redact(result.stderr ?? "", options.secrets ?? []);
+    if (options.streamOutput) {
+        if (stdout)
+            process.stdout.write(stdout);
+        if (stderr)
+            process.stderr.write(stderr);
+    }
+    if (result.error) {
+        throw new Error(`Failed to run ${command}: ${redact(result.error.message, options.secrets ?? [])}`);
+    }
+    if (result.status !== 0) {
+        const diagnostic = bounded(`${stderr}\n${stdout}`.trim());
+        const suffix = diagnostic ? `\n${diagnostic}` : "";
+        throw new Error(`${command} exited with status ${result.status}${result.signal ? ` (${result.signal})` : ""}${suffix}`);
+    }
+    return { stdout, stderr };
+}
+function redact(value, secrets) {
+    return secrets
+        .filter(secret => secret.length > 0)
+        .sort((a, b) => b.length - a.length)
+        .reduce((output, secret) => output.split(secret).join("[REDACTED]"), value);
+}
+function bounded(value) {
+    if (value.length <= MAX_DIAGNOSTIC_LENGTH)
+        return value;
+    return `[diagnostic truncated]\n${value.slice(-MAX_DIAGNOSTIC_LENGTH)}`;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pakstr",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "CLI for packaging Nostr web apps into Android APKs",
   "type": "commonjs",
   "main": "dist/index.js",
@@ -27,6 +27,7 @@
   ],
   "scripts": {
     "build": "tsc",
+    "test": "npm run build && node --test test/*.test.js",
     "start": "node dist/index.js",
     "dev": "ts-node src/index.ts",
     "pack:test": "npm pack"