pakstr 0.7.0 → 0.8.1

package/dist/commands/build.js

@@ -7,141 +7,187 @@ exports.buildCommand = buildCommand;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const child_process_1 = require("child_process");
+const generatedProjectVerification_1 = require("../android/generatedProjectVerification");
 const gradle_1 = require("../android/gradle");
-const validateProject_1 = require("../core/validateProject");
-const buildContext_1 = require("../core/buildContext");
-const template_1 = require("../android/template");
-const createRunner_1 = require("../runners/createRunner");
-const config_1 = require("../core/config");
 const branding_1 = require("../android/branding");
-const version_1 = require("../android/version");
 const icon_1 = require("../android/icon");
-const splash_1 = require("../android/splash");
 const permissions_1 = require("../android/permissions");
+const releaseWorkspace_1 = require("../android/releaseWorkspace");
+const splash_1 = require("../android/splash");
+const template_1 = require("../android/template");
+const buildContext_1 = require("../core/buildContext");
+const config_1 = require("../core/config");
+const releaseSigning_1 = require("../core/releaseSigning");
+const validateProject_1 = require("../core/validateProject");
+const createRunner_1 = require("../runners/createRunner");
 const runtimeConfig_1 = require("../runtime/runtimeConfig");
 async function buildCommand(args) {
     const ctx = (0, buildContext_1.createBuildContext)(args);
     const config = (0, config_1.loadConfig)(process.cwd());
     const manifest = ctx.manifest;
-    console.log("📄 Manifest loaded");
-    const distPath = ctx.dist;
-    const androidRoot = await (0, template_1.ensureTemplate)();
     const mode = ctx.mode;
-    const apkOutput = ctx.out;
-    const assetsTarget = path_1.default.join(androidRoot, "app/src/main/assets/www");
-    const appName = manifest?.app?.name || manifest?.appName || "Pakstr App";
+    const appName = manifest.appName;
+    const finalPath = path_1.default.resolve(ctx.out);
     console.log("\n🚀 Pakstr CLI");
     console.log("📦 App:", appName);
-    console.log("🌐 Web:", distPath);
-    console.log("📱 Out:", apkOutput);
-    console.log("📱 Android:", androidRoot);
+    console.log("🌐 Web:", ctx.dist);
+    console.log("📱 Out:", finalPath);
     console.log("🏗️ Builder:", config.builder);
     console.log("🚀 BUILD MODE:", mode.toUpperCase());
-    // -----------------------------
-    // 1. VALIDATE PROJECT
-    // -----------------------------
-    (0, validateProject_1.validateProject)(distPath, manifest);
+    (0, validateProject_1.validateProject)(ctx.dist, manifest);
+    validateOutputParent(finalPath);
+    if (mode === "release") {
+        removeExistingOutput(finalPath);
+    }
+    const signingInput = mode === "release" ? (0, releaseSigning_1.readReleaseSigningInput)() : undefined;
+    const templateRoot = await (0, template_1.ensureTemplate)();
+    let workspace;
+    let signing;
+    let stagedPath;
+    let primaryError;
+    let cleanupError;
+    try {
+        const androidRoot = mode === "release"
+            ? (workspace = (0, releaseWorkspace_1.createReleaseWorkspace)(templateRoot)).androidRoot
+            : templateRoot;
+        console.log("📱 Android:", androidRoot);
+        await prepareAndroidProject(androidRoot, ctx.dist, manifest, appName);
+        if (signingInput) {
+            signing = (0, releaseSigning_1.createReleaseSigningContext)(signingInput);
+            signingInput.keystoreBase64 = "";
+        }
+        console.log("\n⚙️ Running build runner...");
+        const result = await (0, createRunner_1.createRunner)(config).build({
+            androidRoot,
+            mode,
+            expectedMetadata: {
+                applicationId: manifest.appId,
+                versionCode: manifest.versionCode,
+                versionName: manifest.versionName,
+                appLabel: appName,
+            },
+            signing,
+        });
+        if (mode === "release" && !result.verification) {
+            throw new Error("Release runner returned no verification evidence");
+        }
+        stagedPath = stageArtifact(result.artifactPath, finalPath);
+    }
+    catch (error) {
+        primaryError = error;
+    }
+    try {
+        signing?.cleanup();
+    }
+    catch (error) {
+        cleanupError = error;
+    }
+    try {
+        workspace?.cleanup();
+    }
+    catch (error) {
+        cleanupError ??= error;
+    }
+    if (primaryError || cleanupError) {
+        removeStagedArtifact(stagedPath);
+        removeExistingOutput(finalPath);
+        if (primaryError) {
+            if (cleanupError) {
+                console.error("Cleanup also failed:", safeErrorMessage(cleanupError));
+            }
+            throw primaryError;
+        }
+        throw cleanupError;
+    }
+    if (!stagedPath) {
+        throw new Error("Build completed without a staged APK");
+    }
+    publishArtifact(stagedPath, finalPath);
+    console.log("\n🚀 BUILD COMPLETE");
+    console.log("App:", appName);
+    console.log("Mode:", mode.toUpperCase());
+    console.log("📦 Output:", finalPath);
+    openFolder(finalPath);
+}
+async function prepareAndroidProject(androidRoot, distPath, manifest, appName) {
+    const assetsTarget = path_1.default.join(androidRoot, "app/src/main/assets/www");
     if (!fs_1.default.existsSync(distPath)) {
-        throw new Error("❌ Web assets not found");
-    }
-    // -----------------------------
-    // 2. COPY WEB → ANDROID ASSETS
-    // -----------------------------
-    console.log("\n📦 Copying web → Android assets...");
-    fs_1.default.rmSync(assetsTarget, {
-        recursive: true,
-        force: true,
-    });
-    fs_1.default.mkdirSync(assetsTarget, {
-        recursive: true,
-    });
+        throw new Error("Web assets not found");
+    }
+    fs_1.default.rmSync(assetsTarget, { recursive: true, force: true });
+    fs_1.default.mkdirSync(assetsTarget, { recursive: true });
     copyFolder(distPath, assetsTarget);
-    console.log("📦 Web assets copied successfully");
     (0, runtimeConfig_1.generateRuntimeConfig)(assetsTarget, manifest);
-    console.log("runtime files:", fs_1.default.readdirSync(assetsTarget)
-        .filter(f => f.includes("pakstr")));
-    console.log(fs_1.default.existsSync(path_1.default.join(assetsTarget, "pakstr-runtime.json")));
-    console.log(fs_1.default.readdirSync(assetsTarget));
-    // -----------------------------
-    // 3. PATCH ANDROID PROJECT
-    // -----------------------------
     (0, gradle_1.patchGradle)(androidRoot, manifest);
-    console.log("⚙️ Gradle patched");
-    // -----------------------------
-    // 3.1 PATCH BRANDING
-    // -----------------------------
     (0, branding_1.patchAppName)(androidRoot, appName);
-    (0, branding_1.patchPackageName)(androidRoot, manifest.appId);
-    (0, version_1.patchVersion)(androidRoot, manifest.versionCode, manifest.versionName);
-    const iconPath = manifest.ui?.icon;
-    if (iconPath) {
-        await (0, icon_1.patchIcon)(androidRoot, iconPath, manifest.backgroundColor ?? "#FFFFFF");
-    }
-    const splash = manifest.ui?.splash;
-    if (splash) {
-        console.log("SPLASH IMAGE:", splash.image);
-        console.log("SPLASH BACKGROUND:", splash.background);
-        await (0, splash_1.patchSplash)(androidRoot, splash.image, splash.background ?? "#FFFFFF");
+    if (manifest.ui?.icon) {
+        await (0, icon_1.patchIcon)(androidRoot, manifest.ui.icon, manifest.backgroundColor ?? "#FFFFFF");
+    }
+    if (manifest.ui?.splash) {
+        await (0, splash_1.patchSplash)(androidRoot, manifest.ui.splash.image, manifest.ui.splash.background ?? "#FFFFFF");
     }
     (0, permissions_1.patchPermissions)(androidRoot, manifest);
-    // -----------------------------
-    // 4. RUN BUILD RUNNER
-    // -----------------------------
-    let apkPath;
-    try {
-        console.log("\n⚙️ Running build runner...");
-        const runner = (0, createRunner_1.createRunner)(config);
-        apkPath = await runner.build(androidRoot, mode);
-        console.log("✅ APK build successful");
-        console.log("\n📦 APK GENERATED:");
-        console.log(apkPath);
-    }
-    catch (err) {
-        console.error("❌ Build failed");
-        console.error(err);
-        throw err;
-    }
-    // -----------------------------
-    // 5. COPY APK TO OUTPUT
-    // -----------------------------
-    const finalPath = path_1.default.resolve(apkOutput);
-    fs_1.default.mkdirSync(path_1.default.dirname(finalPath), {
-        recursive: true,
+    (0, generatedProjectVerification_1.verifyGeneratedAndroidProject)(androidRoot, {
+        applicationId: manifest.appId,
+        versionCode: manifest.versionCode,
+        versionName: manifest.versionName,
+        appLabel: appName,
     });
+}
+function validateOutputParent(finalPath) {
+    const parent = path_1.default.dirname(finalPath);
+    if (!fs_1.default.existsSync(parent) || !fs_1.default.lstatSync(parent).isDirectory()) {
+        throw new Error(`Output directory must already exist: ${parent}`);
+    }
+    if (fs_1.default.lstatSync(parent).isSymbolicLink()) {
+        throw new Error(`Output directory must not be a symbolic link: ${parent}`);
+    }
     if (fs_1.default.existsSync(finalPath)) {
         const stat = fs_1.default.lstatSync(finalPath);
-        if (stat.isDirectory()) {
-            fs_1.default.rmSync(finalPath, {
-                recursive: true,
-                force: true,
-            });
+        if (!stat.isFile() || stat.isSymbolicLink()) {
+            throw new Error(`Output path must be a regular file: ${finalPath}`);
         }
     }
-    fs_1.default.copyFileSync(apkPath, finalPath);
-    console.log("\n📦 CLEAN OUTPUT:");
-    console.log(finalPath);
-    openFolder(finalPath);
-    // -----------------------------
-    // 6. FINAL OUTPUT
-    // -----------------------------
-    console.log("\n🚀 BUILD COMPLETE");
-    console.log("App:", appName);
-    console.log("Mode:", mode.toUpperCase());
 }
-// -----------------------------
-// COPY FOLDER
-// -----------------------------
+function stageArtifact(artifactPath, finalPath) {
+    const parent = path_1.default.dirname(finalPath);
+    const stageDir = fs_1.default.mkdtempSync(path_1.default.join(parent, ".pakstr-stage-"));
+    const stagedPath = path_1.default.join(stageDir, "app.apk");
+    fs_1.default.copyFileSync(artifactPath, stagedPath, fs_1.default.constants.COPYFILE_EXCL);
+    if (fs_1.default.statSync(stagedPath).size !== fs_1.default.statSync(artifactPath).size) {
+        fs_1.default.rmSync(stageDir, { recursive: true, force: true });
+        throw new Error("Staged APK size does not match verified artifact");
+    }
+    return stagedPath;
+}
+function publishArtifact(stagedPath, finalPath) {
+    removeExistingOutput(finalPath);
+    fs_1.default.renameSync(stagedPath, finalPath);
+    fs_1.default.rmSync(path_1.default.dirname(stagedPath), { recursive: true, force: true });
+    if (!fs_1.default.existsSync(finalPath) || !fs_1.default.lstatSync(finalPath).isFile()) {
+        throw new Error("Final APK publication failed");
+    }
+}
+function removeExistingOutput(finalPath) {
+    if (!fs_1.default.existsSync(finalPath))
+        return;
+    const stat = fs_1.default.lstatSync(finalPath);
+    if (!stat.isFile() || stat.isSymbolicLink()) {
+        throw new Error(`Refusing to remove non-regular output path: ${finalPath}`);
+    }
+    fs_1.default.unlinkSync(finalPath);
+}
+function removeStagedArtifact(stagedPath) {
+    if (!stagedPath)
+        return;
+    fs_1.default.rmSync(path_1.default.dirname(stagedPath), { recursive: true, force: true });
+}
 function copyFolder(src, dest) {
-    const entries = fs_1.default.readdirSync(src, {
-        withFileTypes: true,
-    });
-    for (const entry of entries) {
+    for (const entry of fs_1.default.readdirSync(src, { withFileTypes: true })) {
         const srcPath = path_1.default.join(src, entry.name);
         const destPath = path_1.default.join(dest, entry.name);
         if (entry.isDirectory()) {
-            fs_1.default.mkdirSync(destPath, {
-                recursive: true,
-            });
+            fs_1.default.mkdirSync(destPath, { recursive: true });
             copyFolder(srcPath, destPath);
         }
         else {
@@ -149,17 +195,16 @@ function copyFolder(src, dest) {
         }
     }
 }
-// -----------------------------
-// OPEN FOLDER (macOS)
-// -----------------------------
 function openFolder(filePath) {
-    if (process.platform !== "darwin") {
+    if (process.platform !== "darwin" || process.env.CI)
         return;
-    }
     try {
-        (0, child_process_1.execSync)(`open "${path_1.default.dirname(filePath)}"`);
+        (0, child_process_1.execFileSync)("open", [path_1.default.dirname(filePath)], { stdio: "ignore" });
     }
     catch {
-        // ignore
+        // Opening the output folder is optional.
     }
 }
+function safeErrorMessage(error) {
+    return error instanceof Error ? error.message : "unknown cleanup error";
+}

package/dist/core/manifest.js

@@ -16,12 +16,31 @@ function loadManifest(path) {
 function validateManifest(m) {
     if (!m.appId)
         throw new Error("❌ appId is required");
+    const appIdPattern = /^[a-z][a-z0-9_]*(\.[a-z][a-z0-9_]*)+$/;
+    if (m.appId.length < 3 ||
+        m.appId.length > 255 ||
+        !appIdPattern.test(m.appId)) {
+        throw new Error("❌ appId must be a lowercase reverse-domain Android Application ID");
+    }
+    const debugAppId = `${m.appId}.debug`;
+    if (debugAppId.length > 255 || !appIdPattern.test(debugAppId)) {
+        throw new Error("❌ appId is too long to derive the debug Application ID");
+    }
     if (!m.appName)
         throw new Error("❌ appName is required");
+    if (/[\r\n]/.test(m.appName)) {
+        throw new Error("❌ appName must not contain line breaks");
+    }
     if (!m.versionName)
         throw new Error("❌ versionName is required");
+    if (/[\r\n"\\]/.test(m.versionName)) {
+        throw new Error("❌ versionName must not contain line breaks, quotes, or backslashes");
+    }
     if (m.versionCode === undefined)
         throw new Error("❌ versionCode is required");
+    if (!Number.isInteger(m.versionCode) || m.versionCode <= 0) {
+        throw new Error("❌ versionCode must be a positive integer");
+    }
     if (m.ui?.splash && !m.ui.splash.image) {
         throw new Error("❌ splash.image is required");
     }

package/dist/core/releaseSigning.js

@@ -0,0 +1,134 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.INTERNAL_KEYSTORE_PATH_ENV = exports.PUBLIC_SIGNING_ENV = void 0;
+exports.readReleaseSigningInput = readReleaseSigningInput;
+exports.createReleaseSigningContext = createReleaseSigningContext;
+exports.removeSigningVariables = removeSigningVariables;
+exports.createGradleSigningEnvironment = createGradleSigningEnvironment;
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+exports.PUBLIC_SIGNING_ENV = {
+    keystoreBase64: "PAKSTR_ANDROID_KEYSTORE_BASE64",
+    keystorePassword: "PAKSTR_ANDROID_KEYSTORE_PASSWORD",
+    keyAlias: "PAKSTR_ANDROID_KEY_ALIAS",
+    keyPassword: "PAKSTR_ANDROID_KEY_PASSWORD",
+};
+exports.INTERNAL_KEYSTORE_PATH_ENV = "PAKSTR_ANDROID_KEYSTORE_PATH";
+const MAX_KEYSTORE_BYTES = 16 * 1024 * 1024;
+const CANONICAL_BASE64 = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/;
+function readReleaseSigningInput(env = process.env) {
+    const keystoreBase64 = requireValue(env, exports.PUBLIC_SIGNING_ENV.keystoreBase64);
+    const storePassword = requireValue(env, exports.PUBLIC_SIGNING_ENV.keystorePassword);
+    const keyAlias = requireValue(env, exports.PUBLIC_SIGNING_ENV.keyAlias);
+    const keyPassword = requireValue(env, exports.PUBLIC_SIGNING_ENV.keyPassword);
+    validateCanonicalBase64(keystoreBase64);
+    return {
+        keystoreBase64,
+        storePassword,
+        keyAlias,
+        keyPassword,
+    };
+}
+function createReleaseSigningContext(input, temporaryRoot = os_1.default.tmpdir()) {
+    let decoded = decodeKeystore(input.keystoreBase64);
+    fs_1.default.mkdirSync(temporaryRoot, { recursive: true, mode: 0o700 });
+    const signingDir = fs_1.default.mkdtempSync(path_1.default.join(temporaryRoot, "pakstr-signing-"));
+    const keystorePath = path_1.default.join(signingDir, "release.keystore");
+    let cleaned = false;
+    try {
+        fs_1.default.chmodSync(signingDir, 0o700);
+        fs_1.default.writeFileSync(keystorePath, decoded, {
+            flag: "wx",
+            mode: 0o600,
+        });
+        verifyProtectedKeystore(signingDir, keystorePath, decoded.length);
+    }
+    catch (error) {
+        fs_1.default.rmSync(signingDir, { recursive: true, force: true });
+        throw error;
+    }
+    finally {
+        decoded.fill(0);
+        decoded = Buffer.alloc(0);
+    }
+    return Object.freeze({
+        keystorePath,
+        storePassword: input.storePassword,
+        keyAlias: input.keyAlias,
+        keyPassword: input.keyPassword,
+        cleanup() {
+            if (cleaned)
+                return;
+            fs_1.default.rmSync(signingDir, { recursive: true, force: true, maxRetries: 2 });
+            if (fs_1.default.existsSync(signingDir)) {
+                throw new Error(`Failed to remove temporary signing directory: ${signingDir}`);
+            }
+            cleaned = true;
+        },
+    });
+}
+function removeSigningVariables(env) {
+    const sanitized = { ...env };
+    delete sanitized[exports.PUBLIC_SIGNING_ENV.keystoreBase64];
+    delete sanitized[exports.PUBLIC_SIGNING_ENV.keystorePassword];
+    delete sanitized[exports.PUBLIC_SIGNING_ENV.keyAlias];
+    delete sanitized[exports.PUBLIC_SIGNING_ENV.keyPassword];
+    delete sanitized[exports.INTERNAL_KEYSTORE_PATH_ENV];
+    return sanitized;
+}
+function createGradleSigningEnvironment(context, env = process.env, keystorePath = context.keystorePath) {
+    return {
+        ...removeSigningVariables(env),
+        [exports.INTERNAL_KEYSTORE_PATH_ENV]: keystorePath,
+        [exports.PUBLIC_SIGNING_ENV.keystorePassword]: context.storePassword,
+        [exports.PUBLIC_SIGNING_ENV.keyAlias]: context.keyAlias,
+        [exports.PUBLIC_SIGNING_ENV.keyPassword]: context.keyPassword,
+    };
+}
+function requireValue(env, name) {
+    const value = env[name];
+    if (value === undefined || value.length === 0) {
+        throw new Error(`${name} is required and must not be empty for release builds`);
+    }
+    return value;
+}
+function validateCanonicalBase64(value) {
+    if (!CANONICAL_BASE64.test(value)) {
+        throw new Error(`${exports.PUBLIC_SIGNING_ENV.keystoreBase64} must be canonical single-line RFC 4648 base64`);
+    }
+    const decodedLength = Buffer.byteLength(value, "base64");
+    if (decodedLength === 0) {
+        throw new Error(`${exports.PUBLIC_SIGNING_ENV.keystoreBase64} decodes to an empty keystore`);
+    }
+    if (decodedLength > MAX_KEYSTORE_BYTES) {
+        throw new Error(`${exports.PUBLIC_SIGNING_ENV.keystoreBase64} exceeds the 16 MiB decoded size limit`);
+    }
+}
+function decodeKeystore(value) {
+    const decoded = Buffer.from(value, "base64");
+    if (decoded.toString("base64") !== value) {
+        decoded.fill(0);
+        throw new Error(`${exports.PUBLIC_SIGNING_ENV.keystoreBase64} is not canonical base64`);
+    }
+    return decoded;
+}
+function verifyProtectedKeystore(signingDir, keystorePath, expectedSize) {
+    const dirStat = fs_1.default.lstatSync(signingDir);
+    const fileStat = fs_1.default.lstatSync(keystorePath);
+    if (!dirStat.isDirectory() || dirStat.isSymbolicLink()) {
+        throw new Error("Temporary signing directory is not a real directory");
+    }
+    if (!fileStat.isFile() || fileStat.isSymbolicLink()) {
+        throw new Error("Temporary keystore is not a regular file");
+    }
+    if ((dirStat.mode & 0o777) !== 0o700 || (fileStat.mode & 0o777) !== 0o600) {
+        throw new Error("Temporary signing storage does not have owner-only permissions");
+    }
+    if (fileStat.size !== expectedSize) {
+        throw new Error("Temporary keystore size does not match decoded input");
+    }
+}