pakstr 0.8.6 → 0.9.0

package/android-template/app/build.gradle.kts

@@ -21,8 +21,11 @@ android {
 
     signingConfigs {
         create("release") {
-            if (releaseRequested) {
-                val keystorePath = requireReleaseSigningValue("PAKSTR_ANDROID_KEYSTORE_PATH")
+            // Signing is optional: pakstr build produces an UNSIGNED release APK and
+            // pakstr sign signs it with apksigner afterwards. Only wire up the
+            // Gradle signingConfig when PAKSTR_ANDROID_KEYSTORE_PATH is present.
+            val keystorePath = System.getenv("PAKSTR_ANDROID_KEYSTORE_PATH")
+            if (releaseRequested && keystorePath != null && keystorePath.isNotEmpty()) {
                 val keystoreFile = File(keystorePath)
                 if (!keystoreFile.isFile) {
                     throw GradleException("Release signing keystore path is not a file")
@@ -53,7 +56,12 @@ android {
         }
 
         release {
-            signingConfig = signingConfigs.getByName("release")
+            // Only attach the signing config when a keystore was provided;
+            // otherwise emit an unsigned release APK for pakstr sign to sign.
+            val keystorePath = System.getenv("PAKSTR_ANDROID_KEYSTORE_PATH")
+            if (keystorePath != null && keystorePath.isNotEmpty()) {
+                signingConfig = signingConfigs.getByName("release")
+            }
             isMinifyEnabled = true
             isShrinkResources = true
             proguardFiles(

package/android-template/app/src/main/java/com/pakstr/app/MainActivity.kt

@@ -209,6 +209,7 @@ class MainActivity : AppCompatActivity(), PermissionHandler {
     private fun setupSupportUnlockGesture() {
         supportUnlockGestureLayout.onUnlock = {
             SupportUnlock.unlock(this)
+            WebViewDebugManager.enable(this)
             Toast.makeText(
                 this,
                 R.string.diagnostics_mode_enabled,
@@ -289,6 +290,7 @@ class MainActivity : AppCompatActivity(), PermissionHandler {
     override fun onResume() {
         super.onResume()
 
+        WebViewDebugManager.enable(this)
         if (::fab.isInitialized) {
             showDebugFab()
         }

package/android-template/app/src/main/java/com/pakstr/app/debug/DebugReportExporter.kt

@@ -106,7 +106,7 @@ object DebugReportExporter {
         ${RuntimeConfig.apiEnabled(context)}
 
         WebView Debug:
-        ${BuildConfig.DEBUG || SupportUnlock.isActive(context)}
+        ${WebViewDebugManager.isInspectionAllowed(context)}
 
         Logs:
         -------------------

package/android-template/app/src/main/java/com/pakstr/app/debug/DeveloperToolsActivity.kt

@@ -129,7 +129,7 @@ class DeveloperToolsActivity : AppCompatActivity() {
     }
 
     private fun isWebViewDebugEnabled(): Boolean {
-        return BuildConfig.DEBUG || SupportUnlock.isActive(this)
+        return WebViewDebugManager.isInspectionAllowed(this)
     }
 
     private fun setupLogActions() {

package/android-template/app/src/main/java/com/pakstr/app/debug/DeviceDeveloperState.kt

@@ -0,0 +1,23 @@
+package com.pakstr.app.debug
+
+import android.content.Context
+import android.provider.Settings
+
+object DeviceDeveloperState {
+
+    fun isAdbEnabled(context: Context): Boolean {
+        return isAdbEnabled {
+            Settings.Global.getInt(
+                context.contentResolver,
+                Settings.Global.ADB_ENABLED,
+                0
+            )
+        }
+    }
+
+    internal fun isAdbEnabled(
+        readSetting: () -> Int
+    ): Boolean {
+        return readSetting() == 1
+    }
+}

package/android-template/app/src/main/java/com/pakstr/app/debug/WebViewDebugManager.kt

@@ -6,15 +6,36 @@ import com.pakstr.app.BuildConfig
 
 object WebViewDebugManager {
 
+    internal var debuggingStateApplier: (Boolean) -> Unit =
+        WebView::setWebContentsDebuggingEnabled
+
+
+    fun isInspectionAllowed(
+        context: Context
+    ): Boolean {
+        return isInspectionAllowed(
+            isDebugBuild = BuildConfig.DEBUG,
+            isSupportUnlocked = SupportUnlock.isActive(context),
+            isAdbEnabled = DeviceDeveloperState.isAdbEnabled(context)
+        )
+    }
+
+    internal fun isInspectionAllowed(
+        isDebugBuild: Boolean,
+        isSupportUnlocked: Boolean,
+        isAdbEnabled: Boolean
+    ): Boolean {
+        return isDebugBuild ||
+                (isSupportUnlocked && isAdbEnabled)
+    }
 
     fun enable(
         context: Context
     ) {
 
-        val enabled = BuildConfig.DEBUG ||
-                SupportUnlock.isActive(context)
+        val enabled = isInspectionAllowed(context)
 
-        WebView.setWebContentsDebuggingEnabled(enabled)
+        setWebContentsDebuggingEnabled(enabled)
 
         AppDebugLogger.log(
             context,
@@ -22,4 +43,10 @@ object WebViewDebugManager {
             "WebView debugging enabled: $enabled"
         )
     }
-}
+
+    internal fun setWebContentsDebuggingEnabled(
+        enabled: Boolean
+    ) {
+        debuggingStateApplier(enabled)
+    }
+}

package/android-template/app/src/test/java/com/pakstr/app/debug/DeviceDeveloperStateTest.kt

@@ -0,0 +1,21 @@
+package com.pakstr.app.debug
+
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+class DeviceDeveloperStateTest {
+
+    @Test
+    fun adb_is_enabled_only_for_setting_value_one() {
+        assertTrue(
+            DeviceDeveloperState.isAdbEnabled { 1 }
+        )
+        assertFalse(
+            DeviceDeveloperState.isAdbEnabled { 0 }
+        )
+        assertFalse(
+            DeviceDeveloperState.isAdbEnabled { 2 }
+        )
+    }
+}

package/android-template/app/src/test/java/com/pakstr/app/debug/WebViewDebugManagerTest.kt

@@ -0,0 +1,84 @@
+package com.pakstr.app.debug
+
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+class WebViewDebugManagerTest {
+
+    @Test
+    fun debug_build_allows_inspection_without_release_prerequisites() {
+        assertTrue(
+            WebViewDebugManager.isInspectionAllowed(
+                isDebugBuild = true,
+                isSupportUnlocked = false,
+                isAdbEnabled = false
+            )
+        )
+    }
+
+    @Test
+    fun release_allows_inspection_with_support_unlock_and_adb() {
+        assertTrue(
+            WebViewDebugManager.isInspectionAllowed(
+                isDebugBuild = false,
+                isSupportUnlocked = true,
+                isAdbEnabled = true
+            )
+        )
+    }
+
+    @Test
+    fun release_rejects_support_unlock_without_adb() {
+        assertFalse(
+            WebViewDebugManager.isInspectionAllowed(
+                isDebugBuild = false,
+                isSupportUnlocked = true,
+                isAdbEnabled = false
+            )
+        )
+    }
+
+    @Test
+    fun release_rejects_adb_without_support_unlock() {
+        assertFalse(
+            WebViewDebugManager.isInspectionAllowed(
+                isDebugBuild = false,
+                isSupportUnlocked = false,
+                isAdbEnabled = true
+            )
+        )
+    }
+
+    @Test
+    fun release_rejects_inspection_without_either_prerequisite() {
+        assertFalse(
+            WebViewDebugManager.isInspectionAllowed(
+                isDebugBuild = false,
+                isSupportUnlocked = false,
+                isAdbEnabled = false
+            )
+        )
+    }
+
+    @Test
+    fun allowed_release_state_is_applied_to_webview_debugging() {
+        val appliedStates = mutableListOf<Boolean>()
+        val previous = WebViewDebugManager.debuggingStateApplier
+        WebViewDebugManager.debuggingStateApplier = appliedStates::add
+
+        try {
+            val allowed =
+                WebViewDebugManager.isInspectionAllowed(
+                    isDebugBuild = false,
+                    isSupportUnlocked = true,
+                    isAdbEnabled = true
+                )
+            WebViewDebugManager.setWebContentsDebuggingEnabled(allowed)
+        } finally {
+            WebViewDebugManager.debuggingStateApplier = previous
+        }
+
+        assertTrue(appliedStates.single())
+    }
+}

package/bin/cli.js

@@ -3,11 +3,16 @@
 const { runCLI } = require("../dist/cli.js");
 
 runCLI(process.argv.slice(2))
-
+  .then(() => {
+    // runCLI sets process.exitCode on user-facing errors; nothing to do here.
+  })
   .catch((err) => {
-
-    console.error("❌ CLI crashed:", err);
-
+    // Known, human-readable errors: print just the message.
+    const name = err && err.name;
+    if (name === "ConfigError" || name === "NsecError" || err && err.envVar !== undefined) {
+      console.error("Error:", err.message);
+    } else {
+      console.error("Error:", err && err.message ? err.message : err);
+    }
     process.exit(1);
-
-  });
+  });

package/dist/cli.js

@@ -5,8 +5,16 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.runCLI = runCLI;
 const build_1 = require("./commands/build");
+const sign_1 = require("./commands/sign");
+const publish_1 = require("./commands/publish");
+const run_1 = require("./commands/run");
+const init_1 = require("./commands/init");
+const dotenv_1 = require("./core/dotenv");
 const package_json_1 = __importDefault(require("../package.json"));
 async function runCLI(argv) {
+    // Auto-load a local `.env` (gitignored) so `pakstr run` works out of the box
+    // after `pakstr init`. Existing env vars (e.g. CI secrets) always win.
+    (0, dotenv_1.loadDotEnv)();
     if (argv.includes("--help") || argv.includes("-h")) {
         printHelp();
         return;
@@ -16,41 +24,70 @@ async function runCLI(argv) {
         return;
     }
     const command = argv[0];
-    const subcommand = argv[1];
-    const args = argv.slice(2);
+    const args = argv.slice(1);
     if (!command) {
         printHelp();
         return;
     }
+    const configFlag = extractFlag(args, "--config");
     switch (command) {
+        case "init":
+            (0, init_1.initCommand)({ force: args.includes("--force"), out: configFlag });
+            return;
         case "build":
-            if (subcommand === "apk") {
-                console.log("🚀 Running: build apk");
-                return await (0, build_1.buildCommand)(args);
-            }
-            console.error("❌ Missing subcommand. Use: build apk");
-            process.exitCode = 1;
+            await (0, build_1.buildCommand)(configFlag ?? undefined);
+            return;
+        case "sign":
+            await (0, sign_1.signCommand)(configFlag ?? undefined);
+            return;
+        case "publish":
+            await (0, publish_1.publishCommand)(configFlag ?? undefined, {
+                dryRun: args.includes("--dry-run"),
+                verify: args.includes("--verify"),
+                outJson: extractFlag(args, "--out-json"),
+            });
+            return;
+        case "run":
+            await (0, run_1.runCommand)(configFlag ?? undefined, {
+                verifyPublish: args.includes("--verify-publish"),
+                publishOutJson: extractFlag(args, "--publish-out-json"),
+            });
             return;
         default:
-            console.error(`❌ Unknown command: ${command}`);
+            console.error(`Unknown command: ${command}`);
             printHelp();
             process.exitCode = 1;
             return;
     }
 }
+function extractFlag(args, flag) {
+    const i = args.indexOf(flag);
+    if (i === -1)
+        return undefined;
+    return args[i + 1];
+}
 function printHelp() {
     console.log(`
-🚀 Pakstr CLI
+Pakstr — one-step nsec -> build -> sign -> publish.
 
 Usage:
+  pakstr init [--force] [--config <path>]
+  pakstr build [--config <path>]
+  pakstr sign [--config <path>]
+  pakstr publish [--config <path>] [--dry-run] [--verify] [--out-json <path>]
+  pakstr run [--config <path>] [--verify-publish] [--publish-out-json <path>]
 
-  pakstr build apk --manifest <path> --web <path> --out <path>
+  pakstr --version
+  pakstr --help
 
-Example:
+Config:
+  pakstr.yaml is the single source of truth (see docs/SPEC.md §3).
+  Secrets live in env vars, never in the config file:
+    PAKSTR_NSEC          nsec that derives the APK signing key (and publish auth by default)
+    PAKSTR_PUBLISH_NSEC  optional separate publish nsec (see publish.publishKey)
 
-  pakstr build apk \
-    --manifest app.manifest.json \
-    --web ./dist \
-    --out ./build/app.apk
+Example:
+  pakstr init
+  PAKSTR_NSEC=nsec1... pakstr run
 `);
 }

package/dist/commands/build.js

@@ -6,95 +6,70 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.buildCommand = buildCommand;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
-const child_process_1 = require("child_process");
-const generatedProjectVerification_1 = require("../android/generatedProjectVerification");
-const gradle_1 = require("../android/gradle");
-const branding_1 = require("../android/branding");
-const icon_1 = require("../android/icon");
-const permissions_1 = require("../android/permissions");
-const releaseWorkspace_1 = require("../android/releaseWorkspace");
-const splash_1 = require("../android/splash");
 const template_1 = require("../android/template");
-const buildContext_1 = require("../core/buildContext");
-const config_1 = require("../core/config");
-const releaseSigning_1 = require("../core/releaseSigning");
-const validateProject_1 = require("../core/validateProject");
+const releaseWorkspace_1 = require("../android/releaseWorkspace");
+const pakstrConfig_1 = require("../core/pakstrConfig");
+const androidProject_1 = require("../core/androidProject");
 const createRunner_1 = require("../runners/createRunner");
-const runtimeConfig_1 = require("../runtime/runtimeConfig");
-async function buildCommand(args) {
-    const ctx = (0, buildContext_1.createBuildContext)(args);
-    const config = (0, config_1.loadConfig)(process.cwd());
-    const manifest = ctx.manifest;
-    const mode = ctx.mode;
-    const appName = manifest.appName;
-    const finalPath = path_1.default.resolve(ctx.out);
-    console.log("\n🚀 Pakstr CLI");
-    console.log("📦 App:", appName);
-    console.log("🌐 Web:", ctx.dist);
+/**
+ * `pakstr build` — produce an UNSIGNED release APK at `build.out`.
+ * Spec §5.2. No nsec required.
+ */
+async function buildCommand(configPath) {
+    const config = (0, pakstrConfig_1.loadPakstrConfig)(configPath);
+    const finalPath = path_1.default.resolve(config.build.out);
+    console.log("\n🚀 pakstr build");
+    console.log("📦 App:", config.app.appName);
+    console.log("🌐 Web:", config.build.web);
     console.log("📱 Out:", finalPath);
-    console.log("🏗️ Builder:", config.builder);
-    console.log("🚀 BUILD MODE:", mode.toUpperCase());
-    (0, validateProject_1.validateProject)(ctx.dist, manifest);
+    console.log("🏗️  Builder:", config.build.builder);
     validateOutputParent(finalPath);
-    if (mode === "release") {
-        removeExistingOutput(finalPath);
-    }
-    const signingInput = mode === "release" ? (0, releaseSigning_1.readReleaseSigningInput)() : undefined;
+    removeExistingOutput(finalPath);
     const templateRoot = await (0, template_1.ensureTemplate)();
-    let workspace;
-    let signing;
+    const workspace = (0, releaseWorkspace_1.createReleaseWorkspace)(templateRoot);
     let stagedPath;
     let primaryError;
-    let cleanupError;
     try {
-        const androidRoot = mode === "release"
-            ? (workspace = (0, releaseWorkspace_1.createReleaseWorkspace)(templateRoot)).androidRoot
-            : templateRoot;
+        const androidRoot = workspace.androidRoot;
         console.log("📱 Android:", androidRoot);
-        await prepareAndroidProject(androidRoot, ctx.dist, manifest, appName, ctx.manifestDir);
-        if (signingInput) {
-            signing = (0, releaseSigning_1.createReleaseSigningContext)(signingInput);
-            signingInput.keystoreBase64 = "";
-        }
-        console.log("\n⚙️ Running build runner...");
-        const result = await (0, createRunner_1.createRunner)(config).build({
+        await (0, androidProject_1.prepareAndroidProject)({
             androidRoot,
-            mode,
+            webDir: config.build.web,
+            app: config.app,
+            configDir: config.configDir,
+        });
+        console.log("\n⚙️  Running build runner...");
+        const result = await (0, createRunner_1.createRunner)(config.build.builder).build({
+            androidRoot,
+            mode: "release",
             expectedMetadata: {
-                applicationId: manifest.appId,
-                versionCode: manifest.versionCode,
-                versionName: manifest.versionName,
-                appLabel: appName,
+                applicationId: config.app.appId,
+                versionCode: config.app.versionCode,
+                versionName: config.app.versionName,
+                appLabel: config.app.appName,
             },
-            signing,
         });
-        if (mode === "release" && !result.verification) {
-            console.warn("⚠️ Release verification evidence unavailable locally.");
-            console.warn("ℹ️ CI/Docker release verification will be used.");
+        if (!result.unsigned) {
+            throw new Error("Build runner did not produce an unsigned release APK");
         }
         stagedPath = stageArtifact(result.artifactPath, finalPath);
     }
     catch (error) {
         primaryError = error;
     }
+    let cleanupError;
     try {
-        signing?.cleanup();
+        workspace.cleanup();
     }
     catch (error) {
         cleanupError = error;
     }
-    try {
-        workspace?.cleanup();
-    }
-    catch (error) {
-        cleanupError ??= error;
-    }
     if (primaryError || cleanupError) {
         removeStagedArtifact(stagedPath);
         removeExistingOutput(finalPath);
         if (primaryError) {
             if (cleanupError) {
-                console.error("Cleanup also failed:", safeErrorMessage(cleanupError));
+                console.error("Workspace cleanup also failed:", safeErrorMessage(cleanupError));
             }
             throw primaryError;
         }
@@ -104,41 +79,17 @@ async function buildCommand(args) {
         throw new Error("Build completed without a staged APK");
     }
     publishArtifact(stagedPath, finalPath);
-    console.log("\n🚀 BUILD COMPLETE");
-    console.log("App:", appName);
-    console.log("Mode:", mode.toUpperCase());
+    console.log("\n✅ BUILD COMPLETE (unsigned)");
     console.log("📦 Output:", finalPath);
-    openFolder(finalPath);
-}
-async function prepareAndroidProject(androidRoot, distPath, manifest, appName, manifestDir) {
-    const assetsTarget = path_1.default.join(androidRoot, "app/src/main/assets/www");
-    if (!fs_1.default.existsSync(distPath)) {
-        throw new Error("Web assets not found");
-    }
-    fs_1.default.rmSync(assetsTarget, { recursive: true, force: true });
-    fs_1.default.mkdirSync(assetsTarget, { recursive: true });
-    copyFolder(distPath, assetsTarget);
-    (0, runtimeConfig_1.generateRuntimeConfig)(assetsTarget, manifest);
-    (0, gradle_1.patchGradle)(androidRoot, manifest);
-    (0, branding_1.patchAppName)(androidRoot, appName);
-    if (manifest.ui?.icon) {
-        await (0, icon_1.patchIcon)(androidRoot, manifest.ui.icon, manifest.backgroundColor ?? "#FFFFFF", manifestDir);
-    }
-    if (manifest.ui?.splash) {
-        await (0, splash_1.patchSplash)(androidRoot, manifest.ui.splash.image, manifest.ui.splash.background ?? "#FFFFFF", manifestDir);
-    }
-    (0, permissions_1.patchPermissions)(androidRoot, manifest);
-    (0, generatedProjectVerification_1.verifyGeneratedAndroidProject)(androidRoot, {
-        applicationId: manifest.appId,
-        versionCode: manifest.versionCode,
-        versionName: manifest.versionName,
-        appLabel: appName,
-    });
+    console.log("➡️  Next: pakstr sign");
+    return finalPath;
 }
 function validateOutputParent(finalPath) {
     const parent = path_1.default.dirname(finalPath);
     if (!fs_1.default.existsSync(parent) || !fs_1.default.lstatSync(parent).isDirectory()) {
-        throw new Error(`Output directory must already exist: ${parent}`);
+        // Create it per spec §5.2 ("Create the parent directory of build.out if missing").
+        fs_1.default.mkdirSync(parent, { recursive: true });
+        return;
     }
     if (fs_1.default.lstatSync(parent).isSymbolicLink()) {
         throw new Error(`Output directory must not be a symbolic link: ${parent}`);
@@ -157,7 +108,7 @@ function stageArtifact(artifactPath, finalPath) {
     fs_1.default.copyFileSync(artifactPath, stagedPath, fs_1.default.constants.COPYFILE_EXCL);
     if (fs_1.default.statSync(stagedPath).size !== fs_1.default.statSync(artifactPath).size) {
         fs_1.default.rmSync(stageDir, { recursive: true, force: true });
-        throw new Error("Staged APK size does not match verified artifact");
+        throw new Error("Staged APK size does not match built artifact");
     }
     return stagedPath;
 }
@@ -183,29 +134,6 @@ function removeStagedArtifact(stagedPath) {
         return;
     fs_1.default.rmSync(path_1.default.dirname(stagedPath), { recursive: true, force: true });
 }
-function copyFolder(src, dest) {
-    for (const entry of fs_1.default.readdirSync(src, { withFileTypes: true })) {
-        const srcPath = path_1.default.join(src, entry.name);
-        const destPath = path_1.default.join(dest, entry.name);
-        if (entry.isDirectory()) {
-            fs_1.default.mkdirSync(destPath, { recursive: true });
-            copyFolder(srcPath, destPath);
-        }
-        else {
-            fs_1.default.copyFileSync(srcPath, destPath);
-        }
-    }
-}
-function openFolder(filePath) {
-    if (process.platform !== "darwin" || process.env.CI)
-        return;
-    try {
-        (0, child_process_1.execFileSync)("open", [path_1.default.dirname(filePath)], { stdio: "ignore" });
-    }
-    catch {
-        // Opening the output folder is optional.
-    }
-}
 function safeErrorMessage(error) {
     return error instanceof Error ? error.message : "unknown cleanup error";
 }