peachsim 0.1.1644 → 0.1.1653

package/src/nitroAdapterContract.ts

@@ -0,0 +1,217 @@
+// the prebuilt Nitro adapter archive's shapes and identity rules, shared by its
+// builder (packages/sootsim-swift/scripts/build-nitro-adapter-archive.ts), its
+// publisher (scripts/ops/nitro-adapter-publish.ts) and the installed CLI that
+// downloads and verifies it. nothing here reads adapter sources: an installed
+// CLI carries this file and checks an archive against the lock it was built with.
+import { createHash } from 'node:crypto'
+import { readdirSync, readFileSync } from 'node:fs'
+import path from 'node:path'
+import { isRecord } from './is-record'
+
+/** the file at the root of an unpacked adapter, and its install marker. */
+export const NITRO_ADAPTER_MANIFEST = 'manifest.json'
+export const NITRO_ADAPTER_ARCHIVE = 'libPeachNitroAdapter.a'
+
+// header staging the collector exposes: JSI without the dynamic and test
+// pieces, and Nitro's cpp tree without views, copied to bare and nested names.
+export const HEADER_STAGE = {
+  jsi: {
+    from: 'ReactCommon/jsi/jsi',
+    skip: ['test'],
+    keep: '\\.h$',
+    exclude: 'JSIDynamic.h',
+    to: 'jsi',
+  },
+  nitro: {
+    from: 'cpp',
+    skip: ['views'],
+    keep: '\\.(?:h|hpp|hxx|inl)$',
+    to: ['core', 'core/NitroModules'],
+  },
+}
+
+export interface NitroAdapterRoots {
+  nitroModules: string
+  reactNative: string
+}
+
+/** what the installed CLI needs to trust an archive; no private provenance. */
+export interface NitroAdapterManifest {
+  schema: 1
+  /** the guest platform the producer built for; every consumer matches it against the lock or its own recomputed identity. */
+  platform: string
+  target: string
+  recipe: string
+  adapter: { sha256: string }
+  headers: { reactNativeJsi: string; nitroModules: string }
+  compiler: string
+  sdk: { id: string; checksum: string }
+  framework: { distribution: string; wireAbi: string }
+  archive: { path: string; size: number; sha256: string }
+}
+
+/** the published tarball one CLI build installs, committed beside swift-distribution.lock.json. */
+export interface NitroAdapterLock extends Omit<NitroAdapterManifest, 'archive'> {
+  /** the downloaded .tar.gz, which installVerifiedTarball checks. */
+  archive: { sha256: string; size: number }
+}
+
+export const sha256Hex = (data: Uint8Array | string) =>
+  createHash('sha256').update(data).digest('hex')
+
+export function digest(entries: Record<string, string>) {
+  const hash = createHash('sha256')
+  for (const key of Object.keys(entries).sort()) hash.update(`${key}\0${entries[key]}\n`)
+  return hash.digest('hex')
+}
+
+function headerFiles(base: string, directory: string, skip: string[], keep: RegExp) {
+  const files: string[] = []
+  const walk = (relative: string) => {
+    for (const entry of readdirSync(path.join(base, relative), { withFileTypes: true })) {
+      if (entry.name.startsWith('.') || skip.includes(entry.name)) continue
+      const next = path.posix.join(relative, entry.name)
+      if (entry.isDirectory()) walk(next)
+      else if (keep.test(entry.name)) files.push(next)
+    }
+  }
+  walk(directory)
+  return files.sort()
+}
+
+/** the original header closures the collector exposes, with per-file hashes. */
+export function headerClosure(roots: NitroAdapterRoots) {
+  const { jsi: j, nitro: n } = HEADER_STAGE
+  const jsiFiles = headerFiles(
+    roots.reactNative,
+    j.from,
+    j.skip,
+    new RegExp(j.keep),
+  ).filter((file) => !file.endsWith(`/${j.exclude}`))
+  const nitroFiles = headerFiles(roots.nitroModules, n.from, n.skip, new RegExp(n.keep))
+  const hashes = (base: string, files: string[]) =>
+    Object.fromEntries(
+      files.map((file) => [file, sha256Hex(readFileSync(path.join(base, file)))]),
+    )
+  return {
+    jsi: hashes(roots.reactNative, jsiFiles),
+    nitro: hashes(roots.nitroModules, nitroFiles),
+    nitroFiles,
+    jsiFiles,
+  }
+}
+
+/** the digests an app's original React Native and Nitro headers must match. */
+export function headerDigests(roots: NitroAdapterRoots) {
+  const closure = headerClosure(roots)
+  return { reactNativeJsi: digest(closure.jsi), nitroModules: digest(closure.nitro) }
+}
+
+const hex64 = (value: unknown): value is string =>
+  typeof value === 'string' && /^[a-f0-9]{64}$/.test(value)
+
+function text(value: unknown, what: string): string {
+  if (typeof value !== 'string' || !value)
+    throw new Error(`invalid Nitro adapter ${what}`)
+  return value
+}
+
+function digestField(value: unknown, what: string): string {
+  if (!hex64(value)) throw new Error(`invalid Nitro adapter ${what}`)
+  return value
+}
+
+function identity(value: unknown) {
+  if (!isRecord(value) || value.schema !== 1)
+    throw new Error('invalid Nitro adapter manifest')
+  const { adapter, headers, sdk, framework } = value
+  if (!isRecord(adapter) || !isRecord(headers) || !isRecord(sdk) || !isRecord(framework))
+    throw new Error('invalid Nitro adapter manifest')
+  return {
+    schema: 1 as const,
+    platform: text(value.platform, 'platform'),
+    target: text(value.target, 'target'),
+    recipe: digestField(value.recipe, 'recipe'),
+    adapter: { sha256: digestField(adapter.sha256, 'adapter digest') },
+    headers: {
+      reactNativeJsi: digestField(headers.reactNativeJsi, 'JSI header digest'),
+      nitroModules: digestField(headers.nitroModules, 'Nitro header digest'),
+    },
+    compiler: text(value.compiler, 'compiler'),
+    sdk: {
+      id: text(sdk.id, 'sdk id'),
+      checksum: digestField(sdk.checksum, 'sdk checksum'),
+    },
+    framework: {
+      distribution: text(framework.distribution, 'distribution'),
+      wireAbi: digestField(framework.wireAbi, 'wire abi'),
+    },
+  }
+}
+
+/** keeps only the public fields, so a producer's private provenance never
+ *  reaches a packed manifest. */
+export function parseNitroAdapterManifest(value: unknown): NitroAdapterManifest {
+  const archive = isRecord(value) ? value.archive : undefined
+  if (
+    !isRecord(archive) ||
+    typeof archive.path !== 'string' ||
+    archive.path !== NITRO_ADAPTER_ARCHIVE ||
+    typeof archive.size !== 'number'
+  )
+    throw new Error('invalid Nitro adapter archive record')
+  return {
+    ...identity(value),
+    archive: {
+      path: archive.path,
+      size: archive.size,
+      sha256: digestField(archive.sha256, 'archive digest'),
+    },
+  }
+}
+
+export function parseNitroAdapterLock(value: unknown): NitroAdapterLock {
+  const archive = isRecord(value) ? value.archive : undefined
+  if (!isRecord(archive) || typeof archive.size !== 'number')
+    throw new Error('invalid Nitro adapter lock archive')
+  return {
+    ...identity(value),
+    archive: {
+      sha256: digestField(archive.sha256, 'lock archive digest'),
+      size: archive.size,
+    },
+  }
+}
+
+/** the lock one published manifest and its tarball produce. */
+export function nitroAdapterLock(
+  manifest: NitroAdapterManifest,
+  tarball: { sha256: string; size: number },
+): NitroAdapterLock {
+  const { archive: _library, ...rest } = manifest
+  return { ...rest, archive: tarball }
+}
+
+/** the tarball's path under PEACH_SWIFT_ENDPOINT: content addressed, so immutable. */
+export function nitroAdapterArchiveKey(lock: NitroAdapterLock): string {
+  return `nitro-adapter/${lock.archive.sha256}.tar.gz`
+}
+
+/** throws unless an unpacked adapter is the one the lock pins and its library
+ *  bytes are the ones its manifest records. needs no adapter source. */
+export function verifyInstalledNitroAdapter(
+  directory: string,
+  lock: NitroAdapterLock,
+): NitroAdapterManifest {
+  const manifest = parseNitroAdapterManifest(
+    JSON.parse(readFileSync(path.join(directory, NITRO_ADAPTER_MANIFEST), 'utf8')),
+  )
+  const { archive, ...recorded } = manifest
+  const { archive: _tarball, ...pinned } = lock
+  if (JSON.stringify(recorded) !== JSON.stringify(pinned))
+    throw new Error('Nitro adapter manifest does not match the lock this build carries')
+  const bytes = readFileSync(path.join(directory, archive.path))
+  if (bytes.length !== archive.size || sha256Hex(bytes) !== archive.sha256)
+    throw new Error('Nitro adapter library does not match its manifest')
+  return manifest
+}

package/src/nitroContract.ts

@@ -3,33 +3,46 @@ import {
   readBundleMetadataFooter,
 } from './bundleGlobalFooter'
 
+/** the guest platform every Nitro compile targets. */
+export const NITRO_GUEST_PLATFORM = 'ios'
+
 export interface NitroCompiledModule {
-  platform: 'ios'
-  packageName: string
-  packageVersion: string
+  platform: typeof NITRO_GUEST_PLATFORM
+  /** the original providers this one executable registers, by package name. */
+  packages: { name: string; version: string }[]
   url: string
   hash: string
   icuUrl: string
 }
 
+function readNitroPackage(
+  value: unknown,
+): NitroCompiledModule['packages'][number] | null {
+  if (typeof value !== 'object' || value === null) return null
+  const name = Reflect.get(value, 'name')
+  const version = Reflect.get(value, 'version')
+  return typeof name === 'string' && name && typeof version === 'string' && version
+    ? { name, version }
+    : null
+}
+
 export function readNitroMetadata(value: unknown): NitroCompiledModule | null {
   if (value === null || value === undefined) return null
   if (
     typeof value !== 'object' ||
     Array.isArray(value) ||
-    Reflect.get(value, 'platform') !== 'ios'
+    Reflect.get(value, 'platform') !== NITRO_GUEST_PLATFORM
   )
     throw new Error('invalid Nitro compilation metadata')
-  const packageName = Reflect.get(value, 'packageName')
-  const packageVersion = Reflect.get(value, 'packageVersion')
+  const listed = Reflect.get(value, 'packages')
+  const packages = Array.isArray(listed) ? listed.map(readNitroPackage) : []
   const url = Reflect.get(value, 'url')
   const hash = Reflect.get(value, 'hash')
   const icuUrl = Reflect.get(value, 'icuUrl')
   if (
-    typeof packageName !== 'string' ||
-    !packageName ||
-    typeof packageVersion !== 'string' ||
-    !packageVersion ||
+    packages.length === 0 ||
+    !packages.every((entry) => entry !== null) ||
+    new Set(packages.map(({ name }) => name)).size !== packages.length ||
     typeof url !== 'string' ||
     !url ||
     typeof hash !== 'string' ||
@@ -38,7 +51,7 @@ export function readNitroMetadata(value: unknown): NitroCompiledModule | null {
     !icuUrl
   )
     throw new Error('invalid Nitro compilation metadata')
-  return { platform: 'ios', packageName, packageVersion, url, hash, icuUrl }
+  return { platform: 'ios', packages, url, hash, icuUrl }
 }
 
 export function readNitroFooter(source: string): NitroCompiledModule | null {

package/src/process-group.ts

@@ -9,6 +9,7 @@ import {
 } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
+import { Duplex } from 'node:stream'
 import { setTimeout as sleep } from 'node:timers/promises'
 
 const GRACEFUL_TIMEOUT_MS = 3_000
@@ -90,6 +91,7 @@ async function protectProcessFreeze(rootPid: number) {
     [
       '-c',
       `
+    (
     journal=$1
     cleanup() {
       trap '' HUP INT TERM
@@ -106,26 +108,53 @@ async function protectProcessFreeze(rootPid: number) {
     trap 'cleanup; exit 0' HUP INT TERM
     trap 'rm -f "$journal"; rmdir "\${journal%/*}"' EXIT
     printf 'ready\n'
-    if ! IFS= read -r command || [ "$command" != disarm ]; then cleanup; fi
+    if ! IFS= read -r command <&3 || [ "$command" != disarm ]; then cleanup; fi
+    ) &
   `,
       FREEZE_GUARD_NAME,
       journal,
     ],
     {
       detached: true,
-      stdio: ['pipe', 'pipe', 'ignore'],
+      // the launcher exits before capture, reparenting the guard outside any
+      // nested target tree. fd 3 survives that exit, unlike child.stdin.
+      stdio: ['ignore', 'pipe', 'ignore', 'pipe'],
     },
   )
+  let guardClosed = false
   const closed = new Promise<void>((resolveClose) =>
-    guard.once('close', () => resolveClose()),
+    guard.once('close', () => {
+      guardClosed = true
+      resolveClose()
+    }),
   )
-  guard.stdin.on('error', () => {})
+  const control = guard.stdio[3]
+  const output = guard.stdout
+  if (!(control instanceof Duplex) || !output) {
+    guard.kill()
+    await closed
+    rmSync(directory, { recursive: true, force: true })
+    throw new Error('process freeze guard control pipe is unavailable')
+  }
+  control.on('error', () => {})
   try {
     await new Promise<void>((resolveReady, reject) => {
-      let output = ''
-      guard.stdout.on('data', (bytes: Buffer) => {
-        output += bytes.toString()
-        if (output.includes('ready\n')) resolveReady()
+      let readyOutput = ''
+      let launcherExited = false
+      const ready = () => {
+        if (launcherExited && readyOutput.includes('ready\n')) resolveReady()
+      }
+      output.on('data', (bytes: Buffer) => {
+        readyOutput += bytes.toString()
+        ready()
+      })
+      guard.once('exit', (code, signal) => {
+        if (code !== 0 || signal !== null) {
+          reject(new Error('process freeze guard launcher failed'))
+          return
+        }
+        launcherExited = true
+        ready()
       })
       guard.once('error', reject)
       guard.once('close', () =>
@@ -133,47 +162,25 @@ async function protectProcessFreeze(rootPid: number) {
       )
     })
   } catch (error) {
-    guard.stdin.destroy()
+    control.destroy()
     await closed
     rmSync(directory, { recursive: true, force: true })
     throw error
   }
   return {
     record(pid: number) {
-      if (guard.exitCode !== null || guard.signalCode !== null)
+      if (guardClosed || control.destroyed)
         throw new Error('process freeze guard exited during capture')
       appendFileSync(journal, `pid ${pid}\n`)
     },
     async release(disarm: boolean) {
-      guard.stdin.end(disarm ? 'disarm\n' : undefined)
+      control.end(disarm ? 'disarm\n' : undefined)
       await closed
       rmSync(directory, { recursive: true, force: true })
     },
   }
 }
 
-// a nested capture's guard is a descendant of this tree but must keep running
-// to resume its own targets, so a freeze never reaches it. ps exits 1 when
-// some pids already vanished, so only a spawn failure or timeout is an error.
-function withoutFreezeGuards(pids: number[]): number[] {
-  if (pids.length === 0) return pids
-  const result = spawnSync('ps', ['-o', 'pid=,command=', '-p', pids.join(',')], {
-    encoding: 'utf8',
-    stdio: ['ignore', 'pipe', 'pipe'],
-    timeout: FORCED_EXIT_TIMEOUT_MS,
-    killSignal: 'SIGKILL',
-  })
-  if (result.error || (result.status !== 0 && result.status !== 1))
-    throw new Error(result.error?.message || `ps exited ${result.status}`)
-  const guards = new Set(
-    result.stdout
-      .split('\n')
-      .filter((line) => line.includes(FREEZE_GUARD_NAME))
-      .map((line) => Number(line.trim().split(/\s+/)[0])),
-  )
-  return pids.filter((pid) => !guards.has(pid))
-}
-
 // reparented members remain in the group; detached descendants need their
 // recorded pids. both can leave zombies, which signal zero cannot distinguish
 // from running processes. inspect their states together before confirming exit.
@@ -266,7 +273,7 @@ export async function terminateProcessGroup(
       }
       let children: number[]
       try {
-        children = withoutFreezeGuards(listProcessChildren(parents, remaining))
+        children = listProcessChildren(parents, remaining)
       } catch (error) {
         inspectionError = new Error(`could not inspect descendants: ${String(error)}`)
         break

package/src/react-bridge-importers.ts

@@ -0,0 +1,28 @@
+// which importers of `react` are routed through the peach-kit react bridge.
+// shared by the vite plugins and the esbuild browser artifacts.
+
+// the engine, compat, kit and reconciler sources the renderer shares a React with
+export function isEngineReactImporter(importer: string): boolean {
+  return (
+    importer.includes('/peachsim/src/') ||
+    importer.includes('/peach-engine/src/') ||
+    importer.includes('/peach-compat/src/') ||
+    importer.includes('/peach-compat/dist-pressability/') ||
+    importer.includes('/peach-kit/src/') ||
+    importer.includes('react-reconciler')
+  )
+}
+
+// the bridge's own import of react would loop, and the stub registry needs the
+// real React (with __CLIENT_INTERNALS) for bundle stubs. these match the files,
+// not any path containing the name, so a checkout directory cannot trip them.
+export function keepsRealReact(importer: string): boolean {
+  return /\/(react-bridge|stub-registry)\.[cm]?[jt]sx?$/.test(importer)
+}
+
+// workers are built, so any pure-JS RN-ecosystem package in node_modules is
+// bridged too. the bridge and the stub registry keep the real React.
+export function isWorkerReactBridgeImporter(importer: string): boolean {
+  if (keepsRealReact(importer)) return false
+  return isEngineReactImporter(importer) || importer.includes('/node_modules/')
+}

package/src/reactNativeConfigurationContract.ts

@@ -0,0 +1,36 @@
+import type { SettingsValues } from './settingsContract.ts'
+
+// render workers mirror only these host-owned values. importing the settings
+// store here would also boot device selection, persistence and the ui schema.
+export const DEFAULT_REACT_NATIVE_CONFIGURATION = {
+  // the appearance setting itself (automatic, light or dark); the resolved
+  // scheme reaches workers through Appearance
+  colorScheme: 'auto',
+  language: 'en',
+  region: 'US',
+  fontSize: 1,
+  boldText: false,
+  reduceMotion: false,
+  largerAccessibilitySizes: false,
+  glassTintAmount: 0.5,
+  reduceTransparency: false,
+  increaseContrast: false,
+  showBorders: false,
+  onOffLabels: false,
+  differentiateWithoutColor: false,
+  smartInvert: false,
+  preferCrossFadeTransitions: false,
+} satisfies Partial<SettingsValues>
+
+export type ReactNativeConfigurationKey = keyof typeof DEFAULT_REACT_NATIVE_CONFIGURATION
+
+export type ReactNativeConfigurationSnapshot = Pick<
+  SettingsValues,
+  ReactNativeConfigurationKey
+>
+
+export const REACT_NATIVE_CONFIGURATION_KEYS = Object.keys(
+  DEFAULT_REACT_NATIVE_CONFIGURATION,
+).filter(
+  (key): key is ReactNativeConfigurationKey => key in DEFAULT_REACT_NATIVE_CONFIGURATION,
+)

package/src/runtime-assets.ts

@@ -54,7 +54,7 @@ export function findMonorepoRoot(): string | null {
 /** the fresh dev-stack engine build to serve when running inside the Contrast
  *  monorepo dev checkout, or null when the installed runtime should serve
  *  (published CLI, packaged electron, or an isolated PEACH_HOME). */
-export function resolveDevCheckoutRuntimeRoot(): string | null {
+export function resolveDevCheckoutRuntimeAssetRoot(): string | null {
   // an explicit home that has a STAGED/active runtime is the isolation the
   // CI/local-publish path sets up to validate the installed-runtime code path —
   // honor that staged runtime. an explicit home with NO active runtime is just
@@ -65,7 +65,12 @@ export function resolveDevCheckoutRuntimeRoot(): string | null {
   if (process.env.PEACH_HOME && readActiveRuntime()) return null
   const root = findMonorepoRoot()
   if (!root) return null
-  const devBuild = path.join(root, 'public/sootsim')
+  return path.join(root, 'public/sootsim')
+}
+
+export function resolveDevCheckoutRuntimeRoot(): string | null {
+  const devBuild = resolveDevCheckoutRuntimeAssetRoot()
+  if (!devBuild) return null
   // require the runtime shape the installed runtime also has, so serving it is
   // a drop-in (index.html shell + engine/ + both engine-tenant workers).
   if (

package/src/runtime-delivery.ts

@@ -11,6 +11,7 @@
 // out as a bare require.
 
 import { createRuntimeDelivery, type RuntimeProduct } from '@contrast/runtime-delivery'
+import { verifyCliCompanion } from './cli-runtime'
 import {
   cacheDir,
   configFilePath,
@@ -37,6 +38,7 @@ export const RNX_RUNTIME_PRODUCT: RuntimeProduct = {
   // engine-tenant/ beneath it. index.html is what the daemon and the
   // vite/metro plugins serve, so its absence means the tarball is not one.
   installedMarker: 'index.html',
+  verifyInstall: verifyCliCompanion,
   env: {
     cdnOrigin: 'PEACH_CDN_ORIGIN',
     channel: 'PEACH_RUNTIME_CHANNEL',

package/src/runtimePlatformContract.ts

@@ -0,0 +1,70 @@
+import type { RuntimePlatform } from './device-catalog.ts'
+
+export interface RuntimePlatformAdapterRegistry<Value> {
+  readonly ios: Value
+  readonly android: Value
+}
+
+interface IOSRuntimePlatformAdapter {
+  readonly id: 'ios'
+  readonly displayName: 'iOS'
+  readonly isIOS: true
+  readonly isAndroid: false
+  select<Value>(registry: RuntimePlatformAdapterRegistry<Value>): Value
+}
+
+interface AndroidRuntimePlatformAdapter {
+  readonly id: 'android'
+  readonly displayName: 'Android'
+  readonly isIOS: false
+  readonly isAndroid: true
+  select<Value>(registry: RuntimePlatformAdapterRegistry<Value>): Value
+}
+
+export type RuntimePlatformAdapter =
+  | IOSRuntimePlatformAdapter
+  | AndroidRuntimePlatformAdapter
+
+const IOS_ADAPTER = Object.freeze({
+  id: 'ios',
+  displayName: 'iOS',
+  isIOS: true,
+  isAndroid: false,
+  select: <Value>(registry: RuntimePlatformAdapterRegistry<Value>) => registry.ios,
+} satisfies IOSRuntimePlatformAdapter)
+
+const ANDROID_ADAPTER = Object.freeze({
+  id: 'android',
+  displayName: 'Android',
+  isIOS: false,
+  isAndroid: true,
+  select: <Value>(registry: RuntimePlatformAdapterRegistry<Value>) => registry.android,
+} satisfies AndroidRuntimePlatformAdapter)
+
+const RUNTIME_PLATFORM_ADAPTERS = Object.freeze({
+  ios: IOS_ADAPTER,
+  android: ANDROID_ADAPTER,
+} satisfies Record<RuntimePlatform, RuntimePlatformAdapter>)
+
+export function isRuntimePlatform(value: unknown): value is RuntimePlatform {
+  return value === 'ios' || value === 'android'
+}
+
+export function parseRuntimePlatform(
+  value: unknown,
+  boundary = 'runtime platform',
+): RuntimePlatform {
+  if (!isRuntimePlatform(value)) {
+    const received = typeof value === 'string' ? JSON.stringify(value) : String(value)
+    throw new Error(
+      `invalid ${boundary}: expected "ios" or "android", received ${received}`,
+    )
+  }
+  return value
+}
+
+export function getRuntimePlatformAdapter<Platform extends RuntimePlatform>(
+  platform: Platform,
+): (typeof RUNTIME_PLATFORM_ADAPTERS)[Platform] {
+  return RUNTIME_PLATFORM_ADAPTERS[platform]
+}