feat(windows): encrypt bundle

Author: triniwiz

lib/common/mobile/windows/windows-application-manager.ts

@@ -96,14 +96,42 @@ export class WindowsApplicationManager extends ApplicationManagerBase {
 				this.$logger.warn(`[Windows] Pre-install uninstall failed: ${err}`);
 			}
 		}
+		// Two distinct artifact shapes reach here (see WindowsProjectService's
+		// getValidBuildOutputData): a debug build resolves to the loose bin/ output's
+		// AppxManifest.xml, meant for `-Register` (in-place dev registration — no signature
+		// validation, matches "AppxManifest.xml triggers Add-AppxPackage -Register (dev flow)");
+		// a release build resolves to the packaged .msix/.msixupload under AppPackages/, which
+		// `-Register` rejects outright ("An invalid manifest file name was passed to this
+		// function") and which instead needs a plain package install via `-Path` — exactly what
+		// the generated Install.ps1/Add-AppDevPackage.ps1 next to it do. A `-Path` install of an
+		// unsigned release package still fails signature validation (0x800B0100); that's expected
+		// — pass `--certificate`/`--certificate-thumbprint` at build time for a sideloadable
+		// release package, this isn't something the install step can paper over.
+		const isLooseManifest = packageFilePath.toLowerCase().endsWith("appxmanifest.xml");
+		let addAppxCommand: string;
+		if (isLooseManifest) {
+			addAppxCommand = `Add-AppxPackage -ForceApplicationShutdown -Register -Path "${packageFilePath}"`;
+		} else {
+			// Thread through any Dependencies\<arch>\*.msix (e.g. the Windows App SDK runtime
+			// framework package) the same way Add-AppDevPackage.ps1 does via `-DependencyPath` —
+			// needed on a machine that doesn't already have that framework package installed.
+			const arch = process.arch === "arm64" ? "arm64" : "x64";
+			const dependencyDir = path.join(path.dirname(packageFilePath), "Dependencies", arch);
+			const dependencyGlob = path.join(dependencyDir, "*.msix");
+			addAppxCommand = fs.existsSync(dependencyDir)
+				? `$deps = Get-ChildItem -Path "${dependencyGlob}" -ErrorAction SilentlyContinue; ` +
+					`if ($deps) { Add-AppxPackage -Path "${packageFilePath}" -DependencyPath $deps.FullName -ForceApplicationShutdown } ` +
+					`else { Add-AppxPackage -Path "${packageFilePath}" -ForceApplicationShutdown }`
+				: `Add-AppxPackage -Path "${packageFilePath}" -ForceApplicationShutdown`;
+		}
 		await this.$childProcess.spawnFromEvent(
 			"powershell.exe",
 			[
 				"-NoProfile",
 				"-ExecutionPolicy",
 				"Bypass",
 				"-Command",
-				`Add-AppxPackage -ForceApplicationShutdown -Register -Path "${packageFilePath}"`,
+				addAppxCommand,
 			],
 			"close",
 			{},

lib/data/build-data.ts

@@ -52,6 +52,8 @@ export class WindowsBuildData extends BuildData {
 	public storeUpload: boolean;
 	public msixBundle: boolean;
 	public architectures: string[];
+	public sourceProtect: boolean;
+	public sourceProtectKeyHex: string;
 
 	constructor(projectDir: string, platform: string, data: any) {
 		super(projectDir, platform, data);
@@ -64,6 +66,8 @@ export class WindowsBuildData extends BuildData {
 		this.architectures = data.arch
 			? [data.arch]
 			: data.architectures ?? ["x64"];
+		this.sourceProtect = data.sourceProtect;
+		this.sourceProtectKeyHex = data.sourceProtectKeyHex;
 	}
 }
 

lib/definitions/project.d.ts

@@ -134,7 +134,14 @@ interface INsConfigIOS extends INsConfigPlaform {
 
 interface INSConfigVisionOS extends INsConfigIOS {}
 
-interface INsConfigWindows extends INsConfigPlaform {}
+interface INsConfigWindows extends INsConfigPlaform {
+	/**
+	 * Seal the app's webpack output into an encrypted app.nsbundle instead of shipping it as
+	 * plaintext. Only takes effect on release builds; overridable per-invocation with
+	 * --source-protect / --no-source-protect.
+	 */
+	sourceProtect?: boolean;
+}
 
 interface INsConfigAndroid extends INsConfigPlaform {
 	v8Flags?: string;

lib/options.ts

@@ -210,6 +210,8 @@ export class Options {
 			},
 			storeUpload: { type: OptionType.Boolean, hasSensitiveValue: false },
 			msixbundle: { type: OptionType.Boolean, hasSensitiveValue: false },
+			sourceProtect: { type: OptionType.Boolean, hasSensitiveValue: false },
+			sourceProtectKeyHex: { type: OptionType.String, hasSensitiveValue: true },
 			arch: { type: OptionType.String, hasSensitiveValue: false },
 			release: {
 				type: OptionType.Boolean,

lib/services/windows-project-service.ts

@@ -562,6 +562,57 @@ export class WindowsProjectService
 		catch (err) {
 			this.$logger.warn(`dotnet-tool check failed: ${err}`);
 		}
+
+		// Source protection: seal the just-written webpack output (app/) into an encrypted
+		// app.nsbundle via nsbundle_pack.
+		// Release builds only — HMR/LiveSync dev builds patch app/ incrementally, which a sealed
+		// container can't do, and --release/--hmr are already mutually exclusive CLI flags.
+		// Never fatal: a missing tool or failed pack just leaves the plaintext app/ folder, which
+		// the .csproj already falls back to via Condition="Exists('app.nsbundle')".
+		try {
+			const isRelease = !!(_prepareData as any)?.release;
+			const wantsSourceProtect =
+				(this.$options as any).sourceProtect ??
+				projectData?.nsConfig?.windows?.sourceProtect ??
+				false;
+			if (isRelease && wantsSourceProtect) {
+				const arch = process.arch === "arm64" ? "arm64" : "x64";
+				const packCandidates = [
+					process.env.NSBUNDLE_PACK_PATH,
+					path.join(platformData.projectRoot, "tools", `nsbundle_pack-${arch}.exe`),
+					path.join(platformData.projectRoot, "tools", "nsbundle_pack.exe"),
+				].filter(Boolean as any);
+				let packExe: string | null = null;
+				for (const p of packCandidates) {
+					if (p && fs.existsSync(p)) { packExe = p as string; break; }
+				}
+				if (packExe) {
+					const keyHex =
+						(this.$options as any).sourceProtectKeyHex ||
+						process.env.NS_WINDOWS_BUNDLE_KEY;
+					const args = [
+						"--input", path.join(appProjectDir, "app"),
+						"--output", path.join(appProjectDir, "app.nsbundle"),
+					];
+					if (keyHex) { args.push("--key-hex", keyHex); }
+					this.$logger.info(`Running nsbundle_pack (source protection): ${packExe}`);
+					try {
+						const result = await this.$childProcess.spawnFromEvent(packExe, args, "close", { cwd: platformData.projectRoot }, { throwError: false });
+						if (result && result.stdout) { this.$logger.info(result.stdout); }
+					}
+					catch (err) {
+						this.$logger.warn(`nsbundle_pack execution failed: ${err}`);
+					}
+				}
+				else {
+					this.$logger.info("Source protection requested but nsbundle_pack.exe was not found under tools/ — skipping (plaintext app/ will be packaged).");
+				}
+			}
+		}
+		catch (err) {
+			this.$logger.warn(`Source protection check failed: ${err}`);
+		}
+
 		const pluginsDir = path.join(appProjectDir, "plugins");
 
 		// Ensure plugins directory exists inside the platform app folder (where csproj expects it)