@_linked/cli 1.18.0 → 1.19.1

package/lib/esm/app-release/create-release-manifest.js

@@ -0,0 +1,238 @@
+import crypto from 'crypto';
+import { execFileSync } from 'child_process';
+import fs from 'fs';
+import path from 'path';
+import { joinObjectKey, normalizeReleasePath, resolveExistingPathWithinRoot, } from './paths.js';
+import { resolveDeclaredStaticAssets } from './static-assets.js';
+const MIME_TYPES = {
+    '.css': 'text/css; charset=utf-8',
+    '.gif': 'image/gif',
+    '.html': 'text/html; charset=utf-8',
+    '.ico': 'image/x-icon',
+    '.jpeg': 'image/jpeg',
+    '.jpg': 'image/jpeg',
+    '.js': 'text/javascript; charset=utf-8',
+    '.json': 'application/json; charset=utf-8',
+    '.map': 'application/json; charset=utf-8',
+    '.png': 'image/png',
+    '.svg': 'image/svg+xml',
+    '.webp': 'image/webp',
+    '.woff': 'font/woff',
+    '.woff2': 'font/woff2',
+};
+export const DEFAULT_RELEASE_PREFIX = 'releases';
+export const MANIFEST_FILE_NAME = 'linked-release.json';
+export const MANIFEST_SOURCE_PATH = `public/bundles/${MANIFEST_FILE_NAME}`;
+export const MANIFEST_CONTENT_TYPE = 'application/json; charset=utf-8';
+/**
+ * Cache-Control rule, decided by where a file came from rather than by what it
+ * is called.
+ *
+ * Files listed in the Vite manifest are content-hashed by construction — Vite
+ * emitted the name, so the bytes behind that key can never change and the
+ * object is immutable for a year. Everything else (declared static assets, the
+ * release manifest) is revalidated after a minute, so a re-published release is
+ * picked up quickly. Guessing "is this hashed?" from the filename was tried and
+ * removed: `og-image-1200x630.png`, `sw-v20260101.js` and `icon-FacebookRound.svg`
+ * all read as hashed, and a year of immutable caching on those cannot be undone
+ * without renaming the file.
+ */
+export const IMMUTABLE_CACHE_CONTROL = 'public, max-age=31536000, immutable';
+export const ENTRY_CACHE_CONTROL = 'public, max-age=60, must-revalidate';
+const getContentType = (filePath) => MIME_TYPES[path.extname(filePath).toLowerCase()] || 'application/octet-stream';
+export const getCacheControl = (origin) => origin === 'vite-bundle' ? IMMUTABLE_CACHE_CONTROL : ENTRY_CACHE_CONTROL;
+/** A revision has to be safe to embed in an object key and a URL. */
+const SAFE_REVISION = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+const runGit = (appRoot, args) => execFileSync('git', args, {
+    cwd: appRoot,
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'ignore'],
+});
+/**
+ * Determine the revision that identifies this release.
+ *
+ * An explicit `--revision`, then `LINKED_RELEASE_REVISION`, then `GITHUB_SHA`
+ * win over Git, so a release can be built from an exported tarball or a CI
+ * checkout that is not a working repository. Falling back to `git rev-parse`
+ * requires a clean tree: two builds of the same uncommitted work would
+ * otherwise share a release ID and a prefix, silently overwriting each other
+ * while files removed in between linger under the prefix.
+ */
+export const resolveSourceRevision = ({ appRoot, revision, allowDirty, env = process.env, }) => {
+    const explicit = (revision ||
+        env.LINKED_RELEASE_REVISION ||
+        env.GITHUB_SHA ||
+        '').trim();
+    if (explicit) {
+        if (!SAFE_REVISION.test(explicit)) {
+            throw new Error(`Invalid release revision "${explicit}". Use letters, digits, ".", "-" or "_".`);
+        }
+        return explicit;
+    }
+    let head;
+    try {
+        head = runGit(appRoot, ['rev-parse', '--short=12', 'HEAD']).trim();
+    }
+    catch (_a) {
+        throw new Error('Cannot determine the Git revision for this release. Build from a Git checkout, ' +
+            'or pass --revision <sha> (or set LINKED_RELEASE_REVISION / GITHUB_SHA).');
+    }
+    let dirty = false;
+    try {
+        dirty = runGit(appRoot, ['status', '--porcelain']).trim().length > 0;
+    }
+    catch (_b) {
+        // `rev-parse` worked, so this is a repository; treat an unreadable status
+        // as clean rather than blocking the build on a Git quirk.
+    }
+    if (!dirty)
+        return head;
+    if (!allowDirty) {
+        throw new Error(`The working tree has uncommitted changes, so release ${head} would not identify ` +
+            'what was built: a second build of the same edits reuses the prefix and overwrites it. ' +
+            'Commit or stash the changes, pass --allow-dirty to publish as ' +
+            `"${head}-dirty", or pass --revision <sha>.`);
+    }
+    return `${head}-dirty`;
+};
+const collectViteOutputPaths = (manifest) => {
+    const files = new Set();
+    for (const [entryName, entry] of Object.entries(manifest)) {
+        if (!entry || typeof entry.file !== 'string') {
+            throw new Error(`Invalid Vite manifest entry: ${entryName}`);
+        }
+        files.add(joinObjectKey('public/bundles', entry.file));
+        for (const relativePath of [...(entry.css || []), ...(entry.assets || [])]) {
+            files.add(joinObjectKey('public/bundles', relativePath));
+        }
+        for (const importedEntry of [
+            ...(entry.imports || []),
+            ...(entry.dynamicImports || []),
+        ]) {
+            if (!manifest[importedEntry]) {
+                throw new Error(`Vite manifest entry ${entryName} references missing import ${importedEntry}`);
+            }
+        }
+    }
+    return [...files];
+};
+/**
+ * Build the key prefix for one release. Every object of a release lives under
+ * it, so publishing a new release cannot overwrite the previous one and a
+ * rollback is a matter of pointing at the older prefix.
+ */
+export const buildReleasePrefix = (releaseId, basePrefix = DEFAULT_RELEASE_PREFIX) => joinObjectKey(basePrefix, releaseId);
+export const releaseObjectKey = (releasePrefix, sourcePath) => joinObjectKey(releasePrefix, sourcePath);
+/** Directory `vite build` writes the client bundle to. See the README. */
+export const VITE_OUTPUT_DIR = 'public/bundles';
+/**
+ * Public URL the client bundle of a release is served from. Object keys are
+ * `<releasePrefix>/public/bundles/…` under the store's `accessURL`, and this is
+ * the value the build passes to Vite as `base`, so the root-absolute URLs the
+ * bundle emits for its own chunks and assets resolve under the release prefix
+ * without any server rewrite.
+ */
+export const releaseBaseURL = (accessURL, releasePrefix) => `${releaseStaticAccessURL(accessURL, releasePrefix)}/${VITE_OUTPUT_DIR}/`;
+/**
+ * The release's root URL: `accessURL` plus the release prefix, without the
+ * bundle directory. `@_linked/server` builds the HTML entry tags as
+ * `${STATIC_ACCESS_URL}/public/bundles/<file>`, so pointing `STATIC_ACCESS_URL`
+ * at this value is what makes a running app serve one particular release —
+ * a value to deploy, not server code to write or a rewrite rule to configure.
+ */
+export const releaseStaticAccessURL = (accessURL, releasePrefix) => `${(accessURL || '').trim().replace(/\/+$/, '')}/${releasePrefix}`;
+/**
+ * Work out the release ID and prefix before anything is built. The client
+ * bundle has to be built with the release prefix as its `base`, so the prefix
+ * cannot wait until the manifest is written.
+ */
+export const resolveReleaseIdentity = (options) => {
+    const packageJson = JSON.parse(fs.readFileSync(path.join(options.appRoot, 'package.json'), 'utf8'));
+    const sourceRevision = resolveSourceRevision({
+        appRoot: options.appRoot,
+        revision: options.sourceRevision,
+        allowDirty: options.allowDirty,
+        env: options.env,
+    });
+    const releaseId = `${packageJson.version}-${sourceRevision}`;
+    return {
+        appName: packageJson.name,
+        appVersion: packageJson.version,
+        sourceRevision,
+        releaseId,
+        releasePrefix: buildReleasePrefix(releaseId, options.releasePrefix),
+    };
+};
+const describeReleaseFile = (appRoot, releasePrefix, sourcePath, origin) => {
+    const normalizedSourcePath = normalizeReleasePath(sourcePath, 'source path');
+    const absolutePath = resolveExistingPathWithinRoot(appRoot, normalizedSourcePath);
+    const content = fs.readFileSync(absolutePath);
+    return {
+        sourcePath: normalizedSourcePath,
+        objectKey: releaseObjectKey(releasePrefix, normalizedSourcePath),
+        sha256: crypto.createHash('sha256').update(content).digest('hex'),
+        size: content.byteLength,
+        contentType: getContentType(normalizedSourcePath),
+        cacheControl: getCacheControl(origin),
+    };
+};
+export const createReleaseManifest = (options) => {
+    var _a;
+    const identity = resolveReleaseIdentity({
+        appRoot: options.appRoot,
+        releasePrefix: options.releasePrefix,
+        sourceRevision: options.sourceRevision,
+        allowDirty: options.allowDirty,
+    });
+    const { releasePrefix } = identity;
+    // A Capacitor build ships its assets inside the native app, so it produces a
+    // manifest for local inspection only and is never uploaded. That is why it
+    // needs no destination and is marked unpublishable.
+    const publishable = options.target === 'web';
+    if (publishable && options.accessURL === undefined) {
+        throw new Error('A web release manifest requires the accessURL of the store it will be published to');
+    }
+    // Origin decides the cache policy: Vite named these files after their own
+    // content, so they are immutable; declared static assets keep their name
+    // across releases and must be revalidated.
+    const origins = new Map();
+    if (options.target === 'web') {
+        const viteManifestPath = path.join(options.appRoot, `${VITE_OUTPUT_DIR}/.vite/manifest.json`);
+        const viteManifest = JSON.parse(fs.readFileSync(viteManifestPath, 'utf8'));
+        for (const sourcePath of collectViteOutputPaths(viteManifest)) {
+            origins.set(sourcePath, 'vite-bundle');
+        }
+    }
+    for (const sourcePath of resolveDeclaredStaticAssets(options.appRoot, options.staticAssets)) {
+        if (!origins.has(sourcePath))
+            origins.set(sourcePath, 'static-asset');
+    }
+    const files = [...origins.entries()]
+        .map(([sourcePath, origin]) => describeReleaseFile(options.appRoot, releasePrefix, sourcePath, origin))
+        .sort((a, b) => a.objectKey.localeCompare(b.objectKey));
+    return {
+        schemaVersion: 1,
+        appName: identity.appName,
+        appVersion: identity.appVersion,
+        releaseId: identity.releaseId,
+        target: options.target,
+        publishable,
+        builtAt: options.builtAt || new Date().toISOString(),
+        environmentNames: [...options.environmentNames],
+        destination: {
+            accessURL: options.accessURL || '',
+            releasePrefix,
+            baseURL: (_a = options.baseURL) !== null && _a !== void 0 ? _a : (options.accessURL
+                ? releaseBaseURL(options.accessURL, releasePrefix)
+                : ''),
+        },
+        files,
+    };
+};
+export const serializeReleaseManifest = (manifest) => `${JSON.stringify(manifest, null, 2)}\n`;
+export const writeReleaseManifest = (appRoot, manifest) => {
+    const outputPath = path.join(appRoot, MANIFEST_SOURCE_PATH);
+    fs.writeFileSync(outputPath, serializeReleaseManifest(manifest));
+    return outputPath;
+};
+//# sourceMappingURL=create-release-manifest.js.map

package/lib/esm/app-release/create-release-manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-release-manifest.js","sourceRoot":"","sources":["../../../src/app-release/create-release-manifest.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAC,YAAY,EAAC,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,6BAA6B,GAC9B,MAAM,YAAY,CAAC;AACpB,OAAO,EAAC,2BAA2B,EAAC,MAAM,oBAAoB,CAAC;AA0C/D,MAAM,UAAU,GAA2B;IACzC,MAAM,EAAE,yBAAyB;IACjC,MAAM,EAAE,WAAW;IACnB,OAAO,EAAE,0BAA0B;IACnC,MAAM,EAAE,cAAc;IACtB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,YAAY;IACpB,KAAK,EAAE,gCAAgC;IACvC,OAAO,EAAE,iCAAiC;IAC1C,MAAM,EAAE,iCAAiC;IACzC,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,eAAe;IACvB,OAAO,EAAE,YAAY;IACrB,OAAO,EAAE,WAAW;IACpB,QAAQ,EAAE,YAAY;CACvB,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAG,UAAU,CAAC;AACjD,MAAM,CAAC,MAAM,kBAAkB,GAAG,qBAAqB,CAAC;AACxD,MAAM,CAAC,MAAM,oBAAoB,GAAG,kBAAkB,kBAAkB,EAAE,CAAC;AAC3E,MAAM,CAAC,MAAM,qBAAqB,GAAG,iCAAiC,CAAC;AAEvE;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,qCAAqC,CAAC;AAC7E,MAAM,CAAC,MAAM,mBAAmB,GAAG,qCAAqC,CAAC;AAKzE,MAAM,cAAc,GAAG,CAAC,QAAgB,EAAU,EAAE,CAClD,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,0BAA0B,CAAC;AAEjF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,MAAyB,EAAU,EAAE,CACnE,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,mBAAmB,CAAC;AAE3E,qEAAqE;AACrE,MAAM,aAAa,GAAG,mCAAmC,CAAC;AAE1D,MAAM,MAAM,GAAG,CAAC,OAAe,EAAE,IAAc,EAAU,EAAE,CACzD,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE;IACxB,GAAG,EAAE,OAAO;IACZ,QAAQ,EAAE,MAAM;IAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;CACpC,CAAC,CAAC;AAWL;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,EACpC,OAAO,EACP,QAAQ,EACR,UAAU,EACV,GAAG,GAAG,OAAO,CAAC,GAAG,GACY,EAAU,EAAE;IACzC,MAAM,QAAQ,GAAG,CACf,QAAQ;QACR,GAAG,CAAC,uBAAuB;QAC3B,GAAG,CAAC,UAAU;QACd,EAAE,CACH,CAAC,IAAI,EAAE,CAAC;IACT,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACb,6BAA6B,QAAQ,0CAA0C,CAChF,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACrE,CAAC;IAAC,WAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,iFAAiF;YAC/E,yEAAyE,CAC5E,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IACvE,CAAC;IAAC,WAAM,CAAC;QACP,0EAA0E;QAC1E,0DAA0D;IAC5D,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,wDAAwD,IAAI,sBAAsB;YAChF,wFAAwF;YACxF,gEAAgE;YAChE,IAAI,IAAI,oCAAoC,CAC/C,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,IAAI,QAAQ,CAAC;AACzB,CAAC,CAAC;AAEF,MAAM,sBAAsB,GAAG,CAAC,QAAsB,EAAY,EAAE;IAClE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAEhC,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1D,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,gCAAgC,SAAS,EAAE,CAAC,CAAC;QAC/D,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,gBAAgB,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACvD,KAAK,MAAM,YAAY,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YAC3E,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC,CAAC;QAC3D,CAAC;QAED,KAAK,MAAM,aAAa,IAAI;YAC1B,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC;YACxB,GAAG,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC;SAChC,EAAE,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CACb,uBAAuB,SAAS,8BAA8B,aAAa,EAAE,CAC9E,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACpB,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,SAAiB,EACjB,aAAqB,sBAAsB,EACnC,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;AAElD,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,aAAqB,EACrB,UAAkB,EACV,EAAE,CAAC,aAAa,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;AAEtD,0EAA0E;AAC1E,MAAM,CAAC,MAAM,eAAe,GAAG,gBAAgB,CAAC;AAEhD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,SAAiB,EACjB,aAAqB,EACb,EAAE,CACV,GAAG,sBAAsB,CAAC,SAAS,EAAE,aAAa,CAAC,IAAI,eAAe,GAAG,CAAC;AAE5E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,SAAiB,EACjB,aAAqB,EACb,EAAE,CACV,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,aAAa,EAAE,CAAC;AAUrE;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,OAMtC,EAAmB,EAAE;IACpB,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAC5B,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CACpE,CAAC;IACF,MAAM,cAAc,GAAG,qBAAqB,CAAC;QAC3C,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,QAAQ,EAAE,OAAO,CAAC,cAAc;QAChC,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,GAAG,WAAW,CAAC,OAAO,IAAI,cAAc,EAAE,CAAC;IAC7D,OAAO;QACL,OAAO,EAAE,WAAW,CAAC,IAAI;QACzB,UAAU,EAAE,WAAW,CAAC,OAAO;QAC/B,cAAc;QACd,SAAS;QACT,aAAa,EAAE,kBAAkB,CAAC,SAAS,EAAE,OAAO,CAAC,aAAa,CAAC;KACpE,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,mBAAmB,GAAG,CAC1B,OAAe,EACf,aAAqB,EACrB,UAAkB,EAClB,MAAyB,EACH,EAAE;IACxB,MAAM,oBAAoB,GAAG,oBAAoB,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAC7E,MAAM,YAAY,GAAG,6BAA6B,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;IAClF,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;IAE9C,OAAO;QACL,UAAU,EAAE,oBAAoB;QAChC,SAAS,EAAE,gBAAgB,CAAC,aAAa,EAAE,oBAAoB,CAAC;QAChE,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QACjE,IAAI,EAAE,OAAO,CAAC,UAAU;QACxB,WAAW,EAAE,cAAc,CAAC,oBAAoB,CAAC;QACjD,YAAY,EAAE,eAAe,CAAC,MAAM,CAAC;KACtC,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,OAAqC,EACX,EAAE;;IAC5B,MAAM,QAAQ,GAAG,sBAAsB,CAAC;QACtC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,UAAU,EAAE,OAAO,CAAC,UAAU;KAC/B,CAAC,CAAC;IACH,MAAM,EAAC,aAAa,EAAC,GAAG,QAAQ,CAAC;IAEjC,6EAA6E;IAC7E,2EAA2E;IAC3E,oDAAoD;IACpD,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC;IAC7C,IAAI,WAAW,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,oFAAoF,CACrF,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,yEAAyE;IACzE,2CAA2C;IAC3C,MAAM,OAAO,GAAG,IAAI,GAAG,EAA6B,CAAC;IACrD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC7B,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAChC,OAAO,CAAC,OAAO,EACf,GAAG,eAAe,sBAAsB,CACzC,CAAC;QACF,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAC7B,EAAE,CAAC,YAAY,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAC1B,CAAC;QAClB,KAAK,MAAM,UAAU,IAAI,sBAAsB,CAAC,YAAY,CAAC,EAAE,CAAC;YAC9D,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IACD,KAAK,MAAM,UAAU,IAAI,2BAA2B,CAClD,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,YAAY,CACrB,EAAE,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;SACjC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,EAAE,CAC5B,mBAAmB,CAAC,OAAO,CAAC,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,CAAC,CACxE;SACA,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IAE1D,OAAO;QACL,aAAa,EAAE,CAAC;QAChB,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,WAAW;QACX,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpD,gBAAgB,EAAE,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC;QAC/C,WAAW,EAAE;YACX,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,EAAE;YAClC,aAAa;YACb,OAAO,EACL,MAAA,OAAO,CAAC,OAAO,mCACf,CAAC,OAAO,CAAC,SAAS;gBAChB,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,SAAS,EAAE,aAAa,CAAC;gBAClD,CAAC,CAAC,EAAE,CAAC;SACV;QACD,KAAK;KACN,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,wBAAwB,GAAG,CACtC,QAAkC,EAC1B,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AAEtD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,OAAe,EACf,QAAkC,EAC1B,EAAE;IACV,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;IAC5D,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjE,OAAO,UAAU,CAAC;AACpB,CAAC,CAAC"}

package/lib/esm/app-release/paths.d.ts

@@ -0,0 +1,5 @@
+export declare const normalizeReleasePath: (value: string, label?: string) => string;
+export declare const joinObjectKey: (...segments: string[]) => string;
+export declare const resolveExistingPathWithinRoot: (appRoot: string, relativePath: string) => string;
+export declare const joinStaticAssetUrl: (publicBaseUrl: string, assetPath: string) => string;
+//# sourceMappingURL=paths.d.ts.map

package/lib/esm/app-release/paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../../src/app-release/paths.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,oBAAoB,GAC/B,OAAO,MAAM,EACb,QAAO,MAAuB,KAC7B,MAiBF,CAAC;AAEF,eAAO,MAAM,aAAa,GAAI,GAAG,UAAU,MAAM,EAAE,KAAG,MAMrD,CAAC;AAEF,eAAO,MAAM,6BAA6B,GACxC,SAAS,MAAM,EACf,cAAc,MAAM,KACnB,MAeF,CAAC;AAEF,eAAO,MAAM,kBAAkB,GAC7B,eAAe,MAAM,EACrB,WAAW,MAAM,KAChB,MASF,CAAC"}

package/lib/esm/app-release/paths.js

@@ -0,0 +1,44 @@
+import fs from 'fs';
+import path from 'path';
+const WINDOWS_ABSOLUTE_PATH = /^[a-zA-Z]:[\\/]/;
+export const normalizeReleasePath = (value, label = 'release path') => {
+    const slashPath = value.replace(/\\/g, '/').trim();
+    if (!slashPath || slashPath === '.') {
+        throw new Error(`${label} must not be empty`);
+    }
+    if (path.posix.isAbsolute(slashPath) || WINDOWS_ABSOLUTE_PATH.test(value)) {
+        throw new Error(`${label} must be relative: ${value}`);
+    }
+    const normalized = path.posix.normalize(slashPath).replace(/^\.\//, '');
+    if (normalized === '..' || normalized.startsWith('../')) {
+        throw new Error(`${label} must stay inside the application root: ${value}`);
+    }
+    return normalized;
+};
+export const joinObjectKey = (...segments) => {
+    if (segments.length === 0) {
+        throw new Error('object key must not be empty');
+    }
+    return normalizeReleasePath(segments.join('/'), 'object key');
+};
+export const resolveExistingPathWithinRoot = (appRoot, relativePath) => {
+    const normalized = normalizeReleasePath(relativePath, 'source path');
+    const rootRealPath = fs.realpathSync(appRoot);
+    const candidateRealPath = fs.realpathSync(path.resolve(rootRealPath, normalized));
+    const relativeToRoot = path.relative(rootRealPath, candidateRealPath);
+    if (relativeToRoot === '..' ||
+        relativeToRoot.startsWith(`..${path.sep}`) ||
+        path.isAbsolute(relativeToRoot)) {
+        throw new Error(`source path escapes the application root: ${relativePath}`);
+    }
+    return candidateRealPath;
+};
+export const joinStaticAssetUrl = (publicBaseUrl, assetPath) => {
+    const normalizedAssetPath = normalizeReleasePath(assetPath, 'asset path');
+    const normalizedBaseUrl = publicBaseUrl.trim().replace(/\/+$/, '');
+    if (!normalizedBaseUrl) {
+        throw new Error('public base URL must not be empty');
+    }
+    return `${normalizedBaseUrl}/${normalizedAssetPath}`;
+};
+//# sourceMappingURL=paths.js.map

package/lib/esm/app-release/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../../src/app-release/paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,MAAM,qBAAqB,GAAG,iBAAiB,CAAC;AAEhD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,KAAa,EACb,QAAgB,cAAc,EACtB,EAAE;IACV,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAEnD,IAAI,CAAC,SAAS,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,sBAAsB,KAAK,EAAE,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACxE,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,2CAA2C,KAAK,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,GAAG,QAAkB,EAAU,EAAE;IAC7D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IAED,OAAO,oBAAoB,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,YAAY,CAAC,CAAC;AAChE,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAC3C,OAAe,EACf,YAAoB,EACZ,EAAE;IACV,MAAM,UAAU,GAAG,oBAAoB,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;IACrE,MAAM,YAAY,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,iBAAiB,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC;IAClF,MAAM,cAAc,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC;IAEtE,IACE,cAAc,KAAK,IAAI;QACvB,cAAc,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;QAC1C,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAC/B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6CAA6C,YAAY,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,OAAO,iBAAiB,CAAC;AAC3B,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,aAAqB,EACrB,SAAiB,EACT,EAAE;IACV,MAAM,mBAAmB,GAAG,oBAAoB,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAC1E,MAAM,iBAAiB,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAEnE,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IAED,OAAO,GAAG,iBAAiB,IAAI,mBAAmB,EAAE,CAAC;AACvD,CAAC,CAAC"}

package/lib/esm/app-release/publisher.d.ts

@@ -0,0 +1,25 @@
+import type { IFileStore } from '@_linked/core/interfaces/IFileStore';
+import type { LinkedAppReleaseManifest, PublishPlan, PublishResult } from './types.js';
+export interface PlanReleasePublishOptions {
+    appRoot: string;
+    manifestPath?: string;
+    store: IFileStore;
+}
+export interface LoadedReleaseManifest {
+    absolutePath: string;
+    manifest: LinkedAppReleaseManifest;
+}
+export interface PublishReleaseOptions extends PlanReleasePublishOptions {
+    yes?: boolean;
+    onProgress?: (progress: PublishProgress) => void;
+    onWarning?: (message: string) => void;
+}
+export interface PublishProgress {
+    completed: number;
+    total: number;
+    objectKey: string;
+}
+export declare const loadReleaseManifest: (appRoot: string, manifestPath?: string) => LoadedReleaseManifest;
+export declare const planReleasePublish: (options: PlanReleasePublishOptions) => PublishPlan;
+export declare const publishRelease: (options: PublishReleaseOptions) => Promise<PublishResult>;
+//# sourceMappingURL=publisher.d.ts.map

package/lib/esm/app-release/publisher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"publisher.d.ts","sourceRoot":"","sources":["../../../src/app-release/publisher.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,qCAAqC,CAAC;AASpE,OAAO,KAAK,EAEV,wBAAwB,EACxB,WAAW,EACX,aAAa,EACd,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,wBAAwB,CAAC;CACpC;AAED,MAAM,WAAW,qBAAsB,SAAQ,yBAAyB;IACtE,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,eAAe,KAAK,IAAI,CAAC;IACjD,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACvC;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AAkCD,eAAO,MAAM,mBAAmB,GAC9B,SAAS,MAAM,EACf,qBAAmC,KAClC,qBA6BF,CAAC;AA2CF,eAAO,MAAM,kBAAkB,GAC7B,SAAS,yBAAyB,KACjC,WAsBF,CAAC;AAkCF,eAAO,MAAM,cAAc,GACzB,SAAS,qBAAqB,KAC7B,OAAO,CAAC,aAAa,CAgJvB,CAAC"}

package/lib/esm/app-release/publisher.js

@@ -0,0 +1,238 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import crypto from 'crypto';
+import fs from 'fs';
+import { normalizeAccessURL } from './app-assets-store.js';
+import { MANIFEST_CONTENT_TYPE, MANIFEST_SOURCE_PATH, ENTRY_CACHE_CONTROL, releaseObjectKey, } from './create-release-manifest.js';
+import { normalizeReleasePath, resolveExistingPathWithinRoot } from './paths.js';
+/**
+ * Every object of a release must land under that release's own prefix.
+ *
+ * The manifest is a plain file on disk: a hand-edited or foreign one can name
+ * any `objectKey` it likes, and nothing else catches it — the `accessURL` check
+ * only proves the store is the right store, and the stored-location check only
+ * proves the store kept the key it was handed. So the key is not merely checked
+ * for shape, it is recomputed: it has to be exactly what this release prefix and
+ * this source path produce, or a release could overwrite a *different* release.
+ */
+const validateObjectKey = (releasePrefix, file) => {
+    var _a, _b;
+    const sourcePath = normalizeReleasePath(String((_a = file.sourcePath) !== null && _a !== void 0 ? _a : ''), 'source path');
+    const objectKey = normalizeReleasePath(String((_b = file.objectKey) !== null && _b !== void 0 ? _b : ''), 'object key');
+    const expected = releaseObjectKey(releasePrefix, sourcePath);
+    if (objectKey !== expected) {
+        throw new Error(`Release manifest object key is not under the release prefix: ` +
+            `"${file.objectKey}" (expected "${expected}"). Rebuild the release; ` +
+            'a manifest may only upload to its own prefix.');
+    }
+};
+export const loadReleaseManifest = (appRoot, manifestPath = MANIFEST_SOURCE_PATH) => {
+    var _a;
+    const absolutePath = resolveExistingPathWithinRoot(appRoot, manifestPath);
+    const manifest = JSON.parse(fs.readFileSync(absolutePath, 'utf8'));
+    if (manifest.schemaVersion !== 1) {
+        throw new Error(`Unsupported release manifest schema: ${manifest.schemaVersion}`);
+    }
+    if (manifest.target !== 'web' || manifest.publishable !== true) {
+        throw new Error('Only publishable web release manifests may be uploaded');
+    }
+    if (!Array.isArray(manifest.files) || manifest.files.length === 0) {
+        throw new Error('Release manifest contains no files');
+    }
+    if (!((_a = manifest.destination) === null || _a === void 0 ? void 0 : _a.releasePrefix)) {
+        throw new Error('Release manifest has no release prefix');
+    }
+    const releasePrefix = normalizeReleasePath(manifest.destination.releasePrefix, 'release prefix');
+    for (const file of manifest.files) {
+        validateObjectKey(releasePrefix, file);
+    }
+    return { absolutePath, manifest };
+};
+/**
+ * The manifest records the `accessURL` of the store it was built for. If the
+ * configured store now writes somewhere else, the release is not the one that
+ * was built and publishing stops. Trailing slashes are not significant.
+ */
+const validateDestination = (manifest, store) => {
+    const expected = normalizeAccessURL(manifest.destination.accessURL);
+    const actual = normalizeAccessURL(store.accessURL);
+    if (expected !== actual) {
+        throw new Error(`Release destination does not match the manifest (manifest was built for ${expected || '(empty)'}, the configured appAssets store writes to ${actual || '(empty)'})`);
+    }
+};
+const hashBuffer = (content) => crypto.createHash('sha256').update(content).digest('hex');
+/**
+ * Re-hash the file on disk before uploading. This needs no support from the
+ * store and is what actually guarantees the bytes match the manifest.
+ */
+const validateLocalFile = (appRoot, file) => {
+    // `resolveExistingPathWithinRoot` resolves symlinks, so a source path that
+    // points out of the app root through one is refused here too.
+    const absolutePath = resolveExistingPathWithinRoot(appRoot, file.sourcePath);
+    const content = fs.readFileSync(absolutePath);
+    if (content.byteLength !== file.size || hashBuffer(content) !== file.sha256) {
+        throw new Error(`Release artifact changed after build: ${file.sourcePath}`);
+    }
+    return absolutePath;
+};
+export const planReleasePublish = (options) => {
+    const { absolutePath, manifest } = loadReleaseManifest(options.appRoot, options.manifestPath);
+    validateDestination(manifest, options.store);
+    for (const file of manifest.files) {
+        validateLocalFile(options.appRoot, file);
+    }
+    return {
+        releaseId: manifest.releaseId,
+        manifestPath: absolutePath,
+        manifestObjectKey: releaseObjectKey(manifest.destination.releasePrefix, MANIFEST_SOURCE_PATH),
+        destination: manifest.destination,
+        files: manifest.files,
+        totalBytes: manifest.files.reduce((total, file) => total + file.size, 0),
+    };
+};
+/**
+ * Verify one uploaded object against the hash in the manifest.
+ *
+ * `statFile` is optional on `IFileStore`, and a store that has it may still
+ * report no `sha256` (S3 only returns one when the object carries a checksum).
+ * Neither case is a failure: verification is skipped, the key is reported back
+ * as unverified, and the caller warns once. An `etag` is deliberately not used
+ * as a substitute — it is not a content hash.
+ */
+const verifyUpload = (store, objectKey, expected) => __awaiter(void 0, void 0, void 0, function* () {
+    if (typeof store.statFile !== 'function')
+        return 'unsupported';
+    const stat = yield store.statFile(objectKey);
+    if (!stat) {
+        throw new Error(`Uploaded artifact is missing from the store: ${objectKey}`);
+    }
+    if (stat.size !== expected.size) {
+        throw new Error(`Uploaded artifact size does not match the manifest: ${objectKey}`);
+    }
+    if (!stat.sha256)
+        return 'no-hash';
+    if (stat.sha256 !== expected.sha256) {
+        throw new Error(`Uploaded artifact verification failed: ${objectKey}`);
+    }
+    return 'verified';
+});
+export const publishRelease = (options) => __awaiter(void 0, void 0, void 0, function* () {
+    var _a, _b;
+    const plan = planReleasePublish(options);
+    if (!options.yes) {
+        return {
+            releaseId: plan.releaseId,
+            uploadedFiles: 0,
+            uploadedBytes: 0,
+            dryRun: true,
+            unverified: [],
+        };
+    }
+    const unverified = [];
+    let warnedAboutVerification = false;
+    const noteUnverified = (objectKey, reason) => {
+        var _a;
+        unverified.push(objectKey);
+        if (warnedAboutVerification)
+            return;
+        warnedAboutVerification = true;
+        (_a = options.onWarning) === null || _a === void 0 ? void 0 : _a.call(options, `Cannot verify uploads against a store hash (${reason}). Files are still ` +
+            'checked against the manifest before upload; the remote copy is not re-checked.');
+    };
+    const upload = (objectKey, content, contentType, cacheControl, sha256) => __awaiter(void 0, void 0, void 0, function* () {
+        // `preventDuplicates: false` is explicit: a release key must be exactly the
+        // key in the manifest. `LocalFileStore` otherwise appends a random suffix,
+        // which would both break the URL and make verification meaningless.
+        const storedURL = yield options.store.saveFile(objectKey, content, {
+            mimeType: contentType,
+            cacheControl,
+            preventDuplicates: false,
+        });
+        // A release key has to survive the round trip verbatim, or the published
+        // URLs in the bundle point at nothing. Some stores sanitise or suffix the
+        // path they are given; say so plainly instead of failing later with a
+        // confusing "missing from the store".
+        if (typeof storedURL === 'string' && !storedURL.endsWith(objectKey)) {
+            throw new Error(`The file store did not store the release object under its own key. ` +
+                `Expected a location ending in "${objectKey}", got "${storedURL}". ` +
+                'A release store must keep object keys verbatim.');
+        }
+        const outcome = yield verifyUpload(options.store, objectKey, {
+            size: content.byteLength,
+            sha256,
+        });
+        if (outcome === 'unsupported') {
+            noteUnverified(objectKey, 'this store does not implement statFile');
+        }
+        else if (outcome === 'no-hash') {
+            noteUnverified(objectKey, 'the store reports no sha256 for stored objects');
+        }
+    });
+    const totalUploads = plan.files.length + 1;
+    let completedUploads = 0;
+    /**
+     * A failure halfway through leaves a partial prefix behind, so the message
+     * has to say which object failed, where it was going and how much is already
+     * there — and that a re-run finishes the job, since keys are deterministic
+     * and every object is overwritten with identical bytes.
+     */
+    const describeFailure = (error, what, objectKey) => {
+        const cause = error instanceof Error ? error : new Error(String(error));
+        const failure = new Error(`Release upload failed while uploading ${what} to "${objectKey}" ` +
+            `(store ${options.store.accessURL || '(no accessURL)'}): ${cause.message}. ` +
+            `${completedUploads} of ${totalUploads} objects were already uploaded under ` +
+            `"${plan.destination.releasePrefix}"; the release manifest was not uploaded, so the ` +
+            'release is incomplete. Re-running publish-app resumes it — object keys are ' +
+            'deterministic and already-uploaded objects are rewritten with identical bytes.');
+        failure.cause = cause;
+        failure.stack = cause.stack
+            ? `${failure.message}\nCaused by: ${cause.stack}`
+            : failure.stack;
+        return failure;
+    };
+    for (const file of plan.files) {
+        const absolutePath = resolveExistingPathWithinRoot(options.appRoot, file.sourcePath);
+        try {
+            yield upload(file.objectKey, fs.readFileSync(absolutePath), file.contentType, file.cacheControl, file.sha256);
+        }
+        catch (error) {
+            throw describeFailure(error, file.sourcePath, file.objectKey);
+        }
+        completedUploads += 1;
+        (_a = options.onProgress) === null || _a === void 0 ? void 0 : _a.call(options, {
+            completed: completedUploads,
+            total: totalUploads,
+            objectKey: file.objectKey,
+        });
+    }
+    // The manifest goes last: its presence under the release prefix is what marks
+    // the release as complete.
+    const manifestBody = fs.readFileSync(plan.manifestPath);
+    try {
+        yield upload(plan.manifestObjectKey, manifestBody, MANIFEST_CONTENT_TYPE, ENTRY_CACHE_CONTROL, hashBuffer(manifestBody));
+    }
+    catch (error) {
+        throw describeFailure(error, 'the release manifest', plan.manifestObjectKey);
+    }
+    completedUploads += 1;
+    (_b = options.onProgress) === null || _b === void 0 ? void 0 : _b.call(options, {
+        completed: completedUploads,
+        total: totalUploads,
+        objectKey: plan.manifestObjectKey,
+    });
+    return {
+        releaseId: plan.releaseId,
+        uploadedFiles: totalUploads,
+        uploadedBytes: plan.totalBytes + manifestBody.byteLength,
+        dryRun: false,
+        unverified,
+    };
+});
+//# sourceMappingURL=publisher.js.map

package/lib/esm/app-release/publisher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publisher.js","sourceRoot":"","sources":["../../../src/app-release/publisher.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,MAAM,IAAI,CAAC;AAEpB,OAAO,EAAC,kBAAkB,EAAC,MAAM,uBAAuB,CAAC;AACzD,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAC,oBAAoB,EAAE,6BAA6B,EAAC,MAAM,YAAY,CAAC;AA+B/E;;;;;;;;;GASG;AACH,MAAM,iBAAiB,GAAG,CACxB,aAAqB,EACrB,IAA0B,EACpB,EAAE;;IACR,MAAM,UAAU,GAAG,oBAAoB,CACrC,MAAM,CAAC,MAAA,IAAI,CAAC,UAAU,mCAAI,EAAE,CAAC,EAC7B,aAAa,CACd,CAAC;IACF,MAAM,SAAS,GAAG,oBAAoB,CACpC,MAAM,CAAC,MAAA,IAAI,CAAC,SAAS,mCAAI,EAAE,CAAC,EAC5B,YAAY,CACb,CAAC;IACF,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;IAC7D,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,+DAA+D;YAC7D,IAAI,IAAI,CAAC,SAAS,gBAAgB,QAAQ,2BAA2B;YACrE,+CAA+C,CAClD,CAAC;IACJ,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,OAAe,EACf,YAAY,GAAG,oBAAoB,EACZ,EAAE;;IACzB,MAAM,YAAY,GAAG,6BAA6B,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAC1E,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CACzB,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CACV,CAAC;IAE9B,IAAI,QAAQ,CAAC,aAAa,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,wCAAwC,QAAQ,CAAC,aAAa,EAAE,CACjE,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,KAAK,IAAI,QAAQ,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,CAAC,CAAA,MAAA,QAAQ,CAAC,WAAW,0CAAE,aAAa,CAAA,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,aAAa,GAAG,oBAAoB,CACxC,QAAQ,CAAC,WAAW,CAAC,aAAa,EAClC,gBAAgB,CACjB,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QAClC,iBAAiB,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;IAED,OAAO,EAAC,YAAY,EAAE,QAAQ,EAAC,CAAC;AAClC,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,mBAAmB,GAAG,CAC1B,QAAkC,EAClC,KAAiB,EACjB,EAAE;IACF,MAAM,QAAQ,GAAG,kBAAkB,CAAC,QAAQ,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACnD,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,2EACE,QAAQ,IAAI,SACd,8CAA8C,MAAM,IAAI,SAAS,GAAG,CACrE,CAAC;IACJ,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,CAAC,OAAe,EAAU,EAAE,CAC7C,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAE5D;;;GAGG;AACH,MAAM,iBAAiB,GAAG,CACxB,OAAe,EACf,IAA0B,EAClB,EAAE;IACV,2EAA2E;IAC3E,8DAA8D;IAC9D,MAAM,YAAY,GAAG,6BAA6B,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAC7E,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;IAC9C,IAAI,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC,IAAI,IAAI,UAAU,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,yCAAyC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,OAAkC,EACrB,EAAE;IACf,MAAM,EAAC,YAAY,EAAE,QAAQ,EAAC,GAAG,mBAAmB,CAClD,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,YAAY,CACrB,CAAC;IACF,mBAAmB,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAE7C,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QAClC,iBAAiB,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC3C,CAAC;IAED,OAAO;QACL,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,YAAY,EAAE,YAAY;QAC1B,iBAAiB,EAAE,gBAAgB,CACjC,QAAQ,CAAC,WAAW,CAAC,aAAa,EAClC,oBAAoB,CACrB;QACD,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;KACzE,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,YAAY,GAAG,CACnB,KAAiB,EACjB,SAAiB,EACjB,QAAwC,EACS,EAAE;IACnD,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,UAAU;QAAE,OAAO,aAAa,CAAC;IAE/D,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,gDAAgD,SAAS,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,uDAAuD,SAAS,EAAE,CACnE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IACnC,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,0CAA0C,SAAS,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC,CAAA,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,OAA8B,EACN,EAAE;;IAC1B,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAEzC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QACjB,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,aAAa,EAAE,CAAC;YAChB,aAAa,EAAE,CAAC;YAChB,MAAM,EAAE,IAAI;YACZ,UAAU,EAAE,EAAE;SACf,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,uBAAuB,GAAG,KAAK,CAAC;IACpC,MAAM,cAAc,GAAG,CAAC,SAAiB,EAAE,MAAc,EAAE,EAAE;;QAC3D,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3B,IAAI,uBAAuB;YAAE,OAAO;QACpC,uBAAuB,GAAG,IAAI,CAAC;QAC/B,MAAA,OAAO,CAAC,SAAS,wDACf,+CAA+C,MAAM,qBAAqB;YACxE,gFAAgF,CACnF,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,CACb,SAAiB,EACjB,OAAe,EACf,WAAmB,EACnB,YAAoB,EACpB,MAAc,EACd,EAAE;QACF,4EAA4E;QAC5E,2EAA2E;QAC3E,oEAAoE;QACpE,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,EAAE;YACjE,QAAQ,EAAE,WAAW;YACrB,YAAY;YACZ,iBAAiB,EAAE,KAAK;SACzB,CAAC,CAAC;QACH,yEAAyE;QACzE,0EAA0E;QAC1E,sEAAsE;QACtE,sCAAsC;QACtC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,KAAK,CACb,qEAAqE;gBACnE,kCAAkC,SAAS,WAAW,SAAS,KAAK;gBACpE,iDAAiD,CACpD,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE;YAC3D,IAAI,EAAE,OAAO,CAAC,UAAU;YACxB,MAAM;SACP,CAAC,CAAC;QACH,IAAI,OAAO,KAAK,aAAa,EAAE,CAAC;YAC9B,cAAc,CAAC,SAAS,EAAE,wCAAwC,CAAC,CAAC;QACtE,CAAC;aAAM,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YACjC,cAAc,CAAC,SAAS,EAAE,gDAAgD,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC,CAAA,CAAC;IAEF,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAC3C,IAAI,gBAAgB,GAAG,CAAC,CAAC;IAEzB;;;;;OAKG;IACH,MAAM,eAAe,GAAG,CACtB,KAAc,EACd,IAAY,EACZ,SAAiB,EACV,EAAE;QACT,MAAM,KAAK,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACxE,MAAM,OAAO,GAAG,IAAI,KAAK,CACvB,yCAAyC,IAAI,QAAQ,SAAS,IAAI;YAChE,UAAU,OAAO,CAAC,KAAK,CAAC,SAAS,IAAI,gBAAgB,MAAM,KAAK,CAAC,OAAO,IAAI;YAC5E,GAAG,gBAAgB,OAAO,YAAY,uCAAuC;YAC7E,IAAI,IAAI,CAAC,WAAW,CAAC,aAAa,mDAAmD;YACrF,6EAA6E;YAC7E,gFAAgF,CACnF,CAAC;QACD,OAAqC,CAAC,KAAK,GAAG,KAAK,CAAC;QACrD,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK;YACzB,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,gBAAgB,KAAK,CAAC,KAAK,EAAE;YACjD,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QAClB,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,MAAM,YAAY,GAAG,6BAA6B,CAChD,OAAO,CAAC,OAAO,EACf,IAAI,CAAC,UAAU,CAChB,CAAC;QACF,IAAI,CAAC;YACH,MAAM,MAAM,CACV,IAAI,CAAC,SAAS,EACd,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,EAC7B,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,MAAM,CACZ,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAChE,CAAC;QACD,gBAAgB,IAAI,CAAC,CAAC;QACtB,MAAA,OAAO,CAAC,UAAU,wDAAG;YACnB,SAAS,EAAE,gBAAgB;YAC3B,KAAK,EAAE,YAAY;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC,CAAC;IACL,CAAC;IAED,8EAA8E;IAC9E,2BAA2B;IAC3B,MAAM,YAAY,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,MAAM,CACV,IAAI,CAAC,iBAAiB,EACtB,YAAY,EACZ,qBAAqB,EACrB,mBAAmB,EACnB,UAAU,CAAC,YAAY,CAAC,CACzB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,eAAe,CAAC,KAAK,EAAE,sBAAsB,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC/E,CAAC;IACD,gBAAgB,IAAI,CAAC,CAAC;IACtB,MAAA,OAAO,CAAC,UAAU,wDAAG;QACnB,SAAS,EAAE,gBAAgB;QAC3B,KAAK,EAAE,YAAY;QACnB,SAAS,EAAE,IAAI,CAAC,iBAAiB;KAClC,CAAC,CAAC;IAEH,OAAO;QACL,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,aAAa,EAAE,YAAY;QAC3B,aAAa,EAAE,IAAI,CAAC,UAAU,GAAG,YAAY,CAAC,UAAU;QACxD,MAAM,EAAE,KAAK;QACb,UAAU;KACX,CAAC;AACJ,CAAC,CAAA,CAAC"}

package/lib/esm/app-release/resolve-build-target.d.ts

@@ -0,0 +1,19 @@
+import type { AppBuildTarget } from './types.js';
+export interface ResolveBuildTargetOptions {
+    target?: AppBuildTarget;
+    appEnv?: string;
+}
+/**
+ * Resolve the app build target.
+ *
+ * `APP_ENV` selects the Capacitor target only when it literally says
+ * `capacitor`. It used to be read as a boolean — any non-empty value meant
+ * "native" — which quietly hijacked the far more common `APP_ENV=production`
+ * into a near-empty, non-publishable manifest, and then made `--target web`
+ * fail outright. Nothing else in this monorepo reads `APP_ENV`, so there is no
+ * boolean contract left to preserve; an unrelated value is ignored and the
+ * build defaults to web, exactly as it does with `APP_ENV` unset. Pass
+ * `--target` to be explicit.
+ */
+export declare const resolveBuildTarget: ({ target, appEnv, }?: ResolveBuildTargetOptions) => AppBuildTarget;
+//# sourceMappingURL=resolve-build-target.d.ts.map

package/lib/esm/app-release/resolve-build-target.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-build-target.d.ts","sourceRoot":"","sources":["../../../src/app-release/resolve-build-target.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,YAAY,CAAC;AAE/C,MAAM,WAAW,yBAAyB;IACxC,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAKD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kBAAkB,GAAI,sBAGhC,yBAA8B,KAAG,cAsBnC,CAAC"}