@absolutejs/deploy 0.21.1 → 0.22.0

package/README.md

@@ -12,6 +12,42 @@ atomically, `rollback(releaseId)` re-points the symlink and restarts.
 Zero `ssh2` / `node-ssh` dependency — `sshTarget` shells out to the system
 `ssh` / `rsync` binaries that already ship on Mac, Linux, and WSL.
 
+## Native application releases (0.22.0)
+
+`@absolutejs/deploy/native-release` publishes the immutable release directory
+created by `absolute mobile build android` through any `@absolutejs/blob`
+adapter. It verifies the local AAB's declared size and SHA-256 digest again,
+requires a signed build by default, and writes the binary only once under its
+content-derived release identity.
+
+```ts
+import { createNativeReleaseRegistry } from '@absolutejs/deploy/native-release';
+import { s3BlobStore } from '@absolutejs/blob/s3';
+
+const store = s3BlobStore({ client, bucket: 'absolute-releases' });
+const releases = createNativeReleaseRegistry({ store });
+
+const published = await releases.publish({
+  releaseRoot:
+    '.absolutejs/mobile/releases/android/amobile_android_<sha256>',
+  channel: 'internal'
+});
+
+await releases.promote({
+  appId: published.record.metadata.appId,
+  platform: 'android',
+  releaseId: published.record.metadata.releaseId,
+  channel: 'production'
+});
+```
+
+Channels are small mutable pointers; release records and AAB bytes are
+immutable. Promoting an older retained release is therefore a rollback without
+rebuilding or copying the binary. Passing `allowUnsigned: true` is required on
+both publication and promotion for intentionally non-publishable local-testing
+artifacts. The registry uses the structural BlobStore shape, so Deploy does not
+take a runtime dependency on `@absolutejs/blob` or a cloud SDK.
+
 ## Infrastructure providers (0.14.0)
 
 Control planes use the normalized `InfrastructureProvider` contract from

package/dist/index.d.ts

@@ -18,5 +18,7 @@ export type { DeployContext, DeployHooks, DeployOptions, DeployResult, DeploySte
 export { createDeployer, defaultBunPipeline } from './deployer';
 export type { CreatedReleaseArtifact, ReleaseArtifactMetadata, } from './releaseArtifact';
 export { createReleaseArtifact, extractReleaseArtifact, receiveReleaseArtifact, ReleaseArtifactError, } from './releaseArtifact';
+export type { AndroidNativeReleaseMetadata, NativeReleaseBlobObject, NativeReleaseBlobStore, NativeReleaseChannel, NativeReleaseMetadata, NativeReleasePublication, NativeReleaseRecord, NativeReleaseRegistry, NativeReleaseRegistryOptions, } from './nativeRelease';
+export { createNativeReleaseRegistry, NATIVE_RELEASE_REGISTRY_FORMAT, NativeReleaseRegistryError, } from './nativeRelease';
 export type { EdgeIngress, EdgeIngressBackend, EdgeIngressCapabilities, EdgeIngressProtocol, EdgeIngressProvider, EdgeIngressSpec, EdgeIngressState, } from './edgeIngress';
 export { EdgeIngressValidationError, normalizedEdgeIngressBackends, validateEdgeIngressSpec, } from './edgeIngress';

package/dist/index.js

@@ -129,7 +129,6 @@ var receiveReleaseArtifact = async (options) => {
     await rm(options.destination, { force: true });
     throw error;
   } finally {
-    reader.releaseLock();
     await writer.end();
   }
   if (bytes !== options.expectedBytes || hasher.digest("hex") !== options.expectedSha256) {
@@ -165,6 +164,308 @@ var extractReleaseArtifact = async (options) => {
   return { extracted: true };
 };
 
+// src/nativeRelease.ts
+import { createHash } from "crypto";
+import { readFile, stat as stat2 } from "fs/promises";
+import path2 from "path";
+var DEFAULT_PREFIX = "absolutejs/native-releases";
+var DEFAULT_MAX_ARTIFACT_BYTES = 2147483648;
+var NATIVE_RELEASE_REGISTRY_FORMAT = 1;
+var SHA256_PATTERN = /^[a-f0-9]{64}$/;
+var APP_ID_PATTERN = /^[A-Za-z][\w]*(?:\.[A-Za-z][\w]*)+$/;
+var CHANNEL_PATTERN = /^[a-z0-9][a-z0-9._-]{0,63}$/;
+
+class NativeReleaseRegistryError extends Error {
+}
+var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var requireString = (value, field) => {
+  if (typeof value !== "string" || value.length === 0)
+    throw new NativeReleaseRegistryError(`Native release ${field} is invalid`);
+  return value;
+};
+var parseMetadata = (value) => {
+  if (!isRecord(value))
+    throw new NativeReleaseRegistryError("Native release metadata is invalid");
+  const appId = requireString(value.appId, "appId");
+  const sha256 = requireString(value.sha256, "sha256");
+  const releaseId = requireString(value.releaseId, "releaseId");
+  if (!APP_ID_PATTERN.test(appId))
+    throw new NativeReleaseRegistryError("Native release appId is invalid");
+  if (!SHA256_PATTERN.test(sha256))
+    throw new NativeReleaseRegistryError("Native release sha256 is invalid");
+  if (releaseId !== `amobile_android_${sha256}`)
+    throw new NativeReleaseRegistryError("Native release id does not match its artifact digest");
+  if (value.artifact !== "app-release.aab" || value.engine !== "capacitor" || value.format !== 1 || value.platform !== "android" || value.type !== "aab" || typeof value.signed !== "boolean" || !Number.isSafeInteger(value.bytes) || Number(value.bytes) < 1)
+    throw new NativeReleaseRegistryError("Native release metadata is invalid");
+  return {
+    appBuild: requireString(value.appBuild, "appBuild"),
+    appId,
+    artifact: "app-release.aab",
+    bytes: Number(value.bytes),
+    engine: "capacitor",
+    format: 1,
+    platform: "android",
+    releaseId,
+    runtime: requireString(value.runtime, "runtime"),
+    sha256,
+    signed: value.signed,
+    type: "aab"
+  };
+};
+var normalizedPrefix = (value) => {
+  const prefix = value.replace(/^\/+|\/+$/g, "");
+  if (prefix.length === 0 || prefix.split("/").some((segment) => segment === "." || segment === ".."))
+    throw new NativeReleaseRegistryError("Native release prefix is invalid");
+  return prefix;
+};
+var requireChannel = (value) => {
+  if (!CHANNEL_PATTERN.test(value))
+    throw new NativeReleaseRegistryError("Native release channel is invalid");
+  return value;
+};
+var appIdentity = (appId) => createHash("sha256").update(appId).digest("hex");
+var sha256Bytes = (bytes) => createHash("sha256").update(bytes).digest("hex");
+var isIsoTimestamp = (value) => {
+  if (typeof value !== "string" || Number.isNaN(Date.parse(value)))
+    return false;
+  return new Date(value).toISOString() === value;
+};
+var sha256File2 = async (file) => {
+  const hasher = new Bun.CryptoHasher("sha256");
+  for await (const chunk of file.stream())
+    hasher.update(chunk);
+  return hasher.digest("hex");
+};
+var encodedJson = (value) => new TextEncoder().encode(`${JSON.stringify(value, null, 2)}
+`);
+var decodedJson = (bytes) => JSON.parse(new TextDecoder().decode(bytes));
+var sameMetadata = (left, right) => JSON.stringify(left) === JSON.stringify(right);
+var parseRecord = (value) => {
+  if (!isRecord(value) || value.format !== NATIVE_RELEASE_REGISTRY_FORMAT || typeof value.artifactKey !== "string")
+    throw new NativeReleaseRegistryError("Native release record is invalid");
+  const metadata = parseMetadata(value.metadata);
+  return {
+    artifactKey: value.artifactKey,
+    format: NATIVE_RELEASE_REGISTRY_FORMAT,
+    metadata
+  };
+};
+var parseChannel = (value) => {
+  if (!isRecord(value) || value.format !== NATIVE_RELEASE_REGISTRY_FORMAT || value.platform !== "android" || !isIsoTimestamp(value.promotedAt))
+    throw new NativeReleaseRegistryError("Native release channel is invalid");
+  const appId = requireString(value.appId, "channel appId");
+  const channel = requireChannel(requireString(value.channel, "channel"));
+  const sha256 = requireString(value.sha256, "channel sha256");
+  const releaseId = requireString(value.releaseId, "channel releaseId");
+  if (!APP_ID_PATTERN.test(appId) || !SHA256_PATTERN.test(sha256))
+    throw new NativeReleaseRegistryError("Native release channel is invalid");
+  if (releaseId !== `amobile_android_${sha256}`)
+    throw new NativeReleaseRegistryError("Native release channel identity does not match");
+  return {
+    appId,
+    channel,
+    format: NATIVE_RELEASE_REGISTRY_FORMAT,
+    platform: "android",
+    promotedAt: value.promotedAt,
+    releaseId,
+    sha256
+  };
+};
+var createNativeReleaseRegistry = (options) => {
+  const prefix = normalizedPrefix(options.prefix ?? DEFAULT_PREFIX);
+  const maxArtifactBytes = options.maxArtifactBytes ?? DEFAULT_MAX_ARTIFACT_BYTES;
+  if (!Number.isSafeInteger(maxArtifactBytes) || maxArtifactBytes < 1)
+    throw new NativeReleaseRegistryError("Native release maxArtifactBytes is invalid");
+  const clock = options.clock ?? (() => new Date);
+  const appRoot = (appId, platform) => `${prefix}/${appIdentity(appId)}/${platform}`;
+  const releaseRoot = (metadata) => `${appRoot(metadata.appId, metadata.platform)}/releases/${metadata.releaseId}`;
+  const recordKey = (metadata) => `${releaseRoot(metadata)}/release.json`;
+  const artifactKey = (metadata) => `${releaseRoot(metadata)}/${metadata.artifact}`;
+  const channelKey = (appId, platform, channel) => `${appRoot(appId, platform)}/channels/${requireChannel(channel)}.json`;
+  const requireStoredArtifact = async (key, metadata) => {
+    const stored = await options.store.head(key);
+    if (!stored || stored.size !== metadata.bytes || stored.metadata?.sha256 !== metadata.sha256 || stored.metadata?.releaseId !== metadata.releaseId)
+      throw new NativeReleaseRegistryError("Stored native release artifact does not match its immutable identity");
+  };
+  const read = async (input) => {
+    if (!APP_ID_PATTERN.test(input.appId))
+      throw new NativeReleaseRegistryError("Native release appId is invalid");
+    const digest = input.releaseId.replace(/^amobile_android_/, "");
+    if (!SHA256_PATTERN.test(digest) || input.releaseId !== `amobile_android_${digest}`)
+      throw new NativeReleaseRegistryError("Native release id is invalid");
+    const identity = {
+      appBuild: "lookup",
+      appId: input.appId,
+      artifact: "app-release.aab",
+      bytes: 1,
+      engine: "capacitor",
+      format: 1,
+      platform: "android",
+      releaseId: input.releaseId,
+      runtime: "lookup",
+      sha256: digest,
+      signed: true,
+      type: "aab"
+    };
+    const key = recordKey(identity);
+    const bytes = await options.store.get(key);
+    if (!bytes)
+      return null;
+    const storedRecord = await options.store.head(key);
+    if (!storedRecord || storedRecord.size !== bytes.byteLength || storedRecord.metadata?.releaseId !== input.releaseId || storedRecord.metadata?.sha256 !== sha256Bytes(bytes))
+      throw new NativeReleaseRegistryError("Stored native release record does not match its immutable identity");
+    const record = parseRecord(decodedJson(bytes));
+    if (record.metadata.appId !== input.appId || record.metadata.platform !== input.platform || record.metadata.releaseId !== input.releaseId || record.artifactKey !== artifactKey(record.metadata))
+      throw new NativeReleaseRegistryError("Stored native release record identity does not match");
+    await requireStoredArtifact(record.artifactKey, record.metadata);
+    return record;
+  };
+  const promote = async (input) => {
+    input.signal?.throwIfAborted();
+    const record = await read(input);
+    if (!record)
+      throw new NativeReleaseRegistryError("Native release was not published");
+    if (!record.metadata.signed && !input.allowUnsigned)
+      throw new NativeReleaseRegistryError("Unsigned native releases cannot be promoted");
+    const key = channelKey(input.appId, input.platform, input.channel);
+    const existingBytes = await options.store.get(key);
+    if (existingBytes) {
+      const existing = parseChannel(decodedJson(existingBytes));
+      if (existing.appId !== input.appId || existing.platform !== input.platform || existing.channel !== input.channel)
+        throw new NativeReleaseRegistryError("Stored native release channel identity does not match");
+      if (existing.releaseId === input.releaseId)
+        return existing;
+    }
+    const channel = {
+      appId: input.appId,
+      channel: requireChannel(input.channel),
+      format: NATIVE_RELEASE_REGISTRY_FORMAT,
+      platform: input.platform,
+      promotedAt: clock().toISOString(),
+      releaseId: record.metadata.releaseId,
+      sha256: record.metadata.sha256
+    };
+    const serialized = encodedJson(channel);
+    await options.store.put(key, serialized, {
+      cacheControl: "no-cache",
+      contentType: "application/json",
+      maxBytes: serialized.byteLength,
+      metadata: {
+        channel: channel.channel,
+        releaseId: channel.releaseId,
+        sha256: channel.sha256
+      },
+      signal: input.signal
+    });
+    const stored = await options.store.get(key);
+    if (!stored || JSON.stringify(parseChannel(decodedJson(stored))) !== JSON.stringify(channel))
+      throw new NativeReleaseRegistryError("Native release channel verification failed");
+    return channel;
+  };
+  return {
+    promote,
+    publish: async (input) => {
+      input.signal?.throwIfAborted();
+      const localRoot = path2.resolve(input.releaseRoot);
+      const metadata = parseMetadata(JSON.parse(await readFile(path2.join(localRoot, "release.json"), "utf8")));
+      if (metadata.bytes > maxArtifactBytes)
+        throw new NativeReleaseRegistryError("Native release exceeds the configured artifact limit");
+      if (!metadata.signed && !input.allowUnsigned)
+        throw new NativeReleaseRegistryError("Unsigned native releases cannot be published");
+      const localArtifact = path2.join(localRoot, metadata.artifact);
+      const artifactStats = await stat2(localArtifact).catch(() => null);
+      if (!artifactStats?.isFile() || artifactStats.size !== metadata.bytes)
+        throw new NativeReleaseRegistryError("Native release artifact size does not match its metadata");
+      if (await sha256File2(Bun.file(localArtifact)) !== metadata.sha256)
+        throw new NativeReleaseRegistryError("Native release artifact digest does not match its metadata");
+      const existing = await read({
+        appId: metadata.appId,
+        platform: metadata.platform,
+        releaseId: metadata.releaseId
+      });
+      let record;
+      let reused = false;
+      if (existing) {
+        if (!sameMetadata(existing.metadata, metadata))
+          throw new NativeReleaseRegistryError("Published native release metadata is immutable");
+        record = existing;
+        reused = true;
+      } else {
+        const key = artifactKey(metadata);
+        const storedArtifact = await options.store.head(key);
+        if (storedArtifact) {
+          await requireStoredArtifact(key, metadata);
+        } else {
+          await options.store.put(key, Bun.file(localArtifact).stream(), {
+            cacheControl: "public, max-age=31536000, immutable",
+            contentType: "application/octet-stream",
+            maxBytes: metadata.bytes,
+            metadata: {
+              appId: metadata.appId,
+              releaseId: metadata.releaseId,
+              sha256: metadata.sha256
+            },
+            signal: input.signal
+          });
+          await requireStoredArtifact(key, metadata);
+        }
+        record = {
+          artifactKey: key,
+          format: NATIVE_RELEASE_REGISTRY_FORMAT,
+          metadata
+        };
+        const serialized = encodedJson(record);
+        await options.store.put(recordKey(metadata), serialized, {
+          cacheControl: "public, max-age=31536000, immutable",
+          contentType: "application/json",
+          maxBytes: serialized.byteLength,
+          metadata: {
+            releaseId: metadata.releaseId,
+            sha256: sha256Bytes(serialized)
+          },
+          signal: input.signal
+        });
+        const verified = await read({
+          appId: metadata.appId,
+          platform: metadata.platform,
+          releaseId: metadata.releaseId
+        });
+        if (!verified || JSON.stringify(verified) !== JSON.stringify(record))
+          throw new NativeReleaseRegistryError("Native release publication verification failed");
+      }
+      const channel = input.channel ? await promote({
+        allowUnsigned: input.allowUnsigned,
+        appId: metadata.appId,
+        channel: input.channel,
+        platform: metadata.platform,
+        releaseId: metadata.releaseId,
+        signal: input.signal
+      }) : undefined;
+      return { ...channel ? { channel } : {}, record, reused };
+    },
+    read,
+    resolve: async (input) => {
+      if (!APP_ID_PATTERN.test(input.appId))
+        throw new NativeReleaseRegistryError("Native release appId is invalid");
+      const key = channelKey(input.appId, input.platform, input.channel);
+      const bytes = await options.store.get(key);
+      if (!bytes)
+        return null;
+      const channel = parseChannel(decodedJson(bytes));
+      if (channel.appId !== input.appId || channel.platform !== input.platform || channel.channel !== input.channel)
+        throw new NativeReleaseRegistryError("Stored native release channel identity does not match");
+      const record = await read({
+        appId: channel.appId,
+        platform: channel.platform,
+        releaseId: channel.releaseId
+      });
+      if (!record || record.metadata.sha256 !== channel.sha256)
+        throw new NativeReleaseRegistryError("Native release channel points to a missing or invalid release");
+      return { channel, record };
+    }
+  };
+};
+
 // src/edgeIngress.ts
 var validPort = (port) => Number.isInteger(port) && port >= 1 && port <= 65535;
 
@@ -860,11 +1161,14 @@ export {
   extractReleaseArtifact,
   defaultBunPipeline,
   createReleaseArtifact,
+  createNativeReleaseRegistry,
   createDeployer,
   bareManager,
   ReleaseArtifactError,
+  NativeReleaseRegistryError,
+  NATIVE_RELEASE_REGISTRY_FORMAT,
   EdgeIngressValidationError
 };
 
-//# debugId=BC2DAC4B8EA4FAB664756E2164756E21
+//# debugId=19FB526D8301A46164756E2164756E21
 //# sourceMappingURL=index.js.map