@appforge-ci/core 0.1.1

package/dist/ota-bundle-hash.test.js

@@ -0,0 +1,28 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { deriveOtaBundleHash } from "./ota-bundle-hash.js";
+test("deriveOtaBundleHash strips non-alphanumeric characters", () => {
+    assert.equal(deriveOtaBundleHash("builds/abc123/app.zip"), "buildsabc123appzip");
+});
+test("deriveOtaBundleHash regression: two different buildIds with the same long fileName no longer collide", () => {
+    // Both buildIds are 32 alphanumeric chars, matching crypto.randomUUID()
+    // with dashes stripped (packages/db/src/id.ts). The fileName alone is
+    // 34 alphanumeric characters — long enough that the old
+    // `.replace(...).slice(-32)` derivation dropped the buildId entirely
+    // and returned an identical hash for both builds.
+    const fileName = "react-native-ota-bundle-production.zip";
+    const buildIdA = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
+    const buildIdB = "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb";
+    const hashA = deriveOtaBundleHash(`builds/${buildIdA}/${fileName}`);
+    const hashB = deriveOtaBundleHash(`builds/${buildIdB}/${fileName}`);
+    assert.notEqual(hashA, hashB);
+    // The old, buggy derivation for comparison — proves this is the exact
+    // collision being fixed, not a hypothetical.
+    const oldDerive = (storageKey) => storageKey.replace(/[^a-zA-Z0-9]/g, "").slice(-32);
+    assert.equal(oldDerive(`builds/${buildIdA}/${fileName}`), oldDerive(`builds/${buildIdB}/${fileName}`));
+});
+test("deriveOtaBundleHash is deterministic for the same storageKey", () => {
+    const storageKey = "builds/deadbeefdeadbeefdeadbeefdeadbeef/app-release.aab";
+    assert.equal(deriveOtaBundleHash(storageKey), deriveOtaBundleHash(storageKey));
+});
+//# sourceMappingURL=ota-bundle-hash.test.js.map

package/dist/ota-bundle-hash.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ota-bundle-hash.test.js","sourceRoot":"","sources":["../src/ota-bundle-hash.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAE3D,IAAI,CAAC,wDAAwD,EAAE,GAAG,EAAE;IAClE,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,uBAAuB,CAAC,EAAE,oBAAoB,CAAC,CAAC;AACnF,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,sGAAsG,EAAE,GAAG,EAAE;IAChH,wEAAwE;IACxE,sEAAsE;IACtE,wDAAwD;IACxD,qEAAqE;IACrE,kDAAkD;IAClD,MAAM,QAAQ,GAAG,wCAAwC,CAAC;IAC1D,MAAM,QAAQ,GAAG,kCAAkC,CAAC;IACpD,MAAM,QAAQ,GAAG,kCAAkC,CAAC;IAEpD,MAAM,KAAK,GAAG,mBAAmB,CAAC,UAAU,QAAQ,IAAI,QAAQ,EAAE,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,mBAAmB,CAAC,UAAU,QAAQ,IAAI,QAAQ,EAAE,CAAC,CAAC;IAEpE,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAE9B,sEAAsE;IACtE,6CAA6C;IAC7C,MAAM,SAAS,GAAG,CAAC,UAAkB,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7F,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,QAAQ,IAAI,QAAQ,EAAE,CAAC,EAAE,SAAS,CAAC,UAAU,QAAQ,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC;AACzG,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,8DAA8D,EAAE,GAAG,EAAE;IACxE,MAAM,UAAU,GAAG,yDAAyD,CAAC;IAC7E,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC,UAAU,CAAC,CAAC,CAAC;AACjF,CAAC,CAAC,CAAC"}

package/dist/ota-rollout.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Deterministic, non-cryptographic staged-rollout gate for OTA manifest
+ * serving (`apps/api/src/routes/ota.ts`'s `GET /apps/:appId/ota/:channel/
+ * manifest`). `OtaRelease.rollout` (0-100) has existed since
+ * `migrations/0012_ota_updates.sql`, but the manifest endpoint has always
+ * served the active release to every caller regardless of it — this is
+ * that missing enforcement, slice (6) of #86's rough plan (see
+ * `ROADMAP.md`).
+ *
+ * A plain, fast, synchronous hash (FNV-1a) rather than WebCrypto's
+ * `crypto.subtle.digest` (async, and this codebase already reserves
+ * WebCrypto for actual security boundaries — see `apps/api/src/lib/
+ * auth.ts`): staged rollout only staggers *exposure* to a release, it
+ * isn't a security control, and a client could trivially compute its own
+ * bucket either way, so there's nothing here worth paying an async
+ * round-trip for.
+ */
+/**
+ * Whether a given installation falls inside a release's rollout
+ * percentage. Hashes `releaseId` together with `installationId` (not
+ * `installationId` alone) so one installation's bucket is independent
+ * from one release to the next — an installation excluded from release
+ * A's 10% rollout isn't guaranteed excluded from release B's, and vice
+ * versa — while staying *stable* across repeat polls of the *same*
+ * release, so a device doesn't flip in and out of an in-progress
+ * rollout between manifest checks.
+ *
+ * `rolloutPercent` is clamped at the boundaries rather than hashed
+ * through: 100 (the default for every release created before this
+ * existed, and the common case) always returns true and 0 always
+ * returns false, with no dependence on the hash at all — a release
+ * meant to reach everyone, or no one, isn't left to chance at the
+ * boundary the way `bucket < rolloutPercent` alone could be (bucket 0
+ * would otherwise need `rolloutPercent` to be *strictly* greater than
+ * zero to ever be included).
+ */
+export declare function isInStagedRollout(installationId: string, releaseId: string, rolloutPercent: number): boolean;
+//# sourceMappingURL=ota-rollout.d.ts.map

package/dist/ota-rollout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ota-rollout.d.ts","sourceRoot":"","sources":["../src/ota-rollout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAWH;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,iBAAiB,CAAC,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAK5G"}

package/dist/ota-rollout.js

@@ -0,0 +1,53 @@
+/**
+ * Deterministic, non-cryptographic staged-rollout gate for OTA manifest
+ * serving (`apps/api/src/routes/ota.ts`'s `GET /apps/:appId/ota/:channel/
+ * manifest`). `OtaRelease.rollout` (0-100) has existed since
+ * `migrations/0012_ota_updates.sql`, but the manifest endpoint has always
+ * served the active release to every caller regardless of it — this is
+ * that missing enforcement, slice (6) of #86's rough plan (see
+ * `ROADMAP.md`).
+ *
+ * A plain, fast, synchronous hash (FNV-1a) rather than WebCrypto's
+ * `crypto.subtle.digest` (async, and this codebase already reserves
+ * WebCrypto for actual security boundaries — see `apps/api/src/lib/
+ * auth.ts`): staged rollout only staggers *exposure* to a release, it
+ * isn't a security control, and a client could trivially compute its own
+ * bucket either way, so there's nothing here worth paying an async
+ * round-trip for.
+ */
+function fnv1a(input) {
+    let hash = 0x811c9dc5;
+    for (let i = 0; i < input.length; i++) {
+        hash ^= input.charCodeAt(i);
+        hash = Math.imul(hash, 0x01000193);
+    }
+    return hash >>> 0;
+}
+/**
+ * Whether a given installation falls inside a release's rollout
+ * percentage. Hashes `releaseId` together with `installationId` (not
+ * `installationId` alone) so one installation's bucket is independent
+ * from one release to the next — an installation excluded from release
+ * A's 10% rollout isn't guaranteed excluded from release B's, and vice
+ * versa — while staying *stable* across repeat polls of the *same*
+ * release, so a device doesn't flip in and out of an in-progress
+ * rollout between manifest checks.
+ *
+ * `rolloutPercent` is clamped at the boundaries rather than hashed
+ * through: 100 (the default for every release created before this
+ * existed, and the common case) always returns true and 0 always
+ * returns false, with no dependence on the hash at all — a release
+ * meant to reach everyone, or no one, isn't left to chance at the
+ * boundary the way `bucket < rolloutPercent` alone could be (bucket 0
+ * would otherwise need `rolloutPercent` to be *strictly* greater than
+ * zero to ever be included).
+ */
+export function isInStagedRollout(installationId, releaseId, rolloutPercent) {
+    if (rolloutPercent >= 100)
+        return true;
+    if (rolloutPercent <= 0)
+        return false;
+    const bucket = fnv1a(`${releaseId}:${installationId}`) % 100;
+    return bucket < rolloutPercent;
+}
+//# sourceMappingURL=ota-rollout.js.map

package/dist/ota-rollout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ota-rollout.js","sourceRoot":"","sources":["../src/ota-rollout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,SAAS,KAAK,CAAC,KAAa;IAC1B,IAAI,IAAI,GAAG,UAAU,CAAC;IACtB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,iBAAiB,CAAC,cAAsB,EAAE,SAAiB,EAAE,cAAsB;IACjG,IAAI,cAAc,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,cAAc,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,SAAS,IAAI,cAAc,EAAE,CAAC,GAAG,GAAG,CAAC;IAC7D,OAAO,MAAM,GAAG,cAAc,CAAC;AACjC,CAAC"}

package/dist/ota-rollout.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ota-rollout.test.d.ts.map

package/dist/ota-rollout.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ota-rollout.test.d.ts","sourceRoot":"","sources":["../src/ota-rollout.test.ts"],"names":[],"mappings":""}

package/dist/ota-rollout.test.js

@@ -0,0 +1,48 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { isInStagedRollout } from "./ota-rollout.js";
+test("rollout of 100 always returns true, regardless of installation/release", () => {
+    for (const installationId of ["a", "b", "c", "device-1234"]) {
+        assert.equal(isInStagedRollout(installationId, "rel-1", 100), true);
+    }
+});
+test("rollout of 0 always returns false, regardless of installation/release", () => {
+    for (const installationId of ["a", "b", "c", "device-1234"]) {
+        assert.equal(isInStagedRollout(installationId, "rel-1", 0), false);
+    }
+});
+test("is deterministic — the same installation/release/rollout always decides the same way", () => {
+    const first = isInStagedRollout("device-abc", "rel-1", 50);
+    for (let i = 0; i < 20; i++) {
+        assert.equal(isInStagedRollout("device-abc", "rel-1", 50), first);
+    }
+});
+test("the same installation can bucket differently across two different releases", () => {
+    // Not guaranteed for every installation/rollout pair, but true often
+    // enough across a spread of installations that this would fail if
+    // releaseId weren't actually mixed into the hash at all (i.e. if
+    // bucketing depended on installationId alone).
+    let sawDifference = false;
+    for (let i = 0; i < 50; i++) {
+        const installationId = `device-${i}`;
+        if (isInStagedRollout(installationId, "rel-1", 50) !== isInStagedRollout(installationId, "rel-2", 50)) {
+            sawDifference = true;
+            break;
+        }
+    }
+    assert.ok(sawDifference, "expected at least one installation to bucket differently between two releases");
+});
+test("a mid-range rollout roughly splits a spread of installations both ways, not all-or-nothing", () => {
+    let included = 0;
+    const total = 500;
+    for (let i = 0; i < total; i++) {
+        if (isInStagedRollout(`device-${i}`, "rel-1", 30))
+            included++;
+    }
+    // Not a strict statistical claim — just guards against the two ways
+    // this could silently degenerate to "always true" or "always false"
+    // (e.g. a hash that doesn't vary, or a comparison operator flipped).
+    assert.ok(included > 0, "expected at least some installations to be included at 30% rollout");
+    assert.ok(included < total, "expected at least some installations to be excluded at 30% rollout");
+});
+//# sourceMappingURL=ota-rollout.test.js.map

package/dist/ota-rollout.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ota-rollout.test.js","sourceRoot":"","sources":["../src/ota-rollout.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAErD,IAAI,CAAC,wEAAwE,EAAE,GAAG,EAAE;IAClF,KAAK,MAAM,cAAc,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,aAAa,CAAC,EAAE,CAAC;QAC5D,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,cAAc,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;IACtE,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,uEAAuE,EAAE,GAAG,EAAE;IACjF,KAAK,MAAM,cAAc,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,aAAa,CAAC,EAAE,CAAC;QAC5D,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,cAAc,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACrE,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,sFAAsF,EAAE,GAAG,EAAE;IAChG,MAAM,KAAK,GAAG,iBAAiB,CAAC,YAAY,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;IAC3D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,YAAY,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;IACpE,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,4EAA4E,EAAE,GAAG,EAAE;IACtF,qEAAqE;IACrE,kEAAkE;IAClE,iEAAiE;IACjE,+CAA+C;IAC/C,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,MAAM,cAAc,GAAG,UAAU,CAAC,EAAE,CAAC;QACrC,IAAI,iBAAiB,CAAC,cAAc,EAAE,OAAO,EAAE,EAAE,CAAC,KAAK,iBAAiB,CAAC,cAAc,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC;YACtG,aAAa,GAAG,IAAI,CAAC;YACrB,MAAM;QACR,CAAC;IACH,CAAC;IACD,MAAM,CAAC,EAAE,CAAC,aAAa,EAAE,+EAA+E,CAAC,CAAC;AAC5G,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,4FAA4F,EAAE,GAAG,EAAE;IACtG,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,MAAM,KAAK,GAAG,GAAG,CAAC;IAClB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/B,IAAI,iBAAiB,CAAC,UAAU,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC;YAAE,QAAQ,EAAE,CAAC;IAChE,CAAC;IACD,oEAAoE;IACpE,oEAAoE;IACpE,qEAAqE;IACrE,MAAM,CAAC,EAAE,CAAC,QAAQ,GAAG,CAAC,EAAE,oEAAoE,CAAC,CAAC;IAC9F,MAAM,CAAC,EAAE,CAAC,QAAQ,GAAG,KAAK,EAAE,oEAAoE,CAAC,CAAC;AACpG,CAAC,CAAC,CAAC"}