@applift/core 0.8.0 → 0.8.1

package/dist/plugins/index.d.mts

@@ -15,7 +15,11 @@ export declare function dingtalkNotify(options: DingtalkNotifyOptions): AppliftP
  * 见 rn-update.ts）——applift 不 spawn 构建命令（架构不变量 1）。
  */
 interface PushyCli {
-  /** 发布热更版本（version/create + 绑定目标原生版本），返回版本 id */
+  /** 发布热更版本（version/create + 绑定目标原生版本），返回版本 id。
+   *  deps 为服务端强校验所需（2026-09-17 后创建的应用要求 deps 里有 react-native-update
+   *  >= 10.53.1——实测缺省被 400 拒绝），由调用方用 readDepVersions 从工程读取。
+   *  不上报 commit：实测带 commit（官方 getCommitInfo 同构形态）被 version/create 以
+   *  「上传凭据无效」拒绝（2026-10-21 实证，去 commit 即过）；溯源走本地 history.jsonl */
   publish(input: {
     appId: number;
     ppk: string;
@@ -24,11 +28,12 @@ interface PushyCli {
     description?: string;
     packageVersion: string;
     rollout?: number;
+    deps: Record<string, string>;
   }): Promise<{
     versionId: number;
   }>;
-  /** 上传原生基线（versionName 由调用方从产物读取后显式传入） */
-  uploadApp(appId: number, appFile: string, versionName: string): Promise<{
+  /** 上传原生基线（versionName 由调用方从产物读取后显式传入；deps 同 publish） */
+  uploadApp(appId: number, appFile: string, versionName: string, deps: Record<string, string>): Promise<{
     packageId: number;
     version: string;
   }>;
@@ -58,7 +63,19 @@ interface PushyApiOptions {
   token: string;
   /** 注入点：测试 mock（缺省 globalThis.fetch） */
   fetchImpl?: FetchImpl;
+  /** 直传实现注入（缺省 node:http(s) 原生；测试 mock） */
+  httpUpload?: HttpUploadImpl;
 }
+/** 直传实现（node:http(s) 原生；测试注入 mock） */
+type HttpUploadImpl = (method: "POST" | "PUT", url: string, headers: Record<string, string>, body: Buffer) => Promise<{
+  status: number;
+}>;
+export declare function nodeHttpUpload(method: "POST" | "PUT", url: string, headers: Record<string, string>, body: Buffer): Promise<{
+  status: number;
+}>;
+/** 项目直接依赖（dependencies+devDependencies）的实装版本映射（逐级向上找 node_modules，键排序）。
+ *  对照官方 dep-versions.js 同构：服务端按 deps["react-native-update"] 做热更兼容门禁与变更提示 */
+export declare function readDepVersions(cwd: string): Record<string, string>;
 /** OpenAPI 实现 PushyCli 的服务端操作（ppk 由调用方产出，见 PushyCli 契约注释） */
 export declare function createPushyApi(opts: PushyApiOptions): PushyCli;
 //#endregion
@@ -90,4 +107,4 @@ export declare function makeRnUpdateProvider(opts: RnUpdateOptions, cli?: PushyC
  *  cli 注入点：测试 mock / 特殊 transport；缺省 OpenAPI 客户端（token 来自 ctx.credentials）。 */
 export declare function rnUpdate(opts?: RnUpdateOptions, cli?: PushyCli): AppliftPlugin;
 //#endregion
-export { type DingtalkNotifyOptions, type FetchImpl, type PushyApiOptions, type PushyCli, type RnUpdateOptions, electronAdapter, electronFramework, flutterAdapter, flutterFramework, knownFrameworkAdapters, nativeAndroidAdapter, nativeAndroidFramework, nativeHarmonyAdapter, nativeHarmonyFramework, nativeIosAdapter, nativeIosFramework, rnAdapter, rnFramework, suggestFramework, tauriAdapter, tauriFramework };
+export { type DingtalkNotifyOptions, type FetchImpl, type HttpUploadImpl, type PushyApiOptions, type PushyCli, type RnUpdateOptions, electronAdapter, electronFramework, flutterAdapter, flutterFramework, knownFrameworkAdapters, nativeAndroidAdapter, nativeAndroidFramework, nativeHarmonyAdapter, nativeHarmonyFramework, nativeIosAdapter, nativeIosFramework, rnAdapter, rnFramework, suggestFramework, tauriAdapter, tauriFramework };

package/dist/plugins/index.mjs

@@ -3,6 +3,8 @@ import fs from "node:fs";
 import path from "node:path";
 import { createHmac } from "node:crypto";
 import { spawnSync } from "node:child_process";
+import nodeHttp from "node:http";
+import nodeHttps from "node:https";
 //#region src/plugins/dingtalk-notify.ts
 /**
 * 官方示例插件 —— 钉钉机器人通知。
@@ -67,7 +69,7 @@ function dingtalkNotify(options) {
 const PUSHY_TOKEN_KEY = "PUSHY_API_TOKEN";
 /** pushy 官方 API 根（官方 CLI 默认端点簇的主端点） */
 const PUSHY_DEFAULT_BASE_URL = "https://update.reactnative.cn/api";
-const UA = "applift/pushy-openapi";
+const UA = "react-native-update-cli/2.29.3";
 async function query(f, baseUrl, token, api, init) {
 	let res;
 	try {
@@ -94,7 +96,7 @@ async function query(f, baseUrl, token, api, init) {
 		const msg = json?.message || res.statusText || `HTTP ${res.status}`;
 		throw new Error(res.status === 401 ? `pushy API 鉴权失败（token 无效或过期）：请更新 credentials.json 的 ${PUSHY_TOKEN_KEY}` : `pushy API ${api} 失败（HTTP ${res.status}）：${msg}`);
 	}
-	return json;
+	return json ?? {};
 }
 /** 文件 part 的 Content-Type（对照官方 fileContentType 的扩展名表；未列出走 octet-stream） */
 function fileContentType(fileName) {
@@ -112,7 +114,7 @@ function fileContentType(fileName) {
 * （旧 CLI 流式是为进度条与代理改写，非容量需求）。不申请 chunked（响应分支少一半，
 * ppk 增量优化留待 diffStatus 端点，见设计说明）。
 */
-async function uploadFile(f, baseUrl, token, appId, file) {
+async function uploadFile(f, baseUrl, token, appId, file, upload) {
 	if (!fs.existsSync(file)) throw new Error(`pushy 上传文件不存在：${file}`);
 	const size = fs.statSync(file).size;
 	const instr = await query(f, baseUrl, token, "/upload", {
@@ -120,19 +122,18 @@ async function uploadFile(f, baseUrl, token, appId, file) {
 		body: JSON.stringify({
 			ext: path.extname(file),
 			appId,
+			chunked: true,
 			size
 		})
 	});
+	const httpUpload = upload ?? nodeHttpUpload;
 	if (instr.method === "PUT") {
-		const res = await f(instr.url, {
-			method: "PUT",
-			body: fs.readFileSync(file),
-			headers: {
-				"content-length": String(size),
-				...instr.headers ?? {}
-			}
-		});
-		if (!res.ok) throw new Error(`pushy 基线直传失败（HTTP ${res.status}）：${res.statusText || instr.url}`);
+		const putBody = fs.readFileSync(file);
+		const res = await httpUpload("PUT", instr.url, {
+			"content-length": String(size),
+			...instr.headers ?? {}
+		}, putBody);
+		if (res.status > 299) throw new Error(`pushy 基线直传失败（HTTP ${res.status}）：${instr.url}`);
 		return instr.key;
 	}
 	const fields = Object.entries(instr.formData ?? {});
@@ -145,16 +146,32 @@ async function uploadFile(f, baseUrl, token, appId, file) {
 		fs.readFileSync(file),
 		Buffer.from(`\r\n--${boundary}--\r\n`)
 	]);
-	const res = await f(instr.url, {
-		method: "POST",
-		body,
-		headers: { "content-type": `multipart/form-data;boundary=${boundary}` }
-	});
-	if (!res.ok) throw new Error(`pushy 文件直传失败（HTTP ${res.status}）：${res.statusText || instr.url}`);
+	const res = await httpUpload("POST", instr.url, {
+		accept: "*/*",
+		"user-agent": UA,
+		"content-type": `multipart/form-data;boundary=${boundary}`,
+		"content-length": String(body.length)
+	}, body);
+	if (res.status > 299) throw new Error(`pushy 文件直传失败（HTTP ${res.status}）：${instr.url}`);
 	const key = fields.find(([name]) => name === "key")?.[1];
 	if (!key) throw new Error(`pushy /upload 指令缺 formData.key（服务端响应异常）：${instr.url}`);
 	return key;
 }
+async function nodeHttpUpload(method, url, headers, body) {
+	const mod = url.startsWith("https:") ? nodeHttps : nodeHttp;
+	return new Promise((resolve, reject) => {
+		const req = mod.request(url, {
+			method,
+			headers
+		});
+		req.on("response", (res) => {
+			res.resume();
+			resolve({ status: res.statusCode ?? 0 });
+		});
+		req.on("error", (e) => reject(/* @__PURE__ */ new Error(`pushy 直传网络错误：${url}——${e.message}`)));
+		req.end(body);
+	});
+}
 /** packageVersion → packageId 精确匹配（对照 CLI update：pkg.name === packageVersion） */
 async function bind(q, appId, versionId, packageVersion, rollout) {
 	const pkgs = await listAllPackages(q, appId);
@@ -180,6 +197,31 @@ async function listAllPackages(q, appId) {
 	}
 	return out;
 }
+/** 项目直接依赖（dependencies+devDependencies）的实装版本映射（逐级向上找 node_modules，键排序）。
+*  对照官方 dep-versions.js 同构：服务端按 deps["react-native-update"] 做热更兼容门禁与变更提示 */
+function readDepVersions(cwd) {
+	let pkg;
+	try {
+		pkg = JSON.parse(fs.readFileSync(path.join(cwd, "package.json"), "utf8"));
+	} catch {
+		return {};
+	}
+	const versions = {};
+	for (const dep of /* @__PURE__ */ new Set([...Object.keys(pkg.dependencies ?? {}), ...Object.keys(pkg.devDependencies ?? {})])) {
+		let dir = path.resolve(cwd);
+		for (;;) {
+			try {
+				const installed = JSON.parse(fs.readFileSync(path.join(dir, "node_modules", dep, "package.json"), "utf8"));
+				if (typeof installed.version === "string") versions[dep] = installed.version;
+				break;
+			} catch {}
+			const parent = path.dirname(dir);
+			if (parent === dir) break;
+			dir = parent;
+		}
+	}
+	return Object.fromEntries(Object.keys(versions).sort().map((k) => [k, versions[k]]));
+}
 /** OpenAPI 实现 PushyCli 的服务端操作（ppk 由调用方产出，见 PushyCli 契约注释） */
 function createPushyApi(opts) {
 	const baseUrl = opts.baseUrl ?? "https://update.reactnative.cn/api";
@@ -187,27 +229,29 @@ function createPushyApi(opts) {
 	const q = (api, init) => query(f, baseUrl, opts.token, api, init);
 	return {
 		async publish(input) {
-			const hash = await uploadFile(f, baseUrl, opts.token, input.appId, input.ppk);
+			const hash = await uploadFile(f, baseUrl, opts.token, input.appId, input.ppk, opts.httpUpload);
 			const { id } = await q(`/app/${input.appId}/version/create`, {
 				method: "POST",
 				body: JSON.stringify({
 					name: input.name,
 					hash,
 					description: input.description ?? "",
-					metaInfo: ""
+					metaInfo: "",
+					deps: input.deps
 				})
 			});
 			await bind(q, input.appId, id, input.packageVersion, input.rollout);
 			return { versionId: id };
 		},
-		async uploadApp(appId, appFile, versionName) {
-			const hash = await uploadFile(f, baseUrl, opts.token, appId, appFile);
+		async uploadApp(appId, appFile, versionName, deps) {
+			const hash = await uploadFile(f, baseUrl, opts.token, appId, appFile, opts.httpUpload);
 			const { id } = await q(`/app/${appId}/package/create`, {
 				method: "POST",
 				body: JSON.stringify({
 					name: versionName,
 					hash,
-					buildTime: String(Date.now())
+					buildTime: String(Date.now()),
+					deps
 				})
 			});
 			return {
@@ -560,7 +604,8 @@ function makeRnUpdateProvider(opts, cli) {
 					platform: ctx.platform,
 					name,
 					description: ctx.note,
-					packageVersion: betaPackageVersion(versionName)
+					packageVersion: betaPackageVersion(versionName),
+					deps: readDepVersions(ctx.cwd)
 				})).versionId
 			};
 		},
@@ -576,7 +621,8 @@ function makeRnUpdateProvider(opts, cli) {
 					name,
 					description: ctx.note,
 					packageVersion: versionName,
-					rollout
+					rollout,
+					deps: readDepVersions(ctx.cwd)
 				})).versionId,
 				...rollout !== void 0 ? { rollout } : {}
 			};
@@ -626,7 +672,7 @@ function rnUpdate(opts = {}, cli) {
 			try {
 				const versionName = readArtifactVersion(result.artifactPath)?.versionName;
 				if (!versionName) throw new Error(`未能从产物读出 versionName：${result.artifactPath}（readArtifactVersion 不支持该格式？）`);
-				await resolvePushyClient(opts, cli, hookCtx.credentials).uploadApp(appId, result.artifactPath, versionName);
+				await resolvePushyClient(opts, cli, hookCtx.credentials).uploadApp(appId, result.artifactPath, versionName, readDepVersions(hookCtx.cwd));
 			} catch (e) {
 				process.stderr.write(`⚠ pushy 基线上传失败（请人工补传）：${e.message}\n`);
 			}
@@ -634,4 +680,4 @@ function rnUpdate(opts = {}, cli) {
 	};
 }
 //#endregion
-export { PUSHY_DEFAULT_BASE_URL, PUSHY_TOKEN_KEY, createPushyApi, dingtalkNotify, electronAdapter, electronFramework, flutterAdapter, flutterFramework, judgeDelivery, knownFrameworkAdapters, makeRnUpdateProvider, nativeAndroidAdapter, nativeAndroidFramework, nativeHarmonyAdapter, nativeHarmonyFramework, nativeIosAdapter, nativeIosFramework, rnAdapter, rnFramework, rnUpdate, suggestFramework, tauriAdapter, tauriFramework };
+export { PUSHY_DEFAULT_BASE_URL, PUSHY_TOKEN_KEY, createPushyApi, dingtalkNotify, electronAdapter, electronFramework, flutterAdapter, flutterFramework, judgeDelivery, knownFrameworkAdapters, makeRnUpdateProvider, nativeAndroidAdapter, nativeAndroidFramework, nativeHarmonyAdapter, nativeHarmonyFramework, nativeIosAdapter, nativeIosFramework, nodeHttpUpload, readDepVersions, rnAdapter, rnFramework, rnUpdate, suggestFramework, tauriAdapter, tauriFramework };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@applift/core",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "repository": {
     "type": "git",
     "url": "https://github.com/hcg1023/applift.git",