@automattic/vip 4.1.2 → 4.1.4

package/node_modules/undici/lib/web/websocket/stream/websocketstream.js

@@ -34,9 +34,9 @@ class WebSocketStream {
   /** @type {ReadableStreamDefaultController} */
   #readableStreamController
 
-  // Each WebSocketStream object has an associated writable stream , which is a WritableStream .
-  /** @type {WritableStream} */
-  #writableStream
+  // Retain the controller so the writable stream can be errored while locked.
+  /** @type {WritableStreamDefaultController} */
+  #writableStreamController
 
   // Each WebSocketStream object has an associated boolean handshake aborted , which is initially false.
   #handshakeAborted = false
@@ -300,6 +300,9 @@ class WebSocketStream {
     // 12. Let writable be a new WritableStream .
     // 13. Set up writable with writeAlgorithm , closeAlgorithm , and abortAlgorithm .
     const writable = new WritableStream({
+      start: (controller) => {
+        this.#writableStreamController = controller
+      },
       write: (chunk) => this.#write(chunk),
       close: () => closeWebSocketConnection(this.#handler, null, null),
       abort: (reason) => this.#closeUsingReason(reason)
@@ -308,9 +311,6 @@ class WebSocketStream {
     // Set stream ’s readable stream to readable .
     this.#readableStream = readable
 
-    // Set stream ’s writable stream to writable .
-    this.#writableStream = writable
-
     // Resolve stream ’s opened promise with WebSocketOpenInfo «[ " extensions " → extensions , " protocol " → protocol , " readable " → readable , " writable " → writable ]».
     this.#openedPromise.resolve({
       extensions,
@@ -396,9 +396,7 @@ class WebSocketStream {
       readableStreamClose(this.#readableStreamController)
 
       // 6.2. Error stream ’s writable stream with an " InvalidStateError " DOMException indicating that a closed WebSocketStream cannot be written to.
-      if (!this.#writableStream.locked) {
-        this.#writableStream.abort(new DOMException('A closed WebSocketStream cannot be written to', 'InvalidStateError'))
-      }
+      this.#writableStreamController.error(new DOMException('A closed WebSocketStream cannot be written to', 'InvalidStateError'))
 
       // 6.3. Resolve stream ’s closed promise with WebSocketCloseInfo «[ " closeCode " → code , " reason " → reason ]».
       this.#closedPromise.resolve({
@@ -415,7 +413,7 @@ class WebSocketStream {
       this.#readableStreamController?.error(error)
 
       // 7.3. Error stream ’s writable stream with error .
-      this.#writableStream?.abort(error)
+      this.#writableStreamController?.error(error)
 
       // 7.4. Reject stream ’s closed promise with error .
       this.#closedPromise.reject(error)

package/node_modules/undici/package.json

@@ -1,6 +1,6 @@
 {
   "name": "undici",
-  "version": "8.10.0",
+  "version": "8.10.2",
   "description": "An HTTP/1.1 client, written from scratch for Node.js",
   "homepage": "https://undici.nodejs.org",
   "bugs": {
@@ -97,7 +97,7 @@
     "test:websocket:autobahn": "node test/autobahn/client.js",
     "test:websocket:autobahn:report": "node test/autobahn/report.js",
     "test:wpt:setup": "node test/web-platform-tests/wpt-runner.mjs setup",
-    "test:wpt": "npm run test:wpt:setup && node test/web-platform-tests/wpt-runner.mjs run /fetch /mimesniff /websockets /serviceWorkers /eventsource",
+    "test:wpt": "npm run test:wpt:setup && node test/web-platform-tests/wpt-runner.mjs run /fetch /mimesniff /xhr /websockets /eventsource",
     "test:cache-tests": "node test/cache-interceptor/cache-tests.mjs --ci",
     "coverage": "npm run coverage:clean && cross-env NODE_V8_COVERAGE=./coverage/tmp npm run test:javascript && npm run coverage:report",
     "coverage:ci": "npm run coverage:clean && cross-env NODE_V8_COVERAGE=./coverage/tmp npm run test:javascript && npm run coverage:report:ci",
@@ -109,7 +109,7 @@
     "prepare": "husky && node ./scripts/platform-shell.js"
   },
   "devDependencies": {
-    "@fastify/busboy": "3.2.0",
+    "@fastify/busboy": "3.2.2",
     "@matteo.collina/tspl": "^0.2.0",
     "@metcoder95/https-pem": "^1.0.0",
     "@sinonjs/fake-timers": "^12.0.0",

package/node_modules/undici/types/client.d.ts

@@ -80,6 +80,8 @@ export declare namespace Client {
     maxResponseSize?: number;
     /** WebSocket-specific options */
     webSocket?: Client.WebSocketOptions;
+    /** EventSource-specific options */
+    eventSource?: Client.EventSourceOptions;
     /** Enables a family autodetection algorithm that loosely implements section 5 of RFC 8305. */
     autoSelectFamily?: boolean;
     /** The amount of time in milliseconds to wait for a connection attempt to finish before trying the next address when using the `autoSelectFamily` option. */
@@ -169,6 +171,14 @@ export declare namespace Client {
      */
     settings?: Omit<SessionOptions['settings'], 'enablePush' | 'maxConcurrentStreams' | 'enableConnectProtocol'>
   }
+  export interface EventSourceOptions {
+    /**
+     * Maximum allowed event size in bytes for EventSource messages.
+     * Set to 0 to disable the limit.
+     * @default buffer.kStringMaxLength
+     */
+    maxEventSize?: number;
+  }
 }
 
 export default Client

package/node_modules/undici/types/interceptors.d.ts

@@ -12,6 +12,8 @@ declare namespace Interceptors {
   export type DecompressInterceptorOpts = {
     skipErrorResponses?: boolean
     skipStatusCodes?: number[]
+    /** Maximum decompressed response size in bytes. @default 67108864 */
+    maxSize?: number
   }
 
   export type ResponseErrorInterceptorOpts = { throwOnError: boolean }

package/node_modules/undici/types/mock-agent.d.ts

@@ -6,10 +6,6 @@ import { MockCallHistory } from './mock-call-history'
 
 export default MockAgent
 
-interface PendingInterceptor extends MockDispatch {
-  origin: string;
-}
-
 /** A mocked Agent class that implements the Agent API. It allows one to intercept HTTP requests made through undici and return mocked responses instead. */
 declare class MockAgent<TMockAgentOptions extends MockAgent.Options = MockAgent.Options> extends Dispatcher {
   constructor (options?: TMockAgentOptions)
@@ -40,17 +36,22 @@ declare class MockAgent<TMockAgentOptions extends MockAgent.Options = MockAgent.
   enableCallHistory (): this
   /** Disable call history. Any subsequence calls will then not be registered. */
   disableCallHistory (): this
-  pendingInterceptors (): PendingInterceptor[]
+  pendingInterceptors (): MockAgent.PendingInterceptor[]
   assertNoPendingInterceptors (options?: {
-    pendingInterceptorsFormatter?: PendingInterceptorsFormatter;
+    pendingInterceptorsFormatter?: MockAgent.PendingInterceptorsFormatter;
   }): void
 }
 
-interface PendingInterceptorsFormatter {
-  format(pendingInterceptors: readonly PendingInterceptor[]): string;
-}
-
 declare namespace MockAgent {
+  /** An interceptor that was registered on a mock dispatcher and has not been consumed yet. */
+  export interface PendingInterceptor extends MockDispatch {
+    origin: string;
+  }
+
+  export interface PendingInterceptorsFormatter {
+    format(pendingInterceptors: readonly PendingInterceptor[]): string;
+  }
+
   /** MockAgent options. */
   export interface Options extends Agent.Options {
     /** A custom agent to be encapsulated by the MockAgent. */

package/node_modules/undici/types/socks5-proxy-agent.d.ts

@@ -21,5 +21,7 @@ declare namespace Socks5ProxyAgent {
     connect?: buildConnector.connector;
     /** TLS options for the proxy connection (for SOCKS5 over TLS) */
     proxyTls?: buildConnector.BuildOptions;
+    /** TLS options for the end-to-end connection to the target */
+    requestTls?: buildConnector.BuildOptions;
   }
 }

package/node_modules/undici-types/client.d.ts

@@ -33,7 +33,7 @@ export declare namespace Client {
   export interface Options {
     /** The maximum length of request headers in bytes. Default: Node.js' `--max-http-header-size` or `16384` (16KiB). */
     maxHeaderSize?: number;
-    /** The amount of time, in milliseconds, the parser will wait to receive the complete HTTP headers (Node 14 and above only). Default: `300e3` milliseconds (300s). */
+    /** The amount of time, in milliseconds, the parser will wait to receive the complete HTTP headers (Node 14 and above only). Default: `300e3` milliseconds (300s). HTTP/1.1 parser timeouts are not guaranteed to fire with exact millisecond precision: delays up to 1000ms use native timers, while larger delays use lower-overhead fast timers with a target resolution around 500ms. */
     headersTimeout?: number;
     /** @deprecated unsupported socketTimeout, use headersTimeout & bodyTimeout instead */
     socketTimeout?: never;
@@ -41,7 +41,7 @@ export declare namespace Client {
     requestTimeout?: never;
     /** The timeout for establishing a socket connection, in milliseconds. Use `0` to disable it entirely. Default: `10e3` milliseconds (10s). */
     connectTimeout?: number;
-    /** The timeout after which a request will time out, in milliseconds. Monitors time between receiving body data. Use `0` to disable it entirely. Default: `300e3` milliseconds (300s). */
+    /** The timeout after which a request will time out, in milliseconds. Monitors time between receiving body data. Use `0` to disable it entirely. Default: `300e3` milliseconds (300s). HTTP/1.1 parser timeouts are not guaranteed to fire with exact millisecond precision: delays up to 1000ms use native timers, while larger delays use lower-overhead fast timers with a target resolution around 500ms. */
     bodyTimeout?: number;
     /** @deprecated unsupported idleTimeout, use keepAliveTimeout instead */
     idleTimeout?: never;
@@ -57,7 +57,7 @@ export declare namespace Client {
     keepAliveTimeoutThreshold?: number;
     /** An IPC endpoint, either a Unix domain socket or Windows named pipe. Default: `null`. */
     socketPath?: string;
-    /** The amount of concurrent requests to be sent over the single TCP/TLS connection according to [RFC7230](https://tools.ietf.org/html/rfc7230#section-6.3.2). Default: `1`. */
+    /** The amount of concurrent requests to be sent over the single TCP/TLS connection according to [RFC7230](https://tools.ietf.org/html/rfc7230#section-6.3.2). Only enable values greater than `1` when the remote server is trusted. Default: `1`. */
     pipelining?: number;
     /** @deprecated use the connect option instead */
     tls?: never;
@@ -116,6 +116,11 @@ export declare namespace Client {
     bytesRead?: number
   }
   export interface WebSocketOptions {
+    /**
+     * Maximum number of fragments in a message. Set to 0 to disable the limit.
+     * @default 131072
+     */
+    maxFragments?: number;
     /**
      * Maximum allowed payload size in bytes for WebSocket messages.
      * Applied to uncompressed messages, compressed frame payloads, and decompressed (permessage-deflate) messages.

package/node_modules/undici-types/connector.d.ts

@@ -7,6 +7,7 @@ declare function buildConnector (options?: buildConnector.BuildOptions): buildCo
 declare namespace buildConnector {
   export type BuildOptions = (ConnectionOptions | TcpNetConnectOpts | IpcNetConnectOpts) & {
     allowH2?: boolean;
+    preferH2?: boolean;
     maxCachedSessions?: number | null;
     socketPath?: string | null;
     timeout?: number | null;

package/node_modules/undici-types/cookies.d.ts

@@ -18,7 +18,7 @@ export interface Cookie {
 export function deleteCookie (
   headers: Headers,
   name: string,
-  attributes?: { name?: string, domain?: string }
+  attributes?: { path?: string, domain?: string }
 ): void
 
 export function getCookies (headers: Headers): Record<string, string>

package/node_modules/undici-types/dispatcher.d.ts

@@ -111,13 +111,13 @@ declare namespace Dispatcher {
     idempotent?: boolean;
     /** Whether the response is expected to take a long time and would end up blocking the pipeline. When this is set to `true` further pipelining will be avoided on the same connection until headers have been received. Defaults to `method !== 'HEAD'`. */
     blocking?: boolean;
-    /** The IP Type of Service (ToS) value for the request socket. Must be an integer between 0 and 255. Default: `0` */
+    /** The IP Type of Service (ToS) value for the request socket. Must be an integer between 0 and 255. */
     typeOfService?: number | null;
     /** Upgrade the request. Should be used to specify the kind of upgrade i.e. `'Websocket'`. Default: `method === 'CONNECT' || null`. */
     upgrade?: boolean | string | null;
-    /** The amount of time, in milliseconds, the parser will wait to receive the complete HTTP headers. Defaults to 300 seconds. */
+    /** The amount of time, in milliseconds, the parser will wait to receive the complete HTTP headers. Defaults to 300 seconds. HTTP/1.1 parser timeouts are not guaranteed to fire with exact millisecond precision: delays up to 1000ms use native timers, while larger delays use lower-overhead fast timers with a target resolution around 500ms. */
     headersTimeout?: number | null;
-    /** The timeout after which a request will time out, in milliseconds. Monitors time between receiving body data. Use 0 to disable it entirely. Defaults to 300 seconds. */
+    /** The timeout after which a request will time out, in milliseconds. Monitors time between receiving body data. Use 0 to disable it entirely. Defaults to 300 seconds. HTTP/1.1 parser timeouts are not guaranteed to fire with exact millisecond precision: delays up to 1000ms use native timers, while larger delays use lower-overhead fast timers with a target resolution around 500ms. */
     bodyTimeout?: number | null;
     /** Whether the request should stablish a keep-alive or not. Default `false` */
     reset?: boolean;

package/node_modules/undici-types/errors.d.ts

@@ -154,6 +154,16 @@ declare namespace Errors {
     code: 'UND_ERR_PRX_TLS'
   }
 
+  export class ProxyConnectionError extends UndiciError {
+    constructor (
+      cause?: Error,
+      message?: string,
+      options?: Record<any, any>
+    )
+    name: 'ProxyConnectionError'
+    code: 'UND_ERR_PRX_CONN'
+  }
+
   export class MaxOriginsReachedError extends UndiciError {
     name: 'MaxOriginsReachedError'
     code: 'UND_ERR_MAX_ORIGINS_REACHED'

package/node_modules/undici-types/fetch.d.ts

@@ -36,7 +36,10 @@ export class BodyMixin {
   readonly bytes: () => Promise<Uint8Array>
   /**
    * @deprecated This method is not recommended for parsing multipart/form-data bodies in server environments.
-   * It is recommended to use a library such as [@fastify/busboy](https://www.npmjs.com/package/@fastify/busboy) as follows:
+   * Calling body.formData() buffers and parses the entire body. Since this is dictated by the spec,
+   * this method must only be called on responses from trusted servers.
+   * For responses from untrusted or user-controlled servers, use a dedicated streaming parser such as
+   * [@fastify/busboy](https://www.npmjs.com/package/@fastify/busboy) and apply application-specific limits as follows:
    *
    * @example
    * ```js
@@ -54,6 +57,7 @@ export class BodyMixin {
   readonly formData: () => Promise<FormData>
   readonly json: () => Promise<unknown>
   readonly text: () => Promise<string>
+  readonly textStream: () => ReadableStream<string>
 }
 
 export interface SpecIterator<T, TReturn = any, TNext = undefined> {

package/node_modules/undici-types/handlers.d.ts

@@ -1,6 +1,8 @@
 import Dispatcher from './dispatcher'
 
 export declare class RedirectHandler implements Dispatcher.DispatchHandler {
+  static buildDispatch (dispatcher: Dispatcher, maxRedirections: number): Dispatcher.Dispatch
+
   constructor (
     dispatch: Dispatcher.Dispatch,
     maxRedirections: number,

package/node_modules/undici-types/interceptors.d.ts

@@ -8,7 +8,7 @@ export default Interceptors
 declare namespace Interceptors {
   export type DumpInterceptorOpts = { maxSize?: number }
   export type RetryInterceptorOpts = RetryHandler.RetryOptions
-  export type RedirectInterceptorOpts = { maxRedirections?: number, throwOnMaxRedirect?: boolean }
+  export type RedirectInterceptorOpts = { maxRedirections?: number, throwOnMaxRedirect?: boolean, stripHeadersOnRedirect?: string[], stripHeadersOnCrossOriginRedirect?: string[] }
   export type DecompressInterceptorOpts = {
     skipErrorResponses?: boolean
     skipStatusCodes?: number[]

package/node_modules/undici-types/mock-interceptor.d.ts

@@ -75,9 +75,13 @@ declare namespace MockInterceptor {
     opts: MockResponseCallbackOptions
   ) => TData | Buffer | string
 
+  export type MockReplyOptions<TData extends object = object> = {
+    statusCode: number, data?: TData | Buffer | string, responseOptions?: MockResponseOptions
+  }
+
   export type MockReplyOptionsCallback<TData extends object = object> = (
     opts: MockResponseCallbackOptions
-  ) => { statusCode: number, data?: TData | Buffer | string, responseOptions?: MockResponseOptions }
+  ) => MockReplyOptions<TData> | Promise<MockReplyOptions<TData>>
 }
 
 interface Interceptable extends Dispatcher {

package/node_modules/undici-types/package.json

@@ -1,6 +1,6 @@
 {
   "name": "undici-types",
-  "version": "8.3.0",
+  "version": "8.9.0",
   "description": "A stand-alone types package for Undici",
   "homepage": "https://undici.nodejs.org",
   "bugs": {

package/node_modules/undici-types/proxy-agent.d.ts

@@ -24,6 +24,13 @@ declare namespace ProxyAgent {
     requestTls?: buildConnector.BuildOptions;
     proxyTls?: buildConnector.BuildOptions;
     clientFactory?(origin: URL, opts: object): Dispatcher;
+    /**
+     * Undici tunnels via CONNECT when the target endpoint uses HTTPS, and
+     * forwards (HTTP/1.1 absolute-form request-target, per RFC 9112 §3.2.2)
+     * otherwise, regardless of whether the proxy URL is HTTP or HTTPS. The
+     * non-tunneled forwarding path does not negotiate HTTP/2 with the proxy.
+     * Set to true to force tunneling for plain HTTP requests as well.
+     */
     proxyTunnel?: boolean;
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@automattic/vip",
-  "version": "4.1.2",
+  "version": "4.1.4",
   "description": "The VIP Javascript library & CLI",
   "main": "index.js",
   "bin": {
@@ -154,7 +154,7 @@
     "typescript": "^6.0.2"
   },
   "dependencies": {
-    "@apollo/client": "4.2.12",
+    "@apollo/client": "4.3.0",
     "@automattic/vip-search-replace": "^2.0.0",
     "@json2csv/plainjs": "^7.0.3",
     "@wwa/single-line-log": "^1.1.4",

package/packaging/macos/build-pkg.sh

@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+set -euo pipefail
+# Build an unsigned installer from already-signed binaries. Signing is owned
+# by the Buildkite caller; local payload tests never need signing credentials.
+if [ "$#" -ne 5 ]; then
+  echo 'Usage: build-pkg.sh <version> <arm64|amd64> <cli> <helper> <output>' >&2
+  exit 1
+fi
+version="$1"; arch="$2"; cli="$3"; helper="$4"; output="$5"
+case "$arch" in
+  arm64) host_arch=arm64 ;;
+  amd64) host_arch=x86_64 ;;
+  *) echo "Unsupported installer architecture: $arch" >&2; exit 1 ;;
+esac
+repo="$(cd "$(dirname "$0")/../.." && pwd)"
+# Inputs are resolved before changing directories; preserve signed bytes.
+cli="$(cd "$(dirname "$cli")" && pwd)/$(basename "$cli")"
+helper="$(cd "$(dirname "$helper")" && pwd)/$(basename "$helper")"
+mkdir -p "$(dirname "$output")"
+output="$(cd "$(dirname "$output")" && pwd)/$(basename "$output")"
+cd "$repo"
+numeric="$(go run -mod=mod ./cmd/installer-version "$version")"
+stage="$(mktemp -d)"
+trap 'rm -rf "$stage"' EXIT
+base="$stage/root/usr/local/lib/vip-cli"
+mkdir -p "$base/bin" "$stage/root/etc/paths.d" "$stage/scripts"
+cp "$cli" "$base/bin/vip-next"
+cp "$helper" "$base/bin/go-search-replace"
+chmod 755 "$base/bin/vip-next" "$base/bin/go-search-replace"
+printf '%s\n' '{"schema":1,"manager":"pkg"}' > "$base/bin/.vip-next-installer.json"
+printf '%s\n' "$numeric" > "$base/package-version"
+printf '%s\n' '/usr/local/lib/vip-cli/bin' > "$stage/root/etc/paths.d/vip-cli"
+cp LICENSE "$base/LICENSE"
+cp packaging/macos/uninstall.sh "$base/uninstall.sh"
+chmod 755 "$base/uninstall.sh"
+# Only a validated numeric version is substituted into the shell script.
+sed "s/@PACKAGE_VERSION@/$numeric/g" packaging/macos/preinstall > "$stage/scripts/preinstall"
+chmod 755 "$stage/scripts/preinstall"
+pkgbuild --root "$stage/root" --identifier com.automattic.vip-cli \
+  --version "$numeric" --install-location / --ownership recommended \
+  --scripts "$stage/scripts" "$stage/vip-cli.pkg"
+cat > "$stage/Distribution.xml" <<EOF
+<?xml version="1.0" encoding="utf-8"?>
+<installer-gui-script minSpecVersion="2">
+  <title>VIP CLI $version</title>
+  <options customize="never" require-scripts="false" hostArchitectures="$host_arch"/>
+  <domains enable_anywhere="false" enable_currentUserHome="false" enable_localSystem="true"/>
+  <choices-outline><line choice="default"/></choices-outline>
+  <choice id="default" visible="false"><pkg-ref id="com.automattic.vip-cli"/></choice>
+  <pkg-ref id="com.automattic.vip-cli" version="$numeric" onConclusion="none">vip-cli.pkg</pkg-ref>
+</installer-gui-script>
+EOF
+productbuild --distribution "$stage/Distribution.xml" --package-path "$stage" "$output"

package/packaging/macos/preinstall

@@ -0,0 +1,33 @@
+#!/bin/sh
+set -eu
+# Installer supplies the target volume as $3. This also permits safe tests
+# against a temporary volume tree without touching system paths.
+target="${3:?missing target volume}"
+target="${target%/}"
+base="$target/usr/local/lib/vip-cli"
+pathfile="$target/etc/paths.d/vip-cli"
+fail() { echo "VIP CLI: $*" >&2; exit 1; }
+for dir in "$target/usr" "$target/usr/local" "$target/usr/local/lib" "$base" "$base/bin" "$target/etc/paths.d"; do
+  [ ! -L "$dir" ] || fail "Refusing symlinked installation path: $dir"
+done
+# /etc is a system symlink on macOS, so it is intentionally allowed above.
+if [ -e "$base" ]; then
+  marker="$base/bin/.vip-next-installer.json"
+  [ -f "$marker" ] && [ ! -L "$marker" ] || fail 'Existing directory is not owned by the VIP CLI installer.'
+  [ "$(cat "$marker")" = '{"schema":1,"manager":"pkg"}' ] || fail 'Invalid installer ownership record.'
+  [ -f "$base/package-version" ] && [ ! -L "$base/package-version" ] || fail 'Missing installed package version.'
+  old="$(cat "$base/package-version")"
+  # Reject malformed records and downgrades before overwriting any files.
+  awk -v old="$old" -v new='@PACKAGE_VERSION@' 'BEGIN {
+    if (old !~ /^[0-9]+\.[0-9]+\.[0-9]+$/) exit 1
+    split(old, a, "."); split(new, b, ".")
+    for (i=1;i<=3;i++) { if (a[i]+0>b[i]+0) exit 1; if (a[i]+0<b[i]+0) exit 0 }
+  }' || fail 'A newer version is installed or its version record is invalid. Uninstall it before installing this version.'
+fi
+if [ -e "$pathfile" ] || [ -L "$pathfile" ]; then
+  [ -f "$pathfile" ] && [ ! -L "$pathfile" ] || fail 'Refusing to replace the existing PATH entry.'
+  [ "$(cat "$pathfile")" = '/usr/local/lib/vip-cli/bin' ] || fail 'Existing PATH entry belongs to another installation.'
+fi
+for file in "$base/bin/vip-next" "$base/bin/go-search-replace" "$base/LICENSE" "$base/uninstall.sh"; do
+  [ ! -L "$file" ] || fail "Refusing to overwrite symlink: $file"
+done

package/packaging/macos/test-install.sh

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+set -euo pipefail
+# System installation is restricted to disposable GitHub-hosted macOS runners.
+if [ "${VIP_INSTALLER_E2E:-}" != 1 ] || [ "${GITHUB_ACTIONS:-}" != true ] || [ "${RUNNER_ENVIRONMENT:-}" != github-hosted ]; then
+  echo 'Installer lifecycle tests require VIP_INSTALLER_E2E=1 on a GitHub-hosted runner.' >&2
+  exit 1
+fi
+base=/usr/local/lib/vip-cli
+pathfile=/etc/paths.d/vip-cli
+if [ -e "$base" ] || [ -L "$base" ] || [ -e "$pathfile" ] || [ -L "$pathfile" ] || pkgutil --pkg-info com.automattic.vip-cli >/dev/null 2>&1; then
+  echo 'Refusing to test over an existing installation or receipt.' >&2
+  exit 1
+fi
+repo="$(cd "$(dirname "$0")/../.." && pwd)"
+cd "$repo"
+stage="$(mktemp -d)"
+cleanup() {
+  if [ -f "$base/bin/.vip-next-installer.json" ] && [ -f "$base/uninstall.sh" ]; then
+    sudo /bin/sh "$base/uninstall.sh"
+  fi
+  rm -rf "$stage"
+}
+trap cleanup EXIT
+case "$(uname -m)" in arm64) arch=arm64 ;; x86_64) arch=amd64 ;; *) exit 1 ;; esac
+for v in 5.0.0-alpha.0 5.0.0-alpha.1; do
+  go build -buildvcs=false -ldflags="-X main.fixtureVersion=$v" -o "$stage/fixture" ./testdata/installer-fixture
+  go build -buildvcs=false -ldflags="-X main.fixtureVersion=$v-helper" -o "$stage/helper" ./testdata/installer-fixture
+  bash packaging/macos/build-pkg.sh "$v" "$arch" "$stage/fixture" "$stage/helper" "$stage/$v.pkg"
+done
+for v in 5.0.0-alpha.0 5.0.0-alpha.1; do
+  sudo installer -pkg "$stage/$v.pkg" -target /
+  test "$("$base/bin/vip-next" --version)" = "$v"
+  test "$("$base/bin/go-search-replace" --version)" = "$v-helper"
+  "$base/bin/vip-next" --installer-owner | grep -F '.pkg'
+  test "$(cat "$pathfile")" = "$base/bin"
+  /bin/zsh -lc 'command -v vip-next' | grep -Fx "$base/bin/vip-next"
+done
+if sudo installer -pkg "$stage/5.0.0-alpha.0.pkg" -target /; then
+  echo 'Downgrade was incorrectly accepted.' >&2
+  exit 1
+fi
+test "$("$base/bin/vip-next" --version)" = 5.0.0-alpha.1
+test "$("$base/bin/go-search-replace" --version)" = 5.0.0-alpha.1-helper
+sudo /bin/sh "$base/uninstall.sh"
+test ! -e "$base"
+test ! -e "$pathfile"
+if pkgutil --pkg-info com.automattic.vip-cli >/dev/null 2>&1; then
+  echo 'Receipt remains after uninstall.' >&2
+  exit 1
+fi
+echo 'macOS installer install/upgrade/downgrade/PATH/ownership/uninstall tests passed.'

package/packaging/macos/test_package.py

@@ -0,0 +1,74 @@
+"""Build and expand real PKGs without installing anything on the host."""
+import os
+from pathlib import Path
+import platform
+import shutil
+import subprocess
+import tempfile
+import unittest
+import xml.etree.ElementTree as ET
+
+REPO = Path(__file__).resolve().parents[2]
+
+
+@unittest.skipUnless(platform.system() == "Darwin", "requires macOS packaging tools")
+class PackageTests(unittest.TestCase):
+    def test_payload_and_preinstall(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            tmp = Path(tmp)
+            package = tmp / "VIP CLI.pkg"
+            subprocess.run(["bash", str(REPO / "packaging/macos/build-pkg.sh"),
+                            "5.0.0-beta.1", "arm64", "/bin/echo", "/usr/bin/true", str(package)],
+                           cwd=REPO, check=True)
+            verify = ["python3", str(REPO / "packaging/macos/verify-pkg.py"), str(package), "5.0.301", "arm64", "/bin/echo", "/usr/bin/true"]
+            subprocess.run(verify, check=True)
+            # Wrong input bytes must reject the completed package, even if it
+            # was successfully produced by the native packaging tools.
+            wrong_input = verify[:-1] + ["/bin/echo"]
+            result = subprocess.run(wrong_input, capture_output=True, text=True)
+            self.assertNotEqual(result.returncode, 0)
+            self.assertIn("payload differs", result.stderr)
+            expanded = tmp / "expanded"
+            subprocess.run(["pkgutil", "--expand-full", str(package), str(expanded)], check=True)
+            distribution = ET.parse(expanded / "Distribution")
+            self.assertEqual(distribution.find("options").get("hostArchitectures"), "arm64")
+            component = expanded / "vip-cli.pkg"
+            info = ET.parse(component / "PackageInfo").getroot()
+            self.assertEqual(info.get("identifier"), "com.automattic.vip-cli")
+            self.assertEqual(info.get("version"), "5.0.301")
+            payload = component / "Payload"
+            base = payload / "usr/local/lib/vip-cli"
+            self.assertEqual((base / "bin/vip-next").read_bytes(), Path("/bin/echo").read_bytes())
+            self.assertEqual((base / "bin/go-search-replace").read_bytes(), Path("/usr/bin/true").read_bytes())
+            self.assertEqual((base / "bin/.vip-next-installer.json").read_text().strip(), '{"schema":1,"manager":"pkg"}')
+            self.assertEqual((payload / "etc/paths.d/vip-cli").read_text(), "/usr/local/lib/vip-cli/bin\n")
+            self.assertEqual((base / "package-version").read_text(), "5.0.301\n")
+            self.assertTrue(os.access(base / "uninstall.sh", os.X_OK))
+            preinstall = component / "Scripts/preinstall"
+            target = tmp / "volume"
+            target.mkdir()
+
+            def check_install(ok):
+                result = subprocess.run(["/bin/sh", str(preinstall), str(package), "/", str(target)], capture_output=True, text=True)
+                self.assertEqual(result.returncode == 0, ok, result.stdout + result.stderr)
+
+            check_install(True)
+            installed = target / "usr/local/lib/vip-cli"
+            installed.mkdir(parents=True)
+            (installed / "unrelated").write_text("keep")
+            check_install(False)
+            self.assertEqual((installed / "unrelated").read_text(), "keep")
+            shutil.copytree(base, installed, dirs_exist_ok=True)
+            check_install(True)
+            (installed / "package-version").write_text("5.0.999\n")
+            check_install(False)
+            (installed / "package-version").write_text("5.0.100\n")
+            check_install(True)
+            paths = target / "etc/paths.d"
+            paths.mkdir(parents=True)
+            (paths / "vip-cli").write_text("/another/tool\n")
+            check_install(False)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/packaging/macos/uninstall.sh

@@ -0,0 +1,24 @@
+#!/bin/sh
+set -eu
+# Remove only installer-owned files. User configuration and credentials are
+# stored elsewhere and are not touched. No recursive removal is used.
+base=/usr/local/lib/vip-cli
+pathfile=/etc/paths.d/vip-cli
+[ "$(id -u)" -eq 0 ] || { echo "Run: sudo $base/uninstall.sh" >&2; exit 1; }
+for dir in /usr /usr/local /usr/local/lib "$base" "$base/bin" /etc/paths.d; do
+  [ ! -L "$dir" ] || { echo "Refusing symlinked path: $dir" >&2; exit 1; }
+done
+marker="$base/bin/.vip-next-installer.json"
+[ -f "$marker" ] && [ ! -L "$marker" ] && [ "$(cat "$marker")" = '{"schema":1,"manager":"pkg"}' ] || {
+  echo 'This directory is not owned by the VIP CLI installer.' >&2; exit 1;
+}
+if [ -e "$pathfile" ] || [ -L "$pathfile" ]; then
+  [ ! -L "$pathfile" ] && [ -f "$pathfile" ] && [ "$(cat "$pathfile")" = '/usr/local/lib/vip-cli/bin' ] || {
+    echo 'PATH entry has changed; inspect it before uninstalling.' >&2; exit 1;
+  }
+  rm "$pathfile"
+fi
+rm -f "$base/bin/vip-next" "$base/bin/go-search-replace" "$marker" "$base/package-version" "$base/LICENSE" "$base/uninstall.sh"
+rmdir "$base/bin" "$base" 2>/dev/null || true
+pkgutil --forget com.automattic.vip-cli
+echo 'VIP CLI removed. Open a new terminal to refresh PATH.'