@better-update/cli 0.3.0 → 0.3.2

package/src/lib/sha256.test.ts

@@ -1,108 +0,0 @@
-import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-
-import { it } from "@effect/vitest";
-import { Effect, Exit } from "effect";
-
-import { BuildFailedError } from "./exit-codes";
-import { sha256File, sha256FileBase64Url, sha256Namespaced } from "./sha256";
-import { failureError } from "./test-utils";
-
-// ── fixtures ──────────────────────────────────────────────────────
-
-const HELLO_WORLD = "hello world";
-const HELLO_WORLD_SHA256 = "b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9";
-
-// ── helpers ───────────────────────────────────────────────────────
-
-const withTempFile = <Result>(
-  content: Buffer,
-  run: (path: string) => Effect.Effect<Result, BuildFailedError>,
-) =>
-  Effect.gen(function* () {
-    const dir = mkdtempSync(join(tmpdir(), "sha256-test-"));
-    const filePath = join(dir, "fixture.bin");
-    writeFileSync(filePath, content);
-    const result = yield* run(filePath).pipe(
-      Effect.ensuring(Effect.sync(() => rmSync(dir, { recursive: true, force: true }))),
-    );
-    return result;
-  });
-
-// ── tests ─────────────────────────────────────────────────────────
-
-describe(sha256File, () => {
-  it.effect('computes known SHA-256 for "hello world"', () =>
-    Effect.gen(function* () {
-      const result = yield* withTempFile(Buffer.from(HELLO_WORLD, "utf8"), (path) =>
-        sha256File(path),
-      );
-      expect(result.sha256).toBe(HELLO_WORLD_SHA256);
-      expect(result.byteSize).toBe(HELLO_WORLD.length);
-    }),
-  );
-
-  it.effect("handles an empty file", () =>
-    Effect.gen(function* () {
-      const result = yield* withTempFile(Buffer.alloc(0), (path) => sha256File(path));
-      // SHA-256 of empty input
-      expect(result.sha256).toBe(
-        "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
-      );
-      expect(result.byteSize).toBe(0);
-    }),
-  );
-
-  it.effect("streams larger content without loading all into memory", () =>
-    Effect.gen(function* () {
-      // 1 MiB of zeros
-      const buf = Buffer.alloc(1_048_576, 0);
-      const result = yield* withTempFile(buf, (path) => sha256File(path));
-      expect(result.byteSize).toBe(1_048_576);
-      expect(result.sha256).toHaveLength(64);
-    }),
-  );
-
-  it.effect("fails with BuildFailedError on non-existent path", () =>
-    Effect.gen(function* () {
-      const exit = yield* sha256File("/nonexistent-path-for-test-xyz").pipe(Effect.exit);
-      expect(Exit.isFailure(exit)).toBe(true);
-      expect(failureError(exit)).toBeInstanceOf(BuildFailedError);
-    }),
-  );
-});
-
-describe(sha256FileBase64Url, () => {
-  it.effect('computes a base64url SHA-256 digest for "hello world"', () =>
-    Effect.gen(function* () {
-      const result = yield* withTempFile(Buffer.from(HELLO_WORLD, "utf8"), (path) =>
-        sha256FileBase64Url(path),
-      );
-      expect(result.sha256Base64Url).toBe("uU0nuZNNPgilLlLX2n2r-sSE7-N6U4DukIj3rOLvzek");
-      expect(result.byteSize).toBe(HELLO_WORLD.length);
-    }),
-  );
-});
-
-describe(sha256Namespaced, () => {
-  it("produces different hashes for same content with different content types", () => {
-    const jsHash = sha256Namespaced("application/javascript", HELLO_WORLD_SHA256);
-    const textHash = sha256Namespaced("text/plain", HELLO_WORLD_SHA256);
-
-    expect(jsHash).not.toBe(textHash);
-    expect(jsHash).not.toBe(HELLO_WORLD_SHA256);
-  });
-
-  it("produces same hash for same content type + content hash", () => {
-    const first = sha256Namespaced("application/javascript", HELLO_WORLD_SHA256);
-    const second = sha256Namespaced("application/javascript", HELLO_WORLD_SHA256);
-    expect(first).toBe(second);
-  });
-
-  it("returns base64url-encoded string", () => {
-    const result = sha256Namespaced("application/javascript", HELLO_WORLD_SHA256);
-    // Base64url: no +, /, or =
-    expect(result).toMatch(/^[A-Za-z0-9_-]+$/u);
-  });
-});

package/src/lib/sha256.ts

@@ -1,80 +0,0 @@
-import { createHash } from "node:crypto";
-import { createReadStream } from "node:fs";
-
-import { toBase64Url } from "@better-update/encoding";
-import { Effect } from "effect";
-
-import { BuildFailedError } from "./exit-codes";
-
-export interface Sha256FileResult {
-  readonly sha256: string;
-  readonly byteSize: number;
-}
-
-export interface Sha256FileBase64UrlResult {
-  readonly sha256Base64Url: string;
-  readonly byteSize: number;
-}
-
-const hashReadError = (message: string) =>
-  new BuildFailedError({
-    step: "sha256",
-    exitCode: 1,
-    message,
-  });
-
-const hashFile = <TDigest>(
-  path: string,
-  formatDigest: (digest: Buffer) => TDigest,
-): Effect.Effect<{ digest: TDigest; byteSize: number }, BuildFailedError> =>
-  Effect.async<{ digest: TDigest; byteSize: number }, BuildFailedError>((resume) => {
-    const hash = createHash("sha256");
-    const stream = createReadStream(path);
-    let byteSize = 0;
-
-    stream.on("data", (chunk) => {
-      const buffer = typeof chunk === "string" ? Buffer.from(chunk) : chunk;
-      byteSize += buffer.byteLength;
-      hash.update(buffer);
-    });
-    stream.on("error", (error) => {
-      resume(Effect.fail(hashReadError(`Failed to read file for SHA-256: ${error.message}`)));
-    });
-    stream.on("end", () => {
-      resume(
-        Effect.succeed({
-          digest: formatDigest(hash.digest()),
-          byteSize,
-        }),
-      );
-    });
-  });
-
-/**
- * Compute the SHA-256 digest and byte size of a file using Node's streaming
- * hash API. The file is never fully loaded into memory — chunks flow through
- * `createReadStream` into `crypto.createHash("sha256")`.
- */
-export const sha256File = (path: string): Effect.Effect<Sha256FileResult, BuildFailedError> =>
-  hashFile(path, (digest) => digest.toString("hex")).pipe(
-    Effect.map(({ digest, byteSize }) => ({ sha256: digest, byteSize })),
-  );
-
-export const sha256FileBase64Url = (
-  path: string,
-): Effect.Effect<Sha256FileBase64UrlResult, BuildFailedError> =>
-  hashFile(path, toBase64Url).pipe(
-    Effect.map(({ digest, byteSize }) => ({ sha256Base64Url: digest, byteSize })),
-  );
-
-/**
- * Compute a content-type-namespaced hash: `SHA-256(contentType + '\0' + SHA-256_hex(fileBytes))`.
- *
- * This prevents hash collisions when identical bytes are served with different
- * MIME types (e.g. same file used as both `application/javascript` and `text/plain`).
- * The raw content hash is still needed separately for R2 upload verification.
- */
-export const sha256Namespaced = (contentType: string, contentSha256Hex: string): string => {
-  const input = `${contentType}\0${contentSha256Hex}`;
-  return toBase64Url(createHash("sha256").update(input).digest());
-};

package/src/lib/signed-payloads.test.ts

@@ -1,181 +0,0 @@
-import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-
-import { BunFileSystem } from "@effect/platform-bun";
-import { it } from "@effect/vitest";
-import { Effect, Exit } from "effect";
-
-import { loadOptionalSignedPayload, loadSignedPublishPayloads } from "./signed-payloads";
-import { failureError } from "./test-utils";
-
-const withSignedFiles = () => {
-  const dir = mkdtempSync(join(tmpdir(), "signed-payloads-"));
-  const manifestPath = join(dir, "manifest.json");
-  const signaturePath = join(dir, "manifest.sig");
-  const certificatePath = join(dir, "manifest.pem");
-
-  writeFileSync(manifestPath, '{"runtimeVersion":"1.0.0"}\n');
-  writeFileSync(signaturePath, 'sig="test-signature"\n');
-  writeFileSync(certificatePath, "-----BEGIN CERTIFICATE-----\nTEST\n-----END CERTIFICATE-----\n");
-
-  return {
-    manifestPath,
-    signaturePath,
-    certificatePath,
-    dispose: () => rmSync(dir, { recursive: true, force: true }),
-  };
-};
-
-describe(loadOptionalSignedPayload, () => {
-  it.effect("loads a complete signed payload triplet", () =>
-    Effect.gen(function* () {
-      const files = withSignedFiles();
-      const payload = yield* loadOptionalSignedPayload({
-        files: {
-          manifestBodyFile: files.manifestPath,
-          signatureFile: files.signaturePath,
-          certificateChainFile: files.certificatePath,
-        },
-        label: "Signed promote",
-        makeError: (message) => new Error(message),
-      }).pipe(Effect.provide(BunFileSystem.layer), Effect.ensuring(Effect.sync(files.dispose)));
-
-      expect(payload).toStrictEqual({
-        manifestBody: '{"runtimeVersion":"1.0.0"}\n',
-        signature: 'sig="test-signature"',
-        certificateChain: "-----BEGIN CERTIFICATE-----\nTEST\n-----END CERTIFICATE-----",
-      });
-    }),
-  );
-});
-
-describe(loadSignedPublishPayloads, () => {
-  it.effect("loads platform-specific signed payloads for a single-platform publish", () =>
-    Effect.gen(function* () {
-      const iosFiles = withSignedFiles();
-      const payloads = yield* loadSignedPublishPayloads({
-        platforms: ["ios"],
-        globalFiles: {
-          manifestBodyFile: undefined,
-          signatureFile: undefined,
-          certificateChainFile: undefined,
-        },
-        platformFiles: {
-          ios: {
-            manifestBodyFile: iosFiles.manifestPath,
-            signatureFile: iosFiles.signaturePath,
-            certificateChainFile: iosFiles.certificatePath,
-          },
-        },
-        makeError: (message) => new Error(message),
-      }).pipe(Effect.provide(BunFileSystem.layer), Effect.ensuring(Effect.sync(iosFiles.dispose)));
-
-      expect(payloads.ios?.manifestBody).toBe('{"runtimeVersion":"1.0.0"}\n');
-      expect(payloads.android).toBeUndefined();
-    }),
-  );
-
-  it.effect("loads per-platform signed payloads for a multi-platform publish", () =>
-    Effect.gen(function* () {
-      const iosFiles = withSignedFiles();
-      const androidFiles = withSignedFiles();
-      const payloads = yield* loadSignedPublishPayloads({
-        platforms: ["ios", "android"],
-        globalFiles: {
-          manifestBodyFile: undefined,
-          signatureFile: undefined,
-          certificateChainFile: undefined,
-        },
-        platformFiles: {
-          ios: {
-            manifestBodyFile: iosFiles.manifestPath,
-            signatureFile: iosFiles.signaturePath,
-            certificateChainFile: iosFiles.certificatePath,
-          },
-          android: {
-            manifestBodyFile: androidFiles.manifestPath,
-            signatureFile: androidFiles.signaturePath,
-            certificateChainFile: androidFiles.certificatePath,
-          },
-        },
-        makeError: (message) => new Error(message),
-      }).pipe(
-        Effect.provide(BunFileSystem.layer),
-        Effect.ensuring(
-          Effect.sync(() => {
-            iosFiles.dispose();
-            androidFiles.dispose();
-          }),
-        ),
-      );
-
-      expect(payloads.ios?.signature).toBe('sig="test-signature"');
-      expect(payloads.android?.certificateChain).toContain("BEGIN CERTIFICATE");
-    }),
-  );
-
-  it.effect("rejects generic signed files for multi-platform publish", () =>
-    Effect.gen(function* () {
-      const files = withSignedFiles();
-      const exit = yield* loadSignedPublishPayloads({
-        platforms: ["ios", "android"],
-        globalFiles: {
-          manifestBodyFile: files.manifestPath,
-          signatureFile: files.signaturePath,
-          certificateChainFile: files.certificatePath,
-        },
-        platformFiles: {},
-        makeError: (message) => new Error(message),
-      }).pipe(
-        Effect.provide(BunFileSystem.layer),
-        Effect.ensuring(Effect.sync(files.dispose)),
-        Effect.exit,
-      );
-
-      expect(Exit.isFailure(exit)).toBe(true);
-      if (Exit.isFailure(exit)) {
-        expect(failureError(exit)).toStrictEqual(
-          new Error(
-            "Signed multi-platform publish requires per-platform file sets. Use the --*-ios and --*-android options.",
-          ),
-        );
-      }
-    }),
-  );
-
-  it.effect("rejects ambiguous generic and platform-specific files for the same platform", () =>
-    Effect.gen(function* () {
-      const files = withSignedFiles();
-      const exit = yield* loadSignedPublishPayloads({
-        platforms: ["ios"],
-        globalFiles: {
-          manifestBodyFile: files.manifestPath,
-          signatureFile: files.signaturePath,
-          certificateChainFile: files.certificatePath,
-        },
-        platformFiles: {
-          ios: {
-            manifestBodyFile: files.manifestPath,
-            signatureFile: files.signaturePath,
-            certificateChainFile: files.certificatePath,
-          },
-        },
-        makeError: (message) => new Error(message),
-      }).pipe(
-        Effect.provide(BunFileSystem.layer),
-        Effect.ensuring(Effect.sync(files.dispose)),
-        Effect.exit,
-      );
-
-      expect(Exit.isFailure(exit)).toBe(true);
-      if (Exit.isFailure(exit)) {
-        expect(failureError(exit)).toStrictEqual(
-          new Error(
-            "Signed publish for ios is ambiguous. Use either the generic file options or the ios-specific file options, not both.",
-          ),
-        );
-      }
-    }),
-  );
-});

package/src/lib/signed-payloads.ts

@@ -1,164 +0,0 @@
-import { FileSystem } from "@effect/platform";
-import { Effect } from "effect";
-
-import { formatCause } from "./format-error";
-
-import type { Platform } from "./build-profile";
-
-export interface SignedPayload {
-  readonly manifestBody: string;
-  readonly signature: string;
-  readonly certificateChain: string;
-}
-
-export interface SignedPayloadFileSet {
-  readonly manifestBodyFile: string | undefined;
-  readonly signatureFile: string | undefined;
-  readonly certificateChainFile: string | undefined;
-}
-
-const emptySignedPayloadFileSet = {
-  manifestBodyFile: undefined,
-  signatureFile: undefined,
-  certificateChainFile: undefined,
-} as const satisfies SignedPayloadFileSet;
-
-const hasAnySignedPayloadFile = (files: SignedPayloadFileSet) =>
-  files.manifestBodyFile !== undefined ||
-  files.signatureFile !== undefined ||
-  files.certificateChainFile !== undefined;
-
-const loadSignedPayloadFromFiles = <Err>(params: {
-  readonly files: SignedPayloadFileSet;
-  readonly label: string;
-  readonly makeError: (message: string) => Err;
-}): Effect.Effect<SignedPayload | null, Err, FileSystem.FileSystem> =>
-  Effect.gen(function* () {
-    const fileSystem = yield* FileSystem.FileSystem;
-    if (!hasAnySignedPayloadFile(params.files)) {
-      return null;
-    }
-
-    if (
-      !params.files.manifestBodyFile ||
-      !params.files.signatureFile ||
-      !params.files.certificateChainFile
-    ) {
-      return yield* Effect.fail(
-        params.makeError(
-          `${params.label} requires ${[
-            params.files.manifestBodyFile ? null : "manifest body",
-            params.files.signatureFile ? null : "signature",
-            params.files.certificateChainFile ? null : "certificate chain",
-          ]
-            .filter(Boolean)
-            .join(", ")} file inputs to be provided as a complete triplet.`,
-        ),
-      );
-    }
-
-    const [manifestBody, signature, certificateChain] = yield* Effect.all(
-      [
-        fileSystem.readFileString(params.files.manifestBodyFile),
-        fileSystem.readFileString(params.files.signatureFile),
-        fileSystem.readFileString(params.files.certificateChainFile),
-      ],
-      { concurrency: "unbounded" },
-    ).pipe(
-      Effect.mapError((cause) =>
-        params.makeError(`${params.label} failed to read signed inputs: ${formatCause(cause)}`),
-      ),
-    );
-
-    return {
-      manifestBody,
-      signature: signature.trim(),
-      certificateChain: certificateChain.trimEnd(),
-    } as const satisfies SignedPayload;
-  });
-
-export const loadOptionalSignedPayload = loadSignedPayloadFromFiles;
-
-export const loadSignedPublishPayloads = <Err>(params: {
-  readonly platforms: readonly Platform[];
-  readonly globalFiles: SignedPayloadFileSet;
-  readonly platformFiles: Partial<Record<Platform, SignedPayloadFileSet>>;
-  readonly makeError: (message: string) => Err;
-}): Effect.Effect<Partial<Record<Platform, SignedPayload>>, Err, FileSystem.FileSystem> =>
-  Effect.gen(function* () {
-    const targetedPlatforms = new Set(params.platforms);
-    const nonTargetedPlatforms = (["ios", "android"] as const).filter(
-      (platform) =>
-        !targetedPlatforms.has(platform) &&
-        hasAnySignedPayloadFile(params.platformFiles[platform] ?? emptySignedPayloadFileSet),
-    );
-    if (nonTargetedPlatforms.length > 0) {
-      return yield* Effect.fail(
-        params.makeError(
-          `Signed publish inputs were provided for non-targeted platform(s): ${nonTargetedPlatforms.join(", ")}.`,
-        ),
-      );
-    }
-
-    const hasGlobalFiles = hasAnySignedPayloadFile(params.globalFiles);
-    if (
-      !hasGlobalFiles &&
-      Object.values(params.platformFiles).every((files) => !hasAnySignedPayloadFile(files))
-    ) {
-      return {};
-    }
-
-    if (params.platforms.length > 1 && hasGlobalFiles) {
-      return yield* Effect.fail(
-        params.makeError(
-          "Signed multi-platform publish requires per-platform file sets. Use the --*-ios and --*-android options.",
-        ),
-      );
-    }
-
-    if (params.platforms.length === 1 && hasGlobalFiles) {
-      const [platform] = params.platforms;
-      if (!platform) {
-        return {};
-      }
-      if (hasAnySignedPayloadFile(params.platformFiles[platform] ?? emptySignedPayloadFileSet)) {
-        return yield* Effect.fail(
-          params.makeError(
-            `Signed publish for ${platform} is ambiguous. Use either the generic file options or the ${platform}-specific file options, not both.`,
-          ),
-        );
-      }
-
-      const globalPayload = yield* loadSignedPayloadFromFiles({
-        files: params.globalFiles,
-        label: "Signed publish",
-        makeError: params.makeError,
-      });
-      return globalPayload === null ? {} : { [platform]: globalPayload };
-    }
-
-    const platformPayloadEntries = yield* Effect.forEach(
-      params.platforms,
-      (platform) =>
-        Effect.gen(function* () {
-          const payload = yield* loadSignedPayloadFromFiles({
-            files: params.platformFiles[platform] ?? emptySignedPayloadFileSet,
-            label: `Signed publish for ${platform}`,
-            makeError: params.makeError,
-          });
-
-          if (payload === null) {
-            return yield* Effect.fail(
-              params.makeError(
-                `Signed multi-platform publish requires a signed payload for ${platform}.`,
-              ),
-            );
-          }
-
-          return [platform, payload] as const;
-        }),
-      { concurrency: 1 },
-    );
-
-    return Object.fromEntries(platformPayloadEntries) as Partial<Record<Platform, SignedPayload>>;
-  });

package/src/lib/string-utils.ts

@@ -1,4 +0,0 @@
-export const capitalize = (value: string): string => {
-  const [first] = value;
-  return first === undefined ? value : `${first.toUpperCase()}${value.slice(1)}`;
-};

package/src/lib/temp-dir.ts

@@ -1,14 +0,0 @@
-import { FileSystem } from "@effect/platform";
-import { Effect } from "effect";
-
-/**
- * Create a scoped temp directory prefixed with "better-update-" and `chmod 0o700`
- * it so only the current user can read its contents. The directory and all files
- * inside it are removed when the enclosing scope closes.
- */
-export const acquireBuildTempDir = Effect.gen(function* () {
-  const fs = yield* FileSystem.FileSystem;
-  const dir = yield* fs.makeTempDirectoryScoped({ prefix: "better-update-" });
-  yield* fs.chmod(dir, 0o700);
-  return dir;
-});

package/src/lib/test-utils.ts

@@ -1,13 +0,0 @@
-import { Cause, Exit, Option } from "effect";
-
-/**
- * Extract the tagged error from a failed `Effect.exit` result. Returns the
- * first `Fail` value in the cause, or `undefined` for interrupts / dies /
- * success. Use in tests after `Effect.exit` to assert a specific error class.
- */
-export const failureError = <Err, Value>(exit: Exit.Exit<Value, Err>): Err | undefined => {
-  if (!Exit.isFailure(exit)) {
-    return undefined;
-  }
-  return Option.getOrUndefined(Cause.failureOption(exit.cause));
-};

package/src/lib/update-platforms.test.ts

@@ -1,45 +0,0 @@
-import { resolveUpdatePlatforms } from "./update-platforms";
-
-describe(resolveUpdatePlatforms, () => {
-  const fullConfig = {
-    expo: {
-      ios: { bundleIdentifier: "com.example.app" },
-      android: { package: "com.example.app" },
-    },
-  } satisfies Record<string, unknown>;
-
-  it('returns both platforms when "all" is requested', () => {
-    expect(resolveUpdatePlatforms(fullConfig, "all")).toStrictEqual(["ios", "android"]);
-  });
-
-  it("returns only the requested platform when it exists", () => {
-    expect(resolveUpdatePlatforms(fullConfig, "ios")).toStrictEqual(["ios"]);
-    expect(resolveUpdatePlatforms(fullConfig, "android")).toStrictEqual(["android"]);
-  });
-
-  it('returns configured platforms when "all" is requested against a partial config', () => {
-    expect(
-      resolveUpdatePlatforms(
-        {
-          expo: {
-            ios: { bundleIdentifier: "com.example.app" },
-          },
-        },
-        "all",
-      ),
-    ).toStrictEqual(["ios"]);
-  });
-
-  it("returns the explicitly requested platform even when app.json omits that section", () => {
-    expect(
-      resolveUpdatePlatforms(
-        {
-          expo: {
-            ios: { bundleIdentifier: "com.example.app" },
-          },
-        },
-        "android",
-      ),
-    ).toStrictEqual(["android"]);
-  });
-});

package/src/lib/update-platforms.ts

@@ -1,19 +0,0 @@
-import { asRecord } from "./record";
-
-import type { Platform } from "./build-profile";
-
-export type UpdatePlatformOption = Platform | "all";
-
-export const resolveUpdatePlatforms = (
-  appJson: Record<string, unknown>,
-  requestedPlatform: UpdatePlatformOption,
-): readonly Platform[] => {
-  if (requestedPlatform !== "all") {
-    return [requestedPlatform] as const;
-  }
-
-  const expo = asRecord(appJson["expo"]);
-  return (["ios", "android"] as const).filter(
-    (platform) => asRecord(expo?.[platform]) !== undefined,
-  );
-};

package/src/lib/xcpretty-formatter.ts

@@ -1,21 +0,0 @@
-import { ExpoRunFormatter } from "@expo/xcpretty";
-
-export interface XcodebuildFormatter {
-  /** Feed a line of raw xcodebuild output. Returns formatted lines (0 or more). */
-  readonly pipe: (line: string) => readonly string[];
-  /** Get a build summary after the process completes. */
-  readonly getBuildSummary: () => string;
-}
-
-/**
- * Create a stateful xcodebuild output formatter backed by `@expo/xcpretty`.
- * Each `pipe(line)` call may return zero or more formatted lines — zero means
- * the line was suppressed (e.g., intermediate compiler invocations).
- */
-export const createXcodebuildFormatter = (projectRoot: string): XcodebuildFormatter => {
-  const formatter = ExpoRunFormatter.create(projectRoot);
-  return {
-    pipe: (line: string) => formatter.pipe(line),
-    getBuildSummary: () => formatter.getBuildSummary(),
-  };
-};