@better-update/cli 0.40.2 → 0.41.1

package/dist/index.mjs

@@ -35,7 +35,7 @@ var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 //#endregion
 //#region package.json
-var version = "0.40.2";
+var version = "0.41.1";
 
 //#endregion
 //#region src/lib/interactive-mode.ts
@@ -19942,20 +19942,98 @@ const walkUpForLockfile = (startCwd, dir) => Effect.gen(function* () {
 */
 const detectWorkspaceRoot = (cwd) => walkUpForLockfile(cwd, cwd);
 /**
-* Build an `Ignore` matcher for the workspace root. `.easignore` REPLACES
-* `.gitignore` when present (matches EAS semantics); otherwise `.gitignore`
-* is layered on top of the always-ignore baseline.
+* Rebase a single nested `.gitignore` line so it applies only within `prefix`
+* (the posix dir path + trailing slash) when folded into the workspace-root
+* matcher. Returns `undefined` for blanks/comments. Anchored patterns (a
+* leading or interior `/`) are prefixed as-is; unanchored ones (which match at
+* any depth) become `prefix**\/pat`. Negation and directory-only trailing
+* slashes are preserved.
+*/
+const rebaseGitignoreLine = (prefix, rawLine) => {
+	const line = rawLine.replace(/(?<!\\)\s+$/u, "");
+	if (line === "" || line.startsWith("#")) return;
+	const negate = line.startsWith("!");
+	const unescaped = negate || line.startsWith(String.raw`\#`) || line.startsWith(String.raw`\!`) ? line.slice(1) : line;
+	const hadLeadingSlash = unescaped.startsWith("/");
+	const body = hadLeadingSlash ? unescaped.slice(1) : unescaped;
+	if (body === "") return;
+	const withoutTrailingSlash = body.endsWith("/") ? body.slice(0, -1) : body;
+	const rebased = hadLeadingSlash || withoutTrailingSlash.includes("/") ? `${prefix}${body}` : `${prefix}**/${body}`;
+	return negate ? `!${rebased}` : rebased;
+};
+/**
+* Rebase every line of a nested `.gitignore` to its own directory (`relDir`,
+* posix, relative to the workspace root) — mirroring how git scopes a
+* `.gitignore` to the dir it lives in.
+*/
+const rebaseGitignore = (relDir, content) => {
+	const prefix = `${relDir}/`;
+	return content.split(/\r?\n/u).map((rawLine) => rebaseGitignoreLine(prefix, rawLine)).filter((pattern) => pattern !== void 0);
+};
+const safeReadDir = async (dir) => {
+	try {
+		return await promises.readdir(dir, { withFileTypes: true });
+	} catch {
+		return [];
+	}
+};
+const safeReadText = async (file) => {
+	try {
+		return await promises.readFile(file, "utf8");
+	} catch {
+		return "";
+	}
+};
+const isDirectory = async (file) => {
+	try {
+		return (await promises.lstat(file)).isDirectory();
+	} catch {
+		return false;
+	}
+};
+/**
+* Fold every NESTED `.gitignore` under `workspaceRoot` into `ig`, each rebased
+* to its own directory (git scopes a `.gitignore` to the dir it lives in, and
+* EAS — which stages via git — honors that). The walk prunes any directory the
+* matcher-so-far already ignores, so it never descends into `node_modules`,
+* build outputs, or a subtree excluded by a shallower `.gitignore` — including
+* the entries a just-loaded nested `.gitignore` adds. The root `.gitignore` is
+* added by the caller, so the walk skips it.
+*/
+const addNestedGitignores = (workspaceRoot, ig) => Effect.promise(async () => {
+	const walk = async (absDir, relDir) => {
+		const entries = await safeReadDir(absDir);
+		if (relDir !== "" && entries.some((entry) => entry.isFile() && entry.name === ".gitignore")) {
+			const content = await safeReadText(path.join(absDir, ".gitignore"));
+			if (content !== "") ig.add(rebaseGitignore(relDir, content));
+		}
+		const subdirs = entries.filter((entry) => entry.isDirectory());
+		for (const entry of subdirs) {
+			const childRel = relDir === "" ? entry.name : `${relDir}/${entry.name}`;
+			if (!ig.ignores(childRel) && !ig.ignores(`${childRel}/`)) await walk(path.join(absDir, entry.name), childRel);
+		}
+	};
+	await walk(workspaceRoot, "");
+});
+/**
+* Build an `Ignore` matcher for the workspace root. `.easignore` REPLACES every
+* `.gitignore` when present (matches EAS semantics); otherwise the root
+* `.gitignore` plus every NESTED `.gitignore` (git semantics) is layered on top
+* of the always-ignore baseline.
 *
 * When `includeNativeSource` is set, the native source dirs are re-included
-* after the ignore files are applied, then their build outputs re-excluded, so
-* a committed `ios/`/`android/` reaches staging intact.
+* before the nested scan (so the scan descends into committed `android/`/`ios/`
+* and folds in their nested ignores), then their build outputs re-excluded last,
+* so a committed `ios/`/`android/` reaches staging intact.
 */
 const buildIgnoreInstance = (workspaceRoot, options = {}) => Effect.gen(function* () {
 	const fs = yield* FileSystem.FileSystem;
 	const ig = ignore();
 	ig.add([...ALWAYS_IGNORE]);
+	const base = options.appRelPath === void 0 || options.appRelPath === "" ? "" : `${options.appRelPath}/`;
 	const easignorePath = path.join(workspaceRoot, ".easignore");
-	if (yield* fs.exists(easignorePath).pipe(Effect.orElseSucceed(() => false))) {
+	const hasEasignore = yield* fs.exists(easignorePath).pipe(Effect.orElseSucceed(() => false));
+	if (hasEasignore) {
 		const content = yield* fs.readFileString(easignorePath).pipe(Effect.orElseSucceed(() => ""));
 		ig.add(content);
 	} else {
@@ -19965,11 +20043,9 @@ const buildIgnoreInstance = (workspaceRoot, options = {}) => Effect.gen(function
 			ig.add(content);
 		}
 	}
-	if (options.includeNativeSource === true) {
-		const base = options.appRelPath === void 0 || options.appRelPath === "" ? "" : `${options.appRelPath}/`;
-		ig.add([`!${base}android`, `!${base}ios`]);
-		ig.add(NATIVE_BUILD_OUTPUTS.map((entry) => `${base}${entry}`));
-	}
+	if (options.includeNativeSource === true) ig.add([`!${base}android`, `!${base}ios`]);
+	if (!hasEasignore) yield* addNestedGitignores(workspaceRoot, ig);
+	if (options.includeNativeSource === true) ig.add(NATIVE_BUILD_OUTPUTS.map((entry) => `${base}${entry}`));
 	return ig;
 });
 const copyProjectTree = (params) => Effect.tryPromise({
@@ -19977,11 +20053,12 @@ const copyProjectTree = (params) => Effect.tryPromise({
 		await promises.cp(params.source, params.dest, {
 			recursive: true,
 			dereference: false,
-			filter: (src) => {
+			filter: async (src) => {
 				const rel = path.relative(params.source, src);
 				if (rel === "") return true;
 				const posixRel = rel.split(path.sep).join("/");
-				return !params.ig.ignores(posixRel);
+				const isDir = await isDirectory(src);
+				return !params.ig.ignores(isDir ? `${posixRel}/` : posixRel);
 			}
 		});
 	},
@@ -20004,6 +20081,50 @@ const initGitRepo = (stagingRoot) => Effect.tryPromise({
 	catch: (cause) => new StagingError({ message: `Failed to init git repo in staging dir: ${formatCause(cause)}` })
 }).pipe(Effect.asVoid);
 /**
+* Snapshot the staged tree as a single commit so its working tree reads CLEAN.
+*
+* EAS stages via `git clone` + checkout, so the tree it hands to
+* `expo prebuild --clean` is a clean checkout. Our `cp` + `git init` leaves
+* every staged file UNTRACKED, which `expo prebuild`'s git check reads as
+* "dirty" (`git status --porcelain` is non-empty). Because the native build
+* runs inside a PTY, Expo's `isInteractive()` is true even with no real
+* controlling TTY, so it prompts `Continue with uncommitted changes?` and then
+* blocks on stdin we never write — hanging CI / backgrounded / piped builds.
+*
+* Committing once here makes `git status` clean, so Expo's check passes on
+* EVERY Expo version — the `EXPO_NO_GIT_STATUS` env gate the build sets only
+* exists in newer Expo — with no global `CI=1` side effects. The real
+* dirty-tree decision already ran against the user's *actual* working tree in
+* `ensureRepoClean` (honoring `--allow-dirty`). Best-effort: hooks are disabled
+* and a failure is non-fatal — the build proceeds and `EXPO_NO_GIT_STATUS`
+* still covers newer Expo.
+*/
+const commitStagingSnapshot = (stagingRoot) => Effect.tryPromise(async () => {
+	const run = async (args) => execFileAsync$1("git", [...args], {
+		cwd: stagingRoot,
+		env: {
+			...process.env,
+			LEFTHOOK: "0",
+			HUSKY: "0"
+		}
+	});
+	await run(["add", "-A"]);
+	await run([
+		"-c",
+		"user.name=better-update",
+		"-c",
+		"user.email=build@better-update.dev",
+		"-c",
+		"commit.gpgsign=false",
+		"commit",
+		"--no-verify",
+		"--allow-empty",
+		"-q",
+		"-m",
+		"better-update staging snapshot"
+	]);
+}).pipe(Effect.ignore);
+/**
 * Install args per package manager, frozen-lockfile variants matching EAS
 * (`bun install --frozen-lockfile` / `npm ci --include=dev` / etc.) so the
 * staged install resolves exactly what the user's lockfile pins.
@@ -20059,6 +20180,7 @@ const prepareStagingProject = (input) => Effect.gen(function* () {
 			env: commandEnv
 		});
 	} else yield* printHuman("No package.json at the staging root — skipping dependency install.");
+	yield* commitStagingSnapshot(stagingRoot);
 	return {
 		stagingRoot,
 		projectRoot,
@@ -23929,6 +24051,26 @@ const discoverSignedTargets = (options) => Effect.gen(function* () {
 	if (results.length === 0) return yield* new XcodeProjectError({ message: `No signed native targets found in ${pbxprojPath} for configuration "${options.configurationName}".` });
 	return results;
 });
+/**
+* Like {@link discoverSignedTargets}, but tolerant of a project that hasn't been
+* prebuilt: returns `undefined` when `iosDir` is absent or contains no
+* `.xcodeproj` (a managed Expo app before `expo prebuild`). A genuine parse
+* error in an existing project still surfaces. Used by `credentials configure`,
+* which runs outside a build and must degrade to the main bundle id from the
+* Expo config when the native project isn't generated yet.
+*/
+const discoverSignedTargetsIfPresent = (options) => Effect.gen(function* () {
+	const fs = yield* FileSystem.FileSystem;
+	if (!(yield* fs.exists(options.iosDir).pipe(Effect.orElseSucceed(() => false)))) return;
+	if (!(yield* fs.readDirectory(options.iosDir).pipe(Effect.orElseSucceed(() => []))).some((entry) => entry.endsWith(".xcodeproj"))) return;
+	return yield* discoverSignedTargets(options);
+});
+/**
+* Pick the "main" target from a discovered set: the application product type if
+* present, otherwise the first signed target. Shared by the build pipeline and
+* `credentials configure` so both agree on which bundle id is primary.
+*/
+const pickMainTarget = (signedTargets) => signedTargets.find((target) => target.productType === "com.apple.product-type.application") ?? signedTargets[0];
 
 //#endregion
 //#region src/lib/xcpretty-formatter.ts
@@ -24160,7 +24302,6 @@ const installProfileForTarget = (target, profileByBundle) => {
 		installed
 	})));
 };
-const pickMainTarget = (signedTargets) => signedTargets.find((target) => target.productType === "com.apple.product-type.application") ?? signedTargets[0];
 const runIosDeviceBuild = (input) => Effect.gen(function* () {
 	const { api, tempDir, projectRoot, iosProfile, envVars } = input;
 	const runtime = yield* CliRuntime;
@@ -28347,6 +28488,12 @@ const accessCommand = defineCommand({
 
 //#endregion
 //#region src/commands/credentials/configure.ts
+/**
+* Xcode build configuration whose `PRODUCT_BUNDLE_IDENTIFIER`s the configure
+* wizard reads when discovering signed targets. Distribution signing always
+* runs against the Release configuration.
+*/
+const IOS_DISCOVERY_CONFIGURATION = "Release";
 const bindAndroidFcmGsa = (api, input) => Effect.gen(function* () {
 	const app = (yield* api.androidApplicationIdentifiers.list({ path: { projectId: input.projectId } })).items.find((entry) => entry.packageName === input.applicationIdentifier);
 	if (app === void 0) return yield* new MissingCredentialsError({
@@ -28441,6 +28588,68 @@ const configureIos = (args) => Effect.gen(function* () {
 	yield* printHuman("Run with --rebind to switch certificate, profile, or ASC key.");
 	yield* printHuman("Run with --bind-push-key <id> / --bind-asc-key <id> to update a single binding.");
 });
+const configureIosTargets = (args) => Effect.gen(function* () {
+	yield* printHuman(`Configuring iOS credentials for ${args.targets.length} signed target(s) (${args.distribution})...`);
+	yield* Effect.forEach(args.targets, (target) => Effect.gen(function* () {
+		const input = {
+			projectId: args.projectId,
+			bundleIdentifier: target.bundleId,
+			distribution: args.distribution
+		};
+		yield* printHuman("");
+		yield* printHuman(`${target.targetName} (${target.bundleId})`);
+		yield* ensureIosCredentials(args.api, input, { freezeCredentials: false });
+		yield* showIosBinding(args.api, input);
+	}), { concurrency: 1 });
+	yield* printHuman("");
+	yield* printHuman("Run with --bundle <id> --rebind to switch a target's certificate, profile, or ASC key.");
+	yield* printHuman("Run with --bundle <id> --bind-push-key <id> / --bind-asc-key <id> to update a single binding.");
+});
+const runConfigureIos = (args) => Effect.gen(function* () {
+	const { api, projectId, root, distribution } = args;
+	const singleBundleOnly = args.bundle !== void 0 || args.rebind || args.bindPushKey !== void 0 || args.bindAscKey !== void 0;
+	const iosMeta = yield* readAppMetaOptional(root, "ios");
+	if (!singleBundleOnly) {
+		const targets = yield* discoverSignedTargetsIfPresent({
+			iosDir: path.join(root, "ios"),
+			configurationName: IOS_DISCOVERY_CONFIGURATION
+		});
+		const main = targets === void 0 ? void 0 : pickMainTarget(targets);
+		if (targets !== void 0 && main !== void 0) {
+			yield* configureIosTargets({
+				api,
+				projectId,
+				distribution,
+				targets
+			});
+			return {
+				platform: "ios",
+				projectId,
+				distribution,
+				bundleIdentifier: main.bundleId,
+				bundleIdentifiers: targets.map((target) => target.bundleId)
+			};
+		}
+		if (iosMeta.bundleId !== void 0) yield* printHuman("No prebuilt iOS project found — configuring the main bundle only. Run `expo prebuild` (or a build) once so app-extension targets are discovered and configured.");
+	}
+	const bundleIdentifier = args.bundle ?? iosMeta.bundleId ?? (yield* promptText("iOS bundle identifier"));
+	yield* configureIos({
+		api,
+		projectId,
+		bundleIdentifier,
+		distribution,
+		rebind: args.rebind,
+		bindPushKey: args.bindPushKey,
+		bindAscKey: args.bindAscKey
+	});
+	return {
+		platform: "ios",
+		projectId,
+		distribution,
+		bundleIdentifier,
+		bundleIdentifiers: [bundleIdentifier]
+	};
+});
 const configureCommand$1 = defineCommand({
 	meta: {
 		name: "configure",
@@ -28454,7 +28663,7 @@ const configureCommand$1 = defineCommand({
 		},
 		bundle: {
 			type: "string",
-			description: "iOS bundle identifier (defaults to app.json)"
+			description: "iOS bundle identifier to scope to a single target (defaults to configuring every signed target — main app + extensions — discovered from the Xcode project)"
 		},
 		"android-package": {
 			type: "string",
@@ -28498,25 +28707,16 @@ const configureCommand$1 = defineCommand({
 		}, {
 			value: "android",
 			label: "Android"
-		}]))) === "ios") {
-			const iosMeta = yield* readAppMetaOptional(root, "ios");
-			const bundleIdentifier = args.bundle ?? iosMeta.bundleId ?? (yield* promptText("iOS bundle identifier"));
-			yield* configureIos({
-				api,
-				projectId,
-				bundleIdentifier,
-				distribution: args.distribution,
-				rebind: args.rebind ?? false,
-				bindPushKey: args["bind-push-key"],
-				bindAscKey: args["bind-asc-key"]
-			});
-			return {
-				platform: "ios",
-				projectId,
-				bundleIdentifier,
-				distribution: args.distribution
-			};
-		}
+		}]))) === "ios") return yield* runConfigureIos({
+			api,
+			projectId,
+			root,
+			bundle: args.bundle,
+			distribution: args.distribution,
+			rebind: args.rebind ?? false,
+			bindPushKey: args["bind-push-key"],
+			bindAscKey: args["bind-asc-key"]
+		});
 		const androidMeta = yield* readAppMetaOptional(root, "android");
 		const applicationIdentifier = args["android-package"] ?? androidMeta.androidPackage ?? (yield* promptText("Android application identifier"));
 		yield* configureAndroid({