@corva/create-app 0.126.1 → 0.128.0

package/README.md

@@ -190,11 +190,47 @@ Options:
   --silent [boolean]           Only log result of the operation (default: false)
   --remove-on-success          App package (.zip) will not be deleted after upload (default: true)
   --remove-existing [boolean]  If package.json version is already taken - remove the previously published package and upload a new one (default: false)
+  --zip-file-name <string>     Upload an existing ZIP without recreating it or bumping its version
+  --prebuilt                  Skip the Corva build for an existing ZIP (requires --zip-file-name)
   --author [string]            Author name for the audit
 ```
 
 ### Examples
 
+#### Release a locally built package
+
+Build the app and install its dependencies in your own CI, then upload the prepared ZIP:
+
+```sh
+create-corva-app release . --zip-file-name app-prebuilt.zip --prebuilt \
+  --env production --api-key "$CORVA_API_KEY" --label BETA --notes "Prebuilt release"
+```
+
+The CLI uploads the ZIP unchanged, waits for deployment, and publishes it with the requested label
+and notes. It does not build, install dependencies, bump versions, or delete the supplied ZIP.
+Without `--prebuilt`, Corva uses its normal build process, including when `--zip-file-name` is supplied.
+
+Keep `manifest.json` in the project directory, and `package.json` for JavaScript apps: the CLI uses
+these files to identify the app and, with `--remove-existing`, its version. They must match the ZIP.
+Set the final app key and version **before** compiling an FE app; the bundle embeds this identity.
+With `--prebuilt`, the CLI checks the ZIP structure and relevant metadata before contacting Corva.
+It checks root manifest/app metadata, FE `app.js`, JavaScript package versions, and Python entrypoint and
+installed-dependency layout. Duplicate and unsafe archive paths are rejected. Metadata files are
+limited to 1 MiB each. It does not rewrite the ZIP or verify imports, embedded FE identity, or native
+dependency compatibility; deployment and runtime testing are still needed.
+
+ZIP entries must be at the archive root, without an enclosing project folder:
+
+- **FE:** `manifest.json`, `package.json`, and the contents of `dist/` (including `app.js`, chunks,
+  and any required assets). Do not include `dist/` itself, source code, `node_modules/`, or an offline mirror.
+- **Python BE:** `manifest.json`, application code at the manifest's entrypoint path,
+  `requirements.txt`, and installed runtime dependencies under `requirements/`.
+  Build dependencies for Linux and the Python version and CPU architecture declared in the manifest;
+  macOS or Windows dependencies may not run on Lambda. Include all runtime dependencies because
+  Corva skips dependency installation.
+
+Prebuilt uploads still use the platform's upload and runtime limits; this option does not increase them.
+
 #### Make a release with ask for version
 
 ```sh

package/lib/commands/create.js

@@ -358,7 +358,12 @@ function addPackageJSON(root, manifest, runtime, opts) {
     },
     scripts,
     dependencies,
-    devDependencies,
+    // the app's scripts run the CLI that generated it, from its own node_modules, so a global
+    // install of another version cannot change what `yarn zip` or `yarn release` do
+    devDependencies: {
+      '@corva/create-app': fs.readJSONSync(join(__dirname, '../../package.json')).version,
+      ...devDependencies,
+    },
     ...rest,
   };
 

package/lib/commands/release.js

@@ -38,8 +38,13 @@ export const releaseCommand = new Command('release')
     ).default(false),
   )
   .addOption(zipFileNameOption)
+  .addOption(new Option('--prebuilt', 'Skip the Corva build for an existing ZIP (requires --zip-file-name)'))
   .addOption(new Option('--author [string]', 'Author name for the audit'))
   .action(async (dirName, patterns, options) => {
+    if (options.prebuilt && !options.zipFileName) {
+      releaseCommand.error('--prebuilt requires --zip-file-name');
+    }
+
     // if author is present in CLI, save it to process.env
     if (options.author) {
       process.env.githubUsername = options.author;

package/lib/flows/lib/validate-prebuilt-zip.js

@@ -0,0 +1,139 @@
+import { posix } from 'node:path';
+import yauzl from 'yauzl';
+import { StepError } from './step-error.js';
+
+export async function validatePrebuiltZip(zipPath, { manifest, pkg, options }) {
+  let zip;
+
+  try {
+    zip = await yauzl.openPromise(zipPath, { autoClose: false, strictFileNames: true });
+
+    const entries = new Map();
+
+    for await (const entry of zip.eachEntry()) {
+      const name = posix.normalize(entry.fileName);
+
+      if (entries.has(name)) {
+        throw new Error(`Duplicate ZIP entry: ${name}`);
+      }
+
+      entries.set(name, entry);
+    }
+
+    const requireFile = (name) => {
+      const entry = entries.get(name);
+
+      if (!entry || entry.fileName.endsWith('/')) {
+        const nested = [...entries.keys()].find((path) => path.endsWith(`/${name}`));
+
+        throw new Error(
+          `${name} is missing at the ZIP root.${
+            nested ? ` Found ${nested}; ZIP the contents of the folder, not the folder itself.` : ''
+          }`,
+        );
+      }
+
+      return entry;
+    };
+
+    const readText = async (name) => {
+      const entry = requireFile(name);
+
+      if (entry.uncompressedSize > 1024 * 1024) {
+        throw new Error(`${name} exceeds the 1 MiB metadata limit`);
+      }
+
+      const stream = await zip.openReadStreamPromise(entry);
+      const chunks = [];
+
+      for await (const chunk of stream) {
+        chunks.push(chunk);
+      }
+
+      return Buffer.concat(chunks).toString('utf8');
+    };
+
+    const readJson = async (name) => {
+      try {
+        const value = JSON.parse(await readText(name));
+
+        if (!value || typeof value !== 'object' || Array.isArray(value)) {
+          throw new Error('expected a JSON object');
+        }
+
+        return value;
+      } catch (error) {
+        throw new Error(`${name}: ${error.message}`);
+      }
+    };
+
+    const archivedManifest = await readJson('manifest.json');
+    const expected = manifest.manifest;
+
+    for (const [field, actual, required] of [
+      ['application.key', archivedManifest.application?.key, expected.application.key],
+      ['application.type', archivedManifest.application?.type, expected.application.type],
+      ['settings.runtime', archivedManifest.settings?.runtime, expected.settings.runtime],
+    ]) {
+      if (!required || actual !== required) {
+        throw new Error(`manifest.json ${field} must match the release project (${required})`);
+      }
+    }
+
+    if (options.appKey && options.appKey !== archivedManifest.application.key) {
+      throw new Error('manifest.json application.key must match --app-key');
+    }
+
+    if (manifest.isUi()) {
+      if (!requireFile('app.js').uncompressedSize) {
+        throw new Error('app.js must not be empty');
+      }
+    }
+
+    if (manifest.isJs()) {
+      const archivedPackage = await readJson('package.json');
+
+      if (!pkg.version || archivedPackage.version !== pkg.version) {
+        throw new Error(`package.json version must match the release project (${pkg.version})`);
+      }
+    } else if (manifest.isPython()) {
+      const settings = archivedManifest.settings;
+
+      for (const field of ['file', 'function']) {
+        if (
+          typeof settings.entrypoint?.[field] !== 'string' ||
+          !settings.entrypoint[field] ||
+          settings.entrypoint[field] !== expected.settings.entrypoint?.[field]
+        ) {
+          throw new Error(`manifest.json settings.entrypoint.${field} must match the release project`);
+        }
+      }
+
+      if (expected.settings.cpu_architecture && settings.cpu_architecture !== expected.settings.cpu_architecture) {
+        throw new Error('manifest.json settings.cpu_architecture must match the release project');
+      }
+
+      const modulePath = settings.entrypoint.file.replaceAll('.', '/');
+
+      if (!entries.has(`${modulePath}.py`) && !entries.has(`${modulePath}/__init__.py`)) {
+        throw new Error(`Python entrypoint is missing: expected ${modulePath}.py or ${modulePath}/__init__.py`);
+      }
+
+      const requirements = await readText('requirements.txt');
+      const hasDependencies = requirements.split(/\r?\n/).some((line) => line.trim() && !line.trim().startsWith('#'));
+
+      if (
+        hasDependencies &&
+        ![...entries].some(
+          ([name, entry]) => name.startsWith('requirements/') && !name.endsWith('/') && entry.uncompressedSize,
+        )
+      ) {
+        throw new Error('requirements.txt declares dependencies, but requirements/ contains no installed dependencies');
+      }
+    }
+  } catch (error) {
+    throw new StepError(`Invalid prebuilt archive: ${error.message}`, { cause: error });
+  } finally {
+    zip?.close();
+  }
+}

package/lib/flows/release.js

@@ -14,11 +14,11 @@ export const RELEASE_FLOW = {
   name: 'release',
   steps: [
     PREPARE_FLOW,
-    SETUP_API_CLIENT_STEP,
-    RELEASE_PREPARE_DATA_STEP,
     // With --zip-file-name the archive already exists, so the zip flow is skipped entirely. That
     // also lets runtimes the zip flow has no file list for (e.g. `provided.*`) be released.
     RESOLVE_PREBUILT_ZIP_STEP,
+    SETUP_API_CLIENT_STEP,
+    RELEASE_PREPARE_DATA_STEP,
     ZIP_SIMPLE_FLOW,
     UPLOAD_ZIP_TO_CORVA_STEP,
     WAIT_FOR_BUILD_FINISH_STEP,

package/lib/flows/steps/release/resolve-prebuilt-zip.js

@@ -2,6 +2,7 @@ import { promises as fs } from 'node:fs';
 import { resolve } from 'node:path';
 
 import { StepError } from '../../lib/step-error.js';
+import { validatePrebuiltZip } from '../../lib/validate-prebuilt-zip.js';
 
 /**
  * Handles `--zip-file-name`: the caller has already built the package archive, so this records it
@@ -9,7 +10,7 @@ import { StepError } from '../../lib/step-error.js';
  */
 export const RESOLVE_PREBUILT_ZIP_STEP = {
   message: 'Resolving prebuilt archive...',
-  fn: async ({ dirName, options }) => {
+  fn: async ({ dirName, options, manifest, pkg }) => {
     const { zipFileName } = options;
 
     if (!zipFileName) {
@@ -24,6 +25,10 @@ export const RESOLVE_PREBUILT_ZIP_STEP = {
       throw new StepError(`Prebuilt archive ${zipFileName} not found in ${dirName}`);
     }
 
+    if (options.prebuilt) {
+      await validatePrebuiltZip(zipPath, { manifest, pkg, options });
+    }
+
     return {
       zipFileName,
       skipZip: true,

package/lib/flows/steps/release/upload-zip-to-corva.js

@@ -102,6 +102,10 @@ export const UPLOAD_ZIP_TO_CORVA_STEP = {
 
       form.append('package', createReadStream(resolve(dirName, zipFileName)), 'package.zip');
 
+      if (options.prebuilt) {
+        form.append('prebuilt', 'true');
+      }
+
       let githubUsername = getGithubUsernameActor();
 
       if (!githubUsername) {

package/lib/flows/steps/zip-file-list-resolve.js

@@ -1,17 +1,14 @@
 import chalk from 'chalk';
-import Glob from 'glob';
+import { glob } from 'glob';
 import isGlob from 'is-glob';
 import _ from 'lodash/fp.js';
 import { promises as fs } from 'node:fs';
 import { resolve } from 'node:path';
-import { promisify } from 'node:util';
 import { getIncreasedVersion } from '../../helpers/cli-version.js';
 import { generateRandomString } from '../../helpers/utils.js';
 import { loadJson } from '../lib/json.js';
 import { StepError } from '../lib/step-error.js';
 
-const glob = promisify(Glob);
-
 import debugFn from 'debug';
 
 const debug = debugFn('cca:flow:zip:resolve');

package/lib/helpers/cli-version.js

@@ -1,4 +1,3 @@
-import NpmApi from 'npm-api';
 import chalk from 'chalk';
 import semver from 'semver';
 import inquirer from 'inquirer';
@@ -9,8 +8,6 @@ import fs from 'fs-extra';
 import { logger } from './logger.js';
 import { StepError } from '../flows/lib/step-error.js';
 
-const npm = new NpmApi();
-
 const error = chalk.bold.red;
 const warning = chalk.hex('#FFA500'); // Orange
 const code = chalk.cyan;
@@ -19,20 +16,32 @@ const asterisks = '*************************************************************
 const getCurrentVersion = async () =>
   (await fs.readJSON(join(url.fileURLToPath(new URL('.', import.meta.url)), '../../package.json'))).version;
 
+// An app that lists @corva/create-app owns the version its scripts run, so there is nothing for the
+// user to update globally; the nag belongs to a global install only.
+const isCliPinnedByApp = async (appDirectory) => {
+  const packageJsonPath = join(appDirectory, 'package.json');
+
+  if (!(await fs.pathExists(packageJsonPath))) {
+    return false;
+  }
+
+  const { dependencies = {}, devDependencies = {} } = await fs.readJSON(packageJsonPath);
+
+  return Boolean(dependencies['@corva/create-app'] || devDependencies['@corva/create-app']);
+};
+
 const getLatestVersion = async () => {
   try {
-    return await npm.repo('@corva/create-app').prop('version');
+    const response = await fetch('https://registry.npmjs.org/@corva/create-app/latest');
+
+    return (await response.json()).version;
   } catch (caughtError) {
-    if (caughtError.name === 'FetchError') {
-      throw new StepError(`The request to check the latest available version has failed due to the network error. Details:
+    throw new StepError(`The request to check the latest available version has failed due to the network error. Details:
 
 ${caughtError}
 
 Please check your internet connection and that the above request is not blocked in your network 
   `);
-    }
-
-    throw caughtError;
   }
 };
 
@@ -71,7 +80,11 @@ export async function ensureLatestVersion() {
 }
 
 // NOTE: Show user-friendly warning if version is outdated
-export async function warnIfOutdated() {
+export async function warnIfOutdated(appDirectory = process.cwd()) {
+  if (await isCliPinnedByApp(appDirectory)) {
+    return;
+  }
+
   logger.write('Checking for updates...\n');
 
   const currentVersion = await getCurrentVersion();

package/lib/main.js

@@ -1,3 +1,5 @@
+import { resolve } from 'node:path';
+
 import chalk from 'chalk';
 import { Command } from 'commander';
 import semver from 'semver';
@@ -35,10 +37,13 @@ function checkNodeVersion() {
 
 export async function run() {
   const program = new Command('create-corva-app')
-    .hook('preAction', async () => {
+    .hook('preAction', async (_, actionCommand) => {
       checkNodeVersion();
 
-      await warnIfOutdated();
+      const [projectDirectory = '.'] = actionCommand.args;
+      const { originalCwd = process.cwd() } = actionCommand.opts();
+
+      await warnIfOutdated(resolve(originalCwd, projectDirectory));
     })
     .addCommand(createCommand, { isDefault: true })
     .addCommand(zipCommand)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@corva/create-app",
-  "version": "0.126.1",
+  "version": "0.128.0",
   "private": false,
   "description": "Create an app to use it in CORVA.AI",
   "keywords": [
@@ -45,7 +45,7 @@
     "lodash": "4.18.1"
   },
   "dependencies": {
-    "archiver": "^5.3.0",
+    "archiver": "^7.0.1",
     "chalk": "^4.1.0",
     "commander": "^9.1.0",
     "cross-spawn": "^7.0.3",
@@ -54,14 +54,14 @@
     "figlet": "^1.5.0",
     "form-data": "^4.0.4",
     "fs-extra": "^9.0.1",
-    "glob": "^8.0.1",
+    "glob": "^13.0.6",
     "got": "^12.5.1",
     "inquirer": "^8.2.3",
     "is-glob": "^4.0.3",
     "lodash": "^4.18.1",
-    "npm-api": "^1.0.0",
     "semver": "^7.3.2",
-    "terminal-link": "^3.0.0"
+    "terminal-link": "^3.0.0",
+    "yauzl": "^3.4.0"
   },
   "devDependencies": {
     "@babel/core": "^7.11.0",