@corva/create-app 0.127.0 → 0.128.0

package/README.md

@@ -190,11 +190,47 @@ Options:
   --silent [boolean]           Only log result of the operation (default: false)
   --remove-on-success          App package (.zip) will not be deleted after upload (default: true)
   --remove-existing [boolean]  If package.json version is already taken - remove the previously published package and upload a new one (default: false)
+  --zip-file-name <string>     Upload an existing ZIP without recreating it or bumping its version
+  --prebuilt                  Skip the Corva build for an existing ZIP (requires --zip-file-name)
   --author [string]            Author name for the audit
 ```
 
 ### Examples
 
+#### Release a locally built package
+
+Build the app and install its dependencies in your own CI, then upload the prepared ZIP:
+
+```sh
+create-corva-app release . --zip-file-name app-prebuilt.zip --prebuilt \
+  --env production --api-key "$CORVA_API_KEY" --label BETA --notes "Prebuilt release"
+```
+
+The CLI uploads the ZIP unchanged, waits for deployment, and publishes it with the requested label
+and notes. It does not build, install dependencies, bump versions, or delete the supplied ZIP.
+Without `--prebuilt`, Corva uses its normal build process, including when `--zip-file-name` is supplied.
+
+Keep `manifest.json` in the project directory, and `package.json` for JavaScript apps: the CLI uses
+these files to identify the app and, with `--remove-existing`, its version. They must match the ZIP.
+Set the final app key and version **before** compiling an FE app; the bundle embeds this identity.
+With `--prebuilt`, the CLI checks the ZIP structure and relevant metadata before contacting Corva.
+It checks root manifest/app metadata, FE `app.js`, JavaScript package versions, and Python entrypoint and
+installed-dependency layout. Duplicate and unsafe archive paths are rejected. Metadata files are
+limited to 1 MiB each. It does not rewrite the ZIP or verify imports, embedded FE identity, or native
+dependency compatibility; deployment and runtime testing are still needed.
+
+ZIP entries must be at the archive root, without an enclosing project folder:
+
+- **FE:** `manifest.json`, `package.json`, and the contents of `dist/` (including `app.js`, chunks,
+  and any required assets). Do not include `dist/` itself, source code, `node_modules/`, or an offline mirror.
+- **Python BE:** `manifest.json`, application code at the manifest's entrypoint path,
+  `requirements.txt`, and installed runtime dependencies under `requirements/`.
+  Build dependencies for Linux and the Python version and CPU architecture declared in the manifest;
+  macOS or Windows dependencies may not run on Lambda. Include all runtime dependencies because
+  Corva skips dependency installation.
+
+Prebuilt uploads still use the platform's upload and runtime limits; this option does not increase them.
+
 #### Make a release with ask for version
 
 ```sh

package/lib/commands/release.js

@@ -38,8 +38,13 @@ export const releaseCommand = new Command('release')
     ).default(false),
   )
   .addOption(zipFileNameOption)
+  .addOption(new Option('--prebuilt', 'Skip the Corva build for an existing ZIP (requires --zip-file-name)'))
   .addOption(new Option('--author [string]', 'Author name for the audit'))
   .action(async (dirName, patterns, options) => {
+    if (options.prebuilt && !options.zipFileName) {
+      releaseCommand.error('--prebuilt requires --zip-file-name');
+    }
+
     // if author is present in CLI, save it to process.env
     if (options.author) {
       process.env.githubUsername = options.author;

package/lib/flows/lib/validate-prebuilt-zip.js

@@ -0,0 +1,139 @@
+import { posix } from 'node:path';
+import yauzl from 'yauzl';
+import { StepError } from './step-error.js';
+
+export async function validatePrebuiltZip(zipPath, { manifest, pkg, options }) {
+  let zip;
+
+  try {
+    zip = await yauzl.openPromise(zipPath, { autoClose: false, strictFileNames: true });
+
+    const entries = new Map();
+
+    for await (const entry of zip.eachEntry()) {
+      const name = posix.normalize(entry.fileName);
+
+      if (entries.has(name)) {
+        throw new Error(`Duplicate ZIP entry: ${name}`);
+      }
+
+      entries.set(name, entry);
+    }
+
+    const requireFile = (name) => {
+      const entry = entries.get(name);
+
+      if (!entry || entry.fileName.endsWith('/')) {
+        const nested = [...entries.keys()].find((path) => path.endsWith(`/${name}`));
+
+        throw new Error(
+          `${name} is missing at the ZIP root.${
+            nested ? ` Found ${nested}; ZIP the contents of the folder, not the folder itself.` : ''
+          }`,
+        );
+      }
+
+      return entry;
+    };
+
+    const readText = async (name) => {
+      const entry = requireFile(name);
+
+      if (entry.uncompressedSize > 1024 * 1024) {
+        throw new Error(`${name} exceeds the 1 MiB metadata limit`);
+      }
+
+      const stream = await zip.openReadStreamPromise(entry);
+      const chunks = [];
+
+      for await (const chunk of stream) {
+        chunks.push(chunk);
+      }
+
+      return Buffer.concat(chunks).toString('utf8');
+    };
+
+    const readJson = async (name) => {
+      try {
+        const value = JSON.parse(await readText(name));
+
+        if (!value || typeof value !== 'object' || Array.isArray(value)) {
+          throw new Error('expected a JSON object');
+        }
+
+        return value;
+      } catch (error) {
+        throw new Error(`${name}: ${error.message}`);
+      }
+    };
+
+    const archivedManifest = await readJson('manifest.json');
+    const expected = manifest.manifest;
+
+    for (const [field, actual, required] of [
+      ['application.key', archivedManifest.application?.key, expected.application.key],
+      ['application.type', archivedManifest.application?.type, expected.application.type],
+      ['settings.runtime', archivedManifest.settings?.runtime, expected.settings.runtime],
+    ]) {
+      if (!required || actual !== required) {
+        throw new Error(`manifest.json ${field} must match the release project (${required})`);
+      }
+    }
+
+    if (options.appKey && options.appKey !== archivedManifest.application.key) {
+      throw new Error('manifest.json application.key must match --app-key');
+    }
+
+    if (manifest.isUi()) {
+      if (!requireFile('app.js').uncompressedSize) {
+        throw new Error('app.js must not be empty');
+      }
+    }
+
+    if (manifest.isJs()) {
+      const archivedPackage = await readJson('package.json');
+
+      if (!pkg.version || archivedPackage.version !== pkg.version) {
+        throw new Error(`package.json version must match the release project (${pkg.version})`);
+      }
+    } else if (manifest.isPython()) {
+      const settings = archivedManifest.settings;
+
+      for (const field of ['file', 'function']) {
+        if (
+          typeof settings.entrypoint?.[field] !== 'string' ||
+          !settings.entrypoint[field] ||
+          settings.entrypoint[field] !== expected.settings.entrypoint?.[field]
+        ) {
+          throw new Error(`manifest.json settings.entrypoint.${field} must match the release project`);
+        }
+      }
+
+      if (expected.settings.cpu_architecture && settings.cpu_architecture !== expected.settings.cpu_architecture) {
+        throw new Error('manifest.json settings.cpu_architecture must match the release project');
+      }
+
+      const modulePath = settings.entrypoint.file.replaceAll('.', '/');
+
+      if (!entries.has(`${modulePath}.py`) && !entries.has(`${modulePath}/__init__.py`)) {
+        throw new Error(`Python entrypoint is missing: expected ${modulePath}.py or ${modulePath}/__init__.py`);
+      }
+
+      const requirements = await readText('requirements.txt');
+      const hasDependencies = requirements.split(/\r?\n/).some((line) => line.trim() && !line.trim().startsWith('#'));
+
+      if (
+        hasDependencies &&
+        ![...entries].some(
+          ([name, entry]) => name.startsWith('requirements/') && !name.endsWith('/') && entry.uncompressedSize,
+        )
+      ) {
+        throw new Error('requirements.txt declares dependencies, but requirements/ contains no installed dependencies');
+      }
+    }
+  } catch (error) {
+    throw new StepError(`Invalid prebuilt archive: ${error.message}`, { cause: error });
+  } finally {
+    zip?.close();
+  }
+}

package/lib/flows/release.js

@@ -14,11 +14,11 @@ export const RELEASE_FLOW = {
   name: 'release',
   steps: [
     PREPARE_FLOW,
-    SETUP_API_CLIENT_STEP,
-    RELEASE_PREPARE_DATA_STEP,
     // With --zip-file-name the archive already exists, so the zip flow is skipped entirely. That
     // also lets runtimes the zip flow has no file list for (e.g. `provided.*`) be released.
     RESOLVE_PREBUILT_ZIP_STEP,
+    SETUP_API_CLIENT_STEP,
+    RELEASE_PREPARE_DATA_STEP,
     ZIP_SIMPLE_FLOW,
     UPLOAD_ZIP_TO_CORVA_STEP,
     WAIT_FOR_BUILD_FINISH_STEP,

package/lib/flows/steps/release/resolve-prebuilt-zip.js

@@ -2,6 +2,7 @@ import { promises as fs } from 'node:fs';
 import { resolve } from 'node:path';
 
 import { StepError } from '../../lib/step-error.js';
+import { validatePrebuiltZip } from '../../lib/validate-prebuilt-zip.js';
 
 /**
  * Handles `--zip-file-name`: the caller has already built the package archive, so this records it
@@ -9,7 +10,7 @@ import { StepError } from '../../lib/step-error.js';
  */
 export const RESOLVE_PREBUILT_ZIP_STEP = {
   message: 'Resolving prebuilt archive...',
-  fn: async ({ dirName, options }) => {
+  fn: async ({ dirName, options, manifest, pkg }) => {
     const { zipFileName } = options;
 
     if (!zipFileName) {
@@ -24,6 +25,10 @@ export const RESOLVE_PREBUILT_ZIP_STEP = {
       throw new StepError(`Prebuilt archive ${zipFileName} not found in ${dirName}`);
     }
 
+    if (options.prebuilt) {
+      await validatePrebuiltZip(zipPath, { manifest, pkg, options });
+    }
+
     return {
       zipFileName,
       skipZip: true,

package/lib/flows/steps/release/upload-zip-to-corva.js

@@ -102,6 +102,10 @@ export const UPLOAD_ZIP_TO_CORVA_STEP = {
 
       form.append('package', createReadStream(resolve(dirName, zipFileName)), 'package.zip');
 
+      if (options.prebuilt) {
+        form.append('prebuilt', 'true');
+      }
+
       let githubUsername = getGithubUsernameActor();
 
       if (!githubUsername) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@corva/create-app",
-  "version": "0.127.0",
+  "version": "0.128.0",
   "private": false,
   "description": "Create an app to use it in CORVA.AI",
   "keywords": [
@@ -60,7 +60,8 @@
     "is-glob": "^4.0.3",
     "lodash": "^4.18.1",
     "semver": "^7.3.2",
-    "terminal-link": "^3.0.0"
+    "terminal-link": "^3.0.0",
+    "yauzl": "^3.4.0"
   },
   "devDependencies": {
     "@babel/core": "^7.11.0",