@hot-updater/protocol 0.0.0-stage → 1.0.0-rc.21

package/LICENSE

@@ -0,0 +1,33 @@
+MIT License
+
+Copyright (c) 2023 Sungyu Kang 
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+---
+
+ADDITIONAL DISCLAIMER
+
+The authors of this software shall not be held responsible for any legal issues,
+regulatory violations, policy violations, or disputes arising from the use,
+distribution, or integration of this software.
+
+Users are solely responsible for ensuring compliance with all applicable laws,
+regulations, and third-party policies (including but not limited to app store
+policies).

package/README.md

@@ -1,3 +1,50 @@
-# Temporary Holding Version
+# @hot-updater/protocol
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+The device-safe, zero-dependency package for what crosses a boundary:
+
+- the data formats and pure computations that the app and the server share,
+  where both sides must get the same answer;
+- the contracts between a host and its extensions on the device, such as the
+  client plugin contract, and the reference host that runs them.
+
+It runs anywhere: Hermes, Node, Workers, and Deno. Code that only the server
+or the CLI uses belongs in `@hot-updater/plugin-core` or
+`@hot-updater/server`.
+
+## What belongs here
+
+Code moves into this package only when all three hold:
+
+1. It crosses a boundary: a format or computation both the app and the server
+   run, or a contract a host on the device offers its extensions.
+2. It does no I/O of its own: what reaches the device or the network, such as
+   the plugin host's `fetch` and storage, the caller passes in. It uses no Node
+   or React Native API and keeps no global state.
+3. It needs no dependency. This package has none; what it takes from another
+   package, such as verkit's version parsing, is bundled into `dist`.
+
+It holds the domain types, the release catalog format and its scope rules,
+the check a client runs on a fetched release catalog (`parseReleaseCatalog`),
+the rollout cohort math, bundle artifacts, the bundle id format (`uuid`), the
+client plugin contract, `canonicalizeAppVersion`, and `resolveBaseURL`. The
+device's update client and doctor's server checks both run
+`parseReleaseCatalog`, so they accept the same catalogs. Client
+plugin authors import `defineClientPlugin` and its types from here.
+`createPluginHost` is the host the SDK runs client plugins on: a device SDK
+passes it the platform, the device's storage, and `fetch`, and
+`@hot-updater/test-utils/react-native` passes it fakes.
+
+## Boundary with `@hot-updater/plugin-core`
+
+`@hot-updater/plugin-core` is the kit that extends the server: the storage and
+database adapter contracts, the server plugin authoring API, and their
+helpers. It runs wherever the server runs, in Node, Workers, Deno, or Lambda,
+and depends on this package, never the reverse. The app never imports it:
+React Native imports this package and the built-in Insights client, never
+plugin-core or the server.
+
+`src/package.spec.ts` checks that this package has no dependencies and imports
+only what its build bundles. An oxlint rule refuses `@hot-updater/plugin-core`
+and `@hot-updater/server` imports in `packages/protocol/src`,
+`packages/react-native/src`, and the Insights client in
+`plugins/insights/src/client`.