@novacraft-engineering/pulsar-cli 1.2.3 → 1.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@novacraft-engineering/pulsar-cli",
-  "version": "1.2.3",
+  "version": "1.3.0",
   "description": "Pulsar OTA release CLI — bundle, hash, and ship React Native updates over-the-air.",
   "type": "module",
   "bin": {
@@ -26,7 +26,7 @@
     "node": ">=18"
   },
   "scripts": {
-    "test": "node test/hash.test.js && node test/security.test.js && node test/signing.test.js"
+    "test": "node test/hash.test.js && node test/security.test.js && node test/signing.test.js && node test/entry.test.js"
   },
   "keywords": [
     "cli",

package/pulsar.js

@@ -6,6 +6,7 @@ import readline from 'node:readline';
 import http from 'node:http';
 import {execFileSync} from 'node:child_process';
 import crypto from 'node:crypto';
+import {fileURLToPath} from 'node:url';
 import {computePackageHash, fileHashes} from './hash.js';
 
 // Code signing: sign the package hash into an RS256 JWT the client verifies against its
@@ -349,9 +350,35 @@ async function cmdApps() {
   }
 }
 
-// Push an already-built (and optionally signed) bundle to one app's deployment, then generate and
-// upload a differential patch against whatever that deployment was serving.
-async function pushBuiltRelease(app, deployment, args, contentsDir, packageHash, zip) {
+// Sign for this app — with a local key when one was given, otherwise by asking Pulsar, which signs for
+// anyone allowed to publish here. Each app can hold a different key, so a release train re-signs.
+async function signForApp(app, deployment, contentsDir, packageHash, localKey) {
+  const signaturePath = path.join(contentsDir, SIGNATURE_PATH);
+  fs.rmSync(signaturePath, {force: true});
+  let signature = null;
+  if (localKey) {
+    try {
+      signature = signCodePushJWT(localKey, packageHash);
+    } catch (error) {
+      die(`could not sign with the provided key (${error.message}) — nothing was uploaded`);
+    }
+  } else {
+    ({signature} = await api(`/apps/${app.id}/deployments/${deployment}/sign`, {method: 'POST', body: {packageHash}}));
+  }
+  if (!signature) {
+    console.log(`• ${app.name} has no signing key — uploading unsigned`);
+    return;
+  }
+  fs.mkdirSync(path.dirname(signaturePath), {recursive: true});
+  fs.writeFileSync(signaturePath, signature);
+  console.log(`• signed${localKey ? ' with your local key' : ' by Pulsar'}`);
+}
+
+// Sign and push an already-built bundle to one app's deployment, then generate and upload a
+// differential patch against whatever that deployment was serving.
+async function pushBuiltRelease(app, deployment, args, contentsDir, packageHash, localKey) {
+  await signForApp(app, deployment, contentsDir, packageHash, localKey);
+  const zip = fs.readFileSync(zipContents(contentsDir));
   let prevLatest = null;
   if (!args.includes('--no-diff')) {
     try {
@@ -392,6 +419,9 @@ async function pushBuiltRelease(app, deployment, args, contentsDir, packageHash,
   ].filter(Boolean);
   const reach = scopes.length ? scopes.join(' + ') : `${release.rollout}% of devices`;
   console.log(`✓ released ${release.label} to ${app.name}/${deployment} — ${release.isDisabled ? 'DISABLED' : reach}`);
+  if (release.signed === false) {
+    console.log('⚠ UNSIGNED — this build is blocked and will not reach devices. An org owner can enable it from the dashboard.');
+  }
   if (release.startsAt) console.log(`  scheduled — goes live ${new Date(release.startsAt).toLocaleString()}`);
   if (release.rolloutRamp) console.log(`  gradual rollout — ${release.rollout}% to ${release.rolloutRamp.to}% over ${release.rolloutRamp.hours}h`);
 
@@ -417,31 +447,18 @@ async function pushBuiltRelease(app, deployment, args, contentsDir, packageHash,
   return release;
 }
 
-// Build the JS bundle once, sign it if requested, and return the reusable artifacts.
+// Build the JS bundle once and return what every target app's release is made from. A local key
+// (--private-key <file>, or PULSAR_SIGNING_KEY holding the key itself) overrides Pulsar's signing.
 function buildOnce(args) {
   const platform = getFlag(args, 'platform', 'ios');
+  const privateKeyPath = getFlag(args, 'private-key');
+  if (privateKeyPath && !fs.existsSync(privateKeyPath)) die(`no signing key at ${privateKeyPath} — drop --private-key to have Pulsar sign`);
+  const localKey = privateKeyPath ? fs.readFileSync(privateKeyPath, 'utf8') : (process.env.PULSAR_SIGNING_KEY || '').trim();
   const contentsDir = fs.mkdtempSync(path.join(os.tmpdir(), 'pulsar-build-'));
   bundle(platform, contentsDir);
   const packageHash = computePackageHash(contentsDir);
-  // CI secrets arrive as environment variables holding the key itself, not as files, so the key can
-  // come from PULSAR_SIGNING_KEY as well as --private-key <file>. An unset or empty secret means
-  // "don't sign", exactly as before.
-  const privateKeyPath = getFlag(args, 'private-key');
-  const signingKey = privateKeyPath ? fs.readFileSync(privateKeyPath, 'utf8') : (process.env.PULSAR_SIGNING_KEY || '').trim();
-  if (signingKey) {
-    let signature;
-    try {
-      signature = signCodePushJWT(signingKey, packageHash);
-    } catch (error) {
-      die(`could not sign with the provided key (${error.message}) — nothing was uploaded`);
-    }
-    fs.mkdirSync(path.join(contentsDir, 'CodePush'), {recursive: true});
-    fs.writeFileSync(path.join(contentsDir, SIGNATURE_PATH), signature);
-    console.log('• signed release — devices with CodePushPublicKey set will verify it');
-  }
-  const zip = fs.readFileSync(zipContents(contentsDir));
-  console.log(`• hash ${packageHash.slice(0, 12)}…  size ${(zip.length / 1e6).toFixed(2)} MB`);
-  return {contentsDir, packageHash, zip};
+  console.log(`• hash ${packageHash.slice(0, 12)}…`);
+  return {contentsDir, packageHash, localKey};
 }
 
 async function cmdRelease(args) {
@@ -452,8 +469,8 @@ async function cmdRelease(args) {
   if (app.os !== getFlag(args, 'platform', 'ios')) {
     console.log(`• note: resolved app "${app.name}" is ${app.os}; bundling ${getFlag(args, 'platform', 'ios')}`);
   }
-  const {contentsDir, packageHash, zip} = buildOnce(args);
-  await pushBuiltRelease(app, deployment, args, contentsDir, packageHash, zip);
+  const {contentsDir, packageHash, localKey} = buildOnce(args);
+  await pushBuiltRelease(app, deployment, args, contentsDir, packageHash, localKey);
 }
 
 // Release the same built bundle to several apps at once (shared-codebase / white-label fleets).
@@ -478,11 +495,11 @@ async function cmdReleaseTrain(args) {
   apps = apps.filter((app) => app.os === platform);
   if (!apps.length) die(`No ${platform} apps matched.`);
 
-  const {contentsDir, packageHash, zip} = buildOnce(args);
+  const {contentsDir, packageHash, localKey} = buildOnce(args);
   console.log(`• release train → ${apps.length} app(s): ${apps.map((app) => app.name).join(', ')}`);
   for (const app of apps) {
     try {
-      await pushBuiltRelease(app, deployment, args, contentsDir, packageHash, zip);
+      await pushBuiltRelease(app, deployment, args, contentsDir, packageHash, localKey);
     } catch (err) {
       console.log(`✗ ${app.name}: ${err.message}`);
     }
@@ -614,7 +631,16 @@ async function cmdKeys(args) {
 export {saveConfig, browserLogin, signCodePushJWT, SIGNATURE_PATH};
 
 // Only dispatch when run as the CLI — importing the module (e.g. from tests) must not execute a command.
-if (import.meta.url === `file://${process.argv[1]}`) {
+// Compare real paths: a global install runs through a bin symlink, so argv[1] is not this file's path.
+function invokedAsCli() {
+  try {
+    return Boolean(process.argv[1]) && fs.realpathSync(process.argv[1]) === fs.realpathSync(fileURLToPath(import.meta.url));
+  } catch {
+    return false;
+  }
+}
+
+if (invokedAsCli()) {
   const [command, ...rest] = process.argv.slice(2);
   const commands = {
     login: cmdLogin,