@tiledev/tile-push-cli 0.1.0

package/LICENSE

@@ -0,0 +1,49 @@
+MIT License
+
+Copyright (c) 2026 Apptile / Tile Push
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+---
+
+This package wraps and depends on `@hot-updater/react-native`, which is the
+work of upstream contributors and is licensed separately under MIT. The
+upstream copyright and license are reproduced below as required by MIT.
+
+MIT License
+
+Copyright (c) 2023 Sungyu Kang
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,183 @@
+# Tile Updater
+
+Over-the-air (OTA) code-push updates for React Native — ship JS/asset changes to
+installed apps without an app-store release. Multi-tenant, fingerprint-safe, and
+self-contained: the SDK and CLI are plain npm packages.
+
+- **`@tiledev/tile-updater`** — the runtime SDK (wrap your app; devices auto-update on launch).
+- **`@tiledev/tile-push-cli`** — the `tile-push` CLI (init, fingerprint, deploy, manage bundles).
+
+Built on [hot-updater](https://github.com/gronxb/hot-updater).
+
+---
+
+## Install
+
+```bash
+npm install @tiledev/tile-updater @hot-updater/react-native @hot-updater/core
+npm install --save-dev @tiledev/tile-push-cli @hot-updater/expo
+```
+
+`@hot-updater/react-native` and `@hot-updater/core` are **peer dependencies** of the
+SDK — install them explicitly. Use `@hot-updater/metro` instead of `@hot-updater/expo`
+for a bare React Native (non-Expo) project.
+
+> **Using the Tile platform?** Skip all of this — `tile init --blueprint default`
+> installs and wires the SDK, the config plugin, `tile-push.config.ts`, the app
+> wrap, and a reconciled lockfile automatically. Jump to [Ship an update](#ship-an-update).
+
+---
+
+## Wire it up (3 steps)
+
+### 1. Wrap your root component
+
+```tsx
+// App.tsx
+import { TileUpdater } from '@tiledev/tile-updater';
+
+function App() {
+  return <YourAppRoot />;
+}
+
+export default TileUpdater.wrap({
+  appId: 'your-app-id',                // your Tile Push tenant id
+  apiUrl: 'https://ota.tile.dev',      // the OTA backend
+  updateStrategy: 'fingerprint',       // or 'appVersion'
+})(App);
+```
+
+### 2. Register the Expo config plugin
+
+`app.json` → `expo.plugins`. This injects the native **fingerprint** into the build
+so devices only receive bundles built from a matching native tree:
+
+```json
+{
+  "expo": {
+    "plugins": ["@tiledev/tile-updater"]
+  }
+}
+```
+
+### 3. Create `tile-push.config.ts`
+
+Run `npx tile-push init --app-id <id> --token <deploy-token>`, or write it by hand:
+
+```ts
+import 'dotenv/config';
+import { defineConfig } from 'hot-updater';
+import { expo } from '@hot-updater/expo';
+import { tilePushDatabase, tilePushStorage } from '@tiledev/tile-push-cli';
+
+const appId = process.env.TILE_PUSH_APP_ID;
+if (!appId) throw new Error('TILE_PUSH_APP_ID is not set (see .env).');
+
+export default defineConfig({
+  build: expo({ enableHermes: true }),
+  storage: tilePushStorage({ appId }),
+  database: tilePushDatabase({ appId }),
+  updateStrategy: 'fingerprint',
+});
+```
+
+---
+
+## Ship an update
+
+The **fingerprint** is a hash of your native inputs (deps, native config). A bundle
+is only served to devices whose installed build has the same fingerprint — so a JS
+push can never land on an incompatible native app. Keep `fingerprint.json` committed
+as the single source of truth.
+
+### 1. Fingerprint (once per native change)
+
+```bash
+npx tile-push fingerprint create   # writes fingerprint.json
+```
+
+For Expo prebuild projects the order is **prebuild → fingerprint create → prebuild
+(injects the hash) → build**. The value is stable across re-injection.
+
+### 2. Build the native app
+
+Any normal build works — the SDK is just a package, and the config plugin injects
+the fingerprint at `expo prebuild`. **No OTA/deploy step happens during the build.**
+
+### 3. Deploy
+
+```bash
+npx tile-push deploy --platform android --rollout 10   # ship to 10% of devices
+npx tile-push deploy --platform android                # ship to everyone
+```
+
+`deploy` bundles your JS (Hermes), verifies its fingerprint matches `fingerprint.json`,
+tags the bundle, and uploads it. Devices whose native build matches pick it up on
+next launch; others are correctly skipped.
+
+---
+
+## Commands
+
+| Command | Description |
+| --- | --- |
+| `tile-push init` | Write `tile-push.config.ts` + `~/.tile-push/credentials.json` |
+| `tile-push fingerprint create` | Compute/snapshot the native fingerprint |
+| `tile-push deploy` | Build and ship a new bundle (supports staged `--rollout`) |
+| `tile-push bundle list/show/enable/disable/update/promote/delete` | Manage bundles |
+| `tile-push rollback <channel>` | Disable the most recent enabled bundle |
+| `tile-push channel [set]` | Read/write the channel baked into the native app |
+| `tile-push whoami` | Show the active tenant + token |
+| `tile-push doctor` | Diagnose config / credentials / server / project |
+| `tile-push console` | Open the web console for this tenant |
+
+### Credentials
+
+The CLI reads credentials in this order:
+
+1. `TILE_PUSH_APP_ID` + `TILE_PUSH_TOKEN` env vars (preferred for CI)
+2. `~/.tile-push/credentials.json` (written by `tile-push init`, chmod 600)
+
+Never put tokens in `tile-push.config.ts` — it's committed to your repo. Override
+the API base URL with `TILE_PUSH_API_URL`.
+
+---
+
+## On the Tile platform
+
+Apptile customers manage the same thing through the unified CLI — `tile ota`
+forwards to this binary with the app id + session token injected automatically:
+
+```bash
+tile ota deploy --platform android --rollout 10
+tile ota bundle list
+tile ota rollback production
+```
+
+`tile init --blueprint default` installs and wires everything above, so a fresh app
+is code-push-ready after `npm install`.
+
+---
+
+## Roadmap
+
+- **Cloud Push** — deploy an OTA bundle **remotely** from a `tile save` or git ref,
+  the same way native builds already run in the cloud. The bundle is built in the
+  same container as the APK, so the fingerprint matches by construction — no local
+  toolchain, no fingerprint drift. Planned surface: `tile ota deploy --source
+  save|git`, with a reach-check that refuses a push no installed build can receive.
+- iOS build/deploy parity docs.
+- First-class staged-rollout cohort tooling in the CLI.
+- `tile-push login` — browser device-code flow that mints and stores a token.
+
+---
+
+## Acknowledgements
+
+Built on [hot-updater](https://github.com/gronxb/hot-updater) (MIT). Tile Push wraps
+it with hosted storage, auth, multi-tenancy, and a unified deploy CLI. The bundle
+pipeline, fingerprinting, and bundle metadata model are hot-updater's work.
+
+## License
+
+MIT. See `LICENSE`.

package/dist/apiClient-DiRjggqw.cjs

@@ -0,0 +1,200 @@
+require("./bin/tile-push.cjs");
+let node_fs_promises = require("node:fs/promises");
+let node_path = require("node:path");
+let node_os = require("node:os");
+//#region src/auth/tokenStore.ts
+const DEFAULT_API_URL = "https://ota.tile.dev";
+const credentialsPath = () => (0, node_path.join)((0, node_os.homedir)(), ".tile-push", "credentials.json");
+const credentialsDir = () => (0, node_path.join)((0, node_os.homedir)(), ".tile-push");
+/**
+* Resolve credentials with env precedence:
+*   1. TILE_PUSH_APP_ID + TILE_PUSH_TOKEN env vars (preferred for CI)
+*   2. ~/.tile-push/credentials.json (interactive / dev machines)
+*   3. null if neither set
+*
+* TILE_PUSH_API_URL overrides the API base URL in either case.
+*/
+const loadCredentials = async () => {
+	const envAppId = process.env.TILE_PUSH_APP_ID;
+	const envToken = process.env.TILE_PUSH_TOKEN;
+	const envApiUrl = process.env.TILE_PUSH_API_URL;
+	if (envAppId && envToken) return {
+		appId: envAppId,
+		token: envToken,
+		apiUrl: envApiUrl ?? DEFAULT_API_URL
+	};
+	try {
+		const raw = await (0, node_fs_promises.readFile)(credentialsPath(), "utf8");
+		const parsed = JSON.parse(raw);
+		if (!parsed.appId || !parsed.token) return null;
+		return {
+			appId: parsed.appId,
+			token: parsed.token,
+			apiUrl: envApiUrl ?? parsed.apiUrl ?? DEFAULT_API_URL
+		};
+	} catch (err) {
+		if (err.code === "ENOENT") return null;
+		throw err;
+	}
+};
+const saveCredentials = async (creds) => {
+	await (0, node_fs_promises.mkdir)(credentialsDir(), {
+		recursive: true,
+		mode: 448
+	});
+	await (0, node_fs_promises.writeFile)(credentialsPath(), JSON.stringify(creds, null, 2), { mode: 384 });
+};
+/**
+* Throws a helpful message if no credentials are configured. Use this at the
+* top of any command that needs server access.
+*/
+const requireCredentials = async () => {
+	const creds = await loadCredentials();
+	if (!creds) throw new Error("No Tile Push credentials found. Run `tile-push init` to set up, or export TILE_PUSH_APP_ID and TILE_PUSH_TOKEN environment variables.");
+	return creds;
+};
+/** Test helper — confirms creds file exists and is 0600 (or just env vars). */
+const credentialsDiagnostic = async () => {
+	if (process.env.TILE_PUSH_APP_ID && process.env.TILE_PUSH_TOKEN) return {
+		source: "env",
+		pathOrEnv: "TILE_PUSH_APP_ID / TILE_PUSH_TOKEN"
+	};
+	try {
+		const s = await (0, node_fs_promises.stat)(credentialsPath());
+		return {
+			source: "file",
+			pathOrEnv: credentialsPath(),
+			modeOk: (s.mode & 511) === 384
+		};
+	} catch {
+		return {
+			source: "none",
+			pathOrEnv: credentialsPath()
+		};
+	}
+};
+//#endregion
+//#region src/auth/apiClient.ts
+/**
+* Thin fetch wrapper that injects the Bearer token, prepends the tenant
+* prefix to relative paths, parses JSON, and throws typed errors.
+*
+* Usage:
+*   const client = await TilePushClient.create();
+*   const me = await client.get<{ appId, tenantName, tokenLabel }>("/me");
+*
+* All `pathSuffix` arguments are appended to `/api/cli/t/{appId}/`, so
+* the client never has to think about tenant routing.
+*/
+var TilePushApiError = class extends Error {
+	constructor(message, status, body) {
+		super(message);
+		this.status = status;
+		this.body = body;
+		this.name = "TilePushApiError";
+	}
+};
+var TilePushClient = class TilePushClient {
+	constructor(creds) {
+		this.creds = creds;
+	}
+	static async create() {
+		return new TilePushClient(await requireCredentials());
+	}
+	/** Like create() but returns null instead of throwing if no creds set. */
+	static async createOptional() {
+		const creds = await loadCredentials();
+		return creds ? new TilePushClient(creds) : null;
+	}
+	get appId() {
+		return this.creds.appId;
+	}
+	get apiUrl() {
+		return this.creds.apiUrl ?? "https://api.tile-push.app";
+	}
+	buildUrl(pathSuffix) {
+		const base = this.apiUrl.replace(/\/+$/, "");
+		const suffix = pathSuffix.startsWith("/") ? pathSuffix : `/${pathSuffix}`;
+		return `${base}/api/cli/t/${encodeURIComponent(this.creds.appId)}${suffix}`;
+	}
+	async request(method, pathSuffix, options = {}) {
+		const headers = {
+			Authorization: `Bearer ${this.creds.token}`,
+			...options.headers
+		};
+		let body;
+		if (options.json !== void 0) {
+			body = JSON.stringify(options.json);
+			headers["Content-Type"] = options.contentType ?? "application/json";
+		} else if (options.body !== void 0) {
+			body = options.body;
+			if (options.contentType) headers["Content-Type"] = options.contentType;
+		}
+		const url = this.buildUrl(pathSuffix);
+		const response = await fetch(url, {
+			method,
+			headers,
+			body
+		});
+		if (!response.ok) {
+			const text = await response.text().catch(() => "");
+			let parsed = text;
+			try {
+				parsed = JSON.parse(text);
+			} catch {}
+			throw new TilePushApiError(`${method} ${pathSuffix} failed: ${typeof parsed === "object" && parsed && "error" in parsed ? String(parsed.error) : `HTTP ${response.status}`}`, response.status, parsed);
+		}
+		if (options.raw) return response;
+		if (response.status === 204) return void 0;
+		return await response.json();
+	}
+	get(pathSuffix, options) {
+		return this.request("GET", pathSuffix, options);
+	}
+	post(pathSuffix, options) {
+		return this.request("POST", pathSuffix, options);
+	}
+	patch(pathSuffix, options) {
+		return this.request("PATCH", pathSuffix, options);
+	}
+	delete(pathSuffix, options) {
+		return this.request("DELETE", pathSuffix, options);
+	}
+};
+//#endregion
+Object.defineProperty(exports, "TilePushApiError", {
+	enumerable: true,
+	get: function() {
+		return TilePushApiError;
+	}
+});
+Object.defineProperty(exports, "TilePushClient", {
+	enumerable: true,
+	get: function() {
+		return TilePushClient;
+	}
+});
+Object.defineProperty(exports, "credentialsDiagnostic", {
+	enumerable: true,
+	get: function() {
+		return credentialsDiagnostic;
+	}
+});
+Object.defineProperty(exports, "loadCredentials", {
+	enumerable: true,
+	get: function() {
+		return loadCredentials;
+	}
+});
+Object.defineProperty(exports, "requireCredentials", {
+	enumerable: true,
+	get: function() {
+		return requireCredentials;
+	}
+});
+Object.defineProperty(exports, "saveCredentials", {
+	enumerable: true,
+	get: function() {
+		return saveCredentials;
+	}
+});

package/dist/apiClient-Dxz7PXQr.mjs

@@ -0,0 +1,164 @@
+import { mkdir, readFile, stat, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { homedir } from "node:os";
+//#region src/auth/tokenStore.ts
+const DEFAULT_API_URL = "https://ota.tile.dev";
+const credentialsPath = () => join(homedir(), ".tile-push", "credentials.json");
+const credentialsDir = () => join(homedir(), ".tile-push");
+/**
+* Resolve credentials with env precedence:
+*   1. TILE_PUSH_APP_ID + TILE_PUSH_TOKEN env vars (preferred for CI)
+*   2. ~/.tile-push/credentials.json (interactive / dev machines)
+*   3. null if neither set
+*
+* TILE_PUSH_API_URL overrides the API base URL in either case.
+*/
+const loadCredentials = async () => {
+	const envAppId = process.env.TILE_PUSH_APP_ID;
+	const envToken = process.env.TILE_PUSH_TOKEN;
+	const envApiUrl = process.env.TILE_PUSH_API_URL;
+	if (envAppId && envToken) return {
+		appId: envAppId,
+		token: envToken,
+		apiUrl: envApiUrl ?? DEFAULT_API_URL
+	};
+	try {
+		const raw = await readFile(credentialsPath(), "utf8");
+		const parsed = JSON.parse(raw);
+		if (!parsed.appId || !parsed.token) return null;
+		return {
+			appId: parsed.appId,
+			token: parsed.token,
+			apiUrl: envApiUrl ?? parsed.apiUrl ?? DEFAULT_API_URL
+		};
+	} catch (err) {
+		if (err.code === "ENOENT") return null;
+		throw err;
+	}
+};
+const saveCredentials = async (creds) => {
+	await mkdir(credentialsDir(), {
+		recursive: true,
+		mode: 448
+	});
+	await writeFile(credentialsPath(), JSON.stringify(creds, null, 2), { mode: 384 });
+};
+/**
+* Throws a helpful message if no credentials are configured. Use this at the
+* top of any command that needs server access.
+*/
+const requireCredentials = async () => {
+	const creds = await loadCredentials();
+	if (!creds) throw new Error("No Tile Push credentials found. Run `tile-push init` to set up, or export TILE_PUSH_APP_ID and TILE_PUSH_TOKEN environment variables.");
+	return creds;
+};
+/** Test helper — confirms creds file exists and is 0600 (or just env vars). */
+const credentialsDiagnostic = async () => {
+	if (process.env.TILE_PUSH_APP_ID && process.env.TILE_PUSH_TOKEN) return {
+		source: "env",
+		pathOrEnv: "TILE_PUSH_APP_ID / TILE_PUSH_TOKEN"
+	};
+	try {
+		const s = await stat(credentialsPath());
+		return {
+			source: "file",
+			pathOrEnv: credentialsPath(),
+			modeOk: (s.mode & 511) === 384
+		};
+	} catch {
+		return {
+			source: "none",
+			pathOrEnv: credentialsPath()
+		};
+	}
+};
+//#endregion
+//#region src/auth/apiClient.ts
+/**
+* Thin fetch wrapper that injects the Bearer token, prepends the tenant
+* prefix to relative paths, parses JSON, and throws typed errors.
+*
+* Usage:
+*   const client = await TilePushClient.create();
+*   const me = await client.get<{ appId, tenantName, tokenLabel }>("/me");
+*
+* All `pathSuffix` arguments are appended to `/api/cli/t/{appId}/`, so
+* the client never has to think about tenant routing.
+*/
+var TilePushApiError = class extends Error {
+	constructor(message, status, body) {
+		super(message);
+		this.status = status;
+		this.body = body;
+		this.name = "TilePushApiError";
+	}
+};
+var TilePushClient = class TilePushClient {
+	constructor(creds) {
+		this.creds = creds;
+	}
+	static async create() {
+		return new TilePushClient(await requireCredentials());
+	}
+	/** Like create() but returns null instead of throwing if no creds set. */
+	static async createOptional() {
+		const creds = await loadCredentials();
+		return creds ? new TilePushClient(creds) : null;
+	}
+	get appId() {
+		return this.creds.appId;
+	}
+	get apiUrl() {
+		return this.creds.apiUrl ?? "https://api.tile-push.app";
+	}
+	buildUrl(pathSuffix) {
+		const base = this.apiUrl.replace(/\/+$/, "");
+		const suffix = pathSuffix.startsWith("/") ? pathSuffix : `/${pathSuffix}`;
+		return `${base}/api/cli/t/${encodeURIComponent(this.creds.appId)}${suffix}`;
+	}
+	async request(method, pathSuffix, options = {}) {
+		const headers = {
+			Authorization: `Bearer ${this.creds.token}`,
+			...options.headers
+		};
+		let body;
+		if (options.json !== void 0) {
+			body = JSON.stringify(options.json);
+			headers["Content-Type"] = options.contentType ?? "application/json";
+		} else if (options.body !== void 0) {
+			body = options.body;
+			if (options.contentType) headers["Content-Type"] = options.contentType;
+		}
+		const url = this.buildUrl(pathSuffix);
+		const response = await fetch(url, {
+			method,
+			headers,
+			body
+		});
+		if (!response.ok) {
+			const text = await response.text().catch(() => "");
+			let parsed = text;
+			try {
+				parsed = JSON.parse(text);
+			} catch {}
+			throw new TilePushApiError(`${method} ${pathSuffix} failed: ${typeof parsed === "object" && parsed && "error" in parsed ? String(parsed.error) : `HTTP ${response.status}`}`, response.status, parsed);
+		}
+		if (options.raw) return response;
+		if (response.status === 204) return void 0;
+		return await response.json();
+	}
+	get(pathSuffix, options) {
+		return this.request("GET", pathSuffix, options);
+	}
+	post(pathSuffix, options) {
+		return this.request("POST", pathSuffix, options);
+	}
+	patch(pathSuffix, options) {
+		return this.request("PATCH", pathSuffix, options);
+	}
+	delete(pathSuffix, options) {
+		return this.request("DELETE", pathSuffix, options);
+	}
+};
+//#endregion
+export { requireCredentials as a, loadCredentials as i, TilePushClient as n, saveCredentials as o, credentialsDiagnostic as r, TilePushApiError as t };