create-vidra-app 0.3.1 → 0.4.0

package/dist/index.js

@@ -1,7 +1,7 @@
 // src/index.ts
 import prompts2 from "prompts";
-import fs2 from "fs-extra";
-import path2 from "path";
+import fs9 from "fs-extra";
+import path10 from "path";
 import { randomUUID } from "crypto";
 import { fileURLToPath } from "url";
 
@@ -170,15 +170,53 @@ var applyReplacements = (str, replacements) => {
 };
 
 // src/doctor.ts
-import { execFileSync } from "child_process";
+import { execFileSync as execFileSync5 } from "child_process";
+import fs8 from "fs";
+import path9 from "path";
 import prompts from "prompts";
+
+// src/signing.ts
+import path2 from "path";
+import fs2 from "fs-extra";
+import { execFileSync, spawnSync } from "child_process";
+
+// src/notarize.ts
+import path3 from "path";
+import { execFileSync as execFileSync2 } from "child_process";
+
+// src/windows-signing.ts
+import path4 from "path";
+import fs3 from "fs-extra";
+import { execFileSync as execFileSync3 } from "child_process";
+
+// src/velopack.ts
+import path5 from "path";
+import os from "os";
+import fs4 from "fs-extra";
+import { execFileSync as execFileSync4 } from "child_process";
+
+// src/update-config.ts
+import path6 from "path";
+import fs5 from "fs-extra";
+
+// src/project.ts
+import path8 from "path";
+
+// src/version.ts
+import fs6 from "fs-extra";
+import path7 from "path";
+
+// src/project.ts
+import fs7 from "fs-extra";
+
+// src/doctor.ts
 var DOTNET = process.platform === "win32" ? "dotnet.exe" : "dotnet";
 var MAUI_DOCS = "https://learn.microsoft.com/dotnet/maui/get-started/installation";
 var INSTALL_NET_10_FIX = "Install the .NET 10 SDK \u2014 https://dotnet.microsoft.com/download";
 var bufToStr = (v) => v == null ? "" : Buffer.isBuffer(v) ? v.toString() : v;
 var run = (cmd, args) => {
   try {
-    const stdout = execFileSync(cmd, args, {
+    const stdout = execFileSync5(cmd, args, {
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -244,7 +282,7 @@ var installWorkload = (csprojPath) => {
   );
   console.log();
   try {
-    execFileSync(DOTNET, args, { stdio: "inherit" });
+    execFileSync5(DOTNET, args, { stdio: "inherit" });
     return true;
   } catch {
     console.error();
@@ -322,15 +360,17 @@ var ensureMauiWorkload = async (opts = {}) => {
 
 // src/index.ts
 var note = (label, body) => `  ${dim(label.padEnd(7))} ${body}`;
-var __dirname = path2.dirname(fileURLToPath(import.meta.url));
-var CLI_ROOT = path2.resolve(__dirname, "..");
-var TEMPLATES_DIR = path2.join(CLI_ROOT, "templates");
-var VIDRA_REPO_ROOT = path2.resolve(CLI_ROOT, "..", "..", "..");
-var LOCAL_FEED_DIR = path2.join(VIDRA_REPO_ROOT, "dist", "packages");
+var __dirname = path10.dirname(fileURLToPath(import.meta.url));
+var CLI_ROOT = path10.resolve(__dirname, "..");
+var TEMPLATES_DIR = path10.join(CLI_ROOT, "templates");
+var VIDRA_REPO_ROOT = path10.resolve(CLI_ROOT, "..", "..", "..");
+var LOCAL_FEED_DIR = path10.join(VIDRA_REPO_ROOT, "dist", "packages");
 var LOCAL_CLI_DIR = CLI_ROOT;
-var LOCAL_SDK_DIR = path2.join(VIDRA_REPO_ROOT, "src", "sdk", "vidra-js");
-var VIDRA_VERSION = "0.3.1";
-var SDK_VERSION = "0.2.0";
+var LOCAL_SDK_DIR = path10.join(VIDRA_REPO_ROOT, "src", "sdk", "vidra-js");
+var VIDRA_VERSION = JSON.parse(
+  fs9.readFileSync(path10.join(CLI_ROOT, "package.json"), "utf-8")
+).version;
+var SDK_VERSION = VIDRA_VERSION;
 var main = async () => {
   console.log();
   console.log(`  create-${lime("vidra")}-app`);
@@ -369,8 +409,8 @@ var main = async () => {
     );
     appId = res.appId;
   }
-  const root = path2.resolve(projectDir);
-  if (fs2.existsSync(root) && fs2.readdirSync(root).length > 0) {
+  const root = path10.resolve(projectDir);
+  if (fs9.existsSync(root) && fs9.readdirSync(root).length > 0) {
     console.error();
     console.error(
       row({
@@ -386,8 +426,8 @@ var main = async () => {
   console.log(kv("directory", root));
   console.log(kv("app id", appId));
   console.log();
-  const isMonorepo = fs2.existsSync(path2.join(LOCAL_SDK_DIR, "package.json"));
-  const localFeedExists = isMonorepo && fs2.existsSync(LOCAL_FEED_DIR);
+  const isMonorepo = fs9.existsSync(path10.join(LOCAL_SDK_DIR, "package.json"));
+  const localFeedExists = isMonorepo && fs9.existsSync(LOCAL_FEED_DIR);
   const localFeedSource = localFeedExists ? `    <add key="vidra-local" value="${toTextPath(LOCAL_FEED_DIR)}" />` : "";
   const cliRef = isMonorepo ? `file:${toTextPath(LOCAL_CLI_DIR)}` : `^${VIDRA_VERSION}`;
   const sdkRef = isMonorepo ? `file:${toTextPath(LOCAL_SDK_DIR)}` : `^${SDK_VERSION}`;
@@ -402,17 +442,17 @@ var main = async () => {
     "{{sdkVersion}}": sdkRef,
     "{{localFeedSource}}": localFeedSource
   };
-  const templateDir = path2.join(TEMPLATES_DIR, "react-vite");
+  const templateDir = path10.join(TEMPLATES_DIR, "react-vite");
   await scaffoldDir(templateDir, root, replacements);
   console.log(row({ glyph: "active", detail: dim("creating solution\u2026") }));
   exec(`dotnet new sln -n ${projectName} --force`, root);
-  const slnFile = fs2.existsSync(path2.join(root, `${projectName}.slnx`)) ? `${projectName}.slnx` : `${projectName}.sln`;
+  const slnFile = fs9.existsSync(path10.join(root, `${projectName}.slnx`)) ? `${projectName}.slnx` : `${projectName}.sln`;
   exec(
     `dotnet sln ${slnFile} add src/${projectName}.Host/${projectName}.Host.csproj`,
     root
   );
   console.log(row({ glyph: "active", detail: dim("installing dependencies\u2026") }));
-  const uiDir = path2.join(root, "ui");
+  const uiDir = path10.join(root, "ui");
   const [rootNpmOk, uiNpmOk] = await Promise.all([
     tryExecAsync("npm install", root),
     tryExecAsync("npm install", uiDir)
@@ -450,7 +490,7 @@ var main = async () => {
     );
     console.log();
   }
-  const hostCsproj = path2.join(
+  const hostCsproj = path10.join(
     root,
     "src",
     `${projectName}.Host`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-vidra-app",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "description": "Scaffold a new Vidra application (React + .NET MAUI)",
   "type": "module",
   "bin": {

package/templates/react-vite/README.md

@@ -31,17 +31,24 @@ npm run dev
 ```
 
 This starts the Vite dev server and launches the native host for the current OS
-under `dotnet watch`. Both sides of the app hot reload:
+under `dotnet watch`. Both sides of the app pick up your edits:
 
 - **UI**: edit anything in `ui/src` — Vite HMR updates the WebView instantly.
-- **C#**: edit the host (for example `OnTickAsync` in `MainPage.cs`) — supported
-  edits apply to the running app in seconds, and the UI flashes a
-  "C# reloaded" badge. Edits hot reload can't express (new fields, changed
-  signatures, …) trigger an automatic rebuild and relaunch.
-
-C# hot reload needs a recent toolchain (on macOS, the .NET 10.0.203+ workload
-set — run `npm run doctor` to check). When unavailable, `vidra dev` falls back
-to a one-shot build and launch. To skip `dotnet watch` explicitly:
+- **C#**: edit the host (for example `OnTickAsync` in `MainPage.cs`) and save —
+  the session puts the change in front of you in seconds. *How* depends on the
+  platform:
+  - **Windows**: supported edits apply to the *running* app and the UI flashes a
+    "C# reloaded" badge. Edits hot reload can't express (new fields, changed
+    signatures, …) trigger an automatic rebuild and relaunch.
+  - **macOS**: the same, when the toolchain cooperates. Mac Catalyst's
+    hot-reload agent often drops its connection mid-session (dotnet/sdk#55488);
+    a dropped agent applies nothing while `dotnet watch` still reports success,
+    so `vidra dev` watches for it and switches the session to rebuild +
+    relaunch on save. You'll see it say so — after that, edits arrive with a
+    restart and no badge.
+    `npm run doctor` says which loop you get.
+
+To skip `dotnet watch` entirely and do a single build and launch:
 
 ```bash
 npx vidra dev --no-hot-reload

package/templates/react-vite/_gitignore

@@ -14,3 +14,7 @@ node_modules/
 .vs/
 .vscode/
 *.user
+
+# Update signing keys — whoever holds one can run code in every installed copy
+*-signing-key.pem
+vidra-signing-key.pem

package/templates/react-vite/package.json

@@ -1,5 +1,6 @@
 {
   "name": "{{projectNameKebab}}",
+  "version": "0.1.0",
   "private": true,
   "scripts": {
     "build": "vidra build",

package/templates/react-vite/src/{{projectName}}.Host/Entitlements.plist

@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>com.apple.security.cs.allow-jit</key>
+    <true/>
+    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+    <true/>
+    <key>com.apple.security.cs.disable-library-validation</key>
+    <true/>
+    <key>com.apple.security.network.client</key>
+    <true/>
+    <key>com.apple.security.files.user-selected.read-write</key>
+    <true/>
+    <key>com.apple.security.app-sandbox</key>
+    <false/>
+</dict>
+</plist>

package/templates/react-vite/src/{{projectName}}.Host/MauiProgram.cs

@@ -9,6 +9,25 @@ public static class MauiProgram
     {
         var builder = MauiApp.CreateBuilder();
 
+        // Updates come in two tiers. Both are opt-in and both read one
+        // `vidra.updates` block in package.json.
+        //
+        // Web bundle: fast, no reinstall. Add `.UseVidraUpdates()` below and
+        //
+        //   "vidra": { "updates": { "feedUrl": "https://example.com/bundles.json" } }
+        //
+        // then publish with `npx vidra bundle`. A bundle only installs when its
+        // contract fingerprints match this build, so JS can never call a bridge
+        // the installed binary lacks.
+        //
+        // Whole app: native code included. Reference Vidra.Updates.Native, add
+        // `.UseVidraNativeUpdates()`, uncomment the line in Platforms/*/Program.cs,
+        // and add
+        //
+        //   "vidra": { "updates": { "native": { "feedUrl": "https://example.com/app/" } } }
+        //
+        // then build with `npx vidra build --target <target> --native-update`.
+        // `npx vidra doctor` names whichever half is missing.
         builder
             .UseMauiApp<App>()
             .UseVidra()

package/templates/react-vite/src/{{projectName}}.Host/Platforms/MacCatalyst/Program.cs

@@ -1,3 +1,25 @@
+// The app's entry point on Mac Catalyst.
+//
+// A native updater has to run before UIKit does: on install, update and
+// uninstall Velopack re-launches the app with a `--veloapp-*` argument and
+// expects it to do that work and exit without ever showing a window. `vpk pack`
+// also inspects the assembly statically and warns when
+// `VelopackApp.Build()...Run()` is anywhere other than the entry point.
+//
+// `UseVidraLocator()` is the Mac Catalyst part. Velopack's client picks its
+// locator from `RuntimeInformation.IsOSPlatform`, which answers false for OSX
+// here, so without it, `Run()` throws before any update logic executes.
+//
+// To turn native updates on:
+//   1. add the Vidra.Updates.Native package reference to this project
+//   2. uncomment the two lines below, and the ones in MauiProgram.cs
+//   3. add a `vidra.updates.native.feedUrl` to package.json
+//   4. build with `npx vidra build --target macos --native-update`
+//
+// `npx vidra doctor` checks all four and names whichever is missing.
+
+// using Velopack;
+// using Vidra.Hosting;
 using UIKit;
 
 namespace {{projectName}};
@@ -6,6 +28,8 @@ public static class Program
 {
     static void Main(string[] args)
     {
+        // VelopackApp.Build().UseVidraLocator().Run();
+
         UIApplication.Main(args, null, typeof(AppDelegate));
     }
 }

package/templates/react-vite/src/{{projectName}}.Host/Platforms/Windows/Program.cs

@@ -0,0 +1,45 @@
+// The app's real entry point on Windows.
+//
+// MAUI generates one of these for you. This app takes it over, via
+// `<DefineConstants>` in the csproj setting DISABLE_XAML_GENERATED_MAIN, for
+// one reason: a native updater has to run *first*, before any UI framework
+// starts.
+//
+// On install, update and uninstall, Velopack re-launches the app with a
+// `--veloapp-*` argument and expects it to do that work and exit without ever
+// showing a window. `VelopackApp.Build()...Run()` is what handles those launches,
+// and `vpk pack` statically inspects the assembly and warns when it finds the
+// call anywhere other than the entry point. Putting it here costs nothing and
+// means an app that later enables updates needs no migration into generated code.
+//
+// To turn native updates on:
+//   1. add the Vidra.Updates.Native package reference to this project
+//   2. uncomment the two lines below, and the ones in MauiProgram.cs
+//   3. add a `vidra.updates.native.feedUrl` to package.json
+//   4. build with `npx vidra build --target windows --native-update`
+//
+// `npx vidra doctor` checks all four and names whichever is missing.
+
+// using Velopack;
+// using Vidra.Hosting;
+
+namespace {{projectName}}.WinUI;
+
+public static class Program
+{
+    [STAThread]
+    static void Main(string[] args)
+    {
+        // VelopackApp.Build().UseVidraLocator().Run();
+
+        WinRT.ComWrappersSupport.InitializeComWrappers();
+
+        Microsoft.UI.Xaml.Application.Start(p =>
+        {
+            var context = new Microsoft.UI.Dispatching.DispatcherQueueSynchronizationContext(
+                Microsoft.UI.Dispatching.DispatcherQueue.GetForCurrentThread());
+            System.Threading.SynchronizationContext.SetSynchronizationContext(context);
+            _ = new App();
+        });
+    }
+}

package/templates/react-vite/src/{{projectName}}.Host/{{projectName}}.Host.csproj

@@ -18,6 +18,28 @@
     <ApplicationVersion>1</ApplicationVersion>
     <ApplicationDisplayVersion>0.1.0</ApplicationDisplayVersion>
     <EnableCodeSigning Condition="$([MSBuild]::GetTargetPlatformIdentifier('$(TargetFramework)')) == 'maccatalyst'">true</EnableCodeSigning>
+    <!--
+      Entitlements for the hardened runtime, which notarization requires and
+      which would otherwise kill .NET's JIT. `vidra build` re-signs the bundle
+      with this same file, so pointing MAUI at it keeps both passes consistent.
+
+      What Entitlements.plist grants (it carries no comments of its own — the
+      MacCatalyst SDK's plist parser rejects XML comments inside <dict>):
+        allow-jit + allow-unsigned-executable-memory  .NET compiles to
+                                                      writable-then-executable memory
+        disable-library-validation                    the runtime loads dylibs
+                                                      signed by another team
+        network.client                                the WebView reaches the
+                                                      Vite dev server
+        files.user-selected.read-write                filePicker hands back paths
+                                                      the app then reads
+        app-sandbox = false                           Vidra's filesystem module
+                                                      exposes unrestricted paths;
+                                                      Developer ID (unlike the App
+                                                      Store) does not require the
+                                                      sandbox
+    -->
+    <CodesignEntitlements Condition="$([MSBuild]::GetTargetPlatformIdentifier('$(TargetFramework)')) == 'maccatalyst'">Entitlements.plist</CodesignEntitlements>
 
     <SupportedOSPlatformVersion Condition="$([MSBuild]::GetTargetPlatformIdentifier('$(TargetFramework)')) == 'maccatalyst'">15.0</SupportedOSPlatformVersion>
     <SupportedOSPlatformVersion Condition="$([MSBuild]::GetTargetPlatformIdentifier('$(TargetFramework)')) == 'windows'">10.0.17763.0</SupportedOSPlatformVersion>
@@ -31,6 +53,21 @@
     -->
     <WindowsPackageType Condition="$([MSBuild]::GetTargetPlatformIdentifier('$(TargetFramework)')) == 'windows'">None</WindowsPackageType>
 
+    <!--
+      This app owns its Windows entry point (Platforms/Windows/Program.cs)
+      instead of the one the XAML compiler generates.
+
+      A native updater has to run before any UI framework starts: on install,
+      update and uninstall Velopack re-launches the app with a `veloapp`
+      argument and expects it to do that work and exit without ever showing a
+      window, and `vpk pack` inspects the assembly and warns when it finds the
+      call outside the entry point. Entry-point shape is the one thing a package
+      reference cannot retrofit, so every Vidra app ships with it and the
+      Velopack line stays commented out until the app opts in. Mac Catalyst
+      already has a real `Main`, so it needs no equivalent switch.
+    -->
+    <DefineConstants Condition="$([MSBuild]::GetTargetPlatformIdentifier('$(TargetFramework)')) == 'windows'">$(DefineConstants);DISABLE_XAML_GENERATED_MAIN</DefineConstants>
+
     <!--
       Skip the MacCatalyst managed linker in Debug. The linker's Setup step
       validates the MacCatalyst SDK headers against the maui workload version,