deeplink-parity 0.1.0 → 0.2.1

package/README.md

@@ -1,9 +1,16 @@
 # deeplink-parity
 
+[![npm](https://img.shields.io/npm/v/deeplink-parity.svg)](https://www.npmjs.com/package/deeplink-parity)
+[![CI](https://github.com/camosss/deeplink-parity/actions/workflows/ci.yml/badge.svg)](https://github.com/camosss/deeplink-parity/actions/workflows/ci.yml)
+![Node](https://img.shields.io/badge/Node-18%2B-brightgreen.svg)
+![Platform](https://img.shields.io/badge/Platform-iOS%20%7C%20Android-lightgrey.svg)
+[![License](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
+
 Checks that what your app **declares** about deep links matches what is actually **hosted** — on both iOS and Android, from one command.
 
 ```bash
-npx deeplink-parity .
+# iOS and Android usually live in separate repositories — pass both
+npx deeplink-parity ./my-app-ios ./my-app-android
 ```
 
 ```
@@ -70,13 +77,26 @@ No configuration file. Domains are discovered from your app, then the matching w
 ## Usage
 
 ```bash
-npx deeplink-parity [path] [options]
+npx deeplink-parity [path...] [options]
 
   --sha256 <fingerprint>   Android signing fingerprint to look for in assetlinks.json
   --well-known <dir>       Read well-known files from <dir>/<domain>/ instead of the network
   --json                   Machine-readable output
 ```
 
+Pass one path per checkout. A monorepo holding both platforms works as a single path,
+two repositories work as two paths, and a directory of symlinks to each checkout works
+too — the scan follows them.
+
+```bash
+npx deeplink-parity .                                  # one repo
+npx deeplink-parity ../app-ios ../app-android          # two repos
+npx deeplink-parity . --sha256 "AB:CD:…"               # include the fingerprint check
+```
+
+The Android signing fingerprint comes from Play Console → App integrity → App signing.
+Without it the fingerprint check is skipped and reported as such.
+
 Exits `1` when there is at least one error, so it drops into CI unchanged.
 
 ### Run it on a schedule — this is the point
@@ -139,4 +159,4 @@ values, and unresolvable references.
 
 ## License
 
-MIT
+`deeplink-parity` is released under an MIT license. See [License](LICENSE) for more information.

package/dist/cli.js

@@ -7,7 +7,12 @@ const USAGE = `deeplink-parity — check that what your app declares about deep
 matches what is actually hosted, across iOS and Android.
 
 Usage
-  deeplink-parity [path] [options]
+  deeplink-parity [path...] [options]
+
+  Pass one path per checkout. iOS and Android usually live in separate
+  repositories, and comparing them is the point:
+
+    deeplink-parity ./my-app-ios ./my-app-android
 
 Options
   --sha256 <fingerprint>   Android signing fingerprint to look for in assetlinks.json
@@ -17,7 +22,7 @@ Options
 `;
 function parseArgs(argv) {
     const args = argv.slice(2);
-    let root = '.';
+    const roots = [];
     let json = false;
     let help = false;
     let sha256;
@@ -33,20 +38,26 @@ function parseArgs(argv) {
         else if (arg === '--well-known')
             wellKnown = args[++i];
         else if (!arg.startsWith('-'))
-            root = arg;
+            roots.push(arg);
     }
-    return { root: resolve(root), json, help, sha256, wellKnown };
+    return {
+        roots: (roots.length ? roots : ['.']).map((r) => resolve(r)),
+        json,
+        help,
+        sha256,
+        wellKnown,
+    };
 }
 async function main() {
-    const { root, json, help, sha256, wellKnown } = parseArgs(process.argv);
+    const { roots, json, help, sha256, wellKnown } = parseArgs(process.argv);
     if (help) {
         console.log(USAGE);
         return;
     }
     const source = wellKnown ? localSource(resolve(wellKnown)) : networkSource();
-    const result = await run({ root, source, sha256 });
+    const result = await run({ roots, source, sha256 });
     if (result.iosApps.length === 0 && result.androidApps.length === 0) {
-        console.error(`No app configuration declaring deep links was found in ${root}`);
+        console.error(`No app configuration declaring deep links was found in ${roots.join(', ')}`);
         console.error('Expected a .entitlements file with applinks:, or an AndroidManifest.xml with intent-filters.');
         process.exit(2);
     }

package/dist/discover/android.js

@@ -1,8 +1,7 @@
 import { readFile } from 'node:fs/promises';
-import { relative } from 'node:path';
 import { XMLParser } from 'fast-xml-parser';
 import { emptyIndex, indexProperties, indexResValues, indexStrings, resolveRef, } from '../resolve/androidResources.js';
-import { walk } from './walk.js';
+import { displayPath, walk } from './walk.js';
 const VIEW_ACTION = 'android.intent.action.VIEW';
 const BROWSABLE = 'android.intent.category.BROWSABLE';
 /** fast-xml-parser hands back a single object when an element occurs once. */
@@ -30,12 +29,26 @@ function collectIntentFilters(node, out) {
                 collectIntentFilters(child, out);
     }
 }
+/**
+ * A build type or flavor can append to the base id with `applicationIdSuffix`, and the
+ * dev variant is usually what a dev domain's assetlinks file names. Suffixes are applied
+ * to every base id so that both `com.example` and `com.example.dev` count as ours.
+ */
 function applicationIds(gradleSources) {
-    const ids = new Set();
+    const bases = new Set();
+    const suffixes = new Set();
     for (const src of gradleSources) {
-        for (const m of src.matchAll(/applicationId\s*(?:=|\s)\s*["']([^"']+)["']/g)) {
-            ids.add(m[1]);
+        for (const m of src.matchAll(/\bapplicationId\s*(?:=|\s)\s*["']([^"']+)["']/g)) {
+            bases.add(m[1]);
         }
+        for (const m of src.matchAll(/\bapplicationIdSuffix\s*(?:=|\s)\s*["']([^"']+)["']/g)) {
+            suffixes.add(m[1]);
+        }
+    }
+    const ids = new Set(bases);
+    for (const base of bases) {
+        for (const suffix of suffixes)
+            ids.add(`${base}${suffix}`);
     }
     return [...ids];
 }
@@ -123,7 +136,7 @@ export async function discoverAndroid(root) {
         if (hosts.size === 0 && unresolved.length === 0)
             continue;
         apps.push({
-            manifestPath: relative(root, manifestPath),
+            manifestPath: displayPath(manifestPath),
             packageIds,
             hosts: [...hosts.values()],
             unresolved,

package/dist/discover/ios.js

@@ -1,7 +1,6 @@
 import { readFile } from 'node:fs/promises';
-import { relative } from 'node:path';
 import plist from 'plist';
-import { walk } from './walk.js';
+import { displayPath, walk } from './walk.js';
 /**
  * Associated Domains entries look like `applinks:example.com`. A domain may carry
  * query-parameter options (`?mode=developer`) which are not part of the host.
@@ -52,6 +51,23 @@ function signingByEntitlements(pbxproj) {
     }
     return map;
 }
+/**
+ * Pick the target whose recorded entitlements path is the longest tail of this file's
+ * path. Longest wins so that `Widget/Widget.entitlements` never matches the app when
+ * `App/App.entitlements` is also on file.
+ */
+function matchSigning(path, signing) {
+    let best = {};
+    let bestLength = -1;
+    for (const [key, value] of signing) {
+        const tail = key.startsWith('/') ? key : `/${key}`;
+        if (path.endsWith(tail) && key.length > bestLength) {
+            best = value;
+            bestLength = key.length;
+        }
+    }
+    return best;
+}
 export async function discoverIos(root) {
     const entitlementFiles = await walk(root, (n) => n.endsWith('.entitlements'));
     if (entitlementFiles.length === 0)
@@ -77,11 +93,12 @@ export async function discoverIos(root) {
         const domains = parseAssociatedDomains(dict['com.apple.developer.associated-domains']);
         if (domains.length === 0)
             continue;
-        // pbxproj records the entitlements path relative to SOURCE_ROOT
-        const rel = relative(root, path);
-        const target = signing.get(rel) ?? {};
+        // pbxproj records the entitlements path relative to SOURCE_ROOT, which is not
+        // necessarily the directory being scanned — match on the tail so that pointing at
+        // a repository root or at a subdirectory both resolve the same target.
+        const target = matchSigning(path, signing);
         apps.push({
-            entitlementsPath: rel,
+            entitlementsPath: displayPath(path),
             domains,
             bundleId: target.bundleId,
             teamId: target.teamId,

package/dist/discover/walk.js

@@ -1,5 +1,13 @@
-import { readdir } from 'node:fs/promises';
-import { join } from 'node:path';
+import { readdir, realpath, stat } from 'node:fs/promises';
+import { join, relative } from 'node:path';
+/**
+ * Paths are shown relative to the working directory rather than to the scanned root,
+ * so that a run covering two checkouts stays unambiguous.
+ */
+export function displayPath(absolute) {
+    const rel = relative(process.cwd(), absolute);
+    return rel.startsWith('..') ? absolute : rel;
+}
 const SKIP_DIRS = new Set([
     'node_modules',
     'Pods',
@@ -12,8 +20,23 @@ const SKIP_DIRS = new Set([
     '.gradle',
     '.idea',
 ]);
-/** Depth-first file scan that skips dependency and build output directories. */
-export async function walk(dir, match, out = []) {
+/**
+ * Depth-first file scan that skips dependency and build output directories.
+ *
+ * Symlinked directories are followed, so a folder of links to several checkouts works
+ * as a single root. Real paths are tracked to stop a link cycle from recursing forever.
+ */
+export async function walk(dir, match, out = [], seen = new Set()) {
+    let here;
+    try {
+        here = await realpath(dir);
+    }
+    catch {
+        return out;
+    }
+    if (seen.has(here))
+        return out;
+    seen.add(here);
     let entries;
     try {
         entries = await readdir(dir, { withFileTypes: true });
@@ -22,14 +45,24 @@ export async function walk(dir, match, out = []) {
         return out;
     }
     for (const entry of entries) {
-        if (entry.isDirectory()) {
+        const path = join(dir, entry.name);
+        let isDir = entry.isDirectory();
+        if (entry.isSymbolicLink()) {
+            try {
+                isDir = (await stat(path)).isDirectory();
+            }
+            catch {
+                continue; // broken link
+            }
+        }
+        if (isDir) {
             if (SKIP_DIRS.has(entry.name))
                 continue;
             // .xcodeproj is a directory but holds project.pbxproj
-            await walk(join(dir, entry.name), match, out);
+            await walk(path, match, out, seen);
         }
         else if (match(entry.name)) {
-            out.push(join(dir, entry.name));
+            out.push(path);
         }
     }
     return out;

package/dist/run.js

@@ -7,8 +7,10 @@ import { isWildcardDomain, wildcardFinding } from './rules/wildcard.js';
 function emptyView() {
     return { domains: new Set(), paths: new Map() };
 }
-export async function run({ root, source, sha256 }) {
-    const [iosApps, androidApps] = await Promise.all([discoverIos(root), discoverAndroid(root)]);
+export async function run({ roots, source, sha256 }) {
+    const discovered = await Promise.all(roots.map(async (root) => Promise.all([discoverIos(root), discoverAndroid(root)])));
+    const iosApps = discovered.flatMap(([ios]) => ios);
+    const androidApps = discovered.flatMap(([, android]) => android);
     const findings = [];
     const ios = emptyView();
     const android = emptyView();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deeplink-parity",
-  "version": "0.1.0",
+  "version": "0.2.1",
   "description": "Checks that what your mobile app declares about deep links matches what is actually hosted — across iOS and Android.",
   "type": "module",
   "bin": {