hotcodepush 0.0.1 → 0.1.0

package/dist/commands/doctor.js

@@ -0,0 +1,363 @@
+import { ProjectConfigurationSchema, resolveSigningKeyId, } from '@hotcodepush/protocol';
+import { defineCommand } from 'zodline';
+import { INIT_MANUAL_STEP, PACKAGE_JSON, PROJECT_CONFIG_FILE_NAME, } from '../config/consts.js';
+import { createApiClient } from '../utils/api-client.js';
+import { fetchCurrentUser, isUnauthenticatedError, resolveCredentialText, } from '../utils/credential.js';
+import { resolveCliError, resolveSentence } from '../utils/error-mapping.js';
+import { CliError, InvalidJsonError, NotLoggedInError, ReportedFailureError, SigningKeyUnavailableError, UnknownFrameworkError, } from '../utils/errors.js';
+import { detectFramework } from '../utils/framework.js';
+import { resolveFrameworkModule } from '../utils/frameworks/index.js';
+import { readInstalledPackageVersion, readSdkDependencyVersion, } from '../utils/frameworks/sdk-package.js';
+import { defineCommandOptions } from '../utils/global-options.js';
+import { resolveFilesBaseUrl, resolveUpdatesBaseUrl } from '../utils/hosts.js';
+import { printOutcomeRows } from '../utils/outcome.js';
+import { printJson, resolveQuantityText } from '../utils/output.js';
+import { readPackageJson } from '../utils/package-json.js';
+import { ID_SCHEMA, locateProjectConfigFile, readProjectConfigFile, resolveProjectChannel, } from '../utils/project-config.js';
+import { fetchChannels, fetchHasSigningKey, fetchResourceId, fetchSigningKeys, } from '../utils/resource-resolution.js';
+import { readSigningKeyPair } from '../utils/signing-private-key.js';
+import { isEnvironmentToken, readToken } from '../utils/token-store.js';
+import { readApiUrl } from '../utils/user-config.js';
+const CHANNEL_NAME_SCHEMA = ProjectConfigurationSchema.shape.channel;
+const PROBE_TIMEOUT_MS = 5000;
+export default defineCommand({
+    description: 'Check the project: its configuration, the hook wiring, the signing key, the hosts and the versions a bug report needs.',
+    examples: ['hotcodepush doctor', 'hotcodepush doctor --json'],
+    options: defineCommandOptions({}),
+    action: async (options) => {
+        const project = readProject(options.config);
+        const { app, checks: sessionAndAppChecks } = await checkSessionAndApp(project);
+        const checks = [
+            checkConfiguration(project),
+            ...sessionAndAppChecks,
+            ...checkFramework(project),
+            await checkHosts(),
+            await checkSigningKey(project, app),
+            checkVersions(project),
+        ];
+        const status = checks.some(({ status }) => status === 'failed')
+            ? 'failed'
+            : 'clean';
+        if (options.json) {
+            printJson({ checks, status });
+        }
+        else {
+            printOutcomeRows(checks.map(({ check, manualStep, message, status }) => ({
+                manualStep,
+                message,
+                name: check,
+                status,
+            })));
+        }
+        if (status === 'failed') {
+            throw new ReportedFailureError('doctor_failed');
+        }
+    },
+});
+function readProject(configPath) {
+    const { directoryPath, filePath } = locateProjectConfigFile(configPath);
+    const framework = resolveProjectFramework(directoryPath);
+    const project = {
+        directoryPath,
+        framework,
+        packageJson: framework instanceof CliError
+            ? undefined
+            : readPackageJson(directoryPath),
+        projectConfig: undefined,
+    };
+    if (filePath === undefined) {
+        return project;
+    }
+    try {
+        return { ...project, projectConfig: readProjectConfigFile(filePath) };
+    }
+    catch (error) {
+        if (!(error instanceof InvalidJsonError)) {
+            throw error;
+        }
+        return { ...project, projectConfigError: error };
+    }
+}
+function checkConfiguration({ directoryPath, projectConfig, projectConfigError, }) {
+    if (projectConfigError !== undefined) {
+        return resolveFailedCheck('configuration', projectConfigError);
+    }
+    if (projectConfig === undefined) {
+        return {
+            check: 'configuration',
+            code: 'project_config_missing',
+            manualStep: INIT_MANUAL_STEP,
+            message: `There is no ${PROJECT_CONFIG_FILE_NAME} in ${directoryPath} or a directory above it.`,
+            status: 'failed',
+        };
+    }
+    const problems = resolveConfigurationProblems(projectConfig);
+    if (problems.length > 0) {
+        return {
+            check: 'configuration',
+            code: 'project_config_invalid',
+            manualStep: INIT_MANUAL_STEP,
+            message: `The file ${PROJECT_CONFIG_FILE_NAME} ${problems.join(' and ')}.`,
+            status: 'failed',
+        };
+    }
+    return {
+        check: 'configuration',
+        message: `The file ${PROJECT_CONFIG_FILE_NAME} names app ${projectConfig.appId} and channel ${resolveProjectChannel(projectConfig)}.`,
+        status: 'ok',
+    };
+}
+// A file without `channel` follows the schema default.
+function resolveConfigurationProblems(projectConfig) {
+    const problems = [];
+    if (projectConfig.appId === undefined) {
+        problems.push('lacks appId');
+    }
+    else if (!ID_SCHEMA.safeParse(projectConfig.appId).success) {
+        problems.push('has an appId that is not an id');
+    }
+    if (projectConfig.channel !== undefined &&
+        !CHANNEL_NAME_SCHEMA.safeParse(projectConfig.channel).success) {
+        problems.push('has a channel that is not a channel name');
+    }
+    return problems;
+}
+// A refused credential, or an API that cannot be asked, fails the session check and leaves the app out.
+async function checkSessionAndApp({ projectConfig, }) {
+    let user;
+    try {
+        if (readToken() === undefined) {
+            return {
+                app: undefined,
+                checks: [
+                    {
+                        check: 'session',
+                        message: 'You are not logged in, so the app is not checked against the API.',
+                        status: 'skipped',
+                    },
+                ],
+            };
+        }
+        user = await fetchCurrentUser();
+    }
+    catch (error) {
+        return { app: undefined, checks: [resolveFailedSessionCheck(error)] };
+    }
+    const sessionCheck = {
+        check: 'session',
+        message: resolveCredentialText(user, isEnvironmentToken()),
+        status: 'ok',
+    };
+    const { app, check } = await checkApp(projectConfig);
+    return { app, checks: [sessionCheck, check] };
+}
+function resolveFailedSessionCheck(error) {
+    const { code, fix, message } = resolveCliError(error);
+    if (isUnauthenticatedError(error) || error instanceof NotLoggedInError) {
+        return {
+            check: 'session',
+            code,
+            manualStep: 'Run "hotcodepush login", or set a valid HOTCODEPUSH_TOKEN.',
+            message: 'The API does not accept the credential.',
+            status: 'failed',
+        };
+    }
+    return {
+        check: 'session',
+        code,
+        manualStep: fix ?? undefined,
+        message: `The credential cannot be checked. ${resolveSentence(message)}`,
+        status: 'failed',
+    };
+}
+async function checkApp(projectConfig) {
+    if (projectConfig?.appId === undefined ||
+        !ID_SCHEMA.safeParse(projectConfig.appId).success) {
+        return {
+            app: undefined,
+            check: {
+                check: 'app',
+                message: 'The configuration names no app and channel to check.',
+                status: 'skipped',
+            },
+        };
+    }
+    const { appId } = projectConfig;
+    const hotCodePush = createApiClient();
+    try {
+        const [app, channel] = await Promise.all([
+            hotCodePush.apps.get({ appId }),
+            fetchResourceId('channel', resolveProjectChannel(projectConfig), () => fetchChannels(hotCodePush, appId), PROJECT_CONFIG_FILE_NAME).then(channelId => hotCodePush.apps.channels.get({ appId, channelId })),
+        ]);
+        return {
+            app,
+            check: {
+                check: 'app',
+                message: `The app ${app.name} and the channel ${channel.name} exist.`,
+                status: 'ok',
+            },
+        };
+    }
+    catch (error) {
+        return {
+            app: undefined,
+            check: {
+                check: 'app',
+                code: resolveCliError(error).code,
+                manualStep: INIT_MANUAL_STEP,
+                message: `The API does not know the app or the channel. ${resolveSentence(error instanceof Error ? error.message : String(error))}`,
+                status: 'failed',
+            },
+        };
+    }
+}
+// No key file is looked for, since an upload is told where its key is.
+// A key the app has but the file does not list fails, since an upload from that project would go unsigned.
+async function checkSigningKey({ projectConfig }, app) {
+    const publicKeys = projectConfig?.appId === undefined ? [] : (projectConfig.publicKeys ?? []);
+    try {
+        if (publicKeys.length === 0 &&
+            app !== undefined &&
+            (await fetchHasSigningKey(createApiClient(), app.id))) {
+            return {
+                check: 'signing_key',
+                code: 'public_key_unlisted',
+                manualStep: `Run "hotcodepush signing-key list --json" and add each publicKey to publicKeys in ${PROJECT_CONFIG_FILE_NAME}.`,
+                message: `The app has a signing key and ${PROJECT_CONFIG_FILE_NAME} lists none.`,
+                status: 'failed',
+            };
+        }
+        const unregisteredKeyCount = app === undefined || publicKeys.length === 0
+            ? 0
+            : await fetchUnregisteredPublicKeyCount(app.id, publicKeys);
+        if (unregisteredKeyCount > 0) {
+            return {
+                check: 'signing_key',
+                code: 'public_key_unregistered',
+                manualStep: 'Run "hotcodepush signing-key list --json" and keep in publicKeys only the keys it prints.',
+                message: `The file ${PROJECT_CONFIG_FILE_NAME} lists ${resolveQuantityText(unregisteredKeyCount, 'public key')} the app has not registered.`,
+                status: 'failed',
+            };
+        }
+        return await checkSigningPrivateKey(publicKeys);
+    }
+    catch (error) {
+        return resolveFailedCheck('signing_key', error);
+    }
+}
+// No variable while keys are listed is fine, since an upload is told where its key is.
+async function checkSigningPrivateKey(publicKeys) {
+    try {
+        const signingKeyPair = await readSigningKeyPair(publicKeys, undefined);
+        return signingKeyPair === null
+            ? {
+                check: 'signing_key',
+                message: 'Code signing is off. Run "hotcodepush signing-key create" to turn it on.',
+                status: 'skipped',
+            }
+            : {
+                check: 'signing_key',
+                message: `HOTCODEPUSH_SIGNING_KEY signs with key ${resolveSigningKeyId(signingKeyPair.publicKey)}.`,
+                status: 'ok',
+            };
+    }
+    catch (error) {
+        if (error instanceof SigningKeyUnavailableError) {
+            return {
+                check: 'signing_key',
+                message: 'Code signing is on. An upload signs with --private-key-path or HOTCODEPUSH_SIGNING_KEY.',
+                status: 'ok',
+            };
+        }
+        throw error;
+    }
+}
+// An upload signed with an unregistered key is refused.
+async function fetchUnregisteredPublicKeyCount(appId, publicKeys) {
+    const registeredPublicKeys = new Set((await fetchSigningKeys(createApiClient(), appId)).map(({ publicKey }) => publicKey));
+    return publicKeys.filter(publicKey => !registeredPublicKeys.has(publicKey))
+        .length;
+}
+// The resource file is not checked, since every build writes it into the app, never into the project.
+function checkFramework(project) {
+    const { framework } = project;
+    if (framework instanceof CliError) {
+        return [resolveFailedCheck('framework', framework)];
+    }
+    return framework.checkWiring(project);
+}
+// Any HTTP answer counts and a network error does not.
+async function checkHosts() {
+    let apiUrl;
+    try {
+        apiUrl = readApiUrl();
+    }
+    catch (error) {
+        return resolveFailedCheck('hosts', error);
+    }
+    const hosts = [
+        ['api', `${apiUrl.replace(/\/+$/, '')}/health`],
+        ['files', resolveFilesBaseUrl(apiUrl)],
+        ['updates', resolveUpdatesBaseUrl(apiUrl)],
+    ];
+    const unreachable = (await Promise.all(hosts.map(async ([name, url]) => (await isReachable(url)) ? undefined : `${name} (${url})`))).filter(host => host !== undefined);
+    if (unreachable.length > 0) {
+        return {
+            check: 'hosts',
+            code: 'host_unreachable',
+            manualStep: 'Check the network, the API URL in config.json and the HOTCODEPUSH_*_BASE_URL variables.',
+            message: `The CLI cannot reach ${unreachable.join(', ')}.`,
+            status: 'failed',
+        };
+    }
+    return {
+        check: 'hosts',
+        message: `The hosts ${hosts.map(([name]) => name).join(', ')} are reachable.`,
+        status: 'ok',
+    };
+}
+function checkVersions({ directoryPath, framework, packageJson, }) {
+    const versions = [
+        `${PACKAGE_JSON.name} ${PACKAGE_JSON.version}`,
+        `node ${process.version}`,
+    ];
+    if (!(framework instanceof CliError)) {
+        versions.push(...framework.versionedPackageNames.map(packageName => `${packageName} ${readInstalledPackageVersion(directoryPath, packageName) ?? packageJson?.dependencies?.[packageName] ?? 'missing'}`), ...(framework.versionedSdkDependencyNames ?? []).map(packageName => `${packageName} ${readSdkDependencyVersion(directoryPath, framework.packageName, packageName) ?? 'missing'}`));
+    }
+    return {
+        check: 'versions',
+        message: `The versions are ${versions.join(', ')}.`,
+        status: 'ok',
+    };
+}
+function resolveFailedCheck(check, error) {
+    const { code, fix, message } = resolveCliError(error);
+    return {
+        check,
+        code,
+        manualStep: fix ?? undefined,
+        message: resolveSentence(message),
+        status: 'failed',
+    };
+}
+async function isReachable(url) {
+    try {
+        await fetch(url, { signal: AbortSignal.timeout(PROBE_TIMEOUT_MS) });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function resolveProjectFramework(directoryPath) {
+    try {
+        return resolveFrameworkModule(detectFramework(directoryPath));
+    }
+    catch (error) {
+        if (error instanceof UnknownFrameworkError ||
+            error instanceof InvalidJsonError) {
+            return error;
+        }
+        throw error;
+    }
+}

package/dist/commands/fingerprint/diff.js

@@ -0,0 +1,133 @@
+import { readFile } from 'node:fs/promises';
+import { z } from 'zod';
+import { defineCommand } from 'zodline';
+import { InvalidParameterError } from '../../utils/errors.js';
+import { defineCommandOptions } from '../../utils/global-options.js';
+import { printJson, printTable } from '../../utils/output.js';
+import { promptText } from '../../utils/prompts.js';
+const FINGERPRINT_FILE_FIX = 'Write each file with "hotcodepush fingerprint --json > <file>", the earlier one at the commit of the store build.';
+const FingerprintFileSchema = z.object({
+    fingerprint: z.string(),
+    extraFingerprintPaths: z.array(z.object({ path: z.string(), sha256: z.string() })),
+    packages: z.array(z.object({
+        integrity: z.string().nullable(),
+        name: z.string(),
+        version: z.string(),
+    })),
+});
+export default defineCommand({
+    description: 'Print the packages and extra fingerprint paths added, removed or moved between <file-a> and <file-b>, two files written by fingerprint --json, the earlier first; local, no login.',
+    examples: [
+        'hotcodepush fingerprint diff store-build.json current.json',
+        'hotcodepush fingerprint diff store-build.json current.json --json',
+    ],
+    args: z.array(z.string()),
+    options: defineCommandOptions({}),
+    action: async (options, args) => {
+        if (args.length > 2) {
+            throw new InvalidParameterError(`The fingerprint diff command compares two files, <file-a> and <file-b>. It does not take ${args.slice(2).join(' ')}.`);
+        }
+        const beforeFile = await readFingerprintFile('<file-a>', args[0] ??
+            (await promptText('<file-a>', "Which file holds the earlier fingerprint, the store build's?", options)));
+        const afterFile = await readFingerprintFile('<file-b>', args[1] ??
+            (await promptText('<file-b>', 'Which file holds the later fingerprint?', options)));
+        const diff = resolveFingerprintDiff(beforeFile, afterFile);
+        if (options.json) {
+            printJson(diff);
+            return;
+        }
+        if (diff.packages.length === 0 && diff.extraFingerprintPaths.length === 0) {
+            console.log(`Nothing moved: both files hold ${beforeFile.fingerprint}.`);
+            return;
+        }
+        printTable({
+            emptyText: 'No package moved.',
+            headers: ['PACKAGE', 'BEFORE', 'AFTER'],
+            nextOffset: null,
+            rows: diff.packages.map(({ after, before, name }) => [
+                name,
+                resolveInstalledVersionText(before, after),
+                resolveInstalledVersionText(after, before),
+            ]),
+        });
+        if (diff.extraFingerprintPaths.length > 0) {
+            printTable({
+                emptyText: '',
+                headers: ['EXTRA FINGERPRINT PATH', 'BEFORE', 'AFTER'],
+                nextOffset: null,
+                rows: diff.extraFingerprintPaths.map(({ after, before, path }) => [
+                    path,
+                    before ?? 'none',
+                    after ?? 'none',
+                ]),
+            });
+        }
+    },
+});
+async function readFingerprintFile(argumentName, filePath) {
+    const text = await readFile(filePath, 'utf8').catch((error) => {
+        throw new InvalidParameterError(`The file ${filePath} from ${argumentName} cannot be read.`, FINGERPRINT_FILE_FIX, error);
+    });
+    const parsedFile = FingerprintFileSchema.safeParse(parseJson(text));
+    if (!parsedFile.success) {
+        throw new InvalidParameterError(`The file ${filePath} from ${argumentName} is not a fingerprint written by fingerprint --json.`, FINGERPRINT_FILE_FIX, parsedFile.error);
+    }
+    return parsedFile.data;
+}
+function parseJson(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+}
+function resolveFingerprintDiff(before, after) {
+    return {
+        extraFingerprintPaths: resolveExtraFingerprintPathChanges(before.extraFingerprintPaths, after.extraFingerprintPaths),
+        packages: resolvePackageChanges(before.packages, after.packages),
+    };
+}
+// Pairs the versions in order: a pair moved, the rest was added or removed.
+function resolvePackageChanges(before, after) {
+    const names = [...new Set([...before, ...after].map(({ name }) => name))];
+    return names.sort().flatMap(name => {
+        const beforeVersions = resolveVersionsOnlyIn(before, after, name);
+        const afterVersions = resolveVersionsOnlyIn(after, before, name);
+        return Array.from({ length: Math.max(beforeVersions.length, afterVersions.length) }, (_, index) => ({
+            after: afterVersions[index] ?? null,
+            before: beforeVersions[index] ?? null,
+            name,
+        }));
+    });
+}
+function resolveVersionsOnlyIn(packages, otherPackages, name) {
+    return packages
+        .filter(locked => locked.name === name &&
+        !otherPackages.some(other => other.name === name &&
+            other.version === locked.version &&
+            other.integrity === locked.integrity))
+        .map(({ integrity, version }) => ({ integrity, version }));
+}
+function resolveExtraFingerprintPathChanges(before, after) {
+    const beforeHashes = new Map(before.map(({ path, sha256 }) => [path, sha256]));
+    const afterHashes = new Map(after.map(({ path, sha256 }) => [path, sha256]));
+    const paths = [...new Set([...beforeHashes.keys(), ...afterHashes.keys()])];
+    return paths
+        .sort()
+        .map(path => ({
+        after: afterHashes.get(path) ?? null,
+        before: beforeHashes.get(path) ?? null,
+        path,
+    }))
+        .filter(({ after, before }) => after !== before);
+}
+// Shows the integrity where the version did not move, so a rebuild under the same version shows.
+function resolveInstalledVersionText(installedVersion, otherInstalledVersion) {
+    if (installedVersion === null) {
+        return 'none';
+    }
+    return installedVersion.version === otherInstalledVersion?.version
+        ? (installedVersion.integrity ?? 'no integrity')
+        : installedVersion.version;
+}

package/dist/commands/fingerprint.js

@@ -0,0 +1,41 @@
+import { computeFingerprint } from '@hotcodepush/protocol/fingerprint';
+import { defineCommand } from 'zodline';
+import { readProjectFingerprintContributors } from '../utils/fingerprint.js';
+import { defineCommandOptions } from '../utils/global-options.js';
+import { printJson, printTable } from '../utils/output.js';
+import { locateProjectConfig } from '../utils/project-config.js';
+export default defineCommand({
+    description: "Print the project's native fingerprint with the packages and the files under the extra fingerprint paths that contribute to it; local, no login.",
+    examples: [
+        'hotcodepush fingerprint',
+        'hotcodepush fingerprint --json > fingerprint.json',
+    ],
+    options: defineCommandOptions({}),
+    action: async (options) => {
+        const { directoryPath, projectConfig } = locateProjectConfig(options.config);
+        const contributors = await readProjectFingerprintContributors(directoryPath, projectConfig?.extraFingerprintPaths ?? []);
+        const fingerprint = computeFingerprint(contributors);
+        if (options.json) {
+            printJson({ fingerprint, ...contributors });
+            return;
+        }
+        console.log(`Fingerprint ${fingerprint}`);
+        printTable({
+            emptyText: 'No installed package ships native code.',
+            headers: ['PACKAGE', 'VERSION'],
+            nextOffset: null,
+            rows: contributors.packages.map(({ name, version }) => [name, version]),
+        });
+        if (contributors.extraFingerprintPaths.length > 0) {
+            printTable({
+                emptyText: '',
+                headers: ['EXTRA FINGERPRINT PATH', 'SHA-256'],
+                nextOffset: null,
+                rows: contributors.extraFingerprintPaths.map(({ path, sha256 }) => [
+                    path,
+                    sha256,
+                ]),
+            });
+        }
+    },
+});