hotcodepush 0.0.1 → 0.2.0

package/dist/utils/resource-file.js

@@ -0,0 +1,81 @@
+import { createPublicKey } from 'node:crypto';
+import { mkdirSync, writeFileSync } from 'node:fs';
+import { dirname } from 'node:path';
+import { ConfigurationSchema, resolveSigningKeyId, SIGNING_KEY_BITS_MINIMUM, SigningPublicKeySchema, } from '@hotcodepush/protocol';
+import { PROJECT_CONFIG_FILE_NAME } from '../config/consts.js';
+import { InvalidParameterError } from './errors.js';
+// The manifest is the unsigned bundle manifest without patches, whether or not a binary was created.
+// The public keys take the form that the platform API imports.
+export function buildResourceFile({ builtAt, channelId, embeddedBundle, fingerprint, hosts, platform, projectConfig, }) {
+    return ConfigurationSchema.parse({
+        ...omitProjectOnlyKeys(projectConfig),
+        builtAt,
+        channelId,
+        embeddedBundleId: embeddedBundle?.id ?? null,
+        embeddedBundleManifest: embeddedBundle === null
+            ? null
+            : {
+                appId: projectConfig.appId,
+                bundleVersion: embeddedBundle.bundleVersion,
+                files: embeddedBundle.files.map(({ path, sha256, sizeBytes }) => ({
+                    path,
+                    sha256,
+                    sizeBytes,
+                })),
+                fingerprint,
+                keyId: null,
+                platforms: [platform],
+            },
+        fingerprint,
+        publicKeys: (projectConfig.publicKeys ?? []).map(publicKey => resolveDevicePublicKey(publicKey, platform)),
+        ...(hosts.filesBaseUrl === undefined
+            ? {}
+            : { filesBaseUrl: hosts.filesBaseUrl }),
+        ...(hosts.updatesBaseUrl === undefined
+            ? {}
+            : { updatesBaseUrl: hosts.updatesBaseUrl }),
+    });
+}
+export function writeResourceFile(filePath, configuration) {
+    mkdirSync(dirname(filePath), { recursive: true });
+    writeFileSync(filePath, `${JSON.stringify(configuration, null, 2)}\n`);
+}
+// The device imports the DER with its platform API and handles no ASN.1 itself.
+// iOS `SecKeyCreateWithData` takes PKCS #1 and Android `X509EncodedKeySpec` takes SPKI.
+function resolveDevicePublicKey(publicKey, platform) {
+    if (!SigningPublicKeySchema.safeParse(publicKey).success) {
+        throw buildUnusablePublicKeyError(publicKey);
+    }
+    let keyObject;
+    try {
+        keyObject = createPublicKey({
+            format: 'der',
+            key: Buffer.from(publicKey.slice(publicKey.indexOf(':') + 1), 'base64'),
+            type: 'spki',
+        });
+    }
+    catch (error) {
+        throw buildUnusablePublicKeyError(publicKey, error);
+    }
+    if (keyObject.asymmetricKeyType !== 'rsa' ||
+        (keyObject.asymmetricKeyDetails?.modulusLength ?? 0) <
+            SIGNING_KEY_BITS_MINIMUM) {
+        throw buildUnusablePublicKeyError(publicKey);
+    }
+    return {
+        der: keyObject
+            .export({ format: 'der', type: platform === 'ios' ? 'pkcs1' : 'spki' })
+            .toString('base64'),
+        keyId: resolveSigningKeyId(publicKey),
+    };
+}
+function buildUnusablePublicKeyError(publicKey, cause) {
+    return new InvalidParameterError(`The publicKeys in ${PROJECT_CONFIG_FILE_NAME} list ${publicKey.slice(0, 32)}…, which is not an rsa-v1_5-sha256 key of ${SIGNING_KEY_BITS_MINIMUM} bits or more.`, 'Replace it with the public key "hotcodepush signing-key create" writes.', cause);
+}
+// The resolved id replaces the channel, and only the CLI reads the fingerprint paths.
+function omitProjectOnlyKeys(projectConfig) {
+    const configuration = { ...projectConfig };
+    delete configuration.channel;
+    delete configuration.extraFingerprintPaths;
+    return configuration;
+}

package/dist/utils/resource-resolution.js

@@ -0,0 +1,107 @@
+import { z } from 'zod';
+import { PROJECT_CONFIG_FILE_NAME } from '../config/consts.js';
+import { isInteractive } from './environment.js';
+import { AmbiguousNameError, MissingParameterError, UnknownNameError, } from './errors.js';
+import { fetchAllPages } from './pagination.js';
+import { assertProjectConfigAppId, ID_SCHEMA, readProjectConfig, resolveProjectChannel, } from './project-config.js';
+import { promptSelect } from './prompts.js';
+export const channelOptionShape = {
+    channel: z
+        .string()
+        .optional()
+        .describe("The channel, by id or name. Defaults to hotcodepush.json's channel."),
+};
+// A name is looked up in `--organization` when given, otherwise in every organization of the user.
+export async function fetchAppId(hotCodePush, options, projectConfig) {
+    if (options.app !== undefined) {
+        return fetchResourceId('app', options.app, () => fetchAppsInScope(hotCodePush, options.organization));
+    }
+    if (projectConfig?.appId !== undefined) {
+        assertProjectConfigAppId(projectConfig.appId);
+        return projectConfig.appId;
+    }
+    if (!isInteractive(options)) {
+        throw new MissingParameterError('--app');
+    }
+    const organizationId = await fetchOrganizationId(hotCodePush, options);
+    return promptResourceId('app', await fetchApps(hotCodePush, organizationId), options);
+}
+export function fetchApps(hotCodePush, organizationId) {
+    return fetchAllPages(page => hotCodePush.organizations.apps.list({ organizationId, ...page }));
+}
+export async function fetchChannel(hotCodePush, options) {
+    const projectConfig = readProjectConfig(options.config);
+    const appId = await fetchAppId(hotCodePush, options, projectConfig);
+    const channelId = await fetchChannelId(hotCodePush, appId, options, projectConfig);
+    return hotCodePush.apps.channels.get({ appId, channelId });
+}
+// The channel of hotcodepush.json counts only when the app is the one of the file too.
+export async function fetchChannelId(hotCodePush, appId, options, projectConfig) {
+    if (options.channel !== undefined) {
+        return fetchResourceId('channel', options.channel, () => fetchChannels(hotCodePush, appId));
+    }
+    if (projectConfig !== undefined && projectConfig.appId === appId) {
+        return fetchResourceId('channel', resolveProjectChannel(projectConfig), () => fetchChannels(hotCodePush, appId), PROJECT_CONFIG_FILE_NAME);
+    }
+    if (!isInteractive(options)) {
+        throw new MissingParameterError('--channel');
+    }
+    return promptResourceId('channel', await fetchChannels(hotCodePush, appId), options);
+}
+export function fetchChannels(hotCodePush, appId) {
+    return fetchAllPages(page => hotCodePush.apps.channels.list({ appId, ...page }));
+}
+export async function fetchOrganizationId(hotCodePush, options) {
+    if (options.organization !== undefined) {
+        return fetchResourceId('organization', options.organization, () => fetchOrganizations(hotCodePush));
+    }
+    const fetchedOrganizations = await fetchOrganizations(hotCodePush);
+    const [onlyOrganization] = fetchedOrganizations;
+    if (onlyOrganization !== undefined && fetchedOrganizations.length === 1) {
+        return onlyOrganization.id;
+    }
+    return promptResourceId('organization', fetchedOrganizations, options);
+}
+export function fetchOrganizations(hotCodePush) {
+    return fetchAllPages(page => hotCodePush.organizations.list(page));
+}
+// A UUID is an id, and anything else is a name looked up in the list.
+export async function fetchResourceId(noun, reference, fetchResources, source = `--${noun}`) {
+    if (ID_SCHEMA.safeParse(reference).success) {
+        return reference;
+    }
+    return resolveNamedResource(noun, reference, await fetchResources(), source)
+        .id;
+}
+// An app with a signing key releases only signed bundles.
+export async function fetchHasSigningKey(hotCodePush, appId) {
+    const { count } = await hotCodePush.apps.signingKeys.count({ appId });
+    return count > 0;
+}
+export function fetchSigningKeys(hotCodePush, appId) {
+    return fetchAllPages(page => hotCodePush.apps.signingKeys.list({ appId, ...page }));
+}
+export function promptResourceId(noun, resources, options) {
+    return promptSelect(`--${noun}`, `Which ${noun}?`, resources.map(({ id, name }) => ({ label: name, value: id })), options);
+}
+// Case-insensitive, as the API keeps app and channel names unique that way.
+export function resolveNamedResource(noun, name, resources, source = `--${noun}`) {
+    const namedResources = resources.filter(resource => resource.name.toLowerCase() === name.toLowerCase());
+    const [namedResource] = namedResources;
+    if (namedResource === undefined) {
+        throw new UnknownNameError(noun, name, source);
+    }
+    if (namedResources.length > 1) {
+        throw new AmbiguousNameError(noun, name, source);
+    }
+    return namedResource;
+}
+async function fetchAppsInScope(hotCodePush, organization) {
+    const organizationIds = organization === undefined
+        ? (await fetchOrganizations(hotCodePush)).map(({ id }) => id)
+        : [
+            await fetchResourceId('organization', organization, () => fetchOrganizations(hotCodePush)),
+        ];
+    const fetchedApps = await Promise.all(organizationIds.map(organizationId => fetchApps(hotCodePush, organizationId)));
+    return fetchedApps.flat();
+}

package/dist/utils/signing-private-key.js

@@ -0,0 +1,105 @@
+import { createPrivateKey } from 'node:crypto';
+import { readFileSync, writeFileSync } from 'node:fs';
+import { resolvePublicKeyOfPrivateKey, SIGNING_KEY_BITS_MINIMUM, } from '@hotcodepush/protocol';
+import { PROJECT_CONFIG_FILE_NAME } from '../config/consts.js';
+import { InvalidParameterError, SigningKeyUnavailableError } from './errors.js';
+// Matches an encrypted PKCS #8 PEM, or a PKCS #1 PEM whose header names its cipher.
+const ENCRYPTED_KEY_PATTERN = /ENCRYPTED PRIVATE KEY|Proc-Type:/;
+// Matches the first and last PEM line of PKCS #8, or of PKCS #1 as the Expo tool writes it.
+// They are dropped with all whitespace, so a key pasted on one line reads like the file.
+const PEM_BOUNDARY_PATTERN = /-----(BEGIN|END) (RSA )?PRIVATE KEY-----/g;
+const WHITESPACE_PATTERN = /\s/g;
+// A private key without a listed public key stops the upload, rather than being ignored.
+export async function readSigningKeyPair(publicKeys, privateKeyPath) {
+    const givenPrivateKey = readGivenPrivateKey(privateKeyPath);
+    if (givenPrivateKey === undefined) {
+        if (publicKeys.length > 0) {
+            throw new SigningKeyUnavailableError();
+        }
+        return null;
+    }
+    if (publicKeys.length === 0) {
+        throw new InvalidParameterError(`A private key is given from ${givenPrivateKey.source}, and ${PROJECT_CONFIG_FILE_NAME} lists no public key of the app.`, `Add its public key to publicKeys in ${PROJECT_CONFIG_FILE_NAME}, as "hotcodepush signing-key list --json" prints it, or give no private key.`);
+    }
+    const signingKeyPair = await resolveSigningKeyPair(givenPrivateKey);
+    if (!publicKeys.includes(signingKeyPair.publicKey)) {
+        throw new InvalidParameterError(`The private key from ${givenPrivateKey.source} belongs to no public key ${PROJECT_CONFIG_FILE_NAME} lists.`, `Give the private key of a public key ${PROJECT_CONFIG_FILE_NAME} lists, or make a new pair with "hotcodepush signing-key create".`);
+    }
+    return signingKeyPair;
+}
+// The public half is derived from the private key, so the two cannot mismatch.
+export function readSigningKeyPairFile(privateKeyPath) {
+    return resolveSigningKeyPair({
+        source: '--private-key-path',
+        text: readPrivateKeyFile(privateKeyPath),
+    });
+}
+export function writeSigningPrivateKeyFile(filePath, privateKey) {
+    const pem = createPrivateKey({
+        format: 'der',
+        key: Buffer.from(privateKey, 'base64'),
+        type: 'pkcs8',
+    }).export({ format: 'pem', type: 'pkcs8' });
+    writeFileSync(filePath, pem, { flag: 'wx', mode: 0o600 });
+}
+function importPrivateKey(text) {
+    const key = Buffer.from(text.replace(PEM_BOUNDARY_PATTERN, '').replace(WHITESPACE_PATTERN, ''), 'base64');
+    let importError;
+    for (const type of resolvePrivateKeyEncodings(text)) {
+        try {
+            return createPrivateKey({ format: 'der', key, type });
+        }
+        catch (error) {
+            importError = error;
+        }
+    }
+    throw importError;
+}
+function readGivenPrivateKey(privateKeyPath) {
+    if (privateKeyPath !== undefined) {
+        return {
+            source: '--private-key-path',
+            text: readPrivateKeyFile(privateKeyPath),
+        };
+    }
+    // An empty variable counts as unset, since a CI renders a secret it does not hold as empty.
+    const variableText = process.env.HOTCODEPUSH_SIGNING_KEY;
+    return variableText
+        ? { source: 'HOTCODEPUSH_SIGNING_KEY', text: variableText }
+        : undefined;
+}
+function readPrivateKeyFile(filePath) {
+    try {
+        return readFileSync(filePath, 'utf8');
+    }
+    catch (error) {
+        throw new InvalidParameterError(`The file ${filePath} from --private-key-path cannot be read.`, 'Pass the path of the private key file, a PEM of PKCS #8 or PKCS #1.', error);
+    }
+}
+function resolvePrivateKeyEncodings(text) {
+    if (text.includes('BEGIN RSA PRIVATE KEY')) {
+        return ['pkcs1'];
+    }
+    if (text.includes('BEGIN PRIVATE KEY')) {
+        return ['pkcs8'];
+    }
+    return ['pkcs8', 'pkcs1'];
+}
+// The protocol signs with the base64 of the PKCS #8 DER.
+async function resolveSigningKeyPair({ source, text, }) {
+    if (ENCRYPTED_KEY_PATTERN.test(text)) {
+        throw new InvalidParameterError(`The private key from ${source} is encrypted, which is not supported.`, 'Remove its passphrase first, as "openssl pkey -in <file> -out <new file>" does.');
+    }
+    try {
+        const privateKey = importPrivateKey(text)
+            .export({ format: 'der', type: 'pkcs8' })
+            .toString('base64');
+        return {
+            privateKey,
+            publicKey: await resolvePublicKeyOfPrivateKey(privateKey),
+        };
+    }
+    catch (error) {
+        throw new InvalidParameterError(`The key from ${source} is not an RSA private key of ${SIGNING_KEY_BITS_MINIMUM} bits or more.`, `Give an RSA private key of ${SIGNING_KEY_BITS_MINIMUM} bits or more, a PEM of PKCS #8 or PKCS #1.`, error);
+    }
+}

package/dist/utils/spending-cap.js

@@ -0,0 +1,16 @@
+import { z } from 'zod';
+const CENTS_PER_DOLLAR = 100;
+// The flag takes whole dollars, while the API counts cents and checks the range.
+export const spendingCapShape = {
+    spendingCap: z.coerce
+        .number()
+        .int()
+        .optional()
+        .describe('The most the organization pays a month, in whole dollars from $5 to $10,000.'),
+};
+export function resolveCents(dollars) {
+    return dollars * CENTS_PER_DOLLAR;
+}
+export function resolveDollarText(cents) {
+    return `$${(cents / CENTS_PER_DOLLAR).toLocaleString('en-US')}`;
+}

package/dist/utils/telemetry.js

@@ -0,0 +1,172 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { hostname } from 'node:os';
+import { basename } from 'node:path/posix';
+import { setTimeout } from 'node:timers/promises';
+import { PACKAGE_JSON, POSTHOG_HOST, POSTHOG_PROJECT_KEY, SENTRY_DSN, } from '../config/consts.js';
+import { printNotice } from './diagnostics.js';
+import { isCi } from './environment.js';
+import { ReportedFailureError, UnexpectedError, UnexpectedResponseError, } from './errors.js';
+import { ignoreUserConfigErrors, readUserConfig, writeUserConfig, } from './user-config.js';
+const COMMAND_FINISHED_EVENT = 'cli.command_finished';
+// Matches `at <function> (<file>:<line>:<column>)`, or the same without the function and parentheses.
+const STACK_FRAME_PATTERN = /^\s*at (?:(.+?) \()?(.+?):(\d+):(\d+)\)?$/;
+const TELEMETRY_NOTICE = 'HotCodePush collects anonymous usage and error data to improve the CLI. Set HOTCODEPUSH_TELEMETRY_DISABLED=1 to opt out.';
+// The longest telemetry may delay the exit, requests included.
+const TELEMETRY_TIMEOUT_MS = 1500;
+// Only the release build has keys, so every other build reports nothing.
+export function isTelemetryEnabled() {
+    return ((POSTHOG_PROJECT_KEY !== '' || SENTRY_DSN !== '') &&
+        process.env.HOTCODEPUSH_TELEMETRY_DISABLED !== '1' &&
+        process.env.DO_NOT_TRACK !== '1');
+}
+export function printTelemetryNotice() {
+    if (!isTelemetryEnabled()) {
+        return;
+    }
+    ignoreUserConfigErrors(() => {
+        const userConfig = readUserConfig();
+        if (userConfig.telemetryNoticeShownAt !== undefined) {
+            return;
+        }
+        printNotice(TELEMETRY_NOTICE);
+        writeUserConfig({
+            ...userConfig,
+            telemetryNoticeShownAt: new Date().toISOString(),
+        });
+    });
+}
+// Telemetry must never fail a command or hold up its exit for long.
+export async function reportFinishedCommand(finishedCommand) {
+    if (!isTelemetryEnabled()) {
+        return;
+    }
+    await waitAtMost(Promise.allSettled([
+        sendCommandFinishedEvent(finishedCommand),
+        sendUnexpectedErrorEvent(finishedCommand),
+    ]), TELEMETRY_TIMEOUT_MS);
+}
+// Drops the message above the frames, since it can hold user data.
+export function resolveScrubbedStack(stack) {
+    return stack
+        .split('\n')
+        .filter(line => /^\s*at /.test(line))
+        .map(line => {
+        const [, functionName, filePath, lineNumber, columnNumber] = STACK_FRAME_PATTERN.exec(line) ?? [];
+        if (filePath === undefined) {
+            return line.trim();
+        }
+        const location = `${resolveFramePath(filePath)}:${lineNumber}:${columnNumber}`;
+        return functionName === undefined
+            ? `at ${location}`
+            : `at ${functionName} (${location})`;
+    })
+        .join('\n');
+}
+// A local path never leaves the machine: a package file keeps the part from `node_modules` on, any other only its name.
+function resolveFramePath(filePath) {
+    const normalizedPath = filePath
+        .replace(/^file:\/\//, '')
+        .replaceAll('\\', '/');
+    if (normalizedPath.startsWith('node:')) {
+        return normalizedPath;
+    }
+    const nodeModulesIndex = normalizedPath.lastIndexOf('node_modules/');
+    return nodeModulesIndex === -1
+        ? basename(normalizedPath)
+        : normalizedPath.slice(nodeModulesIndex);
+}
+// The host name is hashed, so it is never sent as it is.
+function resolveMachineId() {
+    return createHash('sha256').update(hostname()).digest('hex');
+}
+// Imported lazily, since the framework modules load native-project parsers that a build without telemetry never needs.
+async function resolveProjectFramework() {
+    try {
+        const [{ detectFramework }, { locateProjectConfigFile }] = await Promise.all([
+            import('./framework.js'),
+            import('./project-config.js'),
+        ]);
+        return detectFramework(locateProjectConfigFile(undefined).directoryPath);
+    }
+    catch {
+        return null;
+    }
+}
+// The event carries only these properties: no argument, no path and no project name.
+async function sendCommandFinishedEvent({ cliError, commandName, durationMs, }) {
+    if (POSTHOG_PROJECT_KEY === '') {
+        return;
+    }
+    await fetch(`${POSTHOG_HOST}/capture/`, {
+        body: JSON.stringify({
+            api_key: POSTHOG_PROJECT_KEY,
+            distinct_id: resolveMachineId(),
+            event: COMMAND_FINISHED_EVENT,
+            properties: {
+                // Keeps the event anonymous: no location from the IP address and no person profile.
+                $geoip_disable: true,
+                $process_person_profile: false,
+                cli_version: PACKAGE_JSON.version,
+                command: commandName,
+                duration_ms: Math.round(durationMs),
+                framework: await resolveProjectFramework(),
+                is_ci: isCi(),
+                outcome: cliError === undefined ? 'succeeded' : 'failed',
+                source: 'cli',
+                ...(commandName === 'init' && {
+                    stopped_step: cliError instanceof ReportedFailureError
+                        ? (cliError.stoppedStep ?? null)
+                        : null,
+                }),
+            },
+            timestamp: new Date().toISOString(),
+        }),
+        headers: { 'Content-Type': 'application/json' },
+        method: 'POST',
+        signal: AbortSignal.timeout(TELEMETRY_TIMEOUT_MS),
+    });
+}
+// Only our own bugs reach Sentry. Every other error comes from user input or an API answer.
+async function sendUnexpectedErrorEvent({ cliError, commandName, }) {
+    if (SENTRY_DSN === '' ||
+        !(cliError instanceof UnexpectedError ||
+            cliError instanceof UnexpectedResponseError)) {
+        return;
+    }
+    const reportedError = cliError.cause instanceof Error ? cliError.cause : cliError;
+    const { host, pathname, username: publicKey } = new URL(SENTRY_DSN);
+    const eventId = randomUUID().replaceAll('-', '');
+    const sentAt = new Date().toISOString();
+    const event = {
+        event_id: eventId,
+        exception: {
+            values: [
+                {
+                    type: reportedError.name,
+                    value: resolveScrubbedStack(reportedError.stack ?? ''),
+                },
+            ],
+        },
+        platform: 'node',
+        release: `${PACKAGE_JSON.name}@${PACKAGE_JSON.version}`,
+        tags: { code: cliError.code, command: commandName },
+        timestamp: sentAt,
+    };
+    await fetch(`https://${host}/api${pathname}/envelope/`, {
+        body: [{ event_id: eventId, sent_at: sentAt }, { type: 'event' }, event]
+            .map(line => JSON.stringify(line))
+            .join('\n'),
+        headers: {
+            'Content-Type': 'application/x-sentry-envelope',
+            'X-Sentry-Auth': `Sentry sentry_version=7, sentry_key=${publicKey}, sentry_client=${PACKAGE_JSON.name}/${PACKAGE_JSON.version}`,
+        },
+        method: 'POST',
+        signal: AbortSignal.timeout(TELEMETRY_TIMEOUT_MS),
+    });
+}
+async function waitAtMost(promise, timeoutMs) {
+    await Promise.race([
+        promise.catch(() => undefined),
+        setTimeout(timeoutMs, undefined, { ref: false }),
+    ]);
+}

package/dist/utils/token-store.js

@@ -0,0 +1,63 @@
+import { Entry } from '@napi-rs/keyring';
+import { KEYRING_ACCOUNT_NAME, KEYRING_SERVICE_NAME, } from '../config/consts.js';
+import { readUserConfig, writeUserConfig } from './user-config.js';
+// Set by the first keyring failure, such as a headless CI without a usable Secret Service.
+// From then on only `config.json` is used, so a read never returns a stale keyring token after a failed write.
+let hasKeyringFailed = false;
+export function deleteToken() {
+    if (!hasKeyringFailed) {
+        try {
+            createKeyringEntry().deletePassword();
+        }
+        catch {
+            hasKeyringFailed = true;
+        }
+    }
+    deleteUserConfigToken();
+}
+export function isEnvironmentToken() {
+    return Boolean(process.env.HOTCODEPUSH_TOKEN);
+}
+export function readToken() {
+    return process.env.HOTCODEPUSH_TOKEN || readStoredToken();
+}
+// Ignores `HOTCODEPUSH_TOKEN`.
+export function readStoredToken() {
+    return readKeyringToken() || readUserConfig().token;
+}
+export function writeToken(token) {
+    if (!hasKeyringFailed) {
+        try {
+            createKeyringEntry().setPassword(token);
+            deleteUserConfigToken();
+            return;
+        }
+        catch {
+            hasKeyringFailed = true;
+        }
+    }
+    writeUserConfig({ ...readUserConfig(), token });
+}
+function createKeyringEntry() {
+    return new Entry(KEYRING_SERVICE_NAME, KEYRING_ACCOUNT_NAME);
+}
+function deleteUserConfigToken() {
+    const userConfig = readUserConfig();
+    if (userConfig.token === undefined) {
+        return;
+    }
+    delete userConfig.token;
+    writeUserConfig(userConfig);
+}
+function readKeyringToken() {
+    if (hasKeyringFailed) {
+        return undefined;
+    }
+    try {
+        return createKeyringEntry().getPassword() ?? undefined;
+    }
+    catch {
+        hasKeyringFailed = true;
+        return undefined;
+    }
+}

package/dist/utils/update-notice.js

@@ -0,0 +1,68 @@
+import { PACKAGE_JSON } from '../config/consts.js';
+import { printNotice } from './diagnostics.js';
+import { isCi } from './environment.js';
+import { ignoreUserConfigErrors, readUserConfig, writeUserConfig, } from './user-config.js';
+const LATEST_VERSION_URL = `https://registry.npmjs.org/${PACKAGE_JSON.name}/latest`;
+const UPDATE_CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000;
+const UPDATE_CHECK_TIMEOUT_MS = 1000;
+// Matches major, minor and patch. A prerelease suffix is not compared.
+const VERSION_CORE_PATTERN = /^\d+\.\d+\.\d+/;
+export function isNewerVersion(candidateVersion, currentVersion) {
+    const candidateCore = VERSION_CORE_PATTERN.exec(candidateVersion)?.[0];
+    const currentCore = VERSION_CORE_PATTERN.exec(currentVersion)?.[0];
+    if (candidateCore === undefined || currentCore === undefined) {
+        return false;
+    }
+    return candidateCore.localeCompare(currentCore, 'en', { numeric: true }) > 0;
+}
+export function printUpdateNotice() {
+    if (!isUpdateNoticeEnabled()) {
+        return;
+    }
+    ignoreUserConfigErrors(() => {
+        const { latestKnownVersion } = readUserConfig();
+        if (latestKnownVersion !== undefined &&
+            isNewerVersion(latestKnownVersion, PACKAGE_JSON.version)) {
+            printNotice(`HotCodePush CLI ${latestKnownVersion} is available. You run ${PACKAGE_JSON.version}.`);
+        }
+    });
+}
+// A failed check also waits a day, so an offline machine is not asked on every command.
+export async function refreshLatestKnownVersion() {
+    if (!isUpdateNoticeEnabled()) {
+        return;
+    }
+    const isCheckedRecently = ignoreUserConfigErrors(() => {
+        const { lastUpdateCheckAt } = readUserConfig();
+        return (lastUpdateCheckAt !== undefined &&
+            Date.now() - Date.parse(lastUpdateCheckAt) < UPDATE_CHECK_INTERVAL_MS);
+    });
+    if (isCheckedRecently !== false) {
+        return;
+    }
+    const latestVersion = await fetchLatestVersion();
+    ignoreUserConfigErrors(() => {
+        // Read again, since the command may have written config.json during the request.
+        writeUserConfig({
+            ...readUserConfig(),
+            lastUpdateCheckAt: new Date().toISOString(),
+            ...(latestVersion !== undefined && { latestKnownVersion: latestVersion }),
+        });
+    });
+}
+async function fetchLatestVersion() {
+    try {
+        const response = await fetch(LATEST_VERSION_URL, {
+            signal: AbortSignal.timeout(UPDATE_CHECK_TIMEOUT_MS),
+        });
+        const { version } = (await response.json());
+        return typeof version === 'string' ? version : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+// Nobody updates from a CI log line.
+function isUpdateNoticeEnabled() {
+    return !isCi() && process.env.HOTCODEPUSH_UPDATE_NOTICE_DISABLED !== '1';
+}