hotcodepush 0.0.1 → 0.2.0

package/dist/utils/upload.js

@@ -0,0 +1,148 @@
+import { openAsBlob } from 'node:fs';
+import { join } from 'node:path';
+import { HotCodePushError } from '@hotcodepush/node';
+import { BUNDLE_BYTES_LIMIT, signManifest } from '@hotcodepush/protocol';
+import { collectBundleFiles } from './bundle-files.js';
+import { compressFiles, withTemporaryDirectory } from './compressed-files.js';
+import { BundleTooLargeError } from './errors.js';
+import { omitNativeGlue } from './frameworks/native-glue.js';
+import { resolveQuantityText } from './output.js';
+import { writePack } from './pack.js';
+import { fetchAllPages } from './pagination.js';
+import { resolveByteText } from './progress.js';
+// The most the bundle files list takes, more than any other list.
+const BUNDLE_FILE_PAGE_LIMIT = 1000;
+export function assertWithinBundleBytesLimit(files) {
+    const largeFile = files.find(file => file.sizeBytes > BUNDLE_BYTES_LIMIT);
+    if (largeFile !== undefined) {
+        throw new BundleTooLargeError(`The file ${largeFile.path}`, BUNDLE_BYTES_LIMIT);
+    }
+    const totalBytes = files.reduce((sum, file) => sum + file.sizeBytes, 0);
+    if (totalBytes > BUNDLE_BYTES_LIMIT) {
+        throw new BundleTooLargeError('The bundle', BUNDLE_BYTES_LIMIT);
+    }
+}
+export async function collectUploadFiles({ directoryPath, nativeGluePaths = [], reporter, }) {
+    const collectedFiles = await collectBundleFiles(directoryPath);
+    const files = omitNativeGlue(collectedFiles, nativeGluePaths);
+    const omittedFileCount = collectedFiles.length - files.length;
+    if (omittedFileCount > 0) {
+        reporter.report(`Left out ${resolveQuantityText(omittedFileCount, 'file')} of the native glue the binary carries: ${nativeGluePaths.join(', ')}.`);
+    }
+    return files;
+}
+export async function uploadBundle(hotCodePush, { appId, bundleVersion, directoryPath, fingerprint, gitProvenance, nativeGluePaths, platforms, reporter, signingPrivateKey, }) {
+    reporter.report(`Hashing the files under ${directoryPath}…`);
+    const files = await collectUploadFiles({
+        directoryPath,
+        nativeGluePaths,
+        reporter,
+    });
+    assertWithinBundleBytesLimit(files);
+    return withTemporaryDirectory(async (temporaryDirectoryPath) => {
+        const compressedFiles = await compressFiles(files, temporaryDirectoryPath);
+        const manifest = buildManifestToSign({
+            appId,
+            bundleVersion,
+            files,
+            fingerprint,
+            platforms,
+        });
+        const signature = signingPrivateKey === null
+            ? null
+            : (await signManifest(manifest, signingPrivateKey)).signature;
+        if (signature !== null) {
+            reporter.report(`Signed the manifest with key ${signature.keyId}.`);
+        }
+        const createdBundle = await hotCodePush.apps.bundles.create({
+            appId,
+            files: manifest.files,
+            fingerprint,
+            platforms: manifest.platforms,
+            signature,
+            version: bundleVersion,
+            ...gitProvenance,
+        });
+        const missingSha256s = await fetchMissingSha256s(hotCodePush, {
+            appId,
+            bundleId: createdBundle.id,
+        });
+        reporter.report(`Uploading ${missingSha256s.length} of ${files.length} files the app lacks…`);
+        const uploadedFiles = await uploadMissingFiles(hotCodePush, appId, missingSha256s, compressedFiles, reporter);
+        const packFilePath = join(temporaryDirectoryPath, 'pack');
+        await writePack([...compressedFiles.values()], packFilePath);
+        reporter.report('Uploading the full pack…');
+        await uploadPack(hotCodePush, { appId, bundleId: createdBundle.id }, packFilePath);
+        const completedBundle = await hotCodePush.apps.bundles.complete({
+            appId,
+            bundleId: createdBundle.id,
+        });
+        return { bundle: completedBundle, upload: uploadedFiles };
+    });
+}
+// The API rebuilds this manifest before it checks the signature, so the order must match.
+// Canonical JSON leaves array order to the writer: files sort by path and platforms by UTF-16 code units.
+export function buildManifestToSign({ appId, bundleVersion, files, fingerprint, platforms, }) {
+    return {
+        appId,
+        bundleVersion,
+        files: files
+            .map(({ path, sha256, sizeBytes }) => ({ path, sha256, sizeBytes }))
+            .sort((left, right) => compareCodeUnits(left.path, right.path)),
+        fingerprint,
+        platforms: [...platforms].sort(compareCodeUnits),
+    };
+}
+export async function uploadMissingFiles(hotCodePush, appId, missingSha256s, compressedFiles, reporter) {
+    let sizeBytes = 0;
+    for (const [index, sha256] of missingSha256s.entries()) {
+        const compressedFile = compressedFiles.get(sha256);
+        if (compressedFile === undefined) {
+            throw new Error(`The app lacks ${sha256}, which is not in the build.`);
+        }
+        reporter.report(`  ${index + 1}/${missingSha256s.length} ${sha256.slice(0, 12)} (${resolveByteText(compressedFile.sizeBytes)})`);
+        await uploadFile(hotCodePush, appId, compressedFile);
+        sizeBytes += compressedFile.sizeBytes;
+    }
+    return { fileCount: missingSha256s.length, sizeBytes };
+}
+export async function uploadPack(hotCodePush, pathParameters, packFilePath) {
+    await hotCodePush.apps.bundles.pack.upload({
+        ...pathParameters,
+        body: await openAsBlob(packFilePath),
+    });
+}
+// `upload_incomplete` names the missing hashes in its details.
+export function resolveMissingSha256s(error) {
+    if (!(error instanceof HotCodePushError) ||
+        error.code !== 'upload_incomplete') {
+        return undefined;
+    }
+    const details = error.details;
+    const missingSha256s = details?.missingSha256s;
+    return Array.isArray(missingSha256s)
+        ? missingSha256s.filter((sha256) => typeof sha256 === 'string')
+        : [];
+}
+function compareCodeUnits(left, right) {
+    if (left === right) {
+        return 0;
+    }
+    return left < right ? -1 : 1;
+}
+// Several paths can share a hash, so each is listed once.
+async function fetchMissingSha256s(hotCodePush, pathParameters) {
+    const missingFiles = await fetchAllPages(page => hotCodePush.apps.bundles.files.list({
+        ...pathParameters,
+        isStored: false,
+        ...page,
+    }), BUNDLE_FILE_PAGE_LIMIT);
+    return [...new Set(missingFiles.map(({ sha256 }) => sha256))];
+}
+async function uploadFile(hotCodePush, appId, { compressedFilePath, sha256 }) {
+    await hotCodePush.apps.files.upload({
+        appId,
+        body: await openAsBlob(compressedFilePath),
+        sha256,
+    });
+}

package/dist/utils/usage-month.js

@@ -0,0 +1,14 @@
+import { z } from 'zod';
+export const monthOptionShape = {
+    month: z
+        .string()
+        .optional()
+        .describe('The month, YYYY-MM. Defaults to the current one.'),
+};
+export function resolveMonthText(month) {
+    return new Date(`${month}-01T00:00:00.000Z`).toLocaleString('en-US', {
+        month: 'long',
+        timeZone: 'UTC',
+        year: 'numeric',
+    });
+}

package/dist/utils/user-config.js

@@ -0,0 +1,54 @@
+import { chmodSync, existsSync, mkdirSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { CONFIG_DIRECTORY_NAME, CONFIG_FILE_NAME, DEFAULT_API_URL, } from '../config/consts.js';
+import { readJsonFile } from './json-file.js';
+// A config.json the CLI cannot read or write is for the command to report, never for a notice.
+export function ignoreUserConfigErrors(readOrWrite) {
+    try {
+        return readOrWrite();
+    }
+    catch {
+        return undefined;
+    }
+}
+// The variable comes first, so a CI reaches the API its `HOTCODEPUSH_TOKEN` belongs to.
+export function readApiUrl() {
+    return (process.env.HOTCODEPUSH_API_BASE_URL ||
+        readUserConfig().apiUrl ||
+        DEFAULT_API_URL).replace(/\/+$/, '');
+}
+export function readUserConfig() {
+    const filePath = resolveConfigFilePath();
+    if (!existsSync(filePath)) {
+        return {};
+    }
+    return readJsonFile(filePath);
+}
+export function resolveConfigDirectoryPath() {
+    const baseDirectoryPath = process.platform === 'win32'
+        ? (process.env.APPDATA ?? join(homedir(), 'AppData', 'Roaming'))
+        : process.env.XDG_CONFIG_HOME || join(homedir(), '.config');
+    return join(baseDirectoryPath, CONFIG_DIRECTORY_NAME);
+}
+// The expiry is the local hint that a session may have ended; the API's answer is the fact.
+export function writeStoredSession({ expiresAt, id }) {
+    writeUserConfig({
+        ...readUserConfig(),
+        sessionExpiresAt: new Date(expiresAt).toISOString(),
+        sessionId: id,
+    });
+}
+export function writeUserConfig(userConfig) {
+    const filePath = resolveConfigFilePath();
+    mkdirSync(resolveConfigDirectoryPath(), { recursive: true });
+    // The file can hold the token, so only its owner may read it.
+    // The mode covers a new file and chmod an existing one.
+    writeFileSync(filePath, `${JSON.stringify(userConfig, null, 2)}\n`, {
+        mode: 0o600,
+    });
+    chmodSync(filePath, 0o600);
+}
+function resolveConfigFilePath() {
+    return join(resolveConfigDirectoryPath(), CONFIG_FILE_NAME);
+}

package/dist/utils/webhook-resolution.js

@@ -0,0 +1,47 @@
+import { z } from 'zod';
+import { isInteractive } from './environment.js';
+import { MissingParameterError } from './errors.js';
+import { fetchAllPages } from './pagination.js';
+import { fetchApps, fetchOrganizationId, fetchResourceId, promptResourceId, } from './resource-resolution.js';
+export const webhookAppOptionShape = {
+    app: z
+        .string()
+        .optional()
+        .describe("The app, by id or name, whose events alone the webhook receives. Defaults to every app's and the organization's events, never to hotcodepush.json's app."),
+};
+export const webhookEventOptionShape = {
+    event: z
+        .array(z.string())
+        .optional()
+        .describe('An event type the webhook receives, such as release.created, repeatable.'),
+};
+export const webhookOptionShape = {
+    webhook: z.string().optional().describe('The webhook, by id or name.'),
+};
+// The name is unique in the organization, so it names a webhook the way a name does an app.
+export async function fetchWebhook(hotCodePush, options) {
+    const organizationId = await fetchOrganizationId(hotCodePush, options);
+    return hotCodePush.organizations.webhooks.get({
+        organizationId,
+        webhookId: await fetchWebhookId(hotCodePush, organizationId, options),
+    });
+}
+export function fetchWebhookAppId(hotCodePush, organizationId, app) {
+    return fetchResourceId('app', app, () => fetchApps(hotCodePush, organizationId));
+}
+// The API checks the types against its catalog and names the one it refuses.
+export function resolveWebhookEventTypes(events) {
+    return events;
+}
+async function fetchWebhookId(hotCodePush, organizationId, options) {
+    if (options.webhook !== undefined) {
+        return fetchResourceId('webhook', options.webhook, () => fetchWebhooks(hotCodePush, organizationId));
+    }
+    if (!isInteractive(options)) {
+        throw new MissingParameterError('--webhook');
+    }
+    return promptResourceId('webhook', await fetchWebhooks(hotCodePush, organizationId), options);
+}
+function fetchWebhooks(hotCodePush, organizationId) {
+    return fetchAllPages(page => hotCodePush.organizations.webhooks.list({ organizationId, ...page }));
+}

package/dist/utils/xcode-project.js

@@ -0,0 +1,181 @@
+import { existsSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { join } from 'node:path';
+import { project as createXcodeProject } from 'xcode';
+import { InvalidParameterError, MissingParameterError, XcodeProjectError, } from './errors.js';
+import { promptSelect } from './prompts.js';
+const APPLICATION_PRODUCT_TYPE = 'com.apple.product-type.application';
+const BINARY_CREATE_PHASE_MARKER = 'binary-create-xcode.sh';
+const BINARY_CREATE_PHASE_NAME = 'Create HotCodePush binary';
+const KEPT_NUMBER_PLACEHOLDER_PATTERN = /hotcodepushKeptNumber(\d+)_/g;
+// Matches a value of digits alone, after `=`, `(` or `,` and before `;`, `,` or a line break.
+const NUMBER_VALUE_PATTERN = /(?<=[=(,]\s*)\d+(?=[;,\n])/g;
+// The `xcode` package's project parses only a file, so its grammar module parses the text.
+const pbxprojParser = createRequire(import.meta.url)('xcode/lib/parser/pbxproj.js');
+// The script reads the version and build from the processed Info.plist.
+// As the phase's input, Xcode processes the plist before the phase runs.
+const INFO_PLIST_INPUT_PATH = '"$(TARGET_BUILD_DIR)/$(INFOPLIST_PATH)"';
+const RESOURCE_FILE_NAME = 'hotcodepush.json';
+// `cap add ios` lays out `App/App.xcodeproj`. Any other layout takes the first project found.
+export function resolveXcodeProjectFilePath(iosProjectPath) {
+    const capacitorProjectPath = join(iosProjectPath, 'App', 'App.xcodeproj');
+    const projectPath = existsSync(capacitorProjectPath)
+        ? capacitorProjectPath
+        : findXcodeProjectPath(iosProjectPath);
+    return projectPath === undefined
+        ? undefined
+        : join(projectPath, 'project.pbxproj');
+}
+// Every SDK names its script file the same, so the file name recognises the phase.
+export function hasBinaryCreatePhase(projectFilePath) {
+    return readFileSync(projectFilePath, 'utf8').includes(BINARY_CREATE_PHASE_MARKER);
+}
+// A pbxproj string carries its line breaks escaped.
+export function buildPbxprojShellScript(lines) {
+    return lines.join('\\n');
+}
+export async function addBinaryCreatePhase(projectFilePath, phase, options) {
+    if (hasBinaryCreatePhase(projectFilePath)) {
+        return 'present';
+    }
+    const editableProject = parseProject(projectFilePath, phase.fix);
+    const { project } = editableProject;
+    const target = await resolveAppTarget(project, options);
+    const nativeTarget = project.pbxNativeTargetSection()[target.key];
+    const buildPhases = typeof nativeTarget === 'object' ? nativeTarget.buildPhases : [];
+    const anchorPhaseIndex = phase.anchorPhaseName === undefined
+        ? undefined
+        : buildPhases.findIndex(({ comment }) => comment === phase.anchorPhaseName);
+    if (anchorPhaseIndex === -1) {
+        throw new XcodeProjectError(`The Xcode project ${projectFilePath} has no "${phase.anchorPhaseName}" phase to run the build step after.`, undefined, projectFilePath, phase.fix);
+    }
+    const { buildPhase } = project.addBuildPhase([], 'PBXShellScriptBuildPhase', BINARY_CREATE_PHASE_NAME, target.key, {
+        inputPaths: [INFO_PLIST_INPUT_PATH],
+        shellPath: '/bin/sh',
+        shellScript: phase.shellScript,
+    });
+    // The phase writes hotcodepush.json with the build time on every build.
+    // Xcode warns about a phase without outputs that is not marked so.
+    buildPhase.alwaysOutOfDate = 1;
+    if (anchorPhaseIndex !== undefined) {
+        // The package appends the phase, but it must run right after the phase whose output it reads.
+        const binaryCreatePhase = buildPhases.pop();
+        if (binaryCreatePhase !== undefined) {
+            buildPhases.splice(anchorPhaseIndex + 1, 0, binaryCreatePhase);
+        }
+    }
+    writeProject(projectFilePath, editableProject);
+    return 'added';
+}
+// An earlier `init` added this reference to Capacitor's app target.
+// A project that cannot be parsed counts as without it, and the phase's edit reports the parse error.
+export function hasReadableResourceReference(projectFilePath) {
+    try {
+        return (findResourceReferenceKeys(parseProject(projectFilePath).project).length >
+            0);
+    }
+    catch {
+        return false;
+    }
+}
+// The build step now writes the file into the app, and a reference to a missing file fails the build.
+export function removeResourceReference(projectFilePath) {
+    const editableProject = parseProject(projectFilePath);
+    const { project } = editableProject;
+    const { objects } = project.hash.project;
+    const fileReferenceKeys = findResourceReferenceKeys(project);
+    const buildFileKeys = Object.entries(objects.PBXBuildFile)
+        .filter(([, buildFile]) => typeof buildFile === 'object' &&
+        fileReferenceKeys.includes(String(buildFile.fileRef)))
+        .map(([key]) => key);
+    deleteObjects(objects.PBXFileReference, fileReferenceKeys);
+    deleteObjects(objects.PBXBuildFile, buildFileKeys);
+    removeChildren(objects.PBXResourcesBuildPhase ?? {}, 'files', buildFileKeys);
+    removeChildren(objects.PBXGroup, 'children', fileReferenceKeys);
+    writeProject(projectFilePath, editableProject);
+}
+async function resolveAppTarget(project, options) {
+    const appTargets = resolveAppTargets(project);
+    if (options.xcodeTarget !== undefined) {
+        const namedTarget = appTargets.find(({ name }) => name === options.xcodeTarget);
+        if (namedTarget === undefined) {
+            throw new InvalidParameterError(`No app target is named ${options.xcodeTarget}. The targets are ${appTargets.map(({ name }) => name).join(', ')}.`, 'Pass one of them with --xcode-target.');
+        }
+        return namedTarget;
+    }
+    const [onlyTarget] = appTargets;
+    if (onlyTarget !== undefined && appTargets.length === 1) {
+        return onlyTarget;
+    }
+    const targetKey = await promptSelect('--xcode-target', 'Which app target?', appTargets.map(({ key, name }) => ({ label: name, value: key })), options);
+    const selectedTarget = appTargets.find(({ key }) => key === targetKey);
+    if (selectedTarget === undefined) {
+        throw new MissingParameterError('--xcode-target');
+    }
+    return selectedTarget;
+}
+function deleteObjects(section, keys) {
+    for (const key of keys) {
+        delete section[key];
+        delete section[`${key}_comment`];
+    }
+}
+function findResourceReferenceKeys(project) {
+    return Object.entries(project.pbxFileReferenceSection())
+        .filter(([, fileReference]) => typeof fileReference === 'object' &&
+        String(fileReference.path).replaceAll('"', '') === RESOURCE_FILE_NAME)
+        .map(([key]) => key);
+}
+function removeChildren(section, field, keys) {
+    for (const sectionObject of Object.values(section)) {
+        const entries = typeof sectionObject === 'object' ? sectionObject[field] : undefined;
+        if (typeof sectionObject === 'object' && Array.isArray(entries)) {
+            sectionObject[field] = entries.filter(({ value }) => !keys.includes(value));
+        }
+    }
+}
+function findXcodeProjectPath(iosProjectPath) {
+    if (!existsSync(iosProjectPath)) {
+        return undefined;
+    }
+    for (const directoryPath of [iosProjectPath, join(iosProjectPath, 'App')]) {
+        const projectName = existsSync(directoryPath)
+            ? readdirSync(directoryPath).find(name => name.endsWith('.xcodeproj'))
+            : undefined;
+        if (projectName !== undefined) {
+            return join(directoryPath, projectName);
+        }
+    }
+    return undefined;
+}
+// The `xcode` package reads digits as a JavaScript number, so `0920` would come back as `920` and long values lose digits.
+// Such values pass through as text placeholders, and `writeProject` puts them back.
+function parseProject(projectFilePath, fix) {
+    try {
+        const keptNumbers = [];
+        const text = readFileSync(projectFilePath, 'utf8').replace(NUMBER_VALUE_PATTERN, number => {
+            if (String(Number.parseInt(number, 10)) === number) {
+                return number;
+            }
+            keptNumbers.push(number);
+            return `hotcodepushKeptNumber${keptNumbers.length - 1}_`;
+        });
+        const project = createXcodeProject(projectFilePath);
+        project.hash = pbxprojParser.parse(text);
+        return { keptNumbers, project };
+    }
+    catch (error) {
+        throw new XcodeProjectError(`The Xcode project ${projectFilePath} could not be parsed.`, error, projectFilePath, fix);
+    }
+}
+function writeProject(projectFilePath, { keptNumbers, project }) {
+    writeFileSync(projectFilePath, project
+        .writeSync()
+        .replace(KEPT_NUMBER_PLACEHOLDER_PATTERN, (placeholder, index) => keptNumbers[Number(index)] ?? placeholder));
+}
+function resolveAppTargets(project) {
+    return Object.entries(project.pbxNativeTargetSection())
+        .filter((entry) => typeof entry[1] === 'object' &&
+        entry[1].productType.replaceAll('"', '') === APPLICATION_PRODUCT_TYPE)
+        .map(([key, target]) => ({ key, name: target.name.replaceAll('"', '') }));
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "hotcodepush",
   "description": "The HotCodePush CLI: set up, release and manage over-the-air (OTA) updates from the terminal and CI",
-  "version": "0.0.1",
+  "version": "0.2.0",
   "private": false,
   "license": "MIT",
   "homepage": "https://hotcodepush.com",
@@ -33,25 +33,26 @@
     "dist"
   ],
   "telemetry": {
-    "posthogProjectKey": "",
-    "sentryDsn": ""
+    "posthogProjectKey": "phc_AdeADMfxpV9qp8ZxanDNjoXFhnFMr7JDiB3pXyjJ9WRs",
+    "sentryDsn": "https://8e8933170cb380e4079e70cd2b987668@o4507446340747264.ingest.de.sentry.io/4512356211556432"
   },
   "scripts": {
-    "build": "tsc --project tsconfig.build.json && node scripts/generate-completion.mjs",
+    "build": "rimraf ./dist && tsc --project tsconfig.build.json && node scripts/generate-completion.mjs",
     "fmt": "prettier --write .",
     "lint": "eslint .",
+    "prepublishOnly": "npm run build",
     "test": "vitest run",
     "typecheck": "tsc --noEmit --project tsconfig.json"
   },
   "dependencies": {
     "@clack/prompts": "1.8.1",
-    "@hotcodepush/node": "https://pkg.pr.new/hotcodepush-team/hotcodepush-node/@hotcodepush/node@cebeadc",
-    "@hotcodepush/protocol": "https://pkg.pr.new/hotcodepush-team/protocol/@hotcodepush/protocol@313a015",
+    "@hotcodepush/node": "https://pkg.pr.new/hotcodepush-team/hotcodepush-node/@hotcodepush/node@9e671df",
+    "@hotcodepush/protocol": "https://pkg.pr.new/hotcodepush-team/protocol/@hotcodepush/protocol@5b27c65",
     "@napi-rs/keyring": "2.1.0",
-    "better-auth": "1.7.6",
+    "better-auth": "1.7.12",
     "fast-xml-parser": "5.11.2",
     "open": "11.0.4",
-    "xcode": "3.0.1",
+    "xcode": "4.0.0",
     "zod": "4.6.7",
     "zodline": "0.3.1"
   },
@@ -64,8 +65,9 @@
     "eslint-plugin-import-x": "4.17.1",
     "pkg-pr-new": "0.0.88",
     "prettier": "3.9.8",
+    "rimraf": "6.1.3",
     "typescript": "5.9.3",
     "typescript-eslint": "8.70.0",
-    "vitest": "5.0.1"
+    "vitest": "5.0.5"
   }
 }