hotcodepush 0.0.1 → 0.2.0

package/dist/commands/signing-key/create.js

@@ -0,0 +1,84 @@
+import { existsSync, rmSync, statSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { generateSigningKeyPair } from '@hotcodepush/protocol';
+import { z } from 'zod';
+import { PROJECT_CONFIG_FILE_NAME, SIGNING_PRIVATE_KEY_FILE_NAME, } from '../../config/consts.js';
+import { createApiClient } from '../../utils/api-client.js';
+import { defineCommand } from '../../utils/command.js';
+import { InvalidParameterError } from '../../utils/errors.js';
+import { defineCommandOptions } from '../../utils/global-options.js';
+import { printJson } from '../../utils/output.js';
+import { locateProjectConfig, writeProjectConfig, } from '../../utils/project-config.js';
+import { fetchAppId } from '../../utils/resource-resolution.js';
+import { writeSigningPrivateKeyFile } from '../../utils/signing-private-key.js';
+export const UPLOAD_SIGNING_TEXT = "Uploads sign with it through --private-key-path. In CI, set HOTCODEPUSH_SIGNING_KEY to the file's content.";
+export default defineCommand({
+    description: 'Generate a key pair and add its public key to the app, the private key written to a new file on this machine: from then on the app releases only signed bundles.',
+    examples: [
+        'hotcodepush signing-key create',
+        'hotcodepush signing-key create --app "My App" --private-key-path my-app-private-key.pem --json',
+    ],
+    options: defineCommandOptions({
+        privateKeyPath: z
+            .string()
+            .optional()
+            .describe(`The file to write the private key to, which must not exist; ${SIGNING_PRIVATE_KEY_FILE_NAME} in the current directory by default.`),
+    }),
+    action: async (options) => {
+        const privateKeyPath = resolve(options.privateKeyPath ?? SIGNING_PRIVATE_KEY_FILE_NAME);
+        assertNewFilePath(privateKeyPath);
+        const hotCodePush = createApiClient();
+        const projectConfigLocation = locateProjectConfig(options.config);
+        const appId = await fetchAppId(hotCodePush, options, projectConfigLocation.projectConfig);
+        const { privateKey, publicKey } = await generateSigningKeyPair();
+        // Written before the public key is registered, since a registered key without its private key could sign nothing.
+        writeSigningPrivateKeyFile(privateKeyPath, privateKey);
+        const createdSigningKey = await hotCodePush.apps.signingKeys
+            .create({ appId, publicKey })
+            .catch((error) => {
+            // Removed when the registration fails, since the app would refuse what it signs.
+            rmSync(privateKeyPath);
+            throw error;
+        });
+        const isConfigured = addPublicKeyToProjectConfig(projectConfigLocation, appId, publicKey);
+        if (options.json) {
+            printJson({ ...createdSigningKey, privateKeyPath });
+            return;
+        }
+        console.log(`Created signing key ${createdSigningKey.keyId} (${createdSigningKey.id}).`);
+        console.log(resolvePublicKeyListingText(isConfigured, publicKey));
+        console.log(`Wrote the private key to ${privateKeyPath}.`);
+        console.log("Keep the file out of version control: whoever holds it can sign the app's bundles.");
+        console.log(UPLOAD_SIGNING_TEXT);
+    },
+});
+// Keys already listed stay, so the next builds keep trusting them.
+// A file of another app, or no file, is left alone.
+export function addPublicKeyToProjectConfig({ filePath, projectConfig }, appId, publicKey) {
+    if (filePath === undefined || projectConfig?.appId !== appId) {
+        return false;
+    }
+    if (projectConfig.publicKeys?.includes(publicKey)) {
+        return true;
+    }
+    writeProjectConfig(filePath, {
+        ...projectConfig,
+        publicKeys: [...(projectConfig.publicKeys ?? []), publicKey],
+    });
+    return true;
+}
+// An existing file may hold a key that a store build trusts, and no folder is made on the person's behalf.
+function assertNewFilePath(filePath) {
+    if (existsSync(filePath)) {
+        throw new InvalidParameterError(`The file ${filePath} from --private-key-path already exists.`, 'Pass a path where no file is, since signing-key create never overwrites a private key.');
+    }
+    const directoryPath = dirname(filePath);
+    if (!statSync(directoryPath, { throwIfNoEntry: false })?.isDirectory()) {
+        throw new InvalidParameterError(`The folder ${directoryPath} from --private-key-path does not exist.`, 'Create the folder first, or pass a path in an existing one.');
+    }
+}
+export function resolvePublicKeyListingText(isConfigured, publicKey) {
+    return isConfigured
+        ? `Added to publicKeys in ${PROJECT_CONFIG_FILE_NAME}.`
+        : `Add it to publicKeys in the app's ${PROJECT_CONFIG_FILE_NAME}: ${publicKey}`;
+}

package/dist/commands/signing-key/delete.js

@@ -0,0 +1,67 @@
+import { z } from 'zod';
+import { createApiClient } from '../../utils/api-client.js';
+import { defineCommand } from '../../utils/command.js';
+import { InvalidParameterError } from '../../utils/errors.js';
+import { defineCommandOptions } from '../../utils/global-options.js';
+import { printJson } from '../../utils/output.js';
+import { locateProjectConfig, writeProjectConfig, } from '../../utils/project-config.js';
+import { confirmConsequence, promptSelect } from '../../utils/prompts.js';
+import { fetchAppId, fetchSigningKeys, } from '../../utils/resource-resolution.js';
+export default defineCommand({
+    description: 'Unregister a signing key after the store release that stopped trusting it.',
+    examples: [
+        'hotcodepush signing-key delete --signing-key sha256:9f2c4e1ab07d',
+        'hotcodepush signing-key delete --signing-key 3b1f8e7a-5c2d-4f6b-9a0e-7d4c1b2a3f5e --yes --json',
+    ],
+    options: defineCommandOptions({
+        signingKey: z
+            .string()
+            .optional()
+            .describe('The signing key, by id or key id.'),
+    }),
+    action: async (options) => {
+        const hotCodePush = createApiClient();
+        const projectConfigLocation = locateProjectConfig(options.config);
+        const appId = await fetchAppId(hotCodePush, options, projectConfigLocation.projectConfig);
+        const signingKeys = await fetchSigningKeys(hotCodePush, appId);
+        const signingKey = resolveSigningKey(signingKeys, options.signingKey ??
+            (await promptSelect('--signing-key', 'Which signing key?', signingKeys.map(({ id, keyId }) => ({
+                label: keyId,
+                value: id,
+            })), options)));
+        const isConfirmed = await confirmConsequence(`unregisters signing key ${signingKey.keyId}: an upload signed with it is refused from then on`, options);
+        if (!isConfirmed) {
+            return;
+        }
+        await hotCodePush.apps.signingKeys.delete({
+            appId,
+            signingKeyId: signingKey.id,
+        });
+        removePublicKeyFromProjectConfig(projectConfigLocation, appId, signingKey.publicKey);
+        if (options.json) {
+            printJson({ id: signingKey.id, name: signingKey.keyId });
+        }
+        else {
+            console.log(`Deleted signing key ${signingKey.keyId} (${signingKey.id}).`);
+        }
+    },
+});
+// Removing the key from `publicKeys` makes the file and the app agree again.
+function removePublicKeyFromProjectConfig({ filePath, projectConfig }, appId, publicKey) {
+    if (filePath === undefined ||
+        projectConfig?.appId !== appId ||
+        !projectConfig.publicKeys?.includes(publicKey)) {
+        return;
+    }
+    writeProjectConfig(filePath, {
+        ...projectConfig,
+        publicKeys: projectConfig.publicKeys.filter(listedPublicKey => listedPublicKey !== publicKey),
+    });
+}
+function resolveSigningKey(signingKeys, reference) {
+    const signingKey = signingKeys.find(({ id, keyId }) => id === reference || keyId === reference);
+    if (signingKey === undefined) {
+        throw new InvalidParameterError(`The app has no signing key ${reference} from --signing-key.`, 'Run "hotcodepush signing-key list" for the ids and key ids.');
+    }
+    return signingKey;
+}

package/dist/commands/signing-key/list.js

@@ -0,0 +1,38 @@
+import { createApiClient } from '../../utils/api-client.js';
+import { defineCommand } from '../../utils/command.js';
+import { defineCommandOptions } from '../../utils/global-options.js';
+import { printJson, printTable, resolveDate } from '../../utils/output.js';
+import { paginationShape, resolveNextOffset } from '../../utils/pagination.js';
+import { readProjectConfig } from '../../utils/project-config.js';
+import { fetchAppId } from '../../utils/resource-resolution.js';
+export default defineCommand({
+    description: "List the app's signing keys, newest first, with the key id a signature names.",
+    examples: [
+        'hotcodepush signing-key list',
+        'hotcodepush signing-key list --app "My App" --json',
+    ],
+    options: defineCommandOptions(paginationShape),
+    action: async (options) => {
+        const hotCodePush = createApiClient();
+        const listedSigningKeys = await hotCodePush.apps.signingKeys.list({
+            appId: await fetchAppId(hotCodePush, options, readProjectConfig(options.config)),
+            limit: options.limit,
+            offset: options.offset,
+        });
+        const nextOffset = resolveNextOffset(listedSigningKeys.length, options);
+        if (options.json) {
+            printJson({ nextOffset, signingKeys: listedSigningKeys });
+            return;
+        }
+        printTable({
+            emptyText: 'No signing keys. Run signing-key create to enable code signing.',
+            headers: ['ID', 'KEY ID', 'CREATED'],
+            nextOffset,
+            rows: listedSigningKeys.map(({ createdAt, id, keyId }) => [
+                id,
+                keyId,
+                resolveDate(createdAt),
+            ]),
+        });
+    },
+});

package/dist/commands/sso-provider/delete.js

@@ -0,0 +1,32 @@
+import { createApiClient } from '../../utils/api-client.js';
+import { defineCommand } from '../../utils/command.js';
+import { defineCommandOptions } from '../../utils/global-options.js';
+import { printJson } from '../../utils/output.js';
+import { confirmConsequence } from '../../utils/prompts.js';
+import { fetchOrganizationId } from '../../utils/resource-resolution.js';
+export default defineCommand({
+    description: "Delete the organization's SSO provider: password sign-in works again for its members, and the domain is forgotten.",
+    examples: [
+        'hotcodepush sso-provider delete',
+        'hotcodepush sso-provider delete --organization Acme --yes --json',
+    ],
+    options: defineCommandOptions({}),
+    action: async (options) => {
+        const hotCodePush = createApiClient();
+        const organizationId = await fetchOrganizationId(hotCodePush, options);
+        const fetchedProvider = await hotCodePush.organizations.ssoProvider.get({
+            organizationId,
+        });
+        const isConfirmed = await confirmConsequence(`deletes the SSO provider for ${fetchedProvider.domain}: password sign-in works again for its members and the domain is forgotten`, options);
+        if (!isConfirmed) {
+            return;
+        }
+        await hotCodePush.organizations.ssoProvider.delete({ organizationId });
+        if (options.json) {
+            printJson({ id: fetchedProvider.id, name: fetchedProvider.domain });
+        }
+        else {
+            console.log(`Deleted the SSO provider for ${fetchedProvider.domain} (${fetchedProvider.id}).`);
+        }
+    },
+});

package/dist/commands/sso-provider/get.js

@@ -0,0 +1,63 @@
+import { createApiClient } from '../../utils/api-client.js';
+import { defineCommand } from '../../utils/command.js';
+import { defineCommandOptions } from '../../utils/global-options.js';
+import { resolveConsoleBaseUrl } from '../../utils/hosts.js';
+import { printDetails, printJson } from '../../utils/output.js';
+import { fetchOrganizationId } from '../../utils/resource-resolution.js';
+import { readApiUrl } from '../../utils/user-config.js';
+export default defineCommand({
+    description: "Print the organization's SSO provider with its sign-in link and, until the domain is verified, the TXT record to set.",
+    examples: [
+        'hotcodepush sso-provider get',
+        'hotcodepush sso-provider get --organization Acme --json',
+    ],
+    options: defineCommandOptions({}),
+    action: async (options) => {
+        const hotCodePush = createApiClient();
+        const fetchedProvider = await hotCodePush.organizations.ssoProvider.get({
+            organizationId: await fetchOrganizationId(hotCodePush, options),
+        });
+        if (options.json) {
+            printJson(fetchedProvider);
+            return;
+        }
+        printProviderDetails(fetchedProvider);
+    },
+});
+export function printProviderDetails(provider) {
+    const apiUrl = readApiUrl();
+    printDetails([
+        ['ID', provider.id],
+        ['Type', provider.type],
+        ['Domain', provider.domain],
+        ['Verified', provider.domainVerified ? 'yes' : 'no'],
+        [
+            'Sign-in URL',
+            `${resolveConsoleBaseUrl(apiUrl)}/login?sso=${provider.providerId}`,
+        ],
+        ...resolveServiceProviderDetails(provider, apiUrl),
+        ...resolveVerificationDetails(provider),
+    ]);
+}
+// The identity provider calls these URLs on the API origin.
+function resolveServiceProviderDetails({ providerId, type }, apiUrl) {
+    const ssoUrl = `${apiUrl}/v1/auth/sso`;
+    return type === 'oidc'
+        ? [['Redirect URI', `${ssoUrl}/callback/${providerId}`]]
+        : [
+            ['ACS URL', `${ssoUrl}/saml2/sp/acs/${providerId}`],
+            [
+                'SP metadata URL',
+                `${ssoUrl}/saml2/sp/metadata?providerId=${providerId}`,
+            ],
+        ];
+}
+// The record name is the provider name under the domain.
+function resolveVerificationDetails({ domain, domainVerificationToken, domainVerified, providerId, }) {
+    return domainVerified || domainVerificationToken === null
+        ? []
+        : [
+            ['TXT name', `_hotcodepush-sso-${providerId}.${domain}`],
+            ['TXT value', domainVerificationToken],
+        ];
+}

package/dist/commands/sso-provider/set.js

@@ -0,0 +1,161 @@
+import { readFileSync } from 'node:fs';
+import { z } from 'zod';
+import { createApiClient } from '../../utils/api-client.js';
+import { defineCommand } from '../../utils/command.js';
+import { InvalidParameterError } from '../../utils/errors.js';
+import { defineCommandOptions } from '../../utils/global-options.js';
+import { printJson } from '../../utils/output.js';
+import { promptSecret, promptSelect, promptText } from '../../utils/prompts.js';
+import { fetchOrganizationId } from '../../utils/resource-resolution.js';
+import { printProviderDetails } from './get.js';
+// A missing protocol names the first flag of each protocol.
+const PROVIDER_TYPE_FLAG = '--oidc-issuer or --saml-entry-point';
+export default defineCommand({
+    description: "Set the organization's OIDC or SAML provider and its email domain, replacing the one before. A new domain starts unverified.",
+    examples: [
+        'hotcodepush sso-provider set --domain example.com --oidc-issuer https://login.example.com --oidc-client-id hotcodepush --oidc-client-secret "$OIDC_CLIENT_SECRET"',
+        'hotcodepush sso-provider set --domain example.com --saml-entry-point https://idp.example.com/sso --saml-issuer https://idp.example.com --saml-metadata-path idp-metadata.xml --json',
+    ],
+    options: defineCommandOptions({
+        domain: z
+            .string()
+            .optional()
+            .describe('The email domain whose addresses sign in through the provider, such as example.com.'),
+        oidcClientId: z
+            .string()
+            .optional()
+            .describe('OIDC: the client ID the identity provider issued.'),
+        oidcClientSecret: z
+            .string()
+            .optional()
+            .describe('OIDC: the client secret the identity provider issued.'),
+        oidcDiscoveryEndpoint: z
+            .string()
+            .optional()
+            .describe("OIDC: the discovery document's URL, the issuer's /.well-known/openid-configuration by default."),
+        oidcIssuer: z
+            .string()
+            .optional()
+            .describe("OIDC: the identity provider's issuer URL."),
+        oidcScopes: z
+            .string()
+            .transform(value => value.split(',').map(scope => scope.trim()))
+            .optional()
+            .describe('OIDC: the scopes to request, comma-separated.'),
+        samlCertPath: z
+            .string()
+            .optional()
+            .describe("SAML: the identity provider's signing certificate file, sent with --saml-entity-id when no metadata is."),
+        samlEntityId: z
+            .string()
+            .optional()
+            .describe("SAML: the identity provider's entity ID."),
+        samlEntryPoint: z
+            .string()
+            .optional()
+            .describe("SAML: the identity provider's sign-in URL."),
+        samlIssuer: z
+            .string()
+            .optional()
+            .describe("SAML: the identity provider's issuer."),
+        samlMetadataPath: z
+            .string()
+            .optional()
+            .describe("SAML: the identity provider's metadata XML file."),
+    }),
+    action: async (options) => {
+        const flaggedProviderType = resolveFlaggedProviderType(options);
+        const hotCodePush = createApiClient();
+        const organizationId = await fetchOrganizationId(hotCodePush, options);
+        const domain = options.domain ??
+            (await promptText('--domain', 'Which email domain signs in through the provider?', options));
+        const providerType = flaggedProviderType ??
+            (await promptSelect(PROVIDER_TYPE_FLAG, 'Which protocol does the identity provider speak?', [
+                { label: 'OIDC', value: 'oidc' },
+                { label: 'SAML', value: 'saml' },
+            ], options));
+        const updatedProvider = await hotCodePush.organizations.ssoProvider.set({
+            domain,
+            organizationId,
+            ...(providerType === 'oidc'
+                ? { oidc: await promptOidcBlock(options) }
+                : { saml: await promptSamlBlock(options) }),
+        });
+        if (options.json) {
+            printJson(updatedProvider);
+            return;
+        }
+        console.log(`Set the ${providerType} provider for ${updatedProvider.domain}.`);
+        printProviderDetails(updatedProvider);
+    },
+});
+async function promptOidcBlock(options) {
+    const issuer = options.oidcIssuer ??
+        (await promptText('--oidc-issuer', "What is the identity provider's issuer URL?", options));
+    const clientId = options.oidcClientId ??
+        (await promptText('--oidc-client-id', 'What is the client ID?', options));
+    const clientSecret = options.oidcClientSecret ??
+        (await promptSecret('--oidc-client-secret', 'What is the client secret?', options));
+    return {
+        clientId,
+        clientSecret,
+        discoveryEndpoint: options.oidcDiscoveryEndpoint,
+        issuer,
+        scopes: options.oidcScopes,
+    };
+}
+// The metadata and the certificate are sent as text and never parsed, since the API reads them.
+async function promptSamlBlock(options) {
+    const entryPoint = options.samlEntryPoint ??
+        (await promptText('--saml-entry-point', "What is the identity provider's sign-in URL?", options));
+    const issuer = options.samlIssuer ??
+        (await promptText('--saml-issuer', "What is the identity provider's issuer?", options));
+    const hasCertificateOrEntityId = options.samlCertPath !== undefined || options.samlEntityId !== undefined;
+    const metadataPath = options.samlMetadataPath ??
+        (hasCertificateOrEntityId
+            ? undefined
+            : await promptText('--saml-metadata-path', "Which file holds the identity provider's SAML metadata?", options));
+    return {
+        cert: options.samlCertPath === undefined
+            ? undefined
+            : readDocumentFile('--saml-cert-path', options.samlCertPath),
+        entityId: options.samlEntityId,
+        entryPoint,
+        issuer,
+        metadata: metadataPath === undefined
+            ? undefined
+            : readDocumentFile('--saml-metadata-path', metadataPath),
+    };
+}
+function readDocumentFile(flag, filePath) {
+    try {
+        return readFileSync(filePath, 'utf8');
+    }
+    catch (error) {
+        throw new InvalidParameterError(`The file ${filePath} from ${flag} cannot be read.`, 'Pass the path of a file you can read.', error);
+    }
+}
+// A provider speaks one protocol, so flags of both are refused.
+function resolveFlaggedProviderType(options) {
+    const hasOidcFlag = [
+        options.oidcClientId,
+        options.oidcClientSecret,
+        options.oidcDiscoveryEndpoint,
+        options.oidcIssuer,
+        options.oidcScopes,
+    ].some(value => value !== undefined);
+    const hasSamlFlag = [
+        options.samlCertPath,
+        options.samlEntityId,
+        options.samlEntryPoint,
+        options.samlIssuer,
+        options.samlMetadataPath,
+    ].some(value => value !== undefined);
+    if (hasOidcFlag && hasSamlFlag) {
+        throw new InvalidParameterError('The --oidc- and --saml- flags were passed together.', 'Pass the --oidc- flags for an OIDC provider or the --saml- flags for a SAML one, since a provider speaks one protocol.');
+    }
+    if (hasOidcFlag) {
+        return 'oidc';
+    }
+    return hasSamlFlag ? 'saml' : undefined;
+}

package/dist/commands/sso-provider/verify.js

@@ -0,0 +1,31 @@
+import { createApiClient } from '../../utils/api-client.js';
+import { defineCommand } from '../../utils/command.js';
+import { defineCommandOptions } from '../../utils/global-options.js';
+import { printJson } from '../../utils/output.js';
+import { fetchOrganizationId } from '../../utils/resource-resolution.js';
+import { printProviderDetails } from './get.js';
+export default defineCommand({
+    description: "Look up the domain's TXT record and mark the domain verified when it is there.",
+    examples: [
+        'hotcodepush sso-provider verify',
+        'hotcodepush sso-provider verify --organization Acme --json',
+    ],
+    options: defineCommandOptions({}),
+    action: async (options) => {
+        const hotCodePush = createApiClient();
+        const checkedProvider = await hotCodePush.organizations.ssoProvider.verifications.create({
+            organizationId: await fetchOrganizationId(hotCodePush, options),
+        });
+        if (options.json) {
+            printJson(checkedProvider);
+            return;
+        }
+        console.log(resolveVerificationText(checkedProvider));
+        printProviderDetails(checkedProvider);
+    },
+});
+function resolveVerificationText({ domain, domainVerified, }) {
+    return domainVerified
+        ? `Verified ${domain}.`
+        : `No TXT record verifies ${domain} yet. A new record can take a while to appear.`;
+}

package/dist/commands/statistics/get.js

@@ -0,0 +1,189 @@
+import { z } from 'zod';
+import { createApiClient } from '../../utils/api-client.js';
+import { defineCommand } from '../../utils/command.js';
+import { InvalidParameterError } from '../../utils/errors.js';
+import { defineCommandOptions } from '../../utils/global-options.js';
+import { printDetails, printJson, printTable } from '../../utils/output.js';
+import { resolveByteText } from '../../utils/progress.js';
+import { readProjectConfig } from '../../utils/project-config.js';
+import { promptSelect } from '../../utils/prompts.js';
+import { fetchAppId, fetchChannels, fetchResourceId, } from '../../utils/resource-resolution.js';
+const STATISTICS_TYPES = ['fleet', 'updates', 'usage'];
+// Buckets of these dimensions hold only a value and its devices. Release and binary buckets carry more.
+const FLEET_DIMENSIONS = [
+    ['BINARY VERSION', 'binaryVersion'],
+    ['SDK VERSION', 'sdkVersion'],
+    ['PLATFORM', 'platform'],
+    ['OS VERSION', 'osVersion'],
+    ['COUNTRY', 'country'],
+];
+export default defineCommand({
+    description: "Print one of the app's statistics: the fleet of devices seen in 30 days, the updates per day, or the usage the bill counts.",
+    examples: [
+        'hotcodepush statistics get --type fleet --channel production',
+        'hotcodepush statistics get --type updates --period-since 2026-09-01 --period-until 2026-09-30 --json',
+    ],
+    options: defineCommandOptions({
+        channel: z
+            .string()
+            .optional()
+            .describe('The channel, by id or name, to narrow the fleet or the updates to. Defaults to the whole app.'),
+        periodSince: z
+            .string()
+            .optional()
+            .describe('The first UTC day of the updates or the usage, YYYY-MM-DD, inclusive; 30 days before --period-until by default.'),
+        periodUntil: z
+            .string()
+            .optional()
+            .describe('The last UTC day of the updates or the usage, YYYY-MM-DD, inclusive. Defaults to today.'),
+        type: z
+            .enum(STATISTICS_TYPES)
+            .optional()
+            .describe('The statistics to print. fleet is the devices seen in 30 days, updates is the updates per day, and usage is the monthly active devices and the traffic.'),
+    }),
+    action: async (options) => {
+        const hotCodePush = createApiClient();
+        const type = options.type ??
+            (await promptSelect('--type', 'Which statistics?', STATISTICS_TYPES.map(value => ({ label: value, value })), options));
+        assertFlagsOfType(type, options);
+        const appId = await fetchAppId(hotCodePush, options, readProjectConfig(options.config));
+        const query = {
+            appId,
+            channelId: options.channel === undefined
+                ? undefined
+                : await fetchResourceId('channel', options.channel, () => fetchChannels(hotCodePush, appId)),
+            periodSince: options.periodSince,
+            periodUntil: options.periodUntil,
+        };
+        switch (type) {
+            case 'fleet':
+                return printFleetStatistics(await hotCodePush.apps.statistics.fleet.get({
+                    appId,
+                    channelId: query.channelId,
+                }), options.json);
+            case 'updates':
+                return printUpdateStatistics(await hotCodePush.apps.statistics.updates.get(query), options.json);
+            case 'usage':
+                return printUsageStatistics(await hotCodePush.apps.statistics.usage.get({
+                    appId,
+                    periodSince: query.periodSince,
+                    periodUntil: query.periodUntil,
+                }), options.json);
+        }
+    },
+});
+// The fleet is a snapshot without a time axis, and the usage is the whole bill.
+// So each refuses the flag it has no field for.
+function assertFlagsOfType(type, options) {
+    if (type === 'fleet' &&
+        (options.periodSince !== undefined || options.periodUntil !== undefined)) {
+        throw new InvalidParameterError('The fleet is a snapshot of the last 30 days without a period, so --period-since and --period-until do not apply.');
+    }
+    if (type === 'usage' && options.channel !== undefined) {
+        throw new InvalidParameterError('The usage counts the whole app, never one channel, so --channel does not apply.');
+    }
+}
+function printFleetStatistics(statistics, isJson) {
+    if (isJson) {
+        printJson(statistics);
+        return;
+    }
+    printDetails([
+        ['Active devices', String(statistics.deviceCount)],
+        ['Current devices', String(statistics.currentDeviceCount)],
+    ]);
+    printFleetTable(['RELEASE', 'DEVICES'], statistics.release.map(({ deviceCount, number }) => [
+        number === null ? 'embedded' : `#${number}`,
+        String(deviceCount),
+    ]));
+    printFleetTable(['BINARY', 'VERSION', 'PLATFORM', 'DEVICES'], statistics.binary.map(({ deviceCount, platform, value, version }) => [
+        value ?? 'none',
+        version ?? 'none',
+        platform ?? 'none',
+        String(deviceCount),
+    ]));
+    for (const [header, dimension] of FLEET_DIMENSIONS) {
+        printFleetTable([header, 'DEVICES'], statistics[dimension].map(({ deviceCount, value }) => [
+            value ?? 'none',
+            String(deviceCount),
+        ]));
+    }
+}
+function printFleetTable(headers, rows) {
+    printTable({
+        emptyText: `${headers[0]}: no device seen in the last 30 days.`,
+        headers,
+        nextOffset: null,
+        rows,
+    });
+}
+function printUpdateStatistics(statistics, isJson) {
+    if (isJson) {
+        printJson(statistics);
+        return;
+    }
+    printTable({
+        emptyText: 'No days in the period.',
+        headers: ['DAY', 'CONFIRMED', 'FAILED', 'ROLLED BACK'],
+        nextOffset: null,
+        rows: statistics.days.map(({ confirmedUpdateCount, day, failedUpdateCount, rolledBackUpdateCount, }) => [
+            day,
+            String(confirmedUpdateCount),
+            String(failedUpdateCount),
+            String(rolledBackUpdateCount),
+        ]),
+    });
+    printTable({
+        emptyText: 'No release went live recently.',
+        headers: ['RELEASE', 'LIVE', 'CONFIRMED', '50% AT', '90% AT'],
+        nextOffset: null,
+        rows: statistics.releases.map(({ adoption, liveAt, number, timeToAdoption }) => [
+            `#${number}`,
+            liveAt,
+            String(adoption.at(-1)?.confirmedUpdateCount ?? 0),
+            timeToAdoption.percent50At ?? 'not yet',
+            timeToAdoption.percent90At ?? 'not yet',
+        ]),
+    });
+    for (const [header, reasons] of [
+        ['FAILURE REASON', statistics.failureReasons],
+        ['SKIP REASON', statistics.skippedReasons],
+    ]) {
+        printTable({
+            emptyText: `${header}: none in the period.`,
+            headers: [header, 'EVENTS'],
+            nextOffset: null,
+            rows: reasons.map(({ eventCount, reason }) => [
+                reason,
+                String(eventCount),
+            ]),
+        });
+    }
+}
+function printUsageStatistics(statistics, isJson) {
+    if (isJson) {
+        printJson(statistics);
+        return;
+    }
+    printTable({
+        emptyText: 'No months in the period.',
+        headers: ['MONTH', 'MAU', 'DATA TRANSFER'],
+        nextOffset: null,
+        rows: statistics.months.map(({ dataTransferBytes, month, monthlyActiveDeviceCount }) => [
+            month.slice(0, 7),
+            String(monthlyActiveDeviceCount),
+            resolveByteText(dataTransferBytes),
+        ]),
+    });
+    printTable({
+        emptyText: 'No days in the period.',
+        headers: ['DAY', 'CHECKS', 'DATA TRANSFER', 'DEVICE DOWNLOADS'],
+        nextOffset: null,
+        rows: statistics.days.map(({ checkCount, dataTransferBytes, day, deviceDownloadBytes }) => [
+            day,
+            String(checkCount),
+            resolveByteText(dataTransferBytes),
+            resolveByteText(deviceDownloadBytes),
+        ]),
+    });
+}