ubriot 1.1.1 → 1.4.0

package/README.md

@@ -28,8 +28,29 @@ ubriot update        # publish an OTA update
 | `ubriot update` | Export and publish an OTA update |
 | `ubriot push setup --app <name>` | Set up native push notifications |
 | `ubriot apps list` | List your release apps |
+| `ubriot apps activity <app>` | Show who changed what on an app, newest first |
 | `ubriot builds list --app <name>` | List recent builds |
 | `ubriot builds watch <buildId>` | Watch a build live: streaming logs + status until it finishes |
+| `ubriot signing init --app <name>` | Generate an OTA signing key outside the repo and register its certificate (`--mode chain` for an offline root) |
+| `ubriot signing configure --app <name>` | Embed the signing certificate in app.json (expo-updates or ubriot-updates-rn) |
+| `ubriot signing status --app <name>` | Keys, expiry, devices per key, rejected update checks |
+| `ubriot signing import` | Register an existing certificate, for example from EAS Update |
+| `ubriot signing issue-leaf` / `rotate` / `retire` / `revoke` / `require` | Rotate, retire or revoke keys, and refuse unsigned publishes |
+| `ubriot signing verify-binary <app.ipa>` | List the signing certificates an IPA, APK or AAB trusts |
+| `ubriot signing managed create\|rotate\|audit` | Ubriot-managed signing keys (paid plans) |
+| `ubriot updates resign --app <name>` | Sign live update groups again with the current key |
+
+OTA updates are signed automatically when a key is available: `--private-key-path` and
+`--certificate-path`, the `UBRIOT_OTA_PRIVATE_KEY` environment variable in CI, or the key
+paths saved by `ubriot signing init` in `.ubriot/signing.json` (paths only, never key
+contents). Use `--sign-with <keyid>` more than once to sign with two keys during a
+rotation. Guide: https://docs.ubriot.dev/ota-code-signing
+
+Before queueing a build, `ubriot ship` and `ubriot builds create` read the project's Expo
+SDK (or React Native version) and warn when no build worker has the toolchain it needs,
+for example Expo SDK 58 without Xcode 26.4 or newer. `ubriot update` warns when your own
+Node.js is too old for the SDK's export step. Pass `--yes` to skip the question. Guide:
+https://docs.ubriot.dev/expo-sdk-58
 
 ## Documentation
 

package/dist/api.js

@@ -40,28 +40,42 @@ function makeClient() {
         const original = error.config;
         const status = error.response?.status;
         const isAuthCall = typeof original?.url === "string" && original.url.includes("/auth/");
-        if (status !== 401 || !original || original._retry || isAuthCall) {
+        if (status !== 401 || !original || isAuthCall) {
             return Promise.reject(error);
         }
+        const newToken = original._retry ? null : await refreshAccessToken();
+        if (!newToken)
+            exitAuthenticationFailed(error);
         original._retry = true;
-        const newToken = await refreshAccessToken();
-        if (!newToken) {
-            console.error("Session expired. Run: ubriot login");
-            process.exit(1);
-        }
         original.headers = original.headers ?? {};
         original.headers.Authorization = `Bearer ${newToken}`;
         return client(original);
     });
     return client;
 }
+function serverMessage(err) {
+    return err.response?.data?.message ?? err.message;
+}
+function exitAuthenticationFailed(err) {
+    const message = String(serverMessage(err)).replace(/\.+$/, "");
+    const nextStep = /does not accept API keys/.test(message)
+        ? ""
+        : (0, config_1.envToken)()
+            ? ` Check UBRIOT_TOKEN, or create a new API key at ${config_1.API_KEYS_URL}.`
+            : " Run: ubriot login, or set UBRIOT_TOKEN.";
+    console.error(`Authentication failed: ${message}.${nextStep}`);
+    process.exit(2);
+}
 function handleError(err) {
-    if (axios_1.default.isAxiosError(err)) {
-        const msg = err.response?.data?.message ?? err.message;
-        console.error(`Error: ${msg}`);
+    if (axios_1.default.isAxiosError(err) && !err.response) {
+        const apiBase = err.config?.baseURL ?? normalizeApiBase((0, config_1.readConfig)().apiBase);
+        console.error(`Error: could not reach the Ubriot API at ${apiBase} (${err.code ?? err.message}). Check your connection, or point the CLI at another API with UBRIOT_API_BASE or ubriot login --api-base <url>.`);
+    }
+    else if (axios_1.default.isAxiosError(err)) {
+        console.error(`Error: ${serverMessage(err)}`);
     }
     else {
-        console.error("Error:", err);
+        console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
     }
     process.exit(1);
 }

package/dist/app-config-signing.js

@@ -0,0 +1,67 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CODE_SIGNING_PLUGIN = exports.UPDATES_RN_PLUGIN = void 0;
+exports.hasUpdatesRnPlugin = hasUpdatesRnPlugin;
+exports.applyExpoSigningConfig = applyExpoSigningConfig;
+exports.applyBareSigningConfig = applyBareSigningConfig;
+exports.UPDATES_RN_PLUGIN = "ubriot-updates-rn";
+exports.CODE_SIGNING_PLUGIN = "ubriot-updates-rn/code-signing";
+function pluginName(entry) {
+    return Array.isArray(entry) ? entry[0] : entry;
+}
+function withPluginOptions(plugins, name, options) {
+    const index = plugins.findIndex((entry) => pluginName(entry) === name);
+    const next = options ? [name, options] : name;
+    if (index === -1)
+        return [...plugins, next];
+    const copy = [...plugins];
+    copy[index] = next;
+    return copy;
+}
+function withoutPlugin(plugins, name) {
+    return plugins.filter((entry) => pluginName(entry) !== name);
+}
+function expoRoot(appJson) {
+    const root = appJson && typeof appJson === "object" ? { ...appJson } : {};
+    const expo = root.expo && typeof root.expo === "object" ? { ...root.expo } : {};
+    return { root, expo };
+}
+function hasUpdatesRnPlugin(appJson) {
+    const plugins = Array.isArray(appJson?.expo?.plugins) ? appJson.expo.plugins : [];
+    return plugins.some((entry) => pluginName(entry) === exports.UPDATES_RN_PLUGIN);
+}
+function applyExpoSigningConfig(appJson, input) {
+    const { root, expo } = expoRoot(appJson);
+    const updates = expo.updates && typeof expo.updates === "object" ? { ...expo.updates } : {};
+    delete updates.codeSigningAllowUnsignedManifests;
+    updates.codeSigningCertificate = input.certificatePath;
+    updates.codeSigningMetadata = { keyid: input.keyid, alg: "rsa-v1_5-sha256" };
+    expo.updates = updates;
+    const plugins = Array.isArray(expo.plugins) ? expo.plugins : [];
+    expo.plugins =
+        input.mode === "chain"
+            ? withPluginOptions(plugins, exports.CODE_SIGNING_PLUGIN, { includeManifestResponseCertificateChain: true })
+            : withoutPlugin(plugins, exports.CODE_SIGNING_PLUGIN);
+    if (expo.plugins.length === 0)
+        delete expo.plugins;
+    root.expo = expo;
+    return root;
+}
+function applyBareSigningConfig(appJson, input) {
+    const { root, expo } = expoRoot(appJson);
+    const plugins = Array.isArray(expo.plugins) ? expo.plugins : [];
+    const existing = plugins.find((entry) => pluginName(entry) === exports.UPDATES_RN_PLUGIN);
+    const current = Array.isArray(existing) && existing[1] && typeof existing[1] === "object" ? { ...existing[1] } : {};
+    delete current.codeSigningAllowUnsignedManifests;
+    const options = {
+        ...current,
+        codeSigningCertificate: input.certificatePath,
+        codeSigningMetadata: { keyid: input.keyid, alg: "rsa-v1_5-sha256" },
+        codeSigningIncludeManifestResponseCertificateChain: input.mode === "chain",
+    };
+    if (input.additionalCertificates?.length)
+        options.additionalTrustedCertificates = input.additionalCertificates;
+    expo.plugins = withPluginOptions(plugins, exports.UPDATES_RN_PLUGIN, options);
+    root.expo = expo;
+    return root;
+}

package/dist/binary-certificate.js

@@ -0,0 +1,93 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findCertificatesInBuffer = findCertificatesInBuffer;
+exports.extractEmbeddedCertificates = extractEmbeddedCertificates;
+exports.matchAnchors = matchAnchors;
+const child_process_1 = require("child_process");
+const crypto_1 = require("crypto");
+const fs_1 = require("fs");
+const os_1 = require("os");
+const path_1 = require("path");
+const MAX_FILE_BYTES = 32 * 1024 * 1024;
+const MAX_EXTRACTED_BYTES = 4 * 1024 * 1024 * 1024;
+const MAX_FILES = 20000;
+const PEM = /-----BEGIN CERTIFICATE-----(?:[A-Za-z0-9+/=\s]|\\n|\\r)+?-----END CERTIFICATE-----/g;
+function swapBytes(buffer) {
+    const even = buffer.length - (buffer.length % 2);
+    const copy = Buffer.from(buffer.subarray(0, even));
+    copy.swap16();
+    return copy;
+}
+function findCertificatesInBuffer(buffer) {
+    const texts = [buffer.toString("utf8"), buffer.toString("utf16le"), swapBytes(buffer).toString("utf16le")];
+    const out = [];
+    for (const text of texts) {
+        for (const match of text.match(PEM) ?? [])
+            out.push(match.replace(/\\r/g, "").replace(/\\n/g, "\n"));
+    }
+    return out;
+}
+function walk(dir, files = []) {
+    for (const entry of (0, fs_1.readdirSync)(dir, { withFileTypes: true })) {
+        const full = (0, path_1.join)(dir, entry.name);
+        if (entry.isDirectory())
+            walk(full, files);
+        else if (entry.isFile())
+            files.push(full);
+        if (files.length > MAX_FILES)
+            throw new Error("Archive has too many files to scan");
+    }
+    return files;
+}
+function declaredSize(archivePath) {
+    const listing = (0, child_process_1.spawnSync)("unzip", ["-l", archivePath], { encoding: "utf8", maxBuffer: 64 * 1024 * 1024 });
+    if (listing.error || listing.status !== 0)
+        throw new Error(`Could not unpack ${archivePath}. Pass an .ipa, .apk or .aab file.`);
+    const lines = listing.stdout.trim().split("\n");
+    const total = Number(lines[lines.length - 1]?.trim().split(/\s+/)[0]);
+    if (!Number.isFinite(total))
+        throw new Error(`Could not read the contents of ${archivePath}`);
+    return total;
+}
+function extractEmbeddedCertificates(archivePath, options = {}) {
+    const limit = options.maxExtractedBytes ?? MAX_EXTRACTED_BYTES;
+    if (declaredSize(archivePath) > limit)
+        throw new Error(`${archivePath} unpacks to more than ${Math.round(limit / 1024 / 1024)} MB. Refusing to scan it.`);
+    const dir = (0, fs_1.mkdtempSync)((0, path_1.join)((0, os_1.tmpdir)(), "ubriot-verify-binary-"));
+    try {
+        const result = (0, child_process_1.spawnSync)("unzip", ["-qq", "-o", archivePath, "-d", dir], { encoding: "utf8" });
+        if (result.error || (result.status !== 0 && result.status !== 1)) {
+            throw new Error(`Could not unpack ${archivePath}. Pass an .ipa, .apk or .aab file.`);
+        }
+        const found = new Map();
+        for (const file of walk(dir)) {
+            if ((0, fs_1.statSync)(file).size > MAX_FILE_BYTES)
+                continue;
+            for (const pem of findCertificatesInBuffer((0, fs_1.readFileSync)(file))) {
+                let certificate;
+                try {
+                    certificate = new crypto_1.X509Certificate(pem);
+                }
+                catch {
+                    continue;
+                }
+                const fingerprintSha256 = certificate.fingerprint256.replace(/:/g, "").toLowerCase();
+                const entry = found.get(fingerprintSha256) ?? { fingerprintSha256, subject: certificate.subject, notAfter: certificate.validTo, foundIn: [] };
+                const where = (0, path_1.relative)(dir, file);
+                if (!entry.foundIn.includes(where))
+                    entry.foundIn.push(where);
+                found.set(fingerprintSha256, entry);
+            }
+        }
+        return [...found.values()];
+    }
+    finally {
+        (0, fs_1.rmSync)(dir, { recursive: true, force: true });
+    }
+}
+function matchAnchors(embedded, anchors) {
+    return embedded.map((certificate) => ({
+        ...certificate,
+        matches: anchors.filter((anchor) => anchor.fingerprintSha256 === certificate.fingerprintSha256).map((anchor) => anchor.label),
+    }));
+}

package/dist/build-identity.js

@@ -0,0 +1,72 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildIdentityEnv = buildIdentityEnv;
+exports.describeBuildIdentity = describeBuildIdentity;
+exports.assertConfigMatchesApp = assertConfigMatchesApp;
+exports.assertUpdateMatchesApp = assertUpdateMatchesApp;
+exports.hasDynamicExpoConfig = hasDynamicExpoConfig;
+exports.resolveExpoConfig = resolveExpoConfig;
+const child_process_1 = require("child_process");
+const child_env_1 = require("./child-env");
+const fs_1 = require("fs");
+const path_1 = require("path");
+const DYNAMIC_EXPO_CONFIG_FILES = ["app.config.js", "app.config.ts", "app.config.cjs", "app.config.mjs"];
+function buildIdentityEnv(app) {
+    const identity = {
+        UBRIOT_APP_SLUG: app.slug,
+        UBRIOT_IOS_BUNDLE_ID: app.iosBundleIdentifier,
+        UBRIOT_ANDROID_APPLICATION_ID: app.androidApplicationId,
+    };
+    const env = {};
+    for (const [key, value] of Object.entries(identity)) {
+        if (value?.trim())
+            env[key] = value.trim();
+    }
+    return env;
+}
+function describeBuildIdentity(env) {
+    return Object.entries(env).map(([key, value]) => `${key}=${value}`).join(" ") || "none";
+}
+function assertConfigMatchesApp(config, app) {
+    const checks = [
+        ["ios.bundleIdentifier", config?.ios?.bundleIdentifier, app.iosBundleIdentifier],
+        ["android.package", config?.android?.package, app.androidApplicationId],
+    ];
+    for (const [field, local, expected] of checks) {
+        if (local && expected?.trim() && local !== expected.trim()) {
+            throw new Error(`App config ${field} is ${local}, but Ubriot app ${app.slug ?? ""} is ${expected.trim()}. Refusing to publish an update built for another app.`);
+        }
+    }
+}
+function assertUpdateMatchesApp(config, app, runtimeVersion) {
+    assertConfigMatchesApp(config, app);
+    const configuredSlug = config?.extra?.ubriot?.pushAppSlug;
+    if (typeof configuredSlug === "string" && configuredSlug.trim() && configuredSlug !== app.slug) {
+        throw new Error(`App config extra.ubriot.pushAppSlug is ${configuredSlug}, but Ubriot app is ${app.slug ?? "unknown"}. Refusing to publish an update built for another app.`);
+    }
+    const configuredRuntime = config?.runtimeVersion;
+    if (typeof configuredRuntime === "string" && configuredRuntime.trim() && configuredRuntime !== runtimeVersion) {
+        throw new Error(`App config runtimeVersion is ${configuredRuntime}, but the update targets ${runtimeVersion}. Refusing to publish a bundle with a different runtime.`);
+    }
+}
+function hasDynamicExpoConfig(projectDir) {
+    return DYNAMIC_EXPO_CONFIG_FILES.some((file) => (0, fs_1.existsSync)((0, path_1.join)(projectDir, file)));
+}
+function resolveExpoConfig(projectDir, identityEnv, spawn = child_process_1.spawnSync) {
+    const result = spawn("npx", ["expo", "config", "--json", "--type", "public"], {
+        cwd: projectDir,
+        env: (0, child_env_1.childProcessEnv)(identityEnv),
+        encoding: "utf8",
+        maxBuffer: 32 * 1024 * 1024,
+    });
+    if (result.error)
+        throw result.error;
+    if (result.status !== 0)
+        throw new Error(`npx expo config failed with exit code ${result.status ?? "unknown"}: ${result.stderr.trim()}`);
+    try {
+        return JSON.parse(result.stdout);
+    }
+    catch {
+        throw new Error(`npx expo config did not return JSON: ${result.stdout.slice(0, 200)}`);
+    }
+}

package/dist/build-preflight.js

@@ -0,0 +1,99 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectProjectRuntime = detectProjectRuntime;
+exports.localNodeProblem = localNodeProblem;
+exports.fetchBuildPreflight = fetchBuildPreflight;
+exports.renderBuildPreflight = renderBuildPreflight;
+exports.buildPreflightDecision = buildPreflightDecision;
+const fs_1 = require("fs");
+const path_1 = require("path");
+const SDK58_NODE_LINES = [
+    { major: 22, minimum: [22, 13] },
+    { major: 24, minimum: [24, 3] },
+];
+const SDK58_EVEN_MAJORS_FROM = 26;
+function versionParts(version) {
+    const match = version.trim().replace(/^v/i, "").match(/^\d+(\.\d+)*/);
+    return match ? match[0].split(".").map(Number) : [];
+}
+function cleanVersion(value) {
+    if (typeof value !== "string")
+        return null;
+    return value.match(/(\d+\.\d+(\.\d+)?)/)?.[1] ?? value.match(/(\d+)/)?.[1] ?? null;
+}
+function readJson(path) {
+    try {
+        return JSON.parse((0, fs_1.readFileSync)(path, "utf8"));
+    }
+    catch {
+        return null;
+    }
+}
+function detectProjectRuntime(projectDir) {
+    const pkg = readJson((0, path_1.join)(projectDir, "package.json"));
+    const deps = { ...(pkg?.devDependencies ?? {}), ...(pkg?.dependencies ?? {}) };
+    const installed = (name) => cleanVersion(readJson((0, path_1.join)(projectDir, "node_modules", name, "package.json"))?.version);
+    const expo = installed("expo") ?? cleanVersion(deps.expo);
+    const reactNative = installed("react-native") ?? cleanVersion(deps["react-native"]);
+    return { expoSdk: expo ? versionParts(expo)[0] ?? null : null, reactNative };
+}
+function sdk58Reason(runtime) {
+    if (runtime.expoSdk !== null)
+        return runtime.expoSdk >= 58 ? `Expo SDK ${runtime.expoSdk}` : null;
+    if (!runtime.reactNative)
+        return null;
+    const [major, minor] = versionParts(runtime.reactNative);
+    return major === 0 && minor >= 88 ? `React Native 0.${minor}` : null;
+}
+function nodeSupported(version) {
+    const [major, minor = 0] = versionParts(version);
+    if (major === undefined)
+        return false;
+    const line = SDK58_NODE_LINES.find((l) => l.major === major);
+    if (line)
+        return minor >= line.minimum[1];
+    return major >= SDK58_EVEN_MAJORS_FROM && major % 2 === 0;
+}
+function localNodeProblem(runtime, nodeVersion) {
+    const reason = sdk58Reason(runtime);
+    if (!reason || nodeSupported(nodeVersion))
+        return null;
+    return `${reason} tooling needs Node.js 22.13 or newer on the 22 line (24.3+ or an even release from 26 also work), but this terminal runs Node.js ${nodeVersion}. Install it with nvm install 22, then run this command again.`;
+}
+async function fetchBuildPreflight(client, input) {
+    try {
+        const params = { platform: input.platform };
+        if (input.runtime.expoSdk !== null)
+            params.expoSdk = String(input.runtime.expoSdk);
+        if (input.runtime.reactNative)
+            params.reactNative = input.runtime.reactNative;
+        const { data } = await client.get(`/ubriot/apps/${encodeURIComponent(input.app)}/builds/preflight`, { params, timeout: 20000 });
+        if (!data || !Array.isArray(data.warnings) || !data.runtime)
+            return null;
+        return data;
+    }
+    catch {
+        return null;
+    }
+}
+function describeRuntime(runtime) {
+    if (runtime.expoSdk !== null)
+        return `Expo SDK ${runtime.expoSdk}${runtime.reactNative ? ` (React Native ${runtime.reactNative})` : ""}`;
+    return runtime.reactNative ? `React Native ${runtime.reactNative}` : null;
+}
+function renderBuildPreflight(result) {
+    const lines = [];
+    const detected = describeRuntime(result.runtime);
+    if (detected) {
+        const from = result.detectedFrom?.source === "last-build" && result.detectedFrom.buildId ? ` from build #${result.detectedFrom.buildId}` : "";
+        lines.push(`Detected ${detected}${from}.`);
+    }
+    for (const w of result.warnings)
+        lines.push(`${w.level === "warn" ? "Warning" : "Note"}: ${w.message}`);
+    return lines;
+}
+function buildPreflightDecision(result, opts) {
+    if (!result || opts.yes || !opts.interactive)
+        return "continue";
+    return result.warnings.some((w) => w.level === "warn") ? "prompt" : "continue";
+}

package/dist/child-env.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PRIVATE_KEY_ENV = void 0;
+exports.childProcessEnv = childProcessEnv;
+exports.PRIVATE_KEY_ENV = "UBRIOT_OTA_PRIVATE_KEY";
+function childProcessEnv(extra = {}, base = process.env) {
+    const env = { ...base, ...extra };
+    delete env[exports.PRIVATE_KEY_ENV];
+    return env;
+}

package/dist/config.js

@@ -1,5 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.API_KEYS_URL = void 0;
+exports.envToken = envToken;
+exports.readSavedConfig = readSavedConfig;
 exports.readConfig = readConfig;
 exports.writeConfig = writeConfig;
 exports.requireAuth = requireAuth;
@@ -14,30 +17,37 @@ const defaults = {
     refreshToken: null,
     email: null,
 };
-function readConfig() {
-    const applyEnv = (cfg) => ({
-        ...cfg,
-        apiBase: process.env.UBRIOT_API_BASE?.trim() || cfg.apiBase,
-    });
+exports.API_KEYS_URL = "https://ubriot.dev/dashboard/api-keys";
+function envToken() {
+    return process.env.UBRIOT_TOKEN?.trim() || null;
+}
+function readSavedConfig() {
     if (!(0, fs_1.existsSync)(CONFIG_FILE))
-        return applyEnv({ ...defaults });
+        return { ...defaults };
     try {
-        return applyEnv({ ...defaults, ...JSON.parse((0, fs_1.readFileSync)(CONFIG_FILE, "utf8")) });
+        return { ...defaults, ...JSON.parse((0, fs_1.readFileSync)(CONFIG_FILE, "utf8")) };
     }
     catch {
-        return applyEnv({ ...defaults });
+        return { ...defaults };
     }
 }
+function readConfig() {
+    const saved = readSavedConfig();
+    const cfg = { ...saved, apiBase: process.env.UBRIOT_API_BASE?.trim() || saved.apiBase };
+    const token = envToken();
+    return token ? { ...cfg, token, refreshToken: null, email: null } : cfg;
+}
 function writeConfig(updates) {
-    (0, fs_1.mkdirSync)(CONFIG_DIR, { recursive: true });
-    const current = readConfig();
-    (0, fs_1.writeFileSync)(CONFIG_FILE, JSON.stringify({ ...current, ...updates }, null, 2), "utf8");
+    (0, fs_1.mkdirSync)(CONFIG_DIR, { recursive: true, mode: 0o700 });
+    const current = readSavedConfig();
+    (0, fs_1.writeFileSync)(CONFIG_FILE, JSON.stringify({ ...current, ...updates }, null, 2), { encoding: "utf8", mode: 0o600 });
+    (0, fs_1.chmodSync)(CONFIG_FILE, 0o600);
 }
 function requireAuth() {
     const cfg = readConfig();
     if (!cfg.token) {
-        console.error(`Not logged in. Run: ubriot login --api-base ${cfg.apiBase}`);
-        process.exit(1);
+        console.error(`Not logged in. Run: ubriot login --api-base ${cfg.apiBase}, or set UBRIOT_TOKEN to an API key from ${exports.API_KEYS_URL}.`);
+        process.exit(2);
     }
     return cfg;
 }