Packaging

Hosanna Tools resolves config and builds the shared application for Web, Roku, Apple, and Android targets. The final store artifact is still owned by the target platform: Roku signing, Xcode archives, Gradle release bundles, and static web hosting each have different credentials and release checks.

There is no universal set of package:dev or release:final scripts. Use the scripts in the application’s package.json and keep them thin wrappers around documented HST and platform commands.

Build Before Packaging

Resolve the intended environment and build target explicitly:

npx hst build web prod browser --non-interactive
npx hst build roku prod device \
  --hsc-project platforms/hsconfig-roku.prod.json \
  --non-interactive
npx hst build apple-tv prod device \
  --bundled \
  --non-interactive
npx hst build android-tv prod device \
  --bundled \
  --non-interactive

Use --dry-run --explain first when a profile, app flavor, or CI environment can alter the resolved plan.

Platform Boundary

Target	HST/shared output	Final packaging owner
Web	Generated source, resolved runtime config, and Vite/static assets	The app’s web build and hosting pipeline
Roku	BrightScript, SceneGraph XML, manifest, assets, and source maps	hst roku:package plus Roku signing/certification
iOS / Apple TV	Bundled JavaScript/assets and app-owned native project	Xcode archive/export and App Store tooling
Android / Android TV	Bundled JavaScript/assets and app-owned Gradle project	Gradle/Android Studio and Play tooling
Samsung TV	Web output when the app owns a Samsung target	The app’s Samsung/Tizen project and packaging tools

Samsung TV is not a first-class hst build platform in the current command surface. A Samsung deliverable is an app-owned packaging step over a compatible web build, not a hidden Hosanna target.

Roku Example

The current hosanna-ui-samples-public repository exposes:

npm run roku:build:prod
npm run roku:bundle
npm run roku:package

roku:bundle creates the project’s distributable source bundle. hst roku:package can package and sign through a developer-enabled Roku using environment variables such as:

• ROKU_IP
• ROKU_DEVPASSWORD
• ROKU_DEV_ID
• ROKU_DEV_PASSWORD
• ROKU_PKG_NAME or ROKU_PKG_KEY_BASE64

Keep all passwords and signing material in an ignored secret store or protected CI variables. Never add default passwords, private IPs, or package keys to documentation or tracked config.

Build Config and Secrets

Tracked behavior belongs under build-config/; confidential overlays belong under ignored secrets/.

npx hst build-config:resolve \
  --env prod \
  --platform roku \
  --out assets/meta/build-config.json \
  --manifest-out build/build-config-sources.json \
  --explain

In CI, restore ignored overlays from protected base64 variables before resolving:

npx hst build-config:restore-secrets --env prod --quiet

The restore command does not print secret values. Still restrict logs and artifact paths: the resolved runtime config can contain values that should not be published independently.

Release Checks

Before signing or uploading an artifact:

1. Confirm the SDK, compiler, lockfile, app profile, environment, and Git revision.
2. Generate source and fail if tracked generated output is stale.
3. Resolve production config without developer profiles or test credentials.
4. Build once and archive that exact output; do not rebuild between QA and release.
5. Inspect package contents for source maps, mock data, debug flags, unused assets, and secrets.
6. Run platform smoke, launch, deep-link, networking, playback, and recovery checks.
7. Record checksums and platform version/build numbers with the release.