@absolutejs/deploy 0.21.1 → 0.22.0

package/dist/nativeRelease.js

@@ -0,0 +1,343 @@
+// @bun
+var __create = Object.create;
+var __getProtoOf = Object.getPrototypeOf;
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+function __accessProp(key) {
+  return this[key];
+}
+var __toESMCache_node;
+var __toESMCache_esm;
+var __toESM = (mod, isNodeMode, target) => {
+  var canCache = mod != null && typeof mod === "object";
+  if (canCache) {
+    var cache = isNodeMode ? __toESMCache_node ??= new WeakMap : __toESMCache_esm ??= new WeakMap;
+    var cached = cache.get(mod);
+    if (cached)
+      return cached;
+  }
+  target = mod != null ? __create(__getProtoOf(mod)) : {};
+  const to = isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target;
+  for (let key of __getOwnPropNames(mod))
+    if (!__hasOwnProp.call(to, key))
+      __defProp(to, key, {
+        get: __accessProp.bind(mod, key),
+        enumerable: true
+      });
+  if (canCache)
+    cache.set(mod, to);
+  return to;
+};
+var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
+var __require = import.meta.require;
+
+// src/nativeRelease.ts
+import { createHash } from "crypto";
+import { readFile, stat } from "fs/promises";
+import path from "path";
+var DEFAULT_PREFIX = "absolutejs/native-releases";
+var DEFAULT_MAX_ARTIFACT_BYTES = 2147483648;
+var NATIVE_RELEASE_REGISTRY_FORMAT = 1;
+var SHA256_PATTERN = /^[a-f0-9]{64}$/;
+var APP_ID_PATTERN = /^[A-Za-z][\w]*(?:\.[A-Za-z][\w]*)+$/;
+var CHANNEL_PATTERN = /^[a-z0-9][a-z0-9._-]{0,63}$/;
+
+class NativeReleaseRegistryError extends Error {
+}
+var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var requireString = (value, field) => {
+  if (typeof value !== "string" || value.length === 0)
+    throw new NativeReleaseRegistryError(`Native release ${field} is invalid`);
+  return value;
+};
+var parseMetadata = (value) => {
+  if (!isRecord(value))
+    throw new NativeReleaseRegistryError("Native release metadata is invalid");
+  const appId = requireString(value.appId, "appId");
+  const sha256 = requireString(value.sha256, "sha256");
+  const releaseId = requireString(value.releaseId, "releaseId");
+  if (!APP_ID_PATTERN.test(appId))
+    throw new NativeReleaseRegistryError("Native release appId is invalid");
+  if (!SHA256_PATTERN.test(sha256))
+    throw new NativeReleaseRegistryError("Native release sha256 is invalid");
+  if (releaseId !== `amobile_android_${sha256}`)
+    throw new NativeReleaseRegistryError("Native release id does not match its artifact digest");
+  if (value.artifact !== "app-release.aab" || value.engine !== "capacitor" || value.format !== 1 || value.platform !== "android" || value.type !== "aab" || typeof value.signed !== "boolean" || !Number.isSafeInteger(value.bytes) || Number(value.bytes) < 1)
+    throw new NativeReleaseRegistryError("Native release metadata is invalid");
+  return {
+    appBuild: requireString(value.appBuild, "appBuild"),
+    appId,
+    artifact: "app-release.aab",
+    bytes: Number(value.bytes),
+    engine: "capacitor",
+    format: 1,
+    platform: "android",
+    releaseId,
+    runtime: requireString(value.runtime, "runtime"),
+    sha256,
+    signed: value.signed,
+    type: "aab"
+  };
+};
+var normalizedPrefix = (value) => {
+  const prefix = value.replace(/^\/+|\/+$/g, "");
+  if (prefix.length === 0 || prefix.split("/").some((segment) => segment === "." || segment === ".."))
+    throw new NativeReleaseRegistryError("Native release prefix is invalid");
+  return prefix;
+};
+var requireChannel = (value) => {
+  if (!CHANNEL_PATTERN.test(value))
+    throw new NativeReleaseRegistryError("Native release channel is invalid");
+  return value;
+};
+var appIdentity = (appId) => createHash("sha256").update(appId).digest("hex");
+var sha256Bytes = (bytes) => createHash("sha256").update(bytes).digest("hex");
+var isIsoTimestamp = (value) => {
+  if (typeof value !== "string" || Number.isNaN(Date.parse(value)))
+    return false;
+  return new Date(value).toISOString() === value;
+};
+var sha256File = async (file) => {
+  const hasher = new Bun.CryptoHasher("sha256");
+  for await (const chunk of file.stream())
+    hasher.update(chunk);
+  return hasher.digest("hex");
+};
+var encodedJson = (value) => new TextEncoder().encode(`${JSON.stringify(value, null, 2)}
+`);
+var decodedJson = (bytes) => JSON.parse(new TextDecoder().decode(bytes));
+var sameMetadata = (left, right) => JSON.stringify(left) === JSON.stringify(right);
+var parseRecord = (value) => {
+  if (!isRecord(value) || value.format !== NATIVE_RELEASE_REGISTRY_FORMAT || typeof value.artifactKey !== "string")
+    throw new NativeReleaseRegistryError("Native release record is invalid");
+  const metadata = parseMetadata(value.metadata);
+  return {
+    artifactKey: value.artifactKey,
+    format: NATIVE_RELEASE_REGISTRY_FORMAT,
+    metadata
+  };
+};
+var parseChannel = (value) => {
+  if (!isRecord(value) || value.format !== NATIVE_RELEASE_REGISTRY_FORMAT || value.platform !== "android" || !isIsoTimestamp(value.promotedAt))
+    throw new NativeReleaseRegistryError("Native release channel is invalid");
+  const appId = requireString(value.appId, "channel appId");
+  const channel = requireChannel(requireString(value.channel, "channel"));
+  const sha256 = requireString(value.sha256, "channel sha256");
+  const releaseId = requireString(value.releaseId, "channel releaseId");
+  if (!APP_ID_PATTERN.test(appId) || !SHA256_PATTERN.test(sha256))
+    throw new NativeReleaseRegistryError("Native release channel is invalid");
+  if (releaseId !== `amobile_android_${sha256}`)
+    throw new NativeReleaseRegistryError("Native release channel identity does not match");
+  return {
+    appId,
+    channel,
+    format: NATIVE_RELEASE_REGISTRY_FORMAT,
+    platform: "android",
+    promotedAt: value.promotedAt,
+    releaseId,
+    sha256
+  };
+};
+var createNativeReleaseRegistry = (options) => {
+  const prefix = normalizedPrefix(options.prefix ?? DEFAULT_PREFIX);
+  const maxArtifactBytes = options.maxArtifactBytes ?? DEFAULT_MAX_ARTIFACT_BYTES;
+  if (!Number.isSafeInteger(maxArtifactBytes) || maxArtifactBytes < 1)
+    throw new NativeReleaseRegistryError("Native release maxArtifactBytes is invalid");
+  const clock = options.clock ?? (() => new Date);
+  const appRoot = (appId, platform) => `${prefix}/${appIdentity(appId)}/${platform}`;
+  const releaseRoot = (metadata) => `${appRoot(metadata.appId, metadata.platform)}/releases/${metadata.releaseId}`;
+  const recordKey = (metadata) => `${releaseRoot(metadata)}/release.json`;
+  const artifactKey = (metadata) => `${releaseRoot(metadata)}/${metadata.artifact}`;
+  const channelKey = (appId, platform, channel) => `${appRoot(appId, platform)}/channels/${requireChannel(channel)}.json`;
+  const requireStoredArtifact = async (key, metadata) => {
+    const stored = await options.store.head(key);
+    if (!stored || stored.size !== metadata.bytes || stored.metadata?.sha256 !== metadata.sha256 || stored.metadata?.releaseId !== metadata.releaseId)
+      throw new NativeReleaseRegistryError("Stored native release artifact does not match its immutable identity");
+  };
+  const read = async (input) => {
+    if (!APP_ID_PATTERN.test(input.appId))
+      throw new NativeReleaseRegistryError("Native release appId is invalid");
+    const digest = input.releaseId.replace(/^amobile_android_/, "");
+    if (!SHA256_PATTERN.test(digest) || input.releaseId !== `amobile_android_${digest}`)
+      throw new NativeReleaseRegistryError("Native release id is invalid");
+    const identity = {
+      appBuild: "lookup",
+      appId: input.appId,
+      artifact: "app-release.aab",
+      bytes: 1,
+      engine: "capacitor",
+      format: 1,
+      platform: "android",
+      releaseId: input.releaseId,
+      runtime: "lookup",
+      sha256: digest,
+      signed: true,
+      type: "aab"
+    };
+    const key = recordKey(identity);
+    const bytes = await options.store.get(key);
+    if (!bytes)
+      return null;
+    const storedRecord = await options.store.head(key);
+    if (!storedRecord || storedRecord.size !== bytes.byteLength || storedRecord.metadata?.releaseId !== input.releaseId || storedRecord.metadata?.sha256 !== sha256Bytes(bytes))
+      throw new NativeReleaseRegistryError("Stored native release record does not match its immutable identity");
+    const record = parseRecord(decodedJson(bytes));
+    if (record.metadata.appId !== input.appId || record.metadata.platform !== input.platform || record.metadata.releaseId !== input.releaseId || record.artifactKey !== artifactKey(record.metadata))
+      throw new NativeReleaseRegistryError("Stored native release record identity does not match");
+    await requireStoredArtifact(record.artifactKey, record.metadata);
+    return record;
+  };
+  const promote = async (input) => {
+    input.signal?.throwIfAborted();
+    const record = await read(input);
+    if (!record)
+      throw new NativeReleaseRegistryError("Native release was not published");
+    if (!record.metadata.signed && !input.allowUnsigned)
+      throw new NativeReleaseRegistryError("Unsigned native releases cannot be promoted");
+    const key = channelKey(input.appId, input.platform, input.channel);
+    const existingBytes = await options.store.get(key);
+    if (existingBytes) {
+      const existing = parseChannel(decodedJson(existingBytes));
+      if (existing.appId !== input.appId || existing.platform !== input.platform || existing.channel !== input.channel)
+        throw new NativeReleaseRegistryError("Stored native release channel identity does not match");
+      if (existing.releaseId === input.releaseId)
+        return existing;
+    }
+    const channel = {
+      appId: input.appId,
+      channel: requireChannel(input.channel),
+      format: NATIVE_RELEASE_REGISTRY_FORMAT,
+      platform: input.platform,
+      promotedAt: clock().toISOString(),
+      releaseId: record.metadata.releaseId,
+      sha256: record.metadata.sha256
+    };
+    const serialized = encodedJson(channel);
+    await options.store.put(key, serialized, {
+      cacheControl: "no-cache",
+      contentType: "application/json",
+      maxBytes: serialized.byteLength,
+      metadata: {
+        channel: channel.channel,
+        releaseId: channel.releaseId,
+        sha256: channel.sha256
+      },
+      signal: input.signal
+    });
+    const stored = await options.store.get(key);
+    if (!stored || JSON.stringify(parseChannel(decodedJson(stored))) !== JSON.stringify(channel))
+      throw new NativeReleaseRegistryError("Native release channel verification failed");
+    return channel;
+  };
+  return {
+    promote,
+    publish: async (input) => {
+      input.signal?.throwIfAborted();
+      const localRoot = path.resolve(input.releaseRoot);
+      const metadata = parseMetadata(JSON.parse(await readFile(path.join(localRoot, "release.json"), "utf8")));
+      if (metadata.bytes > maxArtifactBytes)
+        throw new NativeReleaseRegistryError("Native release exceeds the configured artifact limit");
+      if (!metadata.signed && !input.allowUnsigned)
+        throw new NativeReleaseRegistryError("Unsigned native releases cannot be published");
+      const localArtifact = path.join(localRoot, metadata.artifact);
+      const artifactStats = await stat(localArtifact).catch(() => null);
+      if (!artifactStats?.isFile() || artifactStats.size !== metadata.bytes)
+        throw new NativeReleaseRegistryError("Native release artifact size does not match its metadata");
+      if (await sha256File(Bun.file(localArtifact)) !== metadata.sha256)
+        throw new NativeReleaseRegistryError("Native release artifact digest does not match its metadata");
+      const existing = await read({
+        appId: metadata.appId,
+        platform: metadata.platform,
+        releaseId: metadata.releaseId
+      });
+      let record;
+      let reused = false;
+      if (existing) {
+        if (!sameMetadata(existing.metadata, metadata))
+          throw new NativeReleaseRegistryError("Published native release metadata is immutable");
+        record = existing;
+        reused = true;
+      } else {
+        const key = artifactKey(metadata);
+        const storedArtifact = await options.store.head(key);
+        if (storedArtifact) {
+          await requireStoredArtifact(key, metadata);
+        } else {
+          await options.store.put(key, Bun.file(localArtifact).stream(), {
+            cacheControl: "public, max-age=31536000, immutable",
+            contentType: "application/octet-stream",
+            maxBytes: metadata.bytes,
+            metadata: {
+              appId: metadata.appId,
+              releaseId: metadata.releaseId,
+              sha256: metadata.sha256
+            },
+            signal: input.signal
+          });
+          await requireStoredArtifact(key, metadata);
+        }
+        record = {
+          artifactKey: key,
+          format: NATIVE_RELEASE_REGISTRY_FORMAT,
+          metadata
+        };
+        const serialized = encodedJson(record);
+        await options.store.put(recordKey(metadata), serialized, {
+          cacheControl: "public, max-age=31536000, immutable",
+          contentType: "application/json",
+          maxBytes: serialized.byteLength,
+          metadata: {
+            releaseId: metadata.releaseId,
+            sha256: sha256Bytes(serialized)
+          },
+          signal: input.signal
+        });
+        const verified = await read({
+          appId: metadata.appId,
+          platform: metadata.platform,
+          releaseId: metadata.releaseId
+        });
+        if (!verified || JSON.stringify(verified) !== JSON.stringify(record))
+          throw new NativeReleaseRegistryError("Native release publication verification failed");
+      }
+      const channel = input.channel ? await promote({
+        allowUnsigned: input.allowUnsigned,
+        appId: metadata.appId,
+        channel: input.channel,
+        platform: metadata.platform,
+        releaseId: metadata.releaseId,
+        signal: input.signal
+      }) : undefined;
+      return { ...channel ? { channel } : {}, record, reused };
+    },
+    read,
+    resolve: async (input) => {
+      if (!APP_ID_PATTERN.test(input.appId))
+        throw new NativeReleaseRegistryError("Native release appId is invalid");
+      const key = channelKey(input.appId, input.platform, input.channel);
+      const bytes = await options.store.get(key);
+      if (!bytes)
+        return null;
+      const channel = parseChannel(decodedJson(bytes));
+      if (channel.appId !== input.appId || channel.platform !== input.platform || channel.channel !== input.channel)
+        throw new NativeReleaseRegistryError("Stored native release channel identity does not match");
+      const record = await read({
+        appId: channel.appId,
+        platform: channel.platform,
+        releaseId: channel.releaseId
+      });
+      if (!record || record.metadata.sha256 !== channel.sha256)
+        throw new NativeReleaseRegistryError("Native release channel points to a missing or invalid release");
+      return { channel, record };
+    }
+  };
+};
+export {
+  createNativeReleaseRegistry,
+  NativeReleaseRegistryError,
+  NATIVE_RELEASE_REGISTRY_FORMAT
+};
+
+//# debugId=1FEEE1047DE9DB9664756E2164756E21
+//# sourceMappingURL=nativeRelease.js.map

package/dist/nativeRelease.js.map

@@ -0,0 +1,10 @@
+{
+  "version": 3,
+  "sources": ["../src/nativeRelease.ts"],
+  "sourcesContent": [
+    "import { createHash } from \"node:crypto\";\nimport { readFile, stat } from \"node:fs/promises\";\nimport path from \"node:path\";\n\nconst DEFAULT_PREFIX = \"absolutejs/native-releases\";\nconst DEFAULT_MAX_ARTIFACT_BYTES = 2_147_483_648;\nexport const NATIVE_RELEASE_REGISTRY_FORMAT = 1 as const;\nconst SHA256_PATTERN = /^[a-f0-9]{64}$/;\nconst APP_ID_PATTERN = /^[A-Za-z][\\w]*(?:\\.[A-Za-z][\\w]*)+$/;\nconst CHANNEL_PATTERN = /^[a-z0-9][a-z0-9._-]{0,63}$/;\n\nexport type AndroidNativeReleaseMetadata = {\n  appBuild: string;\n  appId: string;\n  artifact: \"app-release.aab\";\n  bytes: number;\n  engine: \"capacitor\";\n  format: 1;\n  platform: \"android\";\n  releaseId: string;\n  runtime: string;\n  sha256: string;\n  signed: boolean;\n  type: \"aab\";\n};\n\nexport type NativeReleaseMetadata = AndroidNativeReleaseMetadata;\n\nexport type NativeReleaseRecord = {\n  artifactKey: string;\n  format: typeof NATIVE_RELEASE_REGISTRY_FORMAT;\n  metadata: NativeReleaseMetadata;\n};\n\nexport type NativeReleaseChannel = {\n  appId: string;\n  channel: string;\n  format: typeof NATIVE_RELEASE_REGISTRY_FORMAT;\n  platform: NativeReleaseMetadata[\"platform\"];\n  promotedAt: string;\n  releaseId: string;\n  sha256: string;\n};\n\nexport type NativeReleaseBlobObject = {\n  key: string;\n  metadata?: Record<string, string>;\n  size: number;\n};\n\nexport type NativeReleaseBlobStore = {\n  get: (key: string) => Promise<Uint8Array | null>;\n  head: (key: string) => Promise<NativeReleaseBlobObject | null>;\n  put: (\n    key: string,\n    body: ReadableStream<Uint8Array> | Uint8Array | string,\n    options?: {\n      cacheControl?: string;\n      contentType?: string;\n      maxBytes?: number;\n      metadata?: Record<string, string>;\n      signal?: AbortSignal;\n    },\n  ) => Promise<unknown>;\n};\n\nexport type NativeReleasePublication = {\n  channel?: NativeReleaseChannel;\n  record: NativeReleaseRecord;\n  reused: boolean;\n};\n\nexport type NativeReleaseRegistry = {\n  promote: (options: {\n    allowUnsigned?: boolean;\n    appId: string;\n    channel: string;\n    platform: NativeReleaseMetadata[\"platform\"];\n    releaseId: string;\n    signal?: AbortSignal;\n  }) => Promise<NativeReleaseChannel>;\n  publish: (options: {\n    allowUnsigned?: boolean;\n    channel?: string;\n    releaseRoot: string;\n    signal?: AbortSignal;\n  }) => Promise<NativeReleasePublication>;\n  read: (options: {\n    appId: string;\n    platform: NativeReleaseMetadata[\"platform\"];\n    releaseId: string;\n  }) => Promise<NativeReleaseRecord | null>;\n  resolve: (options: {\n    appId: string;\n    channel: string;\n    platform: NativeReleaseMetadata[\"platform\"];\n  }) => Promise<{\n    channel: NativeReleaseChannel;\n    record: NativeReleaseRecord;\n  } | null>;\n};\n\nexport type NativeReleaseRegistryOptions = {\n  clock?: () => Date;\n  maxArtifactBytes?: number;\n  prefix?: string;\n  store: NativeReleaseBlobStore;\n};\n\nexport class NativeReleaseRegistryError extends Error {}\n\nconst isRecord = (value: unknown): value is Record<string, unknown> =>\n  typeof value === \"object\" && value !== null && !Array.isArray(value);\n\nconst requireString = (value: unknown, field: string) => {\n  if (typeof value !== \"string\" || value.length === 0)\n    throw new NativeReleaseRegistryError(`Native release ${field} is invalid`);\n\n  return value;\n};\n\nconst parseMetadata = (value: unknown): NativeReleaseMetadata => {\n  if (!isRecord(value))\n    throw new NativeReleaseRegistryError(\"Native release metadata is invalid\");\n  const appId = requireString(value.appId, \"appId\");\n  const sha256 = requireString(value.sha256, \"sha256\");\n  const releaseId = requireString(value.releaseId, \"releaseId\");\n  if (!APP_ID_PATTERN.test(appId))\n    throw new NativeReleaseRegistryError(\"Native release appId is invalid\");\n  if (!SHA256_PATTERN.test(sha256))\n    throw new NativeReleaseRegistryError(\"Native release sha256 is invalid\");\n  if (releaseId !== `amobile_android_${sha256}`)\n    throw new NativeReleaseRegistryError(\n      \"Native release id does not match its artifact digest\",\n    );\n  if (\n    value.artifact !== \"app-release.aab\" ||\n    value.engine !== \"capacitor\" ||\n    value.format !== 1 ||\n    value.platform !== \"android\" ||\n    value.type !== \"aab\" ||\n    typeof value.signed !== \"boolean\" ||\n    !Number.isSafeInteger(value.bytes) ||\n    Number(value.bytes) < 1\n  )\n    throw new NativeReleaseRegistryError(\"Native release metadata is invalid\");\n\n  return {\n    appBuild: requireString(value.appBuild, \"appBuild\"),\n    appId,\n    artifact: \"app-release.aab\",\n    bytes: Number(value.bytes),\n    engine: \"capacitor\",\n    format: 1,\n    platform: \"android\",\n    releaseId,\n    runtime: requireString(value.runtime, \"runtime\"),\n    sha256,\n    signed: value.signed,\n    type: \"aab\",\n  };\n};\n\nconst normalizedPrefix = (value: string) => {\n  const prefix = value.replace(/^\\/+|\\/+$/g, \"\");\n  if (\n    prefix.length === 0 ||\n    prefix.split(\"/\").some((segment) => segment === \".\" || segment === \"..\")\n  )\n    throw new NativeReleaseRegistryError(\"Native release prefix is invalid\");\n\n  return prefix;\n};\n\nconst requireChannel = (value: string) => {\n  if (!CHANNEL_PATTERN.test(value))\n    throw new NativeReleaseRegistryError(\"Native release channel is invalid\");\n\n  return value;\n};\n\nconst appIdentity = (appId: string) =>\n  createHash(\"sha256\").update(appId).digest(\"hex\");\n\nconst sha256Bytes = (bytes: Uint8Array) =>\n  createHash(\"sha256\").update(bytes).digest(\"hex\");\n\nconst isIsoTimestamp = (value: unknown): value is string => {\n  if (typeof value !== \"string\" || Number.isNaN(Date.parse(value)))\n    return false;\n\n  return new Date(value).toISOString() === value;\n};\n\nconst sha256File = async (file: Bun.BunFile) => {\n  const hasher = new Bun.CryptoHasher(\"sha256\");\n  for await (const chunk of file.stream()) hasher.update(chunk);\n\n  return hasher.digest(\"hex\");\n};\n\nconst encodedJson = (value: unknown) =>\n  new TextEncoder().encode(`${JSON.stringify(value, null, 2)}\\n`);\n\nconst decodedJson = (bytes: Uint8Array) =>\n  JSON.parse(new TextDecoder().decode(bytes)) as unknown;\n\nconst sameMetadata = (\n  left: NativeReleaseMetadata,\n  right: NativeReleaseMetadata,\n) => JSON.stringify(left) === JSON.stringify(right);\n\nconst parseRecord = (value: unknown): NativeReleaseRecord => {\n  if (\n    !isRecord(value) ||\n    value.format !== NATIVE_RELEASE_REGISTRY_FORMAT ||\n    typeof value.artifactKey !== \"string\"\n  )\n    throw new NativeReleaseRegistryError(\"Native release record is invalid\");\n  const metadata = parseMetadata(value.metadata);\n\n  return {\n    artifactKey: value.artifactKey,\n    format: NATIVE_RELEASE_REGISTRY_FORMAT,\n    metadata,\n  };\n};\n\nconst parseChannel = (value: unknown): NativeReleaseChannel => {\n  if (\n    !isRecord(value) ||\n    value.format !== NATIVE_RELEASE_REGISTRY_FORMAT ||\n    value.platform !== \"android\" ||\n    !isIsoTimestamp(value.promotedAt)\n  )\n    throw new NativeReleaseRegistryError(\"Native release channel is invalid\");\n  const appId = requireString(value.appId, \"channel appId\");\n  const channel = requireChannel(requireString(value.channel, \"channel\"));\n  const sha256 = requireString(value.sha256, \"channel sha256\");\n  const releaseId = requireString(value.releaseId, \"channel releaseId\");\n  if (!APP_ID_PATTERN.test(appId) || !SHA256_PATTERN.test(sha256))\n    throw new NativeReleaseRegistryError(\"Native release channel is invalid\");\n  if (releaseId !== `amobile_android_${sha256}`)\n    throw new NativeReleaseRegistryError(\n      \"Native release channel identity does not match\",\n    );\n\n  return {\n    appId,\n    channel,\n    format: NATIVE_RELEASE_REGISTRY_FORMAT,\n    platform: \"android\",\n    promotedAt: value.promotedAt,\n    releaseId,\n    sha256,\n  };\n};\n\nexport const createNativeReleaseRegistry = (\n  options: NativeReleaseRegistryOptions,\n): NativeReleaseRegistry => {\n  const prefix = normalizedPrefix(options.prefix ?? DEFAULT_PREFIX);\n  const maxArtifactBytes =\n    options.maxArtifactBytes ?? DEFAULT_MAX_ARTIFACT_BYTES;\n  if (!Number.isSafeInteger(maxArtifactBytes) || maxArtifactBytes < 1)\n    throw new NativeReleaseRegistryError(\n      \"Native release maxArtifactBytes is invalid\",\n    );\n  const clock = options.clock ?? (() => new Date());\n  const appRoot = (appId: string, platform: \"android\") =>\n    `${prefix}/${appIdentity(appId)}/${platform}`;\n  const releaseRoot = (metadata: NativeReleaseMetadata) =>\n    `${appRoot(metadata.appId, metadata.platform)}/releases/${metadata.releaseId}`;\n  const recordKey = (metadata: NativeReleaseMetadata) =>\n    `${releaseRoot(metadata)}/release.json`;\n  const artifactKey = (metadata: NativeReleaseMetadata) =>\n    `${releaseRoot(metadata)}/${metadata.artifact}`;\n  const channelKey = (appId: string, platform: \"android\", channel: string) =>\n    `${appRoot(appId, platform)}/channels/${requireChannel(channel)}.json`;\n\n  const requireStoredArtifact = async (\n    key: string,\n    metadata: NativeReleaseMetadata,\n  ) => {\n    const stored = await options.store.head(key);\n    if (\n      !stored ||\n      stored.size !== metadata.bytes ||\n      stored.metadata?.sha256 !== metadata.sha256 ||\n      stored.metadata?.releaseId !== metadata.releaseId\n    )\n      throw new NativeReleaseRegistryError(\n        \"Stored native release artifact does not match its immutable identity\",\n      );\n  };\n\n  const read = async (input: {\n    appId: string;\n    platform: \"android\";\n    releaseId: string;\n  }) => {\n    if (!APP_ID_PATTERN.test(input.appId))\n      throw new NativeReleaseRegistryError(\"Native release appId is invalid\");\n    const digest = input.releaseId.replace(/^amobile_android_/, \"\");\n    if (\n      !SHA256_PATTERN.test(digest) ||\n      input.releaseId !== `amobile_android_${digest}`\n    )\n      throw new NativeReleaseRegistryError(\"Native release id is invalid\");\n    const identity: NativeReleaseMetadata = {\n      appBuild: \"lookup\",\n      appId: input.appId,\n      artifact: \"app-release.aab\",\n      bytes: 1,\n      engine: \"capacitor\",\n      format: 1,\n      platform: \"android\",\n      releaseId: input.releaseId,\n      runtime: \"lookup\",\n      sha256: digest,\n      signed: true,\n      type: \"aab\",\n    };\n    const key = recordKey(identity);\n    const bytes = await options.store.get(key);\n    if (!bytes) return null;\n    const storedRecord = await options.store.head(key);\n    if (\n      !storedRecord ||\n      storedRecord.size !== bytes.byteLength ||\n      storedRecord.metadata?.releaseId !== input.releaseId ||\n      storedRecord.metadata?.sha256 !== sha256Bytes(bytes)\n    )\n      throw new NativeReleaseRegistryError(\n        \"Stored native release record does not match its immutable identity\",\n      );\n    const record = parseRecord(decodedJson(bytes));\n    if (\n      record.metadata.appId !== input.appId ||\n      record.metadata.platform !== input.platform ||\n      record.metadata.releaseId !== input.releaseId ||\n      record.artifactKey !== artifactKey(record.metadata)\n    )\n      throw new NativeReleaseRegistryError(\n        \"Stored native release record identity does not match\",\n      );\n    await requireStoredArtifact(record.artifactKey, record.metadata);\n\n    return record;\n  };\n\n  const promote: NativeReleaseRegistry[\"promote\"] = async (input) => {\n    input.signal?.throwIfAborted();\n    const record = await read(input);\n    if (!record)\n      throw new NativeReleaseRegistryError(\"Native release was not published\");\n    if (!record.metadata.signed && !input.allowUnsigned)\n      throw new NativeReleaseRegistryError(\n        \"Unsigned native releases cannot be promoted\",\n      );\n    const key = channelKey(input.appId, input.platform, input.channel);\n    const existingBytes = await options.store.get(key);\n    if (existingBytes) {\n      const existing = parseChannel(decodedJson(existingBytes));\n      if (\n        existing.appId !== input.appId ||\n        existing.platform !== input.platform ||\n        existing.channel !== input.channel\n      )\n        throw new NativeReleaseRegistryError(\n          \"Stored native release channel identity does not match\",\n        );\n      if (existing.releaseId === input.releaseId) return existing;\n    }\n    const channel: NativeReleaseChannel = {\n      appId: input.appId,\n      channel: requireChannel(input.channel),\n      format: NATIVE_RELEASE_REGISTRY_FORMAT,\n      platform: input.platform,\n      promotedAt: clock().toISOString(),\n      releaseId: record.metadata.releaseId,\n      sha256: record.metadata.sha256,\n    };\n    const serialized = encodedJson(channel);\n    await options.store.put(key, serialized, {\n      cacheControl: \"no-cache\",\n      contentType: \"application/json\",\n      maxBytes: serialized.byteLength,\n      metadata: {\n        channel: channel.channel,\n        releaseId: channel.releaseId,\n        sha256: channel.sha256,\n      },\n      signal: input.signal,\n    });\n    const stored = await options.store.get(key);\n    if (\n      !stored ||\n      JSON.stringify(parseChannel(decodedJson(stored))) !==\n        JSON.stringify(channel)\n    )\n      throw new NativeReleaseRegistryError(\n        \"Native release channel verification failed\",\n      );\n\n    return channel;\n  };\n\n  return {\n    promote,\n    publish: async (input) => {\n      input.signal?.throwIfAborted();\n      const localRoot = path.resolve(input.releaseRoot);\n      const metadata = parseMetadata(\n        JSON.parse(\n          await readFile(path.join(localRoot, \"release.json\"), \"utf8\"),\n        ),\n      );\n      if (metadata.bytes > maxArtifactBytes)\n        throw new NativeReleaseRegistryError(\n          \"Native release exceeds the configured artifact limit\",\n        );\n      if (!metadata.signed && !input.allowUnsigned)\n        throw new NativeReleaseRegistryError(\n          \"Unsigned native releases cannot be published\",\n        );\n      const localArtifact = path.join(localRoot, metadata.artifact);\n      const artifactStats = await stat(localArtifact).catch(() => null);\n      if (!artifactStats?.isFile() || artifactStats.size !== metadata.bytes)\n        throw new NativeReleaseRegistryError(\n          \"Native release artifact size does not match its metadata\",\n        );\n      if ((await sha256File(Bun.file(localArtifact))) !== metadata.sha256)\n        throw new NativeReleaseRegistryError(\n          \"Native release artifact digest does not match its metadata\",\n        );\n      const existing = await read({\n        appId: metadata.appId,\n        platform: metadata.platform,\n        releaseId: metadata.releaseId,\n      });\n      let record: NativeReleaseRecord;\n      let reused = false;\n      if (existing) {\n        if (!sameMetadata(existing.metadata, metadata))\n          throw new NativeReleaseRegistryError(\n            \"Published native release metadata is immutable\",\n          );\n        record = existing;\n        reused = true;\n      } else {\n        const key = artifactKey(metadata);\n        const storedArtifact = await options.store.head(key);\n        if (storedArtifact) {\n          await requireStoredArtifact(key, metadata);\n        } else {\n          await options.store.put(key, Bun.file(localArtifact).stream(), {\n            cacheControl: \"public, max-age=31536000, immutable\",\n            contentType: \"application/octet-stream\",\n            maxBytes: metadata.bytes,\n            metadata: {\n              appId: metadata.appId,\n              releaseId: metadata.releaseId,\n              sha256: metadata.sha256,\n            },\n            signal: input.signal,\n          });\n          await requireStoredArtifact(key, metadata);\n        }\n        record = {\n          artifactKey: key,\n          format: NATIVE_RELEASE_REGISTRY_FORMAT,\n          metadata,\n        };\n        const serialized = encodedJson(record);\n        await options.store.put(recordKey(metadata), serialized, {\n          cacheControl: \"public, max-age=31536000, immutable\",\n          contentType: \"application/json\",\n          maxBytes: serialized.byteLength,\n          metadata: {\n            releaseId: metadata.releaseId,\n            sha256: sha256Bytes(serialized),\n          },\n          signal: input.signal,\n        });\n        const verified = await read({\n          appId: metadata.appId,\n          platform: metadata.platform,\n          releaseId: metadata.releaseId,\n        });\n        if (!verified || JSON.stringify(verified) !== JSON.stringify(record))\n          throw new NativeReleaseRegistryError(\n            \"Native release publication verification failed\",\n          );\n      }\n      const channel = input.channel\n        ? await promote({\n            allowUnsigned: input.allowUnsigned,\n            appId: metadata.appId,\n            channel: input.channel,\n            platform: metadata.platform,\n            releaseId: metadata.releaseId,\n            signal: input.signal,\n          })\n        : undefined;\n\n      return { ...(channel ? { channel } : {}), record, reused };\n    },\n    read,\n    resolve: async (input) => {\n      if (!APP_ID_PATTERN.test(input.appId))\n        throw new NativeReleaseRegistryError(\"Native release appId is invalid\");\n      const key = channelKey(input.appId, input.platform, input.channel);\n      const bytes = await options.store.get(key);\n      if (!bytes) return null;\n      const channel = parseChannel(decodedJson(bytes));\n      if (\n        channel.appId !== input.appId ||\n        channel.platform !== input.platform ||\n        channel.channel !== input.channel\n      )\n        throw new NativeReleaseRegistryError(\n          \"Stored native release channel identity does not match\",\n        );\n      const record = await read({\n        appId: channel.appId,\n        platform: channel.platform,\n        releaseId: channel.releaseId,\n      });\n      if (!record || record.metadata.sha256 !== channel.sha256)\n        throw new NativeReleaseRegistryError(\n          \"Native release channel points to a missing or invalid release\",\n        );\n\n      return { channel, record };\n    },\n  };\n};\n"
+  ],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AACA;AACA;AAEA,IAAM,iBAAiB;AACvB,IAAM,6BAA6B;AAC5B,IAAM,iCAAiC;AAC9C,IAAM,iBAAiB;AACvB,IAAM,iBAAiB;AACvB,IAAM,kBAAkB;AAAA;AAoGjB,MAAM,mCAAmC,MAAM;AAAC;AAEvD,IAAM,WAAW,CAAC,UAChB,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAErE,IAAM,gBAAgB,CAAC,OAAgB,UAAkB;AAAA,EACvD,IAAI,OAAO,UAAU,YAAY,MAAM,WAAW;AAAA,IAChD,MAAM,IAAI,2BAA2B,kBAAkB,kBAAkB;AAAA,EAE3E,OAAO;AAAA;AAGT,IAAM,gBAAgB,CAAC,UAA0C;AAAA,EAC/D,IAAI,CAAC,SAAS,KAAK;AAAA,IACjB,MAAM,IAAI,2BAA2B,oCAAoC;AAAA,EAC3E,MAAM,QAAQ,cAAc,MAAM,OAAO,OAAO;AAAA,EAChD,MAAM,SAAS,cAAc,MAAM,QAAQ,QAAQ;AAAA,EACnD,MAAM,YAAY,cAAc,MAAM,WAAW,WAAW;AAAA,EAC5D,IAAI,CAAC,eAAe,KAAK,KAAK;AAAA,IAC5B,MAAM,IAAI,2BAA2B,iCAAiC;AAAA,EACxE,IAAI,CAAC,eAAe,KAAK,MAAM;AAAA,IAC7B,MAAM,IAAI,2BAA2B,kCAAkC;AAAA,EACzE,IAAI,cAAc,mBAAmB;AAAA,IACnC,MAAM,IAAI,2BACR,sDACF;AAAA,EACF,IACE,MAAM,aAAa,qBACnB,MAAM,WAAW,eACjB,MAAM,WAAW,KACjB,MAAM,aAAa,aACnB,MAAM,SAAS,SACf,OAAO,MAAM,WAAW,aACxB,CAAC,OAAO,cAAc,MAAM,KAAK,KACjC,OAAO,MAAM,KAAK,IAAI;AAAA,IAEtB,MAAM,IAAI,2BAA2B,oCAAoC;AAAA,EAE3E,OAAO;AAAA,IACL,UAAU,cAAc,MAAM,UAAU,UAAU;AAAA,IAClD;AAAA,IACA,UAAU;AAAA,IACV,OAAO,OAAO,MAAM,KAAK;AAAA,IACzB,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,UAAU;AAAA,IACV;AAAA,IACA,SAAS,cAAc,MAAM,SAAS,SAAS;AAAA,IAC/C;AAAA,IACA,QAAQ,MAAM;AAAA,IACd,MAAM;AAAA,EACR;AAAA;AAGF,IAAM,mBAAmB,CAAC,UAAkB;AAAA,EAC1C,MAAM,SAAS,MAAM,QAAQ,cAAc,EAAE;AAAA,EAC7C,IACE,OAAO,WAAW,KAClB,OAAO,MAAM,GAAG,EAAE,KAAK,CAAC,YAAY,YAAY,OAAO,YAAY,IAAI;AAAA,IAEvE,MAAM,IAAI,2BAA2B,kCAAkC;AAAA,EAEzE,OAAO;AAAA;AAGT,IAAM,iBAAiB,CAAC,UAAkB;AAAA,EACxC,IAAI,CAAC,gBAAgB,KAAK,KAAK;AAAA,IAC7B,MAAM,IAAI,2BAA2B,mCAAmC;AAAA,EAE1E,OAAO;AAAA;AAGT,IAAM,cAAc,CAAC,UACnB,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;AAEjD,IAAM,cAAc,CAAC,UACnB,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;AAEjD,IAAM,iBAAiB,CAAC,UAAoC;AAAA,EAC1D,IAAI,OAAO,UAAU,YAAY,OAAO,MAAM,KAAK,MAAM,KAAK,CAAC;AAAA,IAC7D,OAAO;AAAA,EAET,OAAO,IAAI,KAAK,KAAK,EAAE,YAAY,MAAM;AAAA;AAG3C,IAAM,aAAa,OAAO,SAAsB;AAAA,EAC9C,MAAM,SAAS,IAAI,IAAI,aAAa,QAAQ;AAAA,EAC5C,iBAAiB,SAAS,KAAK,OAAO;AAAA,IAAG,OAAO,OAAO,KAAK;AAAA,EAE5D,OAAO,OAAO,OAAO,KAAK;AAAA;AAG5B,IAAM,cAAc,CAAC,UACnB,IAAI,YAAY,EAAE,OAAO,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC;AAAA,CAAK;AAEhE,IAAM,cAAc,CAAC,UACnB,KAAK,MAAM,IAAI,YAAY,EAAE,OAAO,KAAK,CAAC;AAE5C,IAAM,eAAe,CACnB,MACA,UACG,KAAK,UAAU,IAAI,MAAM,KAAK,UAAU,KAAK;AAElD,IAAM,cAAc,CAAC,UAAwC;AAAA,EAC3D,IACE,CAAC,SAAS,KAAK,KACf,MAAM,WAAW,kCACjB,OAAO,MAAM,gBAAgB;AAAA,IAE7B,MAAM,IAAI,2BAA2B,kCAAkC;AAAA,EACzE,MAAM,WAAW,cAAc,MAAM,QAAQ;AAAA,EAE7C,OAAO;AAAA,IACL,aAAa,MAAM;AAAA,IACnB,QAAQ;AAAA,IACR;AAAA,EACF;AAAA;AAGF,IAAM,eAAe,CAAC,UAAyC;AAAA,EAC7D,IACE,CAAC,SAAS,KAAK,KACf,MAAM,WAAW,kCACjB,MAAM,aAAa,aACnB,CAAC,eAAe,MAAM,UAAU;AAAA,IAEhC,MAAM,IAAI,2BAA2B,mCAAmC;AAAA,EAC1E,MAAM,QAAQ,cAAc,MAAM,OAAO,eAAe;AAAA,EACxD,MAAM,UAAU,eAAe,cAAc,MAAM,SAAS,SAAS,CAAC;AAAA,EACtE,MAAM,SAAS,cAAc,MAAM,QAAQ,gBAAgB;AAAA,EAC3D,MAAM,YAAY,cAAc,MAAM,WAAW,mBAAmB;AAAA,EACpE,IAAI,CAAC,eAAe,KAAK,KAAK,KAAK,CAAC,eAAe,KAAK,MAAM;AAAA,IAC5D,MAAM,IAAI,2BAA2B,mCAAmC;AAAA,EAC1E,IAAI,cAAc,mBAAmB;AAAA,IACnC,MAAM,IAAI,2BACR,gDACF;AAAA,EAEF,OAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,YAAY,MAAM;AAAA,IAClB;AAAA,IACA;AAAA,EACF;AAAA;AAGK,IAAM,8BAA8B,CACzC,YAC0B;AAAA,EAC1B,MAAM,SAAS,iBAAiB,QAAQ,UAAU,cAAc;AAAA,EAChE,MAAM,mBACJ,QAAQ,oBAAoB;AAAA,EAC9B,IAAI,CAAC,OAAO,cAAc,gBAAgB,KAAK,mBAAmB;AAAA,IAChE,MAAM,IAAI,2BACR,4CACF;AAAA,EACF,MAAM,QAAQ,QAAQ,UAAU,MAAM,IAAI;AAAA,EAC1C,MAAM,UAAU,CAAC,OAAe,aAC9B,GAAG,UAAU,YAAY,KAAK,KAAK;AAAA,EACrC,MAAM,cAAc,CAAC,aACnB,GAAG,QAAQ,SAAS,OAAO,SAAS,QAAQ,cAAc,SAAS;AAAA,EACrE,MAAM,YAAY,CAAC,aACjB,GAAG,YAAY,QAAQ;AAAA,EACzB,MAAM,cAAc,CAAC,aACnB,GAAG,YAAY,QAAQ,KAAK,SAAS;AAAA,EACvC,MAAM,aAAa,CAAC,OAAe,UAAqB,YACtD,GAAG,QAAQ,OAAO,QAAQ,cAAc,eAAe,OAAO;AAAA,EAEhE,MAAM,wBAAwB,OAC5B,KACA,aACG;AAAA,IACH,MAAM,SAAS,MAAM,QAAQ,MAAM,KAAK,GAAG;AAAA,IAC3C,IACE,CAAC,UACD,OAAO,SAAS,SAAS,SACzB,OAAO,UAAU,WAAW,SAAS,UACrC,OAAO,UAAU,cAAc,SAAS;AAAA,MAExC,MAAM,IAAI,2BACR,sEACF;AAAA;AAAA,EAGJ,MAAM,OAAO,OAAO,UAId;AAAA,IACJ,IAAI,CAAC,eAAe,KAAK,MAAM,KAAK;AAAA,MAClC,MAAM,IAAI,2BAA2B,iCAAiC;AAAA,IACxE,MAAM,SAAS,MAAM,UAAU,QAAQ,qBAAqB,EAAE;AAAA,IAC9D,IACE,CAAC,eAAe,KAAK,MAAM,KAC3B,MAAM,cAAc,mBAAmB;AAAA,MAEvC,MAAM,IAAI,2BAA2B,8BAA8B;AAAA,IACrE,MAAM,WAAkC;AAAA,MACtC,UAAU;AAAA,MACV,OAAO,MAAM;AAAA,MACb,UAAU;AAAA,MACV,OAAO;AAAA,MACP,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,WAAW,MAAM;AAAA,MACjB,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,MAAM;AAAA,IACR;AAAA,IACA,MAAM,MAAM,UAAU,QAAQ;AAAA,IAC9B,MAAM,QAAQ,MAAM,QAAQ,MAAM,IAAI,GAAG;AAAA,IACzC,IAAI,CAAC;AAAA,MAAO,OAAO;AAAA,IACnB,MAAM,eAAe,MAAM,QAAQ,MAAM,KAAK,GAAG;AAAA,IACjD,IACE,CAAC,gBACD,aAAa,SAAS,MAAM,cAC5B,aAAa,UAAU,cAAc,MAAM,aAC3C,aAAa,UAAU,WAAW,YAAY,KAAK;AAAA,MAEnD,MAAM,IAAI,2BACR,oEACF;AAAA,IACF,MAAM,SAAS,YAAY,YAAY,KAAK,CAAC;AAAA,IAC7C,IACE,OAAO,SAAS,UAAU,MAAM,SAChC,OAAO,SAAS,aAAa,MAAM,YACnC,OAAO,SAAS,cAAc,MAAM,aACpC,OAAO,gBAAgB,YAAY,OAAO,QAAQ;AAAA,MAElD,MAAM,IAAI,2BACR,sDACF;AAAA,IACF,MAAM,sBAAsB,OAAO,aAAa,OAAO,QAAQ;AAAA,IAE/D,OAAO;AAAA;AAAA,EAGT,MAAM,UAA4C,OAAO,UAAU;AAAA,IACjE,MAAM,QAAQ,eAAe;AAAA,IAC7B,MAAM,SAAS,MAAM,KAAK,KAAK;AAAA,IAC/B,IAAI,CAAC;AAAA,MACH,MAAM,IAAI,2BAA2B,kCAAkC;AAAA,IACzE,IAAI,CAAC,OAAO,SAAS,UAAU,CAAC,MAAM;AAAA,MACpC,MAAM,IAAI,2BACR,6CACF;AAAA,IACF,MAAM,MAAM,WAAW,MAAM,OAAO,MAAM,UAAU,MAAM,OAAO;AAAA,IACjE,MAAM,gBAAgB,MAAM,QAAQ,MAAM,IAAI,GAAG;AAAA,IACjD,IAAI,eAAe;AAAA,MACjB,MAAM,WAAW,aAAa,YAAY,aAAa,CAAC;AAAA,MACxD,IACE,SAAS,UAAU,MAAM,SACzB,SAAS,aAAa,MAAM,YAC5B,SAAS,YAAY,MAAM;AAAA,QAE3B,MAAM,IAAI,2BACR,uDACF;AAAA,MACF,IAAI,SAAS,cAAc,MAAM;AAAA,QAAW,OAAO;AAAA,IACrD;AAAA,IACA,MAAM,UAAgC;AAAA,MACpC,OAAO,MAAM;AAAA,MACb,SAAS,eAAe,MAAM,OAAO;AAAA,MACrC,QAAQ;AAAA,MACR,UAAU,MAAM;AAAA,MAChB,YAAY,MAAM,EAAE,YAAY;AAAA,MAChC,WAAW,OAAO,SAAS;AAAA,MAC3B,QAAQ,OAAO,SAAS;AAAA,IAC1B;AAAA,IACA,MAAM,aAAa,YAAY,OAAO;AAAA,IACtC,MAAM,QAAQ,MAAM,IAAI,KAAK,YAAY;AAAA,MACvC,cAAc;AAAA,MACd,aAAa;AAAA,MACb,UAAU,WAAW;AAAA,MACrB,UAAU;AAAA,QACR,SAAS,QAAQ;AAAA,QACjB,WAAW,QAAQ;AAAA,QACnB,QAAQ,QAAQ;AAAA,MAClB;AAAA,MACA,QAAQ,MAAM;AAAA,IAChB,CAAC;AAAA,IACD,MAAM,SAAS,MAAM,QAAQ,MAAM,IAAI,GAAG;AAAA,IAC1C,IACE,CAAC,UACD,KAAK,UAAU,aAAa,YAAY,MAAM,CAAC,CAAC,MAC9C,KAAK,UAAU,OAAO;AAAA,MAExB,MAAM,IAAI,2BACR,4CACF;AAAA,IAEF,OAAO;AAAA;AAAA,EAGT,OAAO;AAAA,IACL;AAAA,IACA,SAAS,OAAO,UAAU;AAAA,MACxB,MAAM,QAAQ,eAAe;AAAA,MAC7B,MAAM,YAAY,KAAK,QAAQ,MAAM,WAAW;AAAA,MAChD,MAAM,WAAW,cACf,KAAK,MACH,MAAM,SAAS,KAAK,KAAK,WAAW,cAAc,GAAG,MAAM,CAC7D,CACF;AAAA,MACA,IAAI,SAAS,QAAQ;AAAA,QACnB,MAAM,IAAI,2BACR,sDACF;AAAA,MACF,IAAI,CAAC,SAAS,UAAU,CAAC,MAAM;AAAA,QAC7B,MAAM,IAAI,2BACR,8CACF;AAAA,MACF,MAAM,gBAAgB,KAAK,KAAK,WAAW,SAAS,QAAQ;AAAA,MAC5D,MAAM,gBAAgB,MAAM,KAAK,aAAa,EAAE,MAAM,MAAM,IAAI;AAAA,MAChE,IAAI,CAAC,eAAe,OAAO,KAAK,cAAc,SAAS,SAAS;AAAA,QAC9D,MAAM,IAAI,2BACR,0DACF;AAAA,MACF,IAAK,MAAM,WAAW,IAAI,KAAK,aAAa,CAAC,MAAO,SAAS;AAAA,QAC3D,MAAM,IAAI,2BACR,4DACF;AAAA,MACF,MAAM,WAAW,MAAM,KAAK;AAAA,QAC1B,OAAO,SAAS;AAAA,QAChB,UAAU,SAAS;AAAA,QACnB,WAAW,SAAS;AAAA,MACtB,CAAC;AAAA,MACD,IAAI;AAAA,MACJ,IAAI,SAAS;AAAA,MACb,IAAI,UAAU;AAAA,QACZ,IAAI,CAAC,aAAa,SAAS,UAAU,QAAQ;AAAA,UAC3C,MAAM,IAAI,2BACR,gDACF;AAAA,QACF,SAAS;AAAA,QACT,SAAS;AAAA,MACX,EAAO;AAAA,QACL,MAAM,MAAM,YAAY,QAAQ;AAAA,QAChC,MAAM,iBAAiB,MAAM,QAAQ,MAAM,KAAK,GAAG;AAAA,QACnD,IAAI,gBAAgB;AAAA,UAClB,MAAM,sBAAsB,KAAK,QAAQ;AAAA,QAC3C,EAAO;AAAA,UACL,MAAM,QAAQ,MAAM,IAAI,KAAK,IAAI,KAAK,aAAa,EAAE,OAAO,GAAG;AAAA,YAC7D,cAAc;AAAA,YACd,aAAa;AAAA,YACb,UAAU,SAAS;AAAA,YACnB,UAAU;AAAA,cACR,OAAO,SAAS;AAAA,cAChB,WAAW,SAAS;AAAA,cACpB,QAAQ,SAAS;AAAA,YACnB;AAAA,YACA,QAAQ,MAAM;AAAA,UAChB,CAAC;AAAA,UACD,MAAM,sBAAsB,KAAK,QAAQ;AAAA;AAAA,QAE3C,SAAS;AAAA,UACP,aAAa;AAAA,UACb,QAAQ;AAAA,UACR;AAAA,QACF;AAAA,QACA,MAAM,aAAa,YAAY,MAAM;AAAA,QACrC,MAAM,QAAQ,MAAM,IAAI,UAAU,QAAQ,GAAG,YAAY;AAAA,UACvD,cAAc;AAAA,UACd,aAAa;AAAA,UACb,UAAU,WAAW;AAAA,UACrB,UAAU;AAAA,YACR,WAAW,SAAS;AAAA,YACpB,QAAQ,YAAY,UAAU;AAAA,UAChC;AAAA,UACA,QAAQ,MAAM;AAAA,QAChB,CAAC;AAAA,QACD,MAAM,WAAW,MAAM,KAAK;AAAA,UAC1B,OAAO,SAAS;AAAA,UAChB,UAAU,SAAS;AAAA,UACnB,WAAW,SAAS;AAAA,QACtB,CAAC;AAAA,QACD,IAAI,CAAC,YAAY,KAAK,UAAU,QAAQ,MAAM,KAAK,UAAU,MAAM;AAAA,UACjE,MAAM,IAAI,2BACR,gDACF;AAAA;AAAA,MAEJ,MAAM,UAAU,MAAM,UAClB,MAAM,QAAQ;AAAA,QACZ,eAAe,MAAM;AAAA,QACrB,OAAO,SAAS;AAAA,QAChB,SAAS,MAAM;AAAA,QACf,UAAU,SAAS;AAAA,QACnB,WAAW,SAAS;AAAA,QACpB,QAAQ,MAAM;AAAA,MAChB,CAAC,IACD;AAAA,MAEJ,OAAO,KAAM,UAAU,EAAE,QAAQ,IAAI,CAAC,GAAI,QAAQ,OAAO;AAAA;AAAA,IAE3D;AAAA,IACA,SAAS,OAAO,UAAU;AAAA,MACxB,IAAI,CAAC,eAAe,KAAK,MAAM,KAAK;AAAA,QAClC,MAAM,IAAI,2BAA2B,iCAAiC;AAAA,MACxE,MAAM,MAAM,WAAW,MAAM,OAAO,MAAM,UAAU,MAAM,OAAO;AAAA,MACjE,MAAM,QAAQ,MAAM,QAAQ,MAAM,IAAI,GAAG;AAAA,MACzC,IAAI,CAAC;AAAA,QAAO,OAAO;AAAA,MACnB,MAAM,UAAU,aAAa,YAAY,KAAK,CAAC;AAAA,MAC/C,IACE,QAAQ,UAAU,MAAM,SACxB,QAAQ,aAAa,MAAM,YAC3B,QAAQ,YAAY,MAAM;AAAA,QAE1B,MAAM,IAAI,2BACR,uDACF;AAAA,MACF,MAAM,SAAS,MAAM,KAAK;AAAA,QACxB,OAAO,QAAQ;AAAA,QACf,UAAU,QAAQ;AAAA,QAClB,WAAW,QAAQ;AAAA,MACrB,CAAC;AAAA,MACD,IAAI,CAAC,UAAU,OAAO,SAAS,WAAW,QAAQ;AAAA,QAChD,MAAM,IAAI,2BACR,+DACF;AAAA,MAEF,OAAO,EAAE,SAAS,OAAO;AAAA;AAAA,EAE7B;AAAA;",
+  "debugId": "1FEEE1047DE9DB9664756E2164756E21",
+  "names": []
+}

package/dist/releaseArtifact.js

@@ -129,7 +129,6 @@ var receiveReleaseArtifact = async (options) => {
     await rm(options.destination, { force: true });
     throw error;
   } finally {
-    reader.releaseLock();
     await writer.end();
   }
   if (bytes !== options.expectedBytes || hasher.digest("hex") !== options.expectedSha256) {
@@ -171,5 +170,5 @@ export {
   ReleaseArtifactError
 };
 
-//# debugId=7AC624D04445253564756E2164756E21
+//# debugId=8414E4F4B329037664756E2164756E21
 //# sourceMappingURL=releaseArtifact.js.map

package/dist/releaseArtifact.js.map

@@ -2,9 +2,9 @@
   "version": 3,
   "sources": ["../src/releaseArtifact.ts"],
   "sourcesContent": [
-    "import { mkdir, mkdtemp, rm, stat } from \"node:fs/promises\";\nimport { tmpdir } from \"node:os\";\nimport path from \"node:path\";\n\nconst DEFAULT_MAX_BYTES = 2_147_483_648;\nconst ERROR_DETAIL_LIMIT = 500;\nconst SAFE_RELEASE_ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;\n\nexport type ReleaseArtifactMetadata = {\n  bytes: number;\n  releaseId: string;\n  sha256: string;\n};\n\nexport type CreatedReleaseArtifact = {\n  dispose: () => Promise<void>;\n  file: Bun.BunFile;\n  metadata: ReleaseArtifactMetadata;\n  path: string;\n};\n\nexport class ReleaseArtifactError extends Error {}\n\nconst run = async (command: string[]) => {\n  const process = Bun.spawn(command, { stderr: \"pipe\", stdout: \"pipe\" });\n  const [exitCode, stderr, stdout] = await Promise.all([\n    process.exited,\n    new Response(process.stderr).text(),\n    new Response(process.stdout).text(),\n  ]);\n  if (exitCode !== 0)\n    throw new ReleaseArtifactError(\n      `${command[0]} failed (${exitCode}): ${stderr.slice(0, ERROR_DETAIL_LIMIT)}`,\n    );\n\n  return stdout;\n};\n\nconst assertReleaseId = (value: string) => {\n  if (!SAFE_RELEASE_ID.test(value))\n    throw new ReleaseArtifactError(\"Release id is invalid\");\n\n  return value;\n};\n\nconst assertExclude = (value: string) => {\n  if (\n    value.length === 0 ||\n    value.startsWith(\"-\") ||\n    value.startsWith(\"/\") ||\n    value.split(\"/\").some((part) => part === \"..\") ||\n    /[\\0\\r\\n]/.test(value)\n  )\n    throw new ReleaseArtifactError(`Invalid release exclusion: ${value}`);\n\n  return value.replace(/^\\.\\//, \"\");\n};\n\nconst sha256File = async (file: Blob) => {\n  const hasher = new Bun.CryptoHasher(\"sha256\");\n  for await (const chunk of file.stream()) hasher.update(chunk);\n\n  return hasher.digest(\"hex\");\n};\n\nexport const createReleaseArtifact = async (options: {\n  exclude?: string[];\n  releaseId?: string;\n  sourceRoot: string;\n  temporaryRoot?: string;\n}): Promise<CreatedReleaseArtifact> => {\n  const releaseId = assertReleaseId(options.releaseId ?? crypto.randomUUID());\n  const source = path.resolve(options.sourceRoot);\n  const sourceStats = await stat(source).catch(() => null);\n  if (!sourceStats?.isDirectory())\n    throw new ReleaseArtifactError(\"Release source root is not a directory\");\n  if (!(await Bun.file(path.join(source, \"package.json\")).exists()))\n    throw new ReleaseArtifactError(\"Release source has no package.json\");\n  const temporary = await mkdtemp(\n    path.join(options.temporaryRoot ?? tmpdir(), \"absolutejs-release-\"),\n  );\n  const archivePath = path.join(temporary, `${releaseId}.tgz`);\n  try {\n    await run([\n      \"tar\",\n      \"-czf\",\n      archivePath,\n      ...(options.exclude ?? []).map(\n        (value) => `--exclude=./${assertExclude(value)}`,\n      ),\n      \"-C\",\n      source,\n      \".\",\n    ]);\n    const file = Bun.file(archivePath);\n\n    return {\n      dispose: () => rm(temporary, { force: true, recursive: true }),\n      file,\n      metadata: {\n        bytes: file.size,\n        releaseId,\n        sha256: await sha256File(file),\n      },\n      path: archivePath,\n    };\n  } catch (error) {\n    await rm(temporary, { force: true, recursive: true });\n    throw error;\n  }\n};\n\nexport const receiveReleaseArtifact = async (options: {\n  destination: string;\n  expectedBytes: number;\n  expectedSha256: string;\n  maxBytes?: number;\n  stream: ReadableStream<Uint8Array>;\n}) => {\n  const maxBytes = options.maxBytes ?? DEFAULT_MAX_BYTES;\n  if (\n    !Number.isSafeInteger(options.expectedBytes) ||\n    options.expectedBytes < 1 ||\n    options.expectedBytes > maxBytes ||\n    !/^[a-f0-9]{64}$/.test(options.expectedSha256)\n  )\n    throw new ReleaseArtifactError(\"Release artifact metadata is invalid\");\n  await mkdir(path.dirname(options.destination), { recursive: true });\n  const writer = Bun.file(options.destination).writer();\n  const hasher = new Bun.CryptoHasher(\"sha256\");\n  const reader = options.stream.getReader();\n  let bytes = 0;\n  try {\n    while (true) {\n      const { done, value: chunk } = await reader.read();\n      if (done) break;\n      bytes += chunk.byteLength;\n      if (bytes > options.expectedBytes || bytes > maxBytes)\n        throw new ReleaseArtifactError(\n          \"Release artifact exceeds its declared size\",\n        );\n      hasher.update(chunk);\n      writer.write(chunk);\n    }\n  } catch (error) {\n    await rm(options.destination, { force: true });\n    throw error;\n  } finally {\n    reader.releaseLock();\n    await writer.end();\n  }\n  if (\n    bytes !== options.expectedBytes ||\n    hasher.digest(\"hex\") !== options.expectedSha256\n  ) {\n    await rm(options.destination, { force: true });\n    throw new ReleaseArtifactError(\n      \"Release artifact integrity verification failed\",\n    );\n  }\n\n  return { bytes, sha256: options.expectedSha256 };\n};\n\nexport const extractReleaseArtifact = async (options: {\n  archivePath: string;\n  destination: string;\n}) => {\n  const [names, verbose] = await Promise.all([\n    run([\"tar\", \"-tzf\", options.archivePath]),\n    run([\"tar\", \"-tvzf\", options.archivePath]),\n  ]);\n  const unsafePath = names\n    .split(\"\\n\")\n    .filter(Boolean)\n    .some(\n      (entry) =>\n        entry.startsWith(\"/\") || entry.split(\"/\").some((part) => part === \"..\"),\n    );\n  const unsafeType = verbose\n    .split(\"\\n\")\n    .filter(Boolean)\n    .some((entry) => entry[0] !== \"-\" && entry[0] !== \"d\");\n  if (unsafePath || unsafeType)\n    throw new ReleaseArtifactError(\"Release artifact contains an unsafe entry\");\n  await rm(options.destination, { force: true, recursive: true });\n  await mkdir(options.destination, { recursive: true });\n  await run([\n    \"tar\",\n    \"-xzf\",\n    options.archivePath,\n    \"--no-same-owner\",\n    \"--no-same-permissions\",\n    \"-C\",\n    options.destination,\n  ]);\n  if (\n    !(await Bun.file(path.join(options.destination, \"package.json\")).exists())\n  )\n    throw new ReleaseArtifactError(\"Release artifact has no package.json\");\n\n  return { extracted: true } as const;\n};\n"
+    "import { mkdir, mkdtemp, rm, stat } from \"node:fs/promises\";\nimport { tmpdir } from \"node:os\";\nimport path from \"node:path\";\n\nconst DEFAULT_MAX_BYTES = 2_147_483_648;\nconst ERROR_DETAIL_LIMIT = 500;\nconst SAFE_RELEASE_ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;\n\nexport type ReleaseArtifactMetadata = {\n  bytes: number;\n  releaseId: string;\n  sha256: string;\n};\n\nexport type CreatedReleaseArtifact = {\n  dispose: () => Promise<void>;\n  file: Bun.BunFile;\n  metadata: ReleaseArtifactMetadata;\n  path: string;\n};\n\nexport class ReleaseArtifactError extends Error {}\n\nconst run = async (command: string[]) => {\n  const process = Bun.spawn(command, { stderr: \"pipe\", stdout: \"pipe\" });\n  const [exitCode, stderr, stdout] = await Promise.all([\n    process.exited,\n    new Response(process.stderr).text(),\n    new Response(process.stdout).text(),\n  ]);\n  if (exitCode !== 0)\n    throw new ReleaseArtifactError(\n      `${command[0]} failed (${exitCode}): ${stderr.slice(0, ERROR_DETAIL_LIMIT)}`,\n    );\n\n  return stdout;\n};\n\nconst assertReleaseId = (value: string) => {\n  if (!SAFE_RELEASE_ID.test(value))\n    throw new ReleaseArtifactError(\"Release id is invalid\");\n\n  return value;\n};\n\nconst assertExclude = (value: string) => {\n  if (\n    value.length === 0 ||\n    value.startsWith(\"-\") ||\n    value.startsWith(\"/\") ||\n    value.split(\"/\").some((part) => part === \"..\") ||\n    /[\\0\\r\\n]/.test(value)\n  )\n    throw new ReleaseArtifactError(`Invalid release exclusion: ${value}`);\n\n  return value.replace(/^\\.\\//, \"\");\n};\n\nconst sha256File = async (file: Blob) => {\n  const hasher = new Bun.CryptoHasher(\"sha256\");\n  for await (const chunk of file.stream()) hasher.update(chunk);\n\n  return hasher.digest(\"hex\");\n};\n\nexport const createReleaseArtifact = async (options: {\n  exclude?: string[];\n  releaseId?: string;\n  sourceRoot: string;\n  temporaryRoot?: string;\n}): Promise<CreatedReleaseArtifact> => {\n  const releaseId = assertReleaseId(options.releaseId ?? crypto.randomUUID());\n  const source = path.resolve(options.sourceRoot);\n  const sourceStats = await stat(source).catch(() => null);\n  if (!sourceStats?.isDirectory())\n    throw new ReleaseArtifactError(\"Release source root is not a directory\");\n  if (!(await Bun.file(path.join(source, \"package.json\")).exists()))\n    throw new ReleaseArtifactError(\"Release source has no package.json\");\n  const temporary = await mkdtemp(\n    path.join(options.temporaryRoot ?? tmpdir(), \"absolutejs-release-\"),\n  );\n  const archivePath = path.join(temporary, `${releaseId}.tgz`);\n  try {\n    await run([\n      \"tar\",\n      \"-czf\",\n      archivePath,\n      ...(options.exclude ?? []).map(\n        (value) => `--exclude=./${assertExclude(value)}`,\n      ),\n      \"-C\",\n      source,\n      \".\",\n    ]);\n    const file = Bun.file(archivePath);\n\n    return {\n      dispose: () => rm(temporary, { force: true, recursive: true }),\n      file,\n      metadata: {\n        bytes: file.size,\n        releaseId,\n        sha256: await sha256File(file),\n      },\n      path: archivePath,\n    };\n  } catch (error) {\n    await rm(temporary, { force: true, recursive: true });\n    throw error;\n  }\n};\n\nexport const receiveReleaseArtifact = async (options: {\n  destination: string;\n  expectedBytes: number;\n  expectedSha256: string;\n  maxBytes?: number;\n  stream: ReadableStream<Uint8Array>;\n}) => {\n  const maxBytes = options.maxBytes ?? DEFAULT_MAX_BYTES;\n  if (\n    !Number.isSafeInteger(options.expectedBytes) ||\n    options.expectedBytes < 1 ||\n    options.expectedBytes > maxBytes ||\n    !/^[a-f0-9]{64}$/.test(options.expectedSha256)\n  )\n    throw new ReleaseArtifactError(\"Release artifact metadata is invalid\");\n  await mkdir(path.dirname(options.destination), { recursive: true });\n  const writer = Bun.file(options.destination).writer();\n  const hasher = new Bun.CryptoHasher(\"sha256\");\n  const reader = options.stream.getReader();\n  let bytes = 0;\n  try {\n    while (true) {\n      const { done, value: chunk } = await reader.read();\n      if (done) break;\n      bytes += chunk.byteLength;\n      if (bytes > options.expectedBytes || bytes > maxBytes)\n        throw new ReleaseArtifactError(\n          \"Release artifact exceeds its declared size\",\n        );\n      hasher.update(chunk);\n      writer.write(chunk);\n    }\n  } catch (error) {\n    await rm(options.destination, { force: true });\n    throw error;\n  } finally {\n    await writer.end();\n  }\n  if (\n    bytes !== options.expectedBytes ||\n    hasher.digest(\"hex\") !== options.expectedSha256\n  ) {\n    await rm(options.destination, { force: true });\n    throw new ReleaseArtifactError(\n      \"Release artifact integrity verification failed\",\n    );\n  }\n\n  return { bytes, sha256: options.expectedSha256 };\n};\n\nexport const extractReleaseArtifact = async (options: {\n  archivePath: string;\n  destination: string;\n}) => {\n  const [names, verbose] = await Promise.all([\n    run([\"tar\", \"-tzf\", options.archivePath]),\n    run([\"tar\", \"-tvzf\", options.archivePath]),\n  ]);\n  const unsafePath = names\n    .split(\"\\n\")\n    .filter(Boolean)\n    .some(\n      (entry) =>\n        entry.startsWith(\"/\") || entry.split(\"/\").some((part) => part === \"..\"),\n    );\n  const unsafeType = verbose\n    .split(\"\\n\")\n    .filter(Boolean)\n    .some((entry) => entry[0] !== \"-\" && entry[0] !== \"d\");\n  if (unsafePath || unsafeType)\n    throw new ReleaseArtifactError(\"Release artifact contains an unsafe entry\");\n  await rm(options.destination, { force: true, recursive: true });\n  await mkdir(options.destination, { recursive: true });\n  await run([\n    \"tar\",\n    \"-xzf\",\n    options.archivePath,\n    \"--no-same-owner\",\n    \"--no-same-permissions\",\n    \"-C\",\n    options.destination,\n  ]);\n  if (\n    !(await Bun.file(path.join(options.destination, \"package.json\")).exists())\n  )\n    throw new ReleaseArtifactError(\"Release artifact has no package.json\");\n\n  return { extracted: true } as const;\n};\n"
   ],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AACA;AACA;AAEA,IAAM,oBAAoB;AAC1B,IAAM,qBAAqB;AAC3B,IAAM,kBAAkB;AAAA;AAejB,MAAM,6BAA6B,MAAM;AAAC;AAEjD,IAAM,MAAM,OAAO,YAAsB;AAAA,EACvC,MAAM,UAAU,IAAI,MAAM,SAAS,EAAE,QAAQ,QAAQ,QAAQ,OAAO,CAAC;AAAA,EACrE,OAAO,UAAU,QAAQ,UAAU,MAAM,QAAQ,IAAI;AAAA,IACnD,QAAQ;AAAA,IACR,IAAI,SAAS,QAAQ,MAAM,EAAE,KAAK;AAAA,IAClC,IAAI,SAAS,QAAQ,MAAM,EAAE,KAAK;AAAA,EACpC,CAAC;AAAA,EACD,IAAI,aAAa;AAAA,IACf,MAAM,IAAI,qBACR,GAAG,QAAQ,cAAc,cAAc,OAAO,MAAM,GAAG,kBAAkB,GAC3E;AAAA,EAEF,OAAO;AAAA;AAGT,IAAM,kBAAkB,CAAC,UAAkB;AAAA,EACzC,IAAI,CAAC,gBAAgB,KAAK,KAAK;AAAA,IAC7B,MAAM,IAAI,qBAAqB,uBAAuB;AAAA,EAExD,OAAO;AAAA;AAGT,IAAM,gBAAgB,CAAC,UAAkB;AAAA,EACvC,IACE,MAAM,WAAW,KACjB,MAAM,WAAW,GAAG,KACpB,MAAM,WAAW,GAAG,KACpB,MAAM,MAAM,GAAG,EAAE,KAAK,CAAC,SAAS,SAAS,IAAI,KAC7C,WAAW,KAAK,KAAK;AAAA,IAErB,MAAM,IAAI,qBAAqB,8BAA8B,OAAO;AAAA,EAEtE,OAAO,MAAM,QAAQ,SAAS,EAAE;AAAA;AAGlC,IAAM,aAAa,OAAO,SAAe;AAAA,EACvC,MAAM,SAAS,IAAI,IAAI,aAAa,QAAQ;AAAA,EAC5C,iBAAiB,SAAS,KAAK,OAAO;AAAA,IAAG,OAAO,OAAO,KAAK;AAAA,EAE5D,OAAO,OAAO,OAAO,KAAK;AAAA;AAGrB,IAAM,wBAAwB,OAAO,YAKL;AAAA,EACrC,MAAM,YAAY,gBAAgB,QAAQ,aAAa,OAAO,WAAW,CAAC;AAAA,EAC1E,MAAM,SAAS,KAAK,QAAQ,QAAQ,UAAU;AAAA,EAC9C,MAAM,cAAc,MAAM,KAAK,MAAM,EAAE,MAAM,MAAM,IAAI;AAAA,EACvD,IAAI,CAAC,aAAa,YAAY;AAAA,IAC5B,MAAM,IAAI,qBAAqB,wCAAwC;AAAA,EACzE,IAAI,CAAE,MAAM,IAAI,KAAK,KAAK,KAAK,QAAQ,cAAc,CAAC,EAAE,OAAO;AAAA,IAC7D,MAAM,IAAI,qBAAqB,oCAAoC;AAAA,EACrE,MAAM,YAAY,MAAM,QACtB,KAAK,KAAK,QAAQ,iBAAiB,OAAO,GAAG,qBAAqB,CACpE;AAAA,EACA,MAAM,cAAc,KAAK,KAAK,WAAW,GAAG,eAAe;AAAA,EAC3D,IAAI;AAAA,IACF,MAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,MACA,IAAI,QAAQ,WAAW,CAAC,GAAG,IACzB,CAAC,UAAU,eAAe,cAAc,KAAK,GAC/C;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,IACD,MAAM,OAAO,IAAI,KAAK,WAAW;AAAA,IAEjC,OAAO;AAAA,MACL,SAAS,MAAM,GAAG,WAAW,EAAE,OAAO,MAAM,WAAW,KAAK,CAAC;AAAA,MAC7D;AAAA,MACA,UAAU;AAAA,QACR,OAAO,KAAK;AAAA,QACZ;AAAA,QACA,QAAQ,MAAM,WAAW,IAAI;AAAA,MAC/B;AAAA,MACA,MAAM;AAAA,IACR;AAAA,IACA,OAAO,OAAO;AAAA,IACd,MAAM,GAAG,WAAW,EAAE,OAAO,MAAM,WAAW,KAAK,CAAC;AAAA,IACpD,MAAM;AAAA;AAAA;AAIH,IAAM,yBAAyB,OAAO,YAMvC;AAAA,EACJ,MAAM,WAAW,QAAQ,YAAY;AAAA,EACrC,IACE,CAAC,OAAO,cAAc,QAAQ,aAAa,KAC3C,QAAQ,gBAAgB,KACxB,QAAQ,gBAAgB,YACxB,CAAC,iBAAiB,KAAK,QAAQ,cAAc;AAAA,IAE7C,MAAM,IAAI,qBAAqB,sCAAsC;AAAA,EACvE,MAAM,MAAM,KAAK,QAAQ,QAAQ,WAAW,GAAG,EAAE,WAAW,KAAK,CAAC;AAAA,EAClE,MAAM,SAAS,IAAI,KAAK,QAAQ,WAAW,EAAE,OAAO;AAAA,EACpD,MAAM,SAAS,IAAI,IAAI,aAAa,QAAQ;AAAA,EAC5C,MAAM,SAAS,QAAQ,OAAO,UAAU;AAAA,EACxC,IAAI,QAAQ;AAAA,EACZ,IAAI;AAAA,IACF,OAAO,MAAM;AAAA,MACX,QAAQ,MAAM,OAAO,UAAU,MAAM,OAAO,KAAK;AAAA,MACjD,IAAI;AAAA,QAAM;AAAA,MACV,SAAS,MAAM;AAAA,MACf,IAAI,QAAQ,QAAQ,iBAAiB,QAAQ;AAAA,QAC3C,MAAM,IAAI,qBACR,4CACF;AAAA,MACF,OAAO,OAAO,KAAK;AAAA,MACnB,OAAO,MAAM,KAAK;AAAA,IACpB;AAAA,IACA,OAAO,OAAO;AAAA,IACd,MAAM,GAAG,QAAQ,aAAa,EAAE,OAAO,KAAK,CAAC;AAAA,IAC7C,MAAM;AAAA,YACN;AAAA,IACA,OAAO,YAAY;AAAA,IACnB,MAAM,OAAO,IAAI;AAAA;AAAA,EAEnB,IACE,UAAU,QAAQ,iBAClB,OAAO,OAAO,KAAK,MAAM,QAAQ,gBACjC;AAAA,IACA,MAAM,GAAG,QAAQ,aAAa,EAAE,OAAO,KAAK,CAAC;AAAA,IAC7C,MAAM,IAAI,qBACR,gDACF;AAAA,EACF;AAAA,EAEA,OAAO,EAAE,OAAO,QAAQ,QAAQ,eAAe;AAAA;AAG1C,IAAM,yBAAyB,OAAO,YAGvC;AAAA,EACJ,OAAO,OAAO,WAAW,MAAM,QAAQ,IAAI;AAAA,IACzC,IAAI,CAAC,OAAO,QAAQ,QAAQ,WAAW,CAAC;AAAA,IACxC,IAAI,CAAC,OAAO,SAAS,QAAQ,WAAW,CAAC;AAAA,EAC3C,CAAC;AAAA,EACD,MAAM,aAAa,MAChB,MAAM;AAAA,CAAI,EACV,OAAO,OAAO,EACd,KACC,CAAC,UACC,MAAM,WAAW,GAAG,KAAK,MAAM,MAAM,GAAG,EAAE,KAAK,CAAC,SAAS,SAAS,IAAI,CAC1E;AAAA,EACF,MAAM,aAAa,QAChB,MAAM;AAAA,CAAI,EACV,OAAO,OAAO,EACd,KAAK,CAAC,UAAU,MAAM,OAAO,OAAO,MAAM,OAAO,GAAG;AAAA,EACvD,IAAI,cAAc;AAAA,IAChB,MAAM,IAAI,qBAAqB,2CAA2C;AAAA,EAC5E,MAAM,GAAG,QAAQ,aAAa,EAAE,OAAO,MAAM,WAAW,KAAK,CAAC;AAAA,EAC9D,MAAM,MAAM,QAAQ,aAAa,EAAE,WAAW,KAAK,CAAC;AAAA,EACpD,MAAM,IAAI;AAAA,IACR;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,EACV,CAAC;AAAA,EACD,IACE,CAAE,MAAM,IAAI,KAAK,KAAK,KAAK,QAAQ,aAAa,cAAc,CAAC,EAAE,OAAO;AAAA,IAExE,MAAM,IAAI,qBAAqB,sCAAsC;AAAA,EAEvE,OAAO,EAAE,WAAW,KAAK;AAAA;",
-  "debugId": "7AC624D04445253564756E2164756E21",
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AACA;AACA;AAEA,IAAM,oBAAoB;AAC1B,IAAM,qBAAqB;AAC3B,IAAM,kBAAkB;AAAA;AAejB,MAAM,6BAA6B,MAAM;AAAC;AAEjD,IAAM,MAAM,OAAO,YAAsB;AAAA,EACvC,MAAM,UAAU,IAAI,MAAM,SAAS,EAAE,QAAQ,QAAQ,QAAQ,OAAO,CAAC;AAAA,EACrE,OAAO,UAAU,QAAQ,UAAU,MAAM,QAAQ,IAAI;AAAA,IACnD,QAAQ;AAAA,IACR,IAAI,SAAS,QAAQ,MAAM,EAAE,KAAK;AAAA,IAClC,IAAI,SAAS,QAAQ,MAAM,EAAE,KAAK;AAAA,EACpC,CAAC;AAAA,EACD,IAAI,aAAa;AAAA,IACf,MAAM,IAAI,qBACR,GAAG,QAAQ,cAAc,cAAc,OAAO,MAAM,GAAG,kBAAkB,GAC3E;AAAA,EAEF,OAAO;AAAA;AAGT,IAAM,kBAAkB,CAAC,UAAkB;AAAA,EACzC,IAAI,CAAC,gBAAgB,KAAK,KAAK;AAAA,IAC7B,MAAM,IAAI,qBAAqB,uBAAuB;AAAA,EAExD,OAAO;AAAA;AAGT,IAAM,gBAAgB,CAAC,UAAkB;AAAA,EACvC,IACE,MAAM,WAAW,KACjB,MAAM,WAAW,GAAG,KACpB,MAAM,WAAW,GAAG,KACpB,MAAM,MAAM,GAAG,EAAE,KAAK,CAAC,SAAS,SAAS,IAAI,KAC7C,WAAW,KAAK,KAAK;AAAA,IAErB,MAAM,IAAI,qBAAqB,8BAA8B,OAAO;AAAA,EAEtE,OAAO,MAAM,QAAQ,SAAS,EAAE;AAAA;AAGlC,IAAM,aAAa,OAAO,SAAe;AAAA,EACvC,MAAM,SAAS,IAAI,IAAI,aAAa,QAAQ;AAAA,EAC5C,iBAAiB,SAAS,KAAK,OAAO;AAAA,IAAG,OAAO,OAAO,KAAK;AAAA,EAE5D,OAAO,OAAO,OAAO,KAAK;AAAA;AAGrB,IAAM,wBAAwB,OAAO,YAKL;AAAA,EACrC,MAAM,YAAY,gBAAgB,QAAQ,aAAa,OAAO,WAAW,CAAC;AAAA,EAC1E,MAAM,SAAS,KAAK,QAAQ,QAAQ,UAAU;AAAA,EAC9C,MAAM,cAAc,MAAM,KAAK,MAAM,EAAE,MAAM,MAAM,IAAI;AAAA,EACvD,IAAI,CAAC,aAAa,YAAY;AAAA,IAC5B,MAAM,IAAI,qBAAqB,wCAAwC;AAAA,EACzE,IAAI,CAAE,MAAM,IAAI,KAAK,KAAK,KAAK,QAAQ,cAAc,CAAC,EAAE,OAAO;AAAA,IAC7D,MAAM,IAAI,qBAAqB,oCAAoC;AAAA,EACrE,MAAM,YAAY,MAAM,QACtB,KAAK,KAAK,QAAQ,iBAAiB,OAAO,GAAG,qBAAqB,CACpE;AAAA,EACA,MAAM,cAAc,KAAK,KAAK,WAAW,GAAG,eAAe;AAAA,EAC3D,IAAI;AAAA,IACF,MAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,MACA,IAAI,QAAQ,WAAW,CAAC,GAAG,IACzB,CAAC,UAAU,eAAe,cAAc,KAAK,GAC/C;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,IACD,MAAM,OAAO,IAAI,KAAK,WAAW;AAAA,IAEjC,OAAO;AAAA,MACL,SAAS,MAAM,GAAG,WAAW,EAAE,OAAO,MAAM,WAAW,KAAK,CAAC;AAAA,MAC7D;AAAA,MACA,UAAU;AAAA,QACR,OAAO,KAAK;AAAA,QACZ;AAAA,QACA,QAAQ,MAAM,WAAW,IAAI;AAAA,MAC/B;AAAA,MACA,MAAM;AAAA,IACR;AAAA,IACA,OAAO,OAAO;AAAA,IACd,MAAM,GAAG,WAAW,EAAE,OAAO,MAAM,WAAW,KAAK,CAAC;AAAA,IACpD,MAAM;AAAA;AAAA;AAIH,IAAM,yBAAyB,OAAO,YAMvC;AAAA,EACJ,MAAM,WAAW,QAAQ,YAAY;AAAA,EACrC,IACE,CAAC,OAAO,cAAc,QAAQ,aAAa,KAC3C,QAAQ,gBAAgB,KACxB,QAAQ,gBAAgB,YACxB,CAAC,iBAAiB,KAAK,QAAQ,cAAc;AAAA,IAE7C,MAAM,IAAI,qBAAqB,sCAAsC;AAAA,EACvE,MAAM,MAAM,KAAK,QAAQ,QAAQ,WAAW,GAAG,EAAE,WAAW,KAAK,CAAC;AAAA,EAClE,MAAM,SAAS,IAAI,KAAK,QAAQ,WAAW,EAAE,OAAO;AAAA,EACpD,MAAM,SAAS,IAAI,IAAI,aAAa,QAAQ;AAAA,EAC5C,MAAM,SAAS,QAAQ,OAAO,UAAU;AAAA,EACxC,IAAI,QAAQ;AAAA,EACZ,IAAI;AAAA,IACF,OAAO,MAAM;AAAA,MACX,QAAQ,MAAM,OAAO,UAAU,MAAM,OAAO,KAAK;AAAA,MACjD,IAAI;AAAA,QAAM;AAAA,MACV,SAAS,MAAM;AAAA,MACf,IAAI,QAAQ,QAAQ,iBAAiB,QAAQ;AAAA,QAC3C,MAAM,IAAI,qBACR,4CACF;AAAA,MACF,OAAO,OAAO,KAAK;AAAA,MACnB,OAAO,MAAM,KAAK;AAAA,IACpB;AAAA,IACA,OAAO,OAAO;AAAA,IACd,MAAM,GAAG,QAAQ,aAAa,EAAE,OAAO,KAAK,CAAC;AAAA,IAC7C,MAAM;AAAA,YACN;AAAA,IACA,MAAM,OAAO,IAAI;AAAA;AAAA,EAEnB,IACE,UAAU,QAAQ,iBAClB,OAAO,OAAO,KAAK,MAAM,QAAQ,gBACjC;AAAA,IACA,MAAM,GAAG,QAAQ,aAAa,EAAE,OAAO,KAAK,CAAC;AAAA,IAC7C,MAAM,IAAI,qBACR,gDACF;AAAA,EACF;AAAA,EAEA,OAAO,EAAE,OAAO,QAAQ,QAAQ,eAAe;AAAA;AAG1C,IAAM,yBAAyB,OAAO,YAGvC;AAAA,EACJ,OAAO,OAAO,WAAW,MAAM,QAAQ,IAAI;AAAA,IACzC,IAAI,CAAC,OAAO,QAAQ,QAAQ,WAAW,CAAC;AAAA,IACxC,IAAI,CAAC,OAAO,SAAS,QAAQ,WAAW,CAAC;AAAA,EAC3C,CAAC;AAAA,EACD,MAAM,aAAa,MAChB,MAAM;AAAA,CAAI,EACV,OAAO,OAAO,EACd,KACC,CAAC,UACC,MAAM,WAAW,GAAG,KAAK,MAAM,MAAM,GAAG,EAAE,KAAK,CAAC,SAAS,SAAS,IAAI,CAC1E;AAAA,EACF,MAAM,aAAa,QAChB,MAAM;AAAA,CAAI,EACV,OAAO,OAAO,EACd,KAAK,CAAC,UAAU,MAAM,OAAO,OAAO,MAAM,OAAO,GAAG;AAAA,EACvD,IAAI,cAAc;AAAA,IAChB,MAAM,IAAI,qBAAqB,2CAA2C;AAAA,EAC5E,MAAM,GAAG,QAAQ,aAAa,EAAE,OAAO,MAAM,WAAW,KAAK,CAAC;AAAA,EAC9D,MAAM,MAAM,QAAQ,aAAa,EAAE,WAAW,KAAK,CAAC;AAAA,EACpD,MAAM,IAAI;AAAA,IACR;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,EACV,CAAC;AAAA,EACD,IACE,CAAE,MAAM,IAAI,KAAK,KAAK,KAAK,QAAQ,aAAa,cAAc,CAAC,EAAE,OAAO;AAAA,IAExE,MAAM,IAAI,qBAAqB,sCAAsC;AAAA,EAEvE,OAAO,EAAE,WAAW,KAAK;AAAA;",
+  "debugId": "8414E4F4B329037664756E2164756E21",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@absolutejs/deploy",
-  "version": "0.21.1",
+  "version": "0.22.0",
   "description": "Generic Bun-project deploy pipeline. A Target (localTarget / sshTarget) is anywhere you can exec + upload — DigitalOcean droplets, Linode, Hetzner, Vultr, your own boxes. Bundled pipeline: prepare → upload → install → build → link → restart → verify. Atomic symlink swap, release history, prune, hooks. SSH shells out to system ssh/rsync — zero ssh2 deps.",
   "repository": {
     "type": "git",
@@ -30,7 +30,7 @@
     "release"
   ],
   "scripts": {
-    "build": "rm -rf dist && bun build src/index.ts src/releaseArtifact.ts src/infrastructure.ts src/ephemeralInfrastructure.ts src/edgeIngress.ts src/digitalocean.ts src/digitaloceanInfrastructure.ts src/digitaloceanEphemeralInfrastructure.ts src/digitaloceanIngress.ts src/gcp.ts src/gcpIngress.ts src/hetzner.ts src/hetznerInfrastructure.ts src/linode.ts src/linodeInfrastructure.ts src/vultr.ts src/vultrInfrastructure.ts src/dns.ts src/cloudflare.ts src/digitaloceanDns.ts src/hetznerDns.ts src/route53.ts src/tls.ts src/env.ts src/preview.ts src/managedPreview.ts --outdir dist --root src --sourcemap --target=bun && tsc --project tsconfig.build.json",
+    "build": "rm -rf dist && bun build src/index.ts src/releaseArtifact.ts src/nativeRelease.ts src/infrastructure.ts src/ephemeralInfrastructure.ts src/edgeIngress.ts src/digitalocean.ts src/digitaloceanInfrastructure.ts src/digitaloceanEphemeralInfrastructure.ts src/digitaloceanIngress.ts src/gcp.ts src/gcpIngress.ts src/hetzner.ts src/hetznerInfrastructure.ts src/linode.ts src/linodeInfrastructure.ts src/vultr.ts src/vultrInfrastructure.ts src/dns.ts src/cloudflare.ts src/digitaloceanDns.ts src/hetznerDns.ts src/route53.ts src/tls.ts src/env.ts src/preview.ts src/managedPreview.ts --outdir dist --root src --sourcemap --target=bun && tsc --project tsconfig.build.json",
     "test": "bun test tests/",
     "typecheck": "tsc --noEmit",
     "format": "prettier --write \"./**/*.{ts,json,md}\"",
@@ -86,6 +86,11 @@
       "import": "./dist/releaseArtifact.js",
       "default": "./dist/releaseArtifact.js"
     },
+    "./native-release": {
+      "types": "./dist/nativeRelease.d.ts",
+      "import": "./dist/nativeRelease.js",
+      "default": "./dist/nativeRelease.js"
+    },
     "./digitalocean-ingress": {
       "types": "./dist/digitaloceanIngress.d.ts",
       "import": "./dist/digitaloceanIngress.js",