@applift/core 0.7.2 → 0.8.1

package/dist/{project-4_orxby_.mjs → artifact-B2RCmWw9.mjs}

@@ -1,5 +1,168 @@
 import fs from "node:fs";
 import path from "node:path";
+import os from "node:os";
+import { spawnSync } from "node:child_process";
+import semver from "semver";
+//#region src/version/git.ts
+/**
+* git 只读/写小助手（bump 编排与推断共用）。
+* spawnSync + 超时；失败返回 ok:false 由调用方决定语义，不在此抛。
+*/
+function git(cwd, args) {
+	const r = spawnSync("git", args, {
+		cwd,
+		encoding: "utf8",
+		timeout: 6e4
+	});
+	return {
+		ok: !r.error && r.status === 0,
+		stdout: (r.stdout ?? "").trim(),
+		stderr: (r.stderr ?? "").trim()
+	};
+}
+function isGitRepo(cwd) {
+	return git(cwd, ["rev-parse", "--is-inside-work-tree"]).stdout === "true";
+}
+/** 宽松 semver 解析（可选 v/前缀，如 v4.1.0 / 4.1.0-beta.3 / release-4.1.0 里取 semver 部分） */
+function looseSemver(tag) {
+	const direct = semver.valid(tag);
+	if (direct) return direct;
+	const m = /(\d+\.\d+\.\d+(?:[-+][\w.-]+)?)/.exec(tag);
+	return m ? semver.valid(m[1]) ?? void 0 : void 0;
+}
+/**
+* 最新 semver tag（按版本序取最大，非创建时间——修复补打旧版本 tag 的场景更稳）。
+* 无 tag / 非 git 仓库返回 undefined。
+*/
+function latestSemverTag(cwd) {
+	const r = git(cwd, ["tag", "-l"]);
+	if (!r.ok) return void 0;
+	let best;
+	for (const raw of r.stdout.split("\n")) {
+		const t = raw.trim();
+		if (!t) continue;
+		const v = looseSemver(t);
+		if (!v) continue;
+		if (!best || semver.gt(v, best.v)) best = {
+			raw: t,
+			v
+		};
+	}
+	return best?.raw;
+}
+/** 锚点 tag..HEAD 的完整 commit messages（%B 含 footer，NUL 分隔——body 内建换行安全） */
+function commitsSince(cwd, ref) {
+	const r = git(cwd, [
+		"log",
+		ref ? `${ref}..HEAD` : "HEAD",
+		"--format=%B%x00",
+		"--no-merges"
+	]);
+	if (!r.ok) return [];
+	return r.stdout.split("\0").map((m) => m.trim()).filter(Boolean);
+}
+/** 工作区状态（--porcelain）。注意：不走通用 git()——其 stdout.trim() 会剥掉首行前导空格，
+*  破坏 porcelain 的两列状态位（" M file" → "M file"），此处保留原始行仅去行尾。 */
+function statusShort(cwd) {
+	const r = spawnSync("git", ["status", "--porcelain"], {
+		cwd,
+		encoding: "utf8",
+		timeout: 3e4
+	});
+	if (r.error || r.status !== 0) return [];
+	return (r.stdout ?? "").split("\n").map((l) => l.trimEnd()).filter(Boolean);
+}
+/**
+* release 分发成功后补 tag（tag = 实际已发布的正式版本；beta 不打 tag，追溯走 history）。
+* - tag 已存在（多端发布，前一端已打）→ 跳过
+* - dryRun / 无版本 / 非 git 仓库 → 不动、不炸（tag 失败不阻断发布主流程）
+*/
+function tagReleaseVersion(cwd, version, opts = {}) {
+	if (!version) return {
+		tagged: false,
+		reason: "无版本"
+	};
+	if (opts.dryRun) return {
+		tagged: false,
+		reason: "dry-run"
+	};
+	const tag = `v${version}`;
+	if (spawnSync("git", [
+		"rev-parse",
+		"-q",
+		"--verify",
+		`refs/tags/${tag}`
+	], {
+		cwd,
+		encoding: "utf8"
+	}).status === 0) return {
+		tagged: false,
+		reason: `tag ${tag} 已存在（前一端已发布）`
+	};
+	const r = spawnSync("git", ["tag", tag], {
+		cwd,
+		encoding: "utf8"
+	});
+	if (r.status !== 0) return {
+		tagged: false,
+		reason: `tag ${tag} 创建失败：${r.stderr.trim()}`
+	};
+	return { tagged: true };
+}
+//#endregion
+//#region src/update.ts
+/**
+* 热更能力契约：applift 的第三维扩展（framework × channel 之外的 update 维度）。
+*
+* provider 与 framework 绑定（如 react-native-update 只服务 RN 工程），由插件经
+* 'update:register' 注册；beta/release 管线的投递路由（热更 vs 原生包）消费 judge 结果，
+* 只做推荐与证据展示，最终投递方式由用户在确认界面拍板（CI 非交互时 uncertain 即中止）。
+*/
+/**
+* 投递路由：按当前 framework 匹配 provider 并执行判定。
+* - 无 provider / 无匹配 → null（走原生包路径，原始行为不受影响）
+* - 多个 provider 匹配同一 framework → 配置错误（一个框架一个热更实现）
+* 结论是推荐值：最终投递方式由用户在确认界面拍板，CI 非交互时 uncertain 中止
+*/
+async function routeDelivery(providers, ctx, diff, platform) {
+	const matched = providers.filter((p) => p.frameworks.includes(ctx.framework.id) && (!platform || !p.platforms || p.platforms.includes(platform)));
+	if (matched.length === 0) return null;
+	if (matched.length > 1) throw new Error(`多个热更 provider 匹配 framework「${ctx.framework.id}」：${matched.map((p) => p.id).join(", ")}——一个框架只应有一个热更实现`);
+	const provider = matched[0];
+	return {
+		provider,
+		judgement: await provider.judge(diff, ctx)
+	};
+}
+/**
+* 收集上个发版锚点（最新 semver tag）到工作区的变更文件列表。
+* 含未提交改动与未跟踪文件（pushy bundle 打包的是工作区内容，判定口径必须一致）。
+* 无锚点 / 非 git 仓库 → null（调用方按 uncertain 处理，不猜）。
+*/
+async function collectReleaseDiff(cwd) {
+	const anchor = latestSemverTag(cwd);
+	if (!anchor) return null;
+	const r = spawnSync("git", [
+		"diff",
+		"--name-only",
+		anchor
+	], {
+		cwd,
+		encoding: "utf8"
+	});
+	const untracked = spawnSync("git", [
+		"ls-files",
+		"--others",
+		"--exclude-standard"
+	], {
+		cwd,
+		encoding: "utf8"
+	});
+	if (r.status !== 0 || untracked.status !== 0) return null;
+	const files = [...r.stdout.split("\n"), ...untracked.stdout.split("\n")].map((l) => l.trim());
+	return [...new Set(files)].filter(Boolean);
+}
+//#endregion
 //#region src/framework.ts
 /**
 * 框架适配器：让 applift 框架无关（RN / Flutter / 原生安卓 / 原生 iOS / 原生鸿蒙）。
@@ -803,4 +966,80 @@ function writeProjectVersions(cwd, framework, writes) {
 	};
 }
 //#endregion
-export { readJson as C, findArtifacts as S, subdirs as T, suggestFramework as _, electronFramework as a, deps as b, knownFrameworkAdapters as c, nativeHarmonyAdapter as d, nativeHarmonyFramework as f, rnFramework as g, rnAdapter as h, electronAdapter as i, nativeAndroidAdapter as l, nativeIosFramework as m, writeProjectVersions as n, flutterAdapter as o, nativeIosAdapter as p, redactText as r, flutterFramework as s, readProjectVersions as t, nativeAndroidFramework as u, tauriAdapter as v, resolveFramework as w, detectBundleIds as x, tauriFramework as y };
+//#region src/version/artifact.ts
+/**
+* 产物版本读取（只读不写——版本号变更属开发提交，发版工具只负责读版本防回退）。
+* .hap/.app：pack.info 是纯 JSON，零依赖直接读；
+* .apk：aapt2/aapt dump badging（ANDROID_HOME/SDK 探测，同 oppo 渠道逻辑）；
+* .ipa：二进制 plist 解析成本高，不支持自动读（返回 undefined，doctor 提示用 --version/配置）。
+*/
+function readArtifactVersion(artifactPath) {
+	const ext = path.extname(artifactPath).toLowerCase();
+	if (ext === ".hap" || ext === ".app") return fromPackInfo(artifactPath);
+	if (ext === ".apk") return fromAapt(artifactPath);
+}
+/** 鸿蒙包版本读取：优先包内 pack.info（zip 容器内的权威数据），回退同目录 pack.info（标注可能过期） */
+function fromPackInfo(artifactPath) {
+	const r = spawnSync("unzip", [
+		"-p",
+		artifactPath,
+		"pack.info"
+	], {
+		timeout: 1e4,
+		encoding: "utf8"
+	});
+	if (!r.error && r.status === 0 && r.stdout) {
+		const v = parsePackInfo(r.stdout, "pack.info(包内)");
+		if (v) return v;
+	}
+	const side = path.join(path.dirname(artifactPath), "pack.info");
+	if (fs.existsSync(side)) try {
+		const v = parsePackInfo(fs.readFileSync(side, "utf8"), "pack.info(同目录,可能过期)");
+		if (v) return v;
+	} catch {}
+}
+/** 真实鸿蒙 pack.info schema（qy-driver 实测样本）：summary.app.version.{name,code,build}；
+*  顶层 versionName/versionCode 为历史兼容形态。 */
+function parsePackInfo(text, source) {
+	try {
+		const info = JSON.parse(text);
+		const nested = info.summary?.app?.version;
+		const versionName = nested?.name ?? info.versionName;
+		const versionCode = nested?.code ?? info.versionCode;
+		if (versionName || versionCode !== void 0) return {
+			versionName,
+			versionCode: String(versionCode ?? ""),
+			source
+		};
+	} catch {}
+}
+/** APK：aapt2/aapt dump badging（versionCode/versionName） */
+function fromAapt(artifactPath) {
+	const tools = [];
+	const sdkDir = process.env.ANDROID_HOME ?? path.join(os.homedir(), "Library/Android/sdk");
+	const btDir = path.join(sdkDir, "build-tools");
+	if (fs.existsSync(btDir)) for (const bt of fs.readdirSync(btDir).sort().reverse()) for (const tool of ["aapt2", "aapt"]) {
+		const p = path.join(btDir, bt, tool);
+		if (fs.existsSync(p)) tools.push(p);
+	}
+	for (const tool of tools) {
+		const r = spawnSync(tool, [
+			"dump",
+			"badging",
+			artifactPath
+		], {
+			timeout: 1e4,
+			encoding: "utf8"
+		});
+		if (r.error || r.status !== 0) continue;
+		const name = /versionName='([^']*)'/.exec(r.stdout ?? "")?.[1];
+		const code = /versionCode='(\d+)'/.exec(r.stdout ?? "")?.[1];
+		if (name || code) return {
+			versionName: name,
+			versionCode: code,
+			source: path.basename(tool)
+		};
+	}
+}
+//#endregion
+export { git as A, findArtifacts as C, collectReleaseDiff as D, subdirs as E, tagReleaseVersion as F, latestSemverTag as M, looseSemver as N, routeDelivery as O, statusShort as P, detectBundleIds as S, resolveFramework as T, rnFramework as _, electronAdapter as a, tauriFramework as b, flutterFramework as c, nativeAndroidFramework as d, nativeHarmonyAdapter as f, rnAdapter as g, nativeIosFramework as h, redactText as i, isGitRepo as j, commitsSince as k, knownFrameworkAdapters as l, nativeIosAdapter as m, readProjectVersions as n, electronFramework as o, nativeHarmonyFramework as p, writeProjectVersions as r, flutterAdapter as s, readArtifactVersion as t, nativeAndroidAdapter as u, suggestFramework as v, readJson as w, deps as x, tauriAdapter as y };

package/dist/{frameworks-D83HVg8t.d.mts → frameworks-DJIt293o.d.mts}

@@ -351,16 +351,25 @@ interface UpdateProvider {
   platforms?: string[];
   /** 判定本次 diff 能否走热更（diff = 上个发版锚点到工作区的文件列表，含未提交与未跟踪） */
   judge(diff: string[], ctx: FrameworkContext): Promise<DeliveryJudgement> | DeliveryJudgement;
-  /** beta 热更路径：构建热更包并发到测试通道（测试设备验证用） */
-  publishToTest(ctx: PublishContext): Promise<{
+  /** release 热更路径（必选）：直接发热更正式——ppk 产物入口（--artifact/探测）→ 发布绑正式原生版本 + 灰度。
+   *  无内测流程的 provider 只实现此方法即可独立完成正式热更发布（热更不依赖 beta） */
+  publishToProd(ctx: PublishContext): Promise<{
     versionName: string;
     versionId: number;
+    rollout?: number;
   }>;
-  /** release 热更路径：测试通道最新已验证热更 promote 到正式（重绑正式原生版本 + 灰度） */
-  promoteToProd(ctx: PublishContext): Promise<{
+  /** beta 热更路径（可选）：热更包发测试通道（测试设备验证用）；无内测流程的 provider 不实现
+   *  （beta 判定 ota 时报错引导直接 release） */
+  publishToBeta?(ctx: PublishContext): Promise<{
     versionName: string;
-    rollout?: number;
+    versionId: number;
   }>;
+  /** release 热更路径（可选）：测试通道最新已验证热更 promote 到正式（重绑正式原生版本 + 灰度）。
+   *  返回 null = 测试通道无可 promote（调用方转 publishToProd 直接发布） */
+  promoteToProd?(ctx: PublishContext): Promise<{
+    versionName: string;
+    rollout?: number;
+  } | null>;
 }
 interface DeliveryRoute {
   provider: UpdateProvider;
@@ -373,6 +382,10 @@ interface PublishContext extends FrameworkContext {
   note?: string;
   /** release 热更的灰度比例（CLI 确认时收集；缺省用 provider 默认） */
   rollout?: number;
+  /** 已解析 profile 凭据（热更 provider 读服务端 token，如 PUSHY_API_TOKEN；dry-run 路径缺省） */
+  credentials?: Readonly<Record<string, string>>;
+  /** 显式指定的热更 ppk（--artifact 透传；热更产物入口，与原生 --artifact 对称） */
+  artifact?: string;
 }
 /**
  * 投递路由：按当前 framework 匹配 provider 并执行判定。
@@ -394,6 +407,8 @@ interface HookContext {
   channel?: string;
   /** 项目根目录 */
   cwd: string;
+  /** 该渠道已解析的 profile 凭据（stage/submit 级钩子才有；供基线上传类插件读服务端 token） */
+  credentials?: Readonly<Record<string, string>>;
 }
 interface AppliftPlugin {
   name: string;

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-import { $ as StoreConfigSchema, A as routeDelivery, B as appendEntry, C as resolvePlugins, Ct as subdirs, D as PublishContext, E as FrameworkContext, F as runSubmit, G as CredentialsFileSchema, H as BetaConfig, I as HISTORY_PATH, J as GlobalConfig, K as CredentialsProfile, L as HistoryEntry, M as PipelineSummary, N as PipelineSummaryEntry, O as UpdateProvider, P as runStage, Q as StoreConfig, R as HistoryEvent, S as defineConfig, St as resolveFramework, T as DeliveryRoute, U as BetaConfigSchema, V as readEntries, W as CredentialsFile, X as ProjectConfig, Y as GlobalConfigSchema, Z as ProjectConfigSchema, _ as AppliftPlugin, _t as Platform, a as knownFrameworkAdapters, at as VersionConfigSchema, b as PluginHookName, bt as findArtifacts, c as nativeHarmonyAdapter, ct as ChannelContext, d as nativeIosFramework, dt as ReleasePlanEntry, et as Stores, f as rnAdapter, ft as ReviewStatus, g as tauriFramework, gt as FrameworkAdapter, h as tauriAdapter, ht as BundleIds, i as flutterFramework, it as VersionConfig, j as PipelineInput, k as collectReleaseDiff, l as nativeHarmonyFramework, lt as ChannelEvent, m as suggestFramework, mt as SubmitResult, n as electronFramework, nt as VersionCodeConfig, o as nativeAndroidAdapter, ot as Channel, p as rnFramework, pt as StageResult, q as CredentialsProfileSchema, r as flutterAdapter, rt as VersionCodeConfigSchema, s as nativeAndroidFramework, st as ChannelCapabilities, t as electronAdapter, tt as StoresSchema, u as nativeIosAdapter, ut as ChannelRegistry, v as AppliftUserConfig, vt as deps, w as DeliveryJudgement, x as PluginHost, xt as readJson, y as HookContext, yt as detectBundleIds, z as HistoryQuery } from "./frameworks-D83HVg8t.mjs";
+import { $ as StoreConfigSchema, A as routeDelivery, B as appendEntry, C as resolvePlugins, Ct as subdirs, D as PublishContext, E as FrameworkContext, F as runSubmit, G as CredentialsFileSchema, H as BetaConfig, I as HISTORY_PATH, J as GlobalConfig, K as CredentialsProfile, L as HistoryEntry, M as PipelineSummary, N as PipelineSummaryEntry, O as UpdateProvider, P as runStage, Q as StoreConfig, R as HistoryEvent, S as defineConfig, St as resolveFramework, T as DeliveryRoute, U as BetaConfigSchema, V as readEntries, W as CredentialsFile, X as ProjectConfig, Y as GlobalConfigSchema, Z as ProjectConfigSchema, _ as AppliftPlugin, _t as Platform, a as knownFrameworkAdapters, at as VersionConfigSchema, b as PluginHookName, bt as findArtifacts, c as nativeHarmonyAdapter, ct as ChannelContext, d as nativeIosFramework, dt as ReleasePlanEntry, et as Stores, f as rnAdapter, ft as ReviewStatus, g as tauriFramework, gt as FrameworkAdapter, h as tauriAdapter, ht as BundleIds, i as flutterFramework, it as VersionConfig, j as PipelineInput, k as collectReleaseDiff, l as nativeHarmonyFramework, lt as ChannelEvent, m as suggestFramework, mt as SubmitResult, n as electronFramework, nt as VersionCodeConfig, o as nativeAndroidAdapter, ot as Channel, p as rnFramework, pt as StageResult, q as CredentialsProfileSchema, r as flutterAdapter, rt as VersionCodeConfigSchema, s as nativeAndroidFramework, st as ChannelCapabilities, t as electronAdapter, tt as StoresSchema, u as nativeIosAdapter, ut as ChannelRegistry, v as AppliftUserConfig, vt as deps, w as DeliveryJudgement, x as PluginHost, xt as readJson, y as HookContext, yt as detectBundleIds, z as HistoryQuery } from "./frameworks-DJIt293o.mjs";
 //#region src/registry.d.ts
 export declare class DefaultChannelRegistry implements ChannelRegistry {
   private readonly channels;

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { C as readJson, S as findArtifacts, T as subdirs, _ as suggestFramework, a as electronFramework, b as deps, c as knownFrameworkAdapters, d as nativeHarmonyAdapter, f as nativeHarmonyFramework, g as rnFramework, h as rnAdapter, i as electronAdapter, l as nativeAndroidAdapter, m as nativeIosFramework, n as writeProjectVersions, o as flutterAdapter, p as nativeIosAdapter, r as redactText, s as flutterFramework, t as readProjectVersions, u as nativeAndroidFramework, v as tauriAdapter, w as resolveFramework, x as detectBundleIds, y as tauriFramework } from "./project-4_orxby_.mjs";
+import { A as git, C as findArtifacts, D as collectReleaseDiff, E as subdirs, F as tagReleaseVersion, M as latestSemverTag, N as looseSemver, O as routeDelivery, P as statusShort, S as detectBundleIds, T as resolveFramework, _ as rnFramework, a as electronAdapter, b as tauriFramework, c as flutterFramework, d as nativeAndroidFramework, f as nativeHarmonyAdapter, g as rnAdapter, h as nativeIosFramework, i as redactText, j as isGitRepo, k as commitsSince, l as knownFrameworkAdapters, m as nativeIosAdapter, n as readProjectVersions, o as electronFramework, p as nativeHarmonyFramework, r as writeProjectVersions, s as flutterAdapter, t as readArtifactVersion, u as nativeAndroidAdapter, v as suggestFramework, w as readJson, x as deps, y as tauriAdapter } from "./artifact-B2RCmWw9.mjs";
 import { z } from "zod";
 import fs from "node:fs";
 import path from "node:path";
@@ -567,7 +567,7 @@ var PgyerChannel = class {
 			});
 		}
 		if (!token?.data) throw lastErr instanceof Error ? lastErr : /* @__PURE__ */ new Error("蒲公英凭证获取失败");
-		const { endpoint, params, buildKey } = token.data;
+		const { endpoint, params, key: buildKey } = token.data;
 		ctx.emit({
 			type: "phase",
 			phase: "upload",
@@ -3617,7 +3617,8 @@ async function runStage(input) {
 			};
 			if (plugins) await plugins.broadcast("stage:after", {
 				channel: channel.id,
-				cwd: input.cwd
+				cwd: input.cwd,
+				credentials: effectiveCtx.credentials
 			}, {
 				channel: channel.id,
 				ok: r.ok,
@@ -3740,7 +3741,8 @@ async function runSubmit(input, options) {
 				});
 				if (plugins) await plugins.broadcast("stage:after", {
 					channel: channel.id,
-					cwd: input.cwd
+					cwd: input.cwd,
+					credentials: effectiveCtx.credentials
 				}, {
 					channel: channel.id,
 					ok: true,
@@ -3817,166 +3819,6 @@ function planFor(plans, base, id, artifactPath) {
 	return plans.find((p) => p.channel === id) ?? base.get(id) ?? fallbackPlan(id, artifactPath);
 }
 //#endregion
-//#region src/version/git.ts
-/**
-* git 只读/写小助手（bump 编排与推断共用）。
-* spawnSync + 超时；失败返回 ok:false 由调用方决定语义，不在此抛。
-*/
-function git(cwd, args) {
-	const r = spawnSync("git", args, {
-		cwd,
-		encoding: "utf8",
-		timeout: 6e4
-	});
-	return {
-		ok: !r.error && r.status === 0,
-		stdout: (r.stdout ?? "").trim(),
-		stderr: (r.stderr ?? "").trim()
-	};
-}
-function isGitRepo(cwd) {
-	return git(cwd, ["rev-parse", "--is-inside-work-tree"]).stdout === "true";
-}
-/** 宽松 semver 解析（可选 v/前缀，如 v4.1.0 / 4.1.0-beta.3 / release-4.1.0 里取 semver 部分） */
-function looseSemver(tag) {
-	const direct = semver.valid(tag);
-	if (direct) return direct;
-	const m = /(\d+\.\d+\.\d+(?:[-+][\w.-]+)?)/.exec(tag);
-	return m ? semver.valid(m[1]) ?? void 0 : void 0;
-}
-/**
-* 最新 semver tag（按版本序取最大，非创建时间——修复补打旧版本 tag 的场景更稳）。
-* 无 tag / 非 git 仓库返回 undefined。
-*/
-function latestSemverTag(cwd) {
-	const r = git(cwd, ["tag", "-l"]);
-	if (!r.ok) return void 0;
-	let best;
-	for (const raw of r.stdout.split("\n")) {
-		const t = raw.trim();
-		if (!t) continue;
-		const v = looseSemver(t);
-		if (!v) continue;
-		if (!best || semver.gt(v, best.v)) best = {
-			raw: t,
-			v
-		};
-	}
-	return best?.raw;
-}
-/** 锚点 tag..HEAD 的完整 commit messages（%B 含 footer，NUL 分隔——body 内建换行安全） */
-function commitsSince(cwd, ref) {
-	const r = git(cwd, [
-		"log",
-		ref ? `${ref}..HEAD` : "HEAD",
-		"--format=%B%x00",
-		"--no-merges"
-	]);
-	if (!r.ok) return [];
-	return r.stdout.split("\0").map((m) => m.trim()).filter(Boolean);
-}
-/** 工作区状态（--porcelain）。注意：不走通用 git()——其 stdout.trim() 会剥掉首行前导空格，
-*  破坏 porcelain 的两列状态位（" M file" → "M file"），此处保留原始行仅去行尾。 */
-function statusShort(cwd) {
-	const r = spawnSync("git", ["status", "--porcelain"], {
-		cwd,
-		encoding: "utf8",
-		timeout: 3e4
-	});
-	if (r.error || r.status !== 0) return [];
-	return (r.stdout ?? "").split("\n").map((l) => l.trimEnd()).filter(Boolean);
-}
-/**
-* release 分发成功后补 tag（tag = 实际已发布的正式版本；beta 不打 tag，追溯走 history）。
-* - tag 已存在（多端发布，前一端已打）→ 跳过
-* - dryRun / 无版本 / 非 git 仓库 → 不动、不炸（tag 失败不阻断发布主流程）
-*/
-function tagReleaseVersion(cwd, version, opts = {}) {
-	if (!version) return {
-		tagged: false,
-		reason: "无版本"
-	};
-	if (opts.dryRun) return {
-		tagged: false,
-		reason: "dry-run"
-	};
-	const tag = `v${version}`;
-	if (spawnSync("git", [
-		"rev-parse",
-		"-q",
-		"--verify",
-		`refs/tags/${tag}`
-	], {
-		cwd,
-		encoding: "utf8"
-	}).status === 0) return {
-		tagged: false,
-		reason: `tag ${tag} 已存在（前一端已发布）`
-	};
-	const r = spawnSync("git", ["tag", tag], {
-		cwd,
-		encoding: "utf8"
-	});
-	if (r.status !== 0) return {
-		tagged: false,
-		reason: `tag ${tag} 创建失败：${r.stderr.trim()}`
-	};
-	return { tagged: true };
-}
-//#endregion
-//#region src/update.ts
-/**
-* 热更能力契约：applift 的第三维扩展（framework × channel 之外的 update 维度）。
-*
-* provider 与 framework 绑定（如 react-native-update 只服务 RN 工程），由插件经
-* 'update:register' 注册；beta/release 管线的投递路由（热更 vs 原生包）消费 judge 结果，
-* 只做推荐与证据展示，最终投递方式由用户在确认界面拍板（CI 非交互时 uncertain 即中止）。
-*/
-/**
-* 投递路由：按当前 framework 匹配 provider 并执行判定。
-* - 无 provider / 无匹配 → null（走原生包路径，原始行为不受影响）
-* - 多个 provider 匹配同一 framework → 配置错误（一个框架一个热更实现）
-* 结论是推荐值：最终投递方式由用户在确认界面拍板，CI 非交互时 uncertain 中止
-*/
-async function routeDelivery(providers, ctx, diff, platform) {
-	const matched = providers.filter((p) => p.frameworks.includes(ctx.framework.id) && (!platform || !p.platforms || p.platforms.includes(platform)));
-	if (matched.length === 0) return null;
-	if (matched.length > 1) throw new Error(`多个热更 provider 匹配 framework「${ctx.framework.id}」：${matched.map((p) => p.id).join(", ")}——一个框架只应有一个热更实现`);
-	const provider = matched[0];
-	return {
-		provider,
-		judgement: await provider.judge(diff, ctx)
-	};
-}
-/**
-* 收集上个发版锚点（最新 semver tag）到工作区的变更文件列表。
-* 含未提交改动与未跟踪文件（pushy bundle 打包的是工作区内容，判定口径必须一致）。
-* 无锚点 / 非 git 仓库 → null（调用方按 uncertain 处理，不猜）。
-*/
-async function collectReleaseDiff(cwd) {
-	const anchor = latestSemverTag(cwd);
-	if (!anchor) return null;
-	const r = spawnSync("git", [
-		"diff",
-		"--name-only",
-		anchor
-	], {
-		cwd,
-		encoding: "utf8"
-	});
-	const untracked = spawnSync("git", [
-		"ls-files",
-		"--others",
-		"--exclude-standard"
-	], {
-		cwd,
-		encoding: "utf8"
-	});
-	if (r.status !== 0 || untracked.status !== 0) return null;
-	const files = [...r.stdout.split("\n"), ...untracked.stdout.split("\n")].map((l) => l.trim());
-	return [...new Set(files)].filter(Boolean);
-}
-//#endregion
 //#region src/plugin.ts
 var PluginHost = class {
 	plugins;
@@ -4542,80 +4384,4 @@ function applyBump(cwd, plan, framework, opts) {
 	}
 }
 //#endregion
-//#region src/version/artifact.ts
-/**
-* 产物版本读取（只读不写——版本号变更属开发提交，发版工具只负责读版本防回退）。
-* .hap/.app：pack.info 是纯 JSON，零依赖直接读；
-* .apk：aapt2/aapt dump badging（ANDROID_HOME/SDK 探测，同 oppo 渠道逻辑）；
-* .ipa：二进制 plist 解析成本高，不支持自动读（返回 undefined，doctor 提示用 --version/配置）。
-*/
-function readArtifactVersion(artifactPath) {
-	const ext = path.extname(artifactPath).toLowerCase();
-	if (ext === ".hap" || ext === ".app") return fromPackInfo(artifactPath);
-	if (ext === ".apk") return fromAapt(artifactPath);
-}
-/** 鸿蒙包版本读取：优先包内 pack.info（zip 容器内的权威数据），回退同目录 pack.info（标注可能过期） */
-function fromPackInfo(artifactPath) {
-	const r = spawnSync("unzip", [
-		"-p",
-		artifactPath,
-		"pack.info"
-	], {
-		timeout: 1e4,
-		encoding: "utf8"
-	});
-	if (!r.error && r.status === 0 && r.stdout) {
-		const v = parsePackInfo(r.stdout, "pack.info(包内)");
-		if (v) return v;
-	}
-	const side = path.join(path.dirname(artifactPath), "pack.info");
-	if (fs.existsSync(side)) try {
-		const v = parsePackInfo(fs.readFileSync(side, "utf8"), "pack.info(同目录,可能过期)");
-		if (v) return v;
-	} catch {}
-}
-/** 真实鸿蒙 pack.info schema（qy-driver 实测样本）：summary.app.version.{name,code,build}；
-*  顶层 versionName/versionCode 为历史兼容形态。 */
-function parsePackInfo(text, source) {
-	try {
-		const info = JSON.parse(text);
-		const nested = info.summary?.app?.version;
-		const versionName = nested?.name ?? info.versionName;
-		const versionCode = nested?.code ?? info.versionCode;
-		if (versionName || versionCode !== void 0) return {
-			versionName,
-			versionCode: String(versionCode ?? ""),
-			source
-		};
-	} catch {}
-}
-/** APK：aapt2/aapt dump badging（versionCode/versionName） */
-function fromAapt(artifactPath) {
-	const tools = [];
-	const sdkDir = process.env.ANDROID_HOME ?? path.join(os.homedir(), "Library/Android/sdk");
-	const btDir = path.join(sdkDir, "build-tools");
-	if (fs.existsSync(btDir)) for (const bt of fs.readdirSync(btDir).sort().reverse()) for (const tool of ["aapt2", "aapt"]) {
-		const p = path.join(btDir, bt, tool);
-		if (fs.existsSync(p)) tools.push(p);
-	}
-	for (const tool of tools) {
-		const r = spawnSync(tool, [
-			"dump",
-			"badging",
-			artifactPath
-		], {
-			timeout: 1e4,
-			encoding: "utf8"
-		});
-		if (r.error || r.status !== 0) continue;
-		const name = /versionName='([^']*)'/.exec(r.stdout ?? "")?.[1];
-		const code = /versionCode='(\d+)'/.exec(r.stdout ?? "")?.[1];
-		if (name || code) return {
-			versionName: name,
-			versionCode: code,
-			source: path.basename(tool)
-		};
-	}
-}
-//#endregion
 export { APPLIFT_HOME, AgcHarmonyChannel, AscChannel, BetaConfigSchema, CREDENTIALS_PATH, CredentialsFileSchema, CredentialsProfileSchema, DefaultChannelRegistry, GLOBAL_CONFIG_PATH, GlobalConfigSchema, GooglePlayChannel, HISTORY_PATH, HonorChannel, HuaweiAndroidChannel, OppoChannel, PROJECTS_MAP_PATH, PgyerChannel, PluginHost, ProjectConfigSchema, StoreConfigSchema, StoresSchema, VersionCodeConfigSchema, VersionConfigSchema, VivoChannel, WAIT_BEFORE_SUBMIT_MS, XiaomiChannel, YybChannel, appendEntry, applyBump, assertListingFiles, collectReleaseDiff, commitsSince, decideNextVersion, defineConfig, deps, detectBundleIds, electronAdapter, electronFramework, evalVersionCodeFormula, findArtifacts, findUp, flutterAdapter, flutterFramework, formPost, getAgcToken, getHarmonyAppId, git, hmacSign, humanizeError, inferBumpLevel, isGitRepo, knownFrameworkAdapters, latestSemverTag, loadCredentials, loadCredentialsLayered, loadGlobalConfig, loadListingFile, loadProjectConfig, loadProjectProfileMap, looseSemver, md5File, md5String, nativeAndroidAdapter, nativeAndroidFramework, nativeHarmonyAdapter, nativeHarmonyFramework, nativeIosAdapter, nativeIosFramework, nextVersionCode, planBump, projectCredentialsPath, readArtifactVersion, readEntries, readJson, readProjectVersions, redactText, registry, renderChangelogSection, resolveFramework, resolveListing, resolvePlugins, resolveProfile, resolveProfileFor, resolveProfileSource, rnAdapter, rnFramework, routeDelivery, runStage, runSubmit, saveCredentials, saveProjectProfileMap, setProjectProfile, sha256File, sortedQueryString, statusShort, storeVersionName, subdirs, suggestFramework, tagReleaseVersion, tauriAdapter, tauriFramework, toChangelogEntries, tsMillis, tsSeconds, upsertChangelog, writeProjectVersions };

package/dist/plugins/index.d.mts

@@ -1,4 +1,4 @@
-import { E as FrameworkContext, O as UpdateProvider, _ as AppliftPlugin, a as knownFrameworkAdapters, c as nativeHarmonyAdapter, d as nativeIosFramework, f as rnAdapter, g as tauriFramework, h as tauriAdapter, i as flutterFramework, l as nativeHarmonyFramework, m as suggestFramework, n as electronFramework, o as nativeAndroidAdapter, p as rnFramework, r as flutterAdapter, s as nativeAndroidFramework, t as electronAdapter, u as nativeIosAdapter, w as DeliveryJudgement } from "../frameworks-D83HVg8t.mjs";
+import { E as FrameworkContext, O as UpdateProvider, _ as AppliftPlugin, a as knownFrameworkAdapters, c as nativeHarmonyAdapter, d as nativeIosFramework, f as rnAdapter, g as tauriFramework, h as tauriAdapter, i as flutterFramework, l as nativeHarmonyFramework, m as suggestFramework, n as electronFramework, o as nativeAndroidAdapter, p as rnFramework, r as flutterAdapter, s as nativeAndroidFramework, t as electronAdapter, u as nativeIosAdapter, w as DeliveryJudgement } from "../frameworks-DJIt293o.mjs";
 //#region src/plugins/dingtalk-notify.d.ts
 interface DingtalkNotifyOptions {
   webhook: string;
@@ -8,23 +8,18 @@ interface DingtalkNotifyOptions {
 }
 export declare function dingtalkNotify(options: DingtalkNotifyOptions): AppliftPlugin;
 //#endregion
-//#region src/plugins/pushy-cli.d.ts
-interface CliResult {
-  code: number;
-  stdout: string;
-  stderr: string;
-}
-type CliRunner = (args: string[], opts?: {
-  cwd?: string;
-}) => Promise<CliResult>;
-/** 默认 runner：spawn 全局 pushy，超时 10 分钟（bundle/upload 含网络大文件传输） */
-export declare function spawnPushy(args: string[], opts?: {
-  cwd?: string;
-}): Promise<CliResult>;
+//#region src/plugins/pushy-api.d.ts
+/**
+ * pushy 服务端操作契约（全 OpenAPI 实现；注入点：测试 mock）。
+ * ppk 不在此层：热更包是构建产物，由调用方先行产出（--artifact 显式或 ppkPatterns 探测，
+ * 见 rn-update.ts）——applift 不 spawn 构建命令（架构不变量 1）。
+ */
 interface PushyCli {
-  /** 构建热更包，返回 ppk 路径 */
-  bundle(platform: string, cwd?: string): Promise<string>;
-  /** 发布热更版本（publish），返回版本 id */
+  /** 发布热更版本（version/create + 绑定目标原生版本），返回版本 id。
+   *  deps 为服务端强校验所需（2026-09-17 后创建的应用要求 deps 里有 react-native-update
+   *  >= 10.53.1——实测缺省被 400 拒绝），由调用方用 readDepVersions 从工程读取。
+   *  不上报 commit：实测带 commit（官方 getCommitInfo 同构形态）被 version/create 以
+   *  「上传凭据无效」拒绝（2026-10-21 实证，去 commit 即过）；溯源走本地 history.jsonl */
   publish(input: {
     appId: number;
     ppk: string;
@@ -33,11 +28,12 @@ interface PushyCli {
     description?: string;
     packageVersion: string;
     rollout?: number;
+    deps: Record<string, string>;
   }): Promise<{
     versionId: number;
   }>;
-  /** 上传原生基线（基线版本号由服务端从包内读取） */
-  uploadApp(appId: number, appFile: string): Promise<{
+  /** 上传原生基线（versionName 由调用方从产物读取后显式传入；deps 同 publish） */
+  uploadApp(appId: number, appFile: string, versionName: string, deps: Record<string, string>): Promise<{
     packageId: number;
     version: string;
   }>;
@@ -55,7 +51,33 @@ interface PushyCli {
     name: string;
   }>>;
 }
-export declare function createPushyCli(runner?: CliRunner): PushyCli;
+/** credentials.json 中的 pushy token 键名 */
+export declare const PUSHY_TOKEN_KEY = "PUSHY_API_TOKEN";
+/** pushy 官方 API 根（官方 CLI 默认端点簇的主端点） */
+export declare const PUSHY_DEFAULT_BASE_URL = "https://update.reactnative.cn/api";
+type FetchImpl = (url: string, init?: RequestInit) => Promise<Response>;
+interface PushyApiOptions {
+  /** 服务端 API 根；缺省 pushy 官方，cresc 自建传如 https://cresc.example.com/api */
+  baseUrl?: string;
+  /** x-api-token（credentials.json 的 PUSHY_API_TOKEN） */
+  token: string;
+  /** 注入点：测试 mock（缺省 globalThis.fetch） */
+  fetchImpl?: FetchImpl;
+  /** 直传实现注入（缺省 node:http(s) 原生；测试 mock） */
+  httpUpload?: HttpUploadImpl;
+}
+/** 直传实现（node:http(s) 原生；测试注入 mock） */
+type HttpUploadImpl = (method: "POST" | "PUT", url: string, headers: Record<string, string>, body: Buffer) => Promise<{
+  status: number;
+}>;
+export declare function nodeHttpUpload(method: "POST" | "PUT", url: string, headers: Record<string, string>, body: Buffer): Promise<{
+  status: number;
+}>;
+/** 项目直接依赖（dependencies+devDependencies）的实装版本映射（逐级向上找 node_modules，键排序）。
+ *  对照官方 dep-versions.js 同构：服务端按 deps["react-native-update"] 做热更兼容门禁与变更提示 */
+export declare function readDepVersions(cwd: string): Record<string, string>;
+/** OpenAPI 实现 PushyCli 的服务端操作（ppk 由调用方产出，见 PushyCli 契约注释） */
+export declare function createPushyApi(opts: PushyApiOptions): PushyCli;
 //#endregion
 //#region src/plugins/rn-update.d.ts
 interface RnUpdateOptions {
@@ -68,16 +90,21 @@ interface RnUpdateOptions {
   /** 正式发布默认灰度比例（缺省 100 全量——promote 语义是"验证后发正式"，灰度是显式选择；
    *  优先级：--rollout 旗标 > 此配置 > 内置默认） */
   defaultRollout?: number;
+  /** pushy/cresc 服务端 API 根（自建 cresc 传入，如 https://cresc.example.com/api）；缺省 pushy 官方 */
+  serverUrl?: string;
+  /** 各平台 ppk 产物探测 pattern（相对项目根，glob）；缺省 pushy 官方输出约定
+   *  .pushy/output/{platform}.*.ppk。探测取 mtime 最新；--artifact 显式指定时跳过探测与护栏 */
+  ppkPatterns?: Partial<Record<"harmony" | "android" | "ios", string[]>>;
 }
 /**
  * 判定引擎：diff 能否走热更。
  * 五形态完备性：新原生实体必现于 原生目录/依赖(原生包)/补丁/构建配置/JS——前四判原生，纯 JS 判热更，其余灰区。
  */
 export declare function judgeDelivery(diff: string[], ctx: FrameworkContext, opts: RnUpdateOptions): DeliveryJudgement;
-/** provider 构造（cli 注入点：测试 mock / 将来直连 API） */
+/** provider 构造（cli 注入点见 resolvePushyClient） */
 export declare function makeRnUpdateProvider(opts: RnUpdateOptions, cli?: PushyCli): UpdateProvider;
-/** rnUpdate 插件工厂：注册完整 provider（判定 + 测试发布 + promote）+ 原生发版自动基线。
- *  cli 注入点：测试 mock / 将来进程内直连 API。 */
+/** rnUpdate 插件工厂：注册完整 provider（判定 + beta 发布 + promote）+ 原生发版自动基线。
+ *  cli 注入点：测试 mock / 特殊 transport；缺省 OpenAPI 客户端（token 来自 ctx.credentials）。 */
 export declare function rnUpdate(opts?: RnUpdateOptions, cli?: PushyCli): AppliftPlugin;
 //#endregion
-export { type CliResult, type CliRunner, type DingtalkNotifyOptions, type PushyCli, type RnUpdateOptions, electronAdapter, electronFramework, flutterAdapter, flutterFramework, knownFrameworkAdapters, nativeAndroidAdapter, nativeAndroidFramework, nativeHarmonyAdapter, nativeHarmonyFramework, nativeIosAdapter, nativeIosFramework, rnAdapter, rnFramework, suggestFramework, tauriAdapter, tauriFramework };
+export { type DingtalkNotifyOptions, type FetchImpl, type HttpUploadImpl, type PushyApiOptions, type PushyCli, type RnUpdateOptions, electronAdapter, electronFramework, flutterAdapter, flutterFramework, knownFrameworkAdapters, nativeAndroidAdapter, nativeAndroidFramework, nativeHarmonyAdapter, nativeHarmonyFramework, nativeIosAdapter, nativeIosFramework, rnAdapter, rnFramework, suggestFramework, tauriAdapter, tauriFramework };

package/dist/plugins/index.mjs

@@ -1,8 +1,10 @@
-import { _ as suggestFramework, a as electronFramework, c as knownFrameworkAdapters, d as nativeHarmonyAdapter, f as nativeHarmonyFramework, g as rnFramework, h as rnAdapter, i as electronAdapter, l as nativeAndroidAdapter, m as nativeIosFramework, o as flutterAdapter, p as nativeIosAdapter, r as redactText, s as flutterFramework, t as readProjectVersions, u as nativeAndroidFramework, v as tauriAdapter, y as tauriFramework } from "../project-4_orxby_.mjs";
+import { C as findArtifacts, D as collectReleaseDiff, _ as rnFramework, a as electronAdapter, b as tauriFramework, c as flutterFramework, d as nativeAndroidFramework, f as nativeHarmonyAdapter, g as rnAdapter, h as nativeIosFramework, i as redactText, l as knownFrameworkAdapters, m as nativeIosAdapter, n as readProjectVersions, o as electronFramework, p as nativeHarmonyFramework, s as flutterAdapter, t as readArtifactVersion, u as nativeAndroidAdapter, v as suggestFramework, y as tauriAdapter } from "../artifact-B2RCmWw9.mjs";
 import fs from "node:fs";
 import path from "node:path";
 import { createHmac } from "node:crypto";
-import { spawn, spawnSync } from "node:child_process";
+import { spawnSync } from "node:child_process";
+import nodeHttp from "node:http";
+import nodeHttps from "node:https";
 //#region src/plugins/dingtalk-notify.ts
 /**
 * 官方示例插件 —— 钉钉机器人通知。
@@ -45,119 +47,234 @@ function dingtalkNotify(options) {
 	};
 }
 //#endregion
-//#region src/plugins/pushy-cli.ts
+//#region src/plugins/pushy-api.ts
 /**
-* 不 require 其内部 lib（无公开契约）；cresc/自建服务的差异在服务端 URL，CLI 参数面一致。
-* 输出解析正则按 react-native-update-cli 2.22.9 实测文案编写（源码 i18n 硬编码：pushy 恒中文、cresc 恒英文，
-* 不随系统 locale）；CLI 升级改文案会显式抛错而非静默，升级后请跑 pushy-cli.test.ts 的真实输出回归。
-* cresc 二进制输出为英文，本封装不适用——换 cresc 应另写 provider 插件而非复用本封装。
+* pushy OpenAPI HTTP 客户端（x-api-token 鉴权），替代原 spawn pushy CLI 的服务端操作。
+* 端点与载荷对照 react-native-update-cli 2.29.3 源码（官方参考客户端）反推：
+*   publish     POST /app/:id/version/create {name, hash, description} + POST /app/:id/binding
+*   uploadApp   POST /upload {ext, appId, size} → 对象存储直传 → POST /app/:id/package/create {name, hash, buildTime}
+*   rebind      GET /app/:id/package/list → POST /app/:id/binding {versionId, rollout, packageId}
+*   versions    GET /app/:id/version/list?offset&limit（服务端封顶 limit=100，逐页取尽）
+*   上传指令    POST /upload → {url, formData}（multipart 直传，formData.key 即 hash）
+*               或自托管节点 {method:'PUT', key}（预签名 PUT 直传用户对象存储）
+* ppk 不在此层：热更包是构建产物，由调用方先行产出（--artifact 显式或 ppkPatterns 探测，
+* 见 rn-update.ts）——applift 不 spawn 构建命令（架构不变量 1）。
+* cresc/自建服务差异仅在 baseUrl（同一套服务端代码），serverUrl 由 rnUpdate 配置注入。
+* uploadApp 相对官方 CLI 的有意降级（记录在案）：传原始产物而非 slim 包、不带 bundleHash/
+* bytecodeVersion/bundleLocation（服务端无法将该基线用作 hermes-base 或 package-origin diff）、
+* buildTime 为上传时刻而非包内提取、不校验包内 appId 与目标 app 一致（配错 appId 会传到别的 app——
+* 由配置审查保证）、不做 maxSize 预检（超限撞对象存储错误）。需要 hermes-base 能力时在此补齐。
 */
-/** 默认 runner：spawn 全局 pushy，超时 10 分钟（bundle/upload 含网络大文件传输） */
-function spawnPushy(args, opts) {
+/** credentials.json 中的 pushy token 键名 */
+const PUSHY_TOKEN_KEY = "PUSHY_API_TOKEN";
+/** pushy 官方 API 根（官方 CLI 默认端点簇的主端点） */
+const PUSHY_DEFAULT_BASE_URL = "https://update.reactnative.cn/api";
+const UA = "react-native-update-cli/2.29.3";
+async function query(f, baseUrl, token, api, init) {
+	let res;
+	try {
+		res = await f(`${baseUrl}${api}`, {
+			method: init?.method ?? "GET",
+			headers: {
+				"User-Agent": UA,
+				"x-api-token": token,
+				...init?.body ? { "Content-Type": "application/json" } : {}
+			},
+			...init?.body ? { body: init.body } : {}
+		});
+	} catch (e) {
+		throw new Error(`pushy API 网络错误：${api}——${e.message}`);
+	}
+	const text = await res.text();
+	let json;
+	try {
+		json = text ? JSON.parse(text) : void 0;
+	} catch {
+		if (res.ok) throw new Error(`pushy API ${api} 返回 200 但响应体非 JSON（${text.length} 字节，疑似网关劫持）`);
+	}
+	if (!res.ok) {
+		const msg = json?.message || res.statusText || `HTTP ${res.status}`;
+		throw new Error(res.status === 401 ? `pushy API 鉴权失败（token 无效或过期）：请更新 credentials.json 的 ${PUSHY_TOKEN_KEY}` : `pushy API ${api} 失败（HTTP ${res.status}）：${msg}`);
+	}
+	return json ?? {};
+}
+/** 文件 part 的 Content-Type（对照官方 fileContentType 的扩展名表；未列出走 octet-stream） */
+function fileContentType(fileName) {
+	switch (path.extname(fileName).toLowerCase()) {
+		case ".apk": return "application/vnd.android.package-archive";
+		case ".zip": return "application/zip";
+		case ".json":
+		case ".map": return "application/json";
+		default: return "application/octet-stream";
+	}
+}
+/**
+* 对象存储直传，返回服务端侧 hash/key。
+* Buffer 整体读入：ppk/原生基线在发版机场景为几十 MB 量级，换取 content-length 精确与实现简单
+* （旧 CLI 流式是为进度条与代理改写，非容量需求）。不申请 chunked（响应分支少一半，
+* ppk 增量优化留待 diffStatus 端点，见设计说明）。
+*/
+async function uploadFile(f, baseUrl, token, appId, file, upload) {
+	if (!fs.existsSync(file)) throw new Error(`pushy 上传文件不存在：${file}`);
+	const size = fs.statSync(file).size;
+	const instr = await query(f, baseUrl, token, "/upload", {
+		method: "POST",
+		body: JSON.stringify({
+			ext: path.extname(file),
+			appId,
+			chunked: true,
+			size
+		})
+	});
+	const httpUpload = upload ?? nodeHttpUpload;
+	if (instr.method === "PUT") {
+		const putBody = fs.readFileSync(file);
+		const res = await httpUpload("PUT", instr.url, {
+			"content-length": String(size),
+			...instr.headers ?? {}
+		}, putBody);
+		if (res.status > 299) throw new Error(`pushy 基线直传失败（HTTP ${res.status}）：${instr.url}`);
+		return instr.key;
+	}
+	const fields = Object.entries(instr.formData ?? {});
+	const boundary = `--------------------------${Array.from({ length: 24 }, () => Math.floor(Math.random() * 16).toString(16)).join("")}`;
+	let head = "";
+	for (const [name, value] of fields) head += `--${boundary}\r\nContent-Disposition: form-data; name="${name}"\r\n\r\n${value}\r\n`;
+	head += `--${boundary}\r\nContent-Disposition: form-data; name="file"; filename="${path.basename(file)}"\r\nContent-Type: ${fileContentType(file)}\r\n\r\n`;
+	const body = Buffer.concat([
+		Buffer.from(head),
+		fs.readFileSync(file),
+		Buffer.from(`\r\n--${boundary}--\r\n`)
+	]);
+	const res = await httpUpload("POST", instr.url, {
+		accept: "*/*",
+		"user-agent": UA,
+		"content-type": `multipart/form-data;boundary=${boundary}`,
+		"content-length": String(body.length)
+	}, body);
+	if (res.status > 299) throw new Error(`pushy 文件直传失败（HTTP ${res.status}）：${instr.url}`);
+	const key = fields.find(([name]) => name === "key")?.[1];
+	if (!key) throw new Error(`pushy /upload 指令缺 formData.key（服务端响应异常）：${instr.url}`);
+	return key;
+}
+async function nodeHttpUpload(method, url, headers, body) {
+	const mod = url.startsWith("https:") ? nodeHttps : nodeHttp;
 	return new Promise((resolve, reject) => {
-		const child = spawn("pushy", args, { cwd: opts?.cwd });
-		let stdout = "";
-		let stderr = "";
-		const timer = setTimeout(() => child.kill("SIGKILL"), 6e5);
-		child.stdout?.on("data", (d) => stdout += d.toString());
-		child.stderr?.on("data", (d) => stderr += d.toString());
-		child.on("error", (e) => {
-			clearTimeout(timer);
-			reject(/* @__PURE__ */ new Error(`pushy 命令不可用（react-native-update-cli 未全局安装？）：${e.message}`));
+		const req = mod.request(url, {
+			method,
+			headers
 		});
-		child.on("close", (code) => {
-			clearTimeout(timer);
-			resolve({
-				code: code ?? 1,
-				stdout,
-				stderr
-			});
+		req.on("response", (res) => {
+			res.resume();
+			resolve({ status: res.statusCode ?? 0 });
 		});
+		req.on("error", (e) => reject(/* @__PURE__ */ new Error(`pushy 直传网络错误：${url}——${e.message}`)));
+		req.end(body);
 	});
 }
-function fail(cmd, r) {
-	throw new Error(`pushy ${cmd} 失败（exit ${r.code}）：${(r.stderr || r.stdout).trim()}`);
+/** packageVersion → packageId 精确匹配（对照 CLI update：pkg.name === packageVersion） */
+async function bind(q, appId, versionId, packageVersion, rollout) {
+	const pkgs = await listAllPackages(q, appId);
+	const pkg = pkgs.find((p) => p.name === packageVersion);
+	if (!pkg) throw new Error(`pushy 未找到原生包版本 ${packageVersion}（appId=${appId}，已有 ${pkgs.length} 个基线）——原生包尚未上传？先发一次原生版（stage:after 会自动上传基线）`);
+	await q(`/app/${appId}/binding`, {
+		method: "POST",
+		body: JSON.stringify({
+			versionId,
+			rollout,
+			packageId: pkg.id
+		})
+	});
+}
+async function listAllPackages(q, appId) {
+	const out = [];
+	const limit = 100;
+	for (let offset = 0; offset < 1e4; offset += limit) {
+		const { data } = await q(`/app/${appId}/package/list?offset=${offset}&limit=${limit}`);
+		if (!data?.length) break;
+		out.push(...data);
+		if (data.length < limit) break;
+	}
+	return out;
+}
+/** 项目直接依赖（dependencies+devDependencies）的实装版本映射（逐级向上找 node_modules，键排序）。
+*  对照官方 dep-versions.js 同构：服务端按 deps["react-native-update"] 做热更兼容门禁与变更提示 */
+function readDepVersions(cwd) {
+	let pkg;
+	try {
+		pkg = JSON.parse(fs.readFileSync(path.join(cwd, "package.json"), "utf8"));
+	} catch {
+		return {};
+	}
+	const versions = {};
+	for (const dep of /* @__PURE__ */ new Set([...Object.keys(pkg.dependencies ?? {}), ...Object.keys(pkg.devDependencies ?? {})])) {
+		let dir = path.resolve(cwd);
+		for (;;) {
+			try {
+				const installed = JSON.parse(fs.readFileSync(path.join(dir, "node_modules", dep, "package.json"), "utf8"));
+				if (typeof installed.version === "string") versions[dep] = installed.version;
+				break;
+			} catch {}
+			const parent = path.dirname(dir);
+			if (parent === dir) break;
+			dir = parent;
+		}
+	}
+	return Object.fromEntries(Object.keys(versions).sort().map((k) => [k, versions[k]]));
 }
-function createPushyCli(runner = spawnPushy) {
+/** OpenAPI 实现 PushyCli 的服务端操作（ppk 由调用方产出，见 PushyCli 契约注释） */
+function createPushyApi(opts) {
+	const baseUrl = opts.baseUrl ?? "https://update.reactnative.cn/api";
+	const f = opts.fetchImpl ?? fetch.bind(globalThis);
+	const q = (api, init) => query(f, baseUrl, opts.token, api, init);
 	return {
-		async bundle(platform, cwd) {
-			const r = await runner([
-				"bundle",
-				"--platform",
-				platform,
-				"--no-interactive"
-			], { cwd });
-			if (r.code !== 0) fail("bundle", r);
-			const m = r.stdout.match(/已生成\s+(\S+\.ppk)/);
-			if (!m) throw new Error(`pushy bundle 输出未含 ppk 路径：${r.stdout.trim()}`);
-			return m[1];
-		},
 		async publish(input) {
-			const args = [
-				"publish",
-				input.ppk,
-				"--platform",
-				input.platform,
-				"--appId",
-				String(input.appId),
-				"--name",
-				input.name,
-				"--packageVersion",
-				input.packageVersion
-			];
-			if (input.description) args.push("--description", input.description);
-			if (input.rollout !== void 0) args.push("--rollout", String(input.rollout));
-			args.push("--no-interactive");
-			const r = await runner(args);
-			if (r.code !== 0) fail("publish", r);
-			const m = (r.stdout + r.stderr).match(/已成功上传新热更包（id:\s*(\d+)）/);
-			if (!m) throw new Error(`pushy publish 输出未含版本 id：${r.stdout.trim()}`);
-			return { versionId: Number(m[1]) };
+			const hash = await uploadFile(f, baseUrl, opts.token, input.appId, input.ppk, opts.httpUpload);
+			const { id } = await q(`/app/${input.appId}/version/create`, {
+				method: "POST",
+				body: JSON.stringify({
+					name: input.name,
+					hash,
+					description: input.description ?? "",
+					metaInfo: "",
+					deps: input.deps
+				})
+			});
+			await bind(q, input.appId, id, input.packageVersion, input.rollout);
+			return { versionId: id };
 		},
-		async uploadApp(appId, appFile) {
-			const r = await runner([
-				"uploadApp",
-				appFile,
-				"--appId",
-				String(appId)
-			]);
-			if (r.code !== 0) fail("uploadApp", r);
-			const m = (r.stdout + r.stderr).match(/已成功上传app原生包（id:\s*(\d+),\s*version:\s*([\d.]+)[^）]*）/);
-			if (!m) throw new Error(`pushy uploadApp 输出未含原生包信息：${(r.stdout + r.stderr).trim()}`);
+		async uploadApp(appId, appFile, versionName, deps) {
+			const hash = await uploadFile(f, baseUrl, opts.token, appId, appFile, opts.httpUpload);
+			const { id } = await q(`/app/${appId}/package/create`, {
+				method: "POST",
+				body: JSON.stringify({
+					name: versionName,
+					hash,
+					buildTime: String(Date.now()),
+					deps
+				})
+			});
 			return {
-				packageId: Number(m[1]),
-				version: m[2]
+				packageId: id,
+				version: versionName
 			};
 		},
 		async rebind(input) {
-			const args = [
-				"update",
-				"--versionId",
-				String(input.versionId),
-				"--appId",
-				String(input.appId),
-				"--packageVersion",
-				input.packageVersion
-			];
-			if (input.rollout !== void 0) args.push("--rollout", String(input.rollout));
-			args.push("--no-interactive");
-			const r = await runner(args);
-			if (r.code !== 0) fail("update", r);
+			await bind(q, input.appId, input.versionId, input.packageVersion, input.rollout);
 		},
 		async versions(appId) {
-			const r = await runner([
-				"versions",
-				"--appId",
-				String(appId),
-				"--no-interactive"
-			]);
-			if (r.code !== 0) fail("versions", r);
 			const out = [];
-			for (const m of r.stdout.matchAll(/^(\d+)\)\s+(\S+)\s+(\S+)/gm)) out.push({
-				id: Number(m[1]),
-				hash: m[2],
-				name: m[3]
-			});
+			const limit = 100;
+			for (let offset = 0; offset < 1e4; offset += limit) {
+				const { data } = await q(`/app/${appId}/version/list?offset=${offset}&limit=${limit}`);
+				if (!data?.length) break;
+				for (const v of data) out.push({
+					id: v.id,
+					hash: v.hash ?? "",
+					name: v.name
+				});
+				if (data.length < limit) break;
+			}
 			return out;
 		}
 	};
@@ -166,8 +283,17 @@ function createPushyCli(runner = spawnPushy) {
 //#region src/plugins/rn-update.ts
 /**
 * rn-update 插件：react-native-update（pushy/cresc/自建服务端）的 applift UpdateProvider 实现。
-* 判定引擎为纯函数（五形态完备性见测试头注释）；发布链路 = ppk 构建 / 测试通道 / promote / 原生基线。
+* 判定引擎为纯函数（五形态完备性见测试头注释）；发布链路 = ppk 产物入口 / 测试通道 / promote / 原生基线。
+* ppk 是构建产物（pushy bundle = metro + hermesc，完整构建链）：由项目先行产出
+* （npm script / CI），applift 只探测/接收——不 spawn 构建命令（架构不变量 1）。
 */
+/** ppk 探测内置默认：pushy CLI 官方输出约定（tempDir .pushy + output/{platform}.${time}.ppk；
+*  cresc 同构，仅目录 .cresc.temp 不同——用 cresc 的项目在 ppkPatterns 覆盖） */
+const DEFAULT_PPK_PATTERNS = {
+	harmony: [".pushy/output/harmony.*.ppk"],
+	android: [".pushy/output/android.*.ppk"],
+	ios: [".pushy/output/ios.*.ppk"]
+};
 /** 项目原生目录：任一命中即必须原生发版 */
 const NATIVE_DIRS = [
 	"harmony/",
@@ -366,15 +492,15 @@ function judgeDelivery(diff, ctx, opts) {
 	};
 }
 /** pushy 官方测试包约定：与正式同源码、仅版本号偏移（major+1000，如 1.6.0→1001.6.0） */
-const TEST_VERSION_OFFSET = 1e3;
+const BETA_VERSION_OFFSET = 1e3;
 /** 正式 promote 的内置默认灰度比例（100 = 全量）。promote 语义是"测试通道已验证、发正式"，
 *  全量是常态、灰度是显式选择（--rollout 或 rnUpdate({ defaultRollout })），不藏在配置后面 */
 const DEFAULT_ROLLOUT = 100;
 /** 生成测试包偏移版本号（major+1000）；非数字开头版本号无法偏移，显式报错 */
-function testPackageVersion(versionName) {
+function betaPackageVersion(versionName) {
 	const m = /^(\d+)(\..+)?$/.exec(versionName);
-	if (!m) throw new Error(`versionName「${versionName}」非 X.Y.Z 形态，无法按 major+${TEST_VERSION_OFFSET} 生成测试包偏移版本`);
-	return `${Number(m[1]) + TEST_VERSION_OFFSET}${m[2] ?? ""}`;
+	if (!m) throw new Error(`versionName「${versionName}」非 X.Y.Z 形态，无法按 major+${BETA_VERSION_OFFSET} 生成测试包偏移版本`);
+	return `${Number(m[1]) + BETA_VERSION_OFFSET}${m[2] ?? ""}`;
 }
 function platformAppId(opts, platform) {
 	const id = opts[platform];
@@ -397,8 +523,68 @@ function nextPatchNumber(names, versionName) {
 	}
 	return max + 1;
 }
-/** provider 构造（cli 注入点：测试 mock / 将来直连 API） */
-function makeRnUpdateProvider(opts, cli = createPushyCli()) {
+/**
+* 客户端解析：注入了 cli（测试 mock / 特殊 transport）则直用；缺省按凭据构造 OpenAPI 客户端
+* （token 来自 PUSHY_API_TOKEN，bundle 始终走本地 pushy CLI）。
+* fail-fast：token 缺失在本地 bundle 之前报错（不打无谓的 metro 包）。
+*/
+function resolvePushyClient(opts, cli, credentials) {
+	if (cli) return cli;
+	const token = credentials?.[PUSHY_TOKEN_KEY];
+	if (!token) throw new Error(`pushy 热更缺少凭据 ${PUSHY_TOKEN_KEY}：在 ~/.applift/credentials.json 对应 profile 配置（pushy 网页控制台 → API Token 页创建；CI 可用同名环境变量覆盖）`);
+	return createPushyApi({
+		baseUrl: opts.serverUrl,
+		token
+	});
+}
+/**
+* ppk 产物入口：--artifact 显式 > ppkPatterns 探测（mtime 最新）。
+* 探测路径强制新鲜度护栏；显式 --artifact 是用户声明「我知道我在发什么」，跳过护栏
+* （与 --delivery ota 的显式覆盖语义一致，同原生 --artifact 不校验产物新旧）。
+*/
+async function resolvePpk(opts, ctx) {
+	if (ctx.artifact) return ctx.artifact;
+	const platform = ctx.platform;
+	const patterns = opts.ppkPatterns?.[platform] ?? DEFAULT_PPK_PATTERNS[platform];
+	const ppk = findArtifacts(ctx.cwd, patterns)[0];
+	if (!ppk) throw new Error(`未探测到 ${platform} 的 ppk 热更包（${patterns.join(", ")}）——ppk 是构建产物，请先产出（如 npm run ppk:${platform} = pushy bundle --platform ${platform} --no-interactive）再 applift beta，或用 --artifact 显式指定 ppk 路径`);
+	await assertPpkFresh(ctx.cwd, ppk);
+	return ppk;
+}
+/**
+* 新鲜度护栏：工作区未发布改动（锚点..当前，与判定同口径 collectReleaseDiff）的最新文件
+* mtime 晚于 ppk → 报错——防止忘重新 bundle 把旧 JS 发给测试设备。
+* 无锚点/无 diff/文件已删除（无 mtime 可比）不拦。
+*/
+async function assertPpkFresh(cwd, ppk) {
+	const diff = await collectReleaseDiff(cwd);
+	if (!diff) return;
+	let newest = 0;
+	let newestFile = "";
+	for (const f of diff) try {
+		const m = fs.statSync(path.join(cwd, f)).mtimeMs;
+		if (m > newest) {
+			newest = m;
+			newestFile = f;
+		}
+	} catch {}
+	if (newest > 0 && fs.statSync(ppk).mtimeMs < newest) throw new Error(`ppk（${path.basename(ppk)}）早于最新代码改动（${newestFile}）——疑似忘重新 bundle，请重新产出 ppk 后再发；确认无误可 --artifact 显式指定跳过此护栏`);
+}
+/** 发布新热更的公共骨架：客户端/appId/版本号/ppk 探测 + 服务端取号（publishToBeta/publishToProd 共用） */
+async function preparePublish(opts, cli, ctx) {
+	const client = resolvePushyClient(opts, cli, ctx.credentials);
+	const appId = platformAppId(opts, ctx.platform);
+	const versionName = currentVersionName(ctx);
+	return {
+		client,
+		appId,
+		versionName,
+		ppk: await resolvePpk(opts, ctx),
+		name: `${versionName}-patch.${nextPatchNumber(await client.versions(appId), versionName)}`
+	};
+}
+/** provider 构造（cli 注入点见 resolvePushyClient） */
+function makeRnUpdateProvider(opts, cli) {
 	return {
 		id: "rn-update",
 		frameworks: ["rn"],
@@ -408,40 +594,53 @@ function makeRnUpdateProvider(opts, cli = createPushyCli()) {
 			"ios"
 		].filter((k) => typeof opts[k] === "number"),
 		judge: (diff, ctx) => judgeDelivery(diff, ctx, opts),
-		async publishToTest(ctx) {
-			const appId = platformAppId(opts, ctx.platform);
-			const versionName = currentVersionName(ctx);
-			const name = `${versionName}-patch.${nextPatchNumber(await cli.versions(appId), versionName)}`;
-			const ppk = await cli.bundle(ctx.platform, ctx.cwd);
+		async publishToBeta(ctx) {
+			const { client, appId, versionName, ppk, name } = await preparePublish(opts, cli, ctx);
 			return {
 				versionName: name,
-				versionId: (await cli.publish({
+				versionId: (await client.publish({
 					appId,
 					ppk,
 					platform: ctx.platform,
 					name,
 					description: ctx.note,
-					packageVersion: testPackageVersion(versionName)
+					packageVersion: betaPackageVersion(versionName),
+					deps: readDepVersions(ctx.cwd)
 				})).versionId
 			};
 		},
+		async publishToProd(ctx) {
+			const { client, appId, versionName, ppk, name } = await preparePublish(opts, cli, ctx);
+			const rollout = ctx.rollout ?? opts.defaultRollout ?? DEFAULT_ROLLOUT;
+			return {
+				versionName: name,
+				versionId: (await client.publish({
+					appId,
+					ppk,
+					platform: ctx.platform,
+					name,
+					description: ctx.note,
+					packageVersion: versionName,
+					rollout,
+					deps: readDepVersions(ctx.cwd)
+				})).versionId,
+				...rollout !== void 0 ? { rollout } : {}
+			};
+		},
 		async promoteToProd(ctx) {
+			const client = resolvePushyClient(opts, cli, ctx.credentials);
 			const appId = platformAppId(opts, ctx.platform);
 			const versionName = currentVersionName(ctx);
-			const existing = await cli.versions(appId);
-			const latest = existing.map((v) => {
+			const latest = (await client.versions(appId)).map((v) => {
 				const m = v.name.match(new RegExp(`^${versionName.replace(/\./g, "\\.")}-patch\\.(\\d+)$`));
 				return m ? {
 					...v,
 					n: Number(m[1])
 				} : null;
 			}).filter((x) => x !== null).sort((a, b) => b.n - a.n)[0];
-			if (!latest) {
-				const patchNames = existing.map((v) => v.name).filter((n) => /-patch\.\d+$/.test(n)).slice(0, 5);
-				throw new Error(`测试通道没有 ${versionName}-patch.N 热更版本可供 promote${patchNames.length > 0 ? `（现存：${patchNames.join(", ")}${existing.length > 5 ? " …" : ""}）` : ""}：先 applift beta 发布测试热更并验证`);
-			}
+			if (!latest) return null;
 			const rollout = ctx.rollout ?? opts.defaultRollout ?? DEFAULT_ROLLOUT;
-			await cli.rebind({
+			await client.rebind({
 				appId,
 				versionId: latest.id,
 				packageVersion: versionName,
@@ -456,22 +655,24 @@ function makeRnUpdateProvider(opts, cli = createPushyCli()) {
 }
 /** 渠道 → 平台映射（热更已接入的平台；基线上传按此路由） */
 const CHANNEL_PLATFORM = { agc: "harmony" };
-/** rnUpdate 插件工厂：注册完整 provider（判定 + 测试发布 + promote）+ 原生发版自动基线。
-*  cli 注入点：测试 mock / 将来进程内直连 API。 */
-function rnUpdate(opts = {}, cli = createPushyCli()) {
+/** rnUpdate 插件工厂：注册完整 provider（判定 + beta 发布 + promote）+ 原生发版自动基线。
+*  cli 注入点：测试 mock / 特殊 transport；缺省 OpenAPI 客户端（token 来自 ctx.credentials）。 */
+function rnUpdate(opts = {}, cli) {
 	const provider = makeRnUpdateProvider(opts, cli);
 	return {
 		name: "rn-update",
 		"update:register"(providers) {
 			providers.push(provider);
 		},
-		async "stage:after"(result) {
+		async "stage:after"(result, hookCtx) {
 			const platform = CHANNEL_PLATFORM[result.channel];
 			if (!result.ok || !platform || !result.artifactPath) return;
 			const appId = opts[platform];
 			if (typeof appId !== "number") return;
 			try {
-				await cli.uploadApp(appId, result.artifactPath);
+				const versionName = readArtifactVersion(result.artifactPath)?.versionName;
+				if (!versionName) throw new Error(`未能从产物读出 versionName：${result.artifactPath}（readArtifactVersion 不支持该格式？）`);
+				await resolvePushyClient(opts, cli, hookCtx.credentials).uploadApp(appId, result.artifactPath, versionName, readDepVersions(hookCtx.cwd));
 			} catch (e) {
 				process.stderr.write(`⚠ pushy 基线上传失败（请人工补传）：${e.message}\n`);
 			}
@@ -479,4 +680,4 @@ function rnUpdate(opts = {}, cli = createPushyCli()) {
 	};
 }
 //#endregion
-export { createPushyCli, dingtalkNotify, electronAdapter, electronFramework, flutterAdapter, flutterFramework, judgeDelivery, knownFrameworkAdapters, makeRnUpdateProvider, nativeAndroidAdapter, nativeAndroidFramework, nativeHarmonyAdapter, nativeHarmonyFramework, nativeIosAdapter, nativeIosFramework, rnAdapter, rnFramework, rnUpdate, spawnPushy, suggestFramework, tauriAdapter, tauriFramework };
+export { PUSHY_DEFAULT_BASE_URL, PUSHY_TOKEN_KEY, createPushyApi, dingtalkNotify, electronAdapter, electronFramework, flutterAdapter, flutterFramework, judgeDelivery, knownFrameworkAdapters, makeRnUpdateProvider, nativeAndroidAdapter, nativeAndroidFramework, nativeHarmonyAdapter, nativeHarmonyFramework, nativeIosAdapter, nativeIosFramework, nodeHttpUpload, readDepVersions, rnAdapter, rnFramework, rnUpdate, suggestFramework, tauriAdapter, tauriFramework };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@applift/core",
-  "version": "0.7.2",
+  "version": "0.8.1",
   "repository": {
     "type": "git",
     "url": "https://github.com/hcg1023/applift.git",