@bipopush/cli 0.2.0 → 0.3.0-beta.11

package/LICENSE

@@ -1,21 +1,35 @@
-MIT License
-
-Copyright (c) 2026 BipoPush
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+BipoPush Software License
+
+Copyright (c) 2026 BipoPush. All rights reserved.
+
+This software (the "Software") is licensed, not sold, under these terms and the BipoPush Terms of Service
+(https://bipopush.com/terms). By installing or using the Software you accept them.
+
+1. License. While you have a BipoPush account and follow these terms, BipoPush grants you a limited,
+   non-exclusive, non-transferable, revocable license to install and use the Software to deliver
+   over-the-air updates through the BipoPush service, including in your build and CI systems.
+
+2. Your apps. The updates you publish with the Software are yours. The Software itself is not part of your
+   apps and may not be distributed with them.
+
+3. Restrictions. You may not, and may not let others:
+   a. copy, modify, adapt or create derivative works of the Software, except to install it as in section 1;
+   b. decompile, disassemble, deobfuscate or otherwise reverse engineer the Software, except where the law
+      allows it despite this restriction;
+   c. use the Software with any service other than BipoPush, or to build a competing product or service;
+   d. distribute, sublicense, rent or publish the Software;
+   e. remove or change any notice in the Software.
+
+4. Third-party software. Parts of the Software are covered by their own licenses, listed in the
+   THIRD_PARTY_NOTICES file where present. Those licenses apply to those parts.
+
+5. Termination. This license ends automatically if you breach these terms or your BipoPush account ends.
+
+6. No warranty. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING
+   MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT, TO THE EXTENT THE LAW ALLOWS.
+
+7. Limitation of liability. To the extent the law allows, BipoPush is not liable for any indirect, incidental,
+   special or consequential damages arising from the Software, and its total liability is limited as in the
+   BipoPush Terms of Service.
+
+Questions: contact@bipopush.com

package/README.md

@@ -1,42 +1,61 @@
 # @bipopush/cli
 
-Register a React Native / Expo app and publish signed, compressed OTA updates.
+Register a React Native / Expo app with [BipoPush](https://bipopush.com) and publish signed, compressed over-the-air updates.
 
 ```bash
 npx @bipopush/cli login     # browser sign-in
 npx @bipopush/cli init      # once per project
+npx @bipopush/cli doctor    # checks the setup
 npx @bipopush/cli release   # every JS update
 ```
 
-Installed as a dev dependency, the binary is `bipopush`.
+Installed as a dev dependency, the binary is `bipopush`. Full docs: https://app.bipopush.com/docs
 
 ## Commands
 
 | Command | |
 |---|---|
-| `login` / `logout` / `whoami` | Browser login (PKCE + localhost callback); token stored in `~/.config/bipopush/credentials.json` (0600). `whoami` lists your organizations with role and plan |
-| `init [--name] [--scheme] [--org <slug>] [--app <id>] [--new-signing-key]` | Detects Expo vs React Native, reads the iOS bundle id, Android package, native versions and URL scheme, creates the app in your organization (`--org` when you can create apps in more than one) (or links an existing one with `--app`), generates the ed25519 signing key, writes `bipopush.json` and puts `BipoPushAppKey` / `BipoPushPublicKey` (and the scheme) in `Info.plist` and `AndroidManifest.xml` (Expo: the plugin entry in `app.json`). `--new-signing-key` replaces a lost key (installed builds need a store update) |
-| `release [-p ios\|android\|all] [-c <channel>] [-m text] [--mandatory] [--dry-run]` | Builds and publishes one release (counts as one, whatever the platforms). `-c` defaults to `production`; a new channel name is created if the plan allows. `--mandatory`: devices with auto update install it right away, also when they skip to a later version |
-| `promote [--from staging] [--to production] [-p …] [--number n]` | Re-publishes a tested version (default: newest live one) in another channel — same bundle and assets, new version number there, doesn't count toward the daily limit |
-| `apps` | Lists your apps by organization, with MAU and release usage |
+| `login` / `logout` / `whoami` | Browser login; the token is stored in `~/.config/bipopush/credentials.json` (0600). `whoami` lists your organizations with role and plan |
+| `init [--name] [--scheme] [--org <id\|slug>] [--app <id>] [--new-signing-key]` | Detects Expo vs React Native, reads the iOS bundle id, Android package, native versions and URL scheme, creates the app in your organization (a list to pick from when you belong to several; `--org` in CI) or links an existing one (`--app`), generates the release signing key, writes `bipopush.json` and puts the app's keys in `Info.plist` and `AndroidManifest.xml` (Expo: the plugin entry in `app.json`). Then it shows, side by side, the lines to add to `AppDelegate.swift` and `MainApplication.kt`; it never edits them. `--new-signing-key` replaces a lost key (installed builds need a store update) |
+| `doctor` | Checks the project: SDK installed, other OTA libraries, the app on the server, keys in Info.plist / AndroidManifest / app.json, the signing key, the native setup (with the side-by-side change when something is missing), the iOS pod and the URL scheme. Exit code 1 when something must be fixed |
+| `release [-p ios\|android\|all] [-c <channel>] [-m <text>] [--mandatory] [--rollout <percent>] [--dry-run]` | Builds and publishes one update. `-c` defaults to `production`; a new channel name is created if the plan allows. `--mandatory`: devices with auto update install it right away, also when they skip to a later version. `--rollout`: only that share of devices gets it at first (Plus and above) |
+| `rollout <percent> [-c] [-p] [--number <n>]` | Changes how many devices get the newest version; `100` finishes the rollout |
+| `disable [-c] [-p] [--number <n>]` | Disables the newest version (or version n). Devices get the newest enabled version on their next check: that is the rollback |
+| `promote [--from staging] [--to production] [-p] [--number <n>]` | Re-publishes a tested version in another channel: same bundle and assets, next version number there |
+| `apps` | Your apps by organization, with MAU and usage |
+| `migrate` | Finds CodePush, RevoPush or expo-updates in the project and prints the steps to switch |
+
+## Coming from CodePush, RevoPush or EAS Update
+
+Swap the binary name and your scripts keep working; the app comes from `bipopush.json`.
+
+| You ran | BipoPush does |
+|---|---|
+| `release-react MyApp ios -d Production --description … -m -r 25` | release to production, mandatory, to 25% |
+| `release-expo MyApp android -d Production …` (RevoPush) | the same release (Expo projects are detected) |
+| `promote MyApp Staging Production` | promote from staging to production |
+| `rollback MyApp Production` | disable the newest production version |
+| `patch MyApp Production -m true -r 50` | mandatory and 50% on the newest production version |
+| `codepush …` / `revopush …` prefixes, `-a owner/MyApp` | accepted |
+| `update --channel production --message … --rollout-percentage 10` | release to production, to 10% (`--branch` works as `--channel`) |
+| `update:edit --channel production --rollout-percentage 100` | rollout 100 on production |
+| `release-native MyApp ios ./app.ipa` | refused: app binaries go through the App Store and Google Play |
 
 ## What `release` does
 
 For each platform:
 
 1. **Bundle** with the project's own toolchain (`react-native bundle` or `expo export:embed`), collecting the images and fonts the JS requires.
-2. **Compile** to Hermes bytecode with the app's `hermesc` (delta-optimized against the previous release when there is one).
-3. **Hash** (SHA-256) the bundle and every asset, and **sign** with the app's ed25519 key (a manifest of all hashes when there are assets).
-4. **Compress** with brotli (quality 11).
-5. **Diff** against the previous release of the same channel + native version (bsdiff); the patch is kept only when it is under 60% of the compressed full bundle.
-6. **Upload** straight to storage with presigned URLs (files never pass through the API server) — assets the app already has in storage are skipped — then **publish**. The API assigns `v1, v2, …` per channel, platform and native version.
-
-Example output for a 2 MB app where only an image changed:
+2. **Compile** to Hermes bytecode with the app's `hermesc`.
+3. **Hash** (SHA-256) the bundle and every asset, and **sign** with the app's Ed25519 key (a manifest of all hashes when there are assets).
+4. **Compress** with brotli.
+5. **Diff** against the previous release of the same channel and native version: devices on it download a binary patch of a few KB instead of the full bundle.
+6. **Upload** straight to storage with short-lived URLs (assets already stored are skipped), then **publish**. Versions are numbered `v1, v2, …` per channel, platform and native version.
 
 ```
 ios 1.0
   JS 2016.7 KB → Hermes 1279.5 KB → brotli 462.1 KB  (77% smaller)
-  patch 2.1 KB vs previous release (100% smaller than full)
+  patch 1.9 KB vs previous release (100% smaller than full)
   assets 3 files, 322.3 KB (manifest signed)
 Assets: 2 new uploaded (0.6 KB), 1 already stored.
 Published iOS 1.0 v7 to production.
@@ -44,11 +63,8 @@ Published iOS 1.0 v7 to production.
 
 ## Keys and CI
 
-- The signing key is saved at `~/.config/bipopush/keys/<appId>.pem`. Keep it private — whoever has it can ship code to your users.
-- In CI set `BIPOPUSH_TOKEN` (a CLI token) and `BIPOPUSH_SIGNING_KEY` (the PEM, or its base64).
-- `bsdiff-nodejs` is an optional native dependency; without it releases still work, just without patches.
-
-## Environment
+- The signing key is saved at `~/.config/bipopush/keys/<appId>.pem`. Keep it private: whoever has it can sign updates for your app.
+- In CI, set `BIPOPUSH_TOKEN` (a CLI token) and `BIPOPUSH_SIGNING_KEY` (the PEM, or its base64), then run `npx @bipopush/cli release`.
 
 | Variable | Default |
 |---|---|
@@ -58,8 +74,6 @@ Published iOS 1.0 v7 to production.
 | `BIPOPUSH_SIGNING_KEY` | — |
 | `BIPOPUSH_NO_BROWSER` | Print the login URL instead of opening it |
 
-## Develop
+## License
 
-```bash
-npm test     # runs the real hermesc, brotli and bsdiff on sample bundles
-```
+Proprietary: use with a BipoPush account under the [BipoPush Software License](LICENSE) and the [Terms of Service](https://bipopush.com/terms). Questions: contact@bipopush.com