@bipopush/cli 0.2.0 → 0.3.0-beta.11

package/dist/commands.js

@@ -1,303 +0,0 @@
-import path from "node:path";
-import { API_URL } from "./config.js";
-import { ApiError, request } from "./http.js";
-import { generateSigningKey, keyFile, loadSigningKey, saveSigningKey } from "./keys.js";
-import { decompress, packPlatform, sha256Hex } from "./pack.js";
-import { PROJECT_FILE, detectProject, loadProjectConfig, saveProjectConfig, addAndroidUrlScheme, addIosUrlScheme, writeExpoConfig, writeAndroidManifest, writeIosInfoPlist, } from "./project.js";
-const kb = (n) => `${(n / 1024).toFixed(1)} KB`;
-function nativeFields(project, scheme) {
-    return {
-        iosBundleId: project.ios.id,
-        androidPackage: project.android.id,
-        scheme: scheme ?? project.ios.scheme ?? project.android.scheme,
-    };
-}
-function describeProject(project) {
-    console.log(`Project:  ${project.name} (${project.type === "expo" ? "Expo" : "React Native"})`);
-    console.log(`  iOS      ${project.ios.id ?? "—"}  version ${project.ios.version ?? "—"}`);
-    console.log(`  Android  ${project.android.id ?? "—"}  version ${project.android.version ?? "—"}`);
-    console.log(`  Scheme   ${project.ios.scheme ?? project.android.scheme ?? "— (deeplinks need one: --scheme <name>)"}`);
-}
-/**
- * Registers this project as an app (or links it again), creates the signing key pair,
- * writes bipopush.json and puts the app key + public key in the iOS Info.plist.
- */
-export async function init(token, opts) {
-    const project = detectProject(opts.cwd);
-    if (opts.scheme && project.type === "expo" && !project.ios.scheme) {
-        project.ios.scheme = opts.scheme;
-        project.android.scheme = opts.scheme;
-    }
-    else if (opts.scheme && project.iosInfoPlist && !project.ios.scheme) {
-        addIosUrlScheme(project.iosInfoPlist, opts.scheme);
-        project.ios.scheme = opts.scheme;
-        console.log(`Added URL scheme "${opts.scheme}" to ${path.relative(opts.cwd, project.iosInfoPlist)}`);
-    }
-    describeProject(project);
-    const existing = loadProjectConfig(opts.cwd);
-    const appId = opts.appId ?? existing?.appId;
-    let app;
-    let privateKeyNote;
-    if (appId) {
-        ({ app } = await request(`/apps/${appId}`, { token }));
-        ({ app } = await request(`/apps/${app.id}`, {
-            method: "PATCH",
-            token,
-            headers: { "content-type": "application/json" },
-            body: JSON.stringify(nativeFields(project, opts.scheme ?? null)),
-        }));
-        if (opts.newSigningKey) {
-            // Lost key: register a new public key. Builds already installed only trust the old one,
-            // so they ignore new releases until users install a store build with the new key.
-            const { privateKey, publicKey } = generateSigningKey();
-            ({ app } = await request(`/apps/${app.id}`, {
-                method: "PATCH",
-                token,
-                headers: { "content-type": "application/json" },
-                body: JSON.stringify({ publicKey }),
-            }));
-            privateKeyNote = saveSigningKey(app.id, privateKey);
-            console.log("\nNew signing key registered. Ship a new store build: installed builds only trust the old key.");
-        }
-        else {
-            loadSigningKey(app.id);
-            privateKeyNote = `existing key ${keyFile(app.id)}`;
-        }
-        console.log(`\nLinked to existing app "${app.name}".`);
-    }
-    else {
-        const org = await pickOrganization(token, opts.org);
-        const { privateKey, publicKey } = generateSigningKey();
-        ({ app } = await request("/apps", {
-            method: "POST",
-            token,
-            headers: { "content-type": "application/json" },
-            body: JSON.stringify({ organizationId: org.id, name: opts.name ?? project.name, publicKey, ...nativeFields(project, opts.scheme ?? null) }),
-        }));
-        privateKeyNote = saveSigningKey(app.id, privateKey);
-        console.log(`\nCreated app "${app.name}" in ${org.name}.`);
-    }
-    const config = { appId: app.id, appKey: app.appKey, type: project.type, entryFile: project.entryFile };
-    saveProjectConfig(opts.cwd, config);
-    if (project.type === "expo") {
-        const plugin = { appKey: app.appKey, publicKey: app.publicKey };
-        if (API_URL !== "https://api.bipopush.com")
-            plugin.apiUrl = API_URL;
-        writeExpoConfig(opts.cwd, plugin, opts.scheme);
-        console.log("Configured the @bipopush/react-native plugin in app.json (run npx expo prebuild to apply).");
-    }
-    else {
-        const values = { BipoPushAppKey: app.appKey, BipoPushPublicKey: app.publicKey };
-        if (API_URL !== "https://api.bipopush.com")
-            values.BipoPushApiUrl = API_URL;
-        if (project.iosInfoPlist) {
-            writeIosInfoPlist(project.iosInfoPlist, { BipoPushApiUrl: null, ...values });
-            console.log(`Wrote BipoPushAppKey / BipoPushPublicKey to ${path.relative(opts.cwd, project.iosInfoPlist)}`);
-        }
-        if (project.androidManifest) {
-            writeAndroidManifest(project.androidManifest, { BipoPushApiUrl: null, ...values });
-            console.log(`Wrote BipoPushAppKey / BipoPushPublicKey to ${path.relative(opts.cwd, project.androidManifest)}`);
-            const scheme = opts.scheme ?? project.ios.scheme;
-            if (scheme && !project.android.scheme) {
-                addAndroidUrlScheme(project.androidManifest, scheme);
-                project.android.scheme = scheme;
-                console.log(`Added URL scheme "${scheme}" to ${path.relative(opts.cwd, project.androidManifest)}`);
-            }
-        }
-    }
-    console.log(`\nApp key:     ${app.appKey}`);
-    console.log(`Public key:  ${app.publicKey}`);
-    console.log(`Signing key: ${privateKeyNote}`);
-    console.log(`\nKeep the signing key private. In CI, set BIPOPUSH_SIGNING_KEY to the base64 of that file.`);
-    console.log(`Saved ${PROJECT_FILE} — commit it (it has no secrets).`);
-    console.log(`Next: rebuild the native app once, then run: bipopush release`);
-}
-async function fetchBase(token, appId, channel, platform, appVersion) {
-    const { base } = await request(`/apps/${appId}/base?${new URLSearchParams({ channel, platform, appVersion })}`, { token });
-    if (!base)
-        return null;
-    const res = await fetch(base.url);
-    if (!res.ok)
-        throw new Error(`Could not download the previous release (${res.status})`);
-    const hbc = decompress(Buffer.from(await res.arrayBuffer()));
-    if (sha256Hex(hbc) !== base.sha256)
-        throw new Error("Previous release failed its integrity check");
-    return { artifactId: base.artifactId, sha256: base.sha256, hbc };
-}
-async function put(url, data) {
-    const res = await fetch(url, {
-        method: "PUT",
-        headers: { "content-type": "application/octet-stream", "content-length": String(data.length) },
-        body: new Uint8Array(data),
-    });
-    if (!res.ok)
-        throw new Error(`Upload failed (${res.status}): ${(await res.text()).slice(0, 200)}`);
-}
-function summary(a) {
-    const saved = 100 - (a.full.length / a.jsSize) * 100;
-    console.log(`\n${a.platform} ${a.appVersion}`);
-    console.log(`  JS ${kb(a.jsSize)} → Hermes ${kb(a.bundleSize)} → brotli ${kb(a.full.length)}  (${saved.toFixed(0)}% smaller)`);
-    if (a.patch) {
-        console.log(`  patch ${kb(a.patch.data.length)} vs previous release (${(100 - (a.patch.data.length / a.full.length) * 100).toFixed(0)}% smaller than full)`);
-    }
-    else {
-        console.log(`  no patch: ${a.patchNote}`);
-    }
-    if (a.assets.length > 0) {
-        console.log(`  assets ${a.assets.length} files, ${kb(a.assets.reduce((n, x) => n + x.size, 0))} (manifest signed)`);
-    }
-    console.log(`  sha256 ${a.sha256.slice(0, 16)}…  signed ✓`);
-}
-/** Bundles, compiles, signs, compresses, diffs and uploads one release. */
-export async function release(token, opts) {
-    const config = loadProjectConfig(opts.cwd);
-    if (!config)
-        throw new Error(`No ${PROJECT_FILE} here. Run: bipopush init`);
-    const project = detectProject(opts.cwd);
-    const privateKey = loadSigningKey(config.appId);
-    const { app } = await request(`/apps/${config.appId}`, { token });
-    const wanted = opts.platform === "all" ? ["ios", "android"] : [opts.platform];
-    const platforms = wanted.filter((p) => project[p].id && project[p].version);
-    if (platforms.length === 0)
-        throw new Error(`No native ${wanted.join("/")} project found to release for`);
-    console.log(`Releasing ${app.name} → ${opts.channel} (${platforms.join(", ")})`);
-    const packed = [];
-    for (const platform of platforms) {
-        const appVersion = project[platform].version;
-        const base = await fetchBase(token, app.id, opts.channel, platform, appVersion);
-        packed.push(await packPlatform({ project, platform, appVersion, entryFile: config.entryFile ?? project.entryFile, privateKey, base }));
-    }
-    packed.forEach(summary);
-    if (opts.dryRun) {
-        console.log("\nDry run: nothing uploaded.");
-        return;
-    }
-    // Assets are stored once per app: upload only the hashes the server does not have.
-    const allAssets = new Map();
-    for (const a of packed)
-        for (const x of a.assets)
-            allAssets.set(x.sha256, { sha256: x.sha256, size: x.size, data: a.assetFiles.get(x.sha256) });
-    if (allAssets.size > 0) {
-        const { uploads } = await request(`/apps/${app.id}/assets`, {
-            method: "POST",
-            token,
-            headers: { "content-type": "application/json" },
-            body: JSON.stringify({ assets: [...allAssets.values()].map(({ sha256, size }) => ({ sha256, size })) }),
-        });
-        for (const u of uploads)
-            await put(u.url, allAssets.get(u.sha256).data);
-        const bytes = uploads.reduce((n, u) => n + allAssets.get(u.sha256).size, 0);
-        console.log(`\nAssets: ${uploads.length} new uploaded (${kb(bytes)}), ${allAssets.size - uploads.length} already stored.`);
-    }
-    const created = await waitingForBurst(() => request(`/apps/${app.id}/releases`, {
-        method: "POST",
-        token,
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify({
-            channel: opts.channel,
-            message: opts.message,
-            mandatory: Boolean(opts.mandatory),
-            artifacts: packed.map((a) => ({
-                platform: a.platform,
-                appVersion: a.appVersion,
-                sha256: a.sha256,
-                signature: a.signature,
-                bundleSize: a.bundleSize,
-                fullSize: a.full.length,
-                ...(a.patch ? { patch: { baseArtifactId: a.patch.baseArtifactId, size: a.patch.data.length } } : {}),
-                ...(a.assets.length > 0 ? { assets: a.assets } : {}),
-            })),
-        }),
-    }));
-    for (const upload of created.uploads) {
-        const a = packed.find((p) => p.platform === upload.platform);
-        await put(upload.fullUrl, a.full);
-        if (upload.patchUrl && a.patch)
-            await put(upload.patchUrl, a.patch.data);
-    }
-    const { release: published, usage } = await waitingForBurst(() => request(`/releases/${created.releaseId}/publish`, { method: "POST", token }));
-    const labels = published.artifacts.map((a) => `${a.platform === "ios" ? "iOS" : "Android"} ${a.appVersion} v${a.version}`);
-    console.log(`\nPublished ${labels.join(", ")} to ${opts.channel}${opts.mandatory ? " (mandatory)" : ""}.`);
-    console.log(`${usage.used} release${usage.used === 1 ? "" : "s"} of this app in the last 24h.`);
-}
-/** Waits out a release pause (going over the plan's releases per 10 minutes) instead of failing, e.g. in CI. */
-async function waitingForBurst(call) {
-    for (;;) {
-        try {
-            return await call();
-        }
-        catch (err) {
-            if (!(err instanceof ApiError) || err.body.error !== "release_too_soon")
-                throw err;
-            const wait = Number(err.body.retryAfterSeconds);
-            if (!(wait > 0 && wait <= 31 * 60))
-                throw err;
-            console.log(`${err.message} Waiting ${wait}s…`);
-            await new Promise((r) => setTimeout(r, wait * 1000));
-        }
-    }
-}
-export async function memberships(token) {
-    return (await request("/me", { token })).organizations;
-}
-/** The organization new apps go to: --org (id, slug or name), or the only one the user can create apps in. */
-async function pickOrganization(token, ref) {
-    const orgs = (await memberships(token)).filter((o) => o.role.permissions.includes("app:create"));
-    if (ref) {
-        const wanted = ref.toLowerCase();
-        const match = orgs.find((o) => [o.id, o.slug.current, o.slug.hash, o.slug.custom, o.name.toLowerCase()].includes(wanted));
-        if (!match)
-            throw new Error(`No organization "${ref}" where you can create apps. Run: bipopush whoami`);
-        return match;
-    }
-    if (orgs.length === 1)
-        return orgs[0];
-    if (orgs.length === 0)
-        throw new Error("Your role can't create apps in any organization. Ask an owner or admin.");
-    const list = orgs.map((o) => `  --org ${o.slug.current}   ${o.name}`).join("\n");
-    throw new Error(`You belong to several organizations. Pick one:\n${list}`);
-}
-export async function listApps(token) {
-    const { apps, organizations } = await request("/apps", { token });
-    if (apps.length === 0)
-        console.log("No apps yet. Run: bipopush init");
-    for (const org of organizations) {
-        const own = apps.filter((a) => a.organization.id === org.id);
-        const limit = org.maxApps === null ? "unlimited" : `${own.length}/${org.maxApps}`;
-        console.log(`\n${org.name} (${org.plan}, ${limit} apps)`);
-        for (const a of own) {
-            console.log(`  ${a.name}  ${a.id}\n    key ${a.appKey}  ·  ${a.mau} MAU  ·  ${a.usage.used}/${a.usage.limit} releases today`);
-        }
-    }
-}
-/**
- * Re-publishes the newest live version of a channel (or a given --version) in another channel,
- * e.g. staging → production after testing. Same bundle and signature; does not use the daily quota.
- */
-export async function promote(token, opts) {
-    const config = loadProjectConfig(opts.cwd);
-    if (!config)
-        throw new Error(`No ${PROJECT_FILE} here. Run: bipopush init`);
-    if (opts.from === opts.to)
-        throw new Error("--from and --to must be different channels");
-    const { releases } = await request(`/apps/${config.appId}/releases`, { token });
-    const candidates = releases
-        .filter((r) => r.channel === opts.from)
-        .flatMap((r) => r.artifacts)
-        .filter((a) => !a.disabled && !a.fileDeleted && (opts.platform === "all" || a.platform === opts.platform));
-    const picked = new Map();
-    for (const a of candidates) {
-        if (opts.version !== undefined && a.version !== opts.version)
-            continue;
-        const key = `${a.platform}/${a.appVersion}`;
-        if (!picked.has(key) || picked.get(key).version < a.version)
-            picked.set(key, a);
-    }
-    if (picked.size === 0)
-        throw new Error(`No live ${opts.version ? `v${opts.version} ` : ""}version in ${opts.from} to promote`);
-    for (const a of picked.values()) {
-        const { release: r } = await request(`/apps/${config.appId}/artifacts/${a.id}/promote`, { method: "POST", token, headers: { "content-type": "application/json" }, body: JSON.stringify({ channel: opts.to }) });
-        const label = `${a.platform === "ios" ? "iOS" : "Android"} ${a.appVersion}`;
-        console.log(`Promoted ${label} ${opts.from} v${a.version} → ${opts.to} v${r.artifacts[0].version}`);
-    }
-}

package/dist/config.js

@@ -1,29 +0,0 @@
-import { chmod, mkdir, readFile, rm, writeFile } from "node:fs/promises";
-import { homedir } from "node:os";
-import path from "node:path";
-export const API_URL = (process.env.BIPOPUSH_API_URL ?? "https://api.bipopush.com").replace(/\/$/, "");
-export const SIGN_URL = (process.env.BIPOPUSH_SIGN_URL ?? "https://sign.bipopush.com").replace(/\/$/, "");
-export const CONFIG_DIR = path.join(process.env.XDG_CONFIG_HOME ?? path.join(homedir(), ".config"), "bipopush");
-const dir = CONFIG_DIR;
-export const CREDENTIALS_FILE = path.join(dir, "credentials.json");
-export async function loadCredentials() {
-    if (process.env.BIPOPUSH_TOKEN) {
-        return { apiUrl: API_URL, token: process.env.BIPOPUSH_TOKEN, email: "(BIPOPUSH_TOKEN)" };
-    }
-    try {
-        const creds = JSON.parse(await readFile(CREDENTIALS_FILE, "utf8"));
-        // A token is only valid for the API that issued it.
-        return creds.apiUrl === API_URL ? creds : null;
-    }
-    catch {
-        return null;
-    }
-}
-export async function saveCredentials(creds) {
-    await mkdir(dir, { recursive: true, mode: 0o700 });
-    await writeFile(CREDENTIALS_FILE, JSON.stringify(creds, null, 2), { mode: 0o600 });
-    await chmod(CREDENTIALS_FILE, 0o600);
-}
-export async function clearCredentials() {
-    await rm(CREDENTIALS_FILE, { force: true });
-}

package/dist/http.js

@@ -1,41 +0,0 @@
-import { API_URL } from "./config.js";
-export class ApiError extends Error {
-    status;
-    body;
-    constructor(status, body) {
-        super(body.message ?? `Request failed with status ${status}`);
-        this.status = status;
-        this.body = body;
-    }
-}
-const STALE_SOCKET = new Set(["ECONNRESET", "EPIPE", "UND_ERR_SOCKET"]);
-export async function request(path, init = {}) {
-    const headers = new Headers(init.headers);
-    headers.set("user-agent", `bipopush-cli/0.1.0 node/${process.versions.node} ${process.platform}`);
-    if (init.token)
-        headers.set("authorization", `Bearer ${init.token}`);
-    let res;
-    for (let attempt = 0; !res; attempt++) {
-        try {
-            res = await fetch(`${API_URL}${path}`, { ...init, headers });
-        }
-        catch (err) {
-            const cause = err.cause;
-            // A pooled keep-alive socket can be closed by the server while a long build runs: retry once on a fresh one.
-            if (attempt === 0 && cause?.code && STALE_SOCKET.has(cause.code))
-                continue;
-            throw new Error(`Could not reach ${API_URL} (${cause?.code ?? cause?.message ?? err.message})`);
-        }
-    }
-    const text = await res.text();
-    let body = {};
-    try {
-        body = text ? JSON.parse(text) : {};
-    }
-    catch {
-        body = { message: text.slice(0, 200) };
-    }
-    if (!res.ok)
-        throw new ApiError(res.status, body);
-    return body;
-}

package/dist/keys.js

@@ -1,41 +0,0 @@
-import { createPrivateKey, createPublicKey, generateKeyPairSync, sign } from "node:crypto";
-import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import path from "node:path";
-import { CONFIG_DIR } from "./config.js";
-/**
- * Release signing keys (ed25519). The private key stays on the developer machine or in CI
- * (BIPOPUSH_SIGNING_KEY); the public key is embedded in the app and stored on the server.
- */
-export function keyFile(appId) {
-    return path.join(CONFIG_DIR, "keys", `${appId}.pem`);
-}
-export function rawPublicKey(key) {
-    return createPublicKey(key).export({ format: "der", type: "spki" }).subarray(-32).toString("base64");
-}
-export function generateSigningKey() {
-    const { privateKey } = generateKeyPairSync("ed25519");
-    return { privateKey, publicKey: rawPublicKey(privateKey) };
-}
-export function saveSigningKey(appId, privateKey) {
-    const file = keyFile(appId);
-    mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
-    writeFileSync(file, privateKey.export({ format: "pem", type: "pkcs8" }), { mode: 0o600 });
-    chmodSync(file, 0o600);
-    return file;
-}
-export function loadSigningKey(appId) {
-    const fromEnv = process.env.BIPOPUSH_SIGNING_KEY;
-    if (fromEnv) {
-        const pem = fromEnv.includes("BEGIN") ? fromEnv : Buffer.from(fromEnv, "base64").toString("utf8");
-        return createPrivateKey(pem);
-    }
-    const file = keyFile(appId);
-    if (!existsSync(file)) {
-        throw new Error(`Signing key not found at ${file}. Set BIPOPUSH_SIGNING_KEY or run bipopush init on the machine that has the key.`);
-    }
-    return createPrivateKey(readFileSync(file));
-}
-/** Signs the raw 32-byte SHA-256 digest of the uncompressed bundle. */
-export function signDigest(privateKey, sha256Hex) {
-    return sign(null, Buffer.from(sha256Hex, "hex"), privateKey).toString("base64");
-}

package/dist/login.js

@@ -1,73 +0,0 @@
-import { spawn } from "node:child_process";
-import { createHash, randomBytes } from "node:crypto";
-import { createServer } from "node:http";
-import { API_URL, SIGN_URL, saveCredentials } from "./config.js";
-import { request } from "./http.js";
-const TIMEOUT_MS = 5 * 60 * 1000;
-function openBrowser(url) {
-    if (process.env.BIPOPUSH_NO_BROWSER)
-        return;
-    const [cmd, args] = process.platform === "darwin"
-        ? ["open", [url]]
-        : process.platform === "win32"
-            ? ["cmd", ["/c", "start", "", url]]
-            : ["xdg-open", [url]];
-    spawn(cmd, args, { stdio: "ignore", detached: true }).on("error", () => undefined).unref();
-}
-const page = (title, text) => `<!doctype html><meta charset="utf-8"><title>${title}</title><body style="font-family:system-ui;display:grid;place-items:center;height:100vh;margin:0"><div style="text-align:center"><h1>${title}</h1><p>${text}</p></div>`;
-/**
- * Browser-based login (PKCE):
- * 1. Listen on 127.0.0.1:<random port>.
- * 2. Open sign.bipopush.com/cli with the PKCE challenge, state and port.
- * 3. After the user approves, the browser is redirected to our callback with a one-time code.
- * 4. Exchange code + verifier for a CLI token.
- */
-export async function login() {
-    const verifier = randomBytes(48).toString("base64url");
-    const challenge = createHash("sha256").update(verifier).digest("base64url");
-    const state = randomBytes(24).toString("base64url");
-    const code = await new Promise((resolve, reject) => {
-        const server = createServer((req, res) => {
-            const url = new URL(req.url ?? "/", "http://127.0.0.1");
-            if (url.pathname !== "/callback") {
-                res.writeHead(404).end();
-                return;
-            }
-            const finish = (status, title, text, result) => {
-                res.writeHead(status, { "content-type": "text/html; charset=utf-8" }).end(page(title, text));
-                clearTimeout(timer);
-                server.close();
-                result();
-            };
-            if (url.searchParams.get("state") !== state) {
-                finish(400, "Login failed", "State mismatch. Run bipopush login again.", () => reject(new Error("State mismatch — possible forged callback")));
-                return;
-            }
-            const error = url.searchParams.get("error");
-            const code = url.searchParams.get("code");
-            if (error || !code) {
-                finish(400, "Login cancelled", "You can close this tab.", () => reject(new Error(error ?? "No code received")));
-                return;
-            }
-            finish(200, "BipoPush CLI is logged in", "You can close this tab and return to your terminal.", () => resolve(code));
-        });
-        const timer = setTimeout(() => {
-            server.close();
-            reject(new Error("Timed out waiting for the browser (5 minutes)"));
-        }, TIMEOUT_MS);
-        server.listen(0, "127.0.0.1", () => {
-            const { port } = server.address();
-            const url = `${SIGN_URL}/cli?${new URLSearchParams({ challenge, state, port: String(port) })}`;
-            console.log("Opening your browser to log in…");
-            console.log(`If it doesn't open, visit:\n  ${url}\n`);
-            openBrowser(url);
-        });
-    });
-    const { token, user } = await request("/cli/token", {
-        method: "POST",
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify({ code, codeVerifier: verifier }),
-    });
-    await saveCredentials({ apiUrl: API_URL, token, email: user.email });
-    console.log(`Logged in as ${user.email}`);
-}

package/dist/pack.js

@@ -1,174 +0,0 @@
-import { execFileSync } from "node:child_process";
-import { createHash } from "node:crypto";
-import { existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
-import { createRequire } from "node:module";
-import { tmpdir } from "node:os";
-import path from "node:path";
-import { brotliCompressSync, brotliDecompressSync, constants } from "node:zlib";
-import { signDigest } from "./keys.js";
-/** A patch is only worth shipping when it is clearly smaller than the compressed full bundle. */
-export const PATCH_RATIO = 0.6;
-const localRequire = createRequire(import.meta.url);
-function binFrom(root, request) {
-    return createRequire(path.join(root, "package.json")).resolve(request);
-}
-export function findHermesc(root) {
-    const os = process.platform === "darwin" ? "osx-bin" : process.platform === "win32" ? "win64-bin" : "linux64-bin";
-    const exe = process.platform === "win32" ? "hermesc.exe" : "hermesc";
-    const candidates = [];
-    for (const pkg of ["hermes-compiler/package.json", "react-native/package.json"]) {
-        try {
-            const dir = path.dirname(binFrom(root, pkg));
-            candidates.push(path.join(dir, "hermesc", os, exe), path.join(dir, "sdks", "hermesc", os, exe));
-        }
-        catch {
-            // package not installed
-        }
-    }
-    const found = candidates.find(existsSync);
-    if (!found)
-        throw new Error("hermesc not found — install the app dependencies first (npm install)");
-    return found;
-}
-export function sha256Hex(data) {
-    return createHash("sha256").update(data).digest("hex");
-}
-export function compress(data) {
-    return brotliCompressSync(data, {
-        params: {
-            [constants.BROTLI_PARAM_QUALITY]: 11,
-            [constants.BROTLI_PARAM_LGWIN]: 24,
-            [constants.BROTLI_PARAM_SIZE_HINT]: data.length,
-        },
-    });
-}
-export function decompress(data) {
-    return brotliDecompressSync(data);
-}
-/** BSDIFF40 patch (old → new), or null when the optional native addon is unavailable. */
-export async function makePatch(oldData, newData, workDir) {
-    let bsdiff;
-    try {
-        bsdiff = localRequire("bsdiff-nodejs");
-    }
-    catch {
-        return null;
-    }
-    const oldFile = path.join(workDir, "base.hbc");
-    const newFile = path.join(workDir, "new.hbc");
-    const patchFile = path.join(workDir, "bundle.bspatch");
-    writeFileSync(oldFile, oldData);
-    writeFileSync(newFile, newData);
-    await bsdiff.diff(oldFile, newFile, patchFile);
-    return readFileSync(patchFile);
-}
-/**
- * Canonical manifest digest (same in the API and the native SDK):
- * "bipopush-manifest-v1\n" + "bundle <sha256>\n" + one "<sha256> <path>\n" per asset, sorted by path.
- */
-export function manifestDigestHex(bundleSha256, assets) {
-    const lines = [...assets].sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0)).map((a) => `${a.sha256} ${a.path}\n`);
-    return sha256Hex(Buffer.from(`bipopush-manifest-v1\nbundle ${bundleSha256}\n${lines.join("")}`));
-}
-/** Walks Metro's assets-dest output; paths are relative to it, which is the folder next to the bundle. */
-export function collectAssets(root) {
-    const assets = [];
-    const files = new Map();
-    const walk = (dir) => {
-        for (const name of readdirSync(dir)) {
-            if (name === ".DS_Store")
-                continue;
-            const full = path.join(dir, name);
-            if (statSync(full).isDirectory())
-                walk(full);
-            else {
-                const data = readFileSync(full);
-                const hash = sha256Hex(data);
-                assets.push({ path: path.relative(root, full).split(path.sep).join("/"), sha256: hash, size: data.length });
-                files.set(hash, data);
-            }
-        }
-    };
-    if (existsSync(root))
-        walk(root);
-    assets.sort((a, b) => (a.path < b.path ? -1 : 1));
-    return { assets, files };
-}
-export function assetsDir(outDir) {
-    return path.join(outDir, "assets-out");
-}
-/** Produces the JavaScript bundle with the project's own toolchain (Metro or Expo). */
-export function bundleJs(project, platform, entryFile, outDir) {
-    const out = path.join(outDir, `index.${platform}.bundle`);
-    const assets = assetsDir(outDir);
-    mkdirSync(assets, { recursive: true });
-    if (project.type === "expo") {
-        const expoCli = binFrom(project.root, "expo/bin/cli");
-        execFileSync(process.execPath, [expoCli, "export:embed", "--platform", platform, "--dev", "false", "--minify", "false", "--entry-file", entryFile, "--bundle-output", out, "--assets-dest", assets], { cwd: project.root, stdio: "inherit" });
-    }
-    else {
-        const rnCli = binFrom(project.root, "react-native/cli.js");
-        execFileSync(process.execPath, [rnCli, "bundle", "--platform", platform, "--dev", "false", "--minify", "false", "--entry-file", entryFile, "--bundle-output", out, "--assets-dest", assets], { cwd: project.root, stdio: "inherit" });
-    }
-    return out;
-}
-/** Compiles to Hermes bytecode; with a base, hermesc lays out the output to diff well against it. */
-export function compileHermes(hermesc, jsFile, outDir, baseFile) {
-    const out = path.join(outDir, "index.hbc");
-    const args = ["-O", "-w", "-emit-binary", `-out=${out}`];
-    if (baseFile)
-        args.push(`-base-bytecode=${baseFile}`);
-    args.push(jsFile);
-    execFileSync(hermesc, args, { stdio: ["ignore", "inherit", "inherit"] });
-    return out;
-}
-export async function packPlatform(opts) {
-    const work = mkdtempSync(path.join(tmpdir(), `bipopush-${opts.platform}-`));
-    try {
-        return await packIn(work, opts);
-    }
-    finally {
-        rmSync(work, { recursive: true, force: true });
-    }
-}
-async function packIn(work, opts) {
-    const jsFile = opts.jsFile ?? bundleJs(opts.project, opts.platform, opts.entryFile, work);
-    const hermesc = findHermesc(opts.project.root);
-    let baseFile = null;
-    if (opts.base) {
-        baseFile = path.join(work, "base-input.hbc");
-        writeFileSync(baseFile, opts.base.hbc);
-    }
-    const hbc = readFileSync(compileHermes(hermesc, jsFile, work, baseFile));
-    const sha256 = sha256Hex(hbc);
-    const full = compress(hbc);
-    const { assets, files } = collectAssets(opts.assetsRoot ?? assetsDir(work));
-    // With assets, the signature covers the whole manifest so no file can be swapped.
-    const signedDigest = assets.length > 0 ? manifestDigestHex(sha256, assets) : sha256;
-    let patch = null;
-    let patchNote = "no previous release for this channel and version";
-    if (opts.base) {
-        const data = await makePatch(opts.base.hbc, hbc, work);
-        if (!data)
-            patchNote = "bsdiff-nodejs not installed";
-        else if (data.length >= full.length * PATCH_RATIO)
-            patchNote = `patch ${data.length} B is not smaller than ${PATCH_RATIO * 100}% of full`;
-        else {
-            patch = { baseArtifactId: opts.base.artifactId, data };
-            patchNote = "";
-        }
-    }
-    return {
-        platform: opts.platform,
-        appVersion: opts.appVersion,
-        jsSize: readFileSync(jsFile).length,
-        bundleSize: hbc.length,
-        sha256,
-        signature: signDigest(opts.privateKey, signedDigest),
-        full,
-        patch,
-        patchNote,
-        assets,
-        assetFiles: files,
-    };
-}