@fireota/cli 0.5.0 → 0.7.0

package/README.md

@@ -70,7 +70,7 @@ fireota publish  --app <appId> --platform <android|ios|all> [--runtime <x.y.z>]
 fireota bundle   --platform <android|ios> [--entry index.js] [--out update.fota] [--hermes auto|on|off]
 fireota whoami
 fireota signing generate [--out ./fireota-keys]
-fireota release create   --app <appId> --platform <p> --runtime <r> [--message m] [--version v] [--channel c]
+fireota release create   --app <appId> --platform <p> --runtime <r> [--bundle-url <url>] [--bundle-hash <sha256>] [--bundle-size <bytes>] [--message m] [--version v] [--channel c]
 fireota release upload   <releaseId> --file update.fota [--private-key key.pem]
 fireota release publish  <releaseId> [--rollout 100]
 fireota release rollout  <releaseId> --percentage <0-100>
@@ -112,6 +112,10 @@ script:
   - npx fireota publish --app "$FIREOTA_APP_ID" --platform android --runtime 1.3.0 --message "$(git log -1 --pretty=%s)"
 ```
 
+## Changelog
+
+See the root [CHANGELOG.md](../../CHANGELOG.md) for version release notes and update history.
+
 ## License
 
 MIT

package/bin/fireota.mjs

@@ -9,15 +9,33 @@
  */
 import { execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { createRequire } from "node:module";
 import { join, relative, resolve } from "node:path";
 
 import { detectCi } from "../lib/ci.mjs";
+import {
+  buildPatchApk,
+  buildStore,
+  flutter as runFlutter,
+  flutterConfigSource,
+  flutterVersionInfo,
+  isFlutterProject,
+  libappByAbi,
+  newBuildId,
+  patchCompatibilityProblems,
+  patchFlutterActivity,
+  patchFlutterMain,
+  pluginsHash,
+  readBaseRecord,
+  readPubspec,
+  sha256 as sha256Hex,
+  writeBaseRecord,
+} from "../lib/flutter.mjs";
 import { runInit } from "../lib/init.mjs";
 import { packDirectory } from "../lib/package.mjs";
-import { isExpoProject, readExpoAppJson, storeVersion } from "../lib/project.mjs";
+import { findFile, isExpoProject, readExpoAppJson, storeVersion } from "../lib/project.mjs";
 import { generateKeys, loadPrivateKey, signUpdate } from "../lib/signing.mjs";
 
 const HELP = `FireOTA CLI
@@ -44,6 +62,21 @@ Usage:
   fireota release rollback <releaseId> --reason "..." [--target <releaseId>]
   fireota releases [--app <appId>] [--json]
 
+Flutter (pub.dev package \`fireota\`):
+  fireota init     In a Flutter project: writes lib/fireota_config.dart, starts FireOTA in main.dart
+                   and makes MainActivity extend FireOTAFlutterActivity.
+  fireota flutter release android [--apk] [-- <flutter build args>]
+                   Builds the store build (app bundle, or --apk) and records its fingerprints in
+                   .fireota/flutter/ — commit that file; patches are checked against it.
+  fireota flutter patch android --app <appId> --message "What changed" --private-key key.pem
+                   [--abis arm64-v8a,x86_64] [--assets <dir>] [--config config.json] [--channel c]
+                   [--rollout 10] [--mandatory] [--out patch.fota --dry-run] [--force] [-- <flutter build args>]
+                   Compiles your current Dart code into a signed code patch for the recorded store
+                   build and publishes it. Android only; code patches must be signed.
+  fireota flutter assets --platform <android|ios|all> --app <appId> --assets <dir> [--config config.json]
+                   [--message m] [--private-key key.pem] [--channel c] [--rollout 10]
+                   Publishes asset and remote-config updates (Android and iOS).
+
 Updates are identified by their ID (like Expo): --version is only an optional label, and
 --runtime must equal the runtime version of the store build the update is for. Without
 --runtime, the app's store version is used (android/app/build.gradle versionName, iOS
@@ -233,6 +266,15 @@ async function createRelease(flags, platform, extra = {}) {
     ...(ci.gitCommitSha ? { gitCommitSha: ci.gitCommitSha.slice(0, 64) } : {}),
     ...(ci.gitBranch ? { gitBranch: ci.gitBranch.slice(0, 120) } : {}),
     ...(ci.buildNumber ? { buildNumber: String(ci.buildNumber).slice(0, 40) } : {}),
+    ...(flags["bundle-url"]
+      ? {
+          externalBundle: {
+            url: String(flags["bundle-url"]),
+            sha256: String(flags["bundle-hash"] || flags.hash || ""),
+            size: Number(flags["bundle-size"] || flags.size || 0),
+          },
+        }
+      : {}),
     ...extra,
   };
   // Same inputs -> same release, so a retried CI job never creates duplicates.
@@ -255,7 +297,7 @@ async function uploadRelease(releaseId, file, signing) {
   }
   log(`Uploading ${(bytes.length / 1024 / 1024).toFixed(2)} MB…`);
   const result = await api("POST", `/releases/${releaseId}/bundle`, form, headers);
-  log(`Verified in your Firebase Storage. SHA-256 ${result.checksum}`);
+  log(`Verified in your cloud storage. SHA-256 ${result.checksum}`);
   return result;
 }
 
@@ -315,7 +357,7 @@ async function uploadExpoRelease(releaseId, exported, config) {
   form.append("expoConfig", JSON.stringify(config));
   log(`Uploading bundle + ${exported.assets.length} assets…`);
   const result = await api("POST", `/releases/${releaseId}/bundle`, form, { "x-bundle-sha256": sha256(bytes) });
-  log(`Verified in your Firebase Storage. SHA-256 ${result.checksum}`);
+  log(`Verified in your cloud storage. SHA-256 ${result.checksum}`);
   return result;
 }
 
@@ -357,7 +399,9 @@ async function releaseAction(releaseId, body) {
 /** Create → upload → publish, skipping steps a retried CI job already completed. */
 async function publishOne(flags, platform, file, extra, privateKey) {
   const release = await createRelease(flags, platform, extra);
-  if (["draft", "failed", "uploading"].includes(release.status)) {
+  if (flags["bundle-url"]) {
+    log(`Using external bundle URL: ${flags["bundle-url"]}`);
+  } else if (["draft", "failed", "uploading"].includes(release.status)) {
     await uploadRelease(release.id, file, privateKey ? { key: privateKey, runtimeVersion: runtimeFor(flags, platform), platform } : null);
   } else {
     log(`Bundle already uploaded (status ${release.status}); skipping upload.`);
@@ -372,6 +416,225 @@ async function publishOne(flags, platform, file, extra, privateKey) {
   return { id: release.id, number: release.number, platform, rollout: result.rollout, status: "published" };
 }
 
+// ---------- Flutter ----------
+
+/** Arguments after a bare `--` go to `flutter build` unchanged. */
+function passthroughArgs() {
+  const index = process.argv.indexOf("--");
+  return index >= 0 ? process.argv.slice(index + 1) : [];
+}
+
+function flutterOnly() {
+  if (!isFlutterProject()) fail("Run this from your Flutter project root (pubspec.yaml with a flutter section).");
+}
+
+/** Builds the store build and records what a code patch has to match. */
+function flutterRelease(flags) {
+  flutterOnly();
+  const runtime = runtimeFor(flags, "android");
+  const buildId = newBuildId();
+  const versions = flutterVersionInfo();
+  log(`Building the Android store build ${runtime} (build ID ${buildId})…`);
+  const artifact = buildStore({ buildId, apk: Boolean(flags.apk), extra: passthroughArgs() });
+  const libs = libappByAbi(artifact);
+  if (!Object.keys(libs).length) fail(`${artifact} contains no libapp.so; is this a release build?`);
+  const record = {
+    platform: "android",
+    runtimeVersion: runtime,
+    buildId,
+    ...versions,
+    pluginsHash: pluginsHash(),
+    base: Object.fromEntries(Object.entries(libs).map(([abi, bytes]) => [abi, sha256Hex(bytes)])),
+    artifact: artifact.split("\\").join("/"),
+    createdAt: new Date().toISOString(),
+  };
+  const file = writeBaseRecord(record);
+  if (jsonMode) {
+    console.log(JSON.stringify({ ok: true, ...record, record: file }));
+    return;
+  }
+  log(`
+Store build: ${artifact}
+ABIs:        ${Object.keys(record.base).join(", ")}
+Recorded:    ${file}
+
+Next:
+  1. Commit ${file}: CI needs it to build patches for this store build.
+  2. Ship ${artifact} to Google Play (or your distribution channel) as usual.
+  3. Later, change Dart code and run:  fireota flutter patch android --app <appId> --private-key fireota-private.pem --message "What changed"`);
+}
+
+function stageDescriptor(dir, descriptor, flags) {
+  if (flags.assets && flags.assets !== true) {
+    if (!existsSync(String(flags.assets))) fail(`Assets folder not found: ${flags.assets}`);
+    cpSync(String(flags.assets), join(dir, "assets"), { recursive: true });
+  }
+  if (flags.config && flags.config !== true) {
+    const text = readFileSync(String(flags.config), "utf8");
+    try {
+      JSON.parse(text);
+    } catch {
+      fail(`${flags.config} is not valid JSON.`);
+    }
+    writeFileSync(join(dir, "config.json"), text);
+  }
+  writeFileSync(join(dir, "fireota.json"), `${JSON.stringify(descriptor, null, 2)}\n`);
+}
+
+function signingKey(flags, required) {
+  let key = null;
+  try {
+    key = loadPrivateKey(flags["private-key"] && flags["private-key"] !== true ? String(flags["private-key"]) : undefined);
+  } catch (error) {
+    fail(`Could not read the signing key: ${error instanceof Error ? error.message : error}`);
+  }
+  if (required && !key) {
+    fail("Code patches must be signed: pass --private-key fireota-private.pem (or set FIREOTA_SIGNING_KEY). Create keys with `fireota signing generate`.");
+  }
+  return key;
+}
+
+/** Compiles the current Dart code into a code patch for the recorded store build and publishes it. */
+async function flutterPatch(flags) {
+  flutterOnly();
+  const runtime = runtimeFor(flags, "android");
+  const base = readBaseRecord(runtime);
+  if (!base) {
+    fail(`No store build is recorded for runtime ${runtime}. Run \`fireota flutter release android\` for the build you shipped (or pass --runtime).`);
+  }
+  const current = { ...flutterVersionInfo(), pluginsHash: pluginsHash() };
+  const problems = patchCompatibilityProblems(base, current);
+  if (problems.length && !flags.force) fail(`This patch would not fit store build ${runtime}:\n  - ${problems.join("\n  - ")}`);
+  const abis = String(flags.abis && flags.abis !== true ? flags.abis : "arm64-v8a").split(",").map((a) => a.trim()).filter(Boolean);
+  const missing = abis.filter((abi) => !base.base?.[abi]);
+  if (missing.length) fail(`The store build has no ${missing.join(", ")} code. Recorded ABIs: ${Object.keys(base.base ?? {}).join(", ")}`);
+  const dryRun = Boolean(flags["dry-run"]);
+  const key = signingKey(flags, !dryRun);
+
+  const buildId = newBuildId();
+  log(`Building code patch ${buildId} for store build ${runtime} (${abis.join(", ")})…`);
+  const apk = buildPatchApk({ buildId, abis, extra: passthroughArgs() });
+  const libs = libappByAbi(apk);
+  const dir = mkdtempSync(join(tmpdir(), "fireota-patch-"));
+  try {
+    for (const abi of abis) {
+      if (!libs[abi]) fail(`The patch build has no ${abi} libapp.so.`);
+      mkdirSync(join(dir, "lib", abi), { recursive: true });
+      writeFileSync(join(dir, "lib", abi, "libapp.so"), libs[abi]);
+    }
+    stageDescriptor(
+      dir,
+      {
+        version: 1,
+        kind: "flutter-aot",
+        runtimeVersion: runtime,
+        buildId,
+        flutterVersion: current.flutterVersion,
+        engineRevision: current.engineRevision,
+        pluginsHash: current.pluginsHash,
+        base: Object.fromEntries(abis.map((abi) => [abi, base.base[abi]])),
+      },
+      flags,
+    );
+    const file = flags.out && flags.out !== true ? String(flags.out) : join(dir, "..", `fireota-patch-${buildId}.fota`);
+    writeFileSync(file, packDirectory(dir));
+    log(`Packed ${file} (${(readFileSync(file).length / 1024 / 1024).toFixed(2)} MB).`);
+    if (dryRun) {
+      if (jsonMode) console.log(JSON.stringify({ ok: true, file, buildId }));
+      return;
+    }
+    const result = await publishOne(flags, "android", file, {}, key);
+    if (jsonMode) console.log(JSON.stringify({ ok: true, buildId, updates: [result] }));
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+/** Publishes asset and remote-config updates. */
+async function flutterAssets(flags) {
+  flutterOnly();
+  const platform = need(flags, "platform");
+  if (!["android", "ios", "all"].includes(platform)) fail("--platform must be android, ios or all");
+  if (!flags.assets && !flags.config) fail("Pass --assets <dir> and/or --config config.json.");
+  const key = signingKey(flags, false);
+  const platforms = platform === "all" ? ["android", "ios"] : [platform];
+  const results = [];
+  for (const p of platforms) {
+    const dir = mkdtempSync(join(tmpdir(), "fireota-assets-"));
+    try {
+      stageDescriptor(dir, { version: 1, kind: "flutter-assets", runtimeVersion: runtimeFor(flags, p) }, flags);
+      const file = join(dir, "..", `fireota-assets-${p}-${Date.now()}.fota`);
+      writeFileSync(file, packDirectory(dir));
+      results.push(await publishOne(flags, p, file, {}, key));
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  }
+  if (jsonMode) console.log(JSON.stringify({ ok: true, updates: results }));
+}
+
+/** `fireota init` in a Flutter project. */
+function flutterInit(flags) {
+  const appId = flags.app && flags.app !== true ? String(flags.app) : process.env.FIREOTA_APP_ID;
+  const serverUrl = flags["server-url"] && flags["server-url"] !== true ? String(flags["server-url"]) : process.env.FIREOTA_URL;
+  if (!appId || !serverUrl) fail("Pass --app <appId> and --server-url <url> (or set FIREOTA_APP_ID and FIREOTA_URL).");
+  const channel = String(flags.channel && flags.channel !== true ? flags.channel : "production");
+  const dry = Boolean(flags["dry-run"]);
+  const results = [];
+  const write = (file, text) => {
+    if (!dry) writeFileSync(file, text);
+  };
+
+  if (readPubspec().hasFireOTA) results.push(["✓", "fireota is already a dependency"]);
+  else if (dry) results.push(["+", "would run: flutter pub add fireota"]);
+  else {
+    try {
+      runFlutter(["pub", "add", "fireota"]);
+      results.push(["✓", "added fireota to pubspec.yaml"]);
+    } catch {
+      results.push(["!", "could not add fireota; run: flutter pub add fireota"]);
+    }
+  }
+
+  const configFile = join("lib", "fireota_config.dart");
+  if (existsSync(configFile) && !flags.force) results.push(["✓", `${configFile} already exists (use --force to rewrite)`]);
+  else {
+    write(configFile, flutterConfigSource({ appId, serverUrl: serverUrl.replace(/\/+$/, ""), channel }));
+    results.push(["+", `wrote ${configFile}`]);
+  }
+
+  const mainFile = join("lib", "main.dart");
+  const mainSource = existsSync(mainFile) ? readFileSync(mainFile, "utf8") : null;
+  const patchedMain = mainSource === null ? null : patchFlutterMain(mainSource);
+  if (patchedMain === null) results.push(["!", "add to main(): WidgetsFlutterBinding.ensureInitialized(); await FireOTA.init(fireotaConfig);"]);
+  else if (patchedMain === mainSource) results.push(["✓", "main.dart already starts FireOTA"]);
+  else {
+    write(mainFile, patchedMain);
+    results.push(["+", "main.dart starts FireOTA before runApp"]);
+  }
+
+  const activity = findFile(join("android", "app", "src", "main"), (name) => /^MainActivity\.(kt|java)$/.test(name));
+  const activitySource = activity ? readFileSync(activity, "utf8") : null;
+  const patchedActivity = activitySource === null ? null : patchFlutterActivity(activitySource, activity.endsWith(".kt"));
+  if (patchedActivity === null) results.push(["!", "make MainActivity extend dev.fireota.flutter.FireOTAFlutterActivity (needed for code patches)"]);
+  else if (patchedActivity === activitySource) results.push(["✓", "MainActivity already uses FireOTAFlutterActivity"]);
+  else {
+    write(activity, patchedActivity);
+    results.push(["+", `${activity} extends FireOTAFlutterActivity`]);
+  }
+
+  console.log(dry ? "\nFireOTA init (dry run — nothing written):\n" : "\nFireOTA is set up for Flutter:\n");
+  for (const [mark, text] of results) console.log(`  ${mark} ${text}`);
+  console.log(`
+Runtime version: ${storeVersion("android") ?? "unknown"} (pubspec.yaml version — bump it for every store release).
+
+Next:
+  1. Optional, Android code push: fireota signing generate, paste the public key into
+     lib/fireota_config.dart and the dashboard, and set allowCodePush: true.
+  2. Build and record the store build:  fireota flutter release android
+  3. Ship a patch:  fireota flutter patch android --app ${appId} --private-key fireota-private.pem --message "What changed"`);
+}
+
 async function main() {
   const [command, sub, ...rest] = process.argv.slice(2);
   const { positional, flags } = parseArgs([sub, ...rest].filter((v) => v !== undefined));
@@ -385,6 +648,26 @@ async function main() {
     bundle(parseArgs(process.argv.slice(3)).flags);
     return;
   }
+  if (command === "flutter") {
+    const all = parseArgs(process.argv.slice(4, process.argv.includes("--") ? process.argv.indexOf("--") : undefined)).flags;
+    jsonMode = Boolean(all.json);
+    const target = process.argv[4] && !process.argv[4].startsWith("--") ? process.argv[4] : undefined;
+    const flagsAfterTarget = target ? parseArgs(process.argv.slice(5, process.argv.includes("--") ? process.argv.indexOf("--") : undefined)).flags : all;
+    if (sub === "release") {
+      if (target !== "android") fail("usage: fireota flutter release android [--apk]  (iOS store builds need no recording: iOS gets asset updates only)");
+      return flutterRelease(flagsAfterTarget);
+    }
+    if (sub === "patch") {
+      if (target !== "android") fail("usage: fireota flutter patch android …  (code patches are Android only)");
+      return flutterPatch(flagsAfterTarget);
+    }
+    if (sub === "assets") return flutterAssets(all);
+    fail("usage: fireota flutter <release|patch|assets> … (see fireota help)");
+  }
+  if (command === "init" && isFlutterProject()) {
+    flutterInit(parseArgs(process.argv.slice(3)).flags);
+    return;
+  }
   if (command === "init") {
     const all = parseArgs(process.argv.slice(3)).flags;
     const result = await runInit(all, { api, log, fail });

package/lib/flutter.mjs

@@ -0,0 +1,213 @@
+/**
+ * Flutter support: project detection, store builds ("bases") and code patches.
+ *
+ * A code patch is the compiled Dart library (libapp.so) of a new build. It only runs on the exact
+ * store build it was compiled against, so `fireota flutter release` records that build's
+ * fingerprints (SHA-256 of libapp.so per ABI, Flutter/engine version, native plugins) and
+ * `fireota flutter patch` refuses to build a patch that would not fit.
+ */
+import { execFileSync } from "node:child_process";
+import { createHash, randomBytes } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { basename, dirname, join } from "node:path";
+import { inflateRawSync } from "node:zlib";
+
+export const ABI_TARGETS = { "arm64-v8a": "android-arm64", "armeabi-v7a": "android-arm", "x86_64": "android-x64" };
+
+export function isFlutterProject(root = ".") {
+  const file = join(root, "pubspec.yaml");
+  return existsSync(file) && /^\s*flutter\s*:/m.test(readFileSync(file, "utf8"));
+}
+
+/** name and version from pubspec.yaml; `version: 1.2.0+7` gives version 1.2.0, build 7. */
+export function readPubspec(root = ".") {
+  const text = readFileSync(join(root, "pubspec.yaml"), "utf8");
+  const name = /^name:\s*["']?([\w-]+)/m.exec(text)?.[1] ?? "";
+  const raw = /^version:\s*["']?([^\s"'#]+)/m.exec(text)?.[1] ?? "";
+  const [version, build] = raw.split("+");
+  return { name, version: version ?? "", build: build ?? "", raw, hasFireOTA: /^\s{2}fireota\s*:/m.test(text) };
+}
+
+/** The runtime version the SDK reports by default: `<version>+<build>` of the store build. */
+export function flutterRuntime(root = ".") {
+  const { version, build } = readPubspec(root);
+  if (!version) return undefined;
+  return build ? `${version}+${build}` : version;
+}
+
+/** Runs the flutter tool. On Windows flutter is a .bat file, which only runs through cmd.exe. */
+export function flutter(args, { capture = false } = {}) {
+  const options = { stdio: capture ? ["ignore", "pipe", "inherit"] : "inherit", maxBuffer: 64 * 1024 * 1024 };
+  if (process.platform !== "win32") return execFileSync("flutter", args, options);
+  for (const arg of args) {
+    if (/["%^&|<>!\r\n]/.test(arg)) throw new Error(`Unsupported character in a flutter argument: ${arg}`);
+  }
+  const line = ["flutter", ...args].map((arg) => (/[\s,;=]/.test(arg) ? `"${arg}"` : arg)).join(" ");
+  return execFileSync(process.env.ComSpec ?? "cmd.exe", ["/d", "/s", "/c", `"${line}"`], { ...options, windowsVerbatimArguments: true });
+}
+
+/** Flutter framework and engine versions: a patch must be compiled by the same ones as its base. */
+export function flutterVersionInfo() {
+  const info = JSON.parse(flutter(["--version", "--machine"], { capture: true }).toString());
+  return { flutterVersion: info.frameworkVersion ?? info.flutterVersion, engineRevision: info.engineRevision ?? "" };
+}
+
+/**
+ * Fingerprint of the plugins with Android/iOS native code. Adding, removing or upgrading one
+ * changes native code, which only a store release can ship.
+ */
+export function pluginsHash(root = ".", platform = "android") {
+  const file = join(root, ".flutter-plugins-dependencies");
+  if (!existsSync(file)) return "";
+  const plugins = JSON.parse(readFileSync(file, "utf8")).plugins?.[platform] ?? [];
+  const ids = plugins
+    .filter((p) => p.native_build !== false)
+    .map((p) => `${p.name}:${basename(String(p.path ?? "").replace(/[\\/]+$/, ""))}`)
+    .sort();
+  return createHash("sha256").update(ids.join("\n")).digest("hex");
+}
+
+export function newBuildId() {
+  return `${Date.now().toString(36)}-${randomBytes(6).toString("hex")}`;
+}
+
+/** Reads entries from a ZIP (APK or AAB) whose names match `test`. Stored and deflated entries only. */
+export function readZipEntries(file, test) {
+  const zip = readFileSync(file);
+  let eocd = -1;
+  for (let i = zip.length - 22; i >= Math.max(0, zip.length - 65_557); i -= 1) {
+    if (zip.readUInt32LE(i) === 0x06054b50) {
+      eocd = i;
+      break;
+    }
+  }
+  if (eocd < 0) throw new Error(`${file} is not a ZIP archive.`);
+  const count = zip.readUInt16LE(eocd + 10);
+  let offset = zip.readUInt32LE(eocd + 16);
+  if (offset === 0xffffffff) throw new Error(`${file} is a ZIP64 archive, which is not supported.`);
+  const out = new Map();
+  for (let n = 0; n < count; n += 1) {
+    if (zip.readUInt32LE(offset) !== 0x02014b50) throw new Error(`${file}: corrupt central directory.`);
+    const method = zip.readUInt16LE(offset + 10);
+    const compressed = zip.readUInt32LE(offset + 20);
+    const nameLength = zip.readUInt16LE(offset + 28);
+    const extraLength = zip.readUInt16LE(offset + 30);
+    const commentLength = zip.readUInt16LE(offset + 32);
+    const local = zip.readUInt32LE(offset + 42);
+    const name = zip.toString("utf8", offset + 46, offset + 46 + nameLength);
+    offset += 46 + nameLength + extraLength + commentLength;
+    if (!test(name)) continue;
+    const start = local + 30 + zip.readUInt16LE(local + 26) + zip.readUInt16LE(local + 28);
+    const data = zip.subarray(start, start + compressed);
+    if (method === 0) out.set(name, Buffer.from(data));
+    else if (method === 8) out.set(name, inflateRawSync(data));
+    else throw new Error(`${file}: ${name} uses unsupported compression ${method}.`);
+  }
+  return out;
+}
+
+/** libapp.so per ABI from an APK (`lib/<abi>/libapp.so`) or AAB (`base/lib/<abi>/libapp.so`). */
+export function libappByAbi(archive) {
+  const entries = readZipEntries(archive, (name) => /(^|\/)lib\/[^/]+\/libapp\.so$/.test(name));
+  const result = {};
+  for (const [name, bytes] of entries) result[name.split("/").at(-2)] = bytes;
+  return result;
+}
+
+export const sha256 = (bytes) => createHash("sha256").update(bytes).digest("hex");
+
+export function baseRecordPath(runtime, root = ".") {
+  return join(root, ".fireota", "flutter", `android-${runtime.replace(/[^\w.+-]/g, "_")}.json`);
+}
+
+export function readBaseRecord(runtime, root = ".") {
+  const file = baseRecordPath(runtime, root);
+  return existsSync(file) ? JSON.parse(readFileSync(file, "utf8")) : null;
+}
+
+export function writeBaseRecord(record, root = ".") {
+  const file = baseRecordPath(record.runtimeVersion, root);
+  mkdirSync(dirname(file), { recursive: true });
+  writeFileSync(file, `${JSON.stringify(record, null, 2)}\n`);
+  return file;
+}
+
+/** Why a patch built now would not fit its base, or an empty list. */
+export function patchCompatibilityProblems(base, current) {
+  const problems = [];
+  if (base.flutterVersion !== current.flutterVersion) {
+    problems.push(`Flutter ${current.flutterVersion} differs from the store build's ${base.flutterVersion}.`);
+  }
+  if (base.engineRevision && current.engineRevision && base.engineRevision !== current.engineRevision) {
+    problems.push("The Flutter engine differs from the store build's.");
+  }
+  if (base.pluginsHash && current.pluginsHash && base.pluginsHash !== current.pluginsHash) {
+    problems.push("Plugins with native code were added, removed or upgraded since the store build; ship a store release.");
+  }
+  return problems;
+}
+
+export function buildStore({ buildId, apk = false, extra = [] }) {
+  flutter(["build", apk ? "apk" : "appbundle", "--release", `--dart-define=FIREOTA_BUILD_ID=${buildId}`, ...extra]);
+  return apk ? join("build", "app", "outputs", "flutter-apk", "app-release.apk") : join("build", "app", "outputs", "bundle", "release", "app-release.aab");
+}
+
+export function buildPatchApk({ buildId, abis, extra = [] }) {
+  const targets = abis.map((abi) => ABI_TARGETS[abi]).filter(Boolean);
+  flutter(["build", "apk", "--release", `--target-platform=${targets.join(",")}`, `--dart-define=FIREOTA_BUILD_ID=${buildId}`, ...extra]);
+  return join("build", "app", "outputs", "flutter-apk", "app-release.apk");
+}
+
+// ---------- fireota init for Flutter ----------
+
+export function flutterConfigSource({ appId, serverUrl, channel }) {
+  return `// Generated by \`fireota init\`. Safe to edit and commit.
+import 'package:fireota/fireota.dart';
+
+const fireotaConfig = FireOTAConfig(
+  appId: '${appId}',
+  serverUrl: '${serverUrl}',
+  channel: '${channel}',
+  // Dart code patches on Android. Read "Store policy" in the fireota README first.
+  allowCodePush: false,
+  // Paste fireota-public.pem here (fireota signing generate). Required for code patches.
+  codeSigningCertificate: null,
+);
+`;
+}
+
+/** Makes main() async and starts FireOTA before runApp. Returns null when it cannot patch safely. */
+export function patchFlutterMain(source, configImport = "fireota_config.dart") {
+  if (source.includes("FireOTA.init(")) return source;
+  // Keep the file's own line endings: `flutter create` writes CRLF on Windows.
+  const eol = source.includes("\r\n") ? "\r\n" : "\n";
+  const main = /^[ \t]*(?:Future<void>\s+|void\s+)?main\s*\(\s*\)\s*(?:async\s*)?\{/m.exec(source);
+  if (!main) return null;
+  const body = `Future<void> main() async {${eol}  WidgetsFlutterBinding.ensureInitialized();${eol}  await FireOTA.init(fireotaConfig);`;
+  let next = source.slice(0, main.index) + body + source.slice(main.index + main[0].length);
+  const imports = ["import 'package:fireota/fireota.dart';", `import '${configImport}';`];
+  if (!/import\s+['"]package:flutter\/(material|widgets|cupertino)\.dart['"]/.test(next)) imports.unshift("import 'package:flutter/widgets.dart';");
+  const lastImport = [...next.matchAll(/^import\s+[^;\r\n]+;[ \t]*(?=\r?$)/gm)].at(-1);
+  if (lastImport) {
+    const at = lastImport.index + lastImport[0].length;
+    next = `${next.slice(0, at)}${eol}${imports.join(eol)}${next.slice(at)}`;
+  } else {
+    next = `${imports.join(eol)}${eol}${eol}${next}`;
+  }
+  return next;
+}
+
+/** MainActivity extends FireOTAFlutterActivity, which starts the engine with the installed patch. */
+export function patchFlutterActivity(source, isKotlin) {
+  if (source.includes("FireOTAFlutterActivity")) return source;
+  if (isKotlin) {
+    if (!/:\s*FlutterActivity\(\)/.test(source)) return null;
+    return source
+      .replace(/import io\.flutter\.embedding\.android\.FlutterActivity(?=[ \t]*\r?\n)/, "import dev.fireota.flutter.FireOTAFlutterActivity")
+      .replace(/:\s*FlutterActivity\(\)/, ": FireOTAFlutterActivity()");
+  }
+  if (!/extends\s+FlutterActivity\b/.test(source)) return null;
+  return source
+    .replace(/import io\.flutter\.embedding\.android\.FlutterActivity;/, "import dev.fireota.flutter.FireOTAFlutterActivity;")
+    .replace(/extends\s+FlutterActivity\b/, "extends FireOTAFlutterActivity");
+}

package/lib/project.mjs

@@ -1,7 +1,9 @@
-/** Reads facts about the React Native project the CLI runs in. */
+/** Reads facts about the React Native or Flutter project the CLI runs in. */
 import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 
+import { flutterRuntime, isFlutterProject } from "./flutter.mjs";
+
 /** android/app/build.gradle(.kts): versionName "1.3.3" / versionName = "1.3.3" */
 export function androidVersionName(root = ".") {
   for (const file of ["android/app/build.gradle", "android/app/build.gradle.kts"]) {
@@ -57,6 +59,8 @@ export function expoVersion(root = ".") {
 
 /** The app's store version for a platform — FireOTA's default runtime version. */
 export function storeVersion(platform, root = ".") {
+  // Flutter: pubspec.yaml `version: 1.2.0+7` sets both stores' version, and the SDK reports "1.2.0+7".
+  if (isFlutterProject(root)) return flutterRuntime(root);
   const native = platform === "ios" ? iosMarketingVersion(root) : androidVersionName(root);
   // Expo projects without android/ or ios/ yet (Continuous Native Generation): use app.json.
   return native ?? (isExpoProject(root) ? expoVersion(root) : undefined);

package/package.json

@@ -1,40 +1,40 @@
-{
-  "name": "@fireota/cli",
-  "version": "0.5.0",
-  "description": "Build FireOTA update packages and publish React Native OTA releases from a terminal or CI.",
-  "license": "MIT",
-  "type": "module",
-  "bin": {
-    "fireota": "bin/fireota.mjs"
-  },
-  "files": [
-    "bin",
-    "lib",
-    "README.md",
-    "LICENSE"
-  ],
-  "engines": {
-    "node": ">=18.17"
-  },
-  "keywords": [
-    "react-native",
-    "ota",
-    "over-the-air",
-    "fireota",
-    "cli",
-    "ci"
-  ],
-  "publishConfig": {
-    "access": "public"
-  },
-  "author": "FireOTA",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/Sujay-Dynamisch/FireOTA.git",
-    "directory": "packages/cli"
-  },
-  "homepage": "https://github.com/Sujay-Dynamisch/FireOTA/tree/main/packages/cli#readme",
-  "bugs": {
-    "url": "https://github.com/Sujay-Dynamisch/FireOTA/issues"
-  }
-}
+{
+  "name": "@fireota/cli",
+  "version": "0.7.0",
+  "description": "Build FireOTA update packages and publish React Native OTA releases from a terminal or CI.",
+  "license": "MIT",
+  "type": "module",
+  "bin": {
+    "fireota": "bin/fireota.mjs"
+  },
+  "files": [
+    "bin",
+    "lib",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=18.17"
+  },
+  "keywords": [
+    "react-native",
+    "ota",
+    "over-the-air",
+    "fireota",
+    "cli",
+    "ci"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "author": "FireOTA",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Sujay-Dynamisch/FireOTA.git",
+    "directory": "packages/cli"
+  },
+  "homepage": "https://github.com/Sujay-Dynamisch/FireOTA/tree/main/packages/cli#readme",
+  "bugs": {
+    "url": "https://github.com/Sujay-Dynamisch/FireOTA/issues"
+  }
+}