@hot-updater/cli-tools 0.36.7 → 1.0.0-rc.0

package/dist/index.d.mts

@@ -1,8 +1,8 @@
 import { Readable } from "stream";
 import { Key as Key$1 } from "node:readline";
 import { Readable as Readable$1, Writable } from "node:stream";
+import { Bundle, BundleSigningPlugin, ConfigInput, LocalSigningConfig, Platform, RequiredDeep, SigningConfig, StoragePluginWith, StoragePutResult } from "@hot-updater/plugin-core";
 import * as _$_hot_updater_core0 from "@hot-updater/core";
-import { Bundle, ConfigInput, DatabasePlugin, NodeStoragePlugin, Platform, RequiredDeep } from "@hot-updater/plugin-core";
 
 //#region src/BuildLogger.d.ts
 type LinePattern = string | RegExp;
@@ -33,11 +33,28 @@ declare class BuildLogger {
   private showLogFileLocation;
 }
 //#endregion
+//#region src/apiKeyNote.d.ts
+declare const formatApiKeyNote: (apiKey: string) => string;
+//#endregion
 //#region src/banner.d.ts
 declare const link: (url: string) => string;
 declare const banner: (version?: string) => string;
 declare const printBanner: (version?: string) => void;
 //#endregion
+//#region src/bundleSigning.d.ts
+interface BundleSigningSession {
+  readonly name: string;
+  readonly publicKey: string;
+  readonly signFileHash: (fileHash: string) => Promise<string>;
+}
+declare const prepareBundleSigning: (signing: SigningConfig | undefined, options?: {
+  readonly cwd?: string;
+}) => Promise<BundleSigningSession | null>;
+/** Resolves the native trust anchor without calling a remote signing provider. */
+declare const getBundleSigningPublicKey: (signing: SigningConfig | undefined, options?: {
+  readonly cwd?: string;
+}) => Promise<string | null>;
+//#endregion
 //#region src/ConfigBuilder.d.ts
 type BuildType = "bare" | "rock" | "expo";
 type ImportInfo = {
@@ -246,6 +263,7 @@ type ManagedHelperStatement = {
   name: string;
   code: string;
   strategy: ManagedHelperStrategy;
+  replaceIncompatibleProperties?: string[];
 };
 type CreateHotUpdaterConfigScaffoldOptions = {
   build: BuildType;
@@ -334,6 +352,31 @@ declare const HotUpdateDirUtil: {
   }) => string;
 };
 //#endregion
+//#region src/infrastructureGeneration.d.ts
+type Fetch = typeof fetch;
+declare const assertInfrastructureGenerationPayload: ({
+  payload,
+  provider,
+  resource
+}: {
+  readonly payload: unknown;
+  readonly provider: string;
+  readonly resource: string;
+}) => void;
+declare const assertInfrastructureGenerationAtUrl: ({
+  fetchImpl,
+  legacyStatuses,
+  provider,
+  resource,
+  versionUrl
+}: {
+  readonly fetchImpl?: Fetch;
+  readonly legacyStatuses?: readonly number[];
+  readonly provider: string;
+  readonly resource: string;
+  readonly versionUrl: string;
+}) => Promise<void>;
+//#endregion
 //#region src/initProvider.d.ts
 type InitProviderInputPersistence = "always" | "with-consent";
 type InitProviderInputDefinition = {
@@ -432,6 +475,10 @@ declare class MissingInitInputsError extends InitError {
 declare class InitEnvFileError extends InitError {
   readonly name = "InitEnvFileError";
 }
+declare class LegacyInfrastructureError extends InitError {
+  readonly name = "LegacyInfrastructureError";
+  constructor(provider: string, resource: string);
+}
 declare const assertInitInputs: ({
   inputs,
   strict
@@ -457,12 +504,19 @@ declare const createLogWriter: ({
   logFilePath?: string;
 }) => Promise<HotUpdaterLogWriter>;
 //#endregion
+//#region src/localBundleSigning.d.ts
+declare const normalizeSigningConfig: (signing: SigningConfig | undefined) => BundleSigningPlugin | Extract<LocalSigningConfig, {
+  enabled: true;
+}> | undefined;
+//#endregion
 //#region src/loadConfig.d.ts
 type HotUpdaterConfigOptions = {
   platform: Platform;
   channel: string;
 } | null;
-type ConfigResponse = RequiredDeep<ConfigInput>;
+type ConfigResponse = RequiredDeep<Omit<ConfigInput, "database" | "signing" | "storage">> & Pick<ConfigInput, "database" | "storage"> & {
+  signing?: ReturnType<typeof normalizeSigningConfig>;
+};
 declare const loadConfig: (options: HotUpdaterConfigOptions) => Promise<ConfigResponse>;
 //#endregion
 //#region src/log.d.ts
@@ -486,63 +540,34 @@ declare const makeEnv: (newEnvVars: Record<string, EnvVarValue>, filePath?: stri
 }) => Promise<string>;
 //#endregion
 //#region src/promoteBundle.d.ts
+type PromoteStoragePlugin = StoragePluginWith<"get" | "put" | "exists" | "delete">;
 declare const LEGACY_BUNDLE_ERROR = "This OTA bundle was created by a version that does not support manifest.json. Copy bundle is not available.";
-interface PromoteBundleInput {
-  action: "copy" | "move";
-  bundleId: string;
-  nextBundleId?: string;
-  targetChannel: string;
-}
-interface PromoteBundleDependencies {
-  config: ConfigResponse;
-  databasePlugin: DatabasePlugin;
-  storagePlugin: NodeStoragePlugin | null;
-}
 declare function createCopiedBundleArchive({
   bundle,
   config,
   nextBundleId,
-  storagePlugin,
-  targetChannel
+  storagePlugin
 }: {
   bundle: Bundle;
   config: ConfigResponse;
   nextBundleId: string;
-  storagePlugin: NodeStoragePlugin;
-  targetChannel: string;
+  storagePlugin: PromoteStoragePlugin;
 }): Promise<{
   bundle: {
     id: string;
-    channel: string;
+    archiveByteSize: number;
     storageUri: string;
     fileHash: string;
     metadata: _$_hot_updater_core0.BundleMetadata | undefined;
     assetBaseStorageUri: string;
     patches: never[];
-    patchBaseBundleId: null;
     manifestFileHash: string;
     manifestStorageUri: string;
-    patchBaseFileHash: null;
-    patchFileHash: null;
-    patchStorageUri: null;
     platform: _$_hot_updater_core0.Platform;
-    shouldForceUpdate: boolean;
-    enabled: boolean;
     gitCommitHash: string | null;
-    message: string | null;
-    targetAppVersion: string | null;
-    fingerprintHash: string | null;
-    rolloutCohortCount?: number | null;
-    targetCohorts?: string[] | null;
   };
   uploadedStorageUris: string[];
 }>;
-declare function promoteBundle({
-  action,
-  bundleId,
-  nextBundleId,
-  targetChannel
-}: PromoteBundleInput, deps: PromoteBundleDependencies): Promise<Bundle>;
 //#endregion
 //#region ../../node_modules/.pnpm/@clack+core@1.4.3/node_modules/@clack/core/dist/index.d.mts
 declare const actions: readonly ["up", "down", "left", "right", "space", "enter", "cancel"];
@@ -1792,6 +1817,14 @@ declare const resolveHotUpdaterServerVersion: (currentPackageName: string, optio
   searchFrom?: string;
 }) => string;
 //#endregion
+//#region src/storageFiles.d.ts
+declare const getStorageFileByteSize: (filePath: string) => Promise<number>;
+declare const putStorageFile: (storage: StoragePluginWith<"put">, key: string, filePath: string) => Promise<StoragePutResult & {
+  byteSize: number;
+}>;
+declare const writeStorageFile: (storage: StoragePluginWith<"get">, storageUri: string, filePath: string) => Promise<void>;
+declare const writeStorageResponseFile: (response: Response, filePath: string) => Promise<void>;
+//#endregion
 //#region src/transformEnv.d.ts
 declare const transformEnv: <T extends Record<string, string>>(filename: string, env: T) => string;
 //#endregion
@@ -1809,4 +1842,4 @@ type TransformTemplateArgs<T extends string> = { [Key in ExtractPlaceholders<T>]
  */
 declare function transformTemplate<T extends string>(templateString: T, values: TransformTemplateArgs<T>): string;
 //#endregion
-export { BuildLogger, BuildLoggerConfig, BuildType, ConfigBuilder, ConfigBuilderScaffold, ConfigResponse, CreateHotUpdaterConfigScaffoldFromBuilderOptions, CreateHotUpdaterConfigScaffoldOptions, HOT_UPDATER_SERVER_PACKAGE_VERSION_ENV, HotUpdateDirUtil, HotUpdaterConfigOptions, HotUpdaterConfigScaffold, HotUpdaterInitEnv, HotUpdaterLogWriter, IConfigBuilder, ImportInfo, InitEnvFileError, InitError, InitProviderDefinition, InitProviderInputDefinition, InitProviderInputPersistence, LEGACY_BUNDLE_ERROR, ManagedHelperStatement, ManagedHelperStrategy, MissingInitInputsError, PromoteBundleDependencies, PromoteBundleInput, PromptProgress, PromptSpinner, ProviderConfig, ReactNativeMetadata, ReadPackageUpResult, RunInitOptions, WriteHotUpdaterConfigResult, assertInitInputs, assertInitProviderInputs, banner, typedColors as colors, confirmInitInputPersistence, copyDirToTmp, createCopiedBundleArchive, createHotUpdaterConfigScaffold, createHotUpdaterConfigScaffoldFromBuilder, createLogWriter, createTarBr, createTarBrTargetFiles, createTarGz, createTarGzTargetFiles, createZip, createZipTargetFiles, decryptJson, defineInitProvider, encryptJson, ensureInstallPackages, getAndroidSdkPath, getCwd, getHotUpdaterEnvValue, getHotUpdaterInitInputEnv, getInitProviderEnvVars, getInitProviderTextPromptValues, getMissingInitInputs, getMissingInitProviderInputs, getPackageManager, getReactNativeMetadatas, link, loadConfig, log, makeEnv, p, printBanner, promoteBundle, readHotUpdaterEnv, readHotUpdaterInitEnv, readPackageUp, renderImportStatements, resolveHotUpdaterServerVersion, resolveInitProviderInput, resolveInitProviderInputs, resolvePackageVersion, shouldAutoSelectOnlyInitResource, stripAnsi, transformEnv, transformTemplate, writeHotUpdaterConfig };
+export { BuildLogger, BuildLoggerConfig, BuildType, BundleSigningSession, ConfigBuilder, ConfigBuilderScaffold, ConfigResponse, CreateHotUpdaterConfigScaffoldFromBuilderOptions, CreateHotUpdaterConfigScaffoldOptions, HOT_UPDATER_SERVER_PACKAGE_VERSION_ENV, HotUpdateDirUtil, HotUpdaterConfigOptions, HotUpdaterConfigScaffold, HotUpdaterInitEnv, HotUpdaterLogWriter, IConfigBuilder, ImportInfo, InitEnvFileError, InitError, InitProviderDefinition, InitProviderInputDefinition, InitProviderInputPersistence, LEGACY_BUNDLE_ERROR, LegacyInfrastructureError, ManagedHelperStatement, ManagedHelperStrategy, MissingInitInputsError, PromptProgress, PromptSpinner, ProviderConfig, ReactNativeMetadata, ReadPackageUpResult, RunInitOptions, WriteHotUpdaterConfigResult, assertInfrastructureGenerationAtUrl, assertInfrastructureGenerationPayload, assertInitInputs, assertInitProviderInputs, banner, typedColors as colors, confirmInitInputPersistence, copyDirToTmp, createCopiedBundleArchive, createHotUpdaterConfigScaffold, createHotUpdaterConfigScaffoldFromBuilder, createLogWriter, createTarBr, createTarBrTargetFiles, createTarGz, createTarGzTargetFiles, createZip, createZipTargetFiles, decryptJson, defineInitProvider, encryptJson, ensureInstallPackages, formatApiKeyNote, getAndroidSdkPath, getBundleSigningPublicKey, getCwd, getHotUpdaterEnvValue, getHotUpdaterInitInputEnv, getInitProviderEnvVars, getInitProviderTextPromptValues, getMissingInitInputs, getMissingInitProviderInputs, getPackageManager, getReactNativeMetadatas, getStorageFileByteSize, link, loadConfig, log, makeEnv, p, prepareBundleSigning, printBanner, putStorageFile, readHotUpdaterEnv, readHotUpdaterInitEnv, readPackageUp, renderImportStatements, resolveHotUpdaterServerVersion, resolveInitProviderInput, resolveInitProviderInputs, resolvePackageVersion, shouldAutoSelectOnlyInitResource, stripAnsi, transformEnv, transformTemplate, writeHotUpdaterConfig, writeStorageFile, writeStorageResponseFile };

package/dist/index.mjs

@@ -17,6 +17,8 @@ import tty, { ReadStream } from "node:tty";
 import fs$2, { appendFileSync, createReadStream, createWriteStream as createWriteStream$1, existsSync, lstatSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
 import path$1, { basename, dirname as dirname$1, join, posix, win32 } from "node:path";
 import os, { constants } from "node:os";
+import crypto$1, { randomBytes, randomUUID } from "node:crypto";
+import fs$3 from "node:fs/promises";
 import { pipeline } from "stream/promises";
 import * as Ms from "zlib";
 import Jr, { constants as constants$1, createBrotliCompress } from "zlib";
@@ -24,8 +26,6 @@ import { EventEmitter as EventEmitter$1, addAbortListener, on, once, setMaxListe
 import As, { Duplex, PassThrough as PassThrough$1, Readable as Readable$1, Transform, Writable, getDefaultHighWaterMark } from "node:stream";
 import { StringDecoder } from "node:string_decoder";
 import no from "node:assert";
-import crypto$1, { randomBytes, randomUUID } from "node:crypto";
-import fs$3 from "node:fs/promises";
 import { fileURLToPath } from "node:url";
 import { ChildProcess, execFile, spawn, spawnSync } from "node:child_process";
 import { scheduler, setImmediate as setImmediate$1, setTimeout as setTimeout$1 } from "node:timers/promises";
@@ -33,10 +33,10 @@ import { serialize } from "node:v8";
 import { finished, pipeline as pipeline$1 } from "node:stream/promises";
 import { Buffer as Buffer$2 } from "node:buffer";
 import { parseSync } from "oxc-parser";
+import { createBundleStorageKey, createDatabasePlugin, createStoragePlugin, createStorageRootUriWithPath, detectCompressionFormat, getContentType, getManifestAssetDownloadPath, getManifestAssetStoragePath, isContentAddressedAssetFileHash, parseStorageUri, resolveManifestAssetStorageUri } from "@hot-updater/plugin-core";
 import { loadConfig as loadConfig$1 } from "unconfig";
-import { brotliDecompressSync, createBrotliCompress as createBrotliCompress$1 } from "node:zlib";
+import { brotliDecompressSync, constants as constants$2, createBrotliCompress as createBrotliCompress$1 } from "node:zlib";
 import { getManifestFileHash, stripBundleArtifactMetadata } from "@hot-updater/core";
-import { createBundleStorageKey, createStorageRootUriWithPath, createUUIDv7, detectCompressionFormat, getContentAddressedAssetStoragePath, getManifestAssetDownloadPath, resolveManifestAssetStorageUri } from "@hot-updater/plugin-core";
 import { transformSync } from "oxc-transform";
 //#endregion
 //#region src/colors.ts
@@ -22587,6 +22587,9 @@ var BuildLogger = class {
 	}
 };
 //#endregion
+//#region src/apiKeyNote.ts
+const formatApiKeyNote = (apiKey) => apiKey;
+//#endregion
 //#region ../../node_modules/.pnpm/ansi-regex@6.2.2/node_modules/ansi-regex/index.js
 function ansiRegex({ onlyFirst = false } = {}) {
 	return new RegExp(`(?:\\u001B\\][\\s\\S]*?(?:\\u0007|\\u001B\\u005C|\\u009C))|[\\u001B\\u009B][[\\]()#;?]*(?:\\d{1,4}(?:[;:]\\d{0,4})*)?[\\dA-PR-TZcf-nq-uy=><~]`, onlyFirst ? void 0 : "g");
@@ -24507,6 +24510,187 @@ const printBanner = (version) => {
 	console.log(banner(version));
 };
 //#endregion
+//#region src/localBundleSigning.ts
+const resolvePath$1 = (cwd, filePath) => path$1.isAbsolute(filePath) ? filePath : path$1.resolve(cwd, filePath);
+const loadPrivateKey = async (privateKeyPath) => {
+	try {
+		const privateKey = crypto$1.createPrivateKey(await fs$3.readFile(privateKeyPath, "utf8"));
+		if (privateKey.asymmetricKeyType !== "rsa" || (privateKey.asymmetricKeyDetails?.modulusLength ?? 0) < 2048) throw new Error("not rsa");
+		return privateKey;
+	} catch {
+		throw new Error("Failed to load the local bundle signing private key.");
+	}
+};
+const createLocalSigningPlugin = ({ privateKeyPath, publicKeyPath }) => {
+	const privateKeys = /* @__PURE__ */ new Map();
+	const getPrivateKey = (cwd = process.cwd()) => {
+		const resolvedPath = resolvePath$1(cwd, privateKeyPath);
+		const cached = privateKeys.get(resolvedPath);
+		if (cached) return cached;
+		const pending = loadPrivateKey(resolvedPath).catch((error) => {
+			privateKeys.delete(resolvedPath);
+			throw error;
+		});
+		privateKeys.set(resolvedPath, pending);
+		return pending;
+	};
+	return {
+		name: "localSigning",
+		publicKeyPath,
+		async getPublicKey({ cwd } = {}) {
+			const privateKey = await getPrivateKey(cwd);
+			return { publicKey: crypto$1.createPublicKey(privateKey).export({
+				format: "pem",
+				type: "spki"
+			}).toString() };
+		},
+		async sign({ message, cwd }) {
+			if (!(message instanceof Uint8Array) || message.byteLength !== 32) throw new Error("Local bundle signing messages must be exactly 32 bytes.");
+			const privateKey = await getPrivateKey(cwd);
+			return { signature: crypto$1.sign("RSA-SHA256", message, privateKey) };
+		}
+	};
+};
+const invalidSigningConfig = () => /* @__PURE__ */ new Error("Bundle signing must be a local key config or signing plugin. Omit signing to disable it.");
+const normalizeSigningConfig = (signing) => {
+	if (signing === void 0) return void 0;
+	if (typeof signing !== "object" || signing === null) throw invalidSigningConfig();
+	const hasPrivateKeyPath = Reflect.has(signing, "privateKeyPath");
+	const hasEnabled = Reflect.has(signing, "enabled");
+	const hasPluginMembers = [
+		"name",
+		"getPublicKey",
+		"sign"
+	].some((key) => Reflect.has(signing, key));
+	if ((hasPrivateKeyPath || hasEnabled) && hasPluginMembers) throw new Error("Bundle signing config cannot combine local signing fields with signing plugin fields.");
+	if (!hasPluginMembers) {
+		if (Object.keys(signing).some((key) => key !== "enabled" && key !== "privateKeyPath" && key !== "publicKeyPath")) throw new Error("Local bundle signing accepts only enabled, privateKeyPath and publicKeyPath.");
+		const enabled = Reflect.get(signing, "enabled");
+		if (enabled === false || enabled === void 0) return void 0;
+		if (enabled !== true) throw invalidSigningConfig();
+		const privateKeyPath = Reflect.get(signing, "privateKeyPath");
+		const publicKeyPath = Reflect.get(signing, "publicKeyPath");
+		if (typeof privateKeyPath !== "string" || !privateKeyPath.trim()) throw new Error("Enabled local bundle signing requires privateKeyPath.");
+		if (publicKeyPath !== void 0 && (typeof publicKeyPath !== "string" || !publicKeyPath.trim())) throw new Error("Local bundle signing publicKeyPath must be a non-empty path when provided.");
+		return {
+			enabled: true,
+			privateKeyPath,
+			...publicKeyPath === void 0 ? {} : { publicKeyPath }
+		};
+	}
+	if (typeof Reflect.get(signing, "name") !== "string" || typeof Reflect.get(signing, "publicKeyPath") !== "string" || !Reflect.get(signing, "publicKeyPath").trim() || typeof Reflect.get(signing, "getPublicKey") !== "function" || typeof Reflect.get(signing, "sign") !== "function") throw invalidSigningConfig();
+	return signing;
+};
+//#endregion
+//#region src/bundleSigning.ts
+const FILE_HASH_PATTERN = /^[a-f\d]{64}$/iu;
+const resolvePath = (cwd, filePath) => path$1.isAbsolute(filePath) ? filePath : path$1.resolve(cwd, filePath);
+const parseRsaPublicKey = (publicKeyPEM) => {
+	try {
+		const normalizedPublicKey = publicKeyPEM.trim();
+		if (!normalizedPublicKey.startsWith("-----BEGIN PUBLIC KEY-----") || !normalizedPublicKey.endsWith("-----END PUBLIC KEY-----")) throw new Error("not spki");
+		const publicKey = crypto$1.createPublicKey(normalizedPublicKey);
+		if (publicKey.asymmetricKeyType !== "rsa" || (publicKey.asymmetricKeyDetails?.modulusLength ?? 0) < 2048) throw new Error("not rsa");
+		return publicKey;
+	} catch {
+		throw new Error("Bundle signing public key must be a valid RSA SPKI PEM key with a modulus of at least 2048 bits.");
+	}
+};
+const exportPublicKey = (publicKey) => publicKey.export({
+	type: "spki",
+	format: "pem"
+}).toString();
+const publicKeysMatch = (left, right) => {
+	const leftDer = left.export({
+		type: "spki",
+		format: "der"
+	});
+	const rightDer = right.export({
+		type: "spki",
+		format: "der"
+	});
+	return leftDer.byteLength === rightDer.byteLength && crypto$1.timingSafeEqual(leftDer, rightDer);
+};
+const readKeyFile = async (cwd, filePath) => {
+	try {
+		return await fs$3.readFile(resolvePath(cwd, filePath), "utf8");
+	} catch {
+		throw new Error("Failed to read the bundle signing public key file.");
+	}
+};
+const getProviderPublicKey = async (provider, cwd) => {
+	try {
+		const result = await provider.getPublicKey({ cwd });
+		if (!result || typeof result.publicKey !== "string") throw new Error("invalid result");
+		return parseRsaPublicKey(result.publicKey);
+	} catch {
+		throw new Error("Failed to resolve the bundle signing provider public key.");
+	}
+};
+const createMemoizedSigner = ({ publicKey, sign }) => {
+	const signatures = /* @__PURE__ */ new Map();
+	return (fileHash) => {
+		if (!FILE_HASH_PATTERN.test(fileHash)) return Promise.reject(/* @__PURE__ */ new Error("Bundle signing requires a 64-character hexadecimal file hash."));
+		const normalizedFileHash = fileHash.toLowerCase();
+		const cached = signatures.get(normalizedFileHash);
+		if (cached) return cached;
+		const pending = (async () => {
+			const message = Buffer.from(normalizedFileHash, "hex");
+			let signature;
+			try {
+				signature = await sign(new Uint8Array(message));
+			} catch {
+				throw new Error("Bundle signing provider failed to sign the file hash.");
+			}
+			if (!(signature instanceof Uint8Array) || signature.byteLength === 0) throw new Error("Bundle signing provider returned an invalid signature.");
+			if (!crypto$1.verify("RSA-SHA256", message, publicKey, signature)) throw new Error("Bundle signing provider returned a signature that does not match the configured public key.");
+			return Buffer.from(signature).toString("base64");
+		})().catch((error) => {
+			signatures.delete(normalizedFileHash);
+			throw error;
+		});
+		signatures.set(normalizedFileHash, pending);
+		return pending;
+	};
+};
+const preparePluginSigning = async (signing, cwd) => {
+	const [configuredPublicKeyPEM, providerPublicKey] = await Promise.all([signing.publicKeyPath === void 0 ? void 0 : readKeyFile(cwd, signing.publicKeyPath), getProviderPublicKey(signing, cwd)]);
+	if (!publicKeysMatch(configuredPublicKeyPEM === void 0 ? providerPublicKey : parseRsaPublicKey(configuredPublicKeyPEM), providerPublicKey)) throw new Error("Bundle signing provider public key does not match publicKeyPath.");
+	return {
+		name: signing.name,
+		publicKey: exportPublicKey(providerPublicKey),
+		signFileHash: createMemoizedSigner({
+			publicKey: providerPublicKey,
+			sign: async (message) => {
+				return (await signing.sign({
+					cwd,
+					message
+				})).signature;
+			}
+		})
+	};
+};
+const prepareBundleSigning = async (signing, options = {}) => {
+	const normalized = normalizeSigningConfig(signing);
+	if (!normalized) return null;
+	const cwd = options.cwd ?? getCwd();
+	return preparePluginSigning("enabled" in normalized ? createLocalSigningPlugin(normalized) : normalized, cwd);
+};
+/** Resolves the native trust anchor without calling a remote signing provider. */
+const getBundleSigningPublicKey = async (signing, options = {}) => {
+	const normalized = normalizeSigningConfig(signing);
+	if (!normalized) return null;
+	const cwd = options.cwd ?? getCwd();
+	if (normalized.publicKeyPath !== void 0) return exportPublicKey(parseRsaPublicKey(await readKeyFile(cwd, normalized.publicKeyPath)));
+	if ("enabled" in normalized) try {
+		const { publicKey } = await createLocalSigningPlugin(normalized).getPublicKey({ cwd });
+		return exportPublicKey(parseRsaPublicKey(publicKey));
+	} catch {
+		return exportPublicKey(parseRsaPublicKey(await readKeyFile(cwd, path$1.join(path$1.dirname(normalized.privateKeyPath), "public-key.pem"))));
+	}
+	throw new Error("Bundle signing plugins require publicKeyPath.");
+};
+//#endregion
 //#region src/ConfigBuilder.ts
 const normalizeImportInfos = (imports) => {
 	const collectedImports = /* @__PURE__ */ new Map();
@@ -42992,8 +43176,10 @@ const CONFIG_FILE_NAME = "hot-updater.config.ts";
 const MANAGED_IMPORT_PACKAGES = new Set([
 	"dotenv",
 	"firebase-admin",
+	"firebase-admin/app",
 	"hot-updater",
 	"@aws-sdk/credential-provider-sso",
+	"@aws-sdk/credential-providers",
 	"@hot-updater/aws",
 	"@hot-updater/bare",
 	"@hot-updater/cloudflare",
@@ -43002,7 +43188,12 @@ const MANAGED_IMPORT_PACKAGES = new Set([
 	"@hot-updater/rock",
 	"@hot-updater/supabase"
 ]);
-const MANAGED_HELPER_NAMES = new Set(["commonOptions", "credential"]);
+const MANAGED_HELPER_NAMES = new Set([
+	"awsOptions",
+	"commonOptions",
+	"credential",
+	"storageOptions"
+]);
 const KNOWN_BUILD_CALLEES = new Set([
 	"bare",
 	"expo",
@@ -43096,7 +43287,7 @@ const appendMissingProperties = (objectText, propertyTexts, hasExistingPropertie
 	const suffix = `,\n${closingIndent}`;
 	return `${objectText.slice(0, closeBraceIndex)}${prefix}${formattedProperties}${suffix}${objectText.slice(closeBraceIndex)}`;
 };
-const mergeObjectLiteralText = (existingObject, newObject) => {
+const mergeObjectLiteralText = (existingObject, newObject, replaceIncompatibleProperties = []) => {
 	const existingText = getNodeText(existingObject.source, existingObject.objectExpression);
 	const existingPropertyNames = /* @__PURE__ */ new Set();
 	const existingSpreadTexts = /* @__PURE__ */ new Set();
@@ -43111,6 +43302,17 @@ const mergeObjectLiteralText = (existingObject, newObject) => {
 		existingPropertyNames.add(propertyName);
 		const nextProperty = newObject.objectExpression.properties.find((candidate) => getObjectPropertyName(candidate) === propertyName);
 		if (!nextProperty || !isDataProperty(property) || !isDataProperty(nextProperty)) continue;
+		const existingCallee = getCallCallee(property.value);
+		const nextCallee = getCallCallee(nextProperty.value);
+		const hasIncompatibleValue = existingCallee !== null && nextCallee !== null && existingCallee !== nextCallee || property.value.type === "ObjectExpression" !== (nextProperty.value.type === "ObjectExpression");
+		if (replaceIncompatibleProperties.includes(propertyName) && hasIncompatibleValue) {
+			edits.push({
+				start: property.value.start - existingObject.objectExpression.start,
+				end: property.value.end - existingObject.objectExpression.start,
+				text: getNodeText(newObject.source, nextProperty.value)
+			});
+			continue;
+		}
 		if (property.value.type === "ObjectExpression" && nextProperty.value.type === "ObjectExpression") {
 			const mergedValue = mergeObjectLiteralText({
 				objectExpression: property.value,
@@ -43118,7 +43320,7 @@ const mergeObjectLiteralText = (existingObject, newObject) => {
 			}, {
 				objectExpression: nextProperty.value,
 				source: newObject.source
-			});
+			}, replaceIncompatibleProperties);
 			if (!mergedValue) return null;
 			edits.push({
 				start: property.value.start - existingObject.objectExpression.start,
@@ -43175,7 +43377,7 @@ const mergeHelperStatement = (existingStatementText, helper) => {
 	}, {
 		objectExpression: nextInitializer,
 		source: nextStatement.source
-	});
+	}, helper.replaceIncompatibleProperties);
 	if (!mergedInitializer) return null;
 	return `${existingStatement.statement.kind === "let" || existingStatement.statement.kind === "var" ? existingStatement.statement.kind : "const"} ${helper.name} = ${mergedInitializer};`;
 };
@@ -43230,7 +43432,7 @@ const getManagedHelperName = (statement) => {
 	if (statement.type !== "VariableDeclaration") return null;
 	const declaration = statement.declarations[0];
 	if (declaration?.id.type !== "Identifier") return null;
-	return MANAGED_HELPER_NAMES.has(declaration.id.name) ? declaration.id.name : null;
+	return declaration.id.name;
 };
 const rebuildImportBlock = (source, scaffold) => {
 	const importDeclarations = source.program.body.filter((statement) => statement.type === "ImportDeclaration");
@@ -43247,7 +43449,7 @@ const rebuildImportBlock = (source, scaffold) => {
 	return {
 		start: getTopLevelFullStart(source, firstImport),
 		end: lastImport.end,
-		text: `${nextImportBlock}\n\n`
+		text: nextImportBlock
 	};
 };
 const rebuildManagedBody = (source, exportStart, scaffold) => {
@@ -43255,10 +43457,14 @@ const rebuildManagedBody = (source, exportStart, scaffold) => {
 	const managedHelpers = new Map(scaffold.helperStatements.map((statement) => [statement.name, statement]));
 	const emittedHelpers = /* @__PURE__ */ new Set();
 	const bodyStatements = [];
+	const configStatements = [];
 	for (const statement of statementsBeforeExport) {
-		if (isConfigCallStatement(statement)) continue;
+		if (isConfigCallStatement(statement)) {
+			configStatements.push(getStatementText(source, statement));
+			continue;
+		}
 		const helperName = getManagedHelperName(statement);
-		if (!helperName) {
+		if (!helperName || !MANAGED_HELPER_NAMES.has(helperName)) {
 			bodyStatements.push(getStatementText(source, statement));
 			continue;
 		}
@@ -43271,7 +43477,7 @@ const rebuildManagedBody = (source, exportStart, scaffold) => {
 	}
 	for (const helper of scaffold.helperStatements) if (!emittedHelpers.has(helper.name)) bodyStatements.push(helper.code.trim());
 	const bodyText = bodyStatements.filter(Boolean).join("\n\n");
-	const configStatement = `config({ path: ".env.hotupdater" });`;
+	const configStatement = configStatements.join("\n\n") || `config({ path: ".env.hotupdater" });`;
 	const managedBody = bodyText ? `\n\n${configStatement}\n\n${bodyText}\n\n` : `\n\n${configStatement}\n\n`;
 	return {
 		start: source.program.body.filter((statement) => statement.type === "ImportDeclaration").at(-1)?.end ?? 0,
@@ -43299,7 +43505,9 @@ const mergeHotUpdaterConfigText = (existingText, scaffold) => {
 		source: nextSource
 	});
 	if (!nextObjectText) return { reason: "Existing config uses dynamic build/storage/database expressions that cannot be merged safely." };
-	const bodyEdit = rebuildManagedBody(existingSource, getTopLevelFullStart(existingSource, existingConfig.exportDeclaration), scaffold);
+	const exportFullStart = getTopLevelFullStart(existingSource, existingConfig.exportDeclaration);
+	const firstTriviaContent = existingText.slice(exportFullStart, existingConfig.exportDeclaration.start).search(/\S/);
+	const bodyEdit = rebuildManagedBody(existingSource, firstTriviaContent === -1 ? existingConfig.exportDeclaration.start : exportFullStart + firstTriviaContent, scaffold);
 	if (!bodyEdit) return { reason: "Existing helper declarations could not be merged safely." };
 	return { text: applyTextEdits(existingText, [
 		{
@@ -43386,6 +43594,12 @@ var MissingInitInputsError = class extends InitError {
 var InitEnvFileError = class extends InitError {
 	name = "InitEnvFileError";
 };
+var LegacyInfrastructureError = class extends InitError {
+	name = "LegacyInfrastructureError";
+	constructor(provider, resource) {
+		super(`${provider} v0 infrastructure was detected at ${resource}. Hot Updater v1 cannot upgrade it in place. Run init with new provider resources and ship the new endpoint in a new native build. The existing infrastructure was not changed.`);
+	}
+};
 const assertInitInputs = ({ inputs, strict }) => {
 	if (!strict) return;
 	const missingInputs = getMissingInitInputs(inputs);
@@ -43461,6 +43675,26 @@ const getHotUpdaterEnvValue = (env, key) => {
 	return env[key]?.trim() || void 0;
 };
 //#endregion
+//#region src/infrastructureGeneration.ts
+const assertInfrastructureGenerationPayload = ({ payload, provider, resource }) => {
+	if (typeof payload !== "object" || payload === null || !("infrastructureGeneration" in payload) || payload.infrastructureGeneration !== 1) throw new LegacyInfrastructureError(provider, resource);
+};
+const assertInfrastructureGenerationAtUrl = async ({ fetchImpl = fetch, legacyStatuses = [404], provider, resource, versionUrl }) => {
+	let response;
+	try {
+		response = await fetchImpl(versionUrl);
+	} catch (error) {
+		throw new InitError(`Could not verify the ${provider} infrastructure generation at ${resource}: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	if (legacyStatuses.includes(response.status)) throw new LegacyInfrastructureError(provider, resource);
+	if (!response.ok) throw new InitError(`Could not verify the ${provider} infrastructure generation at ${resource}: HTTP ${response.status}`);
+	assertInfrastructureGenerationPayload({
+		payload: await response.json().catch(() => void 0),
+		provider,
+		resource
+	});
+};
+//#endregion
 //#region src/initProvider.ts
 const defineInitProvider = (provider) => provider;
 const shouldAutoSelectOnlyInitResource = ({ availableResourceCount, savedIdentifier }) => savedIdentifier === void 0 && availableResourceCount === 1;
@@ -43635,6 +43869,91 @@ function isMergeableValue(value) {
 //#endregion
 //#region src/loadConfig.ts
 var import_out = /* @__PURE__ */ __toESM(require_out(), 1);
+const missingDatabase = createDatabasePlugin({
+	name: "missingDatabase",
+	models: {
+		bundles: {
+			findById: async () => {
+				throw new Error("database plugin is required");
+			},
+			findMany: async () => {
+				throw new Error("database plugin is required");
+			},
+			count: async () => {
+				throw new Error("database plugin is required");
+			}
+		},
+		bundlePatches: { findByBundleIds: async () => {
+			throw new Error("database plugin is required");
+		} },
+		releases: {
+			findById: async () => {
+				throw new Error("database plugin is required");
+			},
+			findMany: async () => {
+				throw new Error("database plugin is required");
+			},
+			findManyByScope: async () => {
+				throw new Error("database plugin is required");
+			}
+		},
+		releaseCatalogs: {
+			findByScopeKey: async () => {
+				throw new Error("database plugin is required");
+			},
+			findMany: async () => {
+				throw new Error("database plugin is required");
+			}
+		},
+		channels: {
+			insert: async () => {
+				throw new Error("database plugin is required");
+			},
+			list: async () => {
+				throw new Error("database plugin is required");
+			},
+			delete: async () => {
+				throw new Error("database plugin is required");
+			}
+		},
+		analytics: {
+			append: async () => {
+				throw new Error("database plugin is required");
+			},
+			scan: async () => {
+				throw new Error("database plugin is required");
+			}
+		},
+		apiKeys: {
+			create: async () => {
+				throw new Error("database plugin is required");
+			},
+			findByHash: async () => {
+				throw new Error("database plugin is required");
+			},
+			list: async () => {
+				throw new Error("database plugin is required");
+			},
+			revoke: async () => {
+				throw new Error("database plugin is required");
+			}
+		}
+	},
+	commit: async () => {
+		throw new Error("database plugin is required");
+	}
+});
+const missingStorageError = async () => {
+	throw new Error("storage plugin is required");
+};
+const missingStorage = createStoragePlugin({
+	name: "missingStorage",
+	protocol: "missing",
+	put: missingStorageError,
+	get: missingStorageError,
+	exists: missingStorageError,
+	delete: missingStorageError
+});
 const getDefaultPlatformConfig = () => {
 	let infoPlistPaths = [];
 	try {
@@ -43662,27 +43981,14 @@ const getDefaultPlatformConfig = () => {
 		});
 		if (manifestFiles.length > 0) androidManifestPaths = manifestFiles.map((file) => path.join("android", file));
 	} catch {}
-	let stringResourcePaths = [];
-	try {
-		const stringsFiles = import_out.default.sync(path.join("**", "strings.xml"), {
-			cwd: path.join(getCwd(), "android"),
-			absolute: false,
-			onlyFiles: true
-		});
-		if (stringsFiles.length > 0) stringResourcePaths = stringsFiles.map((file) => path.join("android", file));
-	} catch {}
 	return {
-		android: {
-			androidManifestPaths,
-			stringResourcePaths
-		},
+		android: { androidManifestPaths },
 		ios: { infoPlistPaths }
 	};
 };
 const getDefaultConfig = () => {
 	return {
 		cacheDir: path.join("node_modules", ".hot-updater"),
-		releaseChannel: "production",
 		updateStrategy: "appVersion",
 		compressStrategy: "zip",
 		fingerprint: {},
@@ -43699,16 +44005,21 @@ const getDefaultConfig = () => {
 		build: () => {
 			throw new Error("build plugin is required");
 		},
-		storage: () => {
-			throw new Error("storage plugin is required");
-		},
-		database: () => {
-			throw new Error("database plugin is required");
-		}
+		storage: missingStorage,
+		database: missingDatabase
 	};
 };
 const mergeConfigSources = (...sources) => {
-	return sources.reduceRight((mergedConfig, source) => merge(mergedConfig, source ?? {}), {});
+	const mergedConfig = sources.reduceRight((mergedConfig, source) => merge(mergedConfig, source ?? {}), {});
+	const database = sources.find((source) => source?.database)?.database;
+	const signing = sources.find((source) => source?.signing)?.signing;
+	const storage = sources.find((source) => source?.storage)?.storage;
+	return {
+		...mergedConfig,
+		...database ? { database } : {},
+		...signing ? { signing } : {},
+		...storage ? { storage } : {}
+	};
 };
 const getConfigLoaderOptions = (options) => {
 	const cwd = getCwd();
@@ -43734,7 +44045,13 @@ const getConfigLoaderOptions = (options) => {
 };
 const loadConfig = async (options) => {
 	const { config } = await loadConfig$1(getConfigLoaderOptions(options));
-	return mergeConfigSources(config, getDefaultConfig());
+	for (const key of ["authorityId", "catalogId"]) if (config && Object.hasOwn(config, key)) throw new Error(`Remove ${key} from hot-updater.config. Catalog identity is managed internally.`);
+	const mergedConfig = mergeConfigSources(config, getDefaultConfig());
+	const signing = normalizeSigningConfig(mergedConfig.signing);
+	return {
+		...mergedConfig,
+		signing
+	};
 };
 //#endregion
 //#region src/log.ts
@@ -43849,9 +44166,52 @@ const makeEnv = async (newEnvVars, filePath = ".env.hotupdater", options) => {
 	}
 };
 //#endregion
+//#region src/storageFiles.ts
+const getStorageFileByteSize = async (filePath) => {
+	const { size } = await fs$3.stat(filePath, { bigint: true });
+	if (size < 0n || size > BigInt(Number.MAX_SAFE_INTEGER)) throw new Error("Storage file size must be a non-negative safe integer.");
+	return Number(size);
+};
+const putStorageFile = async (storage, key, filePath) => {
+	const byteSize = await getStorageFileByteSize(filePath);
+	const source = createReadStream(filePath);
+	try {
+		return {
+			...await storage.put({
+				key: path$1.posix.join(key, path$1.basename(filePath)),
+				body: Readable$1.toWeb(source),
+				contentLength: byteSize,
+				contentType: getContentType(filePath)
+			}),
+			byteSize
+		};
+	} finally {
+		source.destroy();
+	}
+};
+const writeStorageFile = async (storage, storageUri, filePath) => {
+	const { response } = await storage.get({ storageUri });
+	if (response === null) throw new Error(`Storage object not found: ${storageUri}`);
+	await writeStorageResponseFile(response, filePath);
+};
+const writeStorageResponseFile = async (response, filePath) => {
+	await fs$3.mkdir(path$1.dirname(filePath), { recursive: true });
+	if (response.body === null) {
+		await fs$3.writeFile(filePath, new Uint8Array());
+		return;
+	}
+	try {
+		await pipeline$1(Readable$1.fromWeb(response.body), createWriteStream$1(filePath));
+	} catch (error) {
+		await fs$3.rm(filePath, { force: true });
+		throw error;
+	}
+};
+//#endregion
 //#region src/promoteBundle.ts
 const LEGACY_BUNDLE_ERROR = "This OTA bundle was created by a version that does not support manifest.json. Copy bundle is not available.";
 const SIGNED_HASH_PREFIX = "sig:";
+const PROMOTE_ASSET_CONCURRENCY = 8;
 function isSignedFileHash(fileHash) {
 	return fileHash.startsWith(SIGNED_HASH_PREFIX);
 }
@@ -43859,16 +44219,27 @@ async function getFileHash(filepath) {
 	const file = await fs$3.readFile(filepath);
 	return crypto$1.createHash("sha256").update(file).digest("hex");
 }
-async function signFileHash(fileHash, privateKeyPath) {
-	const privateKeyPEM = await fs$3.readFile(privateKeyPath, "utf8");
-	const sign = crypto$1.createSign("RSA-SHA256");
-	sign.update(Buffer.from(fileHash, "hex"));
-	sign.end();
-	return `${SIGNED_HASH_PREFIX}${sign.sign(privateKeyPEM).toString("base64")}`;
+async function runWithConcurrency(items, concurrency, task) {
+	let nextIndex = 0;
+	const workerCount = Math.min(concurrency, items.length);
+	await Promise.all(Array.from({ length: workerCount }, async () => {
+		while (nextIndex < items.length) {
+			const itemIndex = nextIndex;
+			nextIndex += 1;
+			await task(items[itemIndex]);
+		}
+	}));
+}
+function verifySignedFileHash({ actualFileHash, publicKey, signedFileHash }) {
+	try {
+		return crypto$1.verify("RSA-SHA256", Buffer.from(actualFileHash, "hex"), publicKey, Buffer.from(signedFileHash.slice(4), "base64"));
+	} catch {
+		return false;
+	}
 }
 function getArchiveFilename(storageUri) {
-	const { pathname } = new URL(storageUri);
-	return path$1.basename(pathname) || "bundle.zip";
+	const { key } = parseStorageUri(storageUri, new URL(storageUri).protocol.replace(":", ""));
+	return path$1.posix.basename(key) || "bundle.zip";
 }
 const getRelativeStorageDir = (relativePath) => {
 	const normalized = relativePath.replace(/\\/g, "/");
@@ -43886,7 +44257,7 @@ async function prepareManifestAssetUploadFile({ assetPath, sourcePath, workDir }
 	if (getManifestAssetDownloadPath(assetPath) === assetPath) return sourcePath;
 	const uploadPath = resolvePreparedUploadPath(workDir, assetPath);
 	await fs$3.mkdir(path$1.dirname(uploadPath), { recursive: true });
-	await pipeline$1(createReadStream(sourcePath), createBrotliCompress$1(), createWriteStream$1(uploadPath));
+	await pipeline$1(createReadStream(sourcePath), createBrotliCompress$1({ params: { [constants$2.BROTLI_PARAM_QUALITY]: 11 } }), createWriteStream$1(uploadPath));
 	return uploadPath;
 }
 async function prepareContentAddressedUploadFile({ sourcePath, storagePath, workDir }) {
@@ -43897,6 +44268,48 @@ async function prepareContentAddressedUploadFile({ sourcePath, storagePath, work
 	await fs$3.copyFile(sourcePath, uploadPath);
 	return uploadPath;
 }
+async function prepareManifestAssetUploadTargets({ extractDir, manifest, workDir }) {
+	const targets = /* @__PURE__ */ new Map();
+	const assetPaths = Object.keys(manifest.assets ?? {}).sort((left, right) => left.localeCompare(right));
+	for (const assetPath of assetPaths) {
+		const asset = manifest.assets?.[assetPath];
+		if (!asset?.fileHash) throw new Error(`Manifest file hash not found for ${assetPath}`);
+		const uploadSourcePath = await prepareManifestAssetUploadFile({
+			assetPath,
+			sourcePath: resolveExtractedPath(extractDir, assetPath),
+			workDir
+		});
+		const downloadByteSize = await getStorageFileByteSize(uploadSourcePath);
+		const downloadPath = getManifestAssetDownloadPath(assetPath);
+		const downloadFileHash = downloadPath !== assetPath ? await getFileHash(uploadSourcePath) : void 0;
+		if (downloadFileHash !== void 0 && !isContentAddressedAssetFileHash(downloadFileHash)) throw new Error(`Prepared asset hash must be a lowercase SHA-256 hash: ${assetPath}`);
+		const nextAsset = {
+			...asset,
+			downloadByteSize
+		};
+		delete nextAsset.downloadFileHash;
+		if (downloadFileHash !== void 0) nextAsset.downloadFileHash = downloadFileHash;
+		manifest.assets[assetPath] = nextAsset;
+		const storagePath = getManifestAssetStoragePath({
+			assetPath: downloadPath,
+			downloadFileHash,
+			fileHash: asset.fileHash
+		});
+		const contentAddressedUploadPath = await prepareContentAddressedUploadFile({
+			sourcePath: uploadSourcePath,
+			storagePath,
+			workDir
+		});
+		targets.set(storagePath, {
+			assetPath: downloadPath,
+			downloadFileHash,
+			fileHash: asset.fileHash,
+			storagePath,
+			uploadSourcePath: contentAddressedUploadPath
+		});
+	}
+	return [...targets.values()];
+}
 function resolveExtractedPath(rootDir, entryName) {
 	const normalizedEntryName = entryName.replaceAll("\\", "/");
 	const entryPath = path$1.resolve(rootDir, normalizedEntryName);
@@ -43906,23 +44319,20 @@ function resolveExtractedPath(rootDir, entryName) {
 }
 async function downloadArchive(storageUri, storagePlugin, archivePath) {
 	const protocol = new URL(storageUri).protocol.replace(":", "");
+	if (storagePlugin?.protocol === protocol) {
+		await writeStorageFile(storagePlugin, storageUri, archivePath);
+		return;
+	}
 	if (protocol === "http" || protocol === "https") {
-		const archiveBuffer = await downloadFromUrl(storageUri);
-		await fs$3.writeFile(archivePath, archiveBuffer);
+		await downloadFromUrl(storageUri, archivePath);
 		return;
 	}
-	await downloadFromStorage(storageUri, storagePlugin, archivePath);
+	throw new Error(`No storage plugin for protocol: ${protocol}`);
 }
-async function downloadFromUrl(fileUrl) {
+async function downloadFromUrl(fileUrl, filePath) {
 	const response = await fetch(fileUrl);
 	if (!response.ok) throw new Error(`Failed to download bundle archive: ${response.statusText}`);
-	return new Uint8Array(await response.arrayBuffer());
-}
-async function downloadFromStorage(storageUri, storagePlugin, filePath) {
-	if (!storagePlugin) throw new Error("Storage plugin is not configured");
-	const protocol = new URL(storageUri).protocol.replace(":", "");
-	if (storagePlugin.supportedProtocol !== protocol) throw new Error(`No storage plugin for protocol: ${protocol}`);
-	await storagePlugin.profiles.node.downloadFile(storageUri, filePath);
+	await writeStorageResponseFile(response, filePath);
 }
 async function extractZipArchive(archivePath, extractDir) {
 	const zip = await import_lib.default.loadAsync(await fs$3.readFile(archivePath));
@@ -44002,7 +44412,7 @@ async function createArchiveFromDirectory(sourceDir, archivePath, format) {
 			return;
 	}
 }
-async function rewriteManifestBundleId(extractDir, nextBundleId) {
+async function readCopiedBundleManifest(extractDir, nextBundleId) {
 	const manifestPath = path$1.join(extractDir, "manifest.json");
 	try {
 		await fs$3.access(manifestPath);
@@ -44011,13 +44421,12 @@ async function rewriteManifestBundleId(extractDir, nextBundleId) {
 	}
 	const manifest = JSON.parse(await fs$3.readFile(manifestPath, "utf8"));
 	manifest.bundleId = nextBundleId;
-	await fs$3.writeFile(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`);
 	return {
 		manifest,
 		manifestPath
 	};
 }
-async function createCopiedBundleArchive({ bundle, config, nextBundleId, storagePlugin, targetChannel }) {
+async function createCopiedBundleArchive({ bundle, config, nextBundleId, storagePlugin }) {
 	const archiveFilename = getArchiveFilename(bundle.storageUri);
 	const workDir = await fs$3.mkdtemp(path$1.join(os.tmpdir(), "hot-updater-console-promote-"));
 	const sourceArchivePath = path$1.join(workDir, archiveFilename);
@@ -44027,65 +44436,73 @@ async function createCopiedBundleArchive({ bundle, config, nextBundleId, storage
 	await fs$3.mkdir(extractDir, { recursive: true });
 	try {
 		await downloadArchive(bundle.storageUri, storagePlugin, sourceArchivePath);
+		const actualSourceFileHash = await getFileHash(sourceArchivePath);
+		const signingSession = await prepareBundleSigning(config.signing);
+		if (isSignedFileHash(bundle.fileHash)) {
+			if (!signingSession) throw new Error("Cannot copy a signed bundle without enabled bundle signing configuration.");
+			if (!verifySignedFileHash({
+				actualFileHash: actualSourceFileHash,
+				publicKey: signingSession.publicKey,
+				signedFileHash: bundle.fileHash
+			})) throw new Error("Source bundle signature verification failed.");
+		} else if (actualSourceFileHash !== bundle.fileHash.toLowerCase()) throw new Error("Source bundle file hash verification failed.");
 		const format = await extractArchive(sourceArchivePath, extractDir);
-		const { manifest, manifestPath } = await rewriteManifestBundleId(extractDir, nextBundleId);
+		const { manifest, manifestPath } = await readCopiedBundleManifest(extractDir, nextBundleId);
+		const assetPaths = Object.keys(manifest.assets ?? {}).sort((left, right) => left.localeCompare(right));
+		const sourceIsSigned = [bundle.fileHash, getManifestFileHash(bundle)].filter((hash) => Boolean(hash)).some((hash) => isSignedFileHash(hash));
+		const manifestHasSignatures = assetPaths.some((assetPath) => Boolean(manifest.assets?.[assetPath]?.signature));
+		if (!signingSession && (sourceIsSigned || manifestHasSignatures)) throw new Error("Cannot copy a signed bundle without enabled bundle signing configuration.");
+		if (signingSession) {
+			await runWithConcurrency(assetPaths, PROMOTE_ASSET_CONCURRENCY, async (assetPath) => {
+				const asset = manifest.assets?.[assetPath];
+				if (!asset?.fileHash) throw new Error(`Manifest file hash not found for ${assetPath}`);
+				if (await getFileHash(resolveExtractedPath(extractDir, assetPath)) !== asset.fileHash.toLowerCase()) throw new Error(`Manifest file hash mismatch for ${assetPath}`);
+			});
+			await runWithConcurrency(assetPaths, PROMOTE_ASSET_CONCURRENCY, async (assetPath) => {
+				const asset = manifest.assets?.[assetPath];
+				if (!asset?.fileHash) throw new Error(`Manifest file hash not found for ${assetPath}`);
+				asset.signature = await signingSession.signFileHash(asset.fileHash);
+			});
+		}
+		const assetUploadTargets = await prepareManifestAssetUploadTargets({
+			extractDir,
+			manifest,
+			workDir
+		});
+		await fs$3.writeFile(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`);
 		await fs$3.rm(sourceArchivePath, { force: true });
 		await createArchiveFromDirectory(extractDir, outputArchivePath, format);
 		const fileHash = await getFileHash(outputArchivePath);
 		const manifestHash = await getFileHash(manifestPath);
-		if ([bundle.fileHash, getManifestFileHash(bundle)].filter((hash) => Boolean(hash)).some((hash) => isSignedFileHash(hash)) && !config.signing?.privateKeyPath) throw new Error("Cannot copy a signed bundle without signing.privateKeyPath in hot-updater.config.ts");
-		const signingKeyPath = config.signing?.enabled && config.signing.privateKeyPath ? config.signing.privateKeyPath : null;
-		const nextFileHash = signingKeyPath ? await signFileHash(fileHash, signingKeyPath) : fileHash;
-		const nextManifestFileHash = signingKeyPath ? await signFileHash(manifestHash, signingKeyPath) : manifestHash;
-		const archiveUpload = await storagePlugin.profiles.node.upload(createBundleStorageKey(nextBundleId), outputArchivePath);
+		const nextFileHash = signingSession ? `${SIGNED_HASH_PREFIX}${await signingSession.signFileHash(fileHash)}` : fileHash;
+		const nextManifestFileHash = signingSession ? `${SIGNED_HASH_PREFIX}${await signingSession.signFileHash(manifestHash)}` : manifestHash;
+		const archiveUpload = await putStorageFile(storagePlugin, createBundleStorageKey(nextBundleId), outputArchivePath);
 		uploadedStorageUris.push(archiveUpload.storageUri);
-		const manifestUpload = await storagePlugin.profiles.node.upload(createBundleStorageKey(nextBundleId), manifestPath);
-		uploadedStorageUris.push(manifestUpload.storageUri);
-		const assetBaseStorageUri = createStorageRootUriWithPath(manifestUpload.storageUri, nextBundleId, "assets");
-		const assetPaths = Object.keys(manifest.assets ?? {}).sort((left, right) => left.localeCompare(right));
-		for (const assetPath of assetPaths) {
-			const asset = manifest.assets?.[assetPath];
-			if (!asset?.fileHash) throw new Error(`Manifest file hash not found for ${assetPath}`);
-			const uploadPath = await prepareManifestAssetUploadFile({
-				assetPath,
-				sourcePath: path$1.join(extractDir, assetPath),
-				workDir
-			});
-			const uploadName = getManifestAssetDownloadPath(assetPath);
-			const storagePath = getContentAddressedAssetStoragePath({
-				assetPath: uploadName,
-				fileHash: asset.fileHash
-			});
+		const assetBaseStorageUri = createStorageRootUriWithPath(archiveUpload.storageUri, nextBundleId, "assets");
+		for (const assetUploadTarget of assetUploadTargets) {
 			const storageUri = resolveManifestAssetStorageUri({
 				assetBaseStorageUri,
-				assetPath: uploadName,
-				fileHash: asset.fileHash
+				assetPath: assetUploadTarget.assetPath,
+				downloadFileHash: assetUploadTarget.downloadFileHash,
+				fileHash: assetUploadTarget.fileHash
 			});
-			if (!await storagePlugin.profiles.node.exists(storageUri)) {
-				const contentAddressedUploadPath = await prepareContentAddressedUploadFile({
-					sourcePath: uploadPath,
-					storagePath,
-					workDir
-				});
-				await storagePlugin.profiles.node.upload(getRelativeStorageDir(storagePath) ? `assets/${getRelativeStorageDir(storagePath)}` : "assets", contentAddressedUploadPath);
-			}
+			const { exists } = await storagePlugin.exists({ storageUri });
+			if (!exists) await putStorageFile(storagePlugin, getRelativeStorageDir(assetUploadTarget.storagePath) ? `assets/${getRelativeStorageDir(assetUploadTarget.storagePath)}` : "assets", assetUploadTarget.uploadSourcePath);
 		}
+		const manifestUpload = await putStorageFile(storagePlugin, createBundleStorageKey(nextBundleId), manifestPath);
+		uploadedStorageUris.push(manifestUpload.storageUri);
 		return {
 			bundle: {
 				...bundle,
 				id: nextBundleId,
-				channel: targetChannel,
+				archiveByteSize: archiveUpload.byteSize,
 				storageUri: archiveUpload.storageUri,
 				fileHash: nextFileHash,
 				metadata: stripBundleArtifactMetadata(bundle.metadata),
 				assetBaseStorageUri,
 				patches: [],
-				patchBaseBundleId: null,
 				manifestFileHash: nextManifestFileHash,
-				manifestStorageUri: manifestUpload.storageUri,
-				patchBaseFileHash: null,
-				patchFileHash: null,
-				patchStorageUri: null
+				manifestStorageUri: manifestUpload.storageUri
 			},
 			uploadedStorageUris
 		};
@@ -44102,44 +44519,13 @@ async function createCopiedBundleArchive({ bundle, config, nextBundleId, storage
 async function deleteUploadedCopy(storagePlugin, storageUris) {
 	if (storageUris.length === 0) return;
 	for (const storageUri of new Set(storageUris)) try {
-		await storagePlugin.profiles.node.delete(storageUri);
+		const protocol = new URL(storageUri).protocol.replace(":", "");
+		if (storagePlugin.protocol === protocol) await storagePlugin.delete({ storageUri });
+		else if (protocol !== "http" && protocol !== "https") throw new Error(`No storage plugin for protocol: ${protocol}`);
 	} catch (error) {
 		console.error("Failed to delete uploaded bundle copy:", error);
 	}
 }
-async function promoteBundle({ action, bundleId, nextBundleId, targetChannel }, deps) {
-	const normalizedTargetChannel = targetChannel.trim();
-	if (!normalizedTargetChannel) throw new Error("Target channel is required");
-	const bundle = await deps.databasePlugin.getBundleById(bundleId);
-	if (!bundle) throw new Error("Bundle not found");
-	if (bundle.channel === normalizedTargetChannel) throw new Error("Target channel must be different from the current channel");
-	if (action === "move") {
-		await deps.databasePlugin.updateBundle(bundleId, { channel: normalizedTargetChannel });
-		await deps.databasePlugin.commitBundle();
-		const updatedBundle = await deps.databasePlugin.getBundleById(bundleId);
-		if (!updatedBundle) throw new Error("Promoted bundle not found");
-		return updatedBundle;
-	}
-	if (!deps.storagePlugin) throw new Error("Storage plugin is not configured");
-	const resolvedNextBundleId = nextBundleId?.trim() || createUUIDv7();
-	const { bundle: copiedBundle, uploadedStorageUris } = await createCopiedBundleArchive({
-		bundle,
-		config: deps.config,
-		nextBundleId: resolvedNextBundleId,
-		storagePlugin: deps.storagePlugin,
-		targetChannel: normalizedTargetChannel
-	});
-	let shouldCleanupUploadedCopy = true;
-	try {
-		await deps.databasePlugin.appendBundle(copiedBundle);
-		await deps.databasePlugin.commitBundle();
-		shouldCleanupUploadedCopy = false;
-		return copiedBundle;
-	} catch (error) {
-		if (shouldCleanupUploadedCopy) await deleteUploadedCopy(deps.storagePlugin, uploadedStorageUris);
-		throw error;
-	}
-}
 //#endregion
 //#region src/resolvePackageVersion.ts
 const require$1 = createRequire(import.meta.url);
@@ -44206,4 +44592,4 @@ function transformTemplate(templateString, values) {
 	return result;
 }
 //#endregion
-export { BuildLogger, ConfigBuilder, HOT_UPDATER_SERVER_PACKAGE_VERSION_ENV, HotUpdateDirUtil, InitEnvFileError, InitError, LEGACY_BUNDLE_ERROR, MissingInitInputsError, assertInitInputs, assertInitProviderInputs, banner, typedColors as colors, confirmInitInputPersistence, copyDirToTmp, createCopiedBundleArchive, createHotUpdaterConfigScaffold, createHotUpdaterConfigScaffoldFromBuilder, createLogWriter, createTarBr, createTarBrTargetFiles, createTarGz, createTarGzTargetFiles, createZip, createZipTargetFiles, decryptJson, defineInitProvider, encryptJson, ensureInstallPackages, getAndroidSdkPath, getCwd, getHotUpdaterEnvValue, getHotUpdaterInitInputEnv, getInitProviderEnvVars, getInitProviderTextPromptValues, getMissingInitInputs, getMissingInitProviderInputs, getPackageManager, getReactNativeMetadatas, link, loadConfig, log, makeEnv, p, printBanner, promoteBundle, readHotUpdaterEnv, readHotUpdaterInitEnv, readPackageUp, renderImportStatements, resolveHotUpdaterServerVersion, resolveInitProviderInput, resolveInitProviderInputs, resolvePackageVersion, shouldAutoSelectOnlyInitResource, stripAnsi, transformEnv, transformTemplate, writeHotUpdaterConfig };
+export { BuildLogger, ConfigBuilder, HOT_UPDATER_SERVER_PACKAGE_VERSION_ENV, HotUpdateDirUtil, InitEnvFileError, InitError, LEGACY_BUNDLE_ERROR, LegacyInfrastructureError, MissingInitInputsError, assertInfrastructureGenerationAtUrl, assertInfrastructureGenerationPayload, assertInitInputs, assertInitProviderInputs, banner, typedColors as colors, confirmInitInputPersistence, copyDirToTmp, createCopiedBundleArchive, createHotUpdaterConfigScaffold, createHotUpdaterConfigScaffoldFromBuilder, createLogWriter, createTarBr, createTarBrTargetFiles, createTarGz, createTarGzTargetFiles, createZip, createZipTargetFiles, decryptJson, defineInitProvider, encryptJson, ensureInstallPackages, formatApiKeyNote, getAndroidSdkPath, getBundleSigningPublicKey, getCwd, getHotUpdaterEnvValue, getHotUpdaterInitInputEnv, getInitProviderEnvVars, getInitProviderTextPromptValues, getMissingInitInputs, getMissingInitProviderInputs, getPackageManager, getReactNativeMetadatas, getStorageFileByteSize, link, loadConfig, log, makeEnv, p, prepareBundleSigning, printBanner, putStorageFile, readHotUpdaterEnv, readHotUpdaterInitEnv, readPackageUp, renderImportStatements, resolveHotUpdaterServerVersion, resolveInitProviderInput, resolveInitProviderInputs, resolvePackageVersion, shouldAutoSelectOnlyInitResource, stripAnsi, transformEnv, transformTemplate, writeHotUpdaterConfig, writeStorageFile, writeStorageResponseFile };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hot-updater/cli-tools",
-  "version": "0.36.7",
+  "version": "1.0.0-rc.0",
   "type": "module",
   "engines": {
     "node": ">=20.19.0"
@@ -49,8 +49,8 @@
     "oxc-parser": "0.141.0",
     "oxc-transform": "0.141.0",
     "unconfig": "7.5.0",
-    "@hot-updater/core": "0.36.7",
-    "@hot-updater/plugin-core": "0.36.7"
+    "@hot-updater/plugin-core": "1.0.0-rc.0",
+    "@hot-updater/core": "1.0.0-rc.0"
   },
   "devDependencies": {
     "@clack/prompts": "1.7.0",
@@ -64,7 +64,7 @@
     "tar": "^7.5.16",
     "verkit": "0.3.2",
     "workspace-tools": "^0.41.7",
-    "@hot-updater/test-utils": "0.36.7"
+    "@hot-updater/test-utils": "1.0.0-rc.0"
   },
   "inlinedDependencies": {
     "@babel/code-frame": "7.29.0",