@hot-updater/cli-tools 1.0.0-rc.14 → 1.0.0-rc.17

package/dist/index.d.mts

@@ -2,6 +2,7 @@ import { Readable } from "stream";
 import { Key as Key$1 } from "node:readline";
 import { Readable as Readable$1, Writable } from "node:stream";
 import { Bundle, BundleSigningPlugin, ConfigInput, LocalSigningConfig, Platform, RequiredDeep, SigningConfig, StoragePluginWith, StoragePutResult } from "@hot-updater/plugin-core";
+import { ManifestArchive } from "@hot-updater/core";
 //#region src/BuildLogger.d.ts
 type LinePattern = string | RegExp;
 interface BuildLoggerConfig {
@@ -31,8 +32,40 @@ declare class BuildLogger {
   private showLogFileLocation;
 }
 //#endregion
-//#region src/apiKeyNote.d.ts
-declare const formatApiKeyNote: (apiKey: string) => string;
+//#region src/appSetup.d.ts
+/** The credential init gives an app, through the server's clientAuth plugin. */
+interface AppClientCredential {
+  /** Its name in output, such as "API key". */
+  readonly label: string;
+  /** The request header that carries it. */
+  readonly header: string;
+  readonly value: string;
+}
+/** A client plugin the server's plugins ask an app to add. */
+interface AppClientPlugin {
+  /** The module that exports it. */
+  readonly module: string;
+  /** The export, which the app calls with no arguments. */
+  readonly name: string;
+}
+interface AppSetup {
+  readonly credential?: AppClientCredential;
+  readonly clientPlugins?: readonly AppClientPlugin[];
+}
+/**
+ * The App.tsx code init prints: `HotUpdater.init` with the server's URL,
+ * the header that carries the client credential when the server takes one,
+ * and the client plugins the server's plugins ask for.
+ */
+declare const renderAppSetup: ({ baseURL, credential, clientPlugins }: AppSetup & {
+  readonly baseURL: string;
+}) => string;
+/** Prints the App.tsx code, when the URL is known, and the app's credential. */
+declare const printAppSetup: ({ baseURL, ...setup }: AppSetup & {
+  readonly baseURL?: string;
+  /** Required, so each init passes its server plugins' client plugins. */
+  readonly clientPlugins: readonly AppClientPlugin[];
+}) => void;
 //#endregion
 //#region src/banner.d.ts
 declare const link: (url: string) => string;
@@ -163,41 +196,16 @@ declare const copyDirToTmp: (dir: string, childDirname?: string) => Promise<{
 }>;
 //#endregion
 //#region src/createTarBr.d.ts
-declare const createTarBrTargetFiles: ({ outfile, targetFiles }: {
-  targetFiles: {
-    path: string;
-    name: string;
-  }[];
+/** Build the one supported bulk transport from the exact manifest file set. */
+declare function createTarBrTargetFiles({ outfile, targetFiles }: {
   outfile: string;
-}) => Promise<string>;
-declare const createTarBr: ({ outfile, targetDir, excludeExts }: {
-  targetDir: string;
-  outfile: string;
-  excludeExts?: string[];
-}) => Promise<string>;
-//#endregion
-//#region src/createTarGz.d.ts
-declare const createTarGzTargetFiles: ({ outfile, targetFiles }: {
   targetFiles: {
     path: string;
     name: string;
   }[];
-  outfile: string;
-}) => Promise<string>;
-declare const createTarGz: ({ outfile, targetDir, excludeExts }: {
-  targetDir: string;
-  outfile: string;
-  excludeExts?: string[];
-}) => Promise<string>;
+}): Promise<ManifestArchive>;
 //#endregion
 //#region src/createZip.d.ts
-declare const createZipTargetFiles: ({ outfile, targetFiles }: {
-  targetFiles: {
-    path: string;
-    name: string;
-  }[];
-  outfile: string;
-}) => Promise<string>;
 declare const createZip: ({ outfile, targetDir, excludeExts }: {
   targetDir: string;
   outfile: string;
@@ -295,6 +303,34 @@ declare const readHotUpdaterInitEnv: (cwd: string, envFile?: string) => Promise<
 declare const readHotUpdaterEnv: (cwd: string) => Promise<Readonly<Record<string, string>>>;
 declare const getHotUpdaterEnvValue: (env: Readonly<Record<string, string>>, key: string) => string | undefined;
 //#endregion
+//#region src/hotUpdaterPlugins.d.ts
+/** Where `hot-updater init` writes a managed server's plugin list. */
+declare const HOT_UPDATER_PLUGINS_PATH = "hotUpdater.plugins.ts";
+/**
+ * The plugins file for a managed provider: a re-export of the fixed list its
+ * package ships, which its prebuilt server runs too.
+ */
+declare const renderHotUpdaterPlugins: (pkg: string) => string;
+type WriteHotUpdaterPluginsResult = {
+  readonly status: "created" | "unchanged";
+  readonly path: string;
+} | {
+  readonly status: "skipped";
+  readonly path: string;
+  readonly reason: string;
+};
+/** Writes the plugins file; an existing file that differs is kept. */
+declare const writeHotUpdaterPlugins: (pkg: string, filePath?: string) => Promise<WriteHotUpdaterPluginsResult>;
+/** Writes the plugins file for `pkg` and reports what happened. */
+declare const generateHotUpdaterPlugins: (pkg: string, filePath?: string) => Promise<WriteHotUpdaterPluginsResult>;
+/**
+ * The plugins a project's `hotUpdater.plugins.ts` exports, which its server
+ * runs; undefined when the project has no such file. The console and the CLI
+ * assemble them in process as the server does, for the features and commands
+ * the plugins add.
+ */
+declare const loadHotUpdaterPlugins: (cwd?: string) => Promise<readonly unknown[] | undefined>;
+//#endregion
 //#region src/HotUpdateDirUtil.d.ts
 declare const HotUpdateDirUtil: {
   readonly dirName: ".hot-updater";
@@ -467,7 +503,7 @@ declare const makeEnv: (newEnvVars: Record<string, EnvVarValue>, filePath?: stri
 //#region src/promoteBundle.d.ts
 type PromoteStoragePlugin = StoragePluginWith<"get" | "put" | "exists" | "delete">;
 declare const LEGACY_BUNDLE_ERROR = "This OTA bundle was created by a version that does not support manifest.json. Copy bundle is not available.";
-declare function createCopiedBundleArchive({ bundle, config, nextBundleId, storagePlugin }: {
+declare function createCopiedBundleArtifacts({ bundle, config, nextBundleId, storagePlugin }: {
   bundle: Bundle;
   config: ConfigResponse;
   nextBundleId: string;
@@ -475,9 +511,6 @@ declare function createCopiedBundleArchive({ bundle, config, nextBundleId, stora
 }): Promise<{
   bundle: {
     id: string;
-    archiveByteSize: number;
-    storageUri: string;
-    fileHash: string;
     metadata: import("@hot-updater/core").BundleMetadata | undefined;
     assetBaseStorageUri: string;
     patches: never[];
@@ -1733,4 +1766,4 @@ type TransformTemplateArgs<T extends string> = { [Key in ExtractPlaceholders<T>]
  */
 declare function transformTemplate<T extends string>(templateString: T, values: TransformTemplateArgs<T>): string;
 //#endregion
-export { BuildLogger, BuildLoggerConfig, BuildType, BundleSigningSession, ConfigBuilder, ConfigBuilderScaffold, ConfigResponse, CreateHotUpdaterConfigScaffoldFromBuilderOptions, CreateHotUpdaterConfigScaffoldOptions, HOT_UPDATER_SERVER_PACKAGE_VERSION_ENV, HotUpdateDirUtil, HotUpdaterConfigOptions, HotUpdaterConfigScaffold, HotUpdaterInitEnv, HotUpdaterLogWriter, IConfigBuilder, ImportInfo, InitEnvFileError, InitError, InitProviderDefinition, InitProviderInputDefinition, InitProviderInputPersistence, LEGACY_BUNDLE_ERROR, LegacyInfrastructureError, ManagedHelperStatement, ManagedHelperStrategy, MissingInitInputsError, PromptProgress, PromptSpinner, ProviderConfig, ReactNativeMetadata, ReadPackageUpResult, RunInitOptions, WriteHotUpdaterConfigResult, assertInfrastructureGenerationAtUrl, assertInfrastructureGenerationPayload, assertInitInputs, assertInitProviderInputs, banner, typedColors as colors, confirmInitInputPersistence, copyDirToTmp, createCopiedBundleArchive, createHotUpdaterConfigScaffold, createHotUpdaterConfigScaffoldFromBuilder, createLogWriter, createTarBr, createTarBrTargetFiles, createTarGz, createTarGzTargetFiles, createZip, createZipTargetFiles, decryptJson, defineInitProvider, encryptJson, ensureInstallPackages, formatApiKeyNote, getAndroidSdkPath, getBundleSigningPublicKey, getCwd, getHotUpdaterEnvValue, getHotUpdaterInitInputEnv, getInitProviderEnvVars, getInitProviderTextPromptValues, getMissingInitInputs, getMissingInitProviderInputs, getPackageManager, getReactNativeMetadatas, getStorageFileByteSize, link, loadConfig, log, makeEnv, p, prepareBundleSigning, printBanner, putStorageFile, readBundleSigningPublicKeyFile, readHotUpdaterEnv, readHotUpdaterInitEnv, readPackageUp, renderImportStatements, resolveHotUpdaterServerVersion, resolveInitProviderInput, resolveInitProviderInputs, resolvePackageVersion, shouldAutoSelectOnlyInitResource, stripAnsi, transformEnv, transformTemplate, writeHotUpdaterConfig, writeStorageFile, writeStorageResponseFile };
+export { AppClientCredential, AppClientPlugin, BuildLogger, BuildLoggerConfig, BuildType, BundleSigningSession, ConfigBuilder, ConfigBuilderScaffold, ConfigResponse, CreateHotUpdaterConfigScaffoldFromBuilderOptions, CreateHotUpdaterConfigScaffoldOptions, HOT_UPDATER_PLUGINS_PATH, HOT_UPDATER_SERVER_PACKAGE_VERSION_ENV, HotUpdateDirUtil, HotUpdaterConfigOptions, HotUpdaterConfigScaffold, HotUpdaterInitEnv, HotUpdaterLogWriter, IConfigBuilder, ImportInfo, InitEnvFileError, InitError, InitProviderDefinition, InitProviderInputDefinition, InitProviderInputPersistence, LEGACY_BUNDLE_ERROR, LegacyInfrastructureError, ManagedHelperStatement, ManagedHelperStrategy, MissingInitInputsError, PromptProgress, PromptSpinner, ProviderConfig, ReactNativeMetadata, ReadPackageUpResult, RunInitOptions, WriteHotUpdaterConfigResult, WriteHotUpdaterPluginsResult, assertInfrastructureGenerationAtUrl, assertInfrastructureGenerationPayload, assertInitInputs, assertInitProviderInputs, banner, typedColors as colors, confirmInitInputPersistence, copyDirToTmp, createCopiedBundleArtifacts, createHotUpdaterConfigScaffold, createHotUpdaterConfigScaffoldFromBuilder, createLogWriter, createTarBrTargetFiles, createZip, decryptJson, defineInitProvider, encryptJson, ensureInstallPackages, generateHotUpdaterPlugins, getAndroidSdkPath, getBundleSigningPublicKey, getCwd, getHotUpdaterEnvValue, getHotUpdaterInitInputEnv, getInitProviderEnvVars, getInitProviderTextPromptValues, getMissingInitInputs, getMissingInitProviderInputs, getPackageManager, getReactNativeMetadatas, getStorageFileByteSize, link, loadConfig, loadHotUpdaterPlugins, log, makeEnv, p, prepareBundleSigning, printAppSetup, printBanner, putStorageFile, readBundleSigningPublicKeyFile, readHotUpdaterEnv, readHotUpdaterInitEnv, readPackageUp, renderAppSetup, renderHotUpdaterPlugins, renderImportStatements, resolveHotUpdaterServerVersion, resolveInitProviderInput, resolveInitProviderInputs, resolvePackageVersion, shouldAutoSelectOnlyInitResource, stripAnsi, transformEnv, transformTemplate, writeHotUpdaterConfig, writeHotUpdaterPlugins, writeStorageFile, writeStorageResponseFile };

package/dist/index.mjs

@@ -3,7 +3,7 @@ import { createRequire } from "node:module";
 import path, { dirname, parse } from "path";
 import { createInterface } from "readline";
 import { PassThrough } from "stream";
-import fs, { createWriteStream } from "fs";
+import fs from "fs";
 import fs$1 from "fs/promises";
 import $r, { EventEmitter } from "events";
 import Pi from "assert";
@@ -14,28 +14,27 @@ import process$1, { execArgv, execPath, hrtime, platform, stdin, stdout } from "
 import * as l from "node:readline";
 import l__default from "node:readline";
 import tty, { ReadStream } from "node:tty";
-import Ei, { appendFileSync, createReadStream, createWriteStream as createWriteStream$1, existsSync, lstatSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
+import Ei, { appendFileSync, createReadStream, createWriteStream, existsSync, lstatSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
 import path$1, { basename, dirname as dirname$1, join, posix, win32 } from "node:path";
 import os, { constants } from "node:os";
-import crypto$1, { randomBytes, randomUUID } from "node:crypto";
+import crypto$1, { createHash, randomBytes, randomUUID } from "node:crypto";
 import fs$2 from "node:fs/promises";
-import { pipeline } from "stream/promises";
-import * as Ms from "zlib";
-import Jr, { constants as constants$1, createBrotliCompress } from "zlib";
-import { EventEmitter as EventEmitter$1, addAbortListener, on, once, setMaxListeners } from "node:events";
 import As, { Duplex, PassThrough as PassThrough$1, Readable as Readable$1, Transform, Writable, getDefaultHighWaterMark } from "node:stream";
+import { finished, pipeline } from "node:stream/promises";
+import { brotliDecompressSync, constants as constants$1, createBrotliCompress } from "node:zlib";
+import { EventEmitter as EventEmitter$1, addAbortListener, on, once, setMaxListeners } from "node:events";
 import { StringDecoder } from "node:string_decoder";
+import * as Ms from "zlib";
+import Jr from "zlib";
 import no from "node:assert";
 import { fileURLToPath } from "node:url";
 import { ChildProcess, execFile, spawn, spawnSync } from "node:child_process";
 import { scheduler, setImmediate as setImmediate$1, setTimeout as setTimeout$1 } from "node:timers/promises";
 import { serialize } from "node:v8";
-import { finished, pipeline as pipeline$1 } from "node:stream/promises";
 import { Buffer as Buffer$2 } from "node:buffer";
 import { parseSync } from "oxc-parser";
-import { createBundleStorageKey, createDatabasePlugin, createStoragePlugin, createStorageRootUriWithPath, detectCompressionFormat, getContentType, getManifestAssetDownloadPath, getManifestAssetStoragePath, isContentAddressedAssetFileHash, parseStorageUri, resolveManifestAssetStorageUri } from "@hot-updater/plugin-core";
 import { loadConfig as loadConfig$1 } from "unconfig";
-import { brotliDecompressSync, constants as constants$2, createBrotliCompress as createBrotliCompress$1 } from "node:zlib";
+import { createBundleStorageKey, createStoragePlugin, createStorageRootUriWithPath, getContentType, getManifestAssetDownloadPath, getManifestAssetStoragePath, isContentAddressedAssetFileHash, resolveManifestAssetStorageUri } from "@hot-updater/plugin-core";
 import { getManifestFileHash, stripBundleArtifactMetadata } from "@hot-updater/core";
 import { transformSync } from "oxc-transform";
 //#endregion
@@ -22906,8 +22905,47 @@ var BuildLogger = class {
 	}
 };
 //#endregion
-//#region src/apiKeyNote.ts
-const formatApiKeyNote = (apiKey) => apiKey;
+//#region src/appSetup.ts
+/**
+* The App.tsx code init prints: `HotUpdater.init` with the server's URL,
+* the header that carries the client credential when the server takes one,
+* and the client plugins the server's plugins ask for.
+*/
+const renderAppSetup = ({ baseURL, credential, clientPlugins = [] }) => [
+	"// Add this to your App.tsx",
+	"import { HotUpdater } from \"@hot-updater/react-native\";",
+	...clientPlugins.map(({ module, name }) => `import { ${name} } from ${JSON.stringify(module)};`),
+	"",
+	"function App() {",
+	"  return null; // Replace with your app root.",
+	"}",
+	"",
+	"HotUpdater.init({",
+	`  baseURL: ${JSON.stringify(baseURL)},`,
+	...credential === void 0 ? [] : [
+		"  requestHeaders: {",
+		`    ${JSON.stringify(credential.header)}: ${JSON.stringify(credential.value)},`,
+		"  },"
+	],
+	...clientPlugins.length === 0 ? [] : [`  plugins: [${clientPlugins.map(({ name }) => `${name}()`).join(", ")}],`],
+	"});",
+	"",
+	"// Call HotUpdater.checkForUpdate({ updateStrategy: \"appVersion\" })",
+	"// when your app is ready to check.",
+	"export default App;"
+].join("\n");
+/** Prints the App.tsx code, when the URL is known, and the app's credential. */
+const printAppSetup = ({ baseURL, ...setup }) => {
+	if (baseURL !== void 0) p.note(renderAppSetup({
+		baseURL,
+		...setup
+	}));
+	const { credential } = setup;
+	if (credential !== void 0) {
+		p.note(credential.value, credential.label);
+		p.log.message(`Store this ${credential.label} separately in a secure place.`);
+	}
+};
 //#endregion
 //#region ../../node_modules/.pnpm/ansi-regex@6.2.2/node_modules/ansi-regex/index.js
 function ansiRegex({ onlyFirst = false } = {}) {
@@ -25043,14 +25081,14 @@ var ConfigBuilder = class {
 	intermediateCode = "";
 	collectedImports = /* @__PURE__ */ new Map();
 	constructor() {
-		this.addImport({
-			pkg: "dotenv",
-			named: ["config"]
-		});
 		this.addImport({
 			pkg: "hot-updater",
 			named: ["defineConfig"]
 		});
+		this.addImport({
+			pkg: "node:fs",
+			named: ["existsSync"]
+		});
 	}
 	addImport(info) {
 		const pkg = info.pkg;
@@ -25127,7 +25165,9 @@ var ConfigBuilder = class {
 		const text = `
 ${importStatements}
 
-config({ path: ".env.hotupdater" });
+if (existsSync(".env.hotupdater")) {
+  process.loadEnvFile(".env.hotupdater");
+}
 
 ${this.intermediateCode ? `${this.intermediateCode}\n` : ""}
 export default defineConfig({
@@ -28325,7 +28365,7 @@ var fo = (s, t) => {
 		});
 	});
 };
-var uo = K(co, fo, (s) => new Te(s), (s) => new Xt(s), (s, t) => {
+K(co, fo, (s) => new Te(s), (s) => new Xt(s), (s, t) => {
 	t?.length && Xi(s, t);
 });
 var mo = (s, t) => {
@@ -28439,150 +28479,47 @@ var Ro = (s) => {
 };
 //#endregion
 //#region src/createTarBr.ts
-const createTarBrTargetFiles = async ({ outfile, targetFiles }) => {
-	await fs$1.rm(outfile, { force: true });
-	const tmpDir = path.join(path.dirname(outfile), `.tmp-tar-${Date.now()}`);
-	await fs$1.mkdir(tmpDir, { recursive: true });
+/** Build the one supported bulk transport from the exact manifest file set. */
+async function createTarBrTargetFiles({ outfile, targetFiles }) {
+	await fs$2.mkdir(path$1.dirname(outfile), { recursive: true });
+	const staging = await fs$2.mkdtemp(path$1.join(path$1.dirname(outfile), ".tar-br-"));
 	try {
+		const names = /* @__PURE__ */ new Set();
 		for (const target of targetFiles) {
-			const sourcePath = target.path;
-			const destPath = path.join(tmpDir, target.name);
-			await fs$1.mkdir(path.dirname(destPath), { recursive: true });
-			if ((await fs$1.stat(sourcePath)).isDirectory()) await copyDir$1(sourcePath, destPath);
-			else await fs$1.copyFile(sourcePath, destPath);
-		}
-		await fs$1.mkdir(path.dirname(outfile), { recursive: true });
+			const name = target.name;
+			if (!name || name !== name.trim() || name.includes("\\") || name.includes("\0") || name.startsWith("/") || /^[A-Za-z]:/.test(name) || name.split("/").some((part) => !part || part === "." || part === "..") || name === "manifest.json" || name === "bundle.tar.br" || names.has(name)) throw new Error(`Invalid or duplicate archive asset path: ${name}`);
+			if (!(await fs$2.lstat(target.path)).isFile()) throw new Error(`Archive asset is not a regular file: ${name}`);
+			names.add(name);
+			const destination = path$1.join(staging, name);
+			await fs$2.mkdir(path$1.dirname(destination), { recursive: true });
+			await fs$2.copyFile(target.path, destination);
+			await fs$2.chmod(destination, 420);
+		}
+		let tarByteSize = 0;
+		const countTarBytes = new Transform({ transform(chunk, _encoding, callback) {
+			tarByteSize += chunk.length;
+			callback(null, chunk);
+		} });
 		await pipeline(Kn({
-			cwd: tmpDir,
+			cwd: staging,
 			portable: true,
 			mtime: /* @__PURE__ */ new Date(0),
 			gzip: false
-		}, await fs$1.readdir(tmpDir)), createBrotliCompress({ params: {
-			[constants$1.BROTLI_PARAM_QUALITY]: 11,
-			[constants$1.BROTLI_PARAM_LGWIN]: 24
-		} }), createWriteStream(outfile));
-		return outfile;
-	} finally {
-		await fs$1.rm(tmpDir, {
-			recursive: true,
-			force: true
-		});
-	}
-};
-async function copyDir$1(src, dest) {
-	await fs$1.mkdir(dest, { recursive: true });
-	const entries = await fs$1.readdir(src, { withFileTypes: true });
-	for (const entry of entries) {
-		const srcPath = path.join(src, entry.name);
-		const destPath = path.join(dest, entry.name);
-		if (entry.isDirectory()) await copyDir$1(srcPath, destPath);
-		else await fs$1.copyFile(srcPath, destPath);
-	}
-}
-const createBrotliTar = async ({ cwd, files, outfile }) => {
-	await fs$1.mkdir(path.dirname(outfile), { recursive: true });
-	await pipeline(Kn({
-		cwd,
-		portable: true,
-		mtime: /* @__PURE__ */ new Date(0),
-		gzip: false
-	}, files), createBrotliCompress({ params: {
-		[constants$1.BROTLI_PARAM_QUALITY]: 11,
-		[constants$1.BROTLI_PARAM_LGWIN]: 24
-	} }), createWriteStream(outfile));
-};
-const createTarBr = async ({ outfile, targetDir, excludeExts = [] }) => {
-	await fs$1.rm(outfile, { force: true });
-	async function getFiles(dir, baseDir = "") {
-		const entries = await fs$1.readdir(dir, { withFileTypes: true });
-		const files = [];
-		for (const entry of entries) {
-			if (excludeExts.some((pattern) => entry.name.includes(pattern))) continue;
-			const fullPath = path.join(dir, entry.name);
-			const relativePath = path.join(baseDir, entry.name);
-			if (entry.isDirectory()) {
-				const subFiles = await getFiles(fullPath, relativePath);
-				files.push(...subFiles);
-			} else files.push(relativePath);
-		}
-		return files;
-	}
-	const filesToInclude = await getFiles(targetDir);
-	filesToInclude.sort();
-	await createBrotliTar({
-		cwd: targetDir,
-		files: filesToInclude,
-		outfile
-	});
-	return outfile;
-};
-//#endregion
-//#region src/createTarGz.ts
-const createTarGzTargetFiles = async ({ outfile, targetFiles }) => {
-	await fs$1.rm(outfile, { force: true });
-	const tmpDir = path.join(path.dirname(outfile), `.tmp-tar-${Date.now()}`);
-	await fs$1.mkdir(tmpDir, { recursive: true });
-	try {
-		for (const target of targetFiles) {
-			const sourcePath = target.path;
-			const destPath = path.join(tmpDir, target.name);
-			await fs$1.mkdir(path.dirname(destPath), { recursive: true });
-			if ((await fs$1.stat(sourcePath)).isDirectory()) await copyDir(sourcePath, destPath);
-			else await fs$1.copyFile(sourcePath, destPath);
-		}
-		await fs$1.mkdir(path.dirname(outfile), { recursive: true });
-		await Kn({
-			file: outfile,
-			cwd: tmpDir,
-			portable: true,
-			mtime: /* @__PURE__ */ new Date(0),
-			gzip: true
-		}, await fs$1.readdir(tmpDir));
-		return outfile;
+		}, [...names].sort()), countTarBytes, createBrotliCompress({ params: { [constants$1.BROTLI_PARAM_QUALITY]: 11 } }), createWriteStream(outfile));
+		const hash = createHash("sha256");
+		for await (const chunk of createReadStream(outfile)) hash.update(chunk);
+		return {
+			downloadFileHash: hash.digest("hex"),
+			downloadByteSize: (await fs$2.stat(outfile)).size,
+			tarByteSize
+		};
 	} finally {
-		await fs$1.rm(tmpDir, {
+		await fs$2.rm(staging, {
 			recursive: true,
 			force: true
 		});
 	}
-};
-async function copyDir(src, dest) {
-	await fs$1.mkdir(dest, { recursive: true });
-	const entries = await fs$1.readdir(src, { withFileTypes: true });
-	for (const entry of entries) {
-		const srcPath = path.join(src, entry.name);
-		const destPath = path.join(dest, entry.name);
-		if (entry.isDirectory()) await copyDir(srcPath, destPath);
-		else await fs$1.copyFile(srcPath, destPath);
-	}
 }
-const createTarGz = async ({ outfile, targetDir, excludeExts = [] }) => {
-	await fs$1.rm(outfile, { force: true });
-	async function getFiles(dir, baseDir = "") {
-		const entries = await fs$1.readdir(dir, { withFileTypes: true });
-		const files = [];
-		for (const entry of entries) {
-			if (excludeExts.some((pattern) => entry.name.includes(pattern))) continue;
-			const fullPath = path.join(dir, entry.name);
-			const relativePath = path.join(baseDir, entry.name);
-			if (entry.isDirectory()) {
-				const subFiles = await getFiles(fullPath, relativePath);
-				files.push(...subFiles);
-			} else files.push(relativePath);
-		}
-		return files;
-	}
-	const filesToInclude = await getFiles(targetDir);
-	filesToInclude.sort();
-	await Kn({
-		file: outfile,
-		cwd: targetDir,
-		portable: true,
-		mtime: /* @__PURE__ */ new Date(0),
-		gzip: true
-	}, filesToInclude);
-	return outfile;
-};
 //#endregion
 //#region ../../node_modules/.pnpm/process-nextick-args@2.0.1/node_modules/process-nextick-args/index.js
 var require_process_nextick_args = /* @__PURE__ */ __commonJSMin(((exports, module) => {
@@ -37664,41 +37601,6 @@ var import_lib = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin(((export
 	JSZip.external = require_external();
 	module.exports = JSZip;
 })))(), 1);
-const createZipTargetFiles = async ({ outfile, targetFiles }) => {
-	const zip = new import_lib.default();
-	await fs$1.rm(outfile, { force: true });
-	async function addFiles(dir, zipFolder) {
-		const files = await fs$1.readdir(dir);
-		files.sort();
-		for (const file of files) {
-			const fullPath = path.join(dir, file);
-			if ((await fs$1.stat(fullPath)).isDirectory()) {
-				const folder = zipFolder.folder(file);
-				if (!folder) continue;
-				await addFiles(fullPath, folder);
-			} else {
-				const data = await fs$1.readFile(fullPath);
-				zipFolder.file(file, data);
-			}
-		}
-	}
-	for (const target of targetFiles) if ((await fs$1.stat(target.path)).isDirectory()) {
-		const folder = zip.folder(target.name);
-		if (folder) await addFiles(target.path, folder);
-	} else {
-		const data = await fs$1.readFile(target.path);
-		zip.file(target.name, data);
-	}
-	const content = await zip.generateAsync({
-		type: "nodebuffer",
-		compression: "DEFLATE",
-		compressionOptions: { level: 9 },
-		platform: "UNIX"
-	});
-	await fs$1.mkdir(path.dirname(outfile), { recursive: true });
-	await fs$1.writeFile(outfile, content);
-	return outfile;
-};
 const createZip = async ({ outfile, targetDir, excludeExts = [] }) => {
 	const zip = new import_lib.default();
 	await fs$1.rm(outfile, { force: true });
@@ -42298,8 +42200,8 @@ const addPropertiesAsync = {
 	},
 	output: {
 		...addProperties,
-		fileUrl: ({ value }) => ({ stream: createWriteStream$1(value) }),
-		filePath: ({ value: { file, append } }) => ({ stream: createWriteStream$1(file, append ? { flags: "a" } : {}) }),
+		fileUrl: ({ value }) => ({ stream: createWriteStream(value) }),
+		filePath: ({ value: { file, append } }) => ({ stream: createWriteStream(file, append ? { flags: "a" } : {}) }),
 		webStream: ({ value }) => ({ stream: Writable.fromWeb(value) }),
 		iterable: forbiddenIfAsync,
 		asyncIterable: forbiddenIfAsync,
@@ -44175,7 +44077,6 @@ const getReactNativeMetadatas = (cwd) => {
 const HOT_UPDATER_CONFIG_PATH = "hot-updater.config.ts";
 const CONFIG_FILE_NAME = "hot-updater.config.ts";
 const MANAGED_IMPORT_PACKAGES = /* @__PURE__ */ new Set([
-	"dotenv",
 	"firebase-admin",
 	"firebase-admin/app",
 	"hot-updater",
@@ -44428,7 +44329,6 @@ const updateManagedObject = (existing, next) => {
 	for (const edit of propertyEdits.sort((left, right) => right.start - left.start)) mergedText = mergedText.slice(0, edit.start) + edit.text + mergedText.slice(edit.end);
 	return appendMissingProperties(mergedText, missingPropertyTexts, existing.objectExpression.properties.length > 0);
 };
-const isConfigCallStatement = (statement) => statement.type === "ExpressionStatement" && statement.expression.type === "CallExpression" && statement.expression.callee.type === "Identifier" && statement.expression.callee.name === "config";
 const getManagedHelperName = (statement) => {
 	if (statement.type !== "VariableDeclaration") return null;
 	const declaration = statement.declarations[0];
@@ -44436,16 +44336,20 @@ const getManagedHelperName = (statement) => {
 	return declaration.id.name;
 };
 const rebuildImportBlock = (source, scaffold) => {
+	const imports = scaffold.imports.map((info) => info.pkg === "node:fs" ? {
+		...info,
+		named: info.named?.filter((name) => name !== "existsSync")
+	} : info);
 	const importDeclarations = source.program.body.filter((statement) => statement.type === "ImportDeclaration");
 	const firstImport = importDeclarations[0];
 	const lastImport = importDeclarations.at(-1);
 	if (!firstImport || !lastImport) return {
 		start: 0,
 		end: 0,
-		text: `${renderImportStatements(scaffold.imports)}\n\n`
+		text: `${renderImportStatements(imports)}\n\n`
 	};
 	const preservedImportTexts = importDeclarations.filter((declaration) => !MANAGED_IMPORT_PACKAGES.has(declaration.source.value)).map((declaration) => source.text.slice(getTopLevelFullStart(source, declaration), declaration.end).trim());
-	const managedImportText = renderImportStatements(scaffold.imports);
+	const managedImportText = renderImportStatements(imports);
 	const nextImportBlock = [...preservedImportTexts, managedImportText].filter(Boolean).join("\n");
 	return {
 		start: getTopLevelFullStart(source, firstImport),
@@ -44458,12 +44362,7 @@ const rebuildManagedBody = (source, exportStart, scaffold) => {
 	const managedHelpers = new Map(scaffold.helperStatements.map((statement) => [statement.name, statement]));
 	const emittedHelpers = /* @__PURE__ */ new Set();
 	const bodyStatements = [];
-	const configStatements = [];
 	for (const statement of statementsBeforeExport) {
-		if (isConfigCallStatement(statement)) {
-			configStatements.push(getStatementText(source, statement));
-			continue;
-		}
 		const helperName = getManagedHelperName(statement);
 		if (!helperName || !MANAGED_HELPER_NAMES.has(helperName)) {
 			bodyStatements.push(getStatementText(source, statement));
@@ -44478,8 +44377,7 @@ const rebuildManagedBody = (source, exportStart, scaffold) => {
 	}
 	for (const helper of scaffold.helperStatements) if (!emittedHelpers.has(helper.name)) bodyStatements.push(helper.code.trim());
 	const bodyText = bodyStatements.filter(Boolean).join("\n\n");
-	const configStatement = configStatements.join("\n\n") || `config({ path: ".env.hotupdater" });`;
-	const managedBody = bodyText ? `\n\n${configStatement}\n\n${bodyText}\n\n` : `\n\n${configStatement}\n\n`;
+	const managedBody = bodyText ? `\n\n${bodyText}\n\n` : "\n\n";
 	return {
 		start: source.program.body.filter((statement) => statement.type === "ImportDeclaration").at(-1)?.end ?? 0,
 		end: exportStart,
@@ -44678,6 +44576,78 @@ const getHotUpdaterEnvValue = (env, key) => {
 	return env[key]?.trim() || void 0;
 };
 //#endregion
+//#region src/hotUpdaterPlugins.ts
+/** Where `hot-updater init` writes a managed server's plugin list. */
+const HOT_UPDATER_PLUGINS_PATH = "hotUpdater.plugins.ts";
+/**
+* The plugins file for a managed provider: a re-export of the fixed list its
+* package ships, which its prebuilt server runs too.
+*/
+const renderHotUpdaterPlugins = (pkg) => [
+	"// Generated by `hot-updater init`. The managed server runs these plugins,",
+	`// and ${pkg} fixes the list, so the server, CLI, and console agree.`,
+	`export { plugins } from "${pkg}";`,
+	""
+].join("\n");
+/** Writes the plugins file; an existing file that differs is kept. */
+const writeHotUpdaterPlugins = async (pkg, filePath = HOT_UPDATER_PLUGINS_PATH) => {
+	const text = renderHotUpdaterPlugins(pkg);
+	const existingText = await fs$1.readFile(filePath, "utf-8").catch((error) => {
+		if (error instanceof Error && "code" in error && error.code === "ENOENT") return null;
+		throw error;
+	});
+	if (existingText === null) {
+		await fs$1.writeFile(filePath, text, "utf-8");
+		return {
+			status: "created",
+			path: filePath
+		};
+	}
+	if (existingText === text) return {
+		status: "unchanged",
+		path: filePath
+	};
+	return {
+		status: "skipped",
+		path: filePath,
+		reason: `it does not re-export the plugins ${pkg} runs; replace it with \`export { plugins } from "${pkg}";\``
+	};
+};
+/** Writes the plugins file for `pkg` and reports what happened. */
+const generateHotUpdaterPlugins = async (pkg, filePath = HOT_UPDATER_PLUGINS_PATH) => {
+	const result = await writeHotUpdaterPlugins(pkg, filePath);
+	if (result.status === "created") p.log.success(`Generated '${filePath}' with the plugins the server runs.`);
+	else if (result.status === "skipped") p.log.warn(`Kept existing '${filePath}' unchanged: ${result.reason}`);
+	return result;
+};
+/**
+* The plugins a project's `hotUpdater.plugins.ts` exports, which its server
+* runs; undefined when the project has no such file. The console and the CLI
+* assemble them in process as the server does, for the features and commands
+* the plugins add.
+*/
+const loadHotUpdaterPlugins = async (cwd = getCwd()) => {
+	const { config, sources } = await loadConfig$1({
+		cwd,
+		stopAt: path.dirname(cwd),
+		merge: false,
+		sources: [{
+			files: "hotUpdater.plugins",
+			extensions: [
+				"ts",
+				"mts",
+				"cts",
+				"js",
+				"mjs",
+				"cjs"
+			]
+		}]
+	});
+	if (sources.length === 0) return void 0;
+	if (!Array.isArray(config?.plugins)) throw new Error(`${path.basename(sources[0])} must export plugins, an array of plugins.`);
+	return config.plugins;
+};
+//#endregion
 //#region src/infrastructureGeneration.ts
 const assertInfrastructureGenerationPayload = ({ payload, provider, resource }) => {
 	if (typeof payload !== "object" || payload === null || !("infrastructureGeneration" in payload) || payload.infrastructureGeneration !== 1) throw new LegacyInfrastructureError(provider, resource);
@@ -44873,89 +44843,20 @@ function isMergeableValue(value) {
 //#endregion
 //#region src/loadConfig.ts
 var import_out = /* @__PURE__ */ __toESM(require_out(), 1);
-const missingDatabase = createDatabasePlugin({
+const missingDatabaseError = async () => {
+	throw new Error("database is required");
+};
+/** The default until the config names a database: every read and write refuses. */
+const missingDatabase = {
 	name: "missingDatabase",
-	models: {
-		bundles: {
-			findById: async () => {
-				throw new Error("database plugin is required");
-			},
-			findMany: async () => {
-				throw new Error("database plugin is required");
-			},
-			count: async () => {
-				throw new Error("database plugin is required");
-			}
-		},
-		bundlePatches: { findByBundleIds: async () => {
-			throw new Error("database plugin is required");
-		} },
-		releases: {
-			findById: async () => {
-				throw new Error("database plugin is required");
-			},
-			findMany: async () => {
-				throw new Error("database plugin is required");
-			},
-			findManyByScope: async () => {
-				throw new Error("database plugin is required");
-			}
-		},
-		releaseCatalogs: {
-			findByScopeKey: async () => {
-				throw new Error("database plugin is required");
-			},
-			findMany: async () => {
-				throw new Error("database plugin is required");
-			}
-		},
-		channels: {
-			insert: async () => {
-				throw new Error("database plugin is required");
-			},
-			list: async () => {
-				throw new Error("database plugin is required");
-			},
-			delete: async () => {
-				throw new Error("database plugin is required");
-			}
-		},
-		insights: {
-			recordEvent: async () => {
-				throw new Error("database plugin is required");
-			},
-			listEvents: async () => {
-				throw new Error("database plugin is required");
-			},
-			findLatestEvents: async () => {
-				throw new Error("database plugin is required");
-			},
-			countLatestEvents: async () => {
-				throw new Error("database plugin is required");
-			},
-			countEvents: async () => {
-				throw new Error("database plugin is required");
-			}
-		},
-		apiKeys: {
-			create: async () => {
-				throw new Error("database plugin is required");
-			},
-			findByHash: async () => {
-				throw new Error("database plugin is required");
-			},
-			list: async () => {
-				throw new Error("database plugin is required");
-			},
-			revoke: async () => {
-				throw new Error("database plugin is required");
-			}
-		}
-	},
-	commit: async () => {
-		throw new Error("database plugin is required");
+	adapter: {
+		id: "missing",
+		fits: () => true,
+		get: missingDatabaseError,
+		query: missingDatabaseError,
+		write: missingDatabaseError
 	}
-});
+};
 const missingStorageError = async () => {
 	throw new Error("storage plugin is required");
 };
@@ -45003,7 +44904,6 @@ const getDefaultConfig = () => {
 	return {
 		cacheDir: path.join("node_modules", ".hot-updater"),
 		updateStrategy: "appVersion",
-		compressStrategy: "zip",
 		fingerprint: {},
 		patch: {
 			enabled: true,
@@ -45059,6 +44959,7 @@ const getConfigLoaderOptions = (options) => {
 const loadConfig = async (options) => {
 	const { config } = await loadConfig$1(getConfigLoaderOptions(options));
 	for (const key of ["authorityId", "catalogId"]) if (config && Object.hasOwn(config, key)) throw new Error(`Remove ${key} from hot-updater.config. Catalog identity is managed internally.`);
+	if (config && Object.hasOwn(config, "compressStrategy")) throw new Error("Remove compressStrategy from hot-updater.config. OTA artifacts use manifest files with per-file Brotli compression.");
 	const mergedConfig = mergeConfigSources(config, getDefaultConfig());
 	const signing = normalizeSigningConfig(mergedConfig.signing);
 	return {
@@ -45216,7 +45117,7 @@ const writeStorageResponseFile = async (response, filePath) => {
 		return;
 	}
 	try {
-		await pipeline$1(Readable$1.fromWeb(response.body), createWriteStream$1(filePath));
+		await pipeline(Readable$1.fromWeb(response.body), createWriteStream(filePath));
 	} catch (error) {
 		await fs$2.rm(filePath, { force: true });
 		throw error;
@@ -45252,11 +45153,6 @@ function verifySignedFileHash({ actualFileHash, publicKey, signedFileHash }) {
 		return false;
 	}
 }
-function getArchiveFilename(storageUri) {
-	const protocol = new URL(storageUri).protocol.replace(":", "");
-	const { key } = parseStorageUri(storageUri, protocol);
-	return path$1.posix.basename(key) || "bundle.zip";
-}
 const getRelativeStorageDir = (relativePath) => {
 	const normalized = relativePath.replace(/\\/g, "/");
 	const dirname = path$1.posix.dirname(normalized);
@@ -45273,7 +45169,7 @@ async function prepareManifestAssetUploadFile({ assetPath, sourcePath, workDir }
 	if (getManifestAssetDownloadPath(assetPath) === assetPath) return sourcePath;
 	const uploadPath = resolvePreparedUploadPath(workDir, assetPath);
 	await fs$2.mkdir(path$1.dirname(uploadPath), { recursive: true });
-	await pipeline$1(createReadStream(sourcePath), createBrotliCompress$1({ params: { [constants$2.BROTLI_PARAM_QUALITY]: 11 } }), createWriteStream$1(uploadPath));
+	await pipeline(createReadStream(sourcePath), createBrotliCompress({ params: { [constants$1.BROTLI_PARAM_QUALITY]: 11 } }), createWriteStream(uploadPath));
 	return uploadPath;
 }
 async function prepareContentAddressedUploadFile({ sourcePath, storagePath, workDir }) {
@@ -45290,9 +45186,10 @@ async function prepareManifestAssetUploadTargets({ extractDir, manifest, workDir
 	for (const assetPath of assetPaths) {
 		const asset = manifest.assets?.[assetPath];
 		if (!asset?.fileHash) throw new Error(`Manifest file hash not found for ${assetPath}`);
+		const sourcePath = resolveExtractedPath(extractDir, assetPath);
 		const uploadSourcePath = await prepareManifestAssetUploadFile({
 			assetPath,
-			sourcePath: resolveExtractedPath(extractDir, assetPath),
+			sourcePath,
 			workDir
 		});
 		const downloadByteSize = await getStorageFileByteSize(uploadSourcePath);
@@ -45301,6 +45198,7 @@ async function prepareManifestAssetUploadTargets({ extractDir, manifest, workDir
 		if (downloadFileHash !== void 0 && !isContentAddressedAssetFileHash(downloadFileHash)) throw new Error(`Prepared asset hash must be a lowercase SHA-256 hash: ${assetPath}`);
 		const nextAsset = {
 			...asset,
+			byteSize: (await fs$2.stat(sourcePath)).size,
 			downloadByteSize
 		};
 		delete nextAsset.downloadFileHash;
@@ -45330,143 +45228,81 @@ function resolveExtractedPath(rootDir, entryName) {
 	const normalizedEntryName = entryName.replaceAll("\\", "/");
 	const entryPath = path$1.resolve(rootDir, normalizedEntryName);
 	const relativePath = path$1.relative(rootDir, entryPath);
-	if (relativePath.startsWith("..") || path$1.isAbsolute(relativePath) || normalizedEntryName.startsWith("/")) throw new Error(`Invalid archive entry path: ${entryName}`);
+	if (relativePath.startsWith("..") || path$1.isAbsolute(relativePath) || normalizedEntryName.startsWith("/")) throw new Error(`Invalid manifest asset path: ${entryName}`);
 	return entryPath;
 }
-async function downloadArchive(storageUri, storagePlugin, archivePath) {
+async function downloadStorageObject(storageUri, storagePlugin, outputPath) {
 	const protocol = new URL(storageUri).protocol.replace(":", "");
 	if (storagePlugin?.protocol === protocol) {
-		await writeStorageFile(storagePlugin, storageUri, archivePath);
+		await writeStorageFile(storagePlugin, storageUri, outputPath);
 		return;
 	}
 	if (protocol === "http" || protocol === "https") {
-		await downloadFromUrl(storageUri, archivePath);
+		await downloadFromUrl(storageUri, outputPath);
 		return;
 	}
 	throw new Error(`No storage plugin for protocol: ${protocol}`);
 }
 async function downloadFromUrl(fileUrl, filePath) {
 	const response = await fetch(fileUrl);
-	if (!response.ok) throw new Error(`Failed to download bundle archive: ${response.statusText}`);
+	if (!response.ok) throw new Error(`Failed to download storage object: ${response.statusText}`);
 	await writeStorageResponseFile(response, filePath);
 }
-async function extractZipArchive(archivePath, extractDir) {
-	const zip = await import_lib.default.loadAsync(await fs$2.readFile(archivePath));
-	const entries = Object.values(zip.files).sort((left, right) => left.name.localeCompare(right.name));
-	for (const entry of entries) {
-		const outputPath = resolveExtractedPath(extractDir, entry.name);
-		if (entry.dir) {
-			await fs$2.mkdir(outputPath, { recursive: true });
-			continue;
+async function downloadManifestAssets({ bundle, manifest, outputDir, storagePlugin, workDir }) {
+	await runWithConcurrency(Object.keys(manifest.assets ?? {}).sort((left, right) => left.localeCompare(right)), PROMOTE_ASSET_CONCURRENCY, async (assetPath) => {
+		const asset = manifest.assets?.[assetPath];
+		if (!asset?.fileHash) throw new Error(`Manifest file hash not found for ${assetPath}`);
+		const downloadPath = getManifestAssetDownloadPath(assetPath);
+		const storageUri = resolveManifestAssetStorageUri({
+			assetBaseStorageUri: bundle.assetBaseStorageUri,
+			assetPath: downloadPath,
+			downloadFileHash: asset.downloadFileHash,
+			fileHash: asset.fileHash
+		});
+		const transferPath = resolveExtractedPath(workDir, `downloads/${downloadPath}`);
+		await fs$2.mkdir(path$1.dirname(transferPath), { recursive: true });
+		await downloadStorageObject(storageUri, storagePlugin, transferPath);
+		if (asset.downloadFileHash) {
+			if (await getFileHash(transferPath) !== asset.downloadFileHash.toLowerCase()) throw new Error(`Manifest download hash mismatch for ${assetPath}`);
 		}
+		const outputPath = resolveExtractedPath(outputDir, assetPath);
 		await fs$2.mkdir(path$1.dirname(outputPath), { recursive: true });
-		await fs$2.writeFile(outputPath, await entry.async("nodebuffer"));
-	}
-}
-async function extractTarBrArchive(archivePath, extractDir) {
-	const tarPath = path$1.join(extractDir, "bundle.tar");
-	const compressedBuffer = await fs$2.readFile(archivePath);
-	const tarBuffer = brotliDecompressSync(compressedBuffer);
-	await fs$2.writeFile(tarPath, tarBuffer);
-	try {
-		await uo({
-			file: tarPath,
-			cwd: extractDir,
-			gzip: false,
-			strict: true
-		});
-	} finally {
-		await fs$2.rm(tarPath, { force: true });
-	}
-}
-async function extractArchive(archivePath, extractDir) {
-	const { format } = detectCompressionFormat(path$1.basename(archivePath));
-	switch (format) {
-		case "zip":
-			await extractZipArchive(archivePath, extractDir);
-			return format;
-		case "tar.gz":
-			await uo({
-				file: archivePath,
-				cwd: extractDir,
-				gzip: true,
-				strict: true
-			});
-			return format;
-		case "tar.br":
-			await extractTarBrArchive(archivePath, extractDir);
-			return format;
-	}
-}
-async function getArchiveTargetFiles(bundleDir) {
-	const entries = await fs$2.readdir(bundleDir, { withFileTypes: true });
-	entries.sort((left, right) => left.name.localeCompare(right.name));
-	return entries.map((entry) => ({
-		path: path$1.join(bundleDir, entry.name),
-		name: entry.name
-	}));
-}
-async function createArchiveFromDirectory(sourceDir, archivePath, format) {
-	const targetFiles = await getArchiveTargetFiles(sourceDir);
-	switch (format) {
-		case "zip":
-			await createZipTargetFiles({
-				outfile: archivePath,
-				targetFiles
-			});
-			return;
-		case "tar.gz":
-			await createTarGzTargetFiles({
-				outfile: archivePath,
-				targetFiles
-			});
-			return;
-		case "tar.br":
-			await createTarBrTargetFiles({
-				outfile: archivePath,
-				targetFiles
-			});
-			return;
-	}
-}
-async function readCopiedBundleManifest(extractDir, nextBundleId) {
-	const manifestPath = path$1.join(extractDir, "manifest.json");
-	try {
-		await fs$2.access(manifestPath);
-	} catch {
-		throw new Error(LEGACY_BUNDLE_ERROR);
-	}
-	const manifest = JSON.parse(await fs$2.readFile(manifestPath, "utf8"));
-	manifest.bundleId = nextBundleId;
-	return {
-		manifest,
-		manifestPath
-	};
+		if (downloadPath === assetPath) await fs$2.copyFile(transferPath, outputPath);
+		else await fs$2.writeFile(outputPath, brotliDecompressSync(await fs$2.readFile(transferPath)));
+		if (await getFileHash(outputPath) !== asset.fileHash.toLowerCase()) throw new Error(`Manifest file hash mismatch for ${assetPath}`);
+	});
 }
-async function createCopiedBundleArchive({ bundle, config, nextBundleId, storagePlugin }) {
-	const archiveFilename = getArchiveFilename(bundle.storageUri);
+async function createCopiedBundleArtifacts({ bundle, config, nextBundleId, storagePlugin }) {
 	const workDir = await fs$2.mkdtemp(path$1.join(os.tmpdir(), "hot-updater-console-promote-"));
-	const sourceArchivePath = path$1.join(workDir, archiveFilename);
 	const extractDir = path$1.join(workDir, "bundle");
-	const outputArchivePath = path$1.join(workDir, archiveFilename);
+	const sourceManifestPath = path$1.join(workDir, "source-manifest.json");
+	const manifestPath = path$1.join(extractDir, "manifest.json");
 	const uploadedStorageUris = [];
 	await fs$2.mkdir(extractDir, { recursive: true });
 	try {
-		await downloadArchive(bundle.storageUri, storagePlugin, sourceArchivePath);
-		const actualSourceFileHash = await getFileHash(sourceArchivePath);
+		await downloadStorageObject(bundle.manifestStorageUri, storagePlugin, sourceManifestPath);
+		const actualManifestHash = await getFileHash(sourceManifestPath);
 		const signingSession = await prepareBundleSigning(config.signing);
-		if (isSignedFileHash(bundle.fileHash)) {
+		if (isSignedFileHash(bundle.manifestFileHash)) {
 			if (!signingSession) throw new Error("Cannot copy a signed bundle without enabled bundle signing configuration.");
 			if (!verifySignedFileHash({
-				actualFileHash: actualSourceFileHash,
+				actualFileHash: actualManifestHash,
 				publicKey: signingSession.publicKey,
-				signedFileHash: bundle.fileHash
-			})) throw new Error("Source bundle signature verification failed.");
-		} else if (actualSourceFileHash !== bundle.fileHash.toLowerCase()) throw new Error("Source bundle file hash verification failed.");
-		const format = await extractArchive(sourceArchivePath, extractDir);
-		const { manifest, manifestPath } = await readCopiedBundleManifest(extractDir, nextBundleId);
+				signedFileHash: bundle.manifestFileHash
+			})) throw new Error("Source manifest signature verification failed.");
+		} else if (actualManifestHash !== bundle.manifestFileHash.toLowerCase()) throw new Error("Source manifest file hash verification failed.");
+		const manifest = JSON.parse(await fs$2.readFile(sourceManifestPath, "utf8"));
+		if (!manifest.assets || typeof manifest.assets !== "object") throw new Error(LEGACY_BUNDLE_ERROR);
+		await downloadManifestAssets({
+			bundle,
+			manifest,
+			outputDir: extractDir,
+			storagePlugin,
+			workDir
+		});
+		manifest.bundleId = nextBundleId;
 		const assetPaths = Object.keys(manifest.assets ?? {}).sort((left, right) => left.localeCompare(right));
-		const sourceIsSigned = [bundle.fileHash, getManifestFileHash(bundle)].filter((hash) => Boolean(hash)).some((hash) => isSignedFileHash(hash));
+		const sourceIsSigned = isSignedFileHash(getManifestFileHash(bundle));
 		const manifestHasSignatures = assetPaths.some((assetPath) => Boolean(manifest.assets?.[assetPath]?.signature));
 		if (!signingSession && (sourceIsSigned || manifestHasSignatures)) throw new Error("Cannot copy a signed bundle without enabled bundle signing configuration.");
 		if (signingSession) {
@@ -45486,16 +45322,22 @@ async function createCopiedBundleArchive({ bundle, config, nextBundleId, storage
 			manifest,
 			workDir
 		});
+		const archivePath = path$1.join(workDir, "bundle.tar.br");
+		manifest.archive = await createTarBrTargetFiles({
+			outfile: archivePath,
+			targetFiles: assetPaths.map((name) => ({
+				name,
+				path: resolveExtractedPath(extractDir, name)
+			}))
+		});
 		await fs$2.writeFile(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`);
-		await fs$2.rm(sourceArchivePath, { force: true });
-		await createArchiveFromDirectory(extractDir, outputArchivePath, format);
-		const fileHash = await getFileHash(outputArchivePath);
 		const manifestHash = await getFileHash(manifestPath);
-		const nextFileHash = signingSession ? `${SIGNED_HASH_PREFIX}${await signingSession.signFileHash(fileHash)}` : fileHash;
 		const nextManifestFileHash = signingSession ? `${SIGNED_HASH_PREFIX}${await signingSession.signFileHash(manifestHash)}` : manifestHash;
-		const archiveUpload = await putStorageFile(storagePlugin, createBundleStorageKey(nextBundleId), outputArchivePath);
+		const archiveUpload = await putStorageFile(storagePlugin, createBundleStorageKey(nextBundleId), archivePath);
 		uploadedStorageUris.push(archiveUpload.storageUri);
-		const assetBaseStorageUri = createStorageRootUriWithPath(archiveUpload.storageUri, nextBundleId, "assets");
+		const manifestUpload = await putStorageFile(storagePlugin, createBundleStorageKey(nextBundleId), manifestPath);
+		uploadedStorageUris.push(manifestUpload.storageUri);
+		const assetBaseStorageUri = createStorageRootUriWithPath(manifestUpload.storageUri, nextBundleId, "assets");
 		for (const assetUploadTarget of assetUploadTargets) {
 			const storageUri = resolveManifestAssetStorageUri({
 				assetBaseStorageUri,
@@ -45506,15 +45348,10 @@ async function createCopiedBundleArchive({ bundle, config, nextBundleId, storage
 			const { exists } = await storagePlugin.exists({ storageUri });
 			if (!exists) await putStorageFile(storagePlugin, getRelativeStorageDir(assetUploadTarget.storagePath) ? `assets/${getRelativeStorageDir(assetUploadTarget.storagePath)}` : "assets", assetUploadTarget.uploadSourcePath);
 		}
-		const manifestUpload = await putStorageFile(storagePlugin, createBundleStorageKey(nextBundleId), manifestPath);
-		uploadedStorageUris.push(manifestUpload.storageUri);
 		return {
 			bundle: {
 				...bundle,
 				id: nextBundleId,
-				archiveByteSize: archiveUpload.byteSize,
-				storageUri: archiveUpload.storageUri,
-				fileHash: nextFileHash,
 				metadata: stripBundleArtifactMetadata(bundle.metadata),
 				assetBaseStorageUri,
 				patches: [],
@@ -45611,4 +45448,4 @@ function transformTemplate(templateString, values) {
 	return result;
 }
 //#endregion
-export { BuildLogger, ConfigBuilder, HOT_UPDATER_SERVER_PACKAGE_VERSION_ENV, HotUpdateDirUtil, InitEnvFileError, InitError, LEGACY_BUNDLE_ERROR, LegacyInfrastructureError, MissingInitInputsError, assertInfrastructureGenerationAtUrl, assertInfrastructureGenerationPayload, assertInitInputs, assertInitProviderInputs, banner, typedColors as colors, confirmInitInputPersistence, copyDirToTmp, createCopiedBundleArchive, createHotUpdaterConfigScaffold, createHotUpdaterConfigScaffoldFromBuilder, createLogWriter, createTarBr, createTarBrTargetFiles, createTarGz, createTarGzTargetFiles, createZip, createZipTargetFiles, decryptJson, defineInitProvider, encryptJson, ensureInstallPackages, formatApiKeyNote, getAndroidSdkPath, getBundleSigningPublicKey, getCwd, getHotUpdaterEnvValue, getHotUpdaterInitInputEnv, getInitProviderEnvVars, getInitProviderTextPromptValues, getMissingInitInputs, getMissingInitProviderInputs, getPackageManager, getReactNativeMetadatas, getStorageFileByteSize, link, loadConfig, log, makeEnv, p, prepareBundleSigning, printBanner, putStorageFile, readBundleSigningPublicKeyFile, readHotUpdaterEnv, readHotUpdaterInitEnv, readPackageUp, renderImportStatements, resolveHotUpdaterServerVersion, resolveInitProviderInput, resolveInitProviderInputs, resolvePackageVersion, shouldAutoSelectOnlyInitResource, stripAnsi, transformEnv, transformTemplate, writeHotUpdaterConfig, writeStorageFile, writeStorageResponseFile };
+export { BuildLogger, ConfigBuilder, HOT_UPDATER_PLUGINS_PATH, HOT_UPDATER_SERVER_PACKAGE_VERSION_ENV, HotUpdateDirUtil, InitEnvFileError, InitError, LEGACY_BUNDLE_ERROR, LegacyInfrastructureError, MissingInitInputsError, assertInfrastructureGenerationAtUrl, assertInfrastructureGenerationPayload, assertInitInputs, assertInitProviderInputs, banner, typedColors as colors, confirmInitInputPersistence, copyDirToTmp, createCopiedBundleArtifacts, createHotUpdaterConfigScaffold, createHotUpdaterConfigScaffoldFromBuilder, createLogWriter, createTarBrTargetFiles, createZip, decryptJson, defineInitProvider, encryptJson, ensureInstallPackages, generateHotUpdaterPlugins, getAndroidSdkPath, getBundleSigningPublicKey, getCwd, getHotUpdaterEnvValue, getHotUpdaterInitInputEnv, getInitProviderEnvVars, getInitProviderTextPromptValues, getMissingInitInputs, getMissingInitProviderInputs, getPackageManager, getReactNativeMetadatas, getStorageFileByteSize, link, loadConfig, loadHotUpdaterPlugins, log, makeEnv, p, prepareBundleSigning, printAppSetup, printBanner, putStorageFile, readBundleSigningPublicKeyFile, readHotUpdaterEnv, readHotUpdaterInitEnv, readPackageUp, renderAppSetup, renderHotUpdaterPlugins, renderImportStatements, resolveHotUpdaterServerVersion, resolveInitProviderInput, resolveInitProviderInputs, resolvePackageVersion, shouldAutoSelectOnlyInitResource, stripAnsi, transformEnv, transformTemplate, writeHotUpdaterConfig, writeHotUpdaterPlugins, writeStorageFile, writeStorageResponseFile };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hot-updater/cli-tools",
-  "version": "1.0.0-rc.14",
+  "version": "1.0.0-rc.17",
   "type": "module",
   "engines": {
     "node": ">=20.19.0"
@@ -49,8 +49,8 @@
     "oxc-parser": "0.141.0",
     "oxc-transform": "0.141.0",
     "unconfig": "7.5.0",
-    "@hot-updater/core": "1.0.0-rc.14",
-    "@hot-updater/plugin-core": "1.0.0-rc.14"
+    "@hot-updater/core": "1.0.0-rc.15",
+    "@hot-updater/plugin-core": "1.0.0-rc.17"
   },
   "devDependencies": {
     "@clack/prompts": "1.7.0",
@@ -64,7 +64,7 @@
     "tar": "^7.5.16",
     "verkit": "0.4.0",
     "workspace-tools": "^0.41.7",
-    "@hot-updater/test-utils": "1.0.0-rc.14"
+    "@hot-updater/test-utils": "1.0.0-rc.17"
   },
   "inlinedDependencies": {
     "@babel/code-frame": "7.29.0",
@@ -174,7 +174,7 @@
       "7.1.0"
     ],
     "strip-final-newline": "4.0.0",
-    "tar": "7.5.1",
+    "tar": "7.5.16",
     "to-regex-range": "5.0.1",
     "unicorn-magic": [
       "0.1.0",