@hot-updater/protocol 1.2.0-rc.12 → 1.2.0-rc.14

package/dist/native-artifact.cjs

@@ -284,6 +284,8 @@ const VERSION_NAME = 16843292;
 const NAME = 16842755;
 const VALUE = 16842788;
 const RESOURCE = 16842789;
+const SCHEME = 16842791;
+const COMPONENTS = /* @__PURE__ */ new Set(["activity", "activity-alias"]);
 const attributeOf = (element, resourceId, name) => element.attributes.find((attribute) => attribute.resourceId !== 0 ? attribute.resourceId === resourceId : attribute.name === name)?.value ?? null;
 /** The values of a parsed manifest that import reads. */
 const readAndroidManifest = (manifest) => {
@@ -292,7 +294,29 @@ const readAndroidManifest = (manifest) => {
 	const versionCode = attributeOf(manifest, VERSION_CODE, "versionCode");
 	const application = manifest.children.find(({ name }) => name === "application");
 	const metaData = /* @__PURE__ */ new Map();
+	const launchers = [];
+	const urlSchemes = /* @__PURE__ */ new Map();
+	const stringAttribute = (element, id, name) => {
+		const value = attributeOf(element, id, name);
+		return value?.type === "string" ? value.value : null;
+	};
 	for (const element of application?.children ?? []) {
+		if (COMPONENTS.has(element.name)) {
+			const component = stringAttribute(element, NAME, "name");
+			if (component === null) continue;
+			for (const filter of element.children) {
+				if (filter.name !== "intent-filter") continue;
+				const named = (child) => filter.children.filter(({ name }) => name === child).map((part) => stringAttribute(part, NAME, "name"));
+				if (named("action").includes("android.intent.action.MAIN") && named("category").includes("android.intent.category.LAUNCHER") && !launchers.includes(component)) launchers.push(component);
+				for (const data of filter.children) {
+					if (data.name !== "data") continue;
+					const scheme = stringAttribute(data, SCHEME, "scheme");
+					if (scheme === null) continue;
+					urlSchemes.set(component, [...urlSchemes.get(component) ?? [], scheme]);
+				}
+			}
+			continue;
+		}
 		if (element.name !== "meta-data") continue;
 		const name = attributeOf(element, NAME, "name");
 		const value = attributeOf(element, VALUE, "value") ?? attributeOf(element, RESOURCE, "resource");
@@ -302,7 +326,9 @@ const readAndroidManifest = (manifest) => {
 		packageName: packageValue?.type === "string" ? packageValue.value : null,
 		versionName: attributeOf(manifest, VERSION_NAME, "versionName"),
 		versionCode: versionCode?.type === "int" ? versionCode.value : null,
-		metaData
+		metaData,
+		launchers,
+		urlSchemes
 	};
 };
 //#endregion
@@ -443,13 +469,30 @@ const ENTITIES = {
 const decodeEntities = (text) => text.replace(/&(#x[0-9a-f]+|#\d+|\w+);/giu, (whole, entity) => {
 	if (entity[0] === "#") {
 		const code = entity[1] === "x" || entity[1] === "X" ? Number.parseInt(entity.slice(2), 16) : Number.parseInt(entity.slice(1), 10);
+		if (code > 1114111) throw corrupt();
 		return String.fromCodePoint(code);
 	}
 	return ENTITIES[entity] ?? whole;
 });
-/** An XML property list, as some tools leave an app's Info.plist. */
+/**
+* `text` without each `open`, what follows it, and its `close`. A scan, because
+* a regular expression retries from every `open` that never closes, which on a
+* crafted file takes minutes.
+*/
+const withoutSpans = (text, open, close) => {
+	let kept = "";
+	let position = 0;
+	for (;;) {
+		const start = text.indexOf(open, position);
+		const end = start === -1 ? -1 : text.indexOf(close, start + open.length);
+		if (end === -1) return kept + text.slice(position);
+		kept += text.slice(position, start);
+		position = end + close.length;
+	}
+};
+/** An XML property list, as a provisioning profile holds one. */
 const parseXmlPlist = (text) => {
-	const tokens = text.replace(/<!--[\s\S]*?-->/gu, "").replace(/<\?[\s\S]*?\?>/gu, "").replace(/<!DOCTYPE[^>]*>/giu, "").split(/(<[^>]+>)/u);
+	const tokens = withoutSpans(withoutSpans(text, "<!--", "-->"), "<?", "?>").replace(/<!DOCTYPE[^<>]*>/giu, "").split(/(<[^<>]+>)/u);
 	let i = 0;
 	const nextTag = () => {
 		while (i < tokens.length) {
@@ -511,6 +554,91 @@ const parsePlist = (bytes) => {
 	return parseXmlPlist(new TextDecoder().decode(bytes));
 };
 //#endregion
+//#region src/nativeArtifact/sandbox.ts
+/**
+* What a sandbox build is, wherever it is built or read: `sandbox: true` on a
+* `nativeBuild` scheme adds a native layer to the app, which a normal build
+* never compiles.
+*/
+/**
+* The literal the sandbox layer's code holds, in `ios/HotUpdater/Sandbox` and
+* `android/src/sandbox`: reading an artifact's strings finds it. Its length
+* is its own among the lengths those reads keep.
+*/
+const SANDBOX_CODE_MARKER = "HOT_UPDATER_SANDBOX_NATIVE_LAYER";
+/** The Info.plist key an iOS sandbox build declares itself with. */
+const SANDBOX_INFO_PLIST_KEY = "HOT_UPDATER_SANDBOX";
+/** The `<meta-data>` an Android sandbox build declares itself with. */
+const SANDBOX_META_DATA = "com.hotupdater.SANDBOX";
+/** The activity that takes an Android sandbox build's launcher entry and links. */
+const SANDBOX_ACTIVITY = "com.hotupdater.HotUpdaterSandboxActivity";
+/** The `applicationIdSuffix` an Android sandbox build appends. */
+const SANDBOX_APPLICATION_ID_SUFFIX = ".sandbox";
+const SANDBOX_CHANNEL_PREFIX = "sandbox-";
+const SANDBOX_URL_SCHEME_PREFIX = "hu-sandbox-";
+/**
+* The channel a scheme's sandbox build registers on. `sandbox-*` is reserved:
+* it is how the registry tells a sandbox build, with no column of its own.
+*/
+const sandboxChannelOf = (scheme) => `${SANDBOX_CHANNEL_PREFIX}${scheme}`;
+/** Whether a channel is reserved for sandbox builds. */
+const isSandboxChannel = (channel) => channel.startsWith(SANDBOX_CHANNEL_PREFIX);
+/**
+* The URL scheme only a sandbox build registers, derived from the app's ID:
+* the app's own scheme would ask which app to open beside the store app.
+*/
+const sandboxUrlSchemeOf = (appId) => `${SANDBOX_URL_SCHEME_PREFIX}${appId.toLowerCase().replace(/[^a-z0-9]+/gu, "-")}`;
+/** Whether a URL scheme is one a sandbox build registers. */
+const isSandboxUrlScheme = (scheme) => scheme.toLowerCase().startsWith(SANDBOX_URL_SCHEME_PREFIX);
+/**
+* The link a preview QR holds. `appId` is the scheme's `bundleIdentifier` or
+* `packageName`: the ID before the Android sandbox's `.sandbox` suffix.
+*/
+const createPreviewLink = ({ appId, channel, fingerprintHash }) => {
+	require_uuid.assertCanonicalChannelName(channel);
+	return `${sandboxUrlSchemeOf(appId)}://hot-updater/preview?channel=${encodeURIComponent(channel)}&fingerprint=${encodeURIComponent(fingerprintHash)}`;
+};
+const PREVIEW_LINK = /^(hu-sandbox-[a-z0-9-]+):\/\/hot-updater\/preview\?([^#]*)$/iu;
+const MAX_FINGERPRINT_LENGTH = 256;
+/**
+* What a preview link says, or null for anything else: another shape, a
+* repeated or missing parameter, or a channel no release can target. Native
+* code parses it the same way before any JavaScript runs, in
+* HotUpdaterSandboxLink, and shares the vectors in test-utils'
+* `sandbox-preview-links.json`.
+*/
+const parsePreviewLink = (link) => {
+	const match = PREVIEW_LINK.exec(link);
+	if (match === null) return null;
+	const parameters = /* @__PURE__ */ new Map();
+	for (const parameter of match[2].split("&")) {
+		const separator = parameter.indexOf("=");
+		if (separator === -1) return null;
+		const name = parameter.slice(0, separator);
+		if (parameters.has(name)) return null;
+		let value;
+		try {
+			value = decodeURIComponent(parameter.slice(separator + 1));
+		} catch {
+			return null;
+		}
+		parameters.set(name, value);
+	}
+	const channel = parameters.get("channel");
+	const fingerprintHash = parameters.get("fingerprint");
+	if (channel === void 0 || fingerprintHash === void 0 || fingerprintHash.length === 0 || fingerprintHash.length > MAX_FINGERPRINT_LENGTH) return null;
+	try {
+		require_uuid.assertCanonicalChannelName(channel);
+	} catch {
+		return null;
+	}
+	return {
+		urlScheme: match[1].toLowerCase(),
+		channel,
+		fingerprintHash
+	};
+};
+//#endregion
 //#region src/nativeArtifact/strings.ts
 const view$1 = (bytes) => new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
 /** Bytes that are all ASCII, as text; null otherwise. */
@@ -656,7 +784,7 @@ const UINT32_MAX = 4294967295;
 const EOCD_SEARCH_LENGTH = 65557;
 /** How much compressed data one read takes. */
 const READ_CHUNK = 1048576;
-const MiB$1 = 1048576;
+const MiB$2 = 1048576;
 /**
 * What an archive may hold before it is refused as no artifact: an upload is
 * untrusted, so a crafted directory or entry (a zip bomb) stops here, not
@@ -664,10 +792,10 @@ const MiB$1 = 1048576;
 */
 const ZIP_LIMITS = {
 	/** The central directory. */
-	directoryBytes: 64 * MiB$1,
+	directoryBytes: 64 * MiB$2,
 	entries: 5e5,
 	/** An entry streamed out whole, such as the built-in bundle. */
-	entryBytes: 1024 * MiB$1
+	entryBytes: 1024 * MiB$2
 };
 const UNIX_HOST = 3;
 const S_IFMT = 61440;
@@ -775,7 +903,7 @@ const filterZipEntries = (entries, match) => {
 const assertReadable = (entry) => {
 	if (entry.symlink) throw new NativeArtifactError("UNREADABLE", `The archive's ${entry.name} is a symbolic link, not a file.`);
 };
-const tooLarge = (entry, limit) => new NativeArtifactError("UNREADABLE", `The archive's ${entry.name} is larger than ${Math.round(limit / MiB$1)} MB, more than any artifact's.`);
+const tooLarge = (entry, limit) => new NativeArtifactError("UNREADABLE", `The archive's ${entry.name} is larger than ${Math.round(limit / MiB$2)} MB, more than any artifact's.`);
 /** Where an entry's data starts, past its local header. */
 const dataOffsetOf = async (source, entry) => {
 	const local = view(await source.read(entry.localHeaderOffset, 30));
@@ -860,13 +988,13 @@ const readZipEntry = (source, entry, maxBytes, budget) => {
 };
 //#endregion
 //#region src/nativeArtifact/readNativeArtifact.ts
-const MiB = 1048576;
+const MiB$1 = 1048576;
 /** The most a manifest or an Info.plist holds. */
-const METADATA_BYTES = 16 * MiB;
+const METADATA_BYTES$1 = 16 * MiB$1;
 /** The most one dex file holds. */
-const DEX_BYTES = 256 * MiB;
+const DEX_BYTES = 256 * MiB$1;
 /** The most reading one artifact inflates, across every entry it reads. */
-const READ_BUDGET_BYTES = 2048 * MiB;
+const READ_BUDGET_BYTES$1 = 2048 * MiB$1;
 /** How long reading one artifact may take. */
 const DEFAULT_TIMEOUT_MS = 12e4;
 /** Where each kind of artifact packs its built-in bundle. */
@@ -879,7 +1007,11 @@ const nativeArtifactKindOf = (fileName) => {
 };
 const UUID_LENGTH = 36;
 const SHA256_HEX = /^[0-9a-f]{64}$/u;
-const LENGTHS = /* @__PURE__ */ new Set([UUID_LENGTH, 64]);
+const LENGTHS = /* @__PURE__ */ new Set([
+	UUID_LENGTH,
+	64,
+	32
+]);
 const unique = (values) => [...new Set(values)].sort();
 const candidatesOf = (strings) => {
 	const all = [...strings];
@@ -908,7 +1040,7 @@ const androidChannelOf = (value) => {
 const readAndroid = async (source, kind, entries, budget) => {
 	const manifestEntry = findZipEntry(entries, kind === "aab" ? "base/manifest/AndroidManifest.xml" : "AndroidManifest.xml");
 	if (manifestEntry === void 0) throw new NativeArtifactError("UNREADABLE", `The ${kind === "aab" ? ".aab has no base/manifest/AndroidManifest.xml" : ".apk has no AndroidManifest.xml"}.`);
-	const manifestBytes = await readZipEntry(source, manifestEntry, METADATA_BYTES, budget);
+	const manifestBytes = await readZipEntry(source, manifestEntry, METADATA_BYTES$1, budget);
 	const manifest = readAndroidManifest(kind === "aab" ? parseProtoManifest(manifestBytes) : parseBinaryManifest(manifestBytes));
 	const strings = [];
 	const dexes = filterZipEntries(entries, (name) => kind === "aab" ? /^base\/dex\/classes\d*\.dex$/u.test(name) : /^classes\d*\.dex$/u.test(name));
@@ -924,19 +1056,38 @@ const readAndroid = async (source, kind, entries, budget) => {
 		channel: androidChannelOf(manifest.metaData.get("com.hotupdater.CHANNEL")),
 		minBundleIdCandidates: minBundleIds,
 		fingerprintCandidates: fingerprints,
+		sandbox: {
+			code: strings.includes(SANDBOX_CODE_MARKER),
+			declared: manifest.metaData.has(SANDBOX_META_DATA)
+		},
+		entry: {
+			launchers: manifest.launchers,
+			sandboxUrlScheme: manifest.urlSchemes.get("com.hotupdater.HotUpdaterSandboxActivity")?.find(isSandboxUrlScheme) ?? null
+		},
 		builtInBundle: bundle === void 0 ? null : {
 			path: bundle.name,
 			byteSize: bundle.uncompressedSize
 		}
 	};
 };
+/** The sandbox URL scheme in an Info.plist's `CFBundleURLTypes`, or null. */
+const sandboxUrlSchemeIn = (info) => {
+	const types = info["CFBundleURLTypes"];
+	if (!Array.isArray(types)) return null;
+	for (const type of types) {
+		const schemes = type?.CFBundleURLSchemes;
+		if (!Array.isArray(schemes)) continue;
+		for (const scheme of schemes) if (typeof scheme === "string" && isSandboxUrlScheme(scheme)) return scheme;
+	}
+	return null;
+};
 const stringValue = (value) => typeof value === "string" && value !== "" ? value : null;
 const readIos = async (source, kind, entries, budget) => {
 	const infoPlist = kind === "ipa" ? /^Payload\/[^/]+\.app\/Info\.plist$/u : /^[^/]+\.app\/Info\.plist$/u;
 	const plistEntry = findZipEntry(entries, (name) => infoPlist.test(name));
 	if (plistEntry === void 0) throw new NativeArtifactError("UNREADABLE", kind === "ipa" ? "The .ipa has no Payload/<App>.app/Info.plist." : "The .app.zip has no <App>.app/Info.plist at its root.");
 	const appDirectory = plistEntry.name.slice(0, -10);
-	const plist = parsePlist(await readZipEntry(source, plistEntry, METADATA_BYTES, budget));
+	const plist = parsePlist(await readZipEntry(source, plistEntry, METADATA_BYTES$1, budget));
 	if (plist === null || typeof plist !== "object" || Array.isArray(plist)) throw new NativeArtifactError("UNREADABLE", "The app's Info.plist is not a dictionary.");
 	const info = plist;
 	const machO = (entry) => readMachOStrings((start, end) => readZipEntryRange(source, entry, start, end, budget), LENGTHS);
@@ -964,6 +1115,14 @@ const readIos = async (source, kind, entries, budget) => {
 		channel: channel === void 0 || channel === "" ? null : typeof channel === "string" ? channel : { unreadable: "HOT_UPDATER_CHANNEL is not a string" },
 		minBundleIdCandidates: minBundleIds,
 		fingerprintCandidates: fingerprints,
+		sandbox: {
+			code: strings.includes(SANDBOX_CODE_MARKER),
+			declared: info[SANDBOX_INFO_PLIST_KEY] !== void 0
+		},
+		entry: {
+			launchers: [],
+			sandboxUrlScheme: sandboxUrlSchemeIn(info)
+		},
 		builtInBundle: bundle === void 0 ? null : {
 			path: bundle.name,
 			byteSize: bundle.uncompressedSize
@@ -981,7 +1140,7 @@ const readNativeArtifact = async (source, fileName, { timeoutMs = DEFAULT_TIMEOU
 	const kind = nativeArtifactKindOf(fileName);
 	if (kind === null) throw new NativeArtifactError("UNSUPPORTED_FILE", `${fileName} is not an .ipa, .aab, .apk or a simulator .app. Import the artifact of a release build.`);
 	const budget = {
-		remaining: READ_BUDGET_BYTES,
+		remaining: READ_BUDGET_BYTES$1,
 		deadline: Date.now() + timeoutMs
 	};
 	const timed = {
@@ -1003,6 +1162,34 @@ const readNativeArtifact = async (source, fileName, { timeoutMs = DEFAULT_TIMEOU
 //#region src/nativeArtifact/checkNativeArtifact.ts
 /** The channel an app without a default channel reports. */
 const DEFAULT_CHANNEL = "production";
+/**
+* Why an artifact can't register on `channel`: the sandbox layer must be whole
+* or absent, and only a sandbox build registers on a `sandbox-*` channel.
+*/
+const sandboxArtifactProblem = ({ kind, platform, sandbox, entry }, channel) => {
+	const declaration = platform === "ios" ? "Info.plist key" : "manifest meta-data";
+	if (sandbox.code !== sandbox.declared) return {
+		code: "SANDBOX_MISMATCH",
+		message: sandbox.code ? `The .${kind} has the sandbox layer's code, but no sandbox ${declaration}.\nBuild it again with hot-updater native-build.` : `The .${kind} has a sandbox ${declaration}, but not the sandbox layer's code.\nBuild it again with hot-updater native-build.`
+	};
+	if (sandbox.code && entry.sandboxUrlScheme === null) return {
+		code: "SANDBOX_MISMATCH",
+		message: `The .${kind} is a sandbox build with no sandbox URL scheme, so no link can open it.\nBuild it again with hot-updater native-build.`
+	};
+	if (sandbox.code && platform === "android" && (entry.launchers.length !== 1 || entry.launchers[0] !== "com.hotupdater.HotUpdaterSandboxActivity")) return {
+		code: "SANDBOX_MISMATCH",
+		message: `The .${kind} is a sandbox build, but its launcher is ${entry.launchers.join(", ") || "missing"}.\nBuild it again with hot-updater native-build.`
+	};
+	if (sandbox.code && !isSandboxChannel(channel)) return {
+		code: "SANDBOX_MISMATCH",
+		message: `The .${kind} is a sandbox build, which can't register on channel ${channel}.\nUse a sandbox-<scheme> channel.`
+	};
+	if (!sandbox.code && isSandboxChannel(channel)) return {
+		code: "SANDBOX_MISMATCH",
+		message: `Channel ${channel} is reserved for sandbox builds, and the .${kind} isn't one.\nUse another channel, or build it with sandbox: true.`
+	};
+	return null;
+};
 const isUnreadable = (value) => typeof value === "object" && value !== null && "unreadable" in value;
 /**
 * Whether a read artifact can be imported as a native build, whose built-in
@@ -1053,6 +1240,8 @@ const checkNativeArtifact = (info, { updateStrategy, appIds = [], channel: chann
 			refuse("INVALID_SCOPE", `The app's channel ${JSON.stringify(channel)} is no channel a release can target: ${error instanceof Error ? error.message : String(error)}.`);
 		}
 	}
+	const sandboxProblem = sandboxArtifactProblem(info, channel);
+	if (sandboxProblem !== null) problems.push(sandboxProblem);
 	if (appIds.length > 0 && info.appId !== null && !appIds.includes(info.appId)) warnings.push({
 		code: "APP_ID_MISMATCH",
 		message: `The app is ${info.appId}, which no ${info.platform} scheme in nativeBuild names (${appIds.join(", ")}): check that it is this project's build.`
@@ -1088,11 +1277,158 @@ const alreadyImportedProblem = (minBundleId, nativeBuildId) => ({
 	message: nativeBuildId === null ? `The built-in bundle ${minBundleId} is already registered, as a bundle that is no native build's.` : `This build is already registered as native build ${nativeBuildId} (built-in bundle ${minBundleId}).`
 });
 //#endregion
+//#region src/nativeArtifact/iosInstall.ts
+const MiB = 1048576;
+/** The most an app's Info.plist or a provisioning profile holds here. */
+const METADATA_BYTES = 1 * MiB;
+/** The most reading what an install needs inflates, across every entry. */
+const READ_BUDGET_BYTES = 8 * MiB;
+/** How long reading what an install needs may take. */
+const READ_TIMEOUT_MS = 3e4;
+/** The extensions an app may carry, each with a profile to read. */
+const MAX_NESTED_PROFILES = 16;
+const APP_INFO_PLIST = /^Payload\/[^/]+\.app\/Info\.plist$/u;
+/**
+* What installs with the app and must list the device too: not a Watch app's
+* profile, which lists watches and installs on one.
+*/
+const NESTED_PROFILE = /^Payload\/[^/]+\.app\/(?:PlugIns|Extensions|AppClips)\/[^/]+\.(?:appex|app)\/embedded\.mobileprovision$/u;
+/** A device's UDID: 40 hex digits, or 8 and 16 joined by a hyphen. */
+const UDID = /^(?:[0-9a-f]{40}|[0-9a-f]{8}-[0-9a-f]{16})$/iu;
+/**
+* The form two UDIDs compare in, or null for text that isn't one. Apple writes
+* them in either case, and App Store Connect takes the device's own.
+*/
+const normalizeIosUdid = (value) => {
+	const trimmed = value.trim();
+	return UDID.test(trimmed) ? trimmed.toLowerCase() : null;
+};
+/**
+* The bytes from `<?xml` through `</plist>`, or null without both: a CMS
+* message, as a provisioning profile and a Profile Service answer are, holds
+* its plist as plain text among binary bytes.
+*/
+const sliceEmbeddedPlist = (bytes) => {
+	const text = new TextDecoder("latin1").decode(bytes);
+	const start = text.indexOf("<?xml");
+	if (start === -1) return null;
+	const end = text.indexOf("</plist>", start);
+	return end === -1 ? null : bytes.subarray(start, end + 8);
+};
+/**
+* The UDID in a Profile Service answer's body, or null when it has no one
+* well-formed UDID. It only finds the text: nothing here verifies the signature
+* around it, so nothing automated may trust the result.
+*/
+const readProfileServiceUdid = (body) => {
+	const plist = sliceEmbeddedPlist(body);
+	if (plist === null) return null;
+	const matches = [...new TextDecoder().decode(plist).matchAll(/<key>\s*UDID\s*<\/key>\s*<string>([^<]*)<\/string>/gu)];
+	if (matches.length !== 1) return null;
+	const udid = matches[0][1].trim();
+	return normalizeIosUdid(udid) === null ? null : udid;
+};
+const unreadable = (message) => new NativeArtifactError("UNREADABLE", message);
+const isDict = (value) => typeof value === "object" && value !== null && !Array.isArray(value) && !(value instanceof Uint8Array);
+const readProfile = (bytes, name) => {
+	const plistBytes = sliceEmbeddedPlist(bytes);
+	if (plistBytes === null) throw unreadable(`The archive's ${name} holds no property list.`);
+	const plist = parsePlist(plistBytes);
+	if (!isDict(plist)) throw unreadable(`The archive's ${name} is corrupt.`);
+	const listed = plist["ProvisionedDevices"];
+	if (listed !== void 0 && !Array.isArray(listed)) throw unreadable(`The archive's ${name} is corrupt.`);
+	const devices = listed?.map((device) => {
+		if (typeof device !== "string") throw unreadable(`The archive's ${name} is corrupt.`);
+		return device.trim().toLowerCase();
+	});
+	const expiration = plist["ExpirationDate"];
+	const expiresAtMs = typeof expiration === "string" ? Date.parse(expiration) : null;
+	if (expiresAtMs !== null && Number.isNaN(expiresAtMs)) throw unreadable(`The archive's ${name} is corrupt.`);
+	const entitlements = plist["Entitlements"];
+	const applicationId = isDict(entitlements) ? entitlements["application-identifier"] : void 0;
+	const bundleId = typeof applicationId === "string" ? applicationId.slice(applicationId.indexOf(".") + 1) : null;
+	return {
+		allDevices: plist["ProvisionsAllDevices"] === true,
+		devices: devices === void 0 ? null : new Set(devices),
+		getTaskAllow: isDict(entitlements) && entitlements["get-task-allow"] === true,
+		expiresAtMs,
+		bundleId: bundleId === null || bundleId.includes("*") ? null : bundleId
+	};
+};
+const distributionOf = (profile) => {
+	if (profile === null) return "store";
+	if (profile.allDevices) return "enterprise";
+	if (profile.devices === null) return "store";
+	return profile.getTaskAllow ? "development" : "ad-hoc";
+};
+/**
+* What an `.ipa` installs as, reading only its directory, its app's Info.plist
+* and its provisioning profiles: a few requests of a remote file, whatever its
+* size. The `.ipa` is untrusted, and each part is bounded before it is read.
+* Throws `NativeArtifactError` for one it can't read.
+*/
+const readIpaInstallInfo = async (source) => {
+	const entries = await readZipDirectory(source);
+	const infoPlists = filterZipEntries(entries, (name) => APP_INFO_PLIST.test(name));
+	const infoEntry = infoPlists[0];
+	if (infoEntry === void 0 || infoPlists.length > 1) throw unreadable("The .ipa has no one Payload/<App>.app/Info.plist.");
+	const budget = {
+		remaining: READ_BUDGET_BYTES,
+		deadline: Date.now() + READ_TIMEOUT_MS
+	};
+	const read = (entry) => readZipEntry(source, entry, METADATA_BYTES, budget);
+	const info = parsePlist(await read(infoEntry));
+	if (!isDict(info)) throw unreadable("The app's Info.plist is corrupt.");
+	const bundleId = info["CFBundleIdentifier"];
+	const bundleVersion = info["CFBundleVersion"];
+	if (typeof bundleId !== "string" || bundleId === "") throw unreadable("The app's Info.plist has no CFBundleIdentifier.");
+	if (typeof bundleVersion !== "string" || bundleVersion === "") throw unreadable("The app's Info.plist has no CFBundleVersion.");
+	const displayName = info["CFBundleDisplayName"];
+	const bundleName = info["CFBundleName"];
+	const title = typeof displayName === "string" && displayName !== "" ? displayName : typeof bundleName === "string" && bundleName !== "" ? bundleName : bundleId;
+	const appDirectory = infoEntry.name.slice(0, -10);
+	const profileEntry = findZipEntry(entries, `${appDirectory}embedded.mobileprovision`);
+	const nestedEntries = filterZipEntries(entries, (name) => name.startsWith(appDirectory) && NESTED_PROFILE.test(name));
+	if (nestedEntries.length > MAX_NESTED_PROFILES) throw unreadable(`The app has more than ${MAX_NESTED_PROFILES} extensions with profiles.`);
+	const profile = profileEntry === void 0 ? null : readProfile(await read(profileEntry), profileEntry.name);
+	const nested = [];
+	for (const entry of nestedEntries) nested.push(readProfile(await read(entry), entry.name));
+	const distribution = distributionOf(profile);
+	const profiles = profile === null ? nested : [profile, ...nested];
+	const listDevices = distribution === "ad-hoc" || distribution === "development";
+	const lists = profiles.flatMap(({ allDevices, devices }) => allDevices ? [] : [devices ?? /* @__PURE__ */ new Set()]);
+	const expiries = profiles.flatMap(({ expiresAtMs }) => expiresAtMs === null ? [] : [expiresAtMs]);
+	return {
+		bundleId,
+		bundleVersion,
+		title,
+		distribution,
+		devices: listDevices ? [...lists[0] ?? []].filter((udid) => lists.every((list) => list.has(udid))).sort() : [],
+		expiresAtMs: expiries.length === 0 ? null : Math.min(...expiries),
+		profileBundleIds: [.../* @__PURE__ */ new Set([bundleId, ...profiles.flatMap((item) => item.bundleId ?? [])])]
+	};
+};
+//#endregion
 exports.NativeArtifactError = NativeArtifactError;
+exports.SANDBOX_ACTIVITY = SANDBOX_ACTIVITY;
+exports.SANDBOX_APPLICATION_ID_SUFFIX = SANDBOX_APPLICATION_ID_SUFFIX;
+exports.SANDBOX_CODE_MARKER = SANDBOX_CODE_MARKER;
+exports.SANDBOX_INFO_PLIST_KEY = SANDBOX_INFO_PLIST_KEY;
+exports.SANDBOX_META_DATA = SANDBOX_META_DATA;
 exports.alreadyImportedProblem = alreadyImportedProblem;
 exports.blobSource = blobSource;
 exports.checkNativeArtifact = checkNativeArtifact;
+exports.createPreviewLink = createPreviewLink;
 exports.findZipEntry = findZipEntry;
+exports.isSandboxChannel = isSandboxChannel;
+exports.isSandboxUrlScheme = isSandboxUrlScheme;
+exports.normalizeIosUdid = normalizeIosUdid;
 exports.openZipEntry = openZipEntry;
+exports.parsePreviewLink = parsePreviewLink;
+exports.readIpaInstallInfo = readIpaInstallInfo;
 exports.readNativeArtifact = readNativeArtifact;
+exports.readProfileServiceUdid = readProfileServiceUdid;
 exports.readZipDirectory = readZipDirectory;
+exports.sandboxArtifactProblem = sandboxArtifactProblem;
+exports.sandboxChannelOf = sandboxChannelOf;
+exports.sandboxUrlSchemeOf = sandboxUrlSchemeOf;

package/dist/native-artifact.d.cts

@@ -22,7 +22,7 @@ declare class NativeArtifactError extends Error {
  * What can keep an artifact from being imported as a native build: the
  * codes `native-build import --json` reports.
  */
-type NativeArtifactProblemCode = "UNSUPPORTED_FILE" | "UNREADABLE" | "NO_BUILT_IN_BUNDLE" | "NO_MIN_BUNDLE_ID" | "AMBIGUOUS_MIN_BUNDLE_ID" | "NO_FINGERPRINT" | "AMBIGUOUS_FINGERPRINT" | "NO_APP_VERSION" | "INVALID_SCOPE" | "APP_ID_MISMATCH" | "ALREADY_IMPORTED";
+type NativeArtifactProblemCode = "UNSUPPORTED_FILE" | "UNREADABLE" | "NO_BUILT_IN_BUNDLE" | "NO_MIN_BUNDLE_ID" | "AMBIGUOUS_MIN_BUNDLE_ID" | "NO_FINGERPRINT" | "AMBIGUOUS_FINGERPRINT" | "NO_APP_VERSION" | "INVALID_SCOPE" | "SANDBOX_MISMATCH" | "APP_ID_MISMATCH" | "ALREADY_IMPORTED";
 //#endregion
 //#region src/nativeArtifact/readNativeArtifact.d.ts
 /**
@@ -63,6 +63,23 @@ interface NativeArtifactInfo {
    * with fingerprint.json compiles its fingerprint in as one.
    */
   readonly fingerprintCandidates: readonly string[];
+  /**
+   * The sandbox layer in the artifact: `code` when the app's code holds its
+   * literal, and `declared` when the Info.plist or the manifest says so. A
+   * sandbox build has both, and a normal build neither.
+   */
+  readonly sandbox: {
+    readonly code: boolean;
+    readonly declared: boolean;
+  };
+  /**
+   * How the app is entered, which a sandbox build changes: its launcher
+   * components (empty on iOS), and the sandbox URL scheme it registers.
+   */
+  readonly entry: {
+    readonly launchers: readonly string[];
+    readonly sandboxUrlScheme: string | null;
+  };
   /** The JavaScript bundle the build packed, the built-in bundle. */
   readonly builtInBundle: {
     readonly path: string;
@@ -116,6 +133,11 @@ type NativeArtifactCheck = ({
    */
   readonly warnings: readonly NativeArtifactProblem[];
 };
+/**
+ * Why an artifact can't register on `channel`: the sandbox layer must be whole
+ * or absent, and only a sandbox build registers on a `sandbox-*` channel.
+ */
+declare const sandboxArtifactProblem: ({ kind, platform, sandbox, entry }: NativeArtifactInfo, channel: string) => NativeArtifactProblem | null;
 /**
  * Whether a read artifact can be imported as a native build, whose built-in
  * bundle OTAs patch from, and what it registers as. It refuses an artifact
@@ -142,6 +164,54 @@ declare const checkNativeArtifact: (info: NativeArtifactInfo, { updateStrategy,
  */
 declare const alreadyImportedProblem: (minBundleId: string, nativeBuildId: string | null) => NativeArtifactProblem;
 //#endregion
+//#region src/nativeArtifact/iosInstall.d.ts
+/**
+ * How an `.ipa`'s profile lets it install: on the devices it lists (`ad-hoc`,
+ * `development`), on any device of the team's company (`enterprise`), or only
+ * through a store, as an App Store export's has no device list (`store`).
+ */
+type IpaDistribution = "ad-hoc" | "development" | "enterprise" | "store";
+/** What installing an `.ipa` over the air needs to know, read from the `.ipa`. */
+interface IpaInstallInfo {
+  /** `CFBundleIdentifier`. */
+  readonly bundleId: string;
+  /** `CFBundleVersion`. */
+  readonly bundleVersion: string;
+  /** The name an install shows: `CFBundleDisplayName`, or `CFBundleName`. */
+  readonly title: string;
+  readonly distribution: IpaDistribution;
+  /**
+   * The normalized UDIDs that every profile of the app lists, so a device
+   * here installs all of it. Empty for `enterprise` and `store`.
+   */
+  readonly devices: readonly string[];
+  /** When the first of the app's profiles expires, or null with none. */
+  readonly expiresAtMs: number | null;
+  /**
+   * The bundle ID of the app and of each extension with a profile of its own,
+   * the app's first: what signing a new `.ipa` needs a profile for.
+   */
+  readonly profileBundleIds: readonly string[];
+}
+/**
+ * The form two UDIDs compare in, or null for text that isn't one. Apple writes
+ * them in either case, and App Store Connect takes the device's own.
+ */
+declare const normalizeIosUdid: (value: string) => string | null;
+/**
+ * The UDID in a Profile Service answer's body, or null when it has no one
+ * well-formed UDID. It only finds the text: nothing here verifies the signature
+ * around it, so nothing automated may trust the result.
+ */
+declare const readProfileServiceUdid: (body: Uint8Array) => string | null;
+/**
+ * What an `.ipa` installs as, reading only its directory, its app's Info.plist
+ * and its provisioning profiles: a few requests of a remote file, whatever its
+ * size. The `.ipa` is untrusted, and each part is bounded before it is read.
+ * Throws `NativeArtifactError` for one it can't read.
+ */
+declare const readIpaInstallInfo: (source: ByteSource) => Promise<IpaInstallInfo>;
+//#endregion
 //#region src/nativeArtifact/zip.d.ts
 /** One file of a zip archive, from its central directory. */
 interface ZipEntry {
@@ -176,4 +246,59 @@ declare const openZipEntry: (source: ByteSource, entry: ZipEntry, { maxBytes }?:
   readonly maxBytes?: number;
 }) => Promise<ReadableStream<Uint8Array>>;
 //#endregion
-export { type ByteSource, type ImportableNativeBuild, type NativeArtifactCheck, NativeArtifactError, type NativeArtifactInfo, type NativeArtifactKind, type NativeArtifactProblem, type NativeArtifactProblemCode, type UnreadableValue, type ZipEntry, alreadyImportedProblem, blobSource, checkNativeArtifact, findZipEntry, openZipEntry, readNativeArtifact, readZipDirectory };
+//#region src/nativeArtifact/sandbox.d.ts
+/**
+ * The literal the sandbox layer's code holds, in `ios/HotUpdater/Sandbox` and
+ * `android/src/sandbox`: reading an artifact's strings finds it. Its length
+ * is its own among the lengths those reads keep.
+ */
+declare const SANDBOX_CODE_MARKER = "HOT_UPDATER_SANDBOX_NATIVE_LAYER";
+/** The Info.plist key an iOS sandbox build declares itself with. */
+declare const SANDBOX_INFO_PLIST_KEY = "HOT_UPDATER_SANDBOX";
+/** The `<meta-data>` an Android sandbox build declares itself with. */
+declare const SANDBOX_META_DATA = "com.hotupdater.SANDBOX";
+/** The activity that takes an Android sandbox build's launcher entry and links. */
+declare const SANDBOX_ACTIVITY = "com.hotupdater.HotUpdaterSandboxActivity";
+/** The `applicationIdSuffix` an Android sandbox build appends. */
+declare const SANDBOX_APPLICATION_ID_SUFFIX = ".sandbox";
+/**
+ * The channel a scheme's sandbox build registers on. `sandbox-*` is reserved:
+ * it is how the registry tells a sandbox build, with no column of its own.
+ */
+declare const sandboxChannelOf: (scheme: string) => string;
+/** Whether a channel is reserved for sandbox builds. */
+declare const isSandboxChannel: (channel: string) => boolean;
+/**
+ * The URL scheme only a sandbox build registers, derived from the app's ID:
+ * the app's own scheme would ask which app to open beside the store app.
+ */
+declare const sandboxUrlSchemeOf: (appId: string) => string;
+/** Whether a URL scheme is one a sandbox build registers. */
+declare const isSandboxUrlScheme: (scheme: string) => boolean;
+/** What a preview link asks a sandbox build to run. */
+interface PreviewLink {
+  /** The sandbox's URL scheme, in lower case. */
+  readonly urlScheme: string;
+  readonly channel: string;
+  /** The fingerprint the channel's bundles need; another build refuses them. */
+  readonly fingerprintHash: string;
+}
+/**
+ * The link a preview QR holds. `appId` is the scheme's `bundleIdentifier` or
+ * `packageName`: the ID before the Android sandbox's `.sandbox` suffix.
+ */
+declare const createPreviewLink: ({ appId, channel, fingerprintHash }: {
+  readonly appId: string;
+  readonly channel: string;
+  readonly fingerprintHash: string;
+}) => string;
+/**
+ * What a preview link says, or null for anything else: another shape, a
+ * repeated or missing parameter, or a channel no release can target. Native
+ * code parses it the same way before any JavaScript runs, in
+ * HotUpdaterSandboxLink, and shares the vectors in test-utils'
+ * `sandbox-preview-links.json`.
+ */
+declare const parsePreviewLink: (link: string) => PreviewLink | null;
+//#endregion
+export { type ByteSource, type ImportableNativeBuild, type IpaDistribution, type IpaInstallInfo, type NativeArtifactCheck, NativeArtifactError, type NativeArtifactInfo, type NativeArtifactKind, type NativeArtifactProblem, type NativeArtifactProblemCode, type PreviewLink, SANDBOX_ACTIVITY, SANDBOX_APPLICATION_ID_SUFFIX, SANDBOX_CODE_MARKER, SANDBOX_INFO_PLIST_KEY, SANDBOX_META_DATA, type UnreadableValue, type ZipEntry, alreadyImportedProblem, blobSource, checkNativeArtifact, createPreviewLink, findZipEntry, isSandboxChannel, isSandboxUrlScheme, normalizeIosUdid, openZipEntry, parsePreviewLink, readIpaInstallInfo, readNativeArtifact, readProfileServiceUdid, readZipDirectory, sandboxArtifactProblem, sandboxChannelOf, sandboxUrlSchemeOf };

package/dist/native-artifact.d.mts

@@ -22,7 +22,7 @@ declare class NativeArtifactError extends Error {
  * What can keep an artifact from being imported as a native build: the
  * codes `native-build import --json` reports.
  */
-type NativeArtifactProblemCode = "UNSUPPORTED_FILE" | "UNREADABLE" | "NO_BUILT_IN_BUNDLE" | "NO_MIN_BUNDLE_ID" | "AMBIGUOUS_MIN_BUNDLE_ID" | "NO_FINGERPRINT" | "AMBIGUOUS_FINGERPRINT" | "NO_APP_VERSION" | "INVALID_SCOPE" | "APP_ID_MISMATCH" | "ALREADY_IMPORTED";
+type NativeArtifactProblemCode = "UNSUPPORTED_FILE" | "UNREADABLE" | "NO_BUILT_IN_BUNDLE" | "NO_MIN_BUNDLE_ID" | "AMBIGUOUS_MIN_BUNDLE_ID" | "NO_FINGERPRINT" | "AMBIGUOUS_FINGERPRINT" | "NO_APP_VERSION" | "INVALID_SCOPE" | "SANDBOX_MISMATCH" | "APP_ID_MISMATCH" | "ALREADY_IMPORTED";
 //#endregion
 //#region src/nativeArtifact/readNativeArtifact.d.ts
 /**
@@ -63,6 +63,23 @@ interface NativeArtifactInfo {
    * with fingerprint.json compiles its fingerprint in as one.
    */
   readonly fingerprintCandidates: readonly string[];
+  /**
+   * The sandbox layer in the artifact: `code` when the app's code holds its
+   * literal, and `declared` when the Info.plist or the manifest says so. A
+   * sandbox build has both, and a normal build neither.
+   */
+  readonly sandbox: {
+    readonly code: boolean;
+    readonly declared: boolean;
+  };
+  /**
+   * How the app is entered, which a sandbox build changes: its launcher
+   * components (empty on iOS), and the sandbox URL scheme it registers.
+   */
+  readonly entry: {
+    readonly launchers: readonly string[];
+    readonly sandboxUrlScheme: string | null;
+  };
   /** The JavaScript bundle the build packed, the built-in bundle. */
   readonly builtInBundle: {
     readonly path: string;
@@ -116,6 +133,11 @@ type NativeArtifactCheck = ({
    */
   readonly warnings: readonly NativeArtifactProblem[];
 };
+/**
+ * Why an artifact can't register on `channel`: the sandbox layer must be whole
+ * or absent, and only a sandbox build registers on a `sandbox-*` channel.
+ */
+declare const sandboxArtifactProblem: ({ kind, platform, sandbox, entry }: NativeArtifactInfo, channel: string) => NativeArtifactProblem | null;
 /**
  * Whether a read artifact can be imported as a native build, whose built-in
  * bundle OTAs patch from, and what it registers as. It refuses an artifact
@@ -142,6 +164,54 @@ declare const checkNativeArtifact: (info: NativeArtifactInfo, { updateStrategy,
  */
 declare const alreadyImportedProblem: (minBundleId: string, nativeBuildId: string | null) => NativeArtifactProblem;
 //#endregion
+//#region src/nativeArtifact/iosInstall.d.ts
+/**
+ * How an `.ipa`'s profile lets it install: on the devices it lists (`ad-hoc`,
+ * `development`), on any device of the team's company (`enterprise`), or only
+ * through a store, as an App Store export's has no device list (`store`).
+ */
+type IpaDistribution = "ad-hoc" | "development" | "enterprise" | "store";
+/** What installing an `.ipa` over the air needs to know, read from the `.ipa`. */
+interface IpaInstallInfo {
+  /** `CFBundleIdentifier`. */
+  readonly bundleId: string;
+  /** `CFBundleVersion`. */
+  readonly bundleVersion: string;
+  /** The name an install shows: `CFBundleDisplayName`, or `CFBundleName`. */
+  readonly title: string;
+  readonly distribution: IpaDistribution;
+  /**
+   * The normalized UDIDs that every profile of the app lists, so a device
+   * here installs all of it. Empty for `enterprise` and `store`.
+   */
+  readonly devices: readonly string[];
+  /** When the first of the app's profiles expires, or null with none. */
+  readonly expiresAtMs: number | null;
+  /**
+   * The bundle ID of the app and of each extension with a profile of its own,
+   * the app's first: what signing a new `.ipa` needs a profile for.
+   */
+  readonly profileBundleIds: readonly string[];
+}
+/**
+ * The form two UDIDs compare in, or null for text that isn't one. Apple writes
+ * them in either case, and App Store Connect takes the device's own.
+ */
+declare const normalizeIosUdid: (value: string) => string | null;
+/**
+ * The UDID in a Profile Service answer's body, or null when it has no one
+ * well-formed UDID. It only finds the text: nothing here verifies the signature
+ * around it, so nothing automated may trust the result.
+ */
+declare const readProfileServiceUdid: (body: Uint8Array) => string | null;
+/**
+ * What an `.ipa` installs as, reading only its directory, its app's Info.plist
+ * and its provisioning profiles: a few requests of a remote file, whatever its
+ * size. The `.ipa` is untrusted, and each part is bounded before it is read.
+ * Throws `NativeArtifactError` for one it can't read.
+ */
+declare const readIpaInstallInfo: (source: ByteSource) => Promise<IpaInstallInfo>;
+//#endregion
 //#region src/nativeArtifact/zip.d.ts
 /** One file of a zip archive, from its central directory. */
 interface ZipEntry {
@@ -176,4 +246,59 @@ declare const openZipEntry: (source: ByteSource, entry: ZipEntry, { maxBytes }?:
   readonly maxBytes?: number;
 }) => Promise<ReadableStream<Uint8Array>>;
 //#endregion
-export { type ByteSource, type ImportableNativeBuild, type NativeArtifactCheck, NativeArtifactError, type NativeArtifactInfo, type NativeArtifactKind, type NativeArtifactProblem, type NativeArtifactProblemCode, type UnreadableValue, type ZipEntry, alreadyImportedProblem, blobSource, checkNativeArtifact, findZipEntry, openZipEntry, readNativeArtifact, readZipDirectory };
+//#region src/nativeArtifact/sandbox.d.ts
+/**
+ * The literal the sandbox layer's code holds, in `ios/HotUpdater/Sandbox` and
+ * `android/src/sandbox`: reading an artifact's strings finds it. Its length
+ * is its own among the lengths those reads keep.
+ */
+declare const SANDBOX_CODE_MARKER = "HOT_UPDATER_SANDBOX_NATIVE_LAYER";
+/** The Info.plist key an iOS sandbox build declares itself with. */
+declare const SANDBOX_INFO_PLIST_KEY = "HOT_UPDATER_SANDBOX";
+/** The `<meta-data>` an Android sandbox build declares itself with. */
+declare const SANDBOX_META_DATA = "com.hotupdater.SANDBOX";
+/** The activity that takes an Android sandbox build's launcher entry and links. */
+declare const SANDBOX_ACTIVITY = "com.hotupdater.HotUpdaterSandboxActivity";
+/** The `applicationIdSuffix` an Android sandbox build appends. */
+declare const SANDBOX_APPLICATION_ID_SUFFIX = ".sandbox";
+/**
+ * The channel a scheme's sandbox build registers on. `sandbox-*` is reserved:
+ * it is how the registry tells a sandbox build, with no column of its own.
+ */
+declare const sandboxChannelOf: (scheme: string) => string;
+/** Whether a channel is reserved for sandbox builds. */
+declare const isSandboxChannel: (channel: string) => boolean;
+/**
+ * The URL scheme only a sandbox build registers, derived from the app's ID:
+ * the app's own scheme would ask which app to open beside the store app.
+ */
+declare const sandboxUrlSchemeOf: (appId: string) => string;
+/** Whether a URL scheme is one a sandbox build registers. */
+declare const isSandboxUrlScheme: (scheme: string) => boolean;
+/** What a preview link asks a sandbox build to run. */
+interface PreviewLink {
+  /** The sandbox's URL scheme, in lower case. */
+  readonly urlScheme: string;
+  readonly channel: string;
+  /** The fingerprint the channel's bundles need; another build refuses them. */
+  readonly fingerprintHash: string;
+}
+/**
+ * The link a preview QR holds. `appId` is the scheme's `bundleIdentifier` or
+ * `packageName`: the ID before the Android sandbox's `.sandbox` suffix.
+ */
+declare const createPreviewLink: ({ appId, channel, fingerprintHash }: {
+  readonly appId: string;
+  readonly channel: string;
+  readonly fingerprintHash: string;
+}) => string;
+/**
+ * What a preview link says, or null for anything else: another shape, a
+ * repeated or missing parameter, or a channel no release can target. Native
+ * code parses it the same way before any JavaScript runs, in
+ * HotUpdaterSandboxLink, and shares the vectors in test-utils'
+ * `sandbox-preview-links.json`.
+ */
+declare const parsePreviewLink: (link: string) => PreviewLink | null;
+//#endregion
+export { type ByteSource, type ImportableNativeBuild, type IpaDistribution, type IpaInstallInfo, type NativeArtifactCheck, NativeArtifactError, type NativeArtifactInfo, type NativeArtifactKind, type NativeArtifactProblem, type NativeArtifactProblemCode, type PreviewLink, SANDBOX_ACTIVITY, SANDBOX_APPLICATION_ID_SUFFIX, SANDBOX_CODE_MARKER, SANDBOX_INFO_PLIST_KEY, SANDBOX_META_DATA, type UnreadableValue, type ZipEntry, alreadyImportedProblem, blobSource, checkNativeArtifact, createPreviewLink, findZipEntry, isSandboxChannel, isSandboxUrlScheme, normalizeIosUdid, openZipEntry, parsePreviewLink, readIpaInstallInfo, readNativeArtifact, readProfileServiceUdid, readZipDirectory, sandboxArtifactProblem, sandboxChannelOf, sandboxUrlSchemeOf };

package/dist/native-artifact.mjs

@@ -1,4 +1,4 @@
-import { l as canonicalizeAppVersion, n as isUUIDv7, o as encodeChannelKey } from "./uuid-kZvLA0Ly.mjs";
+import { l as canonicalizeAppVersion, n as isUUIDv7, o as encodeChannelKey, r as assertCanonicalChannelName } from "./uuid-kZvLA0Ly.mjs";
 //#region src/nativeArtifact/byteSource.ts
 /** A `Blob`, such as Node's `fs.openAsBlob`, read by slices. */
 const blobSource = (blob) => ({
@@ -283,6 +283,8 @@ const VERSION_NAME = 16843292;
 const NAME = 16842755;
 const VALUE = 16842788;
 const RESOURCE = 16842789;
+const SCHEME = 16842791;
+const COMPONENTS = /* @__PURE__ */ new Set(["activity", "activity-alias"]);
 const attributeOf = (element, resourceId, name) => element.attributes.find((attribute) => attribute.resourceId !== 0 ? attribute.resourceId === resourceId : attribute.name === name)?.value ?? null;
 /** The values of a parsed manifest that import reads. */
 const readAndroidManifest = (manifest) => {
@@ -291,7 +293,29 @@ const readAndroidManifest = (manifest) => {
 	const versionCode = attributeOf(manifest, VERSION_CODE, "versionCode");
 	const application = manifest.children.find(({ name }) => name === "application");
 	const metaData = /* @__PURE__ */ new Map();
+	const launchers = [];
+	const urlSchemes = /* @__PURE__ */ new Map();
+	const stringAttribute = (element, id, name) => {
+		const value = attributeOf(element, id, name);
+		return value?.type === "string" ? value.value : null;
+	};
 	for (const element of application?.children ?? []) {
+		if (COMPONENTS.has(element.name)) {
+			const component = stringAttribute(element, NAME, "name");
+			if (component === null) continue;
+			for (const filter of element.children) {
+				if (filter.name !== "intent-filter") continue;
+				const named = (child) => filter.children.filter(({ name }) => name === child).map((part) => stringAttribute(part, NAME, "name"));
+				if (named("action").includes("android.intent.action.MAIN") && named("category").includes("android.intent.category.LAUNCHER") && !launchers.includes(component)) launchers.push(component);
+				for (const data of filter.children) {
+					if (data.name !== "data") continue;
+					const scheme = stringAttribute(data, SCHEME, "scheme");
+					if (scheme === null) continue;
+					urlSchemes.set(component, [...urlSchemes.get(component) ?? [], scheme]);
+				}
+			}
+			continue;
+		}
 		if (element.name !== "meta-data") continue;
 		const name = attributeOf(element, NAME, "name");
 		const value = attributeOf(element, VALUE, "value") ?? attributeOf(element, RESOURCE, "resource");
@@ -301,7 +325,9 @@ const readAndroidManifest = (manifest) => {
 		packageName: packageValue?.type === "string" ? packageValue.value : null,
 		versionName: attributeOf(manifest, VERSION_NAME, "versionName"),
 		versionCode: versionCode?.type === "int" ? versionCode.value : null,
-		metaData
+		metaData,
+		launchers,
+		urlSchemes
 	};
 };
 //#endregion
@@ -442,13 +468,30 @@ const ENTITIES = {
 const decodeEntities = (text) => text.replace(/&(#x[0-9a-f]+|#\d+|\w+);/giu, (whole, entity) => {
 	if (entity[0] === "#") {
 		const code = entity[1] === "x" || entity[1] === "X" ? Number.parseInt(entity.slice(2), 16) : Number.parseInt(entity.slice(1), 10);
+		if (code > 1114111) throw corrupt();
 		return String.fromCodePoint(code);
 	}
 	return ENTITIES[entity] ?? whole;
 });
-/** An XML property list, as some tools leave an app's Info.plist. */
+/**
+* `text` without each `open`, what follows it, and its `close`. A scan, because
+* a regular expression retries from every `open` that never closes, which on a
+* crafted file takes minutes.
+*/
+const withoutSpans = (text, open, close) => {
+	let kept = "";
+	let position = 0;
+	for (;;) {
+		const start = text.indexOf(open, position);
+		const end = start === -1 ? -1 : text.indexOf(close, start + open.length);
+		if (end === -1) return kept + text.slice(position);
+		kept += text.slice(position, start);
+		position = end + close.length;
+	}
+};
+/** An XML property list, as a provisioning profile holds one. */
 const parseXmlPlist = (text) => {
-	const tokens = text.replace(/<!--[\s\S]*?-->/gu, "").replace(/<\?[\s\S]*?\?>/gu, "").replace(/<!DOCTYPE[^>]*>/giu, "").split(/(<[^>]+>)/u);
+	const tokens = withoutSpans(withoutSpans(text, "<!--", "-->"), "<?", "?>").replace(/<!DOCTYPE[^<>]*>/giu, "").split(/(<[^<>]+>)/u);
 	let i = 0;
 	const nextTag = () => {
 		while (i < tokens.length) {
@@ -510,6 +553,91 @@ const parsePlist = (bytes) => {
 	return parseXmlPlist(new TextDecoder().decode(bytes));
 };
 //#endregion
+//#region src/nativeArtifact/sandbox.ts
+/**
+* What a sandbox build is, wherever it is built or read: `sandbox: true` on a
+* `nativeBuild` scheme adds a native layer to the app, which a normal build
+* never compiles.
+*/
+/**
+* The literal the sandbox layer's code holds, in `ios/HotUpdater/Sandbox` and
+* `android/src/sandbox`: reading an artifact's strings finds it. Its length
+* is its own among the lengths those reads keep.
+*/
+const SANDBOX_CODE_MARKER = "HOT_UPDATER_SANDBOX_NATIVE_LAYER";
+/** The Info.plist key an iOS sandbox build declares itself with. */
+const SANDBOX_INFO_PLIST_KEY = "HOT_UPDATER_SANDBOX";
+/** The `<meta-data>` an Android sandbox build declares itself with. */
+const SANDBOX_META_DATA = "com.hotupdater.SANDBOX";
+/** The activity that takes an Android sandbox build's launcher entry and links. */
+const SANDBOX_ACTIVITY = "com.hotupdater.HotUpdaterSandboxActivity";
+/** The `applicationIdSuffix` an Android sandbox build appends. */
+const SANDBOX_APPLICATION_ID_SUFFIX = ".sandbox";
+const SANDBOX_CHANNEL_PREFIX = "sandbox-";
+const SANDBOX_URL_SCHEME_PREFIX = "hu-sandbox-";
+/**
+* The channel a scheme's sandbox build registers on. `sandbox-*` is reserved:
+* it is how the registry tells a sandbox build, with no column of its own.
+*/
+const sandboxChannelOf = (scheme) => `${SANDBOX_CHANNEL_PREFIX}${scheme}`;
+/** Whether a channel is reserved for sandbox builds. */
+const isSandboxChannel = (channel) => channel.startsWith(SANDBOX_CHANNEL_PREFIX);
+/**
+* The URL scheme only a sandbox build registers, derived from the app's ID:
+* the app's own scheme would ask which app to open beside the store app.
+*/
+const sandboxUrlSchemeOf = (appId) => `${SANDBOX_URL_SCHEME_PREFIX}${appId.toLowerCase().replace(/[^a-z0-9]+/gu, "-")}`;
+/** Whether a URL scheme is one a sandbox build registers. */
+const isSandboxUrlScheme = (scheme) => scheme.toLowerCase().startsWith(SANDBOX_URL_SCHEME_PREFIX);
+/**
+* The link a preview QR holds. `appId` is the scheme's `bundleIdentifier` or
+* `packageName`: the ID before the Android sandbox's `.sandbox` suffix.
+*/
+const createPreviewLink = ({ appId, channel, fingerprintHash }) => {
+	assertCanonicalChannelName(channel);
+	return `${sandboxUrlSchemeOf(appId)}://hot-updater/preview?channel=${encodeURIComponent(channel)}&fingerprint=${encodeURIComponent(fingerprintHash)}`;
+};
+const PREVIEW_LINK = /^(hu-sandbox-[a-z0-9-]+):\/\/hot-updater\/preview\?([^#]*)$/iu;
+const MAX_FINGERPRINT_LENGTH = 256;
+/**
+* What a preview link says, or null for anything else: another shape, a
+* repeated or missing parameter, or a channel no release can target. Native
+* code parses it the same way before any JavaScript runs, in
+* HotUpdaterSandboxLink, and shares the vectors in test-utils'
+* `sandbox-preview-links.json`.
+*/
+const parsePreviewLink = (link) => {
+	const match = PREVIEW_LINK.exec(link);
+	if (match === null) return null;
+	const parameters = /* @__PURE__ */ new Map();
+	for (const parameter of match[2].split("&")) {
+		const separator = parameter.indexOf("=");
+		if (separator === -1) return null;
+		const name = parameter.slice(0, separator);
+		if (parameters.has(name)) return null;
+		let value;
+		try {
+			value = decodeURIComponent(parameter.slice(separator + 1));
+		} catch {
+			return null;
+		}
+		parameters.set(name, value);
+	}
+	const channel = parameters.get("channel");
+	const fingerprintHash = parameters.get("fingerprint");
+	if (channel === void 0 || fingerprintHash === void 0 || fingerprintHash.length === 0 || fingerprintHash.length > MAX_FINGERPRINT_LENGTH) return null;
+	try {
+		assertCanonicalChannelName(channel);
+	} catch {
+		return null;
+	}
+	return {
+		urlScheme: match[1].toLowerCase(),
+		channel,
+		fingerprintHash
+	};
+};
+//#endregion
 //#region src/nativeArtifact/strings.ts
 const view$1 = (bytes) => new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
 /** Bytes that are all ASCII, as text; null otherwise. */
@@ -655,7 +783,7 @@ const UINT32_MAX = 4294967295;
 const EOCD_SEARCH_LENGTH = 65557;
 /** How much compressed data one read takes. */
 const READ_CHUNK = 1048576;
-const MiB$1 = 1048576;
+const MiB$2 = 1048576;
 /**
 * What an archive may hold before it is refused as no artifact: an upload is
 * untrusted, so a crafted directory or entry (a zip bomb) stops here, not
@@ -663,10 +791,10 @@ const MiB$1 = 1048576;
 */
 const ZIP_LIMITS = {
 	/** The central directory. */
-	directoryBytes: 64 * MiB$1,
+	directoryBytes: 64 * MiB$2,
 	entries: 5e5,
 	/** An entry streamed out whole, such as the built-in bundle. */
-	entryBytes: 1024 * MiB$1
+	entryBytes: 1024 * MiB$2
 };
 const UNIX_HOST = 3;
 const S_IFMT = 61440;
@@ -774,7 +902,7 @@ const filterZipEntries = (entries, match) => {
 const assertReadable = (entry) => {
 	if (entry.symlink) throw new NativeArtifactError("UNREADABLE", `The archive's ${entry.name} is a symbolic link, not a file.`);
 };
-const tooLarge = (entry, limit) => new NativeArtifactError("UNREADABLE", `The archive's ${entry.name} is larger than ${Math.round(limit / MiB$1)} MB, more than any artifact's.`);
+const tooLarge = (entry, limit) => new NativeArtifactError("UNREADABLE", `The archive's ${entry.name} is larger than ${Math.round(limit / MiB$2)} MB, more than any artifact's.`);
 /** Where an entry's data starts, past its local header. */
 const dataOffsetOf = async (source, entry) => {
 	const local = view(await source.read(entry.localHeaderOffset, 30));
@@ -859,13 +987,13 @@ const readZipEntry = (source, entry, maxBytes, budget) => {
 };
 //#endregion
 //#region src/nativeArtifact/readNativeArtifact.ts
-const MiB = 1048576;
+const MiB$1 = 1048576;
 /** The most a manifest or an Info.plist holds. */
-const METADATA_BYTES = 16 * MiB;
+const METADATA_BYTES$1 = 16 * MiB$1;
 /** The most one dex file holds. */
-const DEX_BYTES = 256 * MiB;
+const DEX_BYTES = 256 * MiB$1;
 /** The most reading one artifact inflates, across every entry it reads. */
-const READ_BUDGET_BYTES = 2048 * MiB;
+const READ_BUDGET_BYTES$1 = 2048 * MiB$1;
 /** How long reading one artifact may take. */
 const DEFAULT_TIMEOUT_MS = 12e4;
 /** Where each kind of artifact packs its built-in bundle. */
@@ -878,7 +1006,11 @@ const nativeArtifactKindOf = (fileName) => {
 };
 const UUID_LENGTH = 36;
 const SHA256_HEX = /^[0-9a-f]{64}$/u;
-const LENGTHS = /* @__PURE__ */ new Set([UUID_LENGTH, 64]);
+const LENGTHS = /* @__PURE__ */ new Set([
+	UUID_LENGTH,
+	64,
+	32
+]);
 const unique = (values) => [...new Set(values)].sort();
 const candidatesOf = (strings) => {
 	const all = [...strings];
@@ -907,7 +1039,7 @@ const androidChannelOf = (value) => {
 const readAndroid = async (source, kind, entries, budget) => {
 	const manifestEntry = findZipEntry(entries, kind === "aab" ? "base/manifest/AndroidManifest.xml" : "AndroidManifest.xml");
 	if (manifestEntry === void 0) throw new NativeArtifactError("UNREADABLE", `The ${kind === "aab" ? ".aab has no base/manifest/AndroidManifest.xml" : ".apk has no AndroidManifest.xml"}.`);
-	const manifestBytes = await readZipEntry(source, manifestEntry, METADATA_BYTES, budget);
+	const manifestBytes = await readZipEntry(source, manifestEntry, METADATA_BYTES$1, budget);
 	const manifest = readAndroidManifest(kind === "aab" ? parseProtoManifest(manifestBytes) : parseBinaryManifest(manifestBytes));
 	const strings = [];
 	const dexes = filterZipEntries(entries, (name) => kind === "aab" ? /^base\/dex\/classes\d*\.dex$/u.test(name) : /^classes\d*\.dex$/u.test(name));
@@ -923,19 +1055,38 @@ const readAndroid = async (source, kind, entries, budget) => {
 		channel: androidChannelOf(manifest.metaData.get("com.hotupdater.CHANNEL")),
 		minBundleIdCandidates: minBundleIds,
 		fingerprintCandidates: fingerprints,
+		sandbox: {
+			code: strings.includes(SANDBOX_CODE_MARKER),
+			declared: manifest.metaData.has(SANDBOX_META_DATA)
+		},
+		entry: {
+			launchers: manifest.launchers,
+			sandboxUrlScheme: manifest.urlSchemes.get("com.hotupdater.HotUpdaterSandboxActivity")?.find(isSandboxUrlScheme) ?? null
+		},
 		builtInBundle: bundle === void 0 ? null : {
 			path: bundle.name,
 			byteSize: bundle.uncompressedSize
 		}
 	};
 };
+/** The sandbox URL scheme in an Info.plist's `CFBundleURLTypes`, or null. */
+const sandboxUrlSchemeIn = (info) => {
+	const types = info["CFBundleURLTypes"];
+	if (!Array.isArray(types)) return null;
+	for (const type of types) {
+		const schemes = type?.CFBundleURLSchemes;
+		if (!Array.isArray(schemes)) continue;
+		for (const scheme of schemes) if (typeof scheme === "string" && isSandboxUrlScheme(scheme)) return scheme;
+	}
+	return null;
+};
 const stringValue = (value) => typeof value === "string" && value !== "" ? value : null;
 const readIos = async (source, kind, entries, budget) => {
 	const infoPlist = kind === "ipa" ? /^Payload\/[^/]+\.app\/Info\.plist$/u : /^[^/]+\.app\/Info\.plist$/u;
 	const plistEntry = findZipEntry(entries, (name) => infoPlist.test(name));
 	if (plistEntry === void 0) throw new NativeArtifactError("UNREADABLE", kind === "ipa" ? "The .ipa has no Payload/<App>.app/Info.plist." : "The .app.zip has no <App>.app/Info.plist at its root.");
 	const appDirectory = plistEntry.name.slice(0, -10);
-	const plist = parsePlist(await readZipEntry(source, plistEntry, METADATA_BYTES, budget));
+	const plist = parsePlist(await readZipEntry(source, plistEntry, METADATA_BYTES$1, budget));
 	if (plist === null || typeof plist !== "object" || Array.isArray(plist)) throw new NativeArtifactError("UNREADABLE", "The app's Info.plist is not a dictionary.");
 	const info = plist;
 	const machO = (entry) => readMachOStrings((start, end) => readZipEntryRange(source, entry, start, end, budget), LENGTHS);
@@ -963,6 +1114,14 @@ const readIos = async (source, kind, entries, budget) => {
 		channel: channel === void 0 || channel === "" ? null : typeof channel === "string" ? channel : { unreadable: "HOT_UPDATER_CHANNEL is not a string" },
 		minBundleIdCandidates: minBundleIds,
 		fingerprintCandidates: fingerprints,
+		sandbox: {
+			code: strings.includes(SANDBOX_CODE_MARKER),
+			declared: info[SANDBOX_INFO_PLIST_KEY] !== void 0
+		},
+		entry: {
+			launchers: [],
+			sandboxUrlScheme: sandboxUrlSchemeIn(info)
+		},
 		builtInBundle: bundle === void 0 ? null : {
 			path: bundle.name,
 			byteSize: bundle.uncompressedSize
@@ -980,7 +1139,7 @@ const readNativeArtifact = async (source, fileName, { timeoutMs = DEFAULT_TIMEOU
 	const kind = nativeArtifactKindOf(fileName);
 	if (kind === null) throw new NativeArtifactError("UNSUPPORTED_FILE", `${fileName} is not an .ipa, .aab, .apk or a simulator .app. Import the artifact of a release build.`);
 	const budget = {
-		remaining: READ_BUDGET_BYTES,
+		remaining: READ_BUDGET_BYTES$1,
 		deadline: Date.now() + timeoutMs
 	};
 	const timed = {
@@ -1002,6 +1161,34 @@ const readNativeArtifact = async (source, fileName, { timeoutMs = DEFAULT_TIMEOU
 //#region src/nativeArtifact/checkNativeArtifact.ts
 /** The channel an app without a default channel reports. */
 const DEFAULT_CHANNEL = "production";
+/**
+* Why an artifact can't register on `channel`: the sandbox layer must be whole
+* or absent, and only a sandbox build registers on a `sandbox-*` channel.
+*/
+const sandboxArtifactProblem = ({ kind, platform, sandbox, entry }, channel) => {
+	const declaration = platform === "ios" ? "Info.plist key" : "manifest meta-data";
+	if (sandbox.code !== sandbox.declared) return {
+		code: "SANDBOX_MISMATCH",
+		message: sandbox.code ? `The .${kind} has the sandbox layer's code, but no sandbox ${declaration}.\nBuild it again with hot-updater native-build.` : `The .${kind} has a sandbox ${declaration}, but not the sandbox layer's code.\nBuild it again with hot-updater native-build.`
+	};
+	if (sandbox.code && entry.sandboxUrlScheme === null) return {
+		code: "SANDBOX_MISMATCH",
+		message: `The .${kind} is a sandbox build with no sandbox URL scheme, so no link can open it.\nBuild it again with hot-updater native-build.`
+	};
+	if (sandbox.code && platform === "android" && (entry.launchers.length !== 1 || entry.launchers[0] !== "com.hotupdater.HotUpdaterSandboxActivity")) return {
+		code: "SANDBOX_MISMATCH",
+		message: `The .${kind} is a sandbox build, but its launcher is ${entry.launchers.join(", ") || "missing"}.\nBuild it again with hot-updater native-build.`
+	};
+	if (sandbox.code && !isSandboxChannel(channel)) return {
+		code: "SANDBOX_MISMATCH",
+		message: `The .${kind} is a sandbox build, which can't register on channel ${channel}.\nUse a sandbox-<scheme> channel.`
+	};
+	if (!sandbox.code && isSandboxChannel(channel)) return {
+		code: "SANDBOX_MISMATCH",
+		message: `Channel ${channel} is reserved for sandbox builds, and the .${kind} isn't one.\nUse another channel, or build it with sandbox: true.`
+	};
+	return null;
+};
 const isUnreadable = (value) => typeof value === "object" && value !== null && "unreadable" in value;
 /**
 * Whether a read artifact can be imported as a native build, whose built-in
@@ -1052,6 +1239,8 @@ const checkNativeArtifact = (info, { updateStrategy, appIds = [], channel: chann
 			refuse("INVALID_SCOPE", `The app's channel ${JSON.stringify(channel)} is no channel a release can target: ${error instanceof Error ? error.message : String(error)}.`);
 		}
 	}
+	const sandboxProblem = sandboxArtifactProblem(info, channel);
+	if (sandboxProblem !== null) problems.push(sandboxProblem);
 	if (appIds.length > 0 && info.appId !== null && !appIds.includes(info.appId)) warnings.push({
 		code: "APP_ID_MISMATCH",
 		message: `The app is ${info.appId}, which no ${info.platform} scheme in nativeBuild names (${appIds.join(", ")}): check that it is this project's build.`
@@ -1087,4 +1276,136 @@ const alreadyImportedProblem = (minBundleId, nativeBuildId) => ({
 	message: nativeBuildId === null ? `The built-in bundle ${minBundleId} is already registered, as a bundle that is no native build's.` : `This build is already registered as native build ${nativeBuildId} (built-in bundle ${minBundleId}).`
 });
 //#endregion
-export { NativeArtifactError, alreadyImportedProblem, blobSource, checkNativeArtifact, findZipEntry, openZipEntry, readNativeArtifact, readZipDirectory };
+//#region src/nativeArtifact/iosInstall.ts
+const MiB = 1048576;
+/** The most an app's Info.plist or a provisioning profile holds here. */
+const METADATA_BYTES = 1 * MiB;
+/** The most reading what an install needs inflates, across every entry. */
+const READ_BUDGET_BYTES = 8 * MiB;
+/** How long reading what an install needs may take. */
+const READ_TIMEOUT_MS = 3e4;
+/** The extensions an app may carry, each with a profile to read. */
+const MAX_NESTED_PROFILES = 16;
+const APP_INFO_PLIST = /^Payload\/[^/]+\.app\/Info\.plist$/u;
+/**
+* What installs with the app and must list the device too: not a Watch app's
+* profile, which lists watches and installs on one.
+*/
+const NESTED_PROFILE = /^Payload\/[^/]+\.app\/(?:PlugIns|Extensions|AppClips)\/[^/]+\.(?:appex|app)\/embedded\.mobileprovision$/u;
+/** A device's UDID: 40 hex digits, or 8 and 16 joined by a hyphen. */
+const UDID = /^(?:[0-9a-f]{40}|[0-9a-f]{8}-[0-9a-f]{16})$/iu;
+/**
+* The form two UDIDs compare in, or null for text that isn't one. Apple writes
+* them in either case, and App Store Connect takes the device's own.
+*/
+const normalizeIosUdid = (value) => {
+	const trimmed = value.trim();
+	return UDID.test(trimmed) ? trimmed.toLowerCase() : null;
+};
+/**
+* The bytes from `<?xml` through `</plist>`, or null without both: a CMS
+* message, as a provisioning profile and a Profile Service answer are, holds
+* its plist as plain text among binary bytes.
+*/
+const sliceEmbeddedPlist = (bytes) => {
+	const text = new TextDecoder("latin1").decode(bytes);
+	const start = text.indexOf("<?xml");
+	if (start === -1) return null;
+	const end = text.indexOf("</plist>", start);
+	return end === -1 ? null : bytes.subarray(start, end + 8);
+};
+/**
+* The UDID in a Profile Service answer's body, or null when it has no one
+* well-formed UDID. It only finds the text: nothing here verifies the signature
+* around it, so nothing automated may trust the result.
+*/
+const readProfileServiceUdid = (body) => {
+	const plist = sliceEmbeddedPlist(body);
+	if (plist === null) return null;
+	const matches = [...new TextDecoder().decode(plist).matchAll(/<key>\s*UDID\s*<\/key>\s*<string>([^<]*)<\/string>/gu)];
+	if (matches.length !== 1) return null;
+	const udid = matches[0][1].trim();
+	return normalizeIosUdid(udid) === null ? null : udid;
+};
+const unreadable = (message) => new NativeArtifactError("UNREADABLE", message);
+const isDict = (value) => typeof value === "object" && value !== null && !Array.isArray(value) && !(value instanceof Uint8Array);
+const readProfile = (bytes, name) => {
+	const plistBytes = sliceEmbeddedPlist(bytes);
+	if (plistBytes === null) throw unreadable(`The archive's ${name} holds no property list.`);
+	const plist = parsePlist(plistBytes);
+	if (!isDict(plist)) throw unreadable(`The archive's ${name} is corrupt.`);
+	const listed = plist["ProvisionedDevices"];
+	if (listed !== void 0 && !Array.isArray(listed)) throw unreadable(`The archive's ${name} is corrupt.`);
+	const devices = listed?.map((device) => {
+		if (typeof device !== "string") throw unreadable(`The archive's ${name} is corrupt.`);
+		return device.trim().toLowerCase();
+	});
+	const expiration = plist["ExpirationDate"];
+	const expiresAtMs = typeof expiration === "string" ? Date.parse(expiration) : null;
+	if (expiresAtMs !== null && Number.isNaN(expiresAtMs)) throw unreadable(`The archive's ${name} is corrupt.`);
+	const entitlements = plist["Entitlements"];
+	const applicationId = isDict(entitlements) ? entitlements["application-identifier"] : void 0;
+	const bundleId = typeof applicationId === "string" ? applicationId.slice(applicationId.indexOf(".") + 1) : null;
+	return {
+		allDevices: plist["ProvisionsAllDevices"] === true,
+		devices: devices === void 0 ? null : new Set(devices),
+		getTaskAllow: isDict(entitlements) && entitlements["get-task-allow"] === true,
+		expiresAtMs,
+		bundleId: bundleId === null || bundleId.includes("*") ? null : bundleId
+	};
+};
+const distributionOf = (profile) => {
+	if (profile === null) return "store";
+	if (profile.allDevices) return "enterprise";
+	if (profile.devices === null) return "store";
+	return profile.getTaskAllow ? "development" : "ad-hoc";
+};
+/**
+* What an `.ipa` installs as, reading only its directory, its app's Info.plist
+* and its provisioning profiles: a few requests of a remote file, whatever its
+* size. The `.ipa` is untrusted, and each part is bounded before it is read.
+* Throws `NativeArtifactError` for one it can't read.
+*/
+const readIpaInstallInfo = async (source) => {
+	const entries = await readZipDirectory(source);
+	const infoPlists = filterZipEntries(entries, (name) => APP_INFO_PLIST.test(name));
+	const infoEntry = infoPlists[0];
+	if (infoEntry === void 0 || infoPlists.length > 1) throw unreadable("The .ipa has no one Payload/<App>.app/Info.plist.");
+	const budget = {
+		remaining: READ_BUDGET_BYTES,
+		deadline: Date.now() + READ_TIMEOUT_MS
+	};
+	const read = (entry) => readZipEntry(source, entry, METADATA_BYTES, budget);
+	const info = parsePlist(await read(infoEntry));
+	if (!isDict(info)) throw unreadable("The app's Info.plist is corrupt.");
+	const bundleId = info["CFBundleIdentifier"];
+	const bundleVersion = info["CFBundleVersion"];
+	if (typeof bundleId !== "string" || bundleId === "") throw unreadable("The app's Info.plist has no CFBundleIdentifier.");
+	if (typeof bundleVersion !== "string" || bundleVersion === "") throw unreadable("The app's Info.plist has no CFBundleVersion.");
+	const displayName = info["CFBundleDisplayName"];
+	const bundleName = info["CFBundleName"];
+	const title = typeof displayName === "string" && displayName !== "" ? displayName : typeof bundleName === "string" && bundleName !== "" ? bundleName : bundleId;
+	const appDirectory = infoEntry.name.slice(0, -10);
+	const profileEntry = findZipEntry(entries, `${appDirectory}embedded.mobileprovision`);
+	const nestedEntries = filterZipEntries(entries, (name) => name.startsWith(appDirectory) && NESTED_PROFILE.test(name));
+	if (nestedEntries.length > MAX_NESTED_PROFILES) throw unreadable(`The app has more than ${MAX_NESTED_PROFILES} extensions with profiles.`);
+	const profile = profileEntry === void 0 ? null : readProfile(await read(profileEntry), profileEntry.name);
+	const nested = [];
+	for (const entry of nestedEntries) nested.push(readProfile(await read(entry), entry.name));
+	const distribution = distributionOf(profile);
+	const profiles = profile === null ? nested : [profile, ...nested];
+	const listDevices = distribution === "ad-hoc" || distribution === "development";
+	const lists = profiles.flatMap(({ allDevices, devices }) => allDevices ? [] : [devices ?? /* @__PURE__ */ new Set()]);
+	const expiries = profiles.flatMap(({ expiresAtMs }) => expiresAtMs === null ? [] : [expiresAtMs]);
+	return {
+		bundleId,
+		bundleVersion,
+		title,
+		distribution,
+		devices: listDevices ? [...lists[0] ?? []].filter((udid) => lists.every((list) => list.has(udid))).sort() : [],
+		expiresAtMs: expiries.length === 0 ? null : Math.min(...expiries),
+		profileBundleIds: [.../* @__PURE__ */ new Set([bundleId, ...profiles.flatMap((item) => item.bundleId ?? [])])]
+	};
+};
+//#endregion
+export { NativeArtifactError, SANDBOX_ACTIVITY, SANDBOX_APPLICATION_ID_SUFFIX, SANDBOX_CODE_MARKER, SANDBOX_INFO_PLIST_KEY, SANDBOX_META_DATA, alreadyImportedProblem, blobSource, checkNativeArtifact, createPreviewLink, findZipEntry, isSandboxChannel, isSandboxUrlScheme, normalizeIosUdid, openZipEntry, parsePreviewLink, readIpaInstallInfo, readNativeArtifact, readProfileServiceUdid, readZipDirectory, sandboxArtifactProblem, sandboxChannelOf, sandboxUrlSchemeOf };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hot-updater/protocol",
-  "version": "1.2.0-rc.12",
+  "version": "1.2.0-rc.14",
   "type": "module",
   "description": "The data formats and pure computations that Hot Updater's app and server share",
   "sideEffects": false,