@lowdefy/shell 0.0.0-experimental-20261019052246

package/runtimeVersion.js

@@ -0,0 +1,105 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+const crypto = require('node:crypto');
+
+function isPositiveInteger(value) {
+  return Number.isInteger(value) && value > 0;
+}
+
+function isObject(value) {
+  return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+
+// JSON with every object's keys sorted, at every depth, so options that differ only in key order
+// give the same text.
+function canonicalJson(value) {
+  if (Array.isArray(value)) {
+    return `[${value.map(canonicalJson).join(',')}]`;
+  }
+  if (isObject(value)) {
+    const entries = Object.keys(value)
+      .sort()
+      .map((key) => `${JSON.stringify(key)}:${canonicalJson(value[key])}`);
+    return `{${entries.join(',')}}`;
+  }
+  return JSON.stringify(value);
+}
+
+// A short hash of the shell plugins a shell carries, the same whatever order they are listed in.
+// Each plugin is keyed on name@version and its options: config plugins bake the options into the
+// native project, so an option change is a native change. No options and {} hash the same.
+function hashPlugins(plugins) {
+  const keys = plugins.map((plugin) => {
+    if (typeof plugin?.name !== 'string' || typeof plugin?.version !== 'string') {
+      throw new Error(
+        `Each shell plugin should be { name, version } with string values. Received ${JSON.stringify(
+          plugin
+        )}.`
+      );
+    }
+    if (plugin.options !== undefined && !isObject(plugin.options)) {
+      throw new Error(
+        `Shell plugin "${plugin.name}" options should be an object. Received ${JSON.stringify(
+          plugin.options
+        )}.`
+      );
+    }
+    return `${plugin.name}@${plugin.version} ${canonicalJson(plugin.options ?? {})}`;
+  });
+  return crypto.createHash('sha256').update(keys.sort().join('\n')).digest('hex').slice(0, 8);
+}
+
+/**
+ * The runtime version of a shell build: `<nativeVersion>-<profile>`, and `-<plugins hash>` when the
+ * shell carries shell plugins. An over-the-air update reaches only binaries with the same runtime
+ * version, so it changes only with the shell's native code (`nativeVersion` in package.json, bumped
+ * on purpose and kept honest by scripts/checkNativeVersion.mjs), its capability profile and its
+ * plugins. Shell identity (name, ids, scheme, icon, colour, URLs) is not part of it, so every shell
+ * on one nativeVersion and profile shares a runtime version.
+ *
+ * Pure, with no Expo import, so `lowdefy mobile` computes the same value app.config.ts sets from the copied
+ * shell's runtimeVersion.js and package.json `nativeVersion`.
+ *
+ * @param {Object} params
+ * @param {number} params.nativeVersion The shell package's nativeVersion.
+ * @param {string} params.profile The shell's capability profile.
+ * @param {{ name: string, version: string, options?: Object }[]} [params.plugins] The shell plugins
+ *   it carries (shell.json `plugins`).
+ * @returns {string}
+ */
+function getRuntimeVersion({ nativeVersion, profile, plugins = [] }) {
+  if (!isPositiveInteger(nativeVersion)) {
+    throw new Error(
+      `nativeVersion should be a positive integer. Received ${JSON.stringify(nativeVersion)}.`
+    );
+  }
+  if (typeof profile !== 'string' || profile.length === 0) {
+    throw new Error(`profile should be a string. Received ${JSON.stringify(profile)}.`);
+  }
+  if (!Array.isArray(plugins)) {
+    throw new Error(`plugins should be an array. Received ${JSON.stringify(plugins)}.`);
+  }
+  if (plugins.length === 0) {
+    return `${nativeVersion}-${profile}`;
+  }
+  return `${nativeVersion}-${profile}-${hashPlugins(plugins)}`;
+}
+
+// `require('./runtimeVersion.js')` is the function, and `.getRuntimeVersion` names it too, so
+// `lowdefy mobile` can load it from the copied shell either way.
+module.exports = getRuntimeVersion;
+module.exports.getRuntimeVersion = getRuntimeVersion;

package/scripts/checkReleaseBundle.mjs

@@ -0,0 +1,358 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+/*
+  The release check: a shell carries only its capability profile's native modules (profiles.js),
+  and a customer shell none of Lowdefy Dev's developer features, in its JavaScript or in its native
+  projects. A shell's release build runs it before a store build.
+
+  For each release profile (basic, field, field-nfc, field-tracking; --profile names one) and each
+  platform, with LOWDEFY_SHELL_VARIANT=release and the shell config LOWDEFY_SHELL_CONFIG names
+  (Lowdefy Dev's shell.dev.json without it) set to that profile:
+
+  1. Bundle: exports the JavaScript bundle and fails when any file of it holds the dev-tab client's
+     marker (src/dev/tab/devClientMarker.js) or the native module name of a module the profile
+     leaves out (getExclusions in shellVariant.js).
+  2. Prebuild: runs `expo prebuild` in a copy of the shell and fails when
+     - Expo autolinking, run with the exclusions the generated Podfile and settings.gradle pass it,
+       still links a module the profile leaves out; or
+     - the native project asks for a permission only a left-out module needs
+       (NSCameraUsageDescription and android.permission.CAMERA without the camera,
+       NSMotionUsageDescription in any release shell).
+
+  With --control it first runs both on the dev variant (profile `dev`) and fails when the marker,
+  the module names or the modules any release profile leaves out are missing there, which shows the
+  check can see them.
+
+    node scripts/checkReleaseBundle.mjs [--platform ios|android] [--profile <name>] [--control]
+*/
+
+import { execFileSync } from 'node:child_process';
+import fs from 'node:fs';
+import { createRequire } from 'node:module';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const shellRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const require = createRequire(import.meta.url);
+const { RELEASE_PROFILES } = require('../profiles.js');
+const readShellConfig = require('../readShellConfig.js');
+const { DEV_CLIENT_MARKER, getExclusions } = require('../shellVariant.js');
+
+// The modules some release profile leaves out, which the dev variant links, for the --control run.
+const RELEASE_EXCLUDED_MODULES = Object.assign(
+  {},
+  ...RELEASE_PROFILES.map(
+    (profile) => getExclusions({ shell: { profile }, variant: 'release' }).modules
+  )
+);
+
+// The native module names a bundle that carries a module's JavaScript holds. A module with no
+// JavaScript of its own in the bundle (null) is checked by autolinking only.
+function nativeNames(modules) {
+  return Object.values(modules).filter((name) => name !== null);
+}
+
+// Copied into each prebuild's temporary project; node_modules is linked, not copied.
+const SKIPPED_IN_COPY = new Set(['android', 'coverage', 'dist', 'ios', 'node_modules', '.expo']);
+
+const AUTOLINKING_PLATFORMS = { ios: 'apple', android: 'android' };
+
+function readOption(argv, option) {
+  const index = argv.indexOf(option);
+  return index === -1 ? undefined : argv[index + 1];
+}
+
+function readArgs(argv) {
+  const platform = readOption(argv, '--platform');
+  const profile = readOption(argv, '--profile');
+  if (profile !== undefined && !RELEASE_PROFILES.includes(profile)) {
+    throw new Error(
+      `--profile should be one of ${RELEASE_PROFILES.join(', ')}. Received ${JSON.stringify(
+        profile
+      )}.`
+    );
+  }
+  return {
+    control: argv.includes('--control'),
+    platforms: platform === undefined ? ['ios', 'android'] : [platform],
+    profiles: profile === undefined ? RELEASE_PROFILES : [profile],
+  };
+}
+
+// The environment of a check of the shell built on one profile and variant: the shell config, set
+// to that profile, written to a temporary shell.json, its icon still found where it is.
+function withShellEnv({ configPath: shellConfigPath, profile, shell, variant }, callback) {
+  return withTemporaryDirectory(`lowdefy-shell-config-${profile}-`, (directory) => {
+    const configPath = path.join(directory, 'shell.json');
+    const icon =
+      shell.icon === undefined
+        ? undefined
+        : path.resolve(path.dirname(shellConfigPath), shell.icon);
+    fs.writeFileSync(configPath, JSON.stringify({ ...shell, icon, profile }, null, 2));
+    return callback({
+      ...process.env,
+      CI: '1',
+      LOWDEFY_SHELL_CONFIG: configPath,
+      LOWDEFY_SHELL_VARIANT: variant,
+    });
+  });
+}
+
+function listFiles(directory) {
+  return fs.readdirSync(directory, { withFileTypes: true }).flatMap((entry) => {
+    const entryPath = path.join(directory, entry.name);
+    return entry.isDirectory() ? listFiles(entryPath) : [entryPath];
+  });
+}
+
+function withTemporaryDirectory(prefix, callback) {
+  const directory = fs.mkdtempSync(path.join(os.tmpdir(), prefix));
+  try {
+    return callback(directory);
+  } finally {
+    fs.rmSync(directory, { recursive: true, force: true });
+  }
+}
+
+// The files of the exported bundle that hold each string, as { [string]: [file] }. Hermes bytecode
+// keeps string literals as plain bytes, so they are found in .hbc files too.
+function findInBundle({ env, platform, strings }) {
+  return withTemporaryDirectory(`lowdefy-shell-bundle-${platform}-`, (outputDir) => {
+    execFileSync(
+      path.join(shellRoot, 'node_modules', '.bin', 'expo'),
+      ['export', '--platform', platform, '--output-dir', outputDir, '--clear'],
+      { cwd: shellRoot, env, stdio: ['ignore', 'ignore', 'inherit'] }
+    );
+    const files = listFiles(outputDir).map((file) => ({
+      name: path.relative(outputDir, file),
+      bytes: fs.readFileSync(file),
+    }));
+    return Object.fromEntries(
+      strings.map((string) => [
+        string,
+        files.filter(({ bytes }) => bytes.includes(Buffer.from(string))).map(({ name }) => name),
+      ])
+    );
+  });
+}
+
+function readList(text) {
+  return [...text.matchAll(/'([^']+)'/g)].map((match) => match[1]);
+}
+
+// The exclusions a generated native project passes to Expo autolinking: [expo modules, react-native
+// config]. iOS: the Podfile's `use_expo_modules!(exclude: [...])` and its react-native-config
+// command's `--exclude` pairs. Android: settings.gradle's `expoAutolinking.exclude` and the list
+// added to `rnConfigCommand`.
+function readExclusions({ platform, projectDir }) {
+  if (platform === 'ios') {
+    const podfile = fs.readFileSync(path.join(projectDir, 'ios', 'Podfile'), 'utf8');
+    const expoModules = /use_expo_modules!\(exclude: \[([^\]]*)\]\)/.exec(podfile);
+    const reactNative = [...podfile.matchAll(/'--exclude', '([^']+)'/g)].map((match) => match[1]);
+    return { expo: expoModules ? readList(expoModules[1]) : [], reactNative };
+  }
+  const settings = fs.readFileSync(path.join(projectDir, 'android', 'settings.gradle'), 'utf8');
+  const expoModules = /expoAutolinking\.exclude = \[([^\]]*)\]/.exec(settings);
+  const reactNative = /rnConfigCommand \+ \[([^\]]*)\]/.exec(settings);
+  return {
+    expo: expoModules ? readList(expoModules[1]) : [],
+    reactNative: reactNative ? readList(reactNative[1]).filter((item) => item !== '--exclude') : [],
+  };
+}
+
+function runAutolinking({ args, exclude, projectDir }) {
+  const output = execFileSync(
+    process.execPath,
+    [
+      '--no-warnings',
+      '--eval',
+      "require('expo/bin/autolinking')",
+      'expo-modules-autolinking',
+      ...args,
+      ...exclude.flatMap((name) => ['--exclude', name]),
+    ],
+    { cwd: projectDir, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 }
+  );
+  return JSON.parse(output);
+}
+
+// The packages the native build links: Expo modules and react-native-config dependencies.
+function readLinkedModules({ platform, projectDir }) {
+  const exclusions = readExclusions({ platform, projectDir });
+  const resolved = runAutolinking({
+    args: ['resolve', '--json', '--platform', AUTOLINKING_PLATFORMS[platform]],
+    exclude: exclusions.expo,
+    projectDir,
+  });
+  const reactNative = runAutolinking({
+    args: ['react-native-config', '--json', '--platform', platform],
+    exclude: exclusions.reactNative,
+    projectDir,
+  });
+  return new Set([
+    ...resolved.modules.map((module) => module.packageName),
+    ...Object.keys(reactNative.dependencies),
+  ]);
+}
+
+// The permissions the native project asks for, of those every profile's modules ask for: iOS
+// Info.plist usage keys and Android permissions not removed by `blockedPermissions`.
+function readPermissions({ platform, projectDir }) {
+  if (platform === 'ios') {
+    const iosDir = path.join(projectDir, 'ios');
+    const plist = fs
+      .readdirSync(iosDir)
+      .map((name) => path.join(iosDir, name, 'Info.plist'))
+      .find((file) => fs.existsSync(file));
+    const text = fs.readFileSync(plist, 'utf8');
+    return new Set(
+      [...text.matchAll(/<key>(NS[A-Za-z]+UsageDescription)<\/key>/g)].map((m) => m[1])
+    );
+  }
+  const manifest = fs.readFileSync(
+    path.join(projectDir, 'android', 'app', 'src', 'main', 'AndroidManifest.xml'),
+    'utf8'
+  );
+  return new Set(
+    [...manifest.matchAll(/<uses-permission [^>]*android:name="([^"]+)"[^>]*>/g)]
+      .filter((match) => !match[0].includes('tools:node="remove"'))
+      .map((match) => match[1])
+  );
+}
+
+function prebuild({ env, platform }) {
+  return withTemporaryDirectory(`lowdefy-shell-prebuild-${platform}-`, (projectDir) => {
+    fs.readdirSync(shellRoot)
+      .filter((name) => !SKIPPED_IN_COPY.has(name))
+      .forEach((name) => {
+        fs.cpSync(path.join(shellRoot, name), path.join(projectDir, name), { recursive: true });
+      });
+    fs.symlinkSync(path.join(shellRoot, 'node_modules'), path.join(projectDir, 'node_modules'));
+    execFileSync(
+      path.join(projectDir, 'node_modules', '.bin', 'expo'),
+      ['prebuild', '--no-install', '--platform', platform],
+      { cwd: projectDir, env, stdio: ['ignore', 'ignore', 'inherit'] }
+    );
+    return {
+      linked: readLinkedModules({ platform, projectDir }),
+      permissions: readPermissions({ platform, projectDir }),
+    };
+  });
+}
+
+function checkControl({ configPath, platform, shell }) {
+  return withShellEnv({ configPath, profile: 'dev', shell, variant: 'dev' }, (env) => {
+    const problems = [];
+    const found = findInBundle({
+      env,
+      platform,
+      strings: [DEV_CLIENT_MARKER, ...nativeNames(RELEASE_EXCLUDED_MODULES)],
+    });
+    Object.entries(found)
+      .filter(([, files]) => files.length === 0)
+      .forEach(([string]) => problems.push(`the dev bundle does not hold "${string}"`));
+    const { linked } = prebuild({ env, platform });
+    Object.keys(RELEASE_EXCLUDED_MODULES)
+      .filter((name) => !linked.has(name))
+      .forEach((name) => problems.push(`the dev prebuild does not link ${name}`));
+    return problems;
+  });
+}
+
+// iOS asks for permissions with Info.plist usage keys, Android with android.permission names.
+function onPlatform({ permissions, platform }) {
+  return permissions.filter(
+    (permission) => permission.startsWith('android.permission.') === (platform === 'android')
+  );
+}
+
+function checkRelease({ configPath, platform, profile, shell }) {
+  const exclusions = getExclusions({ shell: { ...shell, profile }, variant: 'release' });
+  const excluded = {
+    modules: exclusions.modules,
+    permissions: onPlatform({ permissions: exclusions.permissions, platform }),
+  };
+  return withShellEnv({ configPath, profile, shell, variant: 'release' }, (env) => {
+    const problems = [];
+    const found = findInBundle({
+      env,
+      platform,
+      strings: [DEV_CLIENT_MARKER, ...nativeNames(excluded.modules)],
+    });
+    Object.entries(found)
+      .filter(([, files]) => files.length > 0)
+      .forEach(([string, files]) =>
+        problems.push(`the release bundle holds "${string}" (${files.join(', ')})`)
+      );
+    const { linked, permissions } = prebuild({ env, platform });
+    Object.keys(excluded.modules)
+      .filter((name) => linked.has(name))
+      .forEach((name) => problems.push(`the release prebuild links ${name}`));
+    excluded.permissions
+      .filter((permission) => permissions.has(permission))
+      .forEach((permission) =>
+        problems.push(`the release prebuild asks for ${permission}, which no module it links needs`)
+      );
+    return { excluded, problems };
+  });
+}
+
+function main() {
+  const { control, platforms, profiles } = readArgs(process.argv.slice(2));
+  const { configPath, shell } = readShellConfig();
+  let failed = false;
+  platforms.forEach((platform) => {
+    if (control) {
+      const problems = checkControl({ configPath, platform, shell });
+      if (problems.length > 0) {
+        problems.forEach((problem) => console.error(`${platform}: ${problem}.`));
+        failed = true;
+        return;
+      }
+      console.log(
+        `${platform}: the dev variant holds the dev-tab client and links ${Object.keys(
+          RELEASE_EXCLUDED_MODULES
+        ).join(', ')}.`
+      );
+    }
+    profiles.forEach((profile) => {
+      const { excluded, problems } = checkRelease({ configPath, platform, profile, shell });
+      if (problems.length > 0) {
+        problems.forEach((problem) => console.error(`${platform} ${profile}: ${problem}.`));
+        failed = true;
+        return;
+      }
+      const permissions =
+        excluded.permissions.length === 0
+          ? 'asks for no permission of a left-out module'
+          : `asks for none of ${excluded.permissions.join(', ')}`;
+      console.log(
+        `${platform} ${profile}: the release shell "${
+          shell.id
+        }" holds no dev-tab client, links none of ${Object.keys(excluded.modules).join(
+          ', '
+        )}, and ${permissions}.`
+      );
+    });
+  });
+  if (failed) {
+    process.exit(1);
+  }
+}
+
+main();

package/scripts/createDayjsLocales.mjs

@@ -0,0 +1,67 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import fs from 'node:fs';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const shellRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const require = createRequire(import.meta.url);
+
+const HEADER = `/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+// Generated by scripts/createDayjsLocales.mjs from the dayjs package the shell carries. Do not edit.
+`;
+
+// Every locale dayjs ships, as an app may name any of them in config.i18n.locales[].dayjs. Metro
+// bundles each, and a locale's data is evaluated only when the app's active locale needs it.
+function createDayjsLocales() {
+  const localeDirectory = path.join(path.dirname(require.resolve('dayjs/package.json')), 'locale');
+  const ids = fs
+    .readdirSync(localeDirectory)
+    .filter((file) => file.endsWith('.js'))
+    .map((file) => file.slice(0, -'.js'.length))
+    .sort();
+  // Keys are quoted only where an id is not an identifier, as Prettier writes them.
+  const entries = ids.map((id) => {
+    const key = /^[a-z]+$/.test(id) ? id : `'${id}'`;
+    return `  ${key}: () => require('dayjs/locale/${id}.js'),`;
+  });
+  return `${HEADER}\nconst dayjsLocales = {\n${entries.join(
+    '\n'
+  )}\n};\n\nexport default dayjsLocales;\n`;
+}
+
+if (process.argv[1] === fileURLToPath(import.meta.url)) {
+  fs.writeFileSync(path.join(shellRoot, 'src/locale/dayjsLocales.js'), createDayjsLocales());
+}
+
+export default createDayjsLocales;

package/scripts/createShellAssets.mjs

@@ -0,0 +1,54 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+/*
+  Writes a shell's Android adaptive-icon foreground from its 1024×1024 icon: the icon scaled into
+  the centre 66% of a transparent 1024×1024 canvas, the safe zone a launcher's mask never cuts.
+  app.config.ts runs it when the shell's icon has no foreground yet (the app config is evaluated
+  synchronously, and image code is asynchronous).
+
+    node scripts/createShellAssets.mjs <icon.png> <foreground.png>
+*/
+
+import fs from 'node:fs';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const Jimp = require('jimp-compact');
+
+const SIZE = 1024;
+const SAFE_ZONE = 0.66;
+
+async function createAdaptiveIconForeground({ icon, output }) {
+  const image = await Jimp.read(icon);
+  const inner = Math.round(SIZE * SAFE_ZONE);
+  image.contain(inner, inner);
+  const canvas = new Jimp(SIZE, SIZE, 0x00000000);
+  canvas.composite(image, Math.round((SIZE - inner) / 2), Math.round((SIZE - inner) / 2));
+  await canvas.writeAsync(output);
+  return output;
+}
+
+if (fs.realpathSync(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  const [icon, output] = process.argv.slice(2);
+  if (icon === undefined || output === undefined) {
+    throw new Error('Usage: node scripts/createShellAssets.mjs <icon.png> <foreground.png>');
+  }
+  await createAdaptiveIconForeground({ icon, output });
+}
+
+export { createAdaptiveIconForeground };

package/scripts/createShellVersion.mjs

@@ -0,0 +1,83 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+/*
+  The shell's version: the @lowdefy/shell package version, which the shell sends as
+  `x-lowdefy-shell` and compares with an app's `mobile.minShellVersion`
+  (src/version/isShellTooOld.js).
+
+  Written to src/version/shellVersion.js, which the shell's JavaScript imports
+  (src/config/getShellConfig.js). The version travels in the JavaScript bundle, not the Expo config,
+  so it is the version of the code that runs: an embedded launch reads the Expo config the native
+  build embedded, which a shell running newer JavaScript from Metro has outgrown. Only the
+  version is written, not package.json, which would put every dependency name in the bundle. The
+  file is committed; src/version/shellVersion.test.js fails when it is stale, and
+  `pnpm release:version` rewrites it after the version bump.
+
+    node scripts/createShellVersion.mjs           prints the version
+    node scripts/createShellVersion.mjs --write   writes src/version/shellVersion.js
+
+  Usage: pnpm --filter=@lowdefy/shell shell-version
+*/
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const shellRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+const HEADER = `/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+// Generated by scripts/createShellVersion.mjs from package.json. Do not edit.
+`;
+
+function createShellVersion() {
+  const { version } = JSON.parse(fs.readFileSync(path.join(shellRoot, 'package.json'), 'utf8'));
+  return version;
+}
+
+function createShellVersionModule() {
+  return `${HEADER}\nconst shellVersion = ${JSON.stringify(
+    createShellVersion()
+  )};\n\nexport default shellVersion;\n`;
+}
+
+if (process.argv[1] === fileURLToPath(import.meta.url)) {
+  if (process.argv.includes('--write')) {
+    fs.writeFileSync(
+      path.join(shellRoot, 'src/version/shellVersion.js'),
+      createShellVersionModule()
+    );
+  } else {
+    process.stdout.write(createShellVersion());
+  }
+}
+
+export default createShellVersion;