@owear/cli 0.1.3 → 0.1.4

package/template-installer/uninstaller/index.html

@@ -5,14 +5,18 @@
   <head>
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>Desinstalar — __APP_NAME__</title>
+    <title>Desinstalar · __APP_NAME__</title>
   </head>
   <body>
     <header class="titlebar">
       <div class="titlebar__drag" data-ow-drag>
+        <span class="brand__mark" aria-hidden="true"></span>
         <span class="brand__name">Desinstalador · __APP_NAME__</span>
       </div>
       <div class="titlebar__controls">
+        <button id="win-min" class="winbtn" title="Minimizar" aria-label="Minimizar">
+          <svg viewBox="0 0 12 12" width="12" height="12"><path d="M2 6h8" /></svg>
+        </button>
         <button id="win-close" class="winbtn winbtn--close" title="Cerrar" aria-label="Cerrar">
           <svg viewBox="0 0 12 12" width="12" height="12"><path d="M2.5 2.5l7 7M9.5 2.5l-7 7" /></svg>
         </button>
@@ -21,28 +25,30 @@
 
     <main class="page">
       <section class="hero">
-        <span class="eyebrow">Owear Uninstaller</span>
         <h1>Desinstalar __APP_NAME__</h1>
         <p class="lead" id="summary">Localizando la instalación…</p>
       </section>
 
-      <section class="card">
-        <header class="card__head"><h2>Instalación</h2></header>
-        <div class="row">
-          <input id="dir" class="input" type="text" spellcheck="false" />
-          <button id="pick" class="btn">Elegir…</button>
-        </div>
-        <div class="row">
-          <label class="opt"><input type="checkbox" id="keepData" checked /> Conservar mis datos</label>
-        </div>
+      <section class="board">
+        <article class="card">
+          <header class="card__head"><h2>Instalación</h2></header>
+          <div class="row">
+            <input id="dir" class="field" type="text" spellcheck="false" aria-label="Directorio de instalación" />
+            <button id="pick" class="btn">Elegir…</button>
+          </div>
+          <div class="row">
+            <label class="opt"><input type="checkbox" id="keepData" checked /> Conservar mis datos</label>
+          </div>
+        </article>
       </section>
-
-      <footer class="actions">
-        <span id="status" class="status"></span>
-        <button id="uninstall" class="btn btn--primary" disabled>Desinstalar</button>
-      </footer>
     </main>
 
+    <footer class="foot">
+      <span id="status" class="status"></span>
+      <span class="foot__spacer"></span>
+      <button id="uninstall" class="btn btn--primary" disabled>Desinstalar</button>
+    </footer>
+
     <script type="module" src="/src/uninstaller.ts"></script>
   </body>
 </html>

package/template-installer/uninstaller/src/uninstaller.ts

@@ -2,21 +2,35 @@
 // SPDX-License-Identifier: Apache-2.0
 //
 // src/uninstaller.ts — UI del desinstalador (vanilla). Mismo bridge, pero
-// invoca `installer.uninstall`.
+// invoca `installer.uninstall`. Detecta la instalación por el REGISTRO de Owear
+// (no hace falta escribir la ruta ni usar módulos .owm).
+// Estilos: tokens del Starter (ver ../../src/style.css).
 
 import '../../src/style.css'
 
-declare global {
-  interface Window {
-    __owWindowId: number
-    ow: { invoke<T = unknown>(module: string, fn: string, ...args: unknown[]): Promise<T> }
-  }
+interface OwBridge {
+  invoke<T = unknown>(module: string, fn: string, ...args: unknown[]): Promise<T>
 }
+const ow = (window as unknown as { ow: OwBridge }).ow
+const wid = (window as unknown as { __owWindowId: number }).__owWindowId
 
 const $ = <T extends HTMLElement = HTMLElement>(sel: string): T =>
   document.querySelector(sel) as T
 const invoke = <T = unknown>(module: string, fn: string, ...args: unknown[]): Promise<T> =>
-  window.ow.invoke(module, fn, ...args) as Promise<T>
+  ow.invoke<T>(module, fn, ...args)
+
+interface StateResult {
+  installed: boolean
+  version?: string
+  app?: string
+  dir?: string
+}
+interface Info {
+  appName?: string
+  version?: string
+  dir?: string
+  installed?: boolean
+}
 
 function setStatus(msg: string, kind: 'ok' | 'err' | '' = ''): void {
   const el = $('#status')
@@ -25,25 +39,37 @@ function setStatus(msg: string, kind: 'ok' | 'err' | '' = ''): void {
 }
 
 async function boot(): Promise<void> {
-  $('#win-close').addEventListener('click', () => void invoke('ow-window', 'close', window.__owWindowId))
+  $('#win-min').addEventListener('click', () => void invoke('ow-window', 'minimize', wid))
+  $('#win-close').addEventListener('click', () => void invoke('ow-window', 'close', wid))
 
-  const info = await invoke<{ appName?: string; dir?: string }>('installer', 'info').catch(() => ({}))
-  const st = await invoke<{ installed: boolean; version?: string; app?: string }>(
-    'installer',
-    'state',
-    { dir: info.dir ?? '' },
-  ).catch(() => ({ installed: false }))
+  const info = await invoke<Info>('installer', 'info').catch(() => ({}))
+  const st = await invoke<StateResult>('installer', 'state', {}).catch(() => ({
+    installed: false,
+  }))
+  const name = st.app ?? info.appName ?? 'La app'
+  const dir = st.dir ?? info.dir ?? ''
 
-  $('#summary').textContent = st.installed
-    ? `${st.app ?? info.appName ?? 'La app'} ${st.version ?? ''} está instalada.`
-    : 'No se detectó una instalación en el directorio por defecto; elígelo.'
-  ;($('#dir') as HTMLInputElement).value = info.dir ?? ''
+  if (st.installed) {
+    const v = st.version ?? info.version ?? ''
+    $('#summary').textContent = `${name}${v ? ' ' + v : ''} está instalada${
+      dir ? ' en ' + dir : ''
+    }.`
+  } else {
+    $('#summary').textContent =
+      'No se detectó ninguna instalación registrada. Elige la carpeta donde se instaló.'
+  }
+  ;($('#dir') as HTMLInputElement).value = dir
   $('#uninstall').removeAttribute('disabled')
 }
 
 async function pickDir(): Promise<void> {
+  const current = ($('#dir') as HTMLInputElement).value.trim()
   try {
-    const dir = await invoke<string | null>('dialog', 'open', 'openDirectory', 'Elegir carpeta')
+    // Selector NATIVO del builtin installer (no usa el módulo `dialog`).
+    const dir = await invoke<string | null>('installer', 'chooseDir', {
+      title: 'Elegir carpeta de instalación',
+      defaultPath: current,
+    })
     if (dir) ($('#dir') as HTMLInputElement).value = dir
   } catch {
     /* cancelado */
@@ -52,19 +78,18 @@ async function pickDir(): Promise<void> {
 
 async function doUninstall(): Promise<void> {
   const dir = ($('#dir') as HTMLInputElement).value.trim()
-  if (!dir) {
-    setStatus('Elige la carpeta de instalación', 'err')
-    return
-  }
+  const keepData = ($('#keepData') as HTMLInputElement).checked
   $('#uninstall').setAttribute('disabled', 'true')
   setStatus('Desinstalando…')
   try {
-    const res = await invoke<{ removed: number }>('installer', 'uninstall', {
-      dir,
-      keepData: ($('#keepData') as HTMLInputElement).checked,
-    })
+    // Si no hay dir, el builtin usa el registrado.
+    const res = await invoke<{ removed: number }>(
+      'installer',
+      'uninstall',
+      dir ? { dir, keepData } : { keepData },
+    )
     setStatus(`Eliminados ${res.removed} ficheros.`, 'ok')
-    setTimeout(() => void invoke('ow-window', 'close', window.__owWindowId), 900)
+    setTimeout(() => void invoke('ow-window', 'close', wid), 900)
   } catch (e) {
     setStatus(e instanceof Error ? e.message : String(e), 'err')
     $('#uninstall').removeAttribute('disabled')

package/tools/owear-installer.mjs

@@ -44,6 +44,7 @@ const payload = arg('--payload')
 const bridge = arg('--bridge')
 const meta = arg('--meta')
 const modules = arg('--modules')
+const icon = arg('--icon')
 const name = arg('--name', 'app')
 
 if (!kernel || !out || !ui) die('uso: --kernel <owear> --out <bin> --ui <distUI> [--payload <dir>]')
@@ -62,6 +63,10 @@ if (payload && fs.existsSync(payload)) copyInto(payload, 'payload')
 if (bridge && fs.existsSync(bridge)) fs.copyFileSync(bridge, path.join(stage, 'bridge.json'))
 if (meta && fs.existsSync(meta)) fs.copyFileSync(meta, path.join(stage, 'installer.json'))
 if (modules && fs.existsSync(modules)) copyInto(modules, 'modules')
+// icono de la app (para el .desktop / acceso directo del instalado)
+if (icon && fs.existsSync(icon)) {
+  fs.copyFileSync(icon, path.join(stage, 'icon' + path.extname(icon)))
+}
 
 // manifiesto mínimo del payload del instalador (informativo)
 fs.writeFileSync(

package/tools/owear-sign.mjs

@@ -0,0 +1,204 @@
+#!/usr/bin/env node
+// Copyright 2026 Owear Contributors
+// SPDX-License-Identifier: Apache-2.0
+//
+// tools/owear-sign.mjs — firma de artefactos de Owear.
+//
+// Dos mecanismos, combinables:
+//
+//   1. Authenticode (Windows PE, .exe/.msi): firma del binario con un
+//      certificado (PFX/P12). Requiere `osslsigncode` (Linux/macOS) o
+//      `signtool` (Windows). Da confianza de **editor** ante el SO
+//      (SmartScreen, "Unknown publisher").
+//
+//   2. Ed25519 desprendida (cualquier plataforma): escribe `<file>.sig` con la
+//      firma del fichero completo. La clave pública (misma que el updater)
+//      permite verificar el artefacto de forma independiente del feed.
+//
+// Nunca rompe un build: si no hay material de firma o falta la herramienta,
+// omite con un aviso (salvo `--require`, que lo convierte en error).
+//
+// Uso:
+//   node tools/owear-sign.mjs --file release/MiApp \
+//     [--ed25519-key owear-signing.pem] \
+//     [--pfx cert.p12 --pfx-password-env OW_PFX_PASS] \
+//     [--timestamp http://timestamp.digicert.com] \
+//     [--name "Mi App" --url https://miapp.dev] \
+//     [--require] [--dry-run]
+//
+import * as fs from 'node:fs'
+import * as path from 'node:path'
+import * as crypto from 'node:crypto'
+import { spawnSync } from 'node:child_process'
+import { fileURLToPath } from 'node:url'
+
+const C = { reset: '\x1b[0m', dim: '\x1b[2m', green: '\x1b[32m', yellow: '\x1b[33m', red: '\x1b[31m' }
+const info = (m) => console.log(`${C.dim}[owear-sign]${C.reset} ${m}`)
+const warn = (m) => console.warn(`${C.yellow}[owear-sign] ⚠${C.reset} ${m}`)
+const fail = (m) => console.error(`${C.red}[owear-sign] ✗${C.reset} ${m}`)
+
+const isPE = (file) => {
+  try {
+    const fd = fs.openSync(file, 'r')
+    const b = Buffer.alloc(2)
+    fs.readSync(fd, b, 0, 2, 0)
+    fs.closeSync(fd)
+    return b[0] === 0x4d && b[1] === 0x5a // "MZ"
+  } catch {
+    return false
+  }
+}
+
+const PE_EXT = new Set(['.exe', '.dll', '.msi', '.sys', '.ocx', '.scr'])
+
+/** ¿Es un PE/MSI firmable con Authenticode? (por extensión o cabecera MZ). */
+export function isAuthenticodeTarget(file) {
+  if (PE_EXT.has(path.extname(file).toLowerCase())) return true
+  return isPE(file)
+}
+
+/** Comando de firma Authenticode según la herramienta disponible. */
+export function buildAuthenticodeInvocation({ tool, file, pfx, password, timestamp, name, url }) {
+  if (tool === 'osslsigncode') {
+    const args = ['sign', '-pkcs12', pfx, '-in', file, '-out', `${file}.signed`]
+    if (password) args.push('-pass', password)
+    if (name) args.push('-n', name)
+    if (url) args.push('-i', url)
+    if (timestamp) args.push('-t', timestamp)
+    return { cmd: 'osslsigncode', args, out: `${file}.signed`, inPlace: true }
+  }
+  if (tool === 'signtool') {
+    const args = ['sign', '/f', pfx, '/fd', 'SHA256', '/d', name || path.basename(file)]
+    if (password) args.push('/p', password)
+    if (timestamp) args.push('/tr', timestamp, '/td', 'SHA256')
+    args.push(file)
+    return { cmd: 'signtool', args, out: file, inPlace: false }
+  }
+  throw new Error(`herramienta de firma desconocida: ${tool}`)
+}
+
+/** ¿Está la herramienta en el PATH? */
+export function hasTool(cmd) {
+  const probe = process.platform === 'win32' ? 'where' : 'which'
+  return spawnSync(probe, [cmd], { stdio: 'ignore' }).status === 0
+}
+
+/** Firma Ed25519 desprendida: escribe `<file>.sig` (base64) y devuelve la firma. */
+export function signEd25519(file, keyPath) {
+  const data = fs.readFileSync(file)
+  const key = crypto.createPrivateKey(fs.readFileSync(keyPath))
+  const sig = crypto.sign(null, data, key)
+  fs.writeFileSync(`${file}.sig`, sig.toString('base64') + '\n')
+  return sig
+}
+
+/** Verifica una firma Ed25519 desprendida contra `pub` (PEM o SPKI base64). */
+export function verifyEd25519(file, sigPath, pub) {
+  const key = pub.includes('BEGIN')
+    ? crypto.createPublicKey(pub)
+    : crypto.createPublicKey({ key: Buffer.from(pub, 'base64'), format: 'der', type: 'spki' })
+  const data = fs.readFileSync(file)
+  const sig = Buffer.from(fs.readFileSync(sigPath, 'utf8').trim(), 'base64')
+  return crypto.verify(null, data, key, sig)
+}
+
+/** Firma Authenticode (in-place si es posible). Devuelve 'signed'|'skipped'|'failed'. */
+export function signAuthenticode({ file, pfx, password, timestamp, name, url, require = false }) {
+  const tool = hasTool('osslsigncode') ? 'osslsigncode' : hasTool('signtool') ? 'signtool' : null
+  if (!tool) {
+    const msg = 'ni osslsigncode ni signtool están en el PATH'
+    if (require) throw new Error(msg)
+    warn(`${msg} — Authenticode omitido`)
+    return 'skipped'
+  }
+  if (!pfx || !fs.existsSync(pfx)) {
+    const msg = `certificado no encontrado: ${pfx ?? '(sin --pfx)'}`
+    if (require) throw new Error(msg)
+    warn(`${msg} — Authenticode omitido`)
+    return 'skipped'
+  }
+  const inv = buildAuthenticodeInvocation({ tool, file, pfx, password, timestamp, name, url })
+  const r = spawnSync(inv.cmd, inv.args, { stdio: 'inherit' })
+  if (r.status !== 0) {
+    if (require) throw new Error(`${inv.cmd} falló (${r.status})`)
+    warn(`${inv.cmd} falló (${r.status})`)
+    return 'failed'
+  }
+  if (inv.inPlace) {
+    fs.renameSync(inv.out, file)
+    info(`Authenticode OK (${tool})`)
+  } else {
+    info(`Authenticode OK (${tool})`)
+  }
+  return 'signed'
+}
+
+function main() {
+  const argv = process.argv.slice(2)
+  const arg = (n, def = null) => (argv.includes(n) ? argv[argv.indexOf(n) + 1] : def)
+  const flag = (n) => argv.includes(n)
+
+  const file = arg('--file')
+  if (!file) {
+    fail('--file es obligatorio')
+    process.exit(1)
+  }
+  if (!fs.existsSync(file)) {
+    fail(`no existe: ${file}`)
+    process.exit(1)
+  }
+
+  const edKey = arg('--ed25519-key')
+  const pfx = arg('--pfx')
+  const pwEnv = arg('--pfx-password-env')
+  const password = arg('--password', pwEnv ? process.env[pwEnv] ?? '' : '')
+  const timestamp = arg('--timestamp')
+  const name = arg('--name')
+  const url = arg('--url')
+  const require = flag('--require')
+  const dryRun = flag('--dry-run')
+  const isWin = process.platform === 'win32'
+
+  let did = 0
+
+  // 1) Authenticode (solo PE/MSI y solo en Windows o con osslsigncode)
+  if (pfx) {
+    if (!isAuthenticodeTarget(file)) {
+      info(`${path.basename(file)} no es PE/MSI — Authenticode no aplica`)
+    } else if (dryRun) {
+      const tool = hasTool('osslsigncode') ? 'osslsigncode' : 'signtool'
+      const inv = buildAuthenticodeInvocation({ tool, file, pfx, password, timestamp, name, url })
+      console.log(JSON.stringify({ authenticode: { cmd: inv.cmd, args: inv.args } }))
+      did++
+    } else {
+      if (signAuthenticode({ file, pfx, password, timestamp, name, url, require }) === 'signed') did++
+    }
+  }
+
+  // 2) Ed25519 desprendida (siempre disponible)
+  if (edKey) {
+    if (!fs.existsSync(edKey)) {
+      fail(`clave no encontrada: ${edKey}`)
+      process.exit(1)
+    }
+    if (dryRun) {
+      console.log(JSON.stringify({ ed25519: { file, key: edKey, out: `${file}.sig` } }))
+    } else {
+      signEd25519(file, edKey)
+      info(`Ed25519 OK → ${path.basename(file)}.sig`)
+      did++
+    }
+  }
+
+  if (!did) {
+    if (require) {
+      fail('no se firmó nada (--require)')
+      process.exit(1)
+    }
+    warn('sin material de firma (--ed25519-key / --pfx) — nada que hacer')
+  }
+  void isWin
+}
+
+// Ejecuta main solo como script (permite importarlo en tests).
+if (process.argv[1] && fileURLToPath(import.meta.url) === path.resolve(process.argv[1])) main()

package/tools/owear-update.mjs

@@ -0,0 +1,150 @@
+#!/usr/bin/env node
+// Copyright 2026 Owear Contributors
+// SPDX-License-Identifier: Apache-2.0
+//
+// tools/owear-update.mjs — publica un update de Owear: calcula el blockmap
+// (delta por bloques), genera el manifiesto YAML del canal y lo firma con
+// Ed25519.
+//
+// Salidas (en --out-dir, por defecto junto al artefacto):
+//   <file>.blockmap   { blockSize, size, blocks:[sha256…] }
+//   <channel>.yml     manifiesto YAML (version, sha256, sha512, blockSize,
+//                     blockmap, path, releaseDate, notes, signature)
+//
+// El SDK (autoUpdater) verifica `signature` con la clave pública del bridge
+// (Ed25519 sobre "<version>:<sha256>") y descarga solo los bloques cambiados.
+//
+// Uso:
+//   node tools/owear-update.mjs --file release/MiApp-1.4.0 --version 1.4.0 \
+//     --channel latest --url https://up.miapp.dev --key private.pem \
+//     [--notes "…"|--notes @notes.md] [--block-size 262144] [--mandatory] \
+//     [--out-dir release]
+//
+//   # claves (una vez):
+//   node tools/owear-update.mjs --gen-key ./owear-signing
+//       → owear-signing.pem (privada, Ed25519 PKCS8)
+//         owear-signing.pub.b64 (pública SPKI base64 — va en el bridge)
+//
+import * as fs from 'node:fs'
+import * as path from 'node:path'
+import * as crypto from 'node:crypto'
+
+function die(m) {
+  console.error(`[owear-update] ✗ ${m}`)
+  process.exit(1)
+}
+const argv = process.argv.slice(2)
+const arg = (n, def = null) => (argv.includes(n) ? argv[argv.indexOf(n) + 1] : def)
+const flag = (n) => argv.includes(n)
+
+// ── generación de claves ────────────────────────────────────────────────────
+const genKey = arg('--gen-key')
+if (genKey) {
+  if (fs.existsSync(`${genKey}.pem`)) die(`ya existe ${genKey}.pem`)
+  const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519')
+  fs.writeFileSync(`${genKey}.pem`, privateKey.export({ format: 'pem', type: 'pkcs8' }), { mode: 0o600 })
+  fs.writeFileSync(`${genKey}.pub.b64`, publicKey.export({ format: 'der', type: 'spki' }).toString('base64'))
+  console.log(`[owear-update] ✓ clave privada: ${genKey}.pem`)
+  console.log(`[owear-update] ✓ clave pública: ${genKey}.pub.b64 (ponla en el bridge: updater.publicKey)`)
+  process.exit(0)
+}
+
+// ── validación de argumentos ────────────────────────────────────────────────
+const file = arg('--file')
+const version = arg('--version')
+if (!file || !version) die('--file y --version son obligatorios (o usa --gen-key)')
+if (!fs.existsSync(file)) die(`no existe el artefacto: ${file}`)
+if (!/^\d+\.\d+\.\d+/.test(version)) die(`versión inválida: ${version} (semver esperado)`)
+
+const channel = arg('--channel', 'latest')
+const blockSize = parseInt(arg('--block-size', '262144'), 10)
+if (!Number.isFinite(blockSize) || blockSize <= 0) die('--block-size inválido')
+const baseUrl = (arg('--url', '') || '').replace(/\/+$/, '')
+const outDir = arg('--out-dir', path.dirname(file))
+const keyPath = arg('--key')
+const mandatory = flag('--mandatory')
+
+let notes = arg('--notes', '')
+if (notes.startsWith('@')) {
+  const nf = notes.slice(1)
+  if (!fs.existsSync(nf)) die(`no existe el fichero de notas: ${nf}`)
+  notes = fs.readFileSync(nf, 'utf8').trimEnd()
+}
+
+// ── integridad + blockmap ───────────────────────────────────────────────────
+const data = fs.readFileSync(file)
+const sha256 = crypto.createHash('sha256').update(data).digest('hex')
+const sha512 = crypto.createHash('sha512').update(data).digest('hex')
+
+const blocks = []
+for (let off = 0; off < data.length; off += blockSize) {
+  blocks.push(crypto.createHash('sha256').update(data.subarray(off, Math.min(off + blockSize, data.length))).digest('hex'))
+}
+if (data.length === 0) blocks.push(crypto.createHash('sha256').update(Buffer.alloc(0)).digest('hex'))
+
+fs.mkdirSync(outDir, { recursive: true })
+const artifactName = path.basename(file)
+const blockmapPath = path.join(outDir, `${artifactName}.blockmap`)
+fs.writeFileSync(blockmapPath, JSON.stringify({ blockSize, size: data.length, sha256, blocks }))
+
+// ── firma Ed25519 (del manifiesto y del binario) ────────────────────────────
+//   signature:  sobre "<version>:<sha256>" (autentica metadata)
+//   binarySig:  sobre los bytes del artefacto (autentica el payload)
+let signature = ''
+let binarySig = ''
+if (keyPath) {
+  if (!fs.existsSync(keyPath)) die(`no existe la clave: ${keyPath}`)
+  const privateKey = crypto.createPrivateKey(fs.readFileSync(keyPath))
+  signature = crypto
+    .sign(null, Buffer.from(`${version}:${sha256}`), privateKey)
+    .toString('base64')
+  binarySig = crypto.sign(null, data, privateKey).toString('base64')
+}
+
+// ── manifiesto YAML ─────────────────────────────────────────────────────────
+const blockmapUrl = baseUrl ? `${baseUrl}/${path.basename(blockmapPath)}` : path.basename(blockmapPath)
+const releaseDate = new Date().toISOString()
+const yamlEscape = (s) => (/[:#'"@|>{}\[\],&*!?%`-]|^\s|\s$|\n/.test(s) ? `'${s.replace(/'/g, "''")}'` : s)
+// las notas van como bloque literal
+const notesBlock = notes
+  ? `notes: |\n${notes
+      .split('\n')
+      .map((l) => `  ${l}`)
+      .join('\n')}\n`
+  : ''
+
+const manifest = [
+  `version: ${version}`,
+  `releaseDate: '${releaseDate}'`,
+  `path: ${yamlEscape(artifactName)}`,
+  // hashes y firmas se citan siempre: un valor "numérico" (p. ej. un hash solo
+  // de dígitos) no debe reinterpretarse como número al parsear el YAML.
+  `sha256: '${sha256}'`,
+  `sha512: '${sha512}'`,
+  `size: ${data.length}`,
+  `blockSize: ${blockSize}`,
+  `blockmap: ${yamlEscape(blockmapUrl)}`,
+  mandatory ? 'mandatory: true' : null,
+  signature ? `signature: '${signature}'` : null,
+  binarySig ? `binarySig: '${binarySig}'` : null,
+  notesBlock || null,
+  '',
+]
+  .filter((l) => l !== null)
+  .join('\n')
+
+const manifestPath = path.join(outDir, `${channel}.yml`)
+fs.writeFileSync(manifestPath, manifest)
+
+// ── resumen ─────────────────────────────────────────────────────────────────
+const mb = (n) => (n / 1024 / 1024).toFixed(1)
+console.log(`[owear-update] ✓ artefacto  ${artifactName}  ${mb(data.length)} MB`)
+console.log(`[owear-update] ✓ blockmap   ${path.basename(blockmapPath)}  (${blocks.length} bloques × ${(blockSize / 1024).toFixed(0)} KiB)`)
+console.log(`[owear-update] ✓ manifiesto ${manifestPath}`)
+console.log(`[owear-update] ${signature ? '✓ firmado' : '⚠ sin firma (--key)'}  sha256=${sha256.slice(0, 16)}…`)
+if (baseUrl) {
+  console.log(`[owear-update] feed: ${baseUrl}`)
+  console.log(`[owear-update]   ${baseUrl}/${channel}.yml`)
+  console.log(`[owear-update]   ${baseUrl}/${artifactName}`)
+  console.log(`[owear-update]   ${baseUrl}/${path.basename(blockmapPath)}`)
+}