@rs-native-kit/version-check 0.1.2

package/lib/module/data/config/ConfigValidator.js

@@ -0,0 +1,69 @@
+"use strict";
+
+import { parseVersion } from "../../domain/engines/semver/SemVerEngine.js";
+import { InvalidConfigException } from "../../domain/errors/VersionManagerException.js";
+/**
+ * Boundary validation (Prompt 3 §2.2) for the "default fallback" config tier — the
+ * VersionManagerOptions object passed to configure(). Full JSON-Schema structural
+ * validation and signature verification for local/remote config documents (Prompt 3
+ * §2.1, §3) are scoped to the not-yet-built config-document pipeline; see
+ * docs/architecture/03-configuration-system.md.
+ */
+export function validateOptions(options) {
+  if (!options.stores || Object.keys(options.stores).length === 0) {
+    throw new InvalidConfigException({
+      message: 'VersionManagerOptions.stores must configure at least one store (ios/android/huawei/amazon/custom)'
+    });
+  }
+  if (options.appVersion !== undefined) {
+    try {
+      parseVersion(options.appVersion);
+    } catch (error) {
+      throw new InvalidConfigException({
+        message: `options.appVersion "${options.appVersion}" is not a valid SemVer string`,
+        cause: error
+      });
+    }
+  }
+  if (options.policy?.forceUpdateBelow !== undefined) {
+    try {
+      parseVersion(options.policy.forceUpdateBelow);
+    } catch (error) {
+      throw new InvalidConfigException({
+        message: `options.policy.forceUpdateBelow "${options.policy.forceUpdateBelow}" is not a valid SemVer string`,
+        cause: error
+      });
+    }
+  }
+  const timeoutMs = options.fallback?.requestTimeoutMs;
+  if (timeoutMs !== undefined && timeoutMs <= 0) {
+    throw new InvalidConfigException({
+      message: 'options.fallback.requestTimeoutMs must be greater than 0'
+    });
+  }
+  const ttlMs = options.cache?.ttlMs;
+  if (ttlMs !== undefined && ttlMs < 0) {
+    throw new InvalidConfigException({
+      message: 'options.cache.ttlMs must be >= 0'
+    });
+  }
+  const maxAttempts = options.fallback?.retry?.maxAttempts;
+  if (maxAttempts !== undefined && (maxAttempts < 0 || maxAttempts > 10)) {
+    throw new InvalidConfigException({
+      message: 'options.fallback.retry.maxAttempts must be between 0 and 10'
+    });
+  }
+  const baseDelayMs = options.fallback?.retry?.baseDelayMs;
+  if (baseDelayMs !== undefined && baseDelayMs <= 0) {
+    throw new InvalidConfigException({
+      message: 'options.fallback.retry.baseDelayMs must be greater than 0'
+    });
+  }
+  const rolloutPercentage = options.policy?.rolloutPercentage;
+  if (rolloutPercentage !== undefined && (rolloutPercentage < 0 || rolloutPercentage > 100)) {
+    throw new InvalidConfigException({
+      message: 'options.policy.rolloutPercentage must be between 0 and 100'
+    });
+  }
+}
+//# sourceMappingURL=ConfigValidator.js.map

package/lib/module/data/config/ConfigValidator.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["parseVersion","InvalidConfigException","validateOptions","options","stores","Object","keys","length","message","appVersion","undefined","error","cause","policy","forceUpdateBelow","timeoutMs","fallback","requestTimeoutMs","ttlMs","cache","maxAttempts","retry","baseDelayMs","rolloutPercentage"],"sourceRoot":"../../../../src","sources":["data/config/ConfigValidator.ts"],"mappings":";;AAAA,SAASA,YAAY,QAAQ,6CAA0C;AACvE,SAASC,sBAAsB,QAAQ,gDAA6C;AAGpF;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,eAAeA,CAACC,OAA8B,EAAQ;EACpE,IAAI,CAACA,OAAO,CAACC,MAAM,IAAIC,MAAM,CAACC,IAAI,CAACH,OAAO,CAACC,MAAM,CAAC,CAACG,MAAM,KAAK,CAAC,EAAE;IAC/D,MAAM,IAAIN,sBAAsB,CAAC;MAC/BO,OAAO,EACL;IACJ,CAAC,CAAC;EACJ;EAEA,IAAIL,OAAO,CAACM,UAAU,KAAKC,SAAS,EAAE;IACpC,IAAI;MACFV,YAAY,CAACG,OAAO,CAACM,UAAU,CAAC;IAClC,CAAC,CAAC,OAAOE,KAAK,EAAE;MACd,MAAM,IAAIV,sBAAsB,CAAC;QAC/BO,OAAO,EAAE,uBAAuBL,OAAO,CAACM,UAAU,gCAAgC;QAClFG,KAAK,EAAED;MACT,CAAC,CAAC;IACJ;EACF;EAEA,IAAIR,OAAO,CAACU,MAAM,EAAEC,gBAAgB,KAAKJ,SAAS,EAAE;IAClD,IAAI;MACFV,YAAY,CAACG,OAAO,CAACU,MAAM,CAACC,gBAAgB,CAAC;IAC/C,CAAC,CAAC,OAAOH,KAAK,EAAE;MACd,MAAM,IAAIV,sBAAsB,CAAC;QAC/BO,OAAO,EAAE,oCAAoCL,OAAO,CAACU,MAAM,CAACC,gBAAgB,gCAAgC;QAC5GF,KAAK,EAAED;MACT,CAAC,CAAC;IACJ;EACF;EAEA,MAAMI,SAAS,GAAGZ,OAAO,CAACa,QAAQ,EAAEC,gBAAgB;EACpD,IAAIF,SAAS,KAAKL,SAAS,IAAIK,SAAS,IAAI,CAAC,EAAE;IAC7C,MAAM,IAAId,sBAAsB,CAAC;MAC/BO,OAAO,EAAE;IACX,CAAC,CAAC;EACJ;EAEA,MAAMU,KAAK,GAAGf,OAAO,CAACgB,KAAK,EAAED,KAAK;EAClC,IAAIA,KAAK,KAAKR,SAAS,IAAIQ,KAAK,GAAG,CAAC,EAAE;IACpC,MAAM,IAAIjB,sBAAsB,CAAC;MAC/BO,OAAO,EAAE;IACX,CAAC,CAAC;EACJ;EAEA,MAAMY,WAAW,GAAGjB,OAAO,CAACa,QAAQ,EAAEK,KAAK,EAAED,WAAW;EACxD,IAAIA,WAAW,KAAKV,SAAS,KAAKU,WAAW,GAAG,CAAC,IAAIA,WAAW,GAAG,EAAE,CAAC,EAAE;IACtE,MAAM,IAAInB,sBAAsB,CAAC;MAC/BO,OAAO,EAAE;IACX,CAAC,CAAC;EACJ;EAEA,MAAMc,WAAW,GAAGnB,OAAO,CAACa,QAAQ,EAAEK,KAAK,EAAEC,WAAW;EACxD,IAAIA,WAAW,KAAKZ,SAAS,IAAIY,WAAW,IAAI,CAAC,EAAE;IACjD,MAAM,IAAIrB,sBAAsB,CAAC;MAC/BO,OAAO,EAAE;IACX,CAAC,CAAC;EACJ;EAEA,MAAMe,iBAAiB,GAAGpB,OAAO,CAACU,MAAM,EAAEU,iBAAiB;EAC3D,IACEA,iBAAiB,KAAKb,SAAS,KAC9Ba,iBAAiB,GAAG,CAAC,IAAIA,iBAAiB,GAAG,GAAG,CAAC,EAClD;IACA,MAAM,IAAItB,sBAAsB,CAAC;MAC/BO,OAAO,EAAE;IACX,CAAC,CAAC;EACJ;AACF","ignoreList":[]}

package/lib/module/data/config/SignatureVerifier.js

@@ -0,0 +1,80 @@
+"use strict";
+
+import { canonicalize, utf8ToBase64 } from "./canonicalize.js";
+function isDev() {
+  return typeof __DEV__ !== 'undefined' && __DEV__ === true;
+}
+
+/**
+ * Doc 03 §3.2/§3.4 — verification calls are implemented using OS-provided cryptography
+ * exclusively (iOS CryptoKit/Security.framework, Android java.security), reached through
+ * IPlatformBridge.crypto (ICryptoProvider) so this class never itself hand-rolls
+ * cryptographic primitives (Prompt 1 §9.3's zero-external-dependency constraint extends
+ * to "don't implement crypto in JS either" — only OS APIs are trusted for this).
+ */
+export class SignatureVerifier {
+  constructor(crypto) {
+    this.crypto = crypto;
+  }
+  async verify(envelope, trustedKeys) {
+    const {
+      algorithm,
+      keyId,
+      value
+    } = envelope.signature;
+
+    // §3.1: algorithm "none" is permitted only for the local bundled document in
+    // development builds — rejected for any remote fetch and for release builds,
+    // enforced here regardless of what security.signatureAlgorithm claims (a
+    // compromised document cannot downgrade its own algorithm to "none" and be
+    // believed). The pipeline is responsible for only calling verify() with a "none"
+    // envelope on the local-dev path in the first place; this is a defense-in-depth
+    // second check.
+    if (algorithm === 'none') {
+      if (!isDev()) {
+        return {
+          valid: false,
+          reason: 'signature.algorithm "none" is rejected outside development builds'
+        };
+      }
+      return {
+        valid: true
+      };
+    }
+    if (trustedKeys.algorithm !== algorithm) {
+      return {
+        valid: false,
+        reason: `Envelope algorithm "${algorithm}" does not match configured security.signatureAlgorithm "${trustedKeys.algorithm}"`
+      };
+    }
+    if (!trustedKeys.keys.has(keyId)) {
+      return {
+        valid: false,
+        reason: `keyId "${keyId}" is not present in security.trustedKeyIds`
+      };
+    }
+    if (!this.crypto) {
+      return {
+        valid: false,
+        reason: 'No ICryptoProvider available on the active IPlatformBridge — cannot verify signatures on this target'
+      };
+    }
+    const canonicalPayload = canonicalize(envelope.payload);
+    const messageBase64 = utf8ToBase64(canonicalPayload);
+    try {
+      const valid = algorithm === 'ed25519' ? await this.crypto.verifyEd25519(keyId, messageBase64, value) : await this.crypto.verifyHmacSha256(keyId, messageBase64, value);
+      return valid ? {
+        valid: true
+      } : {
+        valid: false,
+        reason: 'Signature mismatch'
+      };
+    } catch (error) {
+      return {
+        valid: false,
+        reason: `Native signature verification threw: ${String(error)}`
+      };
+    }
+  }
+}
+//# sourceMappingURL=SignatureVerifier.js.map

package/lib/module/data/config/SignatureVerifier.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["canonicalize","utf8ToBase64","isDev","__DEV__","SignatureVerifier","constructor","crypto","verify","envelope","trustedKeys","algorithm","keyId","value","signature","valid","reason","keys","has","canonicalPayload","payload","messageBase64","verifyEd25519","verifyHmacSha256","error","String"],"sourceRoot":"../../../../src","sources":["data/config/SignatureVerifier.ts"],"mappings":";;AAAA,SAASA,YAAY,EAAEC,YAAY,QAAQ,mBAAgB;AAW3D,SAASC,KAAKA,CAAA,EAAY;EACxB,OAAO,OAAOC,OAAO,KAAK,WAAW,IAAIA,OAAO,KAAK,IAAI;AAC3D;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,iBAAiB,CAA+B;EAC3DC,WAAWA,CAAkBC,MAAwB,EAAE;IAAA,KAA1BA,MAAwB,GAAxBA,MAAwB;EAAG;EAExD,MAAMC,MAAMA,CACVC,QAA8B,EAC9BC,WAA0B,EACY;IACtC,MAAM;MAAEC,SAAS;MAAEC,KAAK;MAAEC;IAAM,CAAC,GAAGJ,QAAQ,CAACK,SAAS;;IAEtD;IACA;IACA;IACA;IACA;IACA;IACA;IACA,IAAIH,SAAS,KAAK,MAAM,EAAE;MACxB,IAAI,CAACR,KAAK,CAAC,CAAC,EAAE;QACZ,OAAO;UACLY,KAAK,EAAE,KAAK;UACZC,MAAM,EACJ;QACJ,CAAC;MACH;MACA,OAAO;QAAED,KAAK,EAAE;MAAK,CAAC;IACxB;IAEA,IAAIL,WAAW,CAACC,SAAS,KAAKA,SAAS,EAAE;MACvC,OAAO;QACLI,KAAK,EAAE,KAAK;QACZC,MAAM,EAAE,uBAAuBL,SAAS,4DAA4DD,WAAW,CAACC,SAAS;MAC3H,CAAC;IACH;IAEA,IAAI,CAACD,WAAW,CAACO,IAAI,CAACC,GAAG,CAACN,KAAK,CAAC,EAAE;MAChC,OAAO;QACLG,KAAK,EAAE,KAAK;QACZC,MAAM,EAAE,UAAUJ,KAAK;MACzB,CAAC;IACH;IAEA,IAAI,CAAC,IAAI,CAACL,MAAM,EAAE;MAChB,OAAO;QACLQ,KAAK,EAAE,KAAK;QACZC,MAAM,EACJ;MACJ,CAAC;IACH;IAEA,MAAMG,gBAAgB,GAAGlB,YAAY,CAACQ,QAAQ,CAACW,OAAO,CAAC;IACvD,MAAMC,aAAa,GAAGnB,YAAY,CAACiB,gBAAgB,CAAC;IAEpD,IAAI;MACF,MAAMJ,KAAK,GACTJ,SAAS,KAAK,SAAS,GACnB,MAAM,IAAI,CAACJ,MAAM,CAACe,aAAa,CAACV,KAAK,EAAES,aAAa,EAAER,KAAK,CAAC,GAC5D,MAAM,IAAI,CAACN,MAAM,CAACgB,gBAAgB,CAACX,KAAK,EAAES,aAAa,EAAER,KAAK,CAAC;MACrE,OAAOE,KAAK,GACR;QAAEA,KAAK,EAAE;MAAK,CAAC,GACf;QAAEA,KAAK,EAAE,KAAK;QAAEC,MAAM,EAAE;MAAqB,CAAC;IACpD,CAAC,CAAC,OAAOQ,KAAK,EAAE;MACd,OAAO;QACLT,KAAK,EAAE,KAAK;QACZC,MAAM,EAAE,wCAAwCS,MAAM,CAACD,KAAK,CAAC;MAC/D,CAAC;IACH;EACF;AACF","ignoreList":[]}

package/lib/module/data/config/canonicalize.js

@@ -0,0 +1,88 @@
+"use strict";
+
+/**
+ * Hand-rolled canonicalizer (Prompt 1 §9.3 zero-dependency constraint), implementing the
+ * same principles as RFC 8785 (JSON Canonicalization Scheme) that doc 03 §3.3 calls for:
+ * recursive key sorting by UTF-16 code unit order, fixed number formatting, no
+ * insignificant whitespace. Signatures are computed/verified over this canonical byte
+ * form so that whitespace/key-order differences in transit never invalidate a
+ * legitimately signed document.
+ */
+
+function canonicalizeValue(value) {
+  if (value === null) return 'null';
+  if (typeof value === 'boolean') return value ? 'true' : 'false';
+  if (typeof value === 'number') return canonicalizeNumber(value);
+  if (typeof value === 'string') return JSON.stringify(value);
+  if (Array.isArray(value)) {
+    return `[${value.map(canonicalizeValue).join(',')}]`;
+  }
+
+  // Recursive key sorting, UTF-16 code unit order (default JS string `<` comparison).
+  const keys = Object.keys(value).sort();
+  const members = keys.map(key => `${JSON.stringify(key)}:${canonicalizeValue(value[key])}`);
+  return `{${members.join(',')}}`;
+}
+
+/**
+ * Fixed number formatting per RFC 8785 §3.2.2.3 (simplified): integers render without a
+ * decimal point/exponent; this codebase's config schema (doc 03 §6) only ever contains
+ * integers and no fractional/exponential numeric fields, so the full ECMA-262
+ * Number::toString algorithm RFC 8785 mandates is unnecessary here.
+ */
+function canonicalizeNumber(value) {
+  if (!Number.isFinite(value)) {
+    throw new Error('Cannot canonicalize a non-finite number');
+  }
+  if (Number.isInteger(value)) return String(value);
+  return String(value);
+}
+
+/** Canonical byte sequence (as a UTF-8 string) for the given JSON-compatible value. */
+export function canonicalize(value) {
+  return canonicalizeValue(value);
+}
+
+/** Base64 encoding of the UTF-8 bytes of a string, without relying on Node's Buffer. */
+export function utf8ToBase64(input) {
+  if (typeof btoa === 'function' && typeof TextEncoder !== 'undefined') {
+    const bytes = new TextEncoder().encode(input);
+    let binary = '';
+    for (let i = 0; i < bytes.length; i++) {
+      binary += String.fromCharCode(bytes[i]);
+    }
+    return btoa(binary);
+  }
+  // React Native's Hermes engine provides global Buffer via a polyfill in most RN
+  // setups, but not guaranteed — fall back to a minimal hand-rolled base64 encoder.
+  return manualUtf8ToBase64(input);
+}
+const BASE64_CHARS = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';
+function manualUtf8ToBase64(input) {
+  const bytes = [];
+  for (let i = 0; i < input.length; i++) {
+    let code = input.codePointAt(i);
+    if (code > 0xffff) i++; // consumed a surrogate pair
+    if (code < 0x80) {
+      bytes.push(code);
+    } else if (code < 0x800) {
+      bytes.push(0xc0 | code >> 6, 0x80 | code & 0x3f);
+    } else if (code < 0x10000) {
+      bytes.push(0xe0 | code >> 12, 0x80 | code >> 6 & 0x3f, 0x80 | code & 0x3f);
+    } else {
+      bytes.push(0xf0 | code >> 18, 0x80 | code >> 12 & 0x3f, 0x80 | code >> 6 & 0x3f, 0x80 | code & 0x3f);
+    }
+  }
+  let output = '';
+  for (let i = 0; i < bytes.length; i += 3) {
+    const b0 = bytes[i];
+    const b1 = bytes[i + 1];
+    const b2 = bytes[i + 2];
+    output += BASE64_CHARS[b0 >> 2];
+    output += BASE64_CHARS[(b0 & 0x03) << 4 | (b1 ?? 0) >> 4];
+    output += b1 === undefined ? '=' : BASE64_CHARS[(b1 & 0x0f) << 2 | (b2 ?? 0) >> 6];
+    output += b2 === undefined ? '=' : BASE64_CHARS[b2 & 0x3f];
+  }
+  return output;
+}
+//# sourceMappingURL=canonicalize.js.map

package/lib/module/data/config/canonicalize.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["canonicalizeValue","value","canonicalizeNumber","JSON","stringify","Array","isArray","map","join","keys","Object","sort","members","key","Number","isFinite","Error","isInteger","String","canonicalize","utf8ToBase64","input","btoa","TextEncoder","bytes","encode","binary","i","length","fromCharCode","manualUtf8ToBase64","BASE64_CHARS","code","codePointAt","push","output","b0","b1","b2","undefined"],"sourceRoot":"../../../../src","sources":["data/config/canonicalize.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAKA,SAASA,iBAAiBA,CAACC,KAAgB,EAAU;EACnD,IAAIA,KAAK,KAAK,IAAI,EAAE,OAAO,MAAM;EAEjC,IAAI,OAAOA,KAAK,KAAK,SAAS,EAAE,OAAOA,KAAK,GAAG,MAAM,GAAG,OAAO;EAE/D,IAAI,OAAOA,KAAK,KAAK,QAAQ,EAAE,OAAOC,kBAAkB,CAACD,KAAK,CAAC;EAE/D,IAAI,OAAOA,KAAK,KAAK,QAAQ,EAAE,OAAOE,IAAI,CAACC,SAAS,CAACH,KAAK,CAAC;EAE3D,IAAII,KAAK,CAACC,OAAO,CAACL,KAAK,CAAC,EAAE;IACxB,OAAO,IAAIA,KAAK,CAACM,GAAG,CAACP,iBAAiB,CAAC,CAACQ,IAAI,CAAC,GAAG,CAAC,GAAG;EACtD;;EAEA;EACA,MAAMC,IAAI,GAAGC,MAAM,CAACD,IAAI,CAACR,KAAK,CAAC,CAACU,IAAI,CAAC,CAAC;EACtC,MAAMC,OAAO,GAAGH,IAAI,CAACF,GAAG,CACrBM,GAAG,IACF,GAAGV,IAAI,CAACC,SAAS,CAACS,GAAG,CAAC,IAAIb,iBAAiB,CAACC,KAAK,CAACY,GAAG,CAAc,CAAC,EACxE,CAAC;EACD,OAAO,IAAID,OAAO,CAACJ,IAAI,CAAC,GAAG,CAAC,GAAG;AACjC;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA,SAASN,kBAAkBA,CAACD,KAAa,EAAU;EACjD,IAAI,CAACa,MAAM,CAACC,QAAQ,CAACd,KAAK,CAAC,EAAE;IAC3B,MAAM,IAAIe,KAAK,CAAC,yCAAyC,CAAC;EAC5D;EACA,IAAIF,MAAM,CAACG,SAAS,CAAChB,KAAK,CAAC,EAAE,OAAOiB,MAAM,CAACjB,KAAK,CAAC;EACjD,OAAOiB,MAAM,CAACjB,KAAK,CAAC;AACtB;;AAEA;AACA,OAAO,SAASkB,YAAYA,CAAClB,KAAc,EAAU;EACnD,OAAOD,iBAAiB,CAACC,KAAkB,CAAC;AAC9C;;AAEA;AACA,OAAO,SAASmB,YAAYA,CAACC,KAAa,EAAU;EAClD,IAAI,OAAOC,IAAI,KAAK,UAAU,IAAI,OAAOC,WAAW,KAAK,WAAW,EAAE;IACpE,MAAMC,KAAK,GAAG,IAAID,WAAW,CAAC,CAAC,CAACE,MAAM,CAACJ,KAAK,CAAC;IAC7C,IAAIK,MAAM,GAAG,EAAE;IACf,KAAK,IAAIC,CAAC,GAAG,CAAC,EAAEA,CAAC,GAAGH,KAAK,CAACI,MAAM,EAAED,CAAC,EAAE,EAAE;MACrCD,MAAM,IAAIR,MAAM,CAACW,YAAY,CAACL,KAAK,CAACG,CAAC,CAAW,CAAC;IACnD;IACA,OAAOL,IAAI,CAACI,MAAM,CAAC;EACrB;EACA;EACA;EACA,OAAOI,kBAAkB,CAACT,KAAK,CAAC;AAClC;AAEA,MAAMU,YAAY,GAChB,kEAAkE;AAEpE,SAASD,kBAAkBA,CAACT,KAAa,EAAU;EACjD,MAAMG,KAAe,GAAG,EAAE;EAC1B,KAAK,IAAIG,CAAC,GAAG,CAAC,EAAEA,CAAC,GAAGN,KAAK,CAACO,MAAM,EAAED,CAAC,EAAE,EAAE;IACrC,IAAIK,IAAI,GAAGX,KAAK,CAACY,WAAW,CAACN,CAAC,CAAW;IACzC,IAAIK,IAAI,GAAG,MAAM,EAAEL,CAAC,EAAE,CAAC,CAAC;IACxB,IAAIK,IAAI,GAAG,IAAI,EAAE;MACfR,KAAK,CAACU,IAAI,CAACF,IAAI,CAAC;IAClB,CAAC,MAAM,IAAIA,IAAI,GAAG,KAAK,EAAE;MACvBR,KAAK,CAACU,IAAI,CAAC,IAAI,GAAIF,IAAI,IAAI,CAAE,EAAE,IAAI,GAAIA,IAAI,GAAG,IAAK,CAAC;IACtD,CAAC,MAAM,IAAIA,IAAI,GAAG,OAAO,EAAE;MACzBR,KAAK,CAACU,IAAI,CACR,IAAI,GAAIF,IAAI,IAAI,EAAG,EACnB,IAAI,GAAKA,IAAI,IAAI,CAAC,GAAI,IAAK,EAC3B,IAAI,GAAIA,IAAI,GAAG,IACjB,CAAC;IACH,CAAC,MAAM;MACLR,KAAK,CAACU,IAAI,CACR,IAAI,GAAIF,IAAI,IAAI,EAAG,EACnB,IAAI,GAAKA,IAAI,IAAI,EAAE,GAAI,IAAK,EAC5B,IAAI,GAAKA,IAAI,IAAI,CAAC,GAAI,IAAK,EAC3B,IAAI,GAAIA,IAAI,GAAG,IACjB,CAAC;IACH;EACF;EAEA,IAAIG,MAAM,GAAG,EAAE;EACf,KAAK,IAAIR,CAAC,GAAG,CAAC,EAAEA,CAAC,GAAGH,KAAK,CAACI,MAAM,EAAED,CAAC,IAAI,CAAC,EAAE;IACxC,MAAMS,EAAE,GAAGZ,KAAK,CAACG,CAAC,CAAW;IAC7B,MAAMU,EAAE,GAAGb,KAAK,CAACG,CAAC,GAAG,CAAC,CAAC;IACvB,MAAMW,EAAE,GAAGd,KAAK,CAACG,CAAC,GAAG,CAAC,CAAC;IACvBQ,MAAM,IAAIJ,YAAY,CAACK,EAAE,IAAI,CAAC,CAAC;IAC/BD,MAAM,IAAIJ,YAAY,CAAE,CAACK,EAAE,GAAG,IAAI,KAAK,CAAC,GAAK,CAACC,EAAE,IAAI,CAAC,KAAK,CAAE,CAAC;IAC7DF,MAAM,IACJE,EAAE,KAAKE,SAAS,GACZ,GAAG,GACHR,YAAY,CAAE,CAACM,EAAE,GAAG,IAAI,KAAK,CAAC,GAAK,CAACC,EAAE,IAAI,CAAC,KAAK,CAAE,CAAC;IACzDH,MAAM,IAAIG,EAAE,KAAKC,SAAS,GAAG,GAAG,GAAGR,YAAY,CAACO,EAAE,GAAG,IAAI,CAAC;EAC5D;EACA,OAAOH,MAAM;AACf","ignoreList":[]}

package/lib/module/data/config/sources/EnvironmentOverrideSource.js

@@ -0,0 +1,20 @@
+"use strict";
+
+/**
+ * Doc 03 §4 — "there is no OS process environment on a device"; this tier maps to
+ * build-time-injected constants and explicit runtime overrides, not `process.env` on a
+ * server. Build-time constants (Info.plist / BuildConfig fields) are app-specific and
+ * have no generic cross-platform read path from JS, so this implementation covers the
+ * "explicit configure({ configSources: { envOverrides } })" half of §4.1 tier 1 — the
+ * build-time-constant half is a per-app integration concern (documented, not a gap in
+ * this port's contract, which only promises "read whatever overrides are available").
+ */
+export class EnvironmentOverrideSource {
+  constructor(overrides) {
+    this.overrides = overrides;
+  }
+  async read() {
+    return this.overrides ?? {};
+  }
+}
+//# sourceMappingURL=EnvironmentOverrideSource.js.map

package/lib/module/data/config/sources/EnvironmentOverrideSource.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["EnvironmentOverrideSource","constructor","overrides","read"],"sourceRoot":"../../../../../src","sources":["data/config/sources/EnvironmentOverrideSource.ts"],"mappings":";;AAGA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMA,yBAAyB,CAAuC;EAC3EC,WAAWA,CACQC,SACkC,EACnD;IAAA,KAFiBA,SACkC,GADlCA,SACkC;EAClD;EAEH,MAAMC,IAAIA,CAAA,EAAmD;IAC3D,OAAO,IAAI,CAACD,SAAS,IAAI,CAAC,CAAC;EAC7B;AACF","ignoreList":[]}

package/lib/module/data/config/sources/LocalConfigSource.js

@@ -0,0 +1,22 @@
+"use strict";
+
+/**
+ * Doc 03 §5.1 — the design calls for a native mmap reader (iOS Data(alwaysMapped),
+ * Android FileChannel.map) to avoid a double-copy when reading a bundled config asset.
+ * This implementation takes a documented, lower-risk equivalent instead: the host app
+ * imports its bundled config JSON via Metro/webpack's native JSON module support
+ * (`import localConfig from './vm-config.json'`) and passes the parsed envelope through
+ * `VersionManagerOptions.configSources.local`. Metro's JSON loader already avoids the
+ * page-cache -> native-heap -> JS-heap double copy for typical bundle sizes (the asset
+ * is compiled into the JS bundle itself), which satisfies §5.1's actual goal (avoid GC
+ * churn against the 5MB budget for a <=64KB document) without a dedicated native reader.
+ */
+export class LocalConfigSource {
+  constructor(envelope) {
+    this.envelope = envelope;
+  }
+  async read() {
+    return this.envelope ?? null;
+  }
+}
+//# sourceMappingURL=LocalConfigSource.js.map

package/lib/module/data/config/sources/LocalConfigSource.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["LocalConfigSource","constructor","envelope","read"],"sourceRoot":"../../../../../src","sources":["data/config/sources/LocalConfigSource.ts"],"mappings":";;AAMA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMA,iBAAiB,CAA+B;EAC3DC,WAAWA,CAAkBC,QAA0C,EAAE;IAAA,KAA5CA,QAA0C,GAA1CA,QAA0C;EAAG;EAE1E,MAAMC,IAAIA,CAAA,EAAsC;IAC9C,OAAO,IAAI,CAACD,QAAQ,IAAI,IAAI;EAC9B;AACF","ignoreList":[]}

package/lib/module/data/config/sources/RemoteConfigSource.js

@@ -0,0 +1,38 @@
+"use strict";
+
+import { OfflineException, StoreResponseParseException } from "../../../domain/errors/VersionManagerException.js";
+/** Doc 03 §4.3 — the remote-fetch tier, reached through the same IHttpClient port every other network call in this SDK uses. */
+export class RemoteConfigSource {
+  constructor(http) {
+    this.http = http;
+  }
+  async fetch(url, options) {
+    const response = await this.http.request({
+      url,
+      method: 'GET',
+      headers: options.headers,
+      timeoutMs: options.timeoutMs
+    });
+    if (response.status !== 200) {
+      throw new OfflineException({
+        message: `Remote config fetch returned HTTP ${response.status}`,
+        metadata: {
+          url,
+          status: response.status
+        }
+      });
+    }
+    try {
+      return JSON.parse(response.body);
+    } catch (error) {
+      throw new StoreResponseParseException({
+        message: 'Remote config endpoint returned malformed JSON',
+        cause: error,
+        metadata: {
+          url
+        }
+      });
+    }
+  }
+}
+//# sourceMappingURL=RemoteConfigSource.js.map

package/lib/module/data/config/sources/RemoteConfigSource.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["OfflineException","StoreResponseParseException","RemoteConfigSource","constructor","http","fetch","url","options","response","request","method","headers","timeoutMs","status","message","metadata","JSON","parse","body","error","cause"],"sourceRoot":"../../../../../src","sources":["data/config/sources/RemoteConfigSource.ts"],"mappings":";;AAAA,SACEA,gBAAgB,EAChBC,2BAA2B,QACtB,mDAAgD;AAQvD;AACA,OAAO,MAAMC,kBAAkB,CAAgC;EAC7DC,WAAWA,CAAkBC,IAAiB,EAAE;IAAA,KAAnBA,IAAiB,GAAjBA,IAAiB;EAAG;EAEjD,MAAMC,KAAKA,CAACC,GAAW,EAAEC,OAAqB,EAA8B;IAC1E,MAAMC,QAAQ,GAAG,MAAM,IAAI,CAACJ,IAAI,CAACK,OAAO,CAAC;MACvCH,GAAG;MACHI,MAAM,EAAE,KAAK;MACbC,OAAO,EAAEJ,OAAO,CAACI,OAAO;MACxBC,SAAS,EAAEL,OAAO,CAACK;IACrB,CAAC,CAAC;IAEF,IAAIJ,QAAQ,CAACK,MAAM,KAAK,GAAG,EAAE;MAC3B,MAAM,IAAIb,gBAAgB,CAAC;QACzBc,OAAO,EAAE,qCAAqCN,QAAQ,CAACK,MAAM,EAAE;QAC/DE,QAAQ,EAAE;UAAET,GAAG;UAAEO,MAAM,EAAEL,QAAQ,CAACK;QAAO;MAC3C,CAAC,CAAC;IACJ;IAEA,IAAI;MACF,OAAOG,IAAI,CAACC,KAAK,CAACT,QAAQ,CAACU,IAAI,CAAC;IAClC,CAAC,CAAC,OAAOC,KAAK,EAAE;MACd,MAAM,IAAIlB,2BAA2B,CAAC;QACpCa,OAAO,EAAE,gDAAgD;QACzDM,KAAK,EAAED,KAAK;QACZJ,QAAQ,EAAE;UAAET;QAAI;MAClB,CAAC,CAAC;IACJ;EACF;AACF","ignoreList":[]}

package/lib/module/data/providers/amazon/AmazonAppstoreProvider.js

@@ -0,0 +1,13 @@
+"use strict";
+
+import { UnsupportedStoreException } from "../../../domain/errors/VersionManagerException.js";
+/** Not yet implemented — see Prompt 11 in the design series. */
+export class AmazonAppstoreProvider {
+  id = 'amazon';
+  async fetchLatestVersionInfo() {
+    throw new UnsupportedStoreException({
+      message: 'Amazon Appstore provider is not yet implemented — see Prompt 11 in the design series'
+    });
+  }
+}
+//# sourceMappingURL=AmazonAppstoreProvider.js.map

package/lib/module/data/providers/amazon/AmazonAppstoreProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["UnsupportedStoreException","AmazonAppstoreProvider","id","fetchLatestVersionInfo","message"],"sourceRoot":"../../../../../src","sources":["data/providers/amazon/AmazonAppstoreProvider.ts"],"mappings":";;AAAA,SAASA,yBAAyB,QAAQ,mDAAgD;AAK1F;AACA,OAAO,MAAMC,sBAAsB,CAA2B;EACnDC,EAAE,GAAoB,QAAQ;EAEvC,MAAMC,sBAAsBA,CAAA,EAA+B;IACzD,MAAM,IAAIH,yBAAyB,CAAC;MAClCI,OAAO,EACL;IACJ,CAAC,CAAC;EACJ;AACF","ignoreList":[]}

package/lib/module/data/providers/apple/AppleStoreProvider.js

@@ -0,0 +1,67 @@
+"use strict";
+
+import { AppNotFoundException, RateLimitException, StoreResponseParseException } from "../../../domain/errors/VersionManagerException.js";
+/**
+ * Real implementation against the public iTunes Lookup API (Prompt 10). Accepts either
+ * the numeric App Store Connect id (`id=`) or, when the app developer doesn't want to
+ * hardcode one, falls back to looking the app up by its own bundle id (`bundleId=`) —
+ * the iTunes Lookup API supports both query params equivalently.
+ */
+export class AppleStoreProvider {
+  id = 'apple';
+  constructor(http, appStoreId, region = 'us') {
+    this.http = http;
+    this.appStoreId = appStoreId;
+    this.region = region;
+  }
+  async fetchLatestVersionInfo(request) {
+    const country = request.region ?? this.region;
+    const identifierParam = this.appStoreId ? `id=${encodeURIComponent(this.appStoreId)}` : `bundleId=${encodeURIComponent(request.bundleId)}`;
+    const url = `https://itunes.apple.com/lookup?${identifierParam}&country=${encodeURIComponent(country)}`;
+    const response = await this.http.request({
+      url,
+      method: 'GET',
+      timeoutMs: request.timeoutMs
+    });
+    const identifier = this.appStoreId ?? request.bundleId;
+    if (response.status === 429) {
+      throw new RateLimitException({
+        message: 'Apple iTunes Lookup API rate limit exceeded (HTTP 429)'
+      });
+    }
+    if (response.status !== 200) {
+      throw new AppNotFoundException({
+        message: `Apple iTunes Lookup API returned HTTP ${response.status}`,
+        metadata: {
+          identifier,
+          status: response.status
+        }
+      });
+    }
+    let payload;
+    try {
+      payload = JSON.parse(response.body);
+    } catch (error) {
+      throw new StoreResponseParseException({
+        message: 'Apple iTunes Lookup API returned malformed JSON',
+        cause: error
+      });
+    }
+    const result = payload.results[0];
+    if (!result) {
+      throw new AppNotFoundException({
+        message: `No app found in the App Store for "${identifier}"`,
+        metadata: {
+          identifier
+        }
+      });
+    }
+    return {
+      latestVersion: result.version,
+      storeUrl: result.trackViewUrl,
+      releaseNotes: result.releaseNotes ?? null,
+      minimumOsVersion: result.minimumOsVersion ?? null
+    };
+  }
+}
+//# sourceMappingURL=AppleStoreProvider.js.map

package/lib/module/data/providers/apple/AppleStoreProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["AppNotFoundException","RateLimitException","StoreResponseParseException","AppleStoreProvider","id","constructor","http","appStoreId","region","fetchLatestVersionInfo","request","country","identifierParam","encodeURIComponent","bundleId","url","response","method","timeoutMs","identifier","status","message","metadata","payload","JSON","parse","body","error","cause","result","results","latestVersion","version","storeUrl","trackViewUrl","releaseNotes","minimumOsVersion"],"sourceRoot":"../../../../../src","sources":["data/providers/apple/AppleStoreProvider.ts"],"mappings":";;AAAA,SACEA,oBAAoB,EACpBC,kBAAkB,EAClBC,2BAA2B,QACtB,mDAAgD;AAqBvD;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,kBAAkB,CAA2B;EAC/CC,EAAE,GAAoB,OAAO;EAEtCC,WAAWA,CACQC,IAAiB,EACjBC,UAAmB,EACnBC,MAAc,GAAG,IAAI,EACtC;IAAA,KAHiBF,IAAiB,GAAjBA,IAAiB;IAAA,KACjBC,UAAmB,GAAnBA,UAAmB;IAAA,KACnBC,MAAc,GAAdA,MAAc;EAC9B;EAEH,MAAMC,sBAAsBA,CAC1BC,OAA2B,EACC;IAC5B,MAAMC,OAAO,GAAGD,OAAO,CAACF,MAAM,IAAI,IAAI,CAACA,MAAM;IAC7C,MAAMI,eAAe,GAAG,IAAI,CAACL,UAAU,GACnC,MAAMM,kBAAkB,CAAC,IAAI,CAACN,UAAU,CAAC,EAAE,GAC3C,YAAYM,kBAAkB,CAACH,OAAO,CAACI,QAAQ,CAAC,EAAE;IACtD,MAAMC,GAAG,GAAG,mCAAmCH,eAAe,YAAYC,kBAAkB,CAACF,OAAO,CAAC,EAAE;IACvG,MAAMK,QAAQ,GAAG,MAAM,IAAI,CAACV,IAAI,CAACI,OAAO,CAAC;MACvCK,GAAG;MACHE,MAAM,EAAE,KAAK;MACbC,SAAS,EAAER,OAAO,CAACQ;IACrB,CAAC,CAAC;IAEF,MAAMC,UAAU,GAAG,IAAI,CAACZ,UAAU,IAAIG,OAAO,CAACI,QAAQ;IAEtD,IAAIE,QAAQ,CAACI,MAAM,KAAK,GAAG,EAAE;MAC3B,MAAM,IAAInB,kBAAkB,CAAC;QAC3BoB,OAAO,EAAE;MACX,CAAC,CAAC;IACJ;IACA,IAAIL,QAAQ,CAACI,MAAM,KAAK,GAAG,EAAE;MAC3B,MAAM,IAAIpB,oBAAoB,CAAC;QAC7BqB,OAAO,EAAE,yCAAyCL,QAAQ,CAACI,MAAM,EAAE;QACnEE,QAAQ,EAAE;UAAEH,UAAU;UAAEC,MAAM,EAAEJ,QAAQ,CAACI;QAAO;MAClD,CAAC,CAAC;IACJ;IAEA,IAAIG,OAA4B;IAChC,IAAI;MACFA,OAAO,GAAGC,IAAI,CAACC,KAAK,CAACT,QAAQ,CAACU,IAAI,CAAwB;IAC5D,CAAC,CAAC,OAAOC,KAAK,EAAE;MACd,MAAM,IAAIzB,2BAA2B,CAAC;QACpCmB,OAAO,EAAE,iDAAiD;QAC1DO,KAAK,EAAED;MACT,CAAC,CAAC;IACJ;IAEA,MAAME,MAAM,GAAGN,OAAO,CAACO,OAAO,CAAC,CAAC,CAAC;IACjC,IAAI,CAACD,MAAM,EAAE;MACX,MAAM,IAAI7B,oBAAoB,CAAC;QAC7BqB,OAAO,EAAE,sCAAsCF,UAAU,GAAG;QAC5DG,QAAQ,EAAE;UAAEH;QAAW;MACzB,CAAC,CAAC;IACJ;IAEA,OAAO;MACLY,aAAa,EAAEF,MAAM,CAACG,OAAO;MAC7BC,QAAQ,EAAEJ,MAAM,CAACK,YAAY;MAC7BC,YAAY,EAAEN,MAAM,CAACM,YAAY,IAAI,IAAI;MACzCC,gBAAgB,EAAEP,MAAM,CAACO,gBAAgB,IAAI;IAC/C,CAAC;EACH;AACF","ignoreList":[]}

package/lib/module/data/providers/custom-api/CustomApiProvider.js

@@ -0,0 +1,51 @@
+"use strict";
+
+import { StorePermissionException, StoreResponseParseException } from "../../../domain/errors/VersionManagerException.js";
+/** Generic enterprise/private-distribution provider (Prompt 12). */
+export class CustomApiProvider {
+  id = 'custom';
+  constructor(http, url, headers = {}) {
+    this.http = http;
+    this.url = url;
+    this.headers = headers;
+  }
+  async fetchLatestVersionInfo(request) {
+    const response = await this.http.request({
+      url: this.url,
+      method: 'GET',
+      headers: this.headers,
+      timeoutMs: request.timeoutMs
+    });
+    if (response.status === 401 || response.status === 403) {
+      throw new StorePermissionException({
+        message: `Custom API rejected the request (HTTP ${response.status})`
+      });
+    }
+    if (response.status !== 200) {
+      throw new StoreResponseParseException({
+        message: `Custom API returned HTTP ${response.status}`
+      });
+    }
+    let payload;
+    try {
+      payload = JSON.parse(response.body);
+    } catch (error) {
+      throw new StoreResponseParseException({
+        message: 'Custom API returned malformed JSON',
+        cause: error
+      });
+    }
+    if (!payload.latestVersion || !payload.storeUrl) {
+      throw new StoreResponseParseException({
+        message: 'Custom API response is missing required fields "latestVersion"/"storeUrl"'
+      });
+    }
+    return {
+      latestVersion: payload.latestVersion,
+      storeUrl: payload.storeUrl,
+      releaseNotes: payload.releaseNotes ?? null,
+      minimumOsVersion: payload.minimumOsVersion ?? null
+    };
+  }
+}
+//# sourceMappingURL=CustomApiProvider.js.map

package/lib/module/data/providers/custom-api/CustomApiProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["StorePermissionException","StoreResponseParseException","CustomApiProvider","id","constructor","http","url","headers","fetchLatestVersionInfo","request","response","method","timeoutMs","status","message","payload","JSON","parse","body","error","cause","latestVersion","storeUrl","releaseNotes","minimumOsVersion"],"sourceRoot":"../../../../../src","sources":["data/providers/custom-api/CustomApiProvider.ts"],"mappings":";;AAAA,SACEA,wBAAwB,EACxBC,2BAA2B,QACtB,mDAAgD;AAgBvD;AACA,OAAO,MAAMC,iBAAiB,CAA2B;EAC9CC,EAAE,GAAoB,QAAQ;EAEvCC,WAAWA,CACQC,IAAiB,EACjBC,GAAW,EACXC,OAAyC,GAAG,CAAC,CAAC,EAC/D;IAAA,KAHiBF,IAAiB,GAAjBA,IAAiB;IAAA,KACjBC,GAAW,GAAXA,GAAW;IAAA,KACXC,OAAyC,GAAzCA,OAAyC;EACzD;EAEH,MAAMC,sBAAsBA,CAC1BC,OAA2B,EACC;IAC5B,MAAMC,QAAQ,GAAG,MAAM,IAAI,CAACL,IAAI,CAACI,OAAO,CAAC;MACvCH,GAAG,EAAE,IAAI,CAACA,GAAG;MACbK,MAAM,EAAE,KAAK;MACbJ,OAAO,EAAE,IAAI,CAACA,OAAO;MACrBK,SAAS,EAAEH,OAAO,CAACG;IACrB,CAAC,CAAC;IAEF,IAAIF,QAAQ,CAACG,MAAM,KAAK,GAAG,IAAIH,QAAQ,CAACG,MAAM,KAAK,GAAG,EAAE;MACtD,MAAM,IAAIb,wBAAwB,CAAC;QACjCc,OAAO,EAAE,yCAAyCJ,QAAQ,CAACG,MAAM;MACnE,CAAC,CAAC;IACJ;IACA,IAAIH,QAAQ,CAACG,MAAM,KAAK,GAAG,EAAE;MAC3B,MAAM,IAAIZ,2BAA2B,CAAC;QACpCa,OAAO,EAAE,4BAA4BJ,QAAQ,CAACG,MAAM;MACtD,CAAC,CAAC;IACJ;IAEA,IAAIE,OAAiC;IACrC,IAAI;MACFA,OAAO,GAAGC,IAAI,CAACC,KAAK,CAACP,QAAQ,CAACQ,IAAI,CAA6B;IACjE,CAAC,CAAC,OAAOC,KAAK,EAAE;MACd,MAAM,IAAIlB,2BAA2B,CAAC;QACpCa,OAAO,EAAE,oCAAoC;QAC7CM,KAAK,EAAED;MACT,CAAC,CAAC;IACJ;IAEA,IAAI,CAACJ,OAAO,CAACM,aAAa,IAAI,CAACN,OAAO,CAACO,QAAQ,EAAE;MAC/C,MAAM,IAAIrB,2BAA2B,CAAC;QACpCa,OAAO,EACL;MACJ,CAAC,CAAC;IACJ;IAEA,OAAO;MACLO,aAAa,EAAEN,OAAO,CAACM,aAAa;MACpCC,QAAQ,EAAEP,OAAO,CAACO,QAAQ;MAC1BC,YAAY,EAAER,OAAO,CAACQ,YAAY,IAAI,IAAI;MAC1CC,gBAAgB,EAAET,OAAO,CAACS,gBAAgB,IAAI;IAChD,CAAC;EACH;AACF","ignoreList":[]}

package/lib/module/data/providers/firebase-remote-config/FirebaseRemoteConfigProvider.js

@@ -0,0 +1,13 @@
+"use strict";
+
+import { UnsupportedStoreException } from "../../../domain/errors/VersionManagerException.js";
+/** Not yet implemented — see Prompt 13 in the design series. */
+export class FirebaseRemoteConfigProvider {
+  id = 'firebase-remote-config';
+  async fetchLatestVersionInfo() {
+    throw new UnsupportedStoreException({
+      message: 'Firebase Remote Config provider is not yet implemented — see Prompt 13 in the design series'
+    });
+  }
+}
+//# sourceMappingURL=FirebaseRemoteConfigProvider.js.map

package/lib/module/data/providers/firebase-remote-config/FirebaseRemoteConfigProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["UnsupportedStoreException","FirebaseRemoteConfigProvider","id","fetchLatestVersionInfo","message"],"sourceRoot":"../../../../../src","sources":["data/providers/firebase-remote-config/FirebaseRemoteConfigProvider.ts"],"mappings":";;AAAA,SAASA,yBAAyB,QAAQ,mDAAgD;AAK1F;AACA,OAAO,MAAMC,4BAA4B,CAA2B;EACzDC,EAAE,GAAoB,wBAAwB;EAEvD,MAAMC,sBAAsBA,CAAA,EAA+B;IACzD,MAAM,IAAIH,yBAAyB,CAAC;MAClCI,OAAO,EACL;IACJ,CAAC,CAAC;EACJ;AACF","ignoreList":[]}

package/lib/module/data/providers/google-play/GooglePlayProvider.js

@@ -0,0 +1,62 @@
+"use strict";
+
+import { AppNotFoundException, StoreResponseParseException } from "../../../domain/errors/VersionManagerException.js";
+/**
+ * Google Play has no public, unauthenticated lookup API (Prompt 10). This provider is a
+ * best-effort parser of the public store listing page's inline JSON blob. It is
+ * inherently fragile — Play Store markup can change without notice — and is offered as
+ * a pragmatic default; production deployments with a Google Play Developer API service
+ * account should prefer a IStoreProvider backed by that authenticated API instead.
+ *
+ * packageName is optional — on Android the app's own bundle id *is* its package name,
+ * so when it's not supplied explicitly this falls back to request.bundleId.
+ */
+export class GooglePlayProvider {
+  id = 'google-play';
+  constructor(http, packageName) {
+    this.http = http;
+    this.packageName = packageName;
+  }
+  async fetchLatestVersionInfo(request) {
+    const packageName = this.packageName ?? request.bundleId;
+    const storeUrl = `https://play.google.com/store/apps/details?id=${encodeURIComponent(packageName)}&hl=en`;
+    const response = await this.http.request({
+      url: storeUrl,
+      method: 'GET',
+      timeoutMs: request.timeoutMs
+    });
+    if (response.status === 404) {
+      throw new AppNotFoundException({
+        message: `No app found on Google Play for package "${packageName}"`,
+        metadata: {
+          packageName
+        }
+      });
+    }
+    if (response.status !== 200) {
+      throw new StoreResponseParseException({
+        message: `Google Play returned HTTP ${response.status}`
+      });
+    }
+    const version = extractPlayStoreVersion(response.body);
+    if (!version) {
+      throw new StoreResponseParseException({
+        message: 'Could not extract a version string from the Google Play store page',
+        metadata: {
+          packageName
+        }
+      });
+    }
+    return {
+      latestVersion: version,
+      storeUrl: `https://play.google.com/store/apps/details?id=${packageName}`,
+      releaseNotes: null,
+      minimumOsVersion: null
+    };
+  }
+}
+function extractPlayStoreVersion(html) {
+  const match = /\[\[\["(\d+(?:\.\d+){1,3})"\]\]/.exec(html);
+  return match?.[1] ?? null;
+}
+//# sourceMappingURL=GooglePlayProvider.js.map

package/lib/module/data/providers/google-play/GooglePlayProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["AppNotFoundException","StoreResponseParseException","GooglePlayProvider","id","constructor","http","packageName","fetchLatestVersionInfo","request","bundleId","storeUrl","encodeURIComponent","response","url","method","timeoutMs","status","message","metadata","version","extractPlayStoreVersion","body","latestVersion","releaseNotes","minimumOsVersion","html","match","exec"],"sourceRoot":"../../../../../src","sources":["data/providers/google-play/GooglePlayProvider.ts"],"mappings":";;AAAA,SACEA,oBAAoB,EACpBC,2BAA2B,QACtB,mDAAgD;AASvD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,kBAAkB,CAA2B;EAC/CC,EAAE,GAAoB,aAAa;EAE5CC,WAAWA,CACQC,IAAiB,EACjBC,WAAoB,EACrC;IAAA,KAFiBD,IAAiB,GAAjBA,IAAiB;IAAA,KACjBC,WAAoB,GAApBA,WAAoB;EACpC;EAEH,MAAMC,sBAAsBA,CAC1BC,OAA2B,EACC;IAC5B,MAAMF,WAAW,GAAG,IAAI,CAACA,WAAW,IAAIE,OAAO,CAACC,QAAQ;IACxD,MAAMC,QAAQ,GAAG,iDAAiDC,kBAAkB,CAACL,WAAW,CAAC,QAAQ;IACzG,MAAMM,QAAQ,GAAG,MAAM,IAAI,CAACP,IAAI,CAACG,OAAO,CAAC;MACvCK,GAAG,EAAEH,QAAQ;MACbI,MAAM,EAAE,KAAK;MACbC,SAAS,EAAEP,OAAO,CAACO;IACrB,CAAC,CAAC;IAEF,IAAIH,QAAQ,CAACI,MAAM,KAAK,GAAG,EAAE;MAC3B,MAAM,IAAIhB,oBAAoB,CAAC;QAC7BiB,OAAO,EAAE,4CAA4CX,WAAW,GAAG;QACnEY,QAAQ,EAAE;UAAEZ;QAAY;MAC1B,CAAC,CAAC;IACJ;IACA,IAAIM,QAAQ,CAACI,MAAM,KAAK,GAAG,EAAE;MAC3B,MAAM,IAAIf,2BAA2B,CAAC;QACpCgB,OAAO,EAAE,6BAA6BL,QAAQ,CAACI,MAAM;MACvD,CAAC,CAAC;IACJ;IAEA,MAAMG,OAAO,GAAGC,uBAAuB,CAACR,QAAQ,CAACS,IAAI,CAAC;IACtD,IAAI,CAACF,OAAO,EAAE;MACZ,MAAM,IAAIlB,2BAA2B,CAAC;QACpCgB,OAAO,EACL,oEAAoE;QACtEC,QAAQ,EAAE;UAAEZ;QAAY;MAC1B,CAAC,CAAC;IACJ;IAEA,OAAO;MACLgB,aAAa,EAAEH,OAAO;MACtBT,QAAQ,EAAE,iDAAiDJ,WAAW,EAAE;MACxEiB,YAAY,EAAE,IAAI;MAClBC,gBAAgB,EAAE;IACpB,CAAC;EACH;AACF;AAEA,SAASJ,uBAAuBA,CAACK,IAAY,EAAiB;EAC5D,MAAMC,KAAK,GAAG,iCAAiC,CAACC,IAAI,CAACF,IAAI,CAAC;EAC1D,OAAOC,KAAK,GAAG,CAAC,CAAC,IAAI,IAAI;AAC3B","ignoreList":[]}

package/lib/module/data/providers/huawei/HuaweiAppGalleryProvider.js

@@ -0,0 +1,18 @@
+"use strict";
+
+import { UnsupportedStoreException } from "../../../domain/errors/VersionManagerException.js";
+/**
+ * Not yet implemented — Huawei AppGallery integration is designed in Prompt 11 of this
+ * series (AG Connect API parameters, error-code mapping) but not built in this pass.
+ * The file exists so the provider is independently importable/tree-shakeable
+ * (Prompt 1 §8) without pulling in Apple/Google/Custom code.
+ */
+export class HuaweiAppGalleryProvider {
+  id = 'huawei';
+  async fetchLatestVersionInfo() {
+    throw new UnsupportedStoreException({
+      message: 'Huawei AppGallery provider is not yet implemented — see Prompt 11 in the design series'
+    });
+  }
+}
+//# sourceMappingURL=HuaweiAppGalleryProvider.js.map

package/lib/module/data/providers/huawei/HuaweiAppGalleryProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["UnsupportedStoreException","HuaweiAppGalleryProvider","id","fetchLatestVersionInfo","message"],"sourceRoot":"../../../../../src","sources":["data/providers/huawei/HuaweiAppGalleryProvider.ts"],"mappings":";;AAAA,SAASA,yBAAyB,QAAQ,mDAAgD;AAK1F;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,wBAAwB,CAA2B;EACrDC,EAAE,GAAoB,QAAQ;EAEvC,MAAMC,sBAAsBA,CAAA,EAA+B;IACzD,MAAM,IAAIH,yBAAyB,CAAC;MAClCI,OAAO,EACL;IACJ,CAAC,CAAC;EACJ;AACF","ignoreList":[]}