@viettelpost/react-native-ota 0.1.0

package/android/src/main/java/com/viettelpost/otakit/OTAUpdateMetadata.kt

@@ -0,0 +1,72 @@
+package com.viettelpost.otakit
+
+import org.json.JSONObject
+
+data class OTAUpdateMetadata(
+    val schemaVersion: Int = 1,
+    val embeddedBundleVersion: String = EMBEDDED_VERSION,
+    val activeBundleVersion: String = EMBEDDED_VERSION,
+    val previousBundleVersion: String? = null,
+    val pendingBundleVersion: String? = null,
+    val failedBundleVersion: String? = null,
+    val runningBundleVersion: String = EMBEDDED_VERSION,
+    val status: String = STATUS_ACTIVE,
+    val launchCountForPending: Int = 0,
+    val lastSuccessfulLaunchAt: String? = null,
+    val lastFailureReason: String? = null,
+) {
+    fun toJson(): JSONObject =
+        JSONObject().apply {
+            put("schemaVersion", schemaVersion)
+            put("embeddedBundleVersion", embeddedBundleVersion)
+            put("activeBundleVersion", activeBundleVersion)
+            putNullable("previousBundleVersion", previousBundleVersion)
+            putNullable("pendingBundleVersion", pendingBundleVersion)
+            putNullable("failedBundleVersion", failedBundleVersion)
+            put("runningBundleVersion", runningBundleVersion)
+            put("status", status)
+            put("launchCountForPending", launchCountForPending)
+            putNullable("lastSuccessfulLaunchAt", lastSuccessfulLaunchAt)
+            putNullable("lastFailureReason", lastFailureReason)
+        }
+
+    companion object {
+        private const val EMBEDDED_VERSION = "embedded"
+        private const val STATUS_ACTIVE = "active"
+        private const val STATUS_FAILED = "failed"
+        private const val PARSE_FAILED_REASON = "metadata_parse_failed"
+
+        fun default(): OTAUpdateMetadata = OTAUpdateMetadata()
+
+        fun parse(json: String): OTAUpdateMetadata {
+            val data = JSONObject(json)
+            return OTAUpdateMetadata(
+                schemaVersion = data.optInt("schemaVersion", 1),
+                embeddedBundleVersion = data.optString("embeddedBundleVersion", EMBEDDED_VERSION),
+                activeBundleVersion = data.optString("activeBundleVersion", EMBEDDED_VERSION),
+                previousBundleVersion = data.optNullableString("previousBundleVersion"),
+                pendingBundleVersion = data.optNullableString("pendingBundleVersion"),
+                failedBundleVersion = data.optNullableString("failedBundleVersion"),
+                runningBundleVersion = data.optString("runningBundleVersion", EMBEDDED_VERSION),
+                status = data.optString("status", STATUS_ACTIVE),
+                launchCountForPending = data.optInt("launchCountForPending", 0),
+                lastSuccessfulLaunchAt = data.optNullableString("lastSuccessfulLaunchAt"),
+                lastFailureReason = data.optNullableString("lastFailureReason"),
+            )
+        }
+
+        fun metadataParseFailed(): OTAUpdateMetadata =
+            default().copy(status = STATUS_FAILED, lastFailureReason = PARSE_FAILED_REASON)
+    }
+}
+
+private fun JSONObject.putNullable(name: String, value: String?) {
+    put(name, value ?: JSONObject.NULL)
+}
+
+private fun JSONObject.optNullableString(name: String): String? {
+    if (!has(name) || isNull(name)) {
+        return null
+    }
+    return optString(name)
+}

package/android/src/main/java/com/viettelpost/otakit/OTAUpdateModule.kt

@@ -0,0 +1,140 @@
+package com.viettelpost.otakit
+
+import com.facebook.react.bridge.Promise
+import com.facebook.react.bridge.ReactApplicationContext
+import com.facebook.react.module.annotations.ReactModule
+import com.viettelpost.otakit.NativeOTAUpdateSpec
+
+@ReactModule(name = OTAUpdateModule.NAME)
+class OTAUpdateModule(reactContext: ReactApplicationContext) : NativeOTAUpdateSpec(reactContext) {
+    override fun getMetadata(promise: Promise) {
+        try {
+            val metadata = OTAUpdateStorage.readMetadata(reactApplicationContext)
+            promise.resolve(metadata.toJson().toString())
+        } catch (error: Exception) {
+            promise.reject("OTA_GET_METADATA_FAILED", "Failed to read OTA metadata", error)
+        }
+    }
+
+    override fun resetMetadata(promise: Promise) {
+        try {
+            OTAUpdateStorage.resetMetadata(reactApplicationContext)
+            promise.resolve(true)
+        } catch (error: Exception) {
+            promise.reject("OTA_RESET_METADATA_FAILED", "Failed to reset OTA metadata", error)
+        }
+    }
+
+    override fun getOTADirectory(promise: Promise) {
+        try {
+            promise.resolve(OTAUpdateBundleResolver.ensureOTADirectory(reactApplicationContext).absolutePath)
+        } catch (error: Exception) {
+            promise.reject("OTA_GET_DIRECTORY_FAILED", "Failed to read OTA directory", error)
+        }
+    }
+
+    override fun prepareManualInstall(bundleVersion: String, promise: Promise) {
+        try {
+            promise.resolve(OTAUpdateBundleResolver.prepareManualInstall(reactApplicationContext, bundleVersion))
+        } catch (error: OTABundleFileNotFoundException) {
+            promise.reject("OTA_BUNDLE_FILE_NOT_FOUND", error.message, error)
+        } catch (error: IllegalArgumentException) {
+            promise.reject("OTA_INVALID_BUNDLE_VERSION", error.message, error)
+        } catch (error: Exception) {
+            promise.reject("OTA_PREPARE_MANUAL_INSTALL_FAILED", "Failed to prepare OTA manual install", error)
+        }
+    }
+
+    override fun markSuccess(promise: Promise) {
+        try {
+            promise.resolve(OTAUpdateBundleResolver.markSuccess(reactApplicationContext))
+        } catch (error: OTAMarkSuccessRejectedException) {
+            promise.reject("OTA_MARK_SUCCESS_REJECTED", error.message, error)
+        } catch (error: Exception) {
+            promise.reject("OTA_MARK_SUCCESS_FAILED", "Failed to mark OTA success", error)
+        }
+    }
+
+    override fun copyBundleFromDocuments(bundleVersion: String, fileName: String, promise: Promise) {
+        promise.resolve(false)
+    }
+
+    override fun getCurrentBundleInfo(promise: Promise) {
+        try {
+            val bundleInfo = OTAUpdateBundleResolver.getCurrentBundleInfo(reactApplicationContext)
+            promise.resolve(bundleInfo.toString())
+        } catch (error: Exception) {
+            promise.reject("OTA_GET_CURRENT_BUNDLE_INFO_FAILED", "Failed to read OTA bundle info", error)
+        }
+    }
+
+    override fun downloadAndInstallBundle(updateJson: String, promise: Promise) {
+        try {
+            promise.resolve(OTAUpdateDownloader.downloadAndInstallBundle(reactApplicationContext, updateJson))
+        } catch (error: OTAVersionAlreadyExistsException) {
+            promise.reject("OTA_VERSION_ALREADY_EXISTS", error.message, error)
+        } catch (error: OTAMissingSha256Exception) {
+            promise.reject("OTA_MISSING_SHA256", error.message, error)
+        } catch (error: OTAMissingAssetsSha256Exception) {
+            promise.reject("OTA_MISSING_ASSETS_SHA256", error.message, error)
+        } catch (error: OTAMissingSignatureException) {
+            promise.reject("OTA_MISSING_SIGNATURE", error.message, error)
+        } catch (error: IllegalArgumentException) {
+            promise.reject("OTA_INVALID_UPDATE", error.message, error)
+        } catch (error: OTAAssetsDownloadFailedException) {
+            promise.reject("OTA_ASSETS_DOWNLOAD_FAILED", error.message, error)
+        } catch (error: OTADownloadFailedException) {
+            promise.reject("OTA_DOWNLOAD_FAILED", error.message, error)
+        } catch (error: OTATempBundleNotFoundException) {
+            promise.reject("OTA_TEMP_BUNDLE_NOT_FOUND", error.message, error)
+        } catch (error: OTAAssetsZipNotFoundException) {
+            promise.reject("OTA_ASSETS_ZIP_NOT_FOUND", error.message, error)
+        } catch (error: OTASha256MismatchException) {
+            promise.reject("OTA_SHA256_MISMATCH", error.message, error)
+        } catch (error: OTAAssetsSha256MismatchException) {
+            promise.reject("OTA_ASSETS_SHA256_MISMATCH", error.message, error)
+        } catch (error: OTASignatureInvalidException) {
+            promise.reject("OTA_SIGNATURE_INVALID", error.message, error)
+        } catch (error: OTAUnsafeAssetsZipEntryException) {
+            promise.reject("OTA_ASSETS_ZIP_INVALID", error.message, error)
+        } catch (error: OTAAssetsInstallFailedException) {
+            promise.reject("OTA_ASSETS_EXTRACT_FAILED", error.message, error)
+        } catch (error: OTAInstallFailedException) {
+            promise.reject("OTA_INSTALL_FAILED", error.message, error)
+        } catch (error: Exception) {
+            promise.reject("OTA_DOWNLOAD_AND_INSTALL_FAILED", "Failed to download and install OTA bundle", error)
+        }
+    }
+
+    override fun getDownloadInfo(version: String, promise: Promise) {
+        try {
+            val downloadInfo = OTAUpdateDownloader.getDownloadInfo(reactApplicationContext, version)
+            promise.resolve(downloadInfo.toString())
+        } catch (error: IllegalArgumentException) {
+            promise.reject("OTA_INVALID_BUNDLE_VERSION", error.message, error)
+        } catch (error: Exception) {
+            promise.reject("OTA_GET_DOWNLOAD_INFO_FAILED", "Failed to read OTA download info", error)
+        }
+    }
+
+    override fun getOTADiskUsage(promise: Promise) {
+        try {
+            val diskUsage = OTAUpdateCleanup.getOTADiskUsage(reactApplicationContext)
+            promise.resolve(diskUsage.toString())
+        } catch (error: Exception) {
+            promise.reject("OTA_GET_DISK_USAGE_FAILED", "Failed to read OTA disk usage", error)
+        }
+    }
+
+    override fun cleanupOTAStorage(promise: Promise) {
+        try {
+            promise.resolve(OTAUpdateCleanup.cleanupOTAStorage(reactApplicationContext))
+        } catch (error: Exception) {
+            promise.reject("OTA_CLEANUP_STORAGE_FAILED", "Failed to cleanup OTA storage", error)
+        }
+    }
+
+    companion object {
+        const val NAME: String = NativeOTAUpdateSpec.NAME
+    }
+}

package/android/src/main/java/com/viettelpost/otakit/OTAUpdatePackage.kt

@@ -0,0 +1,30 @@
+package com.viettelpost.otakit
+
+import com.facebook.react.BaseReactPackage
+import com.facebook.react.bridge.NativeModule
+import com.facebook.react.bridge.ReactApplicationContext
+import com.facebook.react.module.model.ReactModuleInfo
+import com.facebook.react.module.model.ReactModuleInfoProvider
+
+class OTAUpdatePackage : BaseReactPackage() {
+    override fun getModule(name: String, reactContext: ReactApplicationContext): NativeModule? =
+        if (name == OTAUpdateModule.NAME) {
+            OTAUpdateModule(reactContext)
+        } else {
+            null
+        }
+
+    override fun getReactModuleInfoProvider(): ReactModuleInfoProvider {
+        val moduleInfos = mapOf(
+            OTAUpdateModule.NAME to ReactModuleInfo(
+                OTAUpdateModule.NAME,
+                OTAUpdateModule::class.java.name,
+                false,
+                false,
+                false,
+                true,
+            ),
+        )
+        return ReactModuleInfoProvider { moduleInfos }
+    }
+}

package/android/src/main/java/com/viettelpost/otakit/OTAUpdateSignatureVerifier.kt

@@ -0,0 +1,63 @@
+package com.viettelpost.otakit
+
+import android.content.Context
+import android.util.Base64
+import java.security.KeyFactory
+import java.security.PublicKey
+import java.security.Signature
+import java.security.spec.X509EncodedKeySpec
+
+object OTAUpdateSignatureVerifier {
+    private const val SIGNATURE_ALGORITHM = "SHA256withRSA"
+    private const val KEY_ALGORITHM = "RSA"
+
+    fun canonicalPayload(
+        version: String,
+        platform: String,
+        fileName: String,
+        sha256: String,
+        assetsSha256: String? = null,
+    ): String {
+        val lines = mutableListOf(
+            "version=$version",
+            "platform=$platform",
+            "fileName=$fileName",
+            "sha256=$sha256",
+        )
+        if (!assetsSha256.isNullOrBlank()) {
+            lines.add("assetsSha256=$assetsSha256")
+        }
+        return lines.joinToString("\n")
+    }
+
+    fun verifySignature(
+        context: Context,
+        canonicalPayload: String,
+        base64Signature: String,
+    ): Boolean {
+        val signature = Signature.getInstance(SIGNATURE_ALGORITHM)
+        signature.initVerify(loadPublicKey(context))
+        signature.update(canonicalPayload.toByteArray(Charsets.UTF_8))
+        return signature.verify(Base64.decode(base64Signature, Base64.DEFAULT))
+    }
+
+    private fun loadPublicKey(context: Context): PublicKey {
+        // This is a public key. It is safe to ship in the app. Never ship the private key.
+        val hostResourceId = context.resources.getIdentifier(
+            "ota_public_key",
+            "raw",
+            context.packageName,
+        )
+        val publicKeyResourceId = if (hostResourceId != 0) hostResourceId else R.raw.ota_public_key
+        val pem = context.resources.openRawResource(publicKeyResourceId)
+            .bufferedReader(Charsets.UTF_8)
+            .use { it.readText() }
+        val normalizedPem = pem
+            .replace("-----BEGIN PUBLIC KEY-----", "")
+            .replace("-----END PUBLIC KEY-----", "")
+            .replace("\\s".toRegex(), "")
+        val keyBytes = Base64.decode(normalizedPem, Base64.DEFAULT)
+        val keySpec = X509EncodedKeySpec(keyBytes)
+        return KeyFactory.getInstance(KEY_ALGORITHM).generatePublic(keySpec)
+    }
+}

package/android/src/main/java/com/viettelpost/otakit/OTAUpdateStorage.kt

@@ -0,0 +1,62 @@
+package com.viettelpost.otakit
+
+import android.content.Context
+import java.io.File
+import java.io.IOException
+
+object OTAUpdateStorage {
+    private const val OTA_DIR_NAME = "ota"
+    private const val METADATA_FILE_NAME = "metadata.json"
+    private const val TEMP_METADATA_FILE_NAME = "metadata.json.tmp"
+
+    @Synchronized
+    @Throws(IOException::class)
+    fun readMetadata(context: Context): OTAUpdateMetadata {
+        val metadataFile = getMetadataPath(context)
+        if (!metadataFile.exists()) {
+            return resetMetadata(context)
+        }
+
+        return try {
+            OTAUpdateMetadata.parse(metadataFile.readText(Charsets.UTF_8))
+        } catch (_: Exception) {
+            val fallback = OTAUpdateMetadata.metadataParseFailed()
+            writeMetadata(context, fallback)
+            fallback
+        }
+    }
+
+    @Synchronized
+    @Throws(IOException::class)
+    fun writeMetadata(context: Context, metadata: OTAUpdateMetadata) {
+        val metadataFile = getMetadataPath(context)
+        val metadataDir = metadataFile.parentFile
+            ?: throw IOException("OTA metadata directory is unavailable")
+        if (!metadataDir.exists() && !metadataDir.mkdirs()) {
+            throw IOException("Unable to create OTA metadata directory")
+        }
+
+        val tempFile = File(metadataDir, TEMP_METADATA_FILE_NAME)
+        tempFile.writeText(metadata.toJson().toString(), Charsets.UTF_8)
+
+        if (metadataFile.exists() && !metadataFile.delete()) {
+            tempFile.delete()
+            throw IOException("Unable to replace OTA metadata")
+        }
+        if (!tempFile.renameTo(metadataFile)) {
+            tempFile.delete()
+            throw IOException("Unable to move OTA metadata into place")
+        }
+    }
+
+    @Synchronized
+    @Throws(IOException::class)
+    fun resetMetadata(context: Context): OTAUpdateMetadata {
+        val metadata = OTAUpdateMetadata.default()
+        writeMetadata(context, metadata)
+        return metadata
+    }
+
+    fun getMetadataPath(context: Context): File =
+        File(File(context.filesDir, OTA_DIR_NAME), METADATA_FILE_NAME)
+}

package/android/src/main/java/com/viettelpost/otakit/OTAZipUtils.kt

@@ -0,0 +1,100 @@
+package com.viettelpost.otakit
+
+import android.util.Log
+import java.io.BufferedOutputStream
+import java.io.File
+import java.io.FileOutputStream
+import java.io.IOException
+import java.util.Locale
+import java.util.zip.ZipInputStream
+
+object OTAZipUtils {
+    private const val TAG = "OTAKit"
+
+    fun validate(zipFile: File) {
+        ZipInputStream(zipFile.inputStream()).use { zipInput ->
+            while (true) {
+                val entry = zipInput.nextEntry ?: break
+                ensureZipEntrySafe(entry.name)
+                zipInput.closeEntry()
+            }
+        }
+    }
+
+    fun unzip(zipFile: File, destinationDir: File) {
+        val canonicalDestination = destinationDir.canonicalFile
+        if (!canonicalDestination.exists() && !canonicalDestination.mkdirs()) {
+            throw IOException("Unable to create OTA assets directory ${canonicalDestination.absolutePath}")
+        }
+
+        ZipInputStream(zipFile.inputStream()).use { zipInput ->
+            while (true) {
+                val entry = zipInput.nextEntry ?: break
+                val entryName = entry.name
+                ensureZipEntrySafe(entryName)
+
+                val outputFile = File(canonicalDestination, entryName)
+                val canonicalOutput = outputFile.canonicalFile
+                if (!isInsideDirectory(canonicalDestination, canonicalOutput)) {
+                    throw OTAUnsafeAssetsZipEntryException(entryName)
+                }
+
+                if (entry.isDirectory) {
+                    if (!canonicalOutput.exists() && !canonicalOutput.mkdirs()) {
+                        throw IOException("Unable to create OTA assets directory ${canonicalOutput.absolutePath}")
+                    }
+                } else {
+                    val parent = canonicalOutput.parentFile ?: canonicalDestination
+                    if (!parent.exists() && !parent.mkdirs()) {
+                        throw IOException("Unable to create OTA assets directory ${parent.absolutePath}")
+                    }
+                    BufferedOutputStream(FileOutputStream(canonicalOutput)).use { output ->
+                        val buffer = ByteArray(DEFAULT_BUFFER_SIZE)
+                        while (true) {
+                            val bytesRead = zipInput.read(buffer)
+                            if (bytesRead == -1) {
+                                break
+                            }
+                            output.write(buffer, 0, bytesRead)
+                        }
+                        output.flush()
+                    }
+                }
+                zipInput.closeEntry()
+            }
+        }
+    }
+
+    private fun ensureZipEntrySafe(entryName: String) {
+        if (entryName.isBlank() ||
+            entryName.startsWith("/") ||
+            entryName.startsWith("\\") ||
+            entryName.contains("\\") ||
+            entryName.contains("../") ||
+            entryName == ".." ||
+            entryName.endsWith("/..")
+        ) {
+            Log.w(TAG, "OTA assets zip entry rejected; entry=$entryName, reason=unsafe_path")
+            throw OTAUnsafeAssetsZipEntryException(entryName)
+        }
+
+        val parts = entryName.split('/').filter { it.isNotEmpty() }
+        if (parts.isEmpty()) {
+            Log.w(TAG, "OTA assets zip entry rejected; entry=$entryName, reason=empty_path_parts")
+            throw OTAUnsafeAssetsZipEntryException(entryName)
+        }
+        if (parts.any { it == "." || it == ".." }) {
+            Log.w(TAG, "OTA assets zip entry rejected; entry=$entryName, reason=relative_path_part")
+            throw OTAUnsafeAssetsZipEntryException(entryName)
+        }
+
+        val root = parts.first().lowercase(Locale.US)
+        if (root == "proc" || root == "sys" || root == "data" || root == "etc") {
+            Log.w(TAG, "OTA assets zip entry rejected; entry=$entryName, reason=dangerous_root")
+            throw OTAUnsafeAssetsZipEntryException(entryName)
+        }
+    }
+
+    private fun isInsideDirectory(directory: File, file: File): Boolean =
+        file.path == directory.path || file.path.startsWith(directory.path + File.separator)
+}

package/android/src/main/res/raw/ota_public_key.pem

@@ -0,0 +1,9 @@
+-----BEGIN PUBLIC KEY-----
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA8FidxBN6K3wQeyIGkv0l
+NvxrpkruxpTZgF10Eb2mDVcahDZqZVvEaFELhmz7++nfPdHoE1cuyoki2uLkZVeT
+thAeD2+KMwHtocnn9uELySbm25bf4/ZtvdpaTeiq+qrm9bpgdsFc+GIdGu3P2xmJ
+y/RZu9J6zcjV7SHPgPgRJ0yFXwhecmGfbVKoMYg4NWWAABR6Sr+2JoVmQRKYLkgj
+VVEZgbmS9vrDcxOpbNXILsWWEk4deiGHF/8A2JkTYA17ZFm8swNPnrBjWy+23huA
+UQoDtywNreXJLyh3+R8LAkVF+vplGQXEKViD29ZgJ2Y1xl3k1LzUMp37Qmz2zsGr
+LQIDAQAB
+-----END PUBLIC KEY-----

package/bin/cli/assets-zip.js

@@ -0,0 +1,77 @@
+'use strict';
+/**
+ * Produces a platform-correct assets.zip.
+ *
+ * The iOS and Android native OTA runtimes have DIFFERENT zip-entry expectations,
+ * enforced by their respective OTAZipUtils validators:
+ *
+ *   iOS (OTAZipUtils.swift):
+ *     requiredRootDirectory = "assets"
+ *     validateEntryPath() rejects any entry whose first path component ≠ "assets"
+ *     → every zip entry MUST start with "assets/"
+ *     react-native bundle --assets-dest <dir> emits   <dir>/assets/...  for iOS
+ *     → zip the CONTENTS of <assetsDir>: entries become assets/node_modules/.../icon.png ✅
+ *
+ *   Android (OTAZipUtils.kt):
+ *     No required root; ensureZipEntrySafe() only blocks proc/sys/data/etc and path traversal
+ *     → entries can be at the zip root: drawable-mdpi/icon.png, raw/file.mp3, etc.
+ *     react-native bundle --assets-dest <dir> emits   <dir>/drawable-mdpi/, <dir>/raw/, etc.
+ *     → zip the CONTENTS of <assetsDir>: entries become drawable-mdpi/icon.png ✅
+ *
+ * Both platforms use the SAME zipping strategy: archive.directory(assetsDir, false)
+ * (no prefix, just the contents of assetsDir). The difference is in how RN lays out
+ * the assets-dest folder for each platform — we don't need to do anything special.
+ */
+
+const fs = require('fs');
+const path = require('path');
+const archiver = require('archiver');
+
+/**
+ * Check whether a directory contains any files (recursively).
+ * Returns false if the dir doesn't exist.
+ */
+function hasFiles(dir) {
+  if (!fs.existsSync(dir)) return false;
+  const entries = fs.readdirSync(dir);
+  for (const entry of entries) {
+    const full = path.join(dir, entry);
+    const stat = fs.statSync(full);
+    if (stat.isFile()) return true;
+    if (stat.isDirectory() && hasFiles(full)) return true;
+  }
+  return false;
+}
+
+/**
+ * Zip the contents of assetsDir into zipPath.
+ * Returns the zipPath on success, or null if there are no assets to zip.
+ *
+ * @param {object} opts
+ * @param {string} opts.assetsDir  - RN --assets-dest output directory
+ * @param {string} opts.zipPath    - destination path for assets.zip
+ * @returns {Promise<string|null>}  zipPath if created, null if no assets
+ */
+function zipAssets({ assetsDir, zipPath }) {
+  return new Promise((resolve, reject) => {
+    if (!hasFiles(assetsDir)) {
+      resolve(null);
+      return;
+    }
+
+    const output = fs.createWriteStream(zipPath);
+    const archive = archiver('zip', { zlib: { level: 9 } });
+
+    output.on('close', () => resolve(zipPath));
+    archive.on('error', err => reject(err));
+    archive.pipe(output);
+
+    // Archive the contents of assetsDir without a root prefix (false = no dest prefix).
+    // iOS: assetsDir contains assets/... so entries become assets/<path>  ✅
+    // Android: assetsDir contains drawable-*/, raw/ so entries are flat    ✅
+    archive.directory(assetsDir, false);
+    archive.finalize();
+  });
+}
+
+module.exports = { zipAssets, hasFiles };

package/bin/cli/bundle.js

@@ -0,0 +1,72 @@
+'use strict';
+/**
+ * Wraps `react-native bundle` for a single platform.
+ * Outputs the bundle file and an assets directory ready for zipping.
+ */
+
+const { spawnSync } = require('child_process');
+const fs = require('fs');
+const path = require('path');
+
+/** Platform-specific bundle filenames — must match OTAUpdateDownloader constants. */
+const BUNDLE_NAMES = {
+  android: 'index.android.bundle',
+  ios: 'main.jsbundle',
+};
+
+/**
+ * Build the JS bundle and extract assets into workDir.
+ *
+ * After this call:
+ *   workDir/<fileName>      — the JS bundle
+ *   workDir/assets-src/     — raw asset tree from RN
+ *     iOS:     assets-src/assets/...   (RN emits an assets/ subfolder for iOS)
+ *     Android: assets-src/drawable-mdpi/, assets-src/raw/, etc. (flat)
+ *
+ * @param {object} opts
+ * @param {'ios'|'android'} opts.platform
+ * @param {string} opts.entryFile  - JS entry point (e.g. 'index.js')
+ * @param {string} opts.workDir    - temp directory for this build
+ * @returns {{ bundlePath: string, assetsDir: string, fileName: string }}
+ */
+function buildBundle({ platform, entryFile, workDir }) {
+  const fileName = BUNDLE_NAMES[platform];
+  if (!fileName) {
+    throw new Error(`Unsupported platform: ${platform}. Must be "ios" or "android".`);
+  }
+
+  const bundlePath = path.join(workDir, fileName);
+  const assetsDir = path.join(workDir, 'assets-src');
+  fs.mkdirSync(assetsDir, { recursive: true });
+
+  const args = [
+    'react-native', 'bundle',
+    '--platform', platform,
+    '--dev', 'false',
+    '--entry-file', entryFile,
+    '--bundle-output', bundlePath,
+    '--assets-dest', assetsDir,
+  ];
+
+  console.log(`  $ npx ${args.join(' ')}`);
+  const result = spawnSync('npx', args, {
+    stdio: 'inherit',
+    encoding: 'utf8',
+    cwd: process.cwd(),
+  });
+
+  if (result.error) {
+    throw new Error(`Failed to spawn react-native bundle: ${result.error.message}`);
+  }
+  if (result.status !== 0) {
+    throw new Error(`react-native bundle failed for ${platform} (exit ${result.status})`);
+  }
+
+  if (!fs.existsSync(bundlePath)) {
+    throw new Error(`Bundle file not found after build: ${bundlePath}`);
+  }
+
+  return { bundlePath, assetsDir, fileName };
+}
+
+module.exports = { buildBundle, BUNDLE_NAMES };