native-update 2.0.0 → 3.1.0

package/cli/CLAUDE.md

@@ -5,6 +5,15 @@ Command-line interface for native-update release management and bundle operation
 ## 🔴 3-Day Freshness Rule
 Check and update this file at least every 3 days. See root CLAUDE.md.
 
+## Package Manager Hierarchy: nvm → npm (global) → yarn (local) (IRON-SOLID)
+
+Three tiers, each tool ONLY for its tier — for the best, most reproducible dev results:
+- **`nvm`** → install/update Node.js (which bundles `npm`): `nvm install --lts`. Use nvm to get/update `npm` itself.
+- **`npm`** → ALL global packages: `npm install -g yarn` (install yarn globally if missing) + `npm install -g <pkg>` (every other global CLI).
+- **`yarn`** → ALL local project work: `yarn`, `yarn add <pkg>`, `yarn add -D <pkg>` inside the project.
+
+❌ NEVER use `npm`/`pnpm` for LOCAL installs. NEVER use `pnpm` at all. ✅ Only `yarn.lock` in the project — delete `package-lock.json` and `pnpm-lock.yaml`.
+
 ## Structure
 
 | File/Folder | Purpose |
@@ -48,4 +57,9 @@ All file storage uses FilesHub API. See root CLAUDE.md.
 
 ---
 
-**Last Updated**: 2026-04-02
+## Gitignore Hygiene (IRON-SOLID)
+`.gitignore` stays current with the project structure — ignore only recoverable artifacts (build/`dist`/`www`/`node_modules`/logs/caches/IDE), never lose source. Custom rules always present: `*.ignore.*`, `project-record-ignore/`. This is a **PRIVATE** repo -> `.env`/secrets/keystores ARE tracked in git. Capacitor: track `android`/`ios` source, ignore native build.
+Full rule + private/public protocol: `~/.claude/rules/project-config.md`.
+Gitignore Last Verified: 2026-06-24
+
+**Last Updated**: 2026-04-25

package/cli/commands/backend-create.js

@@ -8,6 +8,46 @@ import ora from 'ora';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 
+/**
+ * Banner injected at the top of every generated server-side file. The
+ * generator emits SCAFFOLDS, not turn-key production code: bundle
+ * lookup, persistent storage, signature verification, and rollout
+ * gating are all left as `TODO[SCAFFOLD-IMPLEMENT-BEFORE-DEPLOY]`
+ * markers because the right answer depends on the host's storage +
+ * DB choices. Fully working references:
+ *   - example-apps/node-express   (minimal HTTP contract)
+ *   - backend/                    (Laravel + Nova production app)
+ */
+const SCAFFOLD_BANNER = `/**
+ * ⚠️  SCAFFOLD — IMPLEMENT BEFORE DEPLOYING ⚠️
+ *
+ * This file was generated by \`native-update backend-create\` as a
+ * STARTING POINT, not a deploy-ready service. Every block tagged
+ * \`TODO[SCAFFOLD-IMPLEMENT-BEFORE-DEPLOY]\` MUST be replaced with
+ * real persistence + storage + signature verification before this
+ * runs in production.
+ *
+ * Working references:
+ *   • example-apps/node-express      — minimal HTTP-contract reference
+ *   • backend/ (Laravel + Nova)      — full SaaS implementation
+ *
+ * Deploying this file as-is will respond with hard-coded sample
+ * payloads and silently drop uploaded bundles.
+ */
+`;
+
+const POST_GENERATION_WARNING = [
+  '',
+  chalk.yellow.bold('⚠️  SCAFFOLD — NOT PRODUCTION READY ⚠️'),
+  chalk.gray('This template ships with placeholder bundle lookup + storage logic.'),
+  chalk.gray('Search the generated code for `TODO[SCAFFOLD-IMPLEMENT-BEFORE-DEPLOY]`'),
+  chalk.gray('and replace each block with your real DB / storage / signing logic.'),
+  chalk.gray('See:'),
+  chalk.gray('  • example-apps/node-express  (minimal HTTP-contract reference)'),
+  chalk.gray('  • backend/ (Laravel + Nova)  (full SaaS implementation)'),
+  '',
+].join('\n');
+
 export async function createBackend(type, options) {
   const spinner = ora(`Creating ${type} backend template...`).start();
 
@@ -40,14 +80,15 @@ export async function createBackend(type, options) {
         throw new Error(`Unknown backend type: ${type}`);
     }
 
-    spinner.succeed(`${type} backend created successfully!`);
-    
-    console.log('');
+    spinner.succeed(`${type} backend scaffold created!`);
+
+    console.log(POST_GENERATION_WARNING);
     console.log(chalk.bold('Next steps:'));
     console.log(chalk.gray(`  1. cd ${options.output}`));
     console.log(chalk.gray(`  2. npm install`));
     console.log(chalk.gray(`  3. Configure your environment variables`));
-    console.log(chalk.gray(`  4. npm run dev`));
+    console.log(chalk.gray(`  4. Replace every TODO[SCAFFOLD-IMPLEMENT-BEFORE-DEPLOY] block`));
+    console.log(chalk.gray(`  5. npm run dev`));
 
   } catch (error) {
     spinner.fail(`Failed to create backend: ${error.message}`);
@@ -90,7 +131,7 @@ async function createExpressBackend(outputDir, options) {
   );
 
   // Create server.js
-  const serverCode = `import express from 'express';
+  const serverCode = `${SCAFFOLD_BANNER}import express from 'express';
 import cors from 'cors';
 import dotenv from 'dotenv';
 import { router as bundleRouter } from './routes/bundles.js';
@@ -141,7 +182,7 @@ router.get('/latest', async (req, res) => {
   try {
     const { appId, version, channel = 'production' } = req.query;
     
-    // TODO: Implement bundle lookup logic
+    // TODO[SCAFFOLD-IMPLEMENT-BEFORE-DEPLOY]: replace with real bundle lookup (DB query against your apps + builds tables)
     // This is a simplified example
     const bundle = {
       version: '1.0.1',
@@ -173,8 +214,8 @@ router.post('/upload', upload.single('bundle'), async (req, res) => {
     const fileBuffer = await fs.readFile(file.path);
     const checksum = crypto.createHash('sha256').update(fileBuffer).digest('hex');
     
-    // TODO: Store bundle metadata in database
-    // TODO: Move file to permanent storage
+    // TODO[SCAFFOLD-IMPLEMENT-BEFORE-DEPLOY]: persist build metadata (channel, version, checksum, signature, fileshub_public_id) — see backend/ Laravel migrations for the canonical shape
+    // TODO[SCAFFOLD-IMPLEMENT-BEFORE-DEPLOY]: upload to FilesHub (preferred) or your CDN; multer drops to /uploads/ which is ephemeral
     
     res.json({
       success: true,
@@ -268,7 +309,7 @@ async function createVercelBackend(outputDir, options) {
   );
 
   // Create bundles API endpoint
-  const bundlesApi = `export default async function handler(req, res) {
+  const bundlesApi = `${SCAFFOLD_BANNER}export default async function handler(req, res) {
   // Enable CORS
   res.setHeader('Access-Control-Allow-Credentials', true);
   res.setHeader('Access-Control-Allow-Origin', '*');
@@ -287,7 +328,7 @@ async function createVercelBackend(outputDir, options) {
     // Get latest bundle
     const { appId, version, channel = 'production' } = req.query;
     
-    // TODO: Implement bundle lookup from your storage solution
+    // TODO[SCAFFOLD-IMPLEMENT-BEFORE-DEPLOY]: replace with real bundle lookup against your KV / DB store
     // This is a simplified example
     const bundle = {
       version: '1.0.1',
@@ -306,8 +347,8 @@ async function createVercelBackend(outputDir, options) {
     // Handle bundle upload
     const { version, channel, metadata } = req.body;
     
-    // TODO: Handle file upload to storage (Vercel Blob, S3, etc.)
-    // TODO: Save metadata to database (Vercel KV, external DB, etc.)
+    // TODO[SCAFFOLD-IMPLEMENT-BEFORE-DEPLOY]: upload to Vercel Blob / S3 / FilesHub; verify signature against your signing key registry
+    // TODO[SCAFFOLD-IMPLEMENT-BEFORE-DEPLOY]: persist build metadata to Vercel KV / Postgres / your DB of choice
     
     return res.status(200).json({
       success: true,
@@ -448,7 +489,7 @@ async function createFirebaseBackend(outputDir, options) {
   );
 
   // Create index.js
-  const indexJs = `import { onRequest } from 'firebase-functions/v2/https';
+  const indexJs = `${SCAFFOLD_BANNER}import { onRequest } from 'firebase-functions/v2/https';
 import * as admin from 'firebase-admin';
 import express from 'express';
 import cors from 'cors';
@@ -490,8 +531,8 @@ app.post('/api/bundles/upload', async (req, res) => {
   try {
     const { version, channel, metadata } = req.body;
     
-    // TODO: Handle file upload to Cloud Storage
-    // TODO: Save metadata to Firestore
+    // TODO[SCAFFOLD-IMPLEMENT-BEFORE-DEPLOY]: upload to Cloud Storage; verify signature; enforce monotonic version per channel
+    // TODO[SCAFFOLD-IMPLEMENT-BEFORE-DEPLOY]: write to Firestore; remember Firestore rules must be locked down (no public writes)
     
     res.json({ success: true, version });
   } catch (error) {

package/cli/commands/bundle-create.js

@@ -3,13 +3,15 @@ import fs from 'fs/promises';
 import path from 'path';
 import crypto from 'crypto';
 import archiver from 'archiver';
-import { createWriteStream } from 'fs';
+import { createWriteStream, createReadStream } from 'fs';
 import { fileURLToPath } from 'url';
 import { dirname, join } from 'path';
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 
+const NEVER_BUNDLE = ['node_modules', '.git', '.env', '.env.local', '.env.production'];
+
 export async function createBundle(webDir, options) {
   console.log(chalk.blue('🔨 Creating update bundle...'));
 
@@ -28,6 +30,18 @@ export async function createBundle(webDir, options) {
       throw new Error(`No index.html found in ${webDir}. Is this a valid web build directory?`);
     }
 
+    // Refuse to bundle a project root by mistake — `node_modules`, `.git`,
+    // and `.env*` should never end up in an OTA bundle. Catches the common
+    // mistake of pointing at the project root instead of `dist/` or `www/`.
+    const entries = await fs.readdir(webDir);
+    const dangerous = entries.filter((e) => NEVER_BUNDLE.includes(e));
+    if (dangerous.length > 0) {
+      throw new Error(
+        `Refusing to bundle: ${webDir} contains ${dangerous.join(', ')}. ` +
+        `Point at your built web output (e.g. ./dist or ./www), not the project root.`
+      );
+    }
+
     // Create output directory
     const outputDir = path.resolve(options.output);
     await fs.mkdir(outputDir, { recursive: true });
@@ -44,13 +58,24 @@ export async function createBundle(webDir, options) {
       }
     }
 
+    // Parse --metadata separately so we can give a clearer error than
+    // a bare "Unexpected token" if the user passes invalid JSON.
+    let extraMetadata = {};
+    if (options.metadata) {
+      try {
+        extraMetadata = JSON.parse(options.metadata);
+      } catch (e) {
+        throw new Error(`Invalid JSON in --metadata: ${e.message}`);
+      }
+    }
+
     // Create bundle metadata
     const metadata = {
       version,
       channel: options.channel,
       created: new Date().toISOString(),
       platform: 'web',
-      ...(options.metadata ? JSON.parse(options.metadata) : {})
+      ...extraMetadata,
     };
 
     const bundleId = `${version}-${Date.now()}`;
@@ -81,13 +106,20 @@ export async function createBundle(webDir, options) {
     await archive.finalize();
     await archivePromise;
 
-    // Calculate checksum
-    const fileBuffer = await fs.readFile(bundlePath);
-    const checksum = crypto.createHash('sha256').update(fileBuffer).digest('hex');
+    // Stream the bundle through the SHA-256 hasher so a 100MB+ bundle
+    // doesn't get slurped into RAM all at once. Size comes from fs.stat.
+    const bundleStat = await fs.stat(bundlePath);
+    const checksum = await new Promise((resolve, reject) => {
+      const hash = crypto.createHash('sha256');
+      createReadStream(bundlePath)
+        .on('data', (chunk) => hash.update(chunk))
+        .on('end', () => resolve(hash.digest('hex')))
+        .on('error', reject);
+    });
 
     // Update metadata with file info
     metadata.checksum = checksum;
-    metadata.size = fileBuffer.length;
+    metadata.size = bundleStat.size;
     metadata.filename = bundleFileName;
 
     // Save metadata
@@ -97,7 +129,7 @@ export async function createBundle(webDir, options) {
     console.log('');
     console.log(chalk.bold('Bundle Details:'));
     console.log(chalk.gray(`  File: ${bundlePath}`));
-    console.log(chalk.gray(`  Size: ${(fileBuffer.length / 1024 / 1024).toFixed(2)} MB`));
+    console.log(chalk.gray(`  Size: ${(bundleStat.size / 1024 / 1024).toFixed(2)} MB`));
     console.log(chalk.gray(`  Checksum: ${checksum}`));
     console.log(chalk.gray(`  Metadata: ${metadataPath}`));
     console.log('');

package/cli/commands/monitor.js

@@ -1,6 +1,9 @@
 import chalk from 'chalk';
 import ora from 'ora';
 
+const POLL_MS = 5000;
+const MAX_CONSECUTIVE_FAILURES = 5;
+
 export async function monitor(options) {
   if (!options.server) {
     console.error(chalk.red('Error: --server URL is required'));
@@ -12,57 +15,75 @@ export async function monitor(options) {
   console.log('');
 
   const spinner = ora('Fetching update statistics...').start();
+  let intervalId = null;
+  let consecutiveFailures = 0;
+  let stopping = false;
+
+  const stop = (code = 0) => {
+    if (stopping) return;
+    stopping = true;
+    if (intervalId) clearInterval(intervalId);
+    if (spinner.isSpinning) spinner.stop();
+    process.exit(code);
+  };
+
+  process.on('SIGINT', () => stop(0));
+  process.on('SIGTERM', () => stop(0));
+
+  const headers = options.key ? { Authorization: `Bearer ${options.key}` } : {};
+
+  const tick = async () => {
+    try {
+      const response = await fetch(`${options.server}/api/stats`, { headers });
+      if (!response.ok) throw new Error(`Server returned ${response.status}`);
+
+      const stats = await response.json();
+      consecutiveFailures = 0;
+
+      spinner.stop();
+      console.clear();
+      console.log(chalk.blue(`📊 Update Monitor - ${new Date().toLocaleTimeString()}`));
+      console.log(chalk.gray('─'.repeat(50)));
+      console.log('');
 
-  try {
-    // Poll server for stats
-    setInterval(async () => {
-      try {
-        const headers = options.key ? { 'Authorization': `Bearer ${options.key}` } : {};
-        
-        const response = await fetch(`${options.server}/api/stats`, { headers });
-        
-        if (!response.ok) {
-          throw new Error(`Server returned ${response.status}`);
-        }
-
-        const stats = await response.json();
-        
-        spinner.stop();
-        console.clear();
-        console.log(chalk.blue(`📊 Update Monitor - ${new Date().toLocaleTimeString()}`));
-        console.log(chalk.gray('─'.repeat(50)));
-        console.log('');
-        
-        console.log(chalk.bold('Current Version:'));
-        console.log(chalk.gray(`  Latest: ${stats.latestVersion || 'N/A'}`));
-        console.log(chalk.gray(`  Channel: ${stats.channel || 'production'}`));
-        console.log('');
-        
-        console.log(chalk.bold('Download Statistics:'));
-        console.log(chalk.gray(`  Total Downloads: ${stats.totalDownloads || 0}`));
-        console.log(chalk.gray(`  Downloads Today: ${stats.downloadsToday || 0}`));
-        console.log(chalk.gray(`  Active Installs: ${stats.activeInstalls || 0}`));
-        console.log('');
-        
-        if (stats.recentActivity) {
-          console.log(chalk.bold('Recent Activity:'));
-          stats.recentActivity.forEach(activity => {
-            console.log(chalk.gray(`  ${activity.time} - ${activity.action} (${activity.version})`));
-          });
-        }
-        
-        console.log('');
-        console.log(chalk.gray('Press Ctrl+C to stop'));
-        
-        spinner.start('Updating...');
-      } catch (error) {
-        spinner.fail(`Failed to fetch stats: ${error.message}`);
-        spinner.start('Retrying...');
+      console.log(chalk.bold('Current Version:'));
+      console.log(chalk.gray(`  Latest: ${stats.latestVersion || 'N/A'}`));
+      console.log(chalk.gray(`  Channel: ${stats.channel || 'production'}`));
+      console.log('');
+
+      console.log(chalk.bold('Download Statistics:'));
+      console.log(chalk.gray(`  Total Downloads: ${stats.totalDownloads || 0}`));
+      console.log(chalk.gray(`  Downloads Today: ${stats.downloadsToday || 0}`));
+      console.log(chalk.gray(`  Active Installs: ${stats.activeInstalls || 0}`));
+      console.log('');
+
+      if (stats.recentActivity) {
+        console.log(chalk.bold('Recent Activity:'));
+        stats.recentActivity.forEach((activity) => {
+          console.log(chalk.gray(`  ${activity.time} - ${activity.action} (${activity.version})`));
+        });
       }
-    }, 5000); // Update every 5 seconds
 
-  } catch (error) {
-    spinner.fail(`Monitor failed: ${error.message}`);
-    process.exit(1);
-  }
-}
+      console.log('');
+      console.log(chalk.gray('Press Ctrl+C to stop'));
+
+      spinner.start('Updating...');
+    } catch (error) {
+      consecutiveFailures += 1;
+      spinner.fail(
+        `Failed to fetch stats (${consecutiveFailures}/${MAX_CONSECUTIVE_FAILURES}): ${error.message}`,
+      );
+      if (consecutiveFailures >= MAX_CONSECUTIVE_FAILURES) {
+        console.error(
+          chalk.red(`\nGiving up after ${MAX_CONSECUTIVE_FAILURES} consecutive failures.`),
+        );
+        stop(1);
+        return;
+      }
+      spinner.start('Retrying...');
+    }
+  };
+
+  await tick();
+  intervalId = setInterval(tick, POLL_MS);
+}

package/cli/index.js

@@ -188,29 +188,6 @@ ${chalk.bold('Examples:')}
     await createBackend(type, options);
   });
 
-// Config Commands
-const configCmd = program
-  .command('config')
-  .description('Configuration commands');
-
-configCmd
-  .command('check')
-  .description('Validate your native-update configuration')
-  .action(async () => {
-    const { checkConfig } = await import('./commands/config-check.js');
-    await checkConfig();
-  });
-
-// Migration Commands
-program
-  .command('migrate')
-  .description('Migrate from other OTA solutions')
-  .option('--from <solution>', 'Source solution (codepush, appflow)', 'codepush')
-  .action(async (options) => {
-    const { migrate } = await import('./commands/migrate.js');
-    await migrate(options);
-  });
-
 // Monitoring Commands
 program
   .command('monitor')
@@ -264,6 +241,15 @@ program.exitOverride();
 try {
   await program.parseAsync(process.argv);
 } catch (error) {
+  // With exitOverride(), Commander throws for normal help/version output too
+  // (exitCode 0). Those are successful displays, not errors — exit quietly.
+  if (
+    error.code === 'commander.helpDisplayed' ||
+    error.code === 'commander.help' ||
+    error.code === 'commander.version'
+  ) {
+    process.exit(0);
+  }
   if (error.code === 'commander.missingArgument') {
     console.error(chalk.red(`Error: ${error.message}`));
   } else if (error.code === 'commander.unknownCommand') {
@@ -272,5 +258,5 @@ try {
   } else {
     console.error(chalk.red(`Error: ${error.message}`));
   }
-  process.exit(1);
+  process.exit(error.exitCode ?? 1);
 }

package/cli/package.json

@@ -1,12 +1,20 @@
 {
   "name": "native-update-cli",
-  "version": "1.0.0",
+  "version": "3.1.0",
   "description": "CLI for Native Update",
   "type": "module",
+  "engines": {
+    "node": ">=24.16.0"
+  },
   "bin": {
     "native-update": "./index.js"
   },
   "dependencies": {
-    "commander": "^11.0.0"
+    "archiver": "^8.0.0",
+    "chalk": "^5.6.2",
+    "commander": "^15.0.0",
+    "express": "^5.2.1",
+    "ora": "^9.4.0",
+    "prompts": "^2.4.2"
   }
-}
+}

package/dist/esm/app-review/app-review-manager.js

@@ -192,4 +192,3 @@ export class AppReviewManager {
         }
     }
 }
-//# sourceMappingURL=app-review-manager.js.map

package/dist/esm/app-review/index.js

@@ -3,4 +3,3 @@ export { ReviewConditionsChecker } from './review-conditions-checker';
 export { ReviewRateLimiter } from './review-rate-limiter';
 export { PlatformReviewHandler } from './platform-review-handler';
 export * from './types';
-//# sourceMappingURL=index.js.map

package/dist/esm/app-review/platform-review-handler.js

@@ -135,4 +135,3 @@ export class PlatformReviewHandler {
         return true;
     }
 }
-//# sourceMappingURL=platform-review-handler.js.map

package/dist/esm/app-review/review-conditions-checker.js

@@ -152,4 +152,3 @@ export class ReviewConditionsChecker {
         }
     }
 }
-//# sourceMappingURL=review-conditions-checker.js.map

package/dist/esm/app-review/review-rate-limiter.js

@@ -161,4 +161,3 @@ export class ReviewRateLimiter {
         return now;
     }
 }
-//# sourceMappingURL=review-rate-limiter.js.map

package/dist/esm/app-review/types.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=types.js.map

package/dist/esm/app-update/app-update-checker.js

@@ -206,4 +206,3 @@ export class AppUpdateChecker {
         return 'web';
     }
 }
-//# sourceMappingURL=app-update-checker.js.map

package/dist/esm/app-update/app-update-installer.d.ts

@@ -4,6 +4,7 @@ export declare class AppUpdateInstaller {
     private logger;
     private progressCallback?;
     private currentState;
+    private flexibleUpdateInterval;
     constructor(_: PluginConfig);
     startImmediateUpdate(): Promise<void>;
     startFlexibleUpdate(): Promise<void>;

package/dist/esm/app-update/app-update-installer.js

@@ -2,7 +2,7 @@ import { Logger } from '../core/logger';
 import { AppUpdateInstallStatus, } from './types';
 export class AppUpdateInstaller {
     constructor(_) {
-        // config parameter is kept for compatibility but not used
+        this.flexibleUpdateInterval = null;
         this.logger = new Logger('AppUpdateInstaller');
         this.currentState = {
             installStatus: AppUpdateInstallStatus.UNKNOWN,
@@ -67,6 +67,13 @@ export class AppUpdateInstaller {
     }
     async cancelUpdate() {
         this.logger.log('Cancelling update');
+        // Stop the simulated download interval. Without this, the interval
+        // runs forever even after cancel because the only previous exit was
+        // a "download finished" branch.
+        if (this.flexibleUpdateInterval) {
+            clearInterval(this.flexibleUpdateInterval);
+            this.flexibleUpdateInterval = null;
+        }
         if (this.currentState.installStatus === AppUpdateInstallStatus.DOWNLOADING) {
             this.updateState(AppUpdateInstallStatus.CANCELED);
         }
@@ -85,22 +92,27 @@ export class AppUpdateInstaller {
         this.logger.log('Update state changed', this.currentState);
     }
     simulateFlexibleUpdate() {
-        // Simulate download progress for web platform
         let downloaded = 0;
-        const totalSize = 50 * 1024 * 1024; // 50MB
-        const chunkSize = 1024 * 1024; // 1MB per tick
-        const interval = setInterval(() => {
+        const totalSize = 50 * 1024 * 1024;
+        const chunkSize = 1024 * 1024;
+        if (this.flexibleUpdateInterval) {
+            clearInterval(this.flexibleUpdateInterval);
+        }
+        this.flexibleUpdateInterval = setInterval(() => {
             downloaded += chunkSize;
             if (downloaded >= totalSize) {
                 downloaded = totalSize;
-                clearInterval(interval);
+                if (this.flexibleUpdateInterval) {
+                    clearInterval(this.flexibleUpdateInterval);
+                    this.flexibleUpdateInterval = null;
+                }
                 this.updateState(AppUpdateInstallStatus.DOWNLOADED);
             }
             const progress = {
                 bytesDownloaded: downloaded,
                 totalBytesToDownload: totalSize,
                 percentComplete: Math.round((downloaded / totalSize) * 100),
-                downloadSpeed: chunkSize, // 1MB/s
+                downloadSpeed: chunkSize,
                 estimatedTime: Math.ceil((totalSize - downloaded) / chunkSize),
             };
             if (this.progressCallback) {
@@ -120,4 +132,3 @@ export class AppUpdateInstaller {
         return !this.isAndroid() && !this.isIOS();
     }
 }
-//# sourceMappingURL=app-update-installer.js.map

package/dist/esm/app-update/app-update-manager.js

@@ -196,4 +196,3 @@ export class AppUpdateManager {
         return Object.assign(Object.assign(Object.assign({}, nativeInfo), serverInfo), { updateAvailable: nativeInfo.updateAvailable || !!serverInfo.availableVersion, availableVersion: serverInfo.availableVersion || nativeInfo.availableVersion });
     }
 }
-//# sourceMappingURL=app-update-manager.js.map

package/dist/esm/app-update/app-update-notifier.js

@@ -97,4 +97,3 @@ export class AppUpdateNotifier {
         }
     }
 }
-//# sourceMappingURL=app-update-notifier.js.map

package/dist/esm/app-update/index.js

@@ -4,4 +4,3 @@ export { AppUpdateInstaller } from './app-update-installer';
 export { AppUpdateNotifier } from './app-update-notifier';
 export { PlatformAppUpdate } from './platform-app-update';
 export * from './types';
-//# sourceMappingURL=index.js.map

package/dist/esm/app-update/platform-app-update.js

@@ -1,5 +1,6 @@
 import { Logger } from '../core/logger';
 import { Capacitor } from '@capacitor/core';
+import { SecurityValidator } from '../core/security';
 export class PlatformAppUpdate {
     constructor(config) {
         this.config = config;
@@ -31,13 +32,19 @@ export class PlatformAppUpdate {
             // Web platform - check configured update URL
             if (this.config.webUpdateUrl) {
                 try {
+                    SecurityValidator.validateDownloadUrl(this.config.webUpdateUrl);
                     const response = await fetch(this.config.webUpdateUrl);
                     const data = await response.json();
                     if (data.version && data.version !== versionInfo.currentVersion) {
                         updateInfo.updateAvailable = true;
                         updateInfo.availableVersion = data.version;
                         updateInfo.releaseNotes = data.releaseNotes;
-                        updateInfo.updateURL = data.downloadUrl;
+                        // Validate downloadUrl scheme — server-controlled value, must
+                        // not be allowed to smuggle javascript: into a later openUrl.
+                        if (data.downloadUrl) {
+                            SecurityValidator.validateStoreUrl(data.downloadUrl);
+                            updateInfo.updateURL = data.downloadUrl;
+                        }
                     }
                 }
                 catch (error) {
@@ -85,8 +92,11 @@ export class PlatformAppUpdate {
         return { url, platform: platform };
     }
     async openUrl(url) {
+        // Reject any non-HTTPS / non-store URL — protects against
+        // `javascript:` payloads handed back from a compromised server.
+        SecurityValidator.validateStoreUrl(url);
         if (typeof window !== 'undefined' && window.open) {
-            window.open(url, '_blank');
+            window.open(url, '_blank', 'noopener,noreferrer');
         }
         else {
             throw new Error('Cannot open URL on this platform');
@@ -126,4 +136,3 @@ export class PlatformAppUpdate {
         return capabilities;
     }
 }
-//# sourceMappingURL=platform-app-update.js.map

package/dist/esm/app-update/types.js

@@ -9,4 +9,3 @@ export var AppUpdateInstallStatus;
     AppUpdateInstallStatus[AppUpdateInstallStatus["CANCELED"] = 6] = "CANCELED";
     AppUpdateInstallStatus[AppUpdateInstallStatus["DOWNLOADED"] = 11] = "DOWNLOADED";
 })(AppUpdateInstallStatus || (AppUpdateInstallStatus = {}));
-//# sourceMappingURL=types.js.map