react-native-bspatch 4.1.0 → 5.0.1

package/tools/setup_project.js

@@ -31,19 +31,25 @@ function findFile(baseDir, predicate, maxDepth = 10) {
     return results;
 }
 
+// --quiet (run by every `patch`): print only what changed, one line each
+const QUIET = process.argv.includes('--quiet');
+const log = (...args) => {
+    if (!QUIET) console.log(...args);
+};
+
 function patchFile(filePath, label, patchFn) {
     if (!fs.existsSync(filePath)) {
-        console.log(`  ⚠  ${label}: file not found at ${filePath}`);
+        log(`  ⚠  ${label}: file not found at ${filePath}`);
         return false;
     }
     const original = fs.readFileSync(filePath, 'utf8');
     const patched = patchFn(original);
     if (patched === original) {
-        console.log(`  ✓  ${label}: already set up (skipped)`);
+        log(`  ✓  ${label}: already set up (skipped)`);
         return false;
     }
     fs.writeFileSync(filePath, patched, 'utf8');
-    console.log(`  ✓  ${label}: patched`);
+    console.log(QUIET ? label : `  ✓  ${label}: patched`);
     return true;
 }
 
@@ -103,6 +109,25 @@ function removePbxprojSnippet(content) {
     return content.slice(0, idx) + content.slice(content.indexOf('";', idx));
 }
 
+// Runs tools/ios_fingerprint.sh at the end of RN's "Bundle React Native code and images"
+// phase (after Copy Resources, with NODE_BINARY from .xcode.env): stamps the native
+// runtime fingerprint into the .app so OTAs only install on a matching binary.
+const FINGERPRINT_MARKER = '# [react-native-bspatch] runtime fingerprint';
+const FINGERPRINT_STEP =
+    `\\n${FINGERPRINT_MARKER}\\n` +
+    '/bin/sh \\"$REACT_NATIVE_PATH/scripts/xcode/with-environment.sh\\" ' +
+    '\\"$REACT_NATIVE_PATH/../react-native-bspatch/tools/ios_fingerprint.sh\\"\\n';
+
+function addPbxprojFingerprint(content) {
+    if (content.includes(FINGERPRINT_MARKER)) return content;
+    const phase = content.indexOf('/* Bundle React Native code and images */ = {');
+    if (phase === -1) return content;
+    const script = content.indexOf('shellScript = "', phase);
+    const end = content.indexOf('";', script);
+    if (script === -1 || end === -1) return content;
+    return content.slice(0, end) + FINGERPRINT_STEP + content.slice(end);
+}
+
 // ── iOS: AppDelegate.swift ────────────────────────────────────────────────────
 
 function patchAppDelegate(content) {
@@ -209,28 +234,29 @@ function main() {
     const rootIdx = args.indexOf('--root');
     const ROOT = rootIdx !== -1 ? path.resolve(args[rootIdx + 1]) : process.cwd();
 
-    console.log('\n=== react-native-bspatch Setup ===');
-    console.log(`  Project root: ${ROOT}`);
+    log('\n=== react-native-bspatch Setup ===');
+    log(`  Project root: ${ROOT}`);
 
     const IOS_DIR = path.join(ROOT, 'ios');
     const ANDROID_DIR = path.join(ROOT, 'android');
 
     // ── iOS ──
-    console.log('\n[iOS]');
+    log('\n[iOS]');
 
     // project.pbxproj (ignore CocoaPods project file)
     const pbxprojFiles = findFile(IOS_DIR, (name, fullPath) => name === 'project.pbxproj' && !fullPath.includes('Pods'));
     if (pbxprojFiles.length === 0) {
-        console.log('  ⚠  No project.pbxproj found. Is this an iOS project?');
+        log('  ⚠  No project.pbxproj found. Is this an iOS project?');
     } else {
         const pbxproj = pbxprojFiles[0];
         patchFile(pbxproj, 'project.pbxproj (remove legacy bundle capture)', removePbxprojSnippet);
+        patchFile(pbxproj, 'project.pbxproj (runtime fingerprint build step)', addPbxprojFingerprint);
     }
 
     // AppDelegate.swift
     const appDelegateFiles = findFile(IOS_DIR, (name) => name === 'AppDelegate.swift');
     if (appDelegateFiles.length === 0) {
-        console.log('  ⚠  No AppDelegate.swift found.');
+        log('  ⚠  No AppDelegate.swift found.');
     } else {
         patchFile(appDelegateFiles[0], 'AppDelegate.swift', patchAppDelegate);
     }
@@ -239,21 +265,21 @@ function main() {
     const outputDir = path.join(IOS_DIR, 'output');
     if (!fs.existsSync(outputDir)) {
         fs.mkdirSync(outputDir, { recursive: true });
-        console.log('  ✓  Created ios/output/ directory');
+        log('  ✓  Created ios/output/ directory');
     }
 
     // ── Android ──
-    console.log('\n[Android]');
+    log('\n[Android]');
     const mainAppFiles = findFile(ANDROID_DIR, (name) => name === 'MainApplication.kt');
     if (mainAppFiles.length === 0) {
-        console.log('  ⚠  No MainApplication.kt found. Is this an Android project?');
+        log('  ⚠  No MainApplication.kt found. Is this an Android project?');
     } else {
         patchFile(mainAppFiles[0], 'MainApplication.kt', patchMainApplication);
     }
 
     const appGradleFiles = findFile(path.join(ANDROID_DIR, 'app'), (name) => name === 'build.gradle');
     if (appGradleFiles.length === 0) {
-        console.log('  ⚠  No android/app/build.gradle found.');
+        log('  ⚠  No android/app/build.gradle found.');
     } else {
         patchFile(appGradleFiles[0], 'android/app/build.gradle (remove legacy bundle capture)', removeAppBuildGradleSnippet);
     }
@@ -262,11 +288,11 @@ function main() {
     const androidOutputDir = path.join(ANDROID_DIR, 'output');
     if (!fs.existsSync(androidOutputDir)) {
         fs.mkdirSync(androidOutputDir, { recursive: true });
-        console.log('  ✓  Created android/output/ directory');
+        log('  ✓  Created android/output/ directory');
     }
 
-    console.log('\n=== Setup Complete ===');
-    console.log('Next: release the app to the store (v1), then publish OTA updates with: npx react-native-bspatch\n');
+    log('\n=== Setup Complete ===');
+    log('Next: release the app to the store (v1), then publish OTA updates with: npx react-native-bspatch\n');
 }
 
 main();

package/tools/update_registry.js

@@ -7,11 +7,38 @@
  * 2. Scopes to : appVersion (e.g. "1.0.0")
  * 3. Scopes to : flavor (e.g. "dev", "staging", "production")
  * 4. Writes the full-bundle entry + patch entries and latestOtaVersion for that app+flavor.
+ * 5. Writes next to the bundle: its gzip copy (uploaded Content-Encoded) and
+ *    release_<app>_v<N>_<platform>_<flavor>.json, the version's details for a dashboard.
  */
 
 const fs = require('fs');
 const path = require('path');
 const crypto = require('crypto');
+const zlib = require('zlib');
+const { execFileSync } = require('child_process');
+
+/** What entrySignature signs. Must stay byte-for-byte equal to src/ota/entrySignature.ts */
+const entryPayload = e =>
+  [
+    'bspatch-entry-v2',
+    e.appVersion,
+    e.flavor ?? '',
+    e.platform ?? '',
+    e.fromVersion,
+    e.toVersion,
+    e.bundleHash ?? '',
+    e.assetManifestHash ?? '',
+    e.minAppVersion ?? '',
+    e.runtimeFingerprint ?? '',
+    e.hermesBytecodeVersion ?? '',
+  ].join('\n');
+
+/** Adds KEY=value lines to build_ota.sh's report file (sourced for the summary) */
+const report = (key, value) => {
+  if (process.env.BSPATCH_REPORT) {
+    fs.appendFileSync(process.env.BSPATCH_REPORT, `${key}='${String(value).replace(/'/g, `'\\''`)}'\n`);
+  }
+};
 
 const [
   projectRoot,
@@ -86,6 +113,8 @@ if (!signingKey) {
   const fullBundleName = `bundle_${appVersion}_v${toOtaVersion}_${platform}_${flavor}.hbc`;
   const manifestName = path.basename(_assetManifestFile);
 
+  const signBytes = (bytes) =>
+    signingKey ? crypto.createSign('SHA256').update(bytes).sign(signingKey, 'base64') : undefined;
   const sign = (file) => {
     if (!signingKey) return undefined;
     const filePath = path.join(outputDir, file);
@@ -93,21 +122,33 @@ if (!signingKey) {
       console.error(`  ❌ Cannot sign ${file}: not found at ${filePath}`);
       process.exit(1);
     }
-    const signer = crypto.createSign('SHA256');
-    signer.update(fs.readFileSync(filePath));
-    return signer.sign(signingKey, 'base64');
+    return signBytes(fs.readFileSync(filePath));
   };
+  const sha256 = (bytes) => crypto.createHash('sha256').update(bytes).digest('hex');
 
   // Signature of the resulting bundle: verified by the client on BOTH the patch
   // path and the full-bundle fallback, so a tampered registry can't swap bundles.
   const bundleSignature = sign(fullBundleName);
 
-  const bundleHash = crypto
-    .createHash('sha256')
-    .update(fs.readFileSync(path.join(outputDir, fullBundleName)))
-    .digest('hex');
+  const bundleBytes = fs.readFileSync(path.join(outputDir, fullBundleName));
+  const bundleHash = sha256(bundleBytes);
+  const manifestBytes = fs.readFileSync(_assetManifestFile);
+  const assetManifestHash = sha256(manifestBytes);
+  // Hermes bytecode header: magic (8 bytes) then the bytecode version (uint32 LE)
+  const hermesBytecodeVersion = bundleBytes.length >= 12 ? bundleBytes.readUInt32LE(8) : undefined;
+  // Same inputs the Xcode/Gradle build hook stamps into the store binary; promote/rollback
+  // pass the source version's own fingerprint (that bundle was built from another commit)
+  const runtimeFingerprint =
+    process.env.BSPATCH_FINGERPRINT ||
+    execFileSync('node', [path.join(__dirname, 'fingerprint.js'), process.cwd(), platform]).toString().trim();
+  const previous = flavorGroup.patches.find(p => p.platform === platform);
+  if (previous?.runtimeFingerprint && previous.runtimeFingerprint !== runtimeFingerprint) {
+    // Not an error: a new store build of this release takes it. Installed binaries won't.
+    report('NATIVE_CHANGED', `v${previous.toVersion}`);
+  }
 
-  const entry = (from, extra) => ({
+  // Signed last: entryPayload reads the final fields
+  const entry = (from, extra) => signEntry({
     id: `v${from}-to-v${toOtaVersion}-${flavor}-${platform}`,
     label: `V${from} → V${toOtaVersion} (${flavor} ${platform})`,
     appVersion,
@@ -115,13 +156,22 @@ if (!signingKey) {
     toVersion: toOtaVersion,
     platform,
     bundleHash,
-    fullBundleUrl: fullBundleName,
+    // Uploaded as a plain .gz (no Content-Encoding): resumable, with an exact progress total
+    fullBundleUrl: `${fullBundleName}.gz`,
+    fullBundleCompression: 'gzip',
+    requires: ['gzip'],
+    bundleSize: bundleBytes.length,
+    runtimeFingerprint,
+    hermesBytecodeVersion,
     assetManifestUrl: manifestName,
+    assetManifestHash,
     flavor,
     bundleSignature,
     ...extra,
   });
 
+  const signEntry = (e) => ({ ...e, entrySignature: signBytes(entryPayload(e)) });
+
   // fromVersion 1 = the store build, whose clients always take the full bundle
   const fullEntry = entry(1, {
     id: `full-to-v${toOtaVersion}-${flavor}-${platform}`,
@@ -132,14 +182,64 @@ if (!signingKey) {
   );
 
   flavorGroup.patches = [...otherPlatformPatches, fullEntry, ...patchEntries];
+
+  const gzipBytes = zlib.gzipSync(bundleBytes, { level: 9 });
+  fs.writeFileSync(path.join(outputDir, `${fullBundleName}.gz`), gzipBytes);
+
+  // ── Release details (public, next to the bundle; clients never read it) ──
+  const git = (...args) => {
+    try {
+      return execFileSync('git', args, { stdio: ['ignore', 'pipe', 'ignore'] }).toString().trim();
+    } catch {
+      return null;
+    }
+  };
+  const commit = git('rev-parse', 'HEAD');
+  const release = {
+    schema: 1,
+    appVersion,
+    flavor,
+    platform,
+    version: toOtaVersion,
+    publishedAt: new Date().toISOString(),
+    publishedBy: git('config', 'user.name') || process.env.USER || null,
+    notes: process.env.BSPATCH_NOTES || null,
+    git: commit && {
+      commit,
+      branch: git('rev-parse', '--abbrev-ref', 'HEAD'),
+      // Tracked files only: build output is often untracked
+      dirty: !!git('status', '--porcelain', '--untracked-files=no'),
+    },
+    cliVersion: require('../package.json').version,
+    bundle: { file: fullBundleName, hash: bundleHash, size: bundleBytes.length, gzipSize: gzipBytes.length },
+    runtimeFingerprint,
+    hermesBytecodeVersion,
+    patches: newPatches.map(p => ({
+      from: p.from,
+      file: p.file,
+      size: fs.statSync(path.join(outputDir, p.file)).size,
+    })),
+    assets: {
+      manifest: manifestName,
+      hash: assetManifestHash,
+      count: (JSON.parse(manifestBytes).assets || []).length,
+    },
+    signing: signingKey && {
+      keyId: sha256(crypto.createPublicKey(signingKey).export({ type: 'spki', format: 'der' })).slice(0, 16),
+    },
+  };
+  fs.writeFileSync(
+    path.join(outputDir, `release_${appVersion}_v${toOtaVersion}_${platform}_${flavor}.json`),
+    JSON.stringify(release, null, 2) + '\n',
+  );
 }
 
 // ── Write updated registry ───────────────────────────────────────────────────
 fs.mkdirSync(path.dirname(registryPath), { recursive: true });
 fs.writeFileSync(registryPath, JSON.stringify(registry, null, 2) + '\n');
-// Same layout as build_ota.sh step details
+// "<entries> · <signing>": build_ota.sh shows it as the Registry step's result
 const patchCount = newPatches.length;
 console.log(
-  `        ${'entries'.padEnd(18)} full bundle${patchCount ? ` + ${patchCount} patch${patchCount > 1 ? 'es' : ''}` : ''}` +
+  `full bundle${patchCount ? ` + ${patchCount} patch${patchCount > 1 ? 'es' : ''}` : ''}` +
     (signingKey ? ' · signed' : ' · unsigned (no ota_private_key.pem)'),
 );

package/tools/upload_ota.sh

@@ -1,23 +1,27 @@
 #!/bin/bash
 
 # ─────────────────────────────────────────────────────────────────────────────
-# OTA Upload Script — Cloudflare R2 (when OTA_R2_BUCKET is set) or a GitHub storage repository
-# Uploads:  1) All .patch & .hbc files  →  {baseFolder}/{appVersion}/{channel}/
-#           2) ota_registry.json         →  {baseFolder}/ota_registry.json
+# OTA Upload Script — Cloudflare R2
+# Uploads:  1) This version's .hbc.gz, .patch, .json                     → {baseFolder}/{appVersion}/{channel}/
+#           2) New content-addressed assets                              → {baseFolder}/assets/
+#           3) ota_registry.json, last                                   → {baseFolder}/ota_registry.json
 # ─────────────────────────────────────────────────────────────────────────────
 
-# Env (.env.<flavor> + .env.ota) is loaded and exported by build_ota.sh
+# Called by build_ota.sh inside its Upload/Remote step: env (.env.<flavor> + .env.ota)
+# and the step_progress/step_fail/run_logged helpers are exported from there
 ROOT_DIR=$(pwd)
 
-BASE_URL="${OTA_BASE_URL:-}"
 BASE_FOLDER="${OTA_FOLDER:-ota}"
 APP_VERSION="$1"
 CHANNEL="$2"
 OTA_VERSION="$3"
-BUNDLE_PATH="$4"  # unused — we upload .patch files, not the bundle
+# $4 (bundle path) is unused: this version's files are picked up from the output dir
 PLATFORM="$5"
 
 REGISTRY_FILE="$ROOT_DIR/ota_registry.json"
+WORK=$(mktemp -d); trap 'rm -rf "$WORK"' EXIT
+# Result for build_ota.sh's step line and summary (sourced there)
+report() { printf '%s=%q\n' "$1" "$2" >> "${BSPATCH_REPORT:-/dev/null}"; }
 OUTPUT_DIR="$ROOT_DIR/android/output"
 if [[ "$PLATFORM" == "ios" ]]; then
     OUTPUT_DIR="$ROOT_DIR/ios/output"
@@ -49,187 +53,84 @@ is_release_file() {
 }
 
 # ── Cloudflare R2 (S3 API, signed by curl --aws-sigv4; no CLI needed) ────────
-if [[ -n "${OTA_R2_BUCKET:-}" ]]; then
-    : "${OTA_R2_ACCOUNT_ID:?set OTA_R2_ACCOUNT_ID}" "${OTA_R2_ACCESS_KEY_ID:?set OTA_R2_ACCESS_KEY_ID}" "${OTA_R2_SECRET_ACCESS_KEY:?set OTA_R2_SECRET_ACCESS_KEY}"
-    R2_URL="https://${OTA_R2_ACCOUNT_ID}.r2.cloudflarestorage.com/${OTA_R2_BUCKET}"
-    r2() { curl -sS --aws-sigv4 "aws:amz:auto:s3" --user "$OTA_R2_ACCESS_KEY_ID:$OTA_R2_SECRET_ACCESS_KEY" "$@"; }
-    # "patch_1.0.4_v4_to_v7_…" → "patch v4 → v7", "bundle_…_v7_…" → "bundle v7"
-    pretty() {
-        case "$1" in
-            patch_*) echo "$1" | sed -E 's/.*_v([0-9]+)_to_v([0-9]+)_.*/patch v\1 → v\2/' ;;
-            bundle_*) echo "$1" | sed -E 's/.*_v([0-9]+)_.*/bundle v\1/' ;;
-            asset-manifest_*) echo "asset manifest" ;;
-            *) echo "$1" ;;
-        esac
-    }
-    r2_put() { # <file> <key> <cache-control> <label>
-        local SIZE PROGRESS=(-s) BAR=false
-        SIZE=$(wc -c < "$1" | tr -d ' ')
-        # Progress bar for big files (bundles) in a terminal; erased once done
-        if [ -t 1 ] && [ "$SIZE" -gt 1048576 ]; then printf "        ↑ %s\n" "$4"; PROGRESS=(-#); BAR=true; fi
-        COLUMNS=60 curl -S "${PROGRESS[@]}" -f --aws-sigv4 "aws:amz:auto:s3" --user "$OTA_R2_ACCESS_KEY_ID:$OTA_R2_SECRET_ACCESS_KEY" \
-            -X PUT -T "$1" -H "Cache-Control: $3" "$R2_URL/$2" -o /dev/null || { echo "  ❌ Upload failed: $2"; exit 1; }
-        if [ "$BAR" = true ]; then printf "\033[2A\033[K\n\033[K\033[1A"; fi
-        printf "        ${GREEN}✓${RESET} %s %s\n" "$(padr "$4" 16)" "$(human_size "$SIZE")"
-    }
-    RELEASE_PREFIX="$BASE_FOLDER/$APP_VERSION/$CHANNEL"
-    IMMUTABLE="public, max-age=31536000, immutable"
-
-    if [ "$CLEAN_REMOTE" = true ]; then
-        # ponytail: one ListObjectsV2 page (1000 keys); a release+channel holds far fewer
-        LISTING=$(r2 -f "$R2_URL?list-type=2&prefix=$RELEASE_PREFIX/") || { echo "  ❌ Listing $RELEASE_PREFIX/ failed"; exit 1; }
-        DELETED=0; BUNDLES=0; PATCHES=0; MANIFESTS=0
-        for KEY in $(echo "$LISTING" | grep -o '<Key>[^<]*</Key>' | sed 's/<[^>]*>//g'); do
-            r2 -f -X DELETE "$R2_URL/$KEY" -o /dev/null || { echo "  ❌ Delete failed: $KEY"; exit 1; }
-            DELETED=$((DELETED + 1))
-            case "$KEY" in *.hbc) BUNDLES=$((BUNDLES + 1)) ;; *.patch) PATCHES=$((PATCHES + 1)) ;; *.json) MANIFESTS=$((MANIFESTS + 1)) ;; esac
-            if [ -t 1 ]; then printf "\r\033[K  ${DIM}%-9s${RESET} deleting… %d" "remote" "$DELETED"; fi
-        done
-        if [ -t 1 ]; then printf "\r\033[K"; fi
-        info remote "$DELETED object(s) deleted ${DIM}($BUNDLES bundles · $PATCHES patches · $MANIFESTS manifests)${RESET}"
-    else
-        # Only this version's files: earlier bundles/patches are already uploaded and never change
-        RELEASE_FILES=()
-        for FILE in "$OUTPUT_DIR"/*_v"${OTA_VERSION}"_*.{patch,hbc,json}; do
-            [[ -f "$FILE" ]] && is_release_file "$(basename "$FILE")" && RELEASE_FILES+=("$FILE")
-        done
-        for FILE in "${RELEASE_FILES[@]}"; do
-            FNAME=$(basename "$FILE")
-            r2_put "$FILE" "$RELEASE_PREFIX/$FNAME" "$IMMUTABLE" "$(pretty "$FNAME")"
-        done
-        # Content-addressed assets: upload only hashes the bucket doesn't have yet
-        ASSETS=("$OUTPUT_DIR"/asset-store/*)
-        [[ -f "${ASSETS[0]}" ]] || ASSETS=()
-        N=0; NEW=0; NEW_BYTES=0
-        for FILE in "${ASSETS[@]}"; do
-            N=$((N + 1))
-            KEY="$BASE_FOLDER/assets/$(basename "$FILE")"
-            if ! r2 -f -I "$R2_URL/$KEY" -o /dev/null 2>/dev/null; then
-                r2 -f -X PUT -T "$FILE" -H "Cache-Control: $IMMUTABLE" "$R2_URL/$KEY" -o /dev/null || { echo "  ❌ Upload failed: $KEY"; exit 1; }
-                NEW=$((NEW + 1)); NEW_BYTES=$((NEW_BYTES + $(wc -c < "$FILE")))
-            fi
-            if [ -t 1 ]; then printf "\r\033[K        ${DIM}assets %d/%d checked${RESET}" "$N" "${#ASSETS[@]}"; fi
-        done
-        if [ -t 1 ] && [ ${#ASSETS[@]} -gt 0 ]; then printf "\r\033[K"; fi
-        printf "        ${GREEN}✓${RESET} %s %s\n" "$(padr assets 16)" "${#ASSETS[@]} · $NEW new ($(human_size "$NEW_BYTES"))"
-    fi
+: "${OTA_R2_ACCOUNT_ID:?set OTA_R2_ACCOUNT_ID}" "${OTA_R2_ACCESS_KEY_ID:?set OTA_R2_ACCESS_KEY_ID}" "${OTA_R2_SECRET_ACCESS_KEY:?set OTA_R2_SECRET_ACCESS_KEY}"
+R2_URL="https://${OTA_R2_ACCOUNT_ID}.r2.cloudflarestorage.com/${OTA_R2_BUCKET}"
+r2() { curl -sS --aws-sigv4 "aws:amz:auto:s3" --user "$OTA_R2_ACCESS_KEY_ID:$OTA_R2_SECRET_ACCESS_KEY" "$@"; }
+# "patch_1.0.4_v4_to_v7_…" → "patch v4 → v7", "bundle_…_v7_…" → "bundle v7"
+pretty() {
+    case "$1" in
+        patch_*) echo "$1" | sed -E 's/.*_v([0-9]+)_to_v([0-9]+)_.*/patch v\1 → v\2/' ;;
+        bundle_*) echo "$1" | sed -E 's/.*_v([0-9]+)_.*/bundle v\1/' ;;
+        asset-manifest_*) echo "asset manifest" ;;
+    release_*) echo "release info" ;;
+        *) echo "$1" ;;
+    esac
+}
+TOTAL_BYTES=0
+r2_put() { # <file> <key> <cache-control> <label>
+    local SIZE; SIZE=$(file_size "$1")
+    RUN_NOTE="↑ $4 · $(human_size "$SIZE")" run_logged "$WORK/curl.log" \
+        r2 -f -X PUT -T "$1" -H "Cache-Control: $3" "$R2_URL/$2" -o /dev/null \
+        || { step_fail "upload failed: $2"; cat "$WORK/curl.log"; exit 1; }
+    TOTAL_BYTES=$((TOTAL_BYTES + SIZE))
+}
+RELEASE_PREFIX="$BASE_FOLDER/$APP_VERSION/$CHANNEL"
+IMMUTABLE="public, max-age=31536000, immutable"
+
+if [ "$CLEAN_REMOTE" = true ]; then
+    # ponytail: one ListObjectsV2 page (1000 keys); a release+channel holds far fewer
+    LISTING=$(r2 -f "$R2_URL?list-type=2&prefix=$RELEASE_PREFIX/") || { step_fail "listing $RELEASE_PREFIX/ failed"; exit 1; }
+    DELETED=0; BUNDLES=0; PATCHES=0; MANIFESTS=0
+    for KEY in $(echo "$LISTING" | grep -o '<Key>[^<]*</Key>' | sed 's/<[^>]*>//g'); do
+        r2 -f -X DELETE "$R2_URL/$KEY" -o /dev/null || { step_fail "delete failed: $KEY"; exit 1; }
+        DELETED=$((DELETED + 1))
+        case "$KEY" in *.hbc) BUNDLES=$((BUNDLES + 1)) ;; *.patch) PATCHES=$((PATCHES + 1)) ;; *.json) MANIFESTS=$((MANIFESTS + 1)) ;; esac
+        step_progress "deleting… $DELETED"
+    done
     # Registry last: clients never see a version whose files aren't uploaded yet
-    if [ "$CLEAN_REMOTE" = true ]; then
-        r2 -f -X PUT -T "$REGISTRY_FILE" -H "Cache-Control: no-cache" "$R2_URL/$BASE_FOLDER/ota_registry.json" -o /dev/null || { echo "  ❌ Upload failed: ota_registry.json"; exit 1; }
-        info registry "uploaded"
-    else
-        r2_put "$REGISTRY_FILE" "$BASE_FOLDER/ota_registry.json" "no-cache" "registry"
-    fi
+    r2 -f -X PUT -T "$REGISTRY_FILE" -H "Cache-Control: no-cache" "$R2_URL/$BASE_FOLDER/ota_registry.json" -o /dev/null || { step_fail "upload failed: ota_registry.json"; exit 1; }
+    report UP_SIZE "$DELETED deleted"
+    report UP_NOTE "$BUNDLES bundles · $PATCHES patches · $MANIFESTS manifests · registry updated"
     exit 0
 fi
 
-# ── GitHub Auto-Push Integration ──────────────────────────────────────────────
-if [[ "$BASE_URL" != "https://raw.githubusercontent.com/"* ]]; then
-    echo "ERROR: OTA_BASE_URL must be https://raw.githubusercontent.com/<owner>/<repo>/<branch>"
-    exit 1
-fi
-
-    # Parse OWNER, REPO, BRANCH from URL
-    # Example: https://raw.githubusercontent.com/hungbv-taureau/baseform-storage/main
-    CLEAN_URL="${BASE_URL#https://raw.githubusercontent.com/}"
-    OWNER=$(echo "$CLEAN_URL" | cut -d'/' -f1)
-    REPO=$(echo "$CLEAN_URL" | cut -d'/' -f2)
-    BRANCH=$(echo "$CLEAN_URL" | cut -d'/' -f3)
-    if [[ -z "$BRANCH" ]]; then BRANCH="main"; fi
-
-    # Check for gh token or env tokens
-    GH_CLI_TOKEN=$(gh auth token 2>/dev/null || true)
-    TOKEN="${GH_CLI_TOKEN:-${GH_TOKEN:-${GITHUB_TOKEN:-}}}"
-    if [[ "$TOKEN" == "baseform" ]]; then TOKEN=""; fi
-
-    # Token goes in a per-command header, never into the clone's .git/config
-    GIT_AUTH=()
-    if [[ -n "$TOKEN" ]]; then
-        GIT_REMOTE="https://github.com/${OWNER}/${REPO}.git"
-        GIT_AUTH=(-c "http.https://github.com/.extraheader=AUTHORIZATION: basic $(printf 'x-access-token:%s' "$TOKEN" | base64 | tr -d '\n')")
-        echo "  Using authenticated gh CLI token for ${OWNER}/${REPO}"
-    else
-        GIT_REMOTE="git@github.com:${OWNER}/${REPO}.git"
-    fi
-
-    GH_REPO_DIR="/tmp/ota_git_repo_${REPO}"
-
-    echo ""
-    echo "=== Auto Syncing OTA Release to GitHub Storage ==="
-    echo "  Target Repo : ${OWNER}/${REPO}"
-    echo "  Branch      : ${BRANCH}"
-    
-    # 1. Clone or Pull target storage repo
-    if [ -d "$GH_REPO_DIR/.git" ]; then
-        echo "  Syncing local storage clone with remote..."
-        git -C "$GH_REPO_DIR" remote set-url origin "$GIT_REMOTE" 2>/dev/null || true
-        git "${GIT_AUTH[@]}" -C "$GH_REPO_DIR" fetch origin "$BRANCH" 2>/dev/null || true
-        git -C "$GH_REPO_DIR" checkout "$BRANCH" 2>/dev/null || true
-        git -C "$GH_REPO_DIR" reset --hard "origin/$BRANCH" 2>/dev/null || true
-    else
-        echo "  Cloning storage repository..."
-        rm -rf "$GH_REPO_DIR"
-        git "${GIT_AUTH[@]}" clone --branch "$BRANCH" --depth 1 "$GIT_REMOTE" "$GH_REPO_DIR" 2>/dev/null || git "${GIT_AUTH[@]}" clone "$GIT_REMOTE" "$GH_REPO_DIR" || exit 1
-        chmod 700 "$GH_REPO_DIR"
-    fi
-
-    # 2. Copy generated files into storage repo (or reset remote)
-    if [ "$CLEAN_REMOTE" = true ]; then
-        echo "  Resetting remote storage state for channel '$CHANNEL' ..."
-        rm -rf "$GH_REPO_DIR/$BASE_FOLDER/$APP_VERSION/${CHANNEL:?}"
-        mkdir -p "$GH_REPO_DIR/$BASE_FOLDER"
-        cp "$REGISTRY_FILE" "$GH_REPO_DIR/$BASE_FOLDER/ota_registry.json"
-        cp "$REGISTRY_FILE" "$GH_REPO_DIR/ota_registry.json" 2>/dev/null || true
-    else
-        TARGET_RELEASE_DIR="$GH_REPO_DIR/$BASE_FOLDER/$APP_VERSION/$CHANNEL"
-        mkdir -p "$TARGET_RELEASE_DIR"
-        
-        echo "  Copying release files to storage repo for channel '$CHANNEL'..."
-        for FILE in "$OUTPUT_DIR"/*.{patch,hbc,json}; do
-            [[ -f "$FILE" ]] || continue
-            FNAME=$(basename "$FILE")
-            is_release_file "$FNAME" || continue
-            cp "$FILE" "$TARGET_RELEASE_DIR/$FNAME"
-        done
-
-        # Copy asset store if present
-        if [[ -d "$OUTPUT_DIR/asset-store" ]]; then
-            TARGET_ASSET_DIR="$GH_REPO_DIR/$BASE_FOLDER/assets"
-            mkdir -p "$TARGET_ASSET_DIR"
-            cp -R "$OUTPUT_DIR/asset-store/"* "$TARGET_ASSET_DIR/" 2>/dev/null || true
-        fi
+# Only this version's files: earlier bundles/patches are already uploaded and never change.
+# The bundle ships as its .gz only (written by update_registry.js): clients and later
+# `patch` runs decompress it, so the raw .hbc never needs to be on storage.
+for FILE in "$OUTPUT_DIR"/*_v"${OTA_VERSION}"_*.{patch,gz,json}; do
+    [[ -f "$FILE" ]] || continue
+    FNAME=$(basename "$FILE")
+    is_release_file "$FNAME" || continue
+    r2_put "$FILE" "$RELEASE_PREFIX/$FNAME" "$IMMUTABLE" "$(pretty "$FNAME")"
+    if [[ "$FNAME" == *.hbc.gz ]]; then report UP_GZIP_BYTES "$(file_size "$FILE")"; fi
+done
 
-        # Copy ota_registry.json
-        mkdir -p "$GH_REPO_DIR/$BASE_FOLDER"
-        cp "$REGISTRY_FILE" "$GH_REPO_DIR/$BASE_FOLDER/ota_registry.json"
-        cp "$REGISTRY_FILE" "$GH_REPO_DIR/ota_registry.json" 2>/dev/null || true
-    fi
+# Content-addressed assets: upload only hashes the bucket doesn't have yet.
+# One listing (1000 keys a page) instead of a HEAD request per asset.
+ASSETS=("$OUTPUT_DIR"/asset-store/*)
+[[ -f "${ASSETS[0]}" ]] || ASSETS=()
+if [ ${#ASSETS[@]} -gt 0 ]; then
+    step_progress "checking ${#ASSETS[@]} assets…"
+    : > "$WORK/remote-assets"
+    AFTER=""
+    while :; do
+        PAGE=$(r2 -f "$R2_URL?list-type=2&prefix=$BASE_FOLDER/assets/${AFTER:+&start-after=$AFTER}") || { step_fail "listing $BASE_FOLDER/assets/ failed"; exit 1; }
+        echo "$PAGE" | grep -o '<Key>[^<]*</Key>' | sed 's/<[^>]*>//g' >> "$WORK/remote-assets"
+        [[ "$PAGE" == *"<IsTruncated>true</IsTruncated>"* ]] || break
+        AFTER=$(tail -n 1 "$WORK/remote-assets")
+    done
+    NEW=0; NEW_BYTES=0
+    for FILE in "${ASSETS[@]}"; do
+        KEY="$BASE_FOLDER/assets/$(basename "$FILE")"
+        grep -qxF "$KEY" "$WORK/remote-assets" && continue
+        step_progress "↑ asset $((NEW + 1)) · $(basename "$FILE")"
+        r2 -f -X PUT -T "$FILE" -H "Cache-Control: $IMMUTABLE" "$R2_URL/$KEY" -o /dev/null || { step_fail "upload failed: $KEY"; exit 1; }
+        NEW=$((NEW + 1)); NEW_BYTES=$((NEW_BYTES + $(file_size "$FILE")))
+    done
+    report UP_ASSETS "$NEW new of ${#ASSETS[@]} · $(human_size "$NEW_BYTES")"; TOTAL_BYTES=$((TOTAL_BYTES + NEW_BYTES))
+fi
 
-    # 3. Commit and Push to GitHub
-    cd "$GH_REPO_DIR"
-    # Fallback identity only where none is configured (e.g. CI); never override the user's
-    git config user.name >/dev/null || git config user.name "react-native-bspatch"
-    git config user.email >/dev/null || git config user.email "react-native-bspatch@users.noreply.github.com"
-    git add .
-    if git diff --staged --quiet; then
-        echo "  ✓ Storage repository is up to date (no changes)."
-    else
-        COMMIT_MSG="auto(ota): publish $PLATFORM $APP_VERSION v$OTA_VERSION ($CHANNEL)"
-        if [ "$CLEAN_REMOTE" = true ]; then
-            COMMIT_MSG="auto(ota): reset remote OTA registry and releases"
-        fi
-        echo "  Committing OTA changes ($COMMIT_MSG)..."
-        git commit -m "$COMMIT_MSG"
-        echo "  Pushing to GitHub (${BRANCH})..."
-        
-        if git "${GIT_AUTH[@]}" push origin "$BRANCH"; then
-            echo "  ✓ Successfully pushed OTA release to GitHub!"
-        else
-            # Usually someone else pushed first: re-run so the registry is re-synced, never force-push
-            echo "  ❌ Git push failed (remote changed or no write access to ${OWNER}/${REPO}). Re-run the build."
-            exit 1
-        fi
-    fi
-    cd "$ROOT_DIR"
-    echo ""
-    echo "=== GitHub Sync Complete ==="
+# Registry last: clients never see a version whose files aren't uploaded yet
+r2_put "$REGISTRY_FILE" "$BASE_FOLDER/ota_registry.json" "no-cache" "registry"
+report UP_SIZE "$(human_size "$TOTAL_BYTES")"
+report UP_DEST "R2 $OTA_R2_BUCKET"