swiftpatch-cli 1.1.3 → 1.1.4

package/dist/index.js

@@ -57,16 +57,26 @@ __export(api_exports, {
   api: () => api
 });
 import axios from "axios";
-function warnIfInsecure(url) {
+import { readFileSync } from "fs";
+import { dirname, join } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+function rejectIfInsecure(url) {
   if (url.startsWith("http://") && !url.includes("localhost") && !url.includes("127.0.0.1")) {
-    console.warn(
-      "\x1B[33m\u26A0 Warning: API URL uses HTTP instead of HTTPS. This is insecure for production use.\x1B[0m"
-    );
+    if (process.env.SWIFTPATCH_ALLOW_INSECURE === "1") {
+      console.warn(
+        "\x1B[33m\u26A0 Warning: API URL uses HTTP instead of HTTPS. Credentials will be sent in plaintext.\x1B[0m"
+      );
+    } else {
+      throw new Error(
+        "API URL uses HTTP instead of HTTPS. This is insecure and credentials would be sent in plaintext.\nSet SWIFTPATCH_ALLOW_INSECURE=1 to bypass this check (not recommended for production)."
+      );
+    }
   }
 }
-function normalizeIds(obj) {
+function normalizeIds(obj, depth = 0) {
+  if (depth > 20) return obj;
   if (obj === null || obj === void 0) return obj;
-  if (Array.isArray(obj)) return obj.map(normalizeIds);
+  if (Array.isArray(obj)) return obj.map((item) => normalizeIds(item, depth + 1));
   if (typeof obj === "object") {
     const result = {};
     for (const [key, value] of Object.entries(obj)) {
@@ -75,14 +85,14 @@ function normalizeIds(obj) {
       } else if (key === "__v") {
         continue;
       } else {
-        result[key] = normalizeIds(value);
+        result[key] = normalizeIds(value, depth + 1);
       }
     }
     return result;
   }
   return obj;
 }
-var API_BASE_URL, ApiClient, api;
+var API_BASE_URL, __dirname2, CLI_VERSION, ApiClient, api;
 var init_api = __esm({
   "src/lib/api.ts"() {
     "use strict";
@@ -90,17 +100,24 @@ var init_api = __esm({
     init_auth();
     init_config();
     API_BASE_URL = process.env.SWIFTPATCH_API_URL || "https://api.blendapp.ae/api/v1";
+    __dirname2 = dirname(fileURLToPath2(import.meta.url));
+    CLI_VERSION = "1.0.0";
+    try {
+      const pkg = JSON.parse(readFileSync(join(__dirname2, "../package.json"), "utf-8"));
+      CLI_VERSION = pkg.version;
+    } catch {
+    }
     ApiClient = class {
       client;
       constructor() {
         const baseURL = config.get("apiUrl") || API_BASE_URL;
-        warnIfInsecure(baseURL);
+        rejectIfInsecure(baseURL);
         this.client = axios.create({
           baseURL,
           timeout: 3e4,
           headers: {
             "Content-Type": "application/json",
-            "User-Agent": "swiftpatch-cli/1.0.0"
+            "User-Agent": `swiftpatch-cli/${CLI_VERSION}`
           }
         });
         this.client.interceptors.request.use((reqConfig) => {
@@ -475,9 +492,9 @@ init_esm_shims();
 init_esm_shims();
 import { Command as Command47 } from "commander";
 import chalk45 from "chalk";
-import { readFileSync as readFileSync3 } from "fs";
-import { fileURLToPath as fileURLToPath2 } from "url";
-import { dirname as dirname2, join as join2 } from "path";
+import { readFileSync as readFileSync4 } from "fs";
+import { fileURLToPath as fileURLToPath3 } from "url";
+import { dirname as dirname3, join as join3 } from "path";
 
 // src/commands/login.ts
 init_esm_shims();
@@ -520,7 +537,7 @@ var logger = {
 };
 
 // src/commands/login.ts
-var loginCommand = new Command("login").description("Authenticate with SwiftPatch").option("-k, --api-key <key>", "Login with API key (for CI/CD)").option("-e, --email <email>", "Login with email and password").option("-p, --password <password>", "Password (used with --email)").option("-i, --interactive", "Force interactive login").action(async (options) => {
+var loginCommand = new Command("login").description("Authenticate with SwiftPatch").option("-k, --api-key <key>", "Login with API key (for CI/CD)").option("-e, --email <email>", "Login with email and password").option("-i, --interactive", "Force interactive login").action(async (options) => {
   const existingToken = auth.getToken();
   if (existingToken && !options.interactive && !options.apiKey && !options.email) {
     const user = await api.getCurrentUser().catch(() => null);
@@ -556,7 +573,7 @@ var loginCommand = new Command("login").description("Authenticate with SwiftPatc
     return;
   }
   if (options.email) {
-    await emailLogin(options.email, options.password);
+    await emailLogin(options.email);
     return;
   }
   const { method } = await inquirer.prompt([
@@ -579,19 +596,17 @@ var loginCommand = new Command("login").description("Authenticate with SwiftPatc
     await apiKeyLogin();
   }
 });
-async function emailLogin(email, password) {
-  if (!password) {
-    const answers = await inquirer.prompt([
-      {
-        type: "password",
-        name: "password",
-        message: "Password:",
-        mask: "*",
-        validate: (input) => input ? true : "Password is required"
-      }
-    ]);
-    password = answers.password;
-  }
+async function emailLogin(email) {
+  const answers = await inquirer.prompt([
+    {
+      type: "password",
+      name: "password",
+      message: "Password:",
+      mask: "*",
+      validate: (input) => input ? true : "Password is required"
+    }
+  ]);
+  const password = answers.password;
   const spinner = ora("Logging in...").start();
   try {
     const result = await api.loginWithCredentials(email, password);
@@ -615,26 +630,19 @@ async function emailLogin(email, password) {
   }
 }
 async function emailLoginInteractive() {
-  const { email, password } = await inquirer.prompt([
+  const { email } = await inquirer.prompt([
     {
       type: "input",
       name: "email",
       message: "Email:",
       validate: (input) => {
         if (!input) return "Email is required";
-        if (!input.includes("@")) return "Invalid email format";
+        if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(input)) return "Invalid email format";
         return true;
       }
-    },
-    {
-      type: "password",
-      name: "password",
-      message: "Password:",
-      mask: "*",
-      validate: (input) => input ? true : "Password is required"
     }
   ]);
-  await emailLogin(email, password);
+  await emailLogin(email);
 }
 async function browserLogin() {
   const spinner = ora("Opening browser...").start();
@@ -1150,7 +1158,6 @@ import { Command as Command10 } from "commander";
 import chalk12 from "chalk";
 import inquirer6 from "inquirer";
 import ora7 from "ora";
-import path4 from "path";
 import fs6 from "fs-extra";
 
 // src/lib/bundler.ts
@@ -1168,8 +1175,7 @@ var bundler = {
       minify = true,
       sourcemap = false
     } = options;
-    const tempDir = path2.join(os2.tmpdir(), `swiftpatch-bundle-${Date.now()}`);
-    await fs.ensureDir(tempDir);
+    const tempDir = await fs.mkdtemp(path2.join(os2.tmpdir(), "swiftpatch-bundle-"));
     const bundlePath = path2.join(tempDir, `index.${platform}.bundle`);
     const sourcemapPath = sourcemap ? path2.join(tempDir, `index.${platform}.bundle.map`) : void 0;
     const args = [
@@ -1206,8 +1212,7 @@ var bundler = {
 function runCommand(command, args) {
   return new Promise((resolve, reject) => {
     const child = spawn(command, args, {
-      stdio: ["inherit", "pipe", "pipe"],
-      shell: true
+      stdio: ["inherit", "pipe", "pipe"]
     });
     let stderr = "";
     child.stdout?.on("data", () => {
@@ -1232,9 +1237,13 @@ function runCommand(command, args) {
 init_esm_shims();
 import axios2 from "axios";
 import fs2 from "fs-extra";
+var MAX_UPLOAD_SIZE = 500 * 1024 * 1024;
 var uploader = {
   async uploadBundle(uploadUrl, bundlePath, onProgress) {
     const fileSize = (await fs2.stat(bundlePath)).size;
+    if (fileSize > MAX_UPLOAD_SIZE) {
+      throw new Error(`Bundle size (${(fileSize / 1024 / 1024).toFixed(1)}MB) exceeds maximum upload size of ${MAX_UPLOAD_SIZE / 1024 / 1024}MB`);
+    }
     const fileStream = fs2.createReadStream(bundlePath);
     let uploadedBytes = 0;
     fileStream.on("data", (chunk) => {
@@ -1256,6 +1265,9 @@ var uploader = {
    */
   async uploadZip(uploadUrl, zipPath, onProgress) {
     const fileSize = (await fs2.stat(zipPath)).size;
+    if (fileSize > MAX_UPLOAD_SIZE) {
+      throw new Error(`ZIP size (${(fileSize / 1024 / 1024).toFixed(1)}MB) exceeds maximum upload size of ${MAX_UPLOAD_SIZE / 1024 / 1024}MB`);
+    }
     const fileStream = fs2.createReadStream(zipPath);
     let uploadedBytes = 0;
     fileStream.on("data", (chunk) => {
@@ -1296,7 +1308,7 @@ function sleep2(ms) {
 init_esm_shims();
 import crypto2 from "crypto";
 import fs3 from "fs-extra";
-import { readFileSync } from "fs";
+import { readFileSync as readFileSync2 } from "fs";
 async function hashBundle(bundlePath) {
   return new Promise((resolve, reject) => {
     const hash = crypto2.createHash("sha256");
@@ -1308,7 +1320,7 @@ async function hashBundle(bundlePath) {
 }
 function calculateZipHash(filePath) {
   try {
-    const fileBuffer = readFileSync(filePath);
+    const fileBuffer = readFileSync2(filePath);
     return crypto2.createHash("sha256").update(fileBuffer).digest("hex");
   } catch {
     return null;
@@ -1677,14 +1689,13 @@ var releaseCommand = new Command10("release").description("Bundle and publish a
 });
 async function detectAppFromConfig() {
   const configPaths = [
-    "./swiftpatch.config.js",
     "./swiftpatch.config.json",
     "./.swiftpatchrc"
   ];
   for (const configPath of configPaths) {
     if (await fs6.pathExists(configPath)) {
       try {
-        const config2 = configPath.endsWith(".js") ? (await import(path4.resolve(configPath))).default : await fs6.readJson(configPath);
+        const config2 = await fs6.readJson(configPath);
         return config2.appId || config2.app;
       } catch {
         continue;
@@ -2794,7 +2805,7 @@ init_esm_shims();
 import { Command as Command34 } from "commander";
 import chalk32 from "chalk";
 import ora27 from "ora";
-import path5 from "path";
+import path4 from "path";
 import fs7 from "fs-extra";
 
 // src/lib/claude.ts
@@ -2954,7 +2965,7 @@ async function collectDiagnostics(projectRoot) {
     gradleDeps: [],
     warnings: []
   };
-  const pkgPath = path5.join(projectRoot, "package.json");
+  const pkgPath = path4.join(projectRoot, "package.json");
   if (await fs7.pathExists(pkgPath)) {
     try {
       diag.packageJson = await fs7.readJson(pkgPath);
@@ -2985,13 +2996,13 @@ async function collectDiagnostics(projectRoot) {
   }
   const assetDirs = ["assets", "src/assets", "app/assets", "src/images"];
   for (const dir of assetDirs) {
-    const fullDir = path5.join(projectRoot, dir);
+    const fullDir = path4.join(projectRoot, dir);
     if (await fs7.pathExists(fullDir)) {
       try {
         const files = await fs7.readdir(fullDir);
         for (const file of files.slice(0, 50)) {
           try {
-            const stat = await fs7.stat(path5.join(fullDir, file));
+            const stat = await fs7.stat(path4.join(fullDir, file));
             if (stat.isFile() && stat.size > 100 * 1024) {
               diag.assets.push({ name: `${dir}/${file}`, sizeKB: Math.round(stat.size / 1024) });
             }
@@ -3002,7 +3013,7 @@ async function collectDiagnostics(projectRoot) {
       }
     }
   }
-  const gradlePath = path5.join(projectRoot, "android/app/build.gradle");
+  const gradlePath = path4.join(projectRoot, "android/app/build.gradle");
   if (await fs7.pathExists(gradlePath)) {
     try {
       const gradle = await fs7.readFile(gradlePath, "utf-8");
@@ -3014,7 +3025,7 @@ async function collectDiagnostics(projectRoot) {
     } catch {
     }
   }
-  const gradlePropsPath = path5.join(projectRoot, "android/gradle.properties");
+  const gradlePropsPath = path4.join(projectRoot, "android/gradle.properties");
   if (await fs7.pathExists(gradlePropsPath)) {
     try {
       const props = await fs7.readFile(gradlePropsPath, "utf-8");
@@ -3025,9 +3036,9 @@ async function collectDiagnostics(projectRoot) {
     }
   }
   const signingPaths = [
-    path5.join(projectRoot, "swiftpatch-private.pem"),
-    path5.join(projectRoot, ".swiftpatch/private.pem"),
-    path5.join(projectRoot, "keys/swiftpatch-private.pem")
+    path4.join(projectRoot, "swiftpatch-private.pem"),
+    path4.join(projectRoot, ".swiftpatch/private.pem"),
+    path4.join(projectRoot, "keys/swiftpatch-private.pem")
   ];
   for (const p of signingPaths) {
     if (await fs7.pathExists(p)) {
@@ -3035,7 +3046,7 @@ async function collectDiagnostics(projectRoot) {
       break;
     }
   }
-  const podfileLock = path5.join(projectRoot, "ios/Podfile.lock");
+  const podfileLock = path4.join(projectRoot, "ios/Podfile.lock");
   if (await fs7.pathExists(podfileLock)) {
     try {
       const stat = await fs7.stat(podfileLock);
@@ -3046,8 +3057,8 @@ async function collectDiagnostics(projectRoot) {
   return diag;
 }
 var aiDoctorCommand = new Command34("doctor").description("AI-powered pre-publish diagnostics for your React Native project").option("-d, --dir <path>", "Project root directory", process.cwd()).option("-y, --yes", "Skip consent prompt (for CI/CD)").option("--json", "Output raw diagnostics as JSON").action(async (options) => {
-  const projectRoot = path5.resolve(options.dir);
-  if (!await fs7.pathExists(path5.join(projectRoot, "package.json"))) {
+  const projectRoot = path4.resolve(options.dir);
+  if (!await fs7.pathExists(path4.join(projectRoot, "package.json"))) {
     logger.error("No package.json found. Run this from your React Native project root.");
     process.exit(1);
   }
@@ -3809,7 +3820,7 @@ init_api();
 import { Command as Command39 } from "commander";
 import chalk37 from "chalk";
 import ora31 from "ora";
-import path9 from "path";
+import path8 from "path";
 import fs11 from "fs-extra";
 import os3 from "os";
 
@@ -3817,10 +3828,10 @@ import os3 from "os";
 init_esm_shims();
 import archiver from "archiver";
 import fs8 from "fs";
-import path6 from "path";
+import path5 from "path";
 function createZip(inputPath, outputPath) {
   return new Promise((resolve, reject) => {
-    const zipPath = path6.join(outputPath, "build.zip");
+    const zipPath = path5.join(outputPath, "build.zip");
     const output = fs8.createWriteStream(zipPath);
     const archive = archiver("zip", { zlib: { level: 9 } });
     output.on("close", () => resolve());
@@ -3834,25 +3845,25 @@ function createZip(inputPath, outputPath) {
 // src/lib/artifacts.ts
 init_esm_shims();
 import fs9 from "fs-extra";
-import path7 from "path";
+import path6 from "path";
 async function keepArtifacts(contentRootPath, platform, variant) {
-  const artifactsDir = path7.join(process.cwd(), "swiftpatch-artifacts", platform, variant);
+  const artifactsDir = path6.join(process.cwd(), "swiftpatch-artifacts", platform, variant);
   await fs9.ensureDir(artifactsDir);
-  const bundlesDir = path7.join(contentRootPath, "bundles");
-  const sourcemapsDir = path7.join(contentRootPath, "sourcemaps");
+  const bundlesDir = path6.join(contentRootPath, "bundles");
+  const sourcemapsDir = path6.join(contentRootPath, "sourcemaps");
   if (await fs9.pathExists(bundlesDir)) {
-    await copyDirRecursive(bundlesDir, path7.join(artifactsDir, "bundles"));
+    await copyDirRecursive(bundlesDir, path6.join(artifactsDir, "bundles"));
   }
   if (await fs9.pathExists(sourcemapsDir)) {
-    await copyDirRecursive(sourcemapsDir, path7.join(artifactsDir, "sourcemaps"));
+    await copyDirRecursive(sourcemapsDir, path6.join(artifactsDir, "sourcemaps"));
   }
 }
 async function copyDirRecursive(srcDir, destDir) {
   await fs9.ensureDir(destDir);
   const entries = await fs9.readdir(srcDir);
   for (const entry of entries) {
-    const srcPath = path7.join(srcDir, entry);
-    const destPath = path7.join(destDir, entry);
+    const srcPath = path6.join(srcDir, entry);
+    const destPath = path6.join(destDir, entry);
     const stat = await fs9.stat(srcPath);
     if (stat.isDirectory()) {
       await copyDirRecursive(srcPath, destPath);
@@ -3864,16 +3875,16 @@ async function copyDirRecursive(srcDir, destDir) {
 
 // src/lib/react-native-utils.ts
 init_esm_shims();
-import * as path8 from "path";
+import * as path7 from "path";
 import * as fs10 from "fs";
 import * as childProcess from "child_process";
 import { coerce, compare } from "semver";
 function findUpwardReactNativePackageJson(startDir = process.cwd()) {
   let current = startDir;
-  while (current !== path8.parse(current).root) {
-    const candidate = path8.join(current, "node_modules", "react-native", "package.json");
+  while (current !== path7.parse(current).root) {
+    const candidate = path7.join(current, "node_modules", "react-native", "package.json");
     if (fs10.existsSync(candidate)) return candidate;
-    current = path8.dirname(current);
+    current = path7.dirname(current);
   }
   return null;
 }
@@ -3883,9 +3894,9 @@ function getReactNativeVersion() {
   const rnPackageJson = JSON.parse(fs10.readFileSync(rnPackageJsonPath, "utf-8"));
   return rnPackageJson.version;
 }
-function directoryExistsSync(dirname3) {
+function directoryExistsSync(dirname4) {
   try {
-    return fs10.statSync(dirname3).isDirectory();
+    return fs10.statSync(dirname4).isDirectory();
   } catch (err) {
     if (err.code !== "ENOENT") throw err;
   }
@@ -3893,14 +3904,14 @@ function directoryExistsSync(dirname3) {
 }
 function getReactNativePackagePath() {
   const rnPackageJsonPath = findUpwardReactNativePackageJson();
-  if (rnPackageJsonPath) return path8.dirname(rnPackageJsonPath);
+  if (rnPackageJsonPath) return path7.dirname(rnPackageJsonPath);
   const result = childProcess.spawnSync("node", [
     "--print",
     "require.resolve('react-native/package.json')"
   ]);
-  const packagePath = path8.dirname(result.stdout.toString().trim());
+  const packagePath = path7.dirname(result.stdout.toString().trim());
   if (result.status === 0 && directoryExistsSync(packagePath)) return packagePath;
-  return path8.join("node_modules", "react-native");
+  return path7.join("node_modules", "react-native");
 }
 function resolvePackageDirFromCwd(packageName) {
   const result = childProcess.spawnSync("node", [
@@ -3910,7 +3921,7 @@ function resolvePackageDirFromCwd(packageName) {
   if (result.status !== 0) return null;
   const resolved = result.stdout.toString().trim();
   if (!resolved) return null;
-  const packageDir = path8.dirname(resolved);
+  const packageDir = path7.dirname(resolved);
   return directoryExistsSync(packageDir) ? packageDir : null;
 }
 function isValidPlatform(platform) {
@@ -3924,12 +3935,12 @@ function fileExists(filePath) {
   }
 }
 function getCliPath() {
-  return path8.join(getReactNativePackagePath(), "cli.js");
+  return path7.join(getReactNativePackagePath(), "cli.js");
 }
 async function runReactNativeBundleCommand(bundleName, entryFile, outputFolder, platform, sourcemap, devMode) {
-  fs10.mkdirSync(path8.join(outputFolder, "bundles"), { recursive: true });
+  fs10.mkdirSync(path7.join(outputFolder, "bundles"), { recursive: true });
   if (sourcemap) {
-    fs10.mkdirSync(path8.join(outputFolder, "sourcemaps"), { recursive: true });
+    fs10.mkdirSync(path7.join(outputFolder, "sourcemaps"), { recursive: true });
   }
   const reactNativeBundleArgs = [
     getCliPath(),
@@ -3937,14 +3948,14 @@ async function runReactNativeBundleCommand(bundleName, entryFile, outputFolder,
     "--dev",
     devMode,
     "--assets-dest",
-    path8.join(outputFolder, "bundles"),
+    path7.join(outputFolder, "bundles"),
     "--bundle-output",
-    path8.join(outputFolder, "bundles", bundleName),
+    path7.join(outputFolder, "bundles", bundleName),
     "--entry-file",
     entryFile,
     "--platform",
     platform,
-    ...sourcemap ? ["--sourcemap-output", path8.join(outputFolder, "sourcemaps", bundleName + ".map")] : []
+    ...sourcemap ? ["--sourcemap-output", path7.join(outputFolder, "sourcemaps", bundleName + ".map")] : []
   ];
   logger.info('Running "react-native bundle" command');
   const reactNativeBundleProcess = childProcess.spawn("node", reactNativeBundleArgs);
@@ -3970,17 +3981,27 @@ async function runHermesEmitBinaryCommand(bundleName, outputFolder, hermesLogs =
     ...sourcemap ? ["--output-source-map"] : [],
     "--emit-binary",
     "--out",
-    path8.join(outputFolder, bundleName + ".hbc"),
-    path8.join(outputFolder, "bundles", bundleName)
+    path7.join(outputFolder, bundleName + ".hbc"),
+    path7.join(outputFolder, "bundles", bundleName)
   ];
   logger.info("Converting JS bundle to Hermes bytecode");
   const hermesCommand = await getHermesCommand();
-  logger.info(`Hermesc path: ${hermescPath || hermesCommand}`);
-  const hermesProcess = childProcess.spawn(hermescPath || hermesCommand, hermesArgs);
+  const resolvedHermesPath = hermescPath || hermesCommand;
+  if (hermescPath) {
+    const binaryName = path7.basename(hermescPath).replace(/\.exe$/, "");
+    if (!["hermesc", "hermes"].includes(binaryName)) {
+      throw new Error(
+        `Invalid hermesc path: binary must be named "hermesc" or "hermes", got "${path7.basename(hermescPath)}"`
+      );
+    }
+  }
+  logger.info(`Hermesc path: ${resolvedHermesPath}`);
+  const hermesProcess = childProcess.spawn(resolvedHermesPath, hermesArgs);
   let logFile = null;
+  const logFilePath = path7.join(outputFolder, "hermes-output.log");
   let isWarned = false;
   if (hermesLogs) {
-    logFile = fs10.createWriteStream("output.log", { flags: "a" });
+    logFile = fs10.createWriteStream(logFilePath, { flags: "a" });
   }
   return new Promise((resolve, reject) => {
     hermesProcess.stdout.on("data", (data) => {
@@ -3996,15 +4017,15 @@ async function runHermesEmitBinaryCommand(bundleName, outputFolder, hermesLogs =
     });
     hermesProcess.on("close", (exitCode, signal) => {
       if (hermesLogs && logFile) {
-        logger.success("Done writing logs in output.log file.");
+        logger.success(`Done writing logs to ${logFilePath}`);
         logFile.end();
       }
       if (exitCode !== 0) {
         reject(new Error(`"hermes" command failed (exitCode=${exitCode}, signal=${signal}).`));
         return;
       }
-      const source = path8.join(outputFolder, bundleName + ".hbc");
-      const destination = path8.join(outputFolder, "bundles", bundleName);
+      const source = path7.join(outputFolder, bundleName + ".hbc");
+      const destination = path7.join(outputFolder, "bundles", bundleName);
       fs10.copyFile(source, destination, (err) => {
         if (err) {
           reject(new Error(`Copying Hermes output failed: ${err.message}`));
@@ -4041,7 +4062,7 @@ function getHermesOSExe() {
   return process.platform === "win32" ? hermesExecutableName + ".exe" : hermesExecutableName;
 }
 async function getHermesCommand() {
-  const bundledHermesEngine = path8.join(
+  const bundledHermesEngine = path7.join(
     getReactNativePackagePath(),
     "sdks",
     "hermesc",
@@ -4051,23 +4072,23 @@ async function getHermesCommand() {
   if (fileExists(bundledHermesEngine)) return bundledHermesEngine;
   const hermesEnginePackageDir = resolvePackageDirFromCwd("hermes-engine");
   if (hermesEnginePackageDir) {
-    const hermesEngine2 = path8.join(hermesEnginePackageDir, getHermesOSBin(), getHermesOSExe());
+    const hermesEngine2 = path7.join(hermesEnginePackageDir, getHermesOSBin(), getHermesOSExe());
     if (fileExists(hermesEngine2)) return hermesEngine2;
   }
-  const hermesEngine = path8.join("node_modules", "hermes-engine", getHermesOSBin(), getHermesOSExe());
+  const hermesEngine = path7.join("node_modules", "hermes-engine", getHermesOSBin(), getHermesOSExe());
   if (fileExists(hermesEngine)) return hermesEngine;
   const hermesCompilerPackageDir = resolvePackageDirFromCwd("hermes-compiler");
   if (hermesCompilerPackageDir) {
-    const hermesCompiler2 = path8.join(hermesCompilerPackageDir, "hermesc", getHermesOSBin(), getHermesOSExe());
+    const hermesCompiler2 = path7.join(hermesCompilerPackageDir, "hermesc", getHermesOSBin(), getHermesOSExe());
     if (fileExists(hermesCompiler2)) return hermesCompiler2;
   }
-  const hermesCompiler = path8.join("node_modules", "hermes-compiler", "hermesc", getHermesOSBin(), getHermesOSExe());
+  const hermesCompiler = path7.join("node_modules", "hermes-compiler", "hermesc", getHermesOSBin(), getHermesOSExe());
   if (fileExists(hermesCompiler)) return hermesCompiler;
   const hermesVmPackageDir = resolvePackageDirFromCwd("hermesvm");
   if (hermesVmPackageDir) {
-    return path8.join(hermesVmPackageDir, getHermesOSBin(), "hermes");
+    return path7.join(hermesVmPackageDir, getHermesOSBin(), "hermes");
   }
-  return path8.join("node_modules", "hermesvm", getHermesOSBin(), "hermes");
+  return path7.join("node_modules", "hermesvm", getHermesOSBin(), "hermes");
 }
 
 // src/commands/publish-bundle.ts
@@ -4116,8 +4137,7 @@ var publishBundleCommand = new Command39("publish-bundle").description("Bundle,
   const uploadPath = appSlug || resolvedAppId || "";
   const entryFile = options.entryFile || "index.js";
   const bundleName = platform === "ios" ? "main.jsbundle" : "index.android.bundle";
-  const contentRootPath = path9.join(os3.tmpdir(), `swiftpatch-publish-${Date.now()}`);
-  await fs11.ensureDir(contentRootPath);
+  const contentRootPath = await fs11.mkdtemp(path8.join(os3.tmpdir(), "swiftpatch-publish-"));
   try {
     const spinner = ora31("Bundling JavaScript...").start();
     try {
@@ -4159,7 +4179,7 @@ var publishBundleCommand = new Command39("publish-bundle").description("Bundle,
     if (options.privateKey) {
       const signSpinner = ora31("Signing bundle...").start();
       try {
-        const bundlesDir2 = path9.join(contentRootPath, "bundles");
+        const bundlesDir2 = path8.join(contentRootPath, "bundles");
         await signBundleDirectory(bundlesDir2, options.privateKey);
         signSpinner.succeed("Bundle signed with JWT RS256");
       } catch (error) {
@@ -4168,9 +4188,9 @@ var publishBundleCommand = new Command39("publish-bundle").description("Bundle,
       }
     }
     const zipSpinner = ora31("Creating ZIP archive...").start();
-    const bundlesDir = path9.join(contentRootPath, "bundles");
+    const bundlesDir = path8.join(contentRootPath, "bundles");
     await createZip(bundlesDir, contentRootPath);
-    const zipPath = path9.join(contentRootPath, "build.zip");
+    const zipPath = path8.join(contentRootPath, "build.zip");
     if (!await fs11.pathExists(zipPath)) {
       zipSpinner.fail("ZIP creation failed: build.zip not found");
       process.exit(1);
@@ -4186,7 +4206,7 @@ var publishBundleCommand = new Command39("publish-bundle").description("Bundle,
     hashSpinner.succeed(`ZIP hash: ${chalk37.gray(hash.slice(0, 16))}...`);
     let bundleSignature;
     if (options.privateKey) {
-      const bundlesDir2 = path9.join(contentRootPath, "bundles");
+      const bundlesDir2 = path8.join(contentRootPath, "bundles");
       const sig = await readBundleSignature(bundlesDir2);
       if (sig) bundleSignature = sig;
     }
@@ -4234,6 +4254,7 @@ var publishBundleCommand = new Command39("publish-bundle").description("Bundle,
     }
   } finally {
     await fs11.remove(contentRootPath).catch(() => {
+      logger.warning(`Failed to clean up temp directory: ${contentRootPath}`);
     });
   }
 });
@@ -4359,12 +4380,12 @@ init_esm_shims();
 import { Command as Command42 } from "commander";
 import chalk40 from "chalk";
 import ora34 from "ora";
-import path10 from "path";
+import path9 from "path";
 var generateKeyPairCommand = new Command42("generate-key-pair").description("Generate RSA 2048-bit key pair for bundle signing").option("-o, --output <dir>", "Output directory for key files", ".").action(async (options) => {
   console.log("");
   logger.info(chalk40.bold("SwiftPatch Generate Key Pair"));
   console.log("");
-  const outputDir = path10.resolve(options.output || ".");
+  const outputDir = path9.resolve(options.output || ".");
   const spinner = ora34("Generating RSA 2048-bit key pair...").start();
   try {
     const { publicKeyPath, privateKeyPath } = await generateKeyPair(outputDir);
@@ -4398,7 +4419,8 @@ import chalk41 from "chalk";
 import inquirer21 from "inquirer";
 import ora35 from "ora";
 import fs12 from "fs-extra";
-import path11 from "path";
+import path10 from "path";
+import os4 from "os";
 var deployCommand = new Command43("deploy").description("Bundle, publish, and release in one step").option("-p, --platform <platform>", "Target platform (ios or android)").option("-a, --app <app-id>", "App ID or slug").option("-o, --org <org-id>", "Organization ID").option("--app-version <version>", "Target app version (semver)").option("-n, --release-note <note>", "Release notes").option("-m, --mandatory", "Mark as mandatory update").option("--paused", "Create release in paused state").option("--hermes", "Compile to Hermes bytecode").option("--ci-token <token>", "CI token for authentication").option("-e, --entry-file <path>", "Entry file (default: index.js)").option("--dev", "Dev bundle").option("--sourcemap", "Generate sourcemaps").option("-k, --private-key <path>", "Private key path for signing").option("-y, --yes", "Skip confirmations").action(async (options) => {
   const ciToken = options.ciToken || process.env.SWIFTPATCH_CI_TOKEN;
   if (!ciToken) {
@@ -4469,94 +4491,99 @@ var deployCommand = new Command43("deploy").description("Bundle, publish, and re
   console.log(chalk41.bold("  Deploy"));
   console.log(chalk41.gray(`  Platform: ${platform} \xB7 Version: ${appVersion}`));
   console.log("");
-  const bundleSpinner = ora35("Bundling JavaScript...").start();
+  const tmpRoot = await fs12.mkdtemp(path10.join(os4.tmpdir(), "swiftpatch-deploy-"));
   try {
-    const entryFile = options.entryFile || "index.js";
-    const outputDir = path11.join(".swiftpatch-tmp", platform);
-    await fs12.ensureDir(outputDir);
-    const bundleName = platform === "ios" ? "main.jsbundle" : "index.android.bundle";
-    await runReactNativeBundleCommand(
-      bundleName,
-      entryFile,
-      outputDir,
-      platform,
-      options.sourcemap || false,
-      options.dev || false
-    );
-    if (options.hermes) {
-      bundleSpinner.text = "Compiling to Hermes bytecode...";
+    const bundleSpinner = ora35("Bundling JavaScript...").start();
+    try {
+      const entryFile = options.entryFile || "index.js";
+      const outputDir = path10.join(tmpRoot, platform);
+      await fs12.ensureDir(outputDir);
+      const bundleName = platform === "ios" ? "main.jsbundle" : "index.android.bundle";
+      await runReactNativeBundleCommand(
+        bundleName,
+        entryFile,
+        outputDir,
+        platform,
+        options.sourcemap || false,
+        options.dev || false
+      );
+      if (options.hermes) {
+        bundleSpinner.text = "Compiling to Hermes bytecode...";
+      }
+      bundleSpinner.succeed("Bundle created");
+    } catch (error) {
+      bundleSpinner.fail(`Bundle failed: ${error.message}`);
+      process.exit(1);
     }
-    bundleSpinner.succeed("Bundle created");
-  } catch (error) {
-    bundleSpinner.fail(`Bundle failed: ${error.message}`);
-    process.exit(1);
-  }
-  const archiveSpinner = ora35("Creating archive...").start();
-  let zipPath;
-  let bundleHash;
-  try {
-    const outputDir = path11.join(".swiftpatch-tmp", platform);
-    const zipOutputDir = path11.join(".swiftpatch-tmp", "zip");
-    await fs12.ensureDir(zipOutputDir);
-    await createZip(outputDir, zipOutputDir);
-    zipPath = path11.join(zipOutputDir, "build.zip");
-    bundleHash = calculateZipHash(zipPath);
-    if (!bundleHash) throw new Error("Failed to compute bundle hash");
-    archiveSpinner.succeed(`Archive created (hash: ${bundleHash.slice(0, 12)}...)`);
-  } catch (error) {
-    archiveSpinner.fail(`Archive failed: ${error.message}`);
-    process.exit(1);
-  }
-  const uploadSpinner = ora35("Uploading bundle...").start();
-  try {
-    const { url } = await api.generateSignedUrl(
-      { hash: bundleHash, uploadPath, platform, releaseNote },
-      ciToken
-    );
-    await uploader.uploadZip(url, zipPath, (progress) => {
-      uploadSpinner.text = `Uploading bundle... ${progress}%`;
-    });
-    uploadSpinner.succeed("Bundle uploaded");
-  } catch (error) {
-    uploadSpinner.fail(`Upload failed: ${error.message}`);
-    process.exit(1);
-  }
-  if (!ciToken) {
-    console.log("");
-    logger.warning("Deploy requires a CI token to create the release.");
-    console.log(chalk41.gray("  Bundle was uploaded. Promote it manually:"));
-    console.log(chalk41.cyan(`  $ swiftpatch release-bundle --hash ${bundleHash} --app-version ${appVersion} --ci-token <token>`));
-    console.log("");
-  } else {
-    const releaseSpinner = ora35("Creating release...").start();
+    const archiveSpinner = ora35("Creating archive...").start();
+    let zipPath;
+    let bundleHash;
     try {
-      await api.promoteBundle(
-        {
-          projectId: uploadPath,
-          hash: bundleHash,
-          appVersion,
-          releaseNote,
-          isMandatory: options.mandatory || false,
-          isPaused: options.paused || false
-        },
+      const outputDir = path10.join(tmpRoot, platform);
+      const zipOutputDir = path10.join(tmpRoot, "zip");
+      await fs12.ensureDir(zipOutputDir);
+      await createZip(outputDir, zipOutputDir);
+      zipPath = path10.join(zipOutputDir, "build.zip");
+      bundleHash = calculateZipHash(zipPath);
+      if (!bundleHash) throw new Error("Failed to compute bundle hash");
+      archiveSpinner.succeed(`Archive created (hash: ${bundleHash.slice(0, 12)}...)`);
+    } catch (error) {
+      archiveSpinner.fail(`Archive failed: ${error.message}`);
+      process.exit(1);
+    }
+    const uploadSpinner = ora35("Uploading bundle...").start();
+    try {
+      const { url } = await api.generateSignedUrl(
+        { hash: bundleHash, uploadPath, platform, releaseNote },
         ciToken
       );
-      releaseSpinner.succeed("Release created!");
-      console.log("");
-      console.log(chalk41.bold("  Deploy Complete"));
-      console.log(`  Hash:      ${chalk41.gray(bundleHash)}`);
-      console.log(`  Version:   ${chalk41.cyan(appVersion)}`);
-      console.log(`  Platform:  ${platform}`);
-      console.log(`  Mandatory: ${options.mandatory ? chalk41.yellow("Yes") : "No"}`);
-      console.log(`  Status:    ${options.paused ? chalk41.yellow("Paused") : chalk41.green("Released")}`);
-      console.log("");
+      await uploader.uploadZip(url, zipPath, (progress) => {
+        uploadSpinner.text = `Uploading bundle... ${progress}%`;
+      });
+      uploadSpinner.succeed("Bundle uploaded");
     } catch (error) {
-      releaseSpinner.fail(`Release failed: ${error.message}`);
+      uploadSpinner.fail(`Upload failed: ${error.message}`);
       process.exit(1);
     }
+    if (!ciToken) {
+      console.log("");
+      logger.warning("Deploy requires a CI token to create the release.");
+      console.log(chalk41.gray("  Bundle was uploaded. Promote it manually:"));
+      console.log(chalk41.cyan(`  $ swiftpatch release-bundle --hash ${bundleHash} --app-version ${appVersion} --ci-token <token>`));
+      console.log("");
+    } else {
+      const releaseSpinner = ora35("Creating release...").start();
+      try {
+        await api.promoteBundle(
+          {
+            projectId: uploadPath,
+            hash: bundleHash,
+            appVersion,
+            releaseNote,
+            isMandatory: options.mandatory || false,
+            isPaused: options.paused || false
+          },
+          ciToken
+        );
+        releaseSpinner.succeed("Release created!");
+        console.log("");
+        console.log(chalk41.bold("  Deploy Complete"));
+        console.log(`  Hash:      ${chalk41.gray(bundleHash)}`);
+        console.log(`  Version:   ${chalk41.cyan(appVersion)}`);
+        console.log(`  Platform:  ${platform}`);
+        console.log(`  Mandatory: ${options.mandatory ? chalk41.yellow("Yes") : "No"}`);
+        console.log(`  Status:    ${options.paused ? chalk41.yellow("Paused") : chalk41.green("Released")}`);
+        console.log("");
+      } catch (error) {
+        releaseSpinner.fail(`Release failed: ${error.message}`);
+        process.exit(1);
+      }
+    }
+  } finally {
+    await fs12.remove(tmpRoot).catch((err) => {
+      logger.warning(`Failed to clean up temp directory: ${tmpRoot}`);
+    });
   }
-  await fs12.remove(".swiftpatch-tmp").catch(() => {
-  });
 });
 
 // src/commands/status.ts
@@ -4654,7 +4681,7 @@ import chalk43 from "chalk";
 import inquirer23 from "inquirer";
 import ora37 from "ora";
 import fs13 from "fs-extra";
-import path12 from "path";
+import path11 from "path";
 var initCommand = new Command45("init").description("Initialize SwiftPatch in your React Native project").option("-y, --yes", "Accept defaults").action(async (options) => {
   console.log("");
   console.log(chalk43.bold("  SwiftPatch Setup"));
@@ -4745,13 +4772,30 @@ var initCommand = new Command45("init").description("Initialize SwiftPatch in yo
     platform: defaultPlatform || (selectedApp.platform === "BOTH" ? void 0 : selectedApp.platform.toLowerCase()),
     deploymentKey: selectedApp.deploymentKey
   };
-  const rcPath = path12.resolve(".swiftpatchrc");
+  const rcPath = path11.resolve(".swiftpatchrc");
   await fs13.writeJson(rcPath, rcConfig, { spaces: 2 });
   logger.success("Created .swiftpatchrc");
   config.set("defaultOrg", orgId);
   config.set("defaultApp", selectedApp.id);
   if (defaultPlatform) config.set("defaultPlatform", defaultPlatform);
   logger.success("Saved defaults to CLI config");
+  const gitignorePath = path11.resolve(".gitignore");
+  const swiftpatchIgnores = [
+    "# SwiftPatch",
+    ".swiftpatch-tmp/",
+    "swiftpatch-artifacts/",
+    "swiftpatch-private.pem"
+  ];
+  try {
+    let gitignore = await fs13.pathExists(gitignorePath) ? await fs13.readFile(gitignorePath, "utf-8") : "";
+    const missing = swiftpatchIgnores.filter((line) => !gitignore.includes(line));
+    if (missing.length > 0) {
+      const addition = (gitignore.endsWith("\n") || gitignore === "" ? "" : "\n") + missing.join("\n") + "\n";
+      await fs13.appendFile(gitignorePath, addition);
+      logger.success("Updated .gitignore with SwiftPatch entries");
+    }
+  } catch {
+  }
   console.log("");
   console.log(chalk43.bold("  Setup Complete"));
   console.log("");
@@ -4772,7 +4816,7 @@ async function createApp(orgId, pkg, platforms) {
       type: "input",
       name: "name",
       message: "App name:",
-      default: pkg.name || path12.basename(process.cwd())
+      default: pkg.name || path11.basename(process.cwd())
     }
   ]);
   let platform;
@@ -4926,10 +4970,10 @@ var doctorCommand = new Command46("doctor").description("Diagnose your SwiftPatc
 });
 
 // src/cli.ts
-var __dirname2 = dirname2(fileURLToPath2(import.meta.url));
+var __dirname3 = dirname3(fileURLToPath3(import.meta.url));
 var version = "1.0.0";
 try {
-  const pkg = JSON.parse(readFileSync3(join2(__dirname2, "../package.json"), "utf-8"));
+  const pkg = JSON.parse(readFileSync4(join3(__dirname3, "../package.json"), "utf-8"));
   version = pkg.version;
 } catch {
 }
@@ -5003,12 +5047,12 @@ function checkForUpdates() {
   try {
     import("update-notifier").then(({ default: updateNotifier }) => {
       import("fs-extra").then(({ default: fs15 }) => {
-        import("url").then(({ fileURLToPath: fileURLToPath3 }) => {
-          import("path").then(({ dirname: dirname3, join: join3 }) => {
+        import("url").then(({ fileURLToPath: fileURLToPath4 }) => {
+          import("path").then(({ dirname: dirname4, join: join4 }) => {
             try {
-              const __dirname3 = dirname3(fileURLToPath3(import.meta.url));
+              const __dirname4 = dirname4(fileURLToPath4(import.meta.url));
               const pkg = JSON.parse(
-                fs15.readFileSync(join3(__dirname3, "../../package.json"), "utf-8")
+                fs15.readFileSync(join4(__dirname4, "../../package.json"), "utf-8")
               );
               const notifier = updateNotifier({ pkg, updateCheckInterval: 1e3 * 60 * 60 * 24 });
               notifier.notify();