tidepush 0.0.0-stage → 0.1.0

package/dist/index.js

@@ -0,0 +1,698 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import { readFileSync } from "node:fs";
+import { join as join5 } from "node:path";
+import { parseArgs } from "node:util";
+
+// src/api.ts
+class ApiError extends Error {
+  status;
+  constructor(status, message) {
+    super(message);
+    this.status = status;
+  }
+}
+var APP_ID = /^app_[a-z0-9_]{1,40}$/;
+function appIdFromUpdatesUrl(url) {
+  if (typeof url !== "string")
+    return;
+  try {
+    return new URL(url).pathname.match(/^\/(app_[a-z0-9_]{1,40})\/manifest\/?$/)?.[1];
+  } catch {
+    return;
+  }
+}
+var appPath = (cfg, path) => cfg.appId ? `/apps/${encodeURIComponent(cfg.appId)}${path}` : path;
+var DEFAULT_SERVER_URL = "https://tidepush.yugenecodes99.workers.dev";
+var DEFAULT_WEB_URL = "https://tidepush-web.yugenecodes99.workers.dev";
+function apiConfigFromEnv(overrides = {}, env = process.env, credentials = null) {
+  const token = env.TIDEPUSH_TOKEN ?? env.TIDEPUSH_API_TOKEN;
+  const appId = overrides.app ?? env.TIDEPUSH_APP_ID;
+  if (appId && !APP_ID.test(appId))
+    throw new Error(`"${appId}" is not an app id (they look like app_xxxxxxxx)`);
+  const app = appId ? { appId } : {};
+  if (!token && credentials) {
+    const web = credentials.webUrl.replace(/\/$/, "");
+    return { server: web, token: credentials.token, adminBase: `${web}/api/v1`, ...app };
+  }
+  if (!token)
+    throw new Error("Not logged in. Run `npx tidepush login`, or set TIDEPUSH_TOKEN to an API token.");
+  const server = overrides.server ?? env.TIDEPUSH_SERVER_URL ?? DEFAULT_SERVER_URL;
+  return {
+    server: server.replace(/\/$/, ""),
+    token,
+    ...app,
+    accessClientId: env.TIDEPUSH_ACCESS_CLIENT_ID,
+    accessClientSecret: env.TIDEPUSH_ACCESS_CLIENT_SECRET
+  };
+}
+async function api(cfg, path, init = {}) {
+  const headers = { authorization: `Bearer ${cfg.token}`, ...init.headers };
+  if (cfg.accessClientId && cfg.accessClientSecret) {
+    headers["cf-access-client-id"] = cfg.accessClientId;
+    headers["cf-access-client-secret"] = cfg.accessClientSecret;
+  }
+  let body = init.body;
+  if (init.json !== undefined) {
+    headers["content-type"] = "application/json";
+    body = JSON.stringify(init.json);
+  }
+  const res = await fetch(`${cfg.adminBase ?? `${cfg.server}/admin`}${path}`, { method: init.method ?? "GET", headers, body });
+  const text = await res.text();
+  if (!res.ok) {
+    let message = text;
+    try {
+      message = JSON.parse(text).error ?? text;
+    } catch {}
+    throw new ApiError(res.status, `${init.method ?? "GET"} ${path} → ${res.status}: ${message}`);
+  }
+  return text ? JSON.parse(text) : undefined;
+}
+
+// src/commands.ts
+async function promote(cfg, id, channel, rolloutPct) {
+  const res = await api(cfg, appPath(cfg, `/updates/${encodeURIComponent(id)}/promote`), { method: "POST", json: { channel, ...rolloutPct !== undefined ? { rolloutPct } : {} } });
+  console.log(`✔ Promoted ${id} to ${channel} (group ${res.groupId})`);
+  for (const u of res.updates)
+    console.log(`  ${u.platform.padEnd(8)} ${u.id}`);
+}
+async function rollout(cfg, id, pct) {
+  const res = await api(cfg, appPath(cfg, `/updates/${encodeURIComponent(id)}/rollout`), { method: "POST", json: { pct } });
+  console.log(`✔ Rollout set to ${pct}% for ${res.updates.map((u) => `${u.platform} ${u.id}`).join(", ")}`);
+}
+async function rollback(cfg, id, toEmbedded) {
+  const res = await api(cfg, appPath(cfg, `/updates/${encodeURIComponent(id)}/rollback`), { method: "POST", json: { toEmbedded } });
+  for (const r of res.results) {
+    const what = r.outcome === "republished" ? `previous update republished as ${r.republishedId}` : r.outcome === "embedded" ? "devices will roll back to the embedded bundle" : "rolled back";
+    console.log(`✔ ${r.platform.padEnd(8)} ${r.id}: ${what}`);
+  }
+}
+async function list(cfg, q) {
+  const params = new URLSearchParams;
+  for (const [k, v] of Object.entries(q))
+    if (typeof v === "string" && v)
+      params.set(k, v);
+  const { updates } = await api(cfg, appPath(cfg, `/updates?${params}`));
+  if (q.json) {
+    console.log(JSON.stringify(updates, null, 2));
+    return;
+  }
+  if (!updates.length) {
+    console.log("No updates.");
+    return;
+  }
+  console.table(updates.map((u) => ({
+    created: u.createdAt.replace("T", " ").slice(0, 16),
+    channel: u.channel,
+    platform: u.platform,
+    runtime: u.runtimeVersion.slice(0, 10),
+    id: u.id,
+    group: u.groupId.slice(0, 8),
+    rollout: `${u.rolloutPct}%`,
+    status: u.status,
+    devices: u.deviceCount ?? 0,
+    message: (u.message ?? "").slice(0, 40)
+  })));
+}
+
+// src/credentials.ts
+import { chmod, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+var credentialsPath = (env = process.env) => env.TIDEPUSH_CREDENTIALS ?? join(env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "tidepush", "credentials.json");
+async function readCredentials(path = credentialsPath()) {
+  try {
+    const c = JSON.parse(await readFile(path, "utf8"));
+    return c.webUrl && c.token && c.email ? { webUrl: c.webUrl, token: c.token, email: c.email } : null;
+  } catch {
+    return null;
+  }
+}
+async function writeCredentials(c, path = credentialsPath()) {
+  await mkdir(dirname(path), { recursive: true, mode: 448 });
+  await writeFile(path, `${JSON.stringify(c, null, 2)}
+`, { mode: 384 });
+  await chmod(path, 384);
+}
+async function deleteCredentials(path = credentialsPath()) {
+  await rm(path, { force: true });
+}
+
+// src/init.ts
+import { existsSync } from "node:fs";
+import { mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2 } from "node:fs/promises";
+import { join as join2, resolve } from "node:path";
+import { createInterface } from "node:readline/promises";
+async function choose(question, items, label) {
+  if (items.length === 1)
+    return items[0];
+  if (!process.stdin.isTTY) {
+    throw new Error(`${question} There are several; pass it as a flag (see \`tidepush help\`).`);
+  }
+  items.forEach((t, i) => console.log(`  ${i + 1}) ${label(t)}`));
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    for (;; ) {
+      const answer = Number((await rl.question(`${question} [1-${items.length}] `)).trim());
+      if (Number.isInteger(answer) && answer >= 1 && answer <= items.length)
+        return items[answer - 1];
+    }
+  } finally {
+    rl.close();
+  }
+}
+async function ask(question) {
+  if (!process.stdin.isTTY)
+    throw new Error(`${question} Pass --create-app <name>.`);
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    return (await rl.question(`${question} `)).trim();
+  } finally {
+    rl.close();
+  }
+}
+async function resolveApp(cfg, opts) {
+  if (opts.appId)
+    return api(cfg, `/apps/${encodeURIComponent(opts.appId)}`);
+  let orgId = opts.orgId;
+  if (!orgId) {
+    const me = await api(cfg, "/me");
+    if (me.orgs) {
+      if (!me.orgs.length)
+        throw new Error("You're not in an organization yet. Create one in the dashboard first.");
+      orgId = (await choose("Which organization?", me.orgs, (o) => `${o.name} (${o.role})`)).id;
+    }
+  }
+  const base = orgId ? `/orgs/${encodeURIComponent(orgId)}` : "";
+  if (opts.createApp)
+    return createApp(cfg, base, opts.createApp);
+  const { apps } = await api(cfg, `${base}/apps`);
+  const active = apps.filter((a) => !a.archived);
+  const NEW = { id: "", name: "Create a new app" };
+  const picked = await choose("Which app?", active.length ? [...active, NEW] : [NEW], (a) => a.id ? `${a.name} (${a.id})` : a.name);
+  return picked.id ? picked : createApp(cfg, base, await ask("Name of the new app?"));
+}
+async function createApp(cfg, base, name) {
+  if (!name)
+    throw new Error("The app needs a name.");
+  const app = await api(cfg, `${base}/apps`, { method: "POST", json: { name } });
+  console.log(`✔ Created app "${app.name}" (${app.id})`);
+  return app;
+}
+async function updatesBase(cfg) {
+  if (cfg.adminBase) {
+    const res = await fetch(`${cfg.server}/api/config`);
+    if (res.ok)
+      return (await res.json()).updatesUrl.replace(/\/$/, "");
+  }
+  return cfg.server;
+}
+async function init(cfg, opts) {
+  const appDir = resolve(opts.appDir);
+  if (!existsSync(join2(appDir, "package.json")))
+    throw new Error(`${appDir} has no package.json. Run this in your Expo app.`);
+  const app = await resolveApp(cfg, opts);
+  const scope = { ...cfg, appId: app.id };
+  const { keys } = await api(scope, `/apps/${app.id}/keys`);
+  const key = keys.find((k) => !k.retired && k.keyId === "main") ?? keys.find((k) => !k.retired);
+  if (!key) {
+    throw new Error(`${app.name} has no signing key with a certificate to download. Add one in the dashboard (App settings → Code signing).`);
+  }
+  await mkdir2(join2(appDir, "certs"), { recursive: true });
+  await writeFile2(join2(appDir, "certs", "certificate.pem"), key.certificatePem);
+  console.log("✔ Saved certs/certificate.pem");
+  const url = `${await updatesBase(cfg)}/${app.id}/manifest`;
+  const appJsonPath = join2(appDir, "app.json");
+  const updates = {
+    url,
+    codeSigningCertificate: "./certs/certificate.pem",
+    codeSigningMetadata: { keyid: key.keyId, alg: "rsa-v1_5-sha256" }
+  };
+  if (!existsSync(appJsonPath)) {
+    console.log("! No app.json here (app.config.ts?). Add these to your config's `expo` object:");
+    console.log(JSON.stringify({ runtimeVersion: { policy: "fingerprint" }, updates: { ...updates, requestHeaders: { "expo-channel-name": opts.channel ?? "production" } } }, null, 2));
+    return;
+  }
+  const raw = JSON.parse(await readFile2(appJsonPath, "utf8"));
+  const expo = raw.expo ?? raw;
+  const current = expo.updates ?? {};
+  const headers = current.requestHeaders ?? {};
+  expo.updates = {
+    enabled: true,
+    checkAutomatically: "ON_LOAD",
+    fallbackToCacheTimeout: 0,
+    ...current,
+    ...updates,
+    requestHeaders: { ...headers, "expo-channel-name": headers["expo-channel-name"] ?? opts.channel ?? "production" }
+  };
+  expo.runtimeVersion ??= { policy: "fingerprint" };
+  await writeFile2(appJsonPath, `${JSON.stringify(raw, null, 2)}
+`);
+  console.log("✔ Updated app.json");
+  console.log(`  updates.url  ${url}`);
+  console.log("Next: make a release build, then `npx tidepush publish --channel production` after it.");
+}
+
+// src/login.ts
+import { spawn } from "node:child_process";
+var CLIENT_ID = "tidepush-cli";
+var GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+async function post(url, body, headers = {}) {
+  const res = await fetch(url, {
+    method: "POST",
+    headers: { "content-type": "application/json", ...headers },
+    body: JSON.stringify(body)
+  });
+  return { status: res.status, data: await res.json().catch(() => ({})) };
+}
+function openBrowser(url) {
+  const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
+  const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
+  try {
+    spawn(cmd, args, { stdio: "ignore", detached: true }).on("error", () => {}).unref();
+  } catch {}
+}
+var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+async function login(opts = {}) {
+  const web = (opts.webUrl ?? process.env.TIDEPUSH_WEB_URL ?? DEFAULT_WEB_URL).replace(/\/$/, "");
+  const start = await post(`${web}/api/auth/device/code`, { client_id: CLIENT_ID });
+  if (start.status !== 200 || !start.data.device_code) {
+    throw new Error(`Couldn't start signing in at ${web} (${start.status}). ${start.data.error_description ?? ""}`.trim());
+  }
+  const code = start.data;
+  const absolute = (u) => new URL(u, web).toString();
+  const link = absolute(code.verification_uri_complete ?? `${code.verification_uri}?user_code=${code.user_code}`);
+  console.log(`Your code: ${code.user_code}`);
+  console.log(`Approve it at ${link}`);
+  if (opts.open !== false)
+    openBrowser(link);
+  let interval = Math.max(1, code.interval) * 1000;
+  const deadline = Date.now() + code.expires_in * 1000;
+  while (Date.now() < deadline) {
+    await sleep(interval);
+    const res = await post(`${web}/api/auth/device/token`, {
+      grant_type: GRANT_TYPE,
+      device_code: code.device_code,
+      client_id: CLIENT_ID
+    });
+    if (res.status === 429) {
+      interval += 5000;
+      continue;
+    }
+    if (res.data.access_token) {
+      const session = await fetch(`${web}/api/auth/get-session`, {
+        headers: { authorization: `Bearer ${res.data.access_token}` }
+      }).then((r) => r.json());
+      const email = session?.user?.email ?? "unknown";
+      await writeCredentials({ webUrl: web, token: res.data.access_token, email });
+      console.log(`✔ Logged in as ${email}`);
+      return;
+    }
+    switch (res.data.error) {
+      case "authorization_pending":
+        break;
+      case "slow_down":
+        interval += 5000;
+        break;
+      case "access_denied":
+        throw new Error("The request was denied in the browser.");
+      case "expired_token":
+        throw new Error("The code expired. Run `npx tidepush login` again.");
+      default:
+        throw new Error(`Signing in failed: ${res.data.error_description ?? res.data.error ?? res.status}`);
+    }
+  }
+  throw new Error("The code expired. Run `npx tidepush login` again.");
+}
+async function logout() {
+  const saved = await readCredentials();
+  if (!saved) {
+    console.log("Not logged in.");
+    return;
+  }
+  await post(`${saved.webUrl}/api/auth/sign-out`, {}, { authorization: `Bearer ${saved.token}` }).catch(() => {
+    return;
+  });
+  await deleteCredentials();
+  console.log(`✔ Logged out ${saved.email}`);
+}
+
+// src/publish.ts
+import { spawn as spawn2 } from "node:child_process";
+import { mkdtemp, readFile as readFile4, rm as rm2 } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join as join4, resolve as resolve2 } from "node:path";
+
+// src/export.ts
+import { createHash } from "node:crypto";
+import { readFile as readFile3 } from "node:fs/promises";
+import { join as join3 } from "node:path";
+var CONTENT_TYPES = {
+  png: "image/png",
+  jpg: "image/jpeg",
+  jpeg: "image/jpeg",
+  gif: "image/gif",
+  webp: "image/webp",
+  bmp: "image/bmp",
+  svg: "image/svg+xml",
+  ttf: "font/ttf",
+  otf: "font/otf",
+  woff: "font/woff",
+  woff2: "font/woff2",
+  json: "application/json",
+  mp3: "audio/mpeg",
+  wav: "audio/wav",
+  mp4: "video/mp4",
+  lottie: "application/json"
+};
+function contentTypeFor(ext) {
+  return CONTENT_TYPES[ext.toLowerCase()] ?? "application/octet-stream";
+}
+async function hashFile(path) {
+  const bytes = await readFile3(path);
+  return { key: createHash("sha256").update(bytes).digest("hex"), size: bytes.byteLength };
+}
+async function readExport(distDir, platforms) {
+  const metadata = JSON.parse(await readFile3(join3(distDir, "metadata.json"), "utf8"));
+  const bundles = [];
+  for (const platform of platforms) {
+    const meta = metadata.fileMetadata[platform];
+    if (!meta)
+      throw new Error(`metadata.json has no ${platform} entry; was it exported?`);
+    const bundlePath = join3(distDir, meta.bundle);
+    const launch = await hashFile(bundlePath);
+    const assets = [];
+    const seen = new Set([launch.key]);
+    for (const a of meta.assets) {
+      const path = join3(distDir, a.path);
+      const { key, size } = await hashFile(path);
+      if (seen.has(key))
+        continue;
+      seen.add(key);
+      assets.push({ path, key, size, contentType: contentTypeFor(a.ext), fileExtension: `.${a.ext}` });
+    }
+    bundles.push({
+      platform,
+      launchAsset: {
+        path: bundlePath,
+        ...launch,
+        contentType: "application/javascript",
+        fileExtension: ".bundle"
+      },
+      assets
+    });
+  }
+  return bundles;
+}
+
+// src/publish.ts
+var childEnv = (channel, base = process.env) => ({
+  ...base,
+  TIDEPUSH_CHANNEL: channel,
+  CI: "1"
+});
+function run(cmd, args, opts) {
+  return new Promise((resolvePromise, reject) => {
+    const child = spawn2(cmd, args, {
+      cwd: opts.cwd,
+      env: childEnv(opts.channel),
+      stdio: ["ignore", "pipe", opts.quiet ? "pipe" : "inherit"]
+    });
+    let out = "";
+    let err = "";
+    child.stdout.on("data", (d) => out += d);
+    child.stderr?.on("data", (d) => err += d);
+    child.on("error", reject);
+    child.on("close", (code) => code === 0 ? resolvePromise(out) : reject(new Error(`${cmd} ${args.join(" ")} exited ${code}
+${err}`)));
+  });
+}
+function lastJson(stdout) {
+  const start = stdout.indexOf("{");
+  if (start < 0)
+    throw new Error(`Expected JSON, got: ${stdout.slice(0, 200)}`);
+  return JSON.parse(stdout.slice(start));
+}
+async function git(appDir, args) {
+  try {
+    return (await run("git", args, { cwd: appDir, channel: "", quiet: true })).trim();
+  } catch {
+    return;
+  }
+}
+async function publish(cfg, opts) {
+  const appDir = resolve2(opts.appDir);
+  const step = (msg) => console.log(`• ${msg}`);
+  const runIn = (cmd, args, quiet = true) => run(cmd, args, { cwd: appDir, channel: opts.channel, quiet });
+  const pkg = JSON.parse(await readFile4(join4(appDir, "package.json"), "utf8"));
+  if (!pkg.dependencies?.["expo-updates"])
+    throw new Error(`${appDir} does not depend on expo-updates`);
+  let distDir = opts.distDir ? resolve2(opts.distDir) : undefined;
+  let tempDir;
+  if (!distDir) {
+    tempDir = await mkdtemp(join4(tmpdir(), "tidepush-export-"));
+    distDir = tempDir;
+    step(`Exporting ${opts.platforms.join(" + ")} bundle(s)…`);
+    await runIn("npx", ["expo", "export", ...opts.platforms.flatMap((p) => ["--platform", p]), "--output-dir", distDir], false);
+  }
+  try {
+    step("Reading app config and runtime version…");
+    const expoClient = lastJson(await runIn("npx", ["expo", "config", "--type", "public", "--json"]));
+    if (cfg && !cfg.appId) {
+      const fromConfig = appIdFromUpdatesUrl(expoClient.updates?.url);
+      if (fromConfig)
+        cfg = { ...cfg, appId: fromConfig };
+    }
+    if (cfg?.appId)
+      console.log(`  app      ${cfg.appId}`);
+    const runtimeVersions = new Map;
+    for (const platform of opts.platforms) {
+      const rv = opts.runtimeVersion ?? lastJson(await runIn("npx", ["expo-updates", "runtimeversion:resolve", "--platform", platform])).runtimeVersion;
+      if (!rv)
+        throw new Error(`Could not resolve a runtime version for ${platform}`);
+      runtimeVersions.set(platform, rv);
+    }
+    const sha = await git(appDir, ["rev-parse", "HEAD"]);
+    const dirty = !!await git(appDir, ["status", "--porcelain"]);
+    const gitSha = sha ? `${sha.slice(0, 12)}${dirty ? "-dirty" : ""}` : undefined;
+    if (dirty)
+      console.warn("! Working tree has uncommitted changes; they are included in this update.");
+    const bundles = await readExport(distDir, opts.platforms);
+    const allAssets = new Map;
+    for (const b of bundles)
+      for (const a of [b.launchAsset, ...b.assets])
+        allAssets.set(a.key, a);
+    const totalBytes = [...allAssets.values()].reduce((n, a) => n + a.size, 0);
+    for (const b of bundles) {
+      console.log(`  ${b.platform.padEnd(8)} runtime ${runtimeVersions.get(b.platform)}  bundle ${kb(b.launchAsset.size)}  ${b.assets.length} assets`);
+    }
+    if (!cfg) {
+      console.log(`✔ Dry run: ${allAssets.size} unique files, ${kb(totalBytes)}. Nothing uploaded.`);
+      return;
+    }
+    const { missing } = await api(cfg, appPath(cfg, "/assets/missing"), {
+      method: "POST",
+      json: { keys: [...allAssets.keys()] }
+    });
+    const toUpload = missing.map((k) => allAssets.get(k));
+    step(`Uploading ${toUpload.length}/${allAssets.size} files (${kb(toUpload.reduce((n, a) => n + a.size, 0))})…`);
+    await pool(toUpload, 6, async (a) => {
+      const body = await readFile4(a.path);
+      await retry(() => api(cfg, appPath(cfg, `/assets/${a.key}`), {
+        method: "PUT",
+        body,
+        headers: { "content-type": a.contentType, "x-file-extension": a.fileExtension }
+      }));
+    });
+    const res = await api(cfg, appPath(cfg, "/updates"), {
+      method: "POST",
+      json: {
+        channel: opts.channel,
+        message: opts.message,
+        gitSha,
+        rolloutPct: opts.rolloutPct,
+        updates: bundles.map((b) => ({
+          platform: b.platform,
+          runtimeVersion: runtimeVersions.get(b.platform),
+          launchAssetKey: b.launchAsset.key,
+          assetKeys: b.assets.map((a) => a.key),
+          extra: { expoClient }
+        }))
+      }
+    });
+    console.log(`✔ Published to ${opts.channel} at ${opts.rolloutPct}% (group ${res.groupId})`);
+    for (const u of res.updates)
+      console.log(`  ${u.platform.padEnd(8)} ${u.id}`);
+  } finally {
+    if (tempDir)
+      await rm2(tempDir, { recursive: true, force: true });
+  }
+}
+var kb = (n) => n > 1024 * 1024 ? `${(n / 1024 / 1024).toFixed(1)} MB` : `${(n / 1024).toFixed(0)} KB`;
+async function retry(fn, attempts = 4, baseDelayMs = 1000) {
+  for (let i = 1;; i++) {
+    try {
+      return await fn();
+    } catch (e) {
+      if (i >= attempts || e instanceof ApiError && e.status < 500)
+        throw e;
+      await new Promise((r) => setTimeout(r, baseDelayMs * 2 ** i));
+    }
+  }
+}
+async function pool(items, size, fn) {
+  const queue = [...items];
+  await Promise.all(Array.from({ length: Math.min(size, queue.length) }, async () => {
+    for (let item = queue.shift();item !== undefined; item = queue.shift())
+      await fn(item);
+  }));
+}
+
+// src/index.ts
+var HELP = `tidepush: publish and manage Expo OTA updates on a Tidepush server
+
+Usage
+  tidepush login    [--web <url>] [--no-open]
+  tidepush logout
+  tidepush init     [--app <appId> | --create-app <name>] [--org <orgId>] [--channel <name>] [--app-dir <dir>]
+  tidepush publish  --channel <name> [--platform ios|android|all] [--rollout <pct>] [-m <message>]
+                     [--app-dir <dir>] [--runtime-version <v>] [--dist <dir>] [--dry-run]
+  tidepush promote  <updateOrGroupId> --to <channel> [--rollout <pct>]
+  tidepush rollout  <updateOrGroupId> <pct>
+  tidepush rollback <updateOrGroupId> [--to-embedded]
+  tidepush list     [--channel <name>] [--platform ios|android] [--runtime-version <v>] [--limit <n>] [--json]
+
+Which app
+  --app <appId>         or TIDEPUSH_APP_ID. Otherwise read from updates.url in the app's config
+                        (https://…/<appId>/manifest). Without any, the server uses the org's only app.
+
+Signing in
+  On your machine, \`tidepush login\` (saved in ~/.config/tidepush/credentials.json).
+  In CI, TIDEPUSH_TOKEN: a tp_… API token from the dashboard (Settings → API tokens).
+
+Environment (bun loads .env automatically)
+  TIDEPUSH_TOKEN        API token (TIDEPUSH_API_TOKEN also works)
+  TIDEPUSH_SERVER_URL   API server for tokens, e.g. https://ota.example.com (or --server). Default: hosted.
+  TIDEPUSH_WEB_URL      web app for \`login\`. Default: hosted.
+  TIDEPUSH_APP_DIR      app directory for publish (default: cwd, or --app-dir)
+  TIDEPUSH_ACCESS_CLIENT_ID / TIDEPUSH_ACCESS_CLIENT_SECRET
+                         Access service token, if the server hostname is behind Cloudflare Access
+
+publish runs \`expo export\` in the app with TIDEPUSH_CHANNEL=<channel> set, so the app's
+app.config.ts can set updates.requestHeaders["expo-channel-name"] from it.
+`;
+if (!("Bun" in globalThis)) {
+  try {
+    process.loadEnvFile(".env");
+  } catch {}
+}
+async function main(argv) {
+  const [command, ...rest] = argv;
+  if (command === "--version" || command === "-v" || command === "version") {
+    console.log("0.1.0");
+    return;
+  }
+  if (!command || command === "help" || command === "--help" || command === "-h") {
+    console.log(HELP);
+    return;
+  }
+  const { values, positionals } = parseArgs({
+    args: rest,
+    allowPositionals: true,
+    options: {
+      channel: { type: "string" },
+      platform: { type: "string" },
+      rollout: { type: "string" },
+      message: { type: "string", short: "m" },
+      "app-dir": { type: "string" },
+      "runtime-version": { type: "string" },
+      dist: { type: "string" },
+      "dry-run": { type: "boolean" },
+      to: { type: "string" },
+      "to-embedded": { type: "boolean" },
+      limit: { type: "string" },
+      server: { type: "string" },
+      app: { type: "string" },
+      web: { type: "string" },
+      org: { type: "string" },
+      "create-app": { type: "string" },
+      "no-open": { type: "boolean" },
+      json: { type: "boolean" }
+    }
+  });
+  const pct = (v, name) => {
+    if (v === undefined)
+      return;
+    const n = Number(v);
+    if (!Number.isInteger(n) || n < 0 || n > 100)
+      throw new Error(`${name} must be an integer 0–100`);
+    return n;
+  };
+  const need = (v, what) => {
+    if (!v)
+      throw new Error(`Missing ${what}. Run \`tidepush help\`.`);
+    return v;
+  };
+  const dryRun = values["dry-run"] ?? false;
+  const appDir = values["app-dir"] ?? process.env.TIDEPUSH_APP_DIR ?? process.cwd();
+  const credentials = await readCredentials();
+  const cfg = (detectApp = true) => apiConfigFromEnv({ server: values.server, app: values.app ?? (detectApp ? appIdFromAppJson(appDir) : undefined) }, process.env, credentials);
+  switch (command) {
+    case "login":
+      return login({ webUrl: values.web, open: !values["no-open"] });
+    case "logout":
+      return logout();
+    case "init":
+      return init(cfg(false), {
+        appDir,
+        appId: values.app,
+        orgId: values.org,
+        createApp: values["create-app"],
+        channel: values.channel
+      });
+    case "publish": {
+      const platform = values.platform ?? "all";
+      if (!["ios", "android", "all"].includes(platform))
+        throw new Error("--platform must be ios, android or all");
+      await publish(dryRun ? null : cfg(false), {
+        channel: need(values.channel, "--channel"),
+        platforms: platform === "all" ? ["ios", "android"] : [platform],
+        rolloutPct: pct(values.rollout, "--rollout") ?? 100,
+        message: values.message,
+        appDir,
+        runtimeVersion: values["runtime-version"],
+        distDir: values.dist
+      });
+      return;
+    }
+    case "promote":
+      return promote(cfg(), need(positionals[0], "update id"), need(values.to, "--to <channel>"), pct(values.rollout, "--rollout"));
+    case "rollout":
+      return rollout(cfg(), need(positionals[0], "update id"), pct(need(positionals[1], "percentage"), "percentage"));
+    case "rollback":
+      return rollback(cfg(), need(positionals[0], "update id"), values["to-embedded"] ?? false);
+    case "list":
+      return list(cfg(), {
+        channel: values.channel,
+        platform: values.platform,
+        runtimeVersion: values["runtime-version"],
+        limit: values.limit,
+        json: values.json ?? false
+      });
+    default:
+      throw new Error(`Unknown command "${command}". Run \`tidepush help\`.`);
+  }
+}
+function appIdFromAppJson(appDir) {
+  try {
+    const config = JSON.parse(readFileSync(join5(appDir, "app.json"), "utf8"));
+    return appIdFromUpdatesUrl((config.expo ?? config).updates?.url);
+  } catch {
+    return;
+  }
+}
+main(process.argv.slice(2)).catch((e) => {
+  console.error(`✖ ${e instanceof ApiError || e instanceof Error ? e.message : String(e)}`);
+  process.exit(1);
+});