workoffdesk 0.0.0-stage → 1.0.0

package/dist/server/http/routes/sessions.js

@@ -0,0 +1,104 @@
+import { homedir } from 'node:os';
+import { heldInBackground } from '../../agents/claude/transcript/transcripts.js';
+import { listDirs } from '../../system/dirs.js';
+import { Conflict } from '../../system/errors.js';
+import { serveSession } from '../sessionSocket.js';
+// The sessions of a machine: listed, started, renamed, ended, and the sockets that carry them live.
+export const register = (app, ctx) => {
+    const { deps, hub, admit, machineOr404 } = ctx;
+    const { machine } = deps;
+    app.get('/api/m/:machine/sessions', async (req, reply) => {
+        const m = machineOr404(req, reply);
+        return m ? m.listSessions() : reply;
+    });
+    app.post('/api/m/:machine/sessions', async (req, reply) => {
+        const m = machineOr404(req, reply);
+        if (!m)
+            return reply;
+        const parsed = parseCreateSpec(req.body);
+        if (!parsed)
+            return reply.code(400).send({ error: 'invalid session spec' });
+        const { spec, takeOver } = parsed;
+        if (spec.kind === 'claude' && spec.resumeId && deps.claudeJobsRoot && (await heldInBackground(deps.claudeJobsRoot))(spec.resumeId)) {
+            throw new Conflict('this conversation is in a Claude background session and cannot be resumed here', 'background-session');
+        }
+        if (spec.kind !== 'shell' && spec.resumeId && takeOver === 'whenIdle') {
+            const made = await m.takeOverWhenIdle({ ...spec, resumeId: spec.resumeId });
+            return made ? reply.code(201).send(made) : reply.code(202).send({ waiting: true });
+        }
+        return reply.code(201).send(await m.createSession(spec.kind === 'shell' ? spec : { ...spec, takeOver: takeOver === 'now' }));
+    });
+    // Goes on with the conversation of a session whose Claude quit, in that same session.
+    app.post('/api/m/:machine/sessions/:id/continue', async (req, reply) => {
+        const m = machineOr404(req, reply);
+        if (!m)
+            return reply;
+        const sid = m.sessionMeta(req.params.id)?.claudeSessionId;
+        if (sid && deps.claudeJobsRoot && (await heldInBackground(deps.claudeJobsRoot))(sid)) {
+            throw new Conflict('this conversation is in a Claude background session and cannot be resumed here', 'background-session');
+        }
+        return m.continueSession(req.params.id);
+    });
+    app.get('/api/m/:machine/agents', async (req, reply) => {
+        const m = machineOr404(req, reply);
+        return m ? m.agents : reply;
+    });
+    // The folders a path typed in the new-session picker points into, only inside home.
+    app.get('/api/m/:machine/dirs', async (req, reply) => {
+        const m = machineOr404(req, reply);
+        return m ? listDirs(req.query.path ?? '', homedir()) : reply;
+    });
+    app.delete('/api/m/:machine/sessions/:id', async (req, reply) => {
+        const m = machineOr404(req, reply);
+        if (!m)
+            return reply;
+        await m.killSession(req.params.id);
+        return reply.code(204).send();
+    });
+    // A name of the session's own, for every device; an empty one goes back to the directory's name.
+    app.patch('/api/m/:machine/sessions/:id', async (req, reply) => {
+        const m = machineOr404(req, reply);
+        if (!m)
+            return reply;
+        const title = req.body?.title;
+        if (typeof title !== 'string' || title.length > 4096)
+            return reply.code(400).send({ error: 'title required' });
+        const s = await m.renameSession(req.params.id, title);
+        if (!s)
+            return reply.code(404).send({ error: 'no such session' });
+        return s;
+    });
+    app.get('/api/events', { websocket: true }, (socket, req) => {
+        if (!admit(socket, req))
+            return;
+        void hub.add(socket);
+    });
+    // What /api/events sends, for a client whose socket does not get through.
+    app.get('/api/events/now', async (_req, reply) => (await hub.snapshot()) ?? reply.code(503).send({ error: 'unavailable' }));
+    app.get('/api/m/:machine/sessions/:id/ws', { websocket: true }, (socket, req) => {
+        if (!admit(socket, req))
+            return;
+        if (req.params.machine !== machine.id)
+            return socket.close(4404);
+        void serveSession(socket, req.params.id, machine, deps.pusher && ((id, conn, v) => deps.pusher.setVisible(id, conn, v)), {
+            ingest: (id) => machine.ingest(id),
+            sync: (id, epoch, v) => machine.journal.sync(id, epoch, v),
+            onRows: (id, cb) => machine.journal.onRows(id, cb),
+        });
+    });
+};
+// takeOver: for a Claude or Codex conversation open in a terminal on the Mac, quit it there now, or once it is idle.
+function parseCreateSpec(body) {
+    if (!body || typeof body !== 'object')
+        return null;
+    const b = body;
+    const str = (v) => (typeof v === 'string' && v.length > 0 && v.length < 4096 ? v : undefined);
+    if (b.takeOver !== undefined && ((b.kind !== 'claude' && b.kind !== 'codex') || (b.takeOver !== 'now' && b.takeOver !== 'whenIdle')))
+        return null;
+    if (b.kind === 'shell')
+        return { spec: { kind: 'shell', cwd: str(b.cwd), title: str(b.title) } };
+    if ((b.kind === 'claude' || b.kind === 'codex') && str(b.cwd)) {
+        return { spec: { kind: b.kind, cwd: str(b.cwd), resumeId: str(b.resumeId), title: str(b.title) }, takeOver: b.takeOver };
+    }
+    return null;
+}

package/dist/server/http/routes/web.js

@@ -0,0 +1,28 @@
+import { existsSync } from 'node:fs';
+import { join, sep } from 'node:path';
+import fastifyStatic from '@fastify/static';
+// The phone app itself: its files, and index.html for any page it routes to. Registered last, so it
+// answers only what no other route does.
+export const register = async (app, ctx) => {
+    const webDir = ctx.deps.webDir;
+    const hasWeb = !!webDir && existsSync(join(webDir, 'index.html'));
+    await app.register(async (scope) => {
+        scope.addHook('onRoute', (route) => {
+            route.config = { ...route.config, public: true };
+        });
+        // The build names what it puts in assets/ after its content, so a name never stands for another file.
+        const built = join(webDir ?? '', 'assets') + sep;
+        const setHeaders = (reply, path) => {
+            if (path.startsWith(built))
+                reply.header('cache-control', 'public, max-age=31536000, immutable');
+        };
+        if (hasWeb)
+            await scope.register(fastifyStatic, { root: webDir, index: false, wildcard: false, setHeaders });
+        scope.setNotFoundHandler((req, reply) => {
+            if (req.url.startsWith('/api/') || !hasWeb || req.method !== 'GET') {
+                return reply.code(404).send({ error: 'not found' });
+            }
+            return reply.type('text/html; charset=utf-8').header('cache-control', 'no-cache').sendFile('index.html', { cacheControl: false });
+        });
+    });
+};

package/dist/server/http/serve.js

@@ -0,0 +1,129 @@
+import { accessSync, constants, mkdirSync } from 'node:fs';
+import { homedir, userInfo } from 'node:os';
+import { delimiter, join } from 'node:path';
+import webpush from 'web-push';
+import { buildApp } from './app.js';
+import { registerPasskeyRoutes } from './auth/passkey.js';
+import { startControlServer } from '../sessions/control.js';
+import { startHookServer, userStatusLine, writeClaudeSettings } from '../agents/claude/hooks/hooks.js';
+import { usageFrom } from '../agents/claude/usage.js';
+import { ClaudeAccounts } from '../agents/claude/accounts.js';
+import { createHookHandler, createPermissionHandler } from '../agents/claude/hooks/tracker.js';
+import { createLogger } from '../system/log.js';
+import { LocalMachine } from '../sessions/machine.js';
+import { socketPath, tmuxSocketFor } from '../system/paths.js';
+import { Apns, loadApnsKey } from '../notify/apns.js';
+import { Pusher } from '../notify/push.js';
+import { Store } from '../system/store.js';
+import { Tmux, writeTmuxConf } from '../system/tmux.js';
+export class NotSetUp extends Error {
+}
+const isExecutable = (f) => {
+    try {
+        accessSync(f, constants.X_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+};
+// npx and pnpm put node_modules/.bin first on PATH, where a stale npm-installed
+// claude can shadow the real one; the official installer puts it in ~/.local/bin.
+export function resolveClaude(env = process.env, userHome = homedir()) {
+    const dirs = [join(userHome, '.local/bin'), ...(env.PATH ?? '').split(delimiter).filter((d) => d && !d.includes('node_modules'))];
+    return dirs.map((d) => join(d, 'claude')).find(isExecutable) ?? 'claude';
+}
+// Codex's CLI where its installer or npm puts it; null when it is not installed.
+export function resolveCodex(env = process.env, userHome = homedir()) {
+    const dirs = [join(userHome, '.local/bin'), ...(env.PATH ?? '').split(delimiter).filter((d) => d && !d.includes('node_modules'))];
+    return dirs.map((d) => join(d, 'codex')).find(isExecutable) ?? null;
+}
+export async function startServer(o) {
+    const store = new Store(join(o.home, 'state.json'));
+    if (!store.get().user)
+        throw new NotSetUp();
+    mkdirSync(join(o.home, 'logs'), { recursive: true });
+    if (!store.get().vapid) {
+        const keys = webpush.generateVAPIDKeys();
+        store.update((s) => {
+            s.vapid = { publicKey: keys.publicKey, privateKey: keys.privateKey };
+        });
+    }
+    const conf = join(o.home, 'tmux.conf');
+    writeTmuxConf(conf);
+    const tmux = new Tmux({ socket: o.tmuxSocket ?? tmuxSocketFor(o.home), conf });
+    const claudeSettingsPath = join(o.home, 'claude-settings.json');
+    const hookSock = socketPath(o.home, 'hooks.sock');
+    writeClaudeSettings(claudeSettingsPath, hookSock, userStatusLine(join(o.claudeDir ?? join(homedir(), '.claude'), 'settings.json')));
+    const claudeBin = o.claudeBin ?? resolveClaude();
+    const codexBin = o.codexBin === undefined ? resolveCodex() : o.codexBin;
+    const logger = o.logger ?? createLogger({ file: join(o.home, 'logs/workoffdesk.log') });
+    const machine = new LocalMachine({
+        tmux,
+        store,
+        claudeSettingsPath,
+        claudeBin,
+        claudeArgs: o.config.claudeArgs,
+        claudeProjectsRoot: o.claudeProjectsRoot ?? join(homedir(), '.claude/projects'),
+        claudeAccounts: o.claudeAccounts ?? new ClaudeAccounts({ home: homedir(), projectsRoot: o.claudeProjectsRoot ?? join(homedir(), '.claude/projects'), own: process.env.CLAUDE_CONFIG_DIR || undefined }),
+        shell: process.env.SHELL || userInfo().shell || '/bin/zsh',
+        journal: { file: join(o.home, 'journal.db'), log: (msg, fields) => logger.info(fields, msg) },
+        codex: codexBin ? { bin: codexBin, sock: socketPath(o.home, 'codex.sock'), home: process.env.CODEX_HOME || join(homedir(), '.codex') } : undefined,
+    });
+    // Push services want a contact URL; Apple rejects anything but https: or mailto:.
+    const subject = o.config.origin.startsWith('https://') ? o.config.origin : 'mailto:workoffdesk@localhost';
+    const apnsKey = loadApnsKey(o.home);
+    const pusher = new Pusher(store, { subject, send: o.pushSend, apns: apnsKey ? new Apns(apnsKey, o.apnsPost) : undefined });
+    machine.setNotifier(pusher);
+    const hooks = await startHookServer(hookSock, createHookHandler(machine, pusher), (id, payload) => machine.setUsage(id, usageFrom(payload)), createPermissionHandler(machine, pusher));
+    const control = await startControlServer(socketPath(o.home, 'control.sock'), {
+        open: async ({ kind, env, ...r }) => (await machine.createSession(kind === 'codex' ? { kind, ...r } : { kind: 'claude', env, ...r })).id,
+        accounts: {
+            view: () => machine.claudeAccountsView(),
+            pick: async (id) => {
+                const view = await machine.pickClaudeAccount(id);
+                logger.info({ account: id, from: 'cli' }, 'claude account picked');
+                return view;
+            },
+            move: async () => {
+                const view = await machine.moveToAccountInUse();
+                logger.info({ moving: view.moving, from: 'cli' }, 'open sessions moving to the claude account in use');
+                return view;
+            },
+        },
+    });
+    const stopWatch = machine.watch(o.watchMs ?? 2000);
+    const { app } = await buildApp({
+        logger,
+        store,
+        machine,
+        origin: o.config.origin,
+        rpId: o.config.rpId,
+        auditPath: join(o.home, 'logs/audit.log'),
+        webDir: o.webDir,
+        pusher,
+        claudeProjectsRoot: o.claudeProjectsRoot ?? join(homedir(), '.claude/projects'),
+        claudeJobsRoot: o.claudeJobsRoot ?? join(homedir(), '.claude/jobs'),
+        claudeDir: o.claudeDir ?? join(homedir(), '.claude'),
+        claudeBin,
+        pinnedDirs: o.config.pinnedDirs,
+        media: { uploadsDir: join(o.home, 'uploads') },
+        appUpdate: o.appUpdate && { ...o.appUpdate, bundlesDir: join(o.home, 'app-bundles') },
+        ops: o.ops,
+        extend: (a, ctx) => registerPasskeyRoutes(a, ctx, { store, origin: o.config.origin, rpId: o.config.rpId }),
+    });
+    return {
+        app,
+        tmux,
+        // The app first, so the phones hear 4012 before anything else stops.
+        close: async () => {
+            await app.close();
+            stopWatch();
+            hooks.close();
+            // Prompts held for the phone go back to the Mac's dialog alone.
+            hooks.closeAllConnections();
+            control.close();
+            machine.closeJournal();
+        },
+    };
+}

package/dist/server/http/sessionSocket.js

@@ -0,0 +1,198 @@
+// How often the screen is read while the page is looked at; what changed on it is sent at once.
+const SCREEN_MS = 250;
+// Said at least this often while the page is looked at, so the page can tell a quiet line from a dead one.
+const ALIVE_MS = 4000;
+// How often the whole screen is read while it is watched as text; it is long, so less often than the chat's
+// part, and sooner after a key.
+const SCREEN_TEXT_MS = 1000;
+const KEY_SHOWS_MS = 300;
+let connSeq = 0;
+// A phone's line to one session: what is typed goes to the program, the page says whether it is being
+// looked at, and the line closes when the session ends. While the page is looked at, it tells the page what
+// the screen holds for the chat each time that changes ({type:'screen'}), so the page need not keep asking.
+// Asked ({type:'screen'}), it sends what the screen holds even if it sent it already; while the screen is watched as text ({type:'screenText', on}), it sends the text, with
+// its history, each time that changes. A page that says where its copy of the journal is
+// ({type:'journal', epoch, v}) is sent what it is missing, then each change ({type:'journal', from, v, rows}).
+export async function serveSession(socket, id, machine, onVisibility, journal) {
+    const connId = String(++connSeq);
+    // Listeners go on before the first await so nothing the client sends early is lost.
+    const early = [];
+    let handle = null;
+    let closed = false;
+    let cleanup = () => { };
+    socket.on('message', (data, isBinary) => (handle ? handle(data, isBinary) : early.push([data, isBinary])));
+    socket.on('close', () => {
+        closed = true;
+        onVisibility?.(id, connId, false);
+        cleanup();
+    });
+    const ended = () => {
+        if (socket.readyState === socket.OPEN)
+            socket.send(JSON.stringify({ type: 'exit' }));
+    };
+    if (!(await machine.exists(id))) {
+        ended();
+        socket.close(4404, 'no such session');
+        return;
+    }
+    if (closed)
+        return;
+    await machine.fitForChat(id).catch(() => { });
+    if (closed)
+        return;
+    let lastSent = 0;
+    const send = (msg) => {
+        if (socket.readyState !== socket.OPEN)
+            return;
+        socket.send(JSON.stringify(msg));
+        lastSent = Date.now();
+    };
+    const ping = setInterval(() => socket.ping(), 25_000);
+    const unwatch = machine.onChange(async () => {
+        if (closed || (await machine.exists(id).catch(() => true)))
+            return;
+        ended();
+        socket.close(1000);
+    });
+    // Where the page's copy of the journal is, once it has said and been caught up; a page behind a change
+    // is sent nothing until it says where it is again.
+    let journalAt = null;
+    const unwatchJournal = journal?.onRows(id, (from, to, rows) => {
+        if (journalAt === null || journalAt < from || journalAt >= to)
+            return;
+        const at = journalAt;
+        send({ type: 'journal', from: at, v: to, rows: rows.filter((r) => r.v > at) });
+        journalAt = to;
+    }) ?? (() => { });
+    const catchUp = async (epoch, v) => {
+        if (!journal)
+            return;
+        journalAt = null;
+        await journal.ingest(id).catch(() => { });
+        if (closed)
+            return;
+        let from = v;
+        let sync = journal.sync(id, epoch, v);
+        send({ type: 'journal', from, ...sync });
+        while (sync.more) {
+            from = sync.v;
+            sync = journal.sync(id, sync.epoch, from);
+            send({ type: 'journal', from, ...sync });
+        }
+        journalAt = sync.v;
+    };
+    // One reading at a time, only while the page is looked at.
+    let visible = false;
+    let reading = false;
+    let lastScreen = '';
+    let screenTimer;
+    const readScreen = async () => {
+        if (closed || !visible || reading)
+            return;
+        reading = true;
+        try {
+            const screen = await machine.onScreen(id);
+            const now = JSON.stringify(screen);
+            if (now !== lastScreen) {
+                lastScreen = now;
+                send({ type: 'screen', screen });
+            }
+            else if (Date.now() - lastSent >= ALIVE_MS)
+                send({ type: 'alive' });
+        }
+        catch {
+            // the next reading tries again
+        }
+        finally {
+            reading = false;
+        }
+        if (!closed && visible)
+            screenTimer = setTimeout(readScreen, SCREEN_MS);
+    };
+    // The same for the screen as text, while it is watched.
+    let textOn = false;
+    let readingText = false;
+    let textAgain = false;
+    let lastText = null;
+    let textTimer;
+    const readText = async () => {
+        clearTimeout(textTimer);
+        if (closed || !textOn)
+            return;
+        if (readingText) {
+            textAgain = true;
+            return;
+        }
+        readingText = true;
+        textAgain = false;
+        try {
+            const text = await machine.screenText(id);
+            if (text !== lastText && textOn) {
+                lastText = text;
+                send({ type: 'screenText', text });
+            }
+        }
+        catch {
+            // the next reading tries again
+        }
+        finally {
+            readingText = false;
+        }
+        if (!closed && textOn)
+            textTimer = setTimeout(readText, textAgain ? 0 : SCREEN_TEXT_MS);
+    };
+    const textSoon = () => {
+        if (!textOn)
+            return;
+        clearTimeout(textTimer);
+        textTimer = setTimeout(readText, KEY_SHOWS_MS);
+    };
+    cleanup = () => {
+        clearInterval(ping);
+        clearTimeout(screenTimer);
+        clearTimeout(textTimer);
+        unwatch();
+        unwatchJournal();
+    };
+    let input = Promise.resolve();
+    handle = (data, isBinary) => {
+        if (isBinary) {
+            const text = data.toString('utf8');
+            input = input.then(() => (closed ? undefined : machine.type(id, text).then(textSoon, () => { })));
+            return;
+        }
+        let msg;
+        try {
+            msg = JSON.parse(data.toString('utf8'));
+        }
+        catch {
+            return;
+        }
+        if (msg?.type === 'journal' && Number.isSafeInteger(msg.v) && msg.v >= 0) {
+            void catchUp(typeof msg.epoch === 'string' ? msg.epoch : undefined, msg.v);
+            return;
+        }
+        if (msg?.type === 'screen') {
+            lastScreen = '';
+            void readScreen();
+            return;
+        }
+        if (msg?.type === 'screenText') {
+            textOn = !!msg.on;
+            lastText = null;
+            void readText();
+            return;
+        }
+        if (msg?.type === 'visible') {
+            onVisibility?.(id, connId, !!msg.visible);
+            visible = !!msg.visible;
+            clearTimeout(screenTimer);
+            // What the page had may be stale after it was away: the next reading is sent whatever it holds.
+            lastScreen = '';
+            if (visible)
+                void readScreen();
+        }
+    };
+    for (const [d, b] of early.splice(0))
+        handle(d, b);
+}

package/dist/server/ios-update/appUpdate.js

@@ -0,0 +1,95 @@
+import { createHash } from 'node:crypto';
+import { copyFileSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { basename, extname, join } from 'node:path';
+// The iPhone app's JavaScript for the native runtime this build was made with, as the server serves it
+// over the expo-updates protocol. The build writes it once (writeAppUpdate); update.json goes last, so a
+// folder with one is complete.
+export const UPDATE_FILE = 'update.json';
+// The form expo-updates checks a download against: base64url SHA-256, no padding.
+export const hashOf = (bytes) => createHash('sha256').update(bytes).digest('base64url');
+const CONTENT_TYPES = {
+    png: 'image/png',
+    jpg: 'image/jpeg',
+    jpeg: 'image/jpeg',
+    gif: 'image/gif',
+    webp: 'image/webp',
+    svg: 'image/svg+xml',
+    ttf: 'font/ttf',
+    otf: 'font/otf',
+    json: 'application/json',
+    mp3: 'audio/mpeg',
+    wav: 'audio/wav',
+    mp4: 'video/mp4',
+};
+// From what `expo export --platform ios` left in exportDir to a served update in outDir. Assets keep the
+// key Metro gave them (their content hash), which is also their key in the binary's own update, so the
+// phone copies rather than downloads the ones it has; the bundle is keyed by its SHA-256.
+export function writeAppUpdate(exportDir, outDir, meta) {
+    rmSync(outDir, { recursive: true, force: true });
+    const ios = JSON.parse(readFileSync(join(exportDir, 'metadata.json'), 'utf8')).fileMetadata?.ios;
+    if (!ios?.bundle)
+        throw new Error(`no iOS bundle in ${join(exportDir, 'metadata.json')}`);
+    mkdirSync(outDir, { recursive: true });
+    const bundle = readFileSync(join(exportDir, ios.bundle));
+    const bundleKey = createHash('sha256').update(bundle).digest('hex');
+    const launchAsset = { file: `${bundleKey}${extname(ios.bundle)}`, key: bundleKey, hash: hashOf(bundle) };
+    writeFileSync(join(outDir, launchAsset.file), bundle);
+    const assets = (ios.assets ?? []).map(({ path, ext }) => {
+        const key = basename(path);
+        const file = `${key}.${ext}`;
+        copyFileSync(join(exportDir, path), join(outDir, file));
+        return { file, key, hash: hashOf(readFileSync(join(outDir, file))), fileExtension: `.${ext}`, contentType: CONTENT_TYPES[ext.toLowerCase()] ?? 'application/octet-stream' };
+    });
+    const update = { ...meta, launchAsset, assets };
+    writeFileSync(join(outDir, UPDATE_FILE), JSON.stringify(update, null, 2));
+}
+const isText = (v) => typeof v === 'string' && v !== '';
+const isFile = (v) => {
+    const f = v;
+    return !!f && isText(f.file) && isText(f.key) && isText(f.hash);
+};
+// The update a build carries, with every file read and checked against its hash, so nothing is offered
+// that a phone could not download whole. Null when the build has none; throws when it has a broken one.
+export function loadAppUpdate(dir) {
+    let raw;
+    try {
+        raw = readFileSync(join(dir, UPDATE_FILE), 'utf8');
+    }
+    catch (e) {
+        if (e.code === 'ENOENT')
+            return null;
+        throw e;
+    }
+    const build = JSON.parse(raw);
+    const assets = Array.isArray(build.assets) ? build.assets : [];
+    if (!isText(build.runtimeVersion) || !isText(build.builtAt) || typeof build.expoClient !== 'object' || !build.expoClient || !isFile(build.launchAsset) || !Array.isArray(build.assets) || !assets.every((a) => isFile(a) && isText(a.fileExtension) && isText(a.contentType))) {
+        throw new Error(`${UPDATE_FILE} is not an update`);
+    }
+    const files = new Map();
+    for (const { file, hash, contentType } of [{ ...build.launchAsset, contentType: 'application/javascript' }, ...build.assets]) {
+        const bytes = readFileSync(join(dir, basename(file)));
+        if (hashOf(bytes) !== hash)
+            throw new Error(`${file} does not match its hash`);
+        files.set(file, { bytes, contentType });
+    }
+    return { build, files };
+}
+// expo-updates takes an update id as immutable: the same id must always mean the same manifest. So it is
+// derived from all that changes one, and nothing else, which keeps it across restarts.
+export function updateId(runtimeVersion, launchHash, createdAt) {
+    const h = createHash('sha256').update(`${runtimeVersion}\n${launchHash}\n${createdAt}`).digest('hex');
+    const variant = ((parseInt(h[16], 16) & 0x3) | 0x8).toString(16);
+    return `${h.slice(0, 8)}-${h.slice(8, 12)}-8${h.slice(13, 16)}-${variant}${h.slice(17, 20)}-${h.slice(20, 32)}`;
+}
+export function manifestOf(build, createdAt, filesBase) {
+    const url = (file) => `${filesBase}/${encodeURIComponent(file)}`;
+    return {
+        id: updateId(build.runtimeVersion, build.launchAsset.hash, createdAt),
+        createdAt,
+        runtimeVersion: build.runtimeVersion,
+        launchAsset: { key: build.launchAsset.key, hash: build.launchAsset.hash, url: url(build.launchAsset.file), contentType: 'application/javascript' },
+        assets: build.assets.map((a) => ({ key: a.key, hash: a.hash, url: url(a.file), fileExtension: a.fileExtension, contentType: a.contentType })),
+        metadata: {},
+        extra: { expoClient: build.expoClient },
+    };
+}

package/dist/server/ios-update/bundlePatch.js

@@ -0,0 +1,56 @@
+import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { extname, join } from 'node:path';
+import { Worker } from 'node:worker_threads';
+// The bundles this server has offered the iPhone app, by update id. The app names the update it runs on
+// every download, so the next bundle can go to it as a bsdiff patch against that one: a few KB to a few
+// hundred, where the whole bundle is 1.9 MB over a line that drops long downloads.
+const KEEP = 20;
+const UPDATE_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+const fileOf = (dir, id) => join(dir, `${id}.bundle`);
+// Next to this module, run as it is: compiled, or as TypeScript when the tests import the source.
+const WORKER = new URL(`./bundlePatch.worker${extname(new URL(import.meta.url).pathname)}`, import.meta.url);
+export function keepBundle(dir, id, bytes) {
+    mkdirSync(dir, { recursive: true });
+    const file = fileOf(dir, id);
+    if (existsSync(file))
+        return;
+    writeFileSync(`${file}.tmp`, bytes);
+    renameSync(`${file}.tmp`, file);
+    const kept = readdirSync(dir)
+        .filter((n) => n.endsWith('.bundle'))
+        .map((n) => ({ n, at: statSync(join(dir, n)).mtimeMs }))
+        .sort((a, b) => b.at - a.at);
+    for (const { n } of kept.slice(KEEP))
+        rmSync(join(dir, n), { force: true });
+}
+function bsdiff(base, target) {
+    return new Promise((resolve, reject) => {
+        const worker = new Worker(WORKER, { workerData: { base, target } });
+        worker.once('message', (patch) => resolve(Buffer.from(patch.buffer, patch.byteOffset, patch.byteLength)));
+        worker.once('error', reject);
+        worker.once('exit', (code) => reject(new Error(`bsdiff worker exited with ${code}`)));
+    });
+}
+// The patch from the bundle `baseId` names to `target`, made once per base; null when this server never
+// kept that bundle, in which case the app downloads the whole one.
+export function bundlePatcher(dir, target) {
+    const made = new Map();
+    return (baseId) => {
+        const id = baseId.toLowerCase();
+        if (!UPDATE_ID.test(id))
+            return Promise.resolve(null);
+        let patch = made.get(id);
+        if (!patch) {
+            let base;
+            try {
+                base = readFileSync(fileOf(dir, id));
+            }
+            catch {
+                return Promise.resolve(null);
+            }
+            patch = bsdiff(base, target);
+            made.set(id, patch);
+        }
+        return patch;
+    };
+}

package/dist/server/ios-update/bundlePatch.worker.js

@@ -0,0 +1,11 @@
+import { parentPort, workerData } from 'node:worker_threads';
+import { loadBsdiff } from 'bsdiff-wasm';
+// bsdiff takes about a second of CPU on a 4.5 MB bundle, so it runs here rather than on the server's thread.
+const { base, target } = workerData;
+const bsdiff = await loadBsdiff();
+bsdiff.FS.writeFile('/base', base);
+bsdiff.FS.writeFile('/target', target);
+const code = bsdiff.callMain(['/base', '/target', '/patch']);
+if (code !== 0)
+    throw new Error(`bsdiff exited with ${code}`);
+parentPort.postMessage(bsdiff.FS.readFile('/patch'));