return new Promise((resolve, reject) => {

// Typed as Uint8Array[] so Buffer.concat infers Buffer<ArrayBuffer> — matches

// the `BlobPart` shape that callers pass to `new Blob([...])`.

const chunks: Uint8Array[] = [];

zipfile.outputStream.on('data', (chunk: Buffer) => chunks.push(chunk));

zipfile.outputStream.on('end', () => resolve(Buffer.concat(chunks)));

zipfile.outputStream.on('error', reject);

zipfile.end();

});

sourceDir: string,

): Promise<{ tempDir: string; zipPath: string }> {

const zipfile = new yazl.ZipFile();

const rootName = path.basename(sourceDir);

const entries = readdirSync(sourceDir, {

recursive: true,

withFileTypes: true,

});

for (const entry of entries) {

if (!entry.isFile()) continue;

const absolutePath = path.join(entry.parentPath, entry.name);

const relativePath = path.relative(sourceDir, absolutePath);

zipfile.addFile(absolutePath, toZipEntryName(path.join(rootName, relativePath)));

}

const tempDir = await mkdtemp(path.join(os.tmpdir(), 'dcd-app-zip-'));

const zipPath = path.join(tempDir, `${rootName}.zip`);

zipfile.end();

await pipeline(zipfile.outputStream, createWriteStream(zipPath));

return { tempDir, zipPath };

basePath: string,

files: string[],

commonRoot: string,

): Promise<Buffer> => {

const zipfile = new yazl.ZipFile();

for (const file of files) {

// Anchored prefix strip — replace() would remove the first occurrence

// of commonRoot anywhere in the path, not just at the start.

zipfile.addFile(

path.resolve(basePath, file),

toZipEntryName(file.startsWith(commonRoot) ? file.slice(commonRoot.length) : file),

);

}

return zipToBuffer(zipfile);

// eslint-disable-next-line new-cap

const zip = await new StreamZip.async({

file: zipPath,

storeEntries: true,

});

try {

const entries = await zip.entries();

// Derive top-level names from all entries rather than requiring an

// explicit directory entry — zips created without directory entries

// (e.g. Python's zipfile) are valid but have no ".app/" entry itself.

// macOS metadata (__MACOSX resource forks, .DS_Store) doesn't count

// toward the "exactly one .app" rule.

const topLevelNames = new Set(

Object.values(entries)

.filter(

(entry) =>

!entry.name.startsWith('__MACOSX/') &&

entry.name.split('/').pop() !== '.DS_Store',

)

.map((entry) => entry.name.split('/')[0]),

);

if (topLevelNames.size !== 1 || ![...topLevelNames][0].endsWith('.app')) {

throw new Error(

'Zip file must contain exactly one entry which is a .app, check the contents of the zip file',

);

}

} finally {

zip.close();

}

auth: AuthContext;

apiUrl: string;

debug?: boolean;

/**

encrypt?: boolean;

filePath: string;

ignoreShaCheck?: boolean;

log?: boolean;

const { filePath, apiUrl, auth, ignoreShaCheck = false, log = true, debug = false } = config;

const encrypt = isEncryptionEnabled(config.encrypt);

if (log) {

ux.action.start(colors.bold('Checking and uploading binary'), colors.dim('Initializing'), {

stdout: true,

});

}

if (debug) {

console.log('[DEBUG] Binary upload started');

console.log(`[DEBUG] File path: ${filePath}`);

console.log(`[DEBUG] API URL: ${apiUrl}`);

console.log(`[DEBUG] Ignore SHA check: ${ignoreShaCheck}`);

}

const startTime = Date.now();

let source: UploadSource | undefined;

let encCleanupDir: string | undefined;

let enc: BinaryEnvelope | undefined;

try {

// Prepare file for upload

source = await prepareFileForUpload(filePath, debug, startTime);

// Hash the PLAINTEXT first, before any encryption (dcd#1168). Encryption

// uses a fresh random DEK per upload, so the ciphertext hash differs every

// time and cannot dedup — the plaintext hash is the only stable key. Doing it

// in this order also means a dedup hit skips the encryption work entirely,

// not just the upload.

const shaPlain = await calculateFileHash(source, debug, log);

// Check for an existing upload before spending anything on encryption.

if (!ignoreShaCheck && shaPlain) {

const { exists, binaryId } = await checkExistingUpload(

apiUrl,

auth,

encrypt ? { encrypted: true, shaPlain } : { sha: shaPlain },

debug,

);

if (exists && binaryId) {

if (log) {

ux.info(

colors.dim('SHA hash matches existing binary with ID: ') + formatId(binaryId) + colors.dim(', skipping upload. Force upload with --ignore-sha-check'),

);

ux.action.stop(colors.info('Skipping upload'));

}

return binaryId;

}

}

// Encrypt after the dedup check, so the SHA sent at finalise, and both

// uploaders, operate on ciphertext (binaries.sha = ciphertext hash, #1138).

if (encrypt) {

const encrypted = await encryptUploadSource(source, apiUrl, debug);

enc = encrypted.enc;

encCleanupDir = encrypted.cleanupDir;

if (log) {

ux.info(colors.dim(`Encrypting binary before upload (KEK v${enc.kek})`));

}

}

// Re-hash once encrypted: what lands in storage is the ciphertext, and every

// downstream verifySha hashes the bytes it actually holds (no DEK required).

const sha = encrypt ? await calculateFileHash(source, debug, false) : shaPlain;

// Perform the upload

const uploadId = await performUpload({

auth,

apiUrl,

debug,

enc,

filePath,

sha,

// Only encrypted uploads record a plaintext hash; it is what makes the

// next encrypted run of this binary dedupable.

shaPlain: encrypt ? shaPlain : undefined,

source,

startTime,

});

if (log) {

ux.action.stop(colors.success('\n✓ Binary uploaded with ID: ') + formatId(uploadId));

}

return uploadId;

} catch (error) {

if (log) {

ux.action.stop(colors.error('✗ Failed'));

}

if (debug) {

console.error('[DEBUG] === BINARY UPLOAD FAILED ===');

console.error('[DEBUG] Binary upload failed:', error);

console.error(`[DEBUG] Error type: ${error instanceof Error ? error.name : typeof error}`);

console.error(`[DEBUG] Error message: ${error instanceof Error ? error.message : String(error)}`);

if (error instanceof Error && error.stack) {

console.error(`[DEBUG] Stack trace: ${error.stack}`);

}

console.error(`[DEBUG] Failed after ${Date.now() - startTime}ms`);

}

throw error;

} finally {

if (source?.cleanupDir) {

await rm(source.cleanupDir, { recursive: true, force: true }).catch(() => {});

}

if (encCleanupDir) {

await rm(encCleanupDir, { recursive: true, force: true }).catch(() => {});

}

}

source: UploadSource,

apiUrl: string,

debug: boolean,

): Promise<{ enc: BinaryEnvelope; cleanupDir: string }> {

const kek = resolveKekPublicKey(apiUrl);

if (!kek) {

throw new Error(

'Binary encryption was requested but no KEK public key is configured for this environment. ' +

'Set DCD_BINARY_KEK_PUBLIC=<version>:<base64> or pin one in src/config/environments.ts.',

);

}

const dek = generateDek();

const enc = wrapDek(dek, kek);

const cleanupDir = await mkdtemp(path.join(os.tmpdir(), 'dcd-enc-'));

const cipherPath = path.join(cleanupDir, 'binary.enc');

if (debug) {

console.log(`[DEBUG] Encrypting binary with KEK v${kek.version} -> ${cipherPath}`);

}

await encryptFileToPath(source.diskPath, cipherPath, dek, kek.version);

const { size } = await stat(cipherPath);

source.diskPath = cipherPath;

source.size = size;

if (debug) {

console.log(`[DEBUG] Ciphertext size: ${(size / 1024 / 1024).toFixed(2)} MB`);

}

return { enc, cleanupDir };

/** MIME type sent with the upload. */

contentType: string;

/** Temp directory to delete once the upload finishes (only for .app dirs). */

cleanupDir?: string;

/** On-disk file all upload paths stream from. */

diskPath: string;

/** User-facing name (original path; .app dirs get '.zip' appended). */

name: string;

size: number;

filePath: string,

debug: boolean,

startTime: number,

): Promise<UploadSource> {

if (debug) {

console.log('[DEBUG] Preparing file for upload...');

}

let source: UploadSource;

if (filePath?.endsWith('.app')) {

if (debug) {

console.log('[DEBUG] Compressing .app folder to zip...');

}

// Validate that the .app directory exists before attempting to compress —

// zipping a non-existent path silently produces an empty 22-byte zip.

try {

await access(filePath);

} catch {

// Provide helpful error message for common quoting issues

const hasQuotes = filePath.includes("'") || filePath.includes('"');

const errorMessage = [

`App folder not found: ${filePath}`,

'',

hasQuotes

? 'Note: Your path contains quote characters. If the folder name has spaces, ensure quotes wrap the entire path:'

: 'Note: If your folder name contains spaces, wrap the entire path in quotes:',

hasQuotes

? ` ❌ Wrong: --app-file=./path/'My App Name.app' (quotes become literal characters)`

: ` Example: --app-file="./path/My App Name.app"`,

hasQuotes

? ` ✅ Right: --app-file="./path/My App Name.app" (quotes processed by shell)`

: '',

]

.filter(Boolean)

.join('\n');

throw new Error(errorMessage);

}

const { tempDir, zipPath } = await compressFolderToTempZip(filePath);

const { size } = await stat(zipPath);

source = {

contentType: 'application/zip',

cleanupDir: tempDir,

diskPath: zipPath,

name: filePath + '.zip',

size,

};

if (debug) {

console.log(`[DEBUG] Compressed file size: ${(size / 1024 / 1024).toFixed(2)} MB`);

}

} else {

const { size } = await stat(filePath!);

if (debug) {

console.log(`[DEBUG] File size: ${(size / 1024 / 1024).toFixed(2)} MB`);

}

source = {

contentType:

mimeTypeLookupByExtension[filePath!.split('.').pop()!] ||

'application/octet-stream',

diskPath: filePath!,

name: filePath!,

size,

};

}

if (debug) {

console.log(`[DEBUG] File preparation completed in ${Date.now() - startTime}ms`);

}

return source;

source: UploadSource,

debug: boolean,

log: boolean,

): Promise<string | undefined> {

try {

if (debug) {

console.log('[DEBUG] Calculating SHA-256 hash...');

}

const hashStartTime = Date.now();

const sha = await getFileHashFromPath(source.diskPath);

if (debug) {

console.log(`[DEBUG] SHA-256 hash: ${sha}`);

console.log(`[DEBUG] Hash calculation completed in ${Date.now() - hashStartTime}ms`);

}

return sha;

} catch (error) {

if (log) {

console.warn('Warning: Failed to get file hash', error);

}

if (debug) {

console.error('[DEBUG] Hash calculation failed:', error);

}

return undefined;

}

apiUrl: string,

auth: AuthContext,

lookup: { encrypted?: boolean; sha?: string; shaPlain?: string },

debug: boolean,

): Promise<{ binaryId?: string; exists: boolean }> {

try {

if (debug) {

console.log('[DEBUG] Checking for existing upload with matching SHA...');

console.log(`[DEBUG] Lookup: ${JSON.stringify(lookup)}`);

console.log(`[DEBUG] Target endpoint: ${apiUrl}/uploads/checkForExistingUpload`);

}

const shaCheckStartTime = Date.now();

const { appBinaryId, encrypted, exists } = await ApiGateway.checkForExistingUpload(

apiUrl,

auth,

lookup,

);

if (debug) {

console.log(`[DEBUG] SHA check completed in ${Date.now() - shaCheckStartTime}ms`);

console.log(`[DEBUG] Existing binary found: ${exists}`);

if (exists) {

console.log(`[DEBUG] Existing binary ID: ${appBinaryId}`);

}

}

if (exists && lookup.encrypted && encrypted !== true) {

if (debug) {

console.log(

'[DEBUG] Ignoring dedup hit: encryption was requested but the matched binary is not encrypted',

);

}

return { exists: false };

}

return { binaryId: appBinaryId, exists };

} catch (error) {

// Invalid credentials will fail every subsequent request — surface now

// rather than after the user has waited through a potentially huge upload.

if (error instanceof ApiError && (error.status === 401 || error.status === 403)) {

throw error;

}

if (debug) {

console.error('[DEBUG] === SHA CHECK FAILED ===');

console.error('[DEBUG] Continuing with upload despite SHA check failure');

console.error(`[DEBUG] Error type: ${error instanceof Error ? error.name : typeof error}`);

console.error(`[DEBUG] Error message: ${error instanceof Error ? error.message : String(error)}`);

if (error instanceof Error && error.stack) {

console.error(`[DEBUG] Stack trace:\n${error.stack}`);

}

} else if (error instanceof Error && error.name === 'NetworkError') {

// Even without debug, show a warning for network errors

console.warn('\nWarning: Failed to check for existing binary upload (network error).');

console.warn('Continuing with new upload...\n');

}

return { exists: false };

}

auth: AuthContext;

apiUrl: string;

debug: boolean;

/** Envelope metadata when the binary was encrypted (#1138); undefined otherwise. */

enc?: BinaryEnvelope;

filePath: string;

sha: string | undefined;

/**

shaPlain?: string;

source: UploadSource;

startTime: number;

env: 'dev' | 'prod',

tempPath: string,

source: UploadSource,

debug: boolean,

): Promise<{ error: Error | null; success: boolean }> {

if (debug) {

console.log(`[DEBUG] Uploading to Supabase storage (${env}) using resumable uploads...`);

console.log(`[DEBUG] Staging path: ${tempPath}`);

console.log(`[DEBUG] File size: ${(source.size / 1024 / 1024).toFixed(2)} MB`);

}

try {

const uploadStartTime = Date.now();

await SupabaseGateway.uploadResumable(env, tempPath, source, debug);

if (debug) {

const uploadDuration = Date.now() - uploadStartTime;

const uploadDurationSeconds = uploadDuration / 1000;

const uploadSpeed = (source.size / 1024 / 1024) / uploadDurationSeconds;

console.log(`[DEBUG] Supabase resumable upload completed in ${uploadDurationSeconds.toFixed(2)}s (${uploadDuration}ms)`);

console.log(`[DEBUG] Average upload speed: ${uploadSpeed.toFixed(2)} MB/s`);

}

return { error: null, success: true };

} catch (error) {

const uploadError = error instanceof Error ? error : new Error(String(error));

if (debug) {

console.error(`[DEBUG] === SUPABASE RESUMABLE UPLOAD FAILED ===`);

console.error(`[DEBUG] Error message: ${uploadError.message}`);

console.error(`[DEBUG] Error name: ${uploadError.name}`);

if (uploadError.stack) {

console.error(`[DEBUG] Error stack:\n${uploadError.stack}`);

}

console.error(`[DEBUG] Staging path: ${tempPath}`);

console.error(`[DEBUG] File size: ${source.size} bytes`);

console.log('[DEBUG] Will attempt Backblaze fallback if available...');

}

return { error: uploadError, success: false };

}

auth: AuthContext;

apiUrl: string;

b2: { large?: unknown; simple?: unknown; strategy: string } | undefined;

debug: boolean;

finalPath: string;

source: UploadSource;

const { b2, apiUrl, auth, finalPath, source, debug } = config;

if (!b2) {

if (debug) {

console.log('[DEBUG] Backblaze not configured, will fall back to Supabase');

}

return { error: null, success: false };

}

if (debug) {

console.log('[DEBUG] Starting Backblaze upload (primary)...');

}

try {

const b2UploadStartTime = Date.now();

let backblazeSuccess = false;

if (b2.strategy === 'simple' && b2.simple) {

const simple = b2.simple as { authorizationToken: string; uploadUrl: string };

backblazeSuccess = await uploadToBackblaze(

simple.uploadUrl,

simple.authorizationToken,

`organizations/${finalPath}`,

source,

debug,

);

} else if (b2.strategy === 'large' && b2.large) {

const large = b2.large as { fileId: string; uploadPartUrls: Array<{ authorizationToken: string; uploadUrl: string }> };

backblazeSuccess = await uploadLargeFileToBackblaze({

auth,

apiUrl,

debug,

fileId: large.fileId,

fileName: `organizations/${finalPath}`,

filePath: source.diskPath,

fileSize: source.size,

uploadPartUrls: large.uploadPartUrls,

});

}

if (debug) {

const duration = Date.now() - b2UploadStartTime;

const durationSeconds = duration / 1000;

console.log(backblazeSuccess

? `[DEBUG] Backblaze upload completed successfully in ${durationSeconds.toFixed(2)}s (${duration}ms)`

: `[DEBUG] Backblaze upload failed after ${durationSeconds.toFixed(2)}s (${duration}ms)`

);

}

return { error: null, success: backblazeSuccess };

} catch (error) {

const b2Error = error instanceof Error ? error : new Error(String(error));

if (debug) {

console.error(`[DEBUG] === UNEXPECTED BACKBLAZE UPLOAD ERROR ===`);

console.error(`[DEBUG] Error message: ${b2Error.message}`);

console.error(`[DEBUG] Error name: ${b2Error.name}`);

if (b2Error.stack) {

console.error(`[DEBUG] Error stack:\n${b2Error.stack}`);

}

console.error(`[DEBUG] Upload strategy: ${b2.strategy}`);

}

return { error: b2Error, success: false };

}

b2: unknown;

finalPath: string;

id: string;

tempPath: string;

apiUrl: string,

auth: AuthContext,

filePath: string,

fileSize: number,

debug: boolean,

): Promise<UploadPaths> {

const platform = filePath?.endsWith('.apk') ? 'android' : 'ios';

if (debug) {

console.log('[DEBUG] Requesting upload URL...');

console.log(`[DEBUG] Target endpoint: ${apiUrl}/uploads/getBinaryUploadUrl`);

console.log(`[DEBUG] Platform: ${platform}`);

}

try {

const urlRequestStartTime = Date.now();

const { id, tempPath, finalPath, b2 } = await ApiGateway.getBinaryUploadUrl(apiUrl, auth, platform, fileSize);

if (debug) {

const hasStrategy = b2 && typeof b2 === 'object' && 'strategy' in b2;

console.log(`[DEBUG] Upload URL request completed in ${Date.now() - urlRequestStartTime}ms`);

console.log(`[DEBUG] Upload ID: ${id}`);

console.log(`[DEBUG] Temp path (TUS upload): ${tempPath}`);

console.log(`[DEBUG] Final path (after finalize): ${finalPath}`);

console.log(`[DEBUG] Backblaze upload URL provided: ${Boolean(b2)}`);

if (hasStrategy) console.log(`[DEBUG] Backblaze strategy: ${(b2 as { strategy: string }).strategy}`);

}

if (!tempPath) throw new Error('No upload path provided by API');

return { b2, finalPath, id, tempPath };

} catch (error) {

if (debug) {

console.error('[DEBUG] === FAILED TO GET UPLOAD URL ===');

console.error(`[DEBUG] Error: ${error instanceof Error ? error.message : String(error)}`);

}

// Add context to the error

if (error instanceof Error) {

if (error.name === 'NetworkError') {

throw new Error(

`Failed to request upload URL from API.\n\n${error.message}`,

{ cause: error }

);

}

throw new Error(`Failed to request upload URL: ${error.message}`, {

cause: error,

});

}

throw error;

}

filePath: string,

debug: boolean,

): Promise<TAppMetadata> {

if (debug) console.log('[DEBUG] Extracting app metadata...');

const metadataExtractor = new MetadataExtractorService();

const metadata = await metadataExtractor.extract(filePath);

if (!metadata) {

throw new Error(`Failed to extract metadata from ${filePath}. Supported formats: .apk, .app, .zip`);

}

if (debug) console.log(`[DEBUG] Metadata extracted: ${JSON.stringify(metadata)}`);

return metadata;

supabaseSuccess: boolean,

backblazeSuccess: boolean,

lastError: Error | null,

b2: unknown,

debug: boolean,

): void {

if (supabaseSuccess || backblazeSuccess) {

return;

}

if (debug) {

console.error(`[DEBUG] === ALL UPLOADS FAILED ===`);

console.error(`[DEBUG] Supabase upload: FAILED`);

console.error(`[DEBUG] Backblaze upload: ${b2 ? 'FAILED' : 'NOT CONFIGURED'}`);

if (lastError) {

console.error(`[DEBUG] Final error details:`);

console.error(`[DEBUG] - Message: ${lastError.message}`);

console.error(`[DEBUG] - Name: ${lastError.name}`);

console.error(`[DEBUG] - Stack: ${lastError.stack}`);

}

}

throw new Error(

`All uploads failed. ${lastError ? `Last error: ${JSON.stringify({ message: lastError.message, name: lastError.name, stack: lastError.stack })}` : 'No upload targets available.'}`

);

const { filePath, apiUrl, auth, enc, source, sha, shaPlain, debug, startTime } = config;

// Request upload URL and paths

const { id, tempPath, finalPath, b2 } = await requestUploadPaths(apiUrl, auth, filePath, source.size, debug);

// Extract app metadata from the original (plaintext) file. Attach the

// envelope so it lands on binaries.metadata.enc (#1138).

const metadata = await extractBinaryMetadata(filePath, debug);

if (enc) {

metadata.enc = enc;

}

const env = inferEnvFromApiUrl(apiUrl);

// Upload to Backblaze first (primary)

const backblazeResult = await handleBackblazeUpload({

auth,

apiUrl,

b2: b2 as { large?: unknown; simple?: unknown; strategy: string } | undefined,

debug,

finalPath,

source,

});

let lastError = backblazeResult.error;

// Always upload to Supabase (re-enabled as always-on alongside Backblaze)

if (debug) {

console.log('[DEBUG] Uploading to Supabase...');

}

const supabaseResult: { error: Error | null; success: boolean } =

await uploadToSupabase(env, tempPath, source, debug);

if (!supabaseResult.success && supabaseResult.error) {

lastError = supabaseResult.error;