Vendor acquisition-sdk instead of depending on the code-push npm package

Adds src/acquisition-sdk/ (vendored TypeScript from the archived
microsoft/code-push repo, trimmed types.ts to only what's used, tests
ported for future reference but not wired into any runner), a
tsconfig.build.json + build:ts script compiling it to lib/ at
prepack/setup time, and points CodePush.js at the compiled output
instead of the code-push package. Drops the code-push dependency
entirely, which was only ever used for this one submodule and pulled
in the superagent/proxy-agent/vm2 CLI dependency chain that never
actually shipped in the bundled app JS.

Author: ofalvai

.gitignore

@@ -77,6 +77,9 @@ build/Release
 # https://docs.npmjs.com/misc/faq#should-i-check-my-node-modules-folder-into-git
 node_modules
 
+# Compiled output of src/ (built via `npm run build:ts`, generated fresh at publish time)
+lib/
+
 # Xcode
 #
 # gitignore contributors: remember to update Global/Xcode.gitignore, Objective-C.gitignore & Swift.gitignore

.npmignore

@@ -34,6 +34,12 @@ Recipes/
 bin/
 test/
 
+# Don't publish TypeScript source - only the compiled lib/ output (built via `npm run build:ts`
+# as part of `prepack`) ships
+# Anchored to repo root (leading slash) - an unanchored `src/` also matches android/app/src/,
+# which stripped the native Android module's Java sources from every published tarball.
+/src/
+
 # Remove after this framework is published on NPM
 code-push-plugin-testing-framework/
 
@@ -101,3 +107,9 @@ packages/
 
 .watchmanconfig
 
+# Dev tooling, not relevant to consumers
+.claude/
+.config/
+CLAUDE.md
+mise.toml
+

CLAUDE.md

@@ -16,6 +16,8 @@ React Native CodePush is a native module that enables over-the-air updates for R
 ### Build
 - `npm run build` - Build TypeScript tests to bin/ directory
 - `npm run tsc` - TypeScript compilation
+- `npm run build:ts` - Compiles `src/` (currently just the vendored `acquisition-sdk`) to `lib/`, which is what ships to consumers instead of raw `.ts`. Wired into `setup` (so local dev/tests have `lib/` available) and `prepack` (so `npm publish`/`npm pack` always ship a freshly built `lib/`).
+  - This split (a separate `tsconfig.build.json` and `tsconfig.json` for `test/` -> `bin/`) is temporary. Once `CodePush.js` and the rest of this repo's runtime JS are migrated to TypeScript, these should be unified into a single build, and adopting `react-native-builder-bob` (or some other common tool) is worth considering at that point instead of hand-rolled `tsc` + npm script wiring.
 
 ### Platform Testing
 - Tests run on actual emulators/simulators with real React Native apps
@@ -28,7 +30,7 @@ React Native CodePush is a native module that enables over-the-air updates for R
 - **JavaScript Bridge** (`CodePush.js`): Main API layer exposing update methods
 - **Native Modules**: Platform-specific implementations handling file operations, bundle management
 - **Update Manager**: Handles download, installation, and rollback logic
-- **Acquisition SDK**: Manages server communication and update metadata
+- **Acquisition SDK** (`src/acquisition-sdk/`): Manages server communication and update metadata
 
 ### Platform Structure
 - **iOS**: `ios/` - Objective-C implementation with CocoaPods integration
@@ -46,6 +48,7 @@ React Native CodePush is a native module that enables over-the-air updates for R
 - **Custom Test Runner**: TypeScript-based test framework in `test/`
 - **Real App Testing**: Creates actual React Native apps for integration testing
 - **Scenario Testing**: Update, rollback, and error scenarios
+- **No unit test infra yet**: this repo only has the mocha-based integration suite above. `src/acquisition-sdk/__tests__/` contains tests ported from upstream `microsoft/code-push`, kept for future reference - they are deliberately not wired into `npm test` or any runner. Don't assume they're dead/forgotten code, and don't wire them in without setting up real unit test infra first.
 - **Templates**: `test/template/` holds native files (Podfile, AppDelegate, Android app files) and JS scenarios copied over top of a freshly generated RN/Expo app during test setup, overwriting its defaults — edit files here, not the generated project, for changes to persist
 - **`test:ios` vs `test:setup:ios` vs `test:fast:ios`**: `test:ios` is just `test:setup:ios` followed by `test:fast:ios` — the two are meant to be split apart for local iteration.
   - `test:setup:ios` (mocha `--ios --setup`) boots the simulator and provisions the test app once: copies templates, runs `pod install`, patches Info.plist/AppDelegate. It never builds or runs any test scenario.
@@ -61,3 +64,4 @@ React Native CodePush is a native module that enables over-the-air updates for R
 - **Android Gradle Plugin**: Automatically generates bundle hashes and processes assets
 - **iOS CocoaPods**: Manages native dependencies and build configuration
 - **Bundle Processing**: Automated zip creation and hash calculation for OTA updates
+- **`.npmignore` is a blocklist, not an allowlist**: `package.json` has no `files` field, so any new top-level file/dir ships to npm by default unless explicitly excluded. When adding new repo tooling/config, check whether it needs a `.npmignore` entry. Verify with `npm pack --dry-run`.

CodePush.js

@@ -1,4 +1,4 @@
-import { AcquisitionManager as Sdk } from "code-push/script/acquisition-sdk";
+import { AcquisitionManager as Sdk } from "./lib/acquisition-sdk/acquisition-sdk";
 import { Alert } from "./AlertAdapter";
 import requestFetchAdapter from "./request-fetch-adapter";
 import { AppState, Platform } from "react-native";

lib/acquisition-sdk/acquisition-sdk.d.ts

@@ -0,0 +1,72 @@
+export declare namespace Http {
+    const enum Verb {
+        GET = 0,
+        HEAD = 1,
+        POST = 2,
+        PUT = 3,
+        DELETE = 4,
+        TRACE = 5,
+        OPTIONS = 6,
+        CONNECT = 7,
+        PATCH = 8
+    }
+    interface Response {
+        statusCode: number;
+        body?: string;
+    }
+    interface Requester {
+        request(verb: Verb, url: string, callback: Callback<Response>): void;
+        request(verb: Verb, url: string, requestBody: string, callback: Callback<Response>): void;
+    }
+}
+export interface Package {
+    deploymentKey: string;
+    description: string;
+    label: string;
+    appVersion: string;
+    isMandatory: boolean;
+    packageHash: string;
+    packageSize: number;
+}
+export interface RemotePackage extends Package {
+    downloadUrl: string;
+}
+export interface NativeUpdateNotification {
+    updateAppVersion: boolean;
+    appVersion: string;
+}
+export interface LocalPackage extends Package {
+    localPath: string;
+}
+export interface Callback<T> {
+    (error: Error, parameter: T): void;
+}
+export interface Configuration {
+    appVersion: string;
+    clientUniqueId: string;
+    deploymentKey: string;
+    serverUrl: string;
+    ignoreAppVersion?: boolean;
+}
+export declare class AcquisitionStatus {
+    static DeploymentSucceeded: string;
+    static DeploymentFailed: string;
+}
+export declare class AcquisitionManager {
+    private readonly BASE_URL_PART;
+    private _appVersion;
+    private _clientUniqueId;
+    private _deploymentKey;
+    private _httpRequester;
+    private _ignoreAppVersion;
+    private _serverUrl;
+    private _publicPrefixUrl;
+    private _statusCode;
+    private static _apiCallsDisabled;
+    constructor(httpRequester: Http.Requester, configuration: Configuration);
+    private isRecoverable;
+    private handleRequestFailure;
+    queryUpdateWithCurrentPackage(currentPackage: Package, callback?: Callback<RemotePackage | NativeUpdateNotification>): void;
+    reportStatusDeploy(deployedPackage?: Package, status?: string, previousLabelOrAppVersion?: string, previousDeploymentKey?: string, callback?: Callback<void>): void;
+    reportStatusDownload(downloadedPackage: Package, callback?: Callback<void>): void;
+}