fix: use forward slashes in AAB ZIP entries on Windows (#3624)

packages/shorebird_cli/pubspec.yaml

@@ -10,7 +10,7 @@ environment:
   sdk: ">=3.9.0 <4.0.0"
 
 dependencies:
-  archive: ^4.0.7
+  archive: ^4.0.8
   args: ^2.7.0
   checked_yaml: ^2.0.4
   cli_completion: ^0.5.0

packages/shorebird_cli/test/src/commands/preview_command_test.dart

@@ -139,6 +139,18 @@ void main() {
         ..createSync(recursive: true)
         ..writeAsStringSync(yamlContents);
 
+      // Include AndroidManifest.xml to match real AAB structure.
+      File(
+          p.join(
+            aabDirectory.path,
+            'base',
+            'manifest',
+            'AndroidManifest.xml',
+          ),
+        )
+        ..createSync(recursive: true)
+        ..writeAsStringSync('<manifest />');
+
       await ZipFileEncoder().zipDirectory(aabDirectory, filename: aabPath());
 
       return File(aabPath());
@@ -802,6 +814,29 @@ app_id: $appId
 channel: ${track.channel}
 ''');
           });
+
+          test('re-zipped AAB uses forward slashes in entry names', () async {
+            aabFile = await createAabFile(channel: 'dev');
+            await runWithOverrides(
+              () => command.setChannelOnAab(
+                aabFile: aabFile,
+                channel: track.channel,
+              ),
+            );
+
+            // Verify all ZIP entry names use forward slashes per the
+            // ZIP spec. On Windows, without normalization, entries would
+            // contain backslashes which breaks bundletool.
+            final bytes = aabFile.readAsBytesSync();
+            final archive = ZipDecoder().decodeBytes(bytes);
+            for (final file in archive.files) {
+              expect(
+                file.name,
+                isNot(contains(r'\')),
+                reason: 'ZIP entry "${file.name}" contains backslash',
+              );
+            }
+          });
         });
       });
 

pubspec.lock

@@ -21,10 +21,10 @@ packages:
     dependency: transitive
     description:
       name: archive
-      sha256: "2fde1607386ab523f7a36bb3e7edb43bd58e6edaf2ffb29d8a6d578b297fdbbd"
+      sha256: a96e8b390886ee8abb49b7bd3ac8df6f451c621619f52a26e815fdcf568959ff
       url: "https://pub.dev"
     source: hosted
-    version: "4.0.7"
+    version: "4.0.9"
   args:
     dependency: transitive
     description: