Capgo is a full-stack platform for distributing 'instant' (over-the-air) JavaScript bundle updates to Capacitor-based iOS and Android apps. The repository contains the web console (Vue/Vite), a backend that runs on both Supabase Edge Functions (Deno) and Cloudflare Workers (via Hono), a publishing CLI (`@capgo/cli`), and several Capacitor plugin packages under `packages/`. It positions itself as an open-source alternative to Ionic Appflow.

The problem it addresses is the slow app-store review cycle for shipping JavaScript/HTML/CSS fixes to hybrid mobile apps. Capgo lets developers upload new bundles, assign them to channels (production, beta, QA), target specific devices, roll back broken releases, and ship delta updates with encryption/signing — all without waiting for App Store or Play Store approval.

Users are Capacitor/Ionic app developers and teams. They install the Capgo updater plugin in their app, use the CLI (`capgo bundle upload`, etc.) from CI or locally to publish bundles, and manage releases, channels, devices, and analytics through the web console at capgo.app or their own self-hosted deployment.

Architecturally, Supabase (Postgres + Edge Functions) is the reference/self-hostable backend and holds source-of-truth data, auth, and CRON/private endpoints. In Capgo's production cloud, ~99% of update-serving traffic is routed to Cloudflare Workers (multi-region: EU, NA, AS, JP, HK, SA, AF, OC, ME) for cost reasons, sharing core code with Supabase via a Hono adapter. Bundles are stored in S3-compatible object storage (R2). The frontend is a Vue 3 + Vite SPA that can also be packaged as a Capacitor app itself. Stripe handles billing, PostHog handles analytics, and there is extensive tooling (Playwright, Vitest, CodSpeed benches, oxlint, sqlfluff, Snyk, SonarCloud, deepsec).

Notable observations: this is a very large, actively developed monorepo (2300+ paths, 20MB+ of TypeScript, version 12.208.0, hundreds of npm scripts including many Stripe/admin backfill jobs and per-region deploys). Licensing is mixed — root is AGPL-3.0 (package.json also declares GPL-3.0), while the CLI is Apache-2.0 and plugins are AGPL-3.0-only. Includes `.gitsecret/` encrypted secrets and `.env.test` in the tree, which is standard but worth noting for self-hosters. No indication of malicious behavior; this is a legitimate commercial-open-source product.