@calo-design/cli 0.4.7 → 0.5.0

package/bin/art-push.js

@@ -0,0 +1,281 @@
+"use strict";
+
+/**
+ * `calo-design art push <dir>` — upload a bulk image set to the Tigris CDN and
+ * emit a generated manifest module of remote { uri, width, height } sources.
+ *
+ * Why: Metro statically collects every `require()`d image into the EAS update,
+ * and EAS caps updates at 1000 assets. Bulk/generated art (BYO component art,
+ * photo sets, …) must therefore be REMOTE — a URI is just a string in the JS
+ * bundle and counts for nothing. This command is how art becomes remote:
+ *
+ *   calo-design art push ./art/byo --set byo
+ *     → art/byo/<relpath>.<hash12>.png in the calo-design-mirror bucket
+ *     → ./byo-art.ts manifest: { "drive/avocado": { uri, width, height }, … }
+ *
+ * Keys are content-hashed, so re-runs are incremental (existing objects are
+ * skipped via public HEAD) and objects are immutable → served with a 1-year
+ * cache-control. Changing a file changes its hash, its key, and its URI.
+ *
+ * Rule of thumb: small always-on sets (DS core visuals, icons) stay local
+ * `require()`s for offline-safety; anything bulk goes through here.
+ *
+ * Default path is the broker (login only — same trust model as `push`: storage
+ * creds never reach a client). `--direct` uploads straight from this machine with
+ * local Tigris creds (`source ~/.designchef/mirror.env`), for the maintainer.
+ */
+
+const crypto = require("node:crypto");
+const fs = require("node:fs");
+const path = require("node:path");
+const { _s3Put: s3Put, _publicBase: PUBLIC_BASE } = require("./mirror-push");
+const { ensureLoggedIn, publishArt } = require("./login");
+
+const c = {
+  dim: (s) => `\x1b[2m${s}\x1b[0m`, b: (s) => `\x1b[1m${s}\x1b[0m`,
+  g: (s) => `\x1b[32m${s}\x1b[0m`, y: (s) => `\x1b[33m${s}\x1b[0m`,
+};
+const log = (s = "") => console.log(s);
+const ok = (s) => log(`${c.g("✓")} ${s}`);
+const warn = (s) => log(`${c.y("!")} ${s}`);
+
+const flag = (args, name, def) => {
+  const i = args.indexOf(name);
+  return i >= 0 && args[i + 1] ? args[i + 1] : def;
+};
+const has = (args, name) => args.includes(name);
+
+const IMAGE_TYPES = {
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".webp": "image/webp",
+  ".gif": "image/gif",
+};
+
+// ---- intrinsic pixel dimensions (no deps — header parsing per format) -------
+// RN can't infer sizes for remote images the way it does for require()d ones,
+// so the manifest bakes them in. These are PIXEL dims; @2x/@3x/-retina naming
+// is the author's density convention and is left to the consumer's styles.
+
+function pngSize(buf) {
+  // 8-byte signature, then IHDR: width/height at offsets 16/20 (big-endian).
+  if (buf.length < 24 || buf.readUInt32BE(0) !== 0x89504e47) return null;
+  return { width: buf.readUInt32BE(16), height: buf.readUInt32BE(20) };
+}
+
+function jpegSize(buf) {
+  if (buf.length < 4 || buf.readUInt16BE(0) !== 0xffd8) return null;
+  let p = 2;
+  while (p + 9 < buf.length) {
+    if (buf[p] !== 0xff) { p++; continue; }
+    const marker = buf[p + 1];
+    // SOF0–SOF15 carry dimensions, except DHT(C4)/JPG(C8)/DAC(CC).
+    if (marker >= 0xc0 && marker <= 0xcf && marker !== 0xc4 && marker !== 0xc8 && marker !== 0xcc) {
+      return { height: buf.readUInt16BE(p + 5), width: buf.readUInt16BE(p + 7) };
+    }
+    if (marker === 0xd8 || (marker >= 0xd0 && marker <= 0xd9)) { p += 2; continue; }
+    p += 2 + buf.readUInt16BE(p + 2);
+  }
+  return null;
+}
+
+function webpSize(buf) {
+  if (buf.length < 30 || buf.toString("ascii", 0, 4) !== "RIFF" || buf.toString("ascii", 8, 12) !== "WEBP") return null;
+  const fourcc = buf.toString("ascii", 12, 16);
+  if (fourcc === "VP8 ") return { width: buf.readUInt16LE(26) & 0x3fff, height: buf.readUInt16LE(28) & 0x3fff };
+  if (fourcc === "VP8L") {
+    const b = buf.readUInt32LE(21);
+    return { width: (b & 0x3fff) + 1, height: ((b >> 14) & 0x3fff) + 1 };
+  }
+  if (fourcc === "VP8X") return { width: buf.readUIntLE(24, 3) + 1, height: buf.readUIntLE(27, 3) + 1 };
+  return null;
+}
+
+function gifSize(buf) {
+  if (buf.length < 10 || buf.toString("ascii", 0, 3) !== "GIF") return null;
+  return { width: buf.readUInt16LE(6), height: buf.readUInt16LE(8) };
+}
+
+function imageSize(buf, ext) {
+  const fn = { ".png": pngSize, ".jpg": jpegSize, ".jpeg": jpegSize, ".webp": webpSize, ".gif": gifSize }[ext];
+  return (fn && fn(buf)) || null;
+}
+
+// ---- helpers ----------------------------------------------------------------
+
+function walkImages(root) {
+  const out = [];
+  const walk = (dir) => {
+    for (const e of fs.readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+      if (e.name.startsWith(".")) continue;
+      const p = path.join(dir, e.name);
+      if (e.isDirectory()) walk(p);
+      else if (IMAGE_TYPES[path.extname(e.name).toLowerCase()]) out.push(p);
+    }
+  };
+  walk(root);
+  return out;
+}
+
+// "Drive/Avocado Half.png" → "drive/avocado-half" (manifest key + key slug)
+const slugPath = (rel) =>
+  rel.split(path.sep).map((seg) =>
+    seg.toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "")
+  ).filter(Boolean).join("/");
+
+async function pool(items, n, fn) {
+  const it = items.entries();
+  const workers = Array.from({ length: Math.min(n, items.length) }, async () => {
+    for (let x = it.next(); !x.done; x = it.next()) await fn(x.value[1], x.value[0]);
+  });
+  await Promise.all(workers);
+}
+
+const camel = (s) => s.replace(/[^a-zA-Z0-9]+(.)/g, (_, ch) => ch.toUpperCase()).replace(/^[^a-zA-Z_]+/, "");
+
+function manifestSource({ setName, dir, entries }) {
+  const exportName = `${camel(setName)}Art`;
+  const lines = entries.map(
+    ({ key, uri, width, height }) =>
+      `  ${JSON.stringify(key)}: { uri: ${JSON.stringify(uri)}, width: ${width}, height: ${height} },`
+  );
+  return `// Generated by \`calo-design art push\` — do not edit by hand.
+// Set: ${setName}   Source: ${dir}   Assets: ${entries.length}
+//
+// Remote CDN art (Fly Tigris, edge-cached, immutable content-hashed keys).
+// These are plain { uri } sources: they ship as strings, never as EAS update
+// assets, so this set doesn't count against the 1000-asset update limit.
+// width/height are intrinsic PIXEL dims — set display size in styles as usual.
+
+export type CaloArtAsset = { uri: string; width: number; height: number };
+
+export const ${exportName} = {
+${lines.join("\n")}
+} as const;
+
+export type ${camel(`${setName}-art-name`).replace(/^./, (m) => m.toUpperCase())} = keyof typeof ${exportName};
+`;
+}
+
+// ---- command ----------------------------------------------------------------
+
+async function cmdArtPush(args) {
+  // First positional = the art directory (skip --flags; --set/--manifest take a value).
+  const VALUE_FLAGS = new Set(["--set", "--manifest"]);
+  let dirArg;
+  for (let i = 0; i < args.length; i++) {
+    if (args[i].startsWith("--")) { if (VALUE_FLAGS.has(args[i])) i++; continue; }
+    dirArg = args[i];
+    break;
+  }
+  const dir = path.resolve(dirArg || ".");
+  if (!fs.existsSync(dir) || !fs.statSync(dir).isDirectory()) {
+    throw new Error(`not a directory: ${dir}\n  Usage: calo-design art push <dir> [--set name] [--manifest out.ts] [--dry-run]`);
+  }
+
+  const setName = slugPath(flag(args, "--set", path.basename(dir))) || "art";
+  const manifestPath = path.resolve(flag(args, "--manifest", `${setName}-art.ts`));
+  const dry = has(args, "--dry-run");
+  const force = has(args, "--force"); // re-upload even when the object already exists
+  const direct = has(args, "--direct"); // legacy: upload from this machine's own Tigris creds
+
+  const files = walkImages(dir);
+  if (!files.length) throw new Error(`no images found under ${dir} (looked for ${Object.keys(IMAGE_TYPES).join(" ")})`);
+
+  log(c.b(`\n[art push] ${setName}`) + c.dim(`  ${files.length} images from ${dir}`));
+
+  // Hash + measure everything up front so collisions and unreadable files fail
+  // before any upload starts.
+  const entries = [];
+  const byKey = new Map();
+  let totalBytes = 0;
+  for (const file of files) {
+    const rel = path.relative(dir, file);
+    const ext = path.extname(file).toLowerCase();
+    const buf = fs.readFileSync(file);
+    const size = imageSize(buf, ext);
+    if (!size) { warn(`skipping ${rel} — couldn't parse ${ext} header`); continue; }
+    if (buf.length > 8e6) throw new Error(`${rel} is ${(buf.length / 1e6).toFixed(1)} MB — over the 8 MB per-image cap. Resize/compress it (device screens never need more).`);
+    if (buf.length > 4e6) warn(`${rel} is ${(buf.length / 1e6).toFixed(1)} MB — that's heavy for on-device loading; consider resizing/compressing.`);
+    const hash = crypto.createHash("sha256").update(buf).digest("hex").slice(0, 12);
+    const key = slugPath(rel.slice(0, -ext.length));
+    const prev = byKey.get(key);
+    if (prev) throw new Error(`manifest key collision: "${key}" from both ${prev.rel} and ${rel} — rename one.`);
+    const objectKey = `art/${setName}/${key}.${hash}${ext}`;
+    const entry = { rel, key, buf, objectKey, contentType: IMAGE_TYPES[ext], uri: `${PUBLIC_BASE}/${objectKey}`, ...size };
+    byKey.set(key, entry);
+    entries.push(entry);
+    totalBytes += buf.length;
+  }
+  if (!entries.length) throw new Error("nothing uploadable — every file failed header parsing.");
+  ok(`hashed + measured ${entries.length} images (${(totalBytes / 1e6).toFixed(1)} MB)`);
+
+  if (dry) {
+    for (const e of entries.slice(0, 10)) log(c.dim(`  ${e.key}  ${e.width}×${e.height}  → ${e.objectKey}`));
+    if (entries.length > 10) log(c.dim(`  … and ${entries.length - 10} more`));
+    log(c.dim(`  would write manifest: ${manifestPath}`));
+    return;
+  }
+
+  // Incremental: content-hashed keys are immutable, so a public HEAD hit means
+  // the exact bytes are already live and the upload can be skipped. The HEAD is a
+  // plain public read, so it works on both paths (broker and --direct).
+  let reused = 0, done = 0;
+  const pending = [];
+  const label = (phase) => process.stdout.write(`\r  ${phase}… ${done}/${entries.length}`);
+  await pool(entries, 8, async (e) => {
+    const exists = !force && (await fetch(e.uri, { method: "HEAD" })).ok;
+    if (exists) reused++;
+    else pending.push(e);
+    done++;
+    label("checking");
+  });
+  process.stdout.write("\r");
+
+  let uploaded = 0;
+  if (!pending.length) {
+    ok(`nothing to upload — all ${entries.length} assets already live`);
+  } else if (direct) {
+    // Maintainer path: signed PUTs straight to Tigris with local creds.
+    done = 0;
+    await pool(pending, 8, async (e) => {
+      await s3Put(e.objectKey, e.buf, e.contentType, { "cache-control": "public, max-age=31536000, immutable" });
+      uploaded++; done++;
+      label("uploading");
+    });
+    process.stdout.write("\r");
+    ok(`uploaded ${uploaded} asset${uploaded === 1 ? "" : "s"} (direct)${reused ? ` — reused ${reused} already-live` : ""}`);
+  } else {
+    // Default path: no local secrets. Batch through the broker, which performs the
+    // Tigris writes server-side (≤32 files and ≤16 MB raw per request — the broker
+    // caps the JSON envelope at 24 MB and 64 files).
+    await ensureLoggedIn();
+    const batches = [];
+    let batch = [], batchBytes = 0;
+    for (const e of pending) {
+      if (batch.length >= 32 || (batchBytes + e.buf.length > 16e6 && batch.length)) {
+        batches.push(batch); batch = []; batchBytes = 0;
+      }
+      batch.push(e); batchBytes += e.buf.length;
+    }
+    if (batch.length) batches.push(batch);
+    done = 0;
+    for (const b of batches) {
+      await publishArt(b.map((e) => ({ key: e.objectKey, contentType: e.contentType, dataBase64: e.buf.toString("base64") })));
+      uploaded += b.length; done += b.length;
+      label("uploading");
+    }
+    process.stdout.write("\r");
+    ok(`uploaded ${uploaded} asset${uploaded === 1 ? "" : "s"} via broker${reused ? ` — reused ${reused} already-live` : ""}`);
+  }
+
+  fs.writeFileSync(manifestPath, manifestSource({ setName, dir: path.relative(process.cwd(), dir) || ".", entries }));
+  ok(`manifest → ${path.relative(process.cwd(), manifestPath)}`);
+
+  log(c.b("\n✨ Art is live on the CDN.") + c.dim("  Import the manifest and pass entries straight to <Image source={…}>."));
+  log(c.dim(`  e.g.  import { ${camel(setName)}Art } from "./${path.basename(manifestPath, ".ts")}";`));
+  log(c.dim(`        <Image source={${camel(setName)}Art[${JSON.stringify(entries[0].key)}]} style={{ width: 96, height: 96 }} />`));
+}
+
+module.exports = { cmdArtPush, _imageSize: imageSize, _slugPath: slugPath, _manifestSource: manifestSource };

package/bin/cli.js

@@ -16,6 +16,7 @@ const fs = require("node:fs");
 const os = require("node:os");
 const path = require("node:path");
 const { cmdPush } = require("./mirror-push");
+const { cmdArtPush } = require("./art-push");
 const { cmdShare } = require("./share");
 const { cmdLogin, cmdLogout, ensureLoggedIn, githubToken, reportEvent, ensureSession, loadSession, BROKER } = require("./login");
 
@@ -35,7 +36,12 @@ const PEERS = [
   "expo-updates",
   // Video + bundled-asset support (Mirror shell ships the native side from build 7).
   "expo-video",
-  "expo-asset"
+  "expo-asset",
+  // Crash reporting: `push` injects a Sentry init + error boundary into every
+  // prototype (see mirror-push.js mirrorChromeSource). The shell binary provides
+  // the native module (from build 8); prototypes ship JS only, and on older
+  // binaries the SDK falls back to JS-only transport.
+  "@sentry/react-native"
 ];
 // Install via explicit HTTPS git URLs. Auth is a short-lived GitHub token the Calo
 // broker mints after `calo-design login` — injected into git for the install
@@ -55,8 +61,17 @@ const ok = (s) => log(`${c.g("✓")} ${s}`);
 const warn = (s) => log(`${c.y("!")} ${s}`);
 const tilde = (p) => p.replace(os.homedir(), "~");
 
+// npm/npx are .cmd shims on Windows, and Node >= 18.20.2 (CVE-2024-27980)
+// refuses to spawn .cmd files without shell:true. With shell:true cmd.exe
+// gets the args space-joined and unescaped, so quote anything with whitespace.
+function winShell(bin, argv) {
+  if (process.platform !== "win32") return [bin, argv, false];
+  const q = (s) => (/[ \t]/.test(s) ? `"${s}"` : s);
+  return [q(bin), argv.map(q), true];
+}
 function run(bin, argv, opts = {}) {
-  const r = spawnSync(bin, argv, { stdio: "inherit", ...opts });
+  const [b, a, shell] = winShell(bin, argv);
+  const r = spawnSync(b, a, { stdio: "inherit", shell, ...opts });
   if (r.error) throw r.error;
   if (typeof r.status === "number" && r.status !== 0) throw new Error(`${bin} ${argv.join(" ")} exited ${r.status}`);
   return r;
@@ -68,7 +83,8 @@ function sleep(sec) {
 // races / rate limits) and recover on retry. Retry before giving up.
 function runWithRetry(bin, argv, tries = 3, opts = {}) {
   for (let i = 1; i <= tries; i++) {
-    const r = spawnSync(bin, argv, { stdio: "inherit", ...opts });
+    const [b, a, shell] = winShell(bin, argv);
+    const r = spawnSync(b, a, { stdio: "inherit", shell, ...opts });
     if (!r.error && r.status === 0) return r;
     if (i < tries) { warn(`install hiccup — retrying (${i}/${tries - 1})…`); sleep(3); }
   }
@@ -752,6 +768,8 @@ function help() {
   ${c.dim("logout")}                                    forget the saved Calo session
   ${c.dim("push")}                                      publish THIS prototype to the Calo Mirror (login only — no EAS/Tigris creds needed)
   ${c.dim("    push --slug x --title \"…\" --owner \"…\" --screenshot path  --dry-run  --direct")}
+  ${c.dim("art push <dir>")}                            upload a bulk image set to the CDN + emit a remote-source manifest (login only)
+  ${c.dim("    art push ./art/byo --set byo --manifest src/byo-art.ts  --dry-run  --force  --direct")}
   ${c.dim("share")}                                     publish THIS web prototype (React/Vite/CRA/Next) to Cloudflare Pages → share link
   ${c.dim("    share --slug x --dir dist --build --project calo-prototypes  --dry-run")}
   ${c.dim("gallery")}                                   serve the @calo/design-system component gallery locally (live from the runtime)
@@ -772,6 +790,8 @@ function help() {
     else if (cmd === "init") await cmdInit();
     else if (cmd === "update") await cmdUpdate();
     else if (cmd === "push") await cmdPush(args.slice(1));
+    else if (cmd === "art" && args[1] === "push") await cmdArtPush(args.slice(2));
+    else if (cmd === "art") throw new Error("unknown art command — did you mean `calo-design art push <dir>`?");
     else if (cmd === "share") await cmdShare(args.slice(1));
     else if (cmd === "feed") await cmdFeed();
     else if (cmd === "insights") await cmdInsights();

package/bin/login.js

@@ -193,6 +193,13 @@ async function publishToMirror(payload) {
   return api("/v1/publish", payload, session);
 }
 
+// Hand a batch of content-hashed art files to the broker, which performs the Tigris
+// writes server-side (same trust model as publishToMirror — no storage creds locally).
+async function publishArt(files) {
+  const session = await ensureSession();
+  return api("/v1/publish-art", { files }, session);
+}
+
 // Best-effort design-ops telemetry: report an init/update to the broker feed (The Pass).
 // Never throws and never blocks the command on failure — telemetry is not the job. Uses the
 // existing session if it's still valid; won't trigger a refresh just to report an event.
@@ -206,4 +213,4 @@ async function reportEvent(action, target) {
   }
 }
 
-module.exports = { cmdLogin, cmdLogout, ensureSession, ensureLoggedIn, githubToken, easToken, publishWeb, publishToMirror, reportEvent, BROKER, loadSession };
+module.exports = { cmdLogin, cmdLogout, ensureSession, ensureLoggedIn, githubToken, easToken, publishWeb, publishToMirror, publishArt, reportEvent, BROKER, loadSession };

package/bin/mirror-push.js

@@ -25,6 +25,12 @@ const SHARED_PROJECT_ID = "290a759f-427c-432e-9ab5-dab98310e66b";
 const UPDATES_URL = `https://u.expo.dev/${SHARED_PROJECT_ID}`;
 const RUNTIME_VERSION = "0.1.0"; // must equal the shell binary's runtimeVersion (appVersion policy, version 0.1.0)
 const LAUNCHER_CHANNEL = "mirror";
+// Crash reporting: every pushed prototype gets a Sentry init + error boundary
+// injected (see injectBackChrome). Same project as the shell's own init
+// (calo-design-mirror expo.extra.sentryDsn) — keep the two DSNs in sync. A DSN
+// is a public event-ingest identifier, not a secret. Empty => no injection.
+const SENTRY_DSN = process.env.CALO_MIRROR_SENTRY_DSN ||
+  "https://20090c120924d4952c564611ac08afdc@o4510813973577728.ingest.us.sentry.io/4511807869616128";
 
 // ---- registry (Fly Tigris, S3-compatible; override via env) -----------------
 const BUCKET = process.env.CALO_MIRROR_BUCKET || "calo-design-mirror";
@@ -50,14 +56,24 @@ const flag = (args, name, def) => {
 };
 const has = (args, name) => args.includes(name);
 
+// npm/npx/eas are .cmd shims on Windows, and Node >= 18.20.2 (CVE-2024-27980)
+// refuses to spawn .cmd files without shell:true. With shell:true cmd.exe
+// gets the args space-joined and unescaped, so quote anything with whitespace.
+function winShell(bin, argv) {
+  if (process.platform !== "win32") return [bin, argv, false];
+  const q = (s) => (/[ \t]/.test(s) ? `"${s}"` : s);
+  return [q(bin), argv.map(q), true];
+}
 function run(bin, argv, opts = {}) {
-  const r = spawnSync(bin, argv, { stdio: "inherit", ...opts });
+  const [b, a, shell] = winShell(bin, argv);
+  const r = spawnSync(b, a, { stdio: "inherit", shell, ...opts });
   if (r.error) throw r.error;
   if (typeof r.status === "number" && r.status !== 0) throw new Error(`${bin} ${argv.join(" ")} exited ${r.status}`);
   return r;
 }
 function capture(bin, argv, opts = {}) {
-  const r = spawnSync(bin, argv, { encoding: "utf8", ...opts });
+  const [b, a, shell] = winShell(bin, argv);
+  const r = spawnSync(b, a, { encoding: "utf8", shell, ...opts });
   return { status: r.status == null ? 1 : r.status, out: `${r.stdout || ""}${r.stderr || ""}` };
 }
 
@@ -143,7 +159,7 @@ const STAGE_SKIP_DIRS = new Set([
   "ios", "android", ".tamagui", ".vscode", ".idea",
 ]);
 
-function stageProject({ root, stage, slug, title, ad }) {
+function stageProject({ root, stage, slug, title, ad, owner }) {
   // Copy the author's whole project (minus STAGE_SKIP_DIRS). Managed files
   // (app.json, package.json, tsconfig, babel, metro, node_modules, .gitignore,
   // the root _layout) are overwritten below, exactly as before.
@@ -196,7 +212,7 @@ function stageProject({ root, stage, slug, title, ad }) {
 
   writeMetroConfig(stage);
   linkNodeModules(stage);
-  injectBackChrome({ stagedAppDir, mirrorChromeDir, libRel });
+  injectBackChrome({ stagedAppDir, mirrorChromeDir, libRel, slug, owner });
 
   // EAS Update enumerates project files via git. Give the throwaway staging dir
   // its own local repo (node_modules ignored). This never leaves the temp dir —
@@ -207,6 +223,49 @@ function stageProject({ root, stage, slug, title, ad }) {
   run("git", ["-C", stage, "-c", "user.email=mirror@calo.app", "-c", "user.name=Calo Mirror", "commit", "-q", "-m", "mirror push"]);
 }
 
+// ---- asset-count preflight --------------------------------------------------
+// EAS hard-caps updates at 1000 assets per platform (server-side; not a plan
+// setting). Metro collects every statically-reachable require(), and the shared
+// DS ships ~230 assets (visual library + fonts) with EVERY prototype, so a
+// designer who drops a big image set into their prototype would otherwise sit
+// through the full stage + export + upload only to get a cryptic server
+// rejection. Count the prototype's image files up front and speak up BEFORE
+// eas update runs. File count is an upper bound (unreferenced files don't
+// bundle), so over-the-line is a loud warning, not a hard block.
+const IMAGE_EXTS = new Set([".png", ".jpg", ".jpeg", ".webp", ".gif", ".bmp", ".svg"]);
+const DS_BASELINE_ASSETS = 230; // @calo/design-system visuals + fonts, bundled with every push
+const EAS_ASSET_LIMIT = 1000;
+
+function countStagedImages(stage) {
+  let n = 0;
+  const walk = (dir) => {
+    for (const e of fs.readdirSync(dir, { withFileTypes: true })) {
+      if (e.name === "node_modules" || e.name.startsWith(".")) continue;
+      const p = path.join(dir, e.name);
+      if (e.isSymbolicLink()) continue; // never follow into the runtime symlink
+      if (e.isDirectory()) walk(p);
+      else if (IMAGE_EXTS.has(path.extname(e.name).toLowerCase())) n++;
+    }
+  };
+  walk(stage);
+  return n;
+}
+
+function preflightAssetCount(stage) {
+  const own = countStagedImages(stage);
+  const estimate = own + DS_BASELINE_ASSETS;
+  if (estimate > EAS_ASSET_LIMIT) {
+    warn(`this prototype has ${own} image files; with the ~${DS_BASELINE_ASSETS} design-system assets every push carries, ` +
+      `that's ~${estimate} — OVER the EAS limit of ${EAS_ASSET_LIMIT} assets per update.`);
+    warn(`the publish will very likely be REJECTED by the server after the upload. Bulk image sets must be remote:`);
+    log(c.dim("    run `calo-design art push <your image folder>` (login only) — it moves the images to the CDN and"));
+    log(c.dim("    generates a manifest module; import that instead of require()ing the files, then delete them."));
+  } else if (estimate > EAS_ASSET_LIMIT * 0.7) {
+    warn(`heads-up: ~${estimate} assets would ship with this update (${own} yours + ~${DS_BASELINE_ASSETS} design-system). ` +
+      `The EAS cap is ${EAS_ASSET_LIMIT}; large image sets belong on the CDN via \`calo-design art push\`.`);
+  }
+}
+
 function writeMetroConfig(stage) {
   const runtimeReal = fs.realpathSync(runtimeDir());
   fs.writeFileSync(
@@ -236,10 +295,10 @@ function linkNodeModules(stage) {
 
 // Overwrite the root _layout with a managed one. Returning to the launcher is now
 // handled natively by the Mirror shell (shake the device — see withCaloMirrorIos),
-// so no visible "back" control is injected; MirrorChrome is a pass-through kept as
-// a seam for any future prototype-side chrome. NOTE (v1): a custom root _layout
+// so no visible "back" control is injected; MirrorChrome carries the injected
+// crash reporting (Sentry init + error boundary). NOTE (v1): a custom root _layout
 // (custom providers/Tabs) is not preserved — we warn when it looks non-standard.
-function injectBackChrome({ stagedAppDir, mirrorChromeDir, libRel }) {
+function injectBackChrome({ stagedAppDir, mirrorChromeDir, libRel, slug, owner }) {
   const layout = path.join(stagedAppDir, "_layout.tsx");
   if (fs.existsSync(layout)) {
     const cur = fs.readFileSync(layout, "utf8");
@@ -264,21 +323,101 @@ export default function RootLayout() {
 }
 `
   );
-  fs.writeFileSync(
-    path.join(mirrorChromeDir, "mirror-chrome.tsx"),
-    `import type { ReactNode } from "react";
+  fs.writeFileSync(path.join(mirrorChromeDir, "mirror-chrome.tsx"), mirrorChromeSource({ slug, owner }));
+}
+
+// True when the shared runtime can bundle @sentry/react-native. Old runtimes
+// (before the peer was added to calo-cli's PEERS list) can't — inject the plain
+// pass-through chrome there so push keeps working; `calo-design update` fixes it.
+function runtimeHasSentry() {
+  return fs.existsSync(path.join(runtimeDir(), "node_modules", "@sentry", "react-native", "package.json"));
+}
+
+// The injected chrome. With a DSN + a Sentry-capable runtime it (a) initialises
+// Sentry tagged with the prototype's slug/owner, so every crash is attributable
+// from the feed, and (b) wraps the prototype in an error boundary: a render
+// crash shows a "this prototype crashed, it's been reported" screen instead of
+// killing the shell. Everything is defensive — on an old shell binary without
+// the Sentry NATIVE module, init falls back to JS-only transport (and the
+// try/catch backstops that), so prototypes never crash BECAUSE of reporting.
+function mirrorChromeSource({ slug, owner }) {
+  if (!SENTRY_DSN || !runtimeHasSentry()) {
+    return `import type { ReactNode } from "react";
 
 // Returning to the Mirror launcher is handled NATIVELY by the shell binary:
-// shake the device and the shell flips its EAS Update channel back to the
-// launcher and relaunches (see calo-design-mirror/plugins/withCaloMirrorIos.js,
-// CaloShakeWindow + CaloMirrorBack). That works for every loaded prototype
-// without any JS here, so this wrapper no longer renders a "back" control — it
-// stays as a pass-through seam for any future prototype-side chrome.
+// shake the device (see calo-design-mirror/plugins/withCaloMirrorIos.js).
+// Crash reporting was NOT injected: no Sentry DSN configured or the shared
+// runtime predates @sentry/react-native (run \`calo-design update\`).
 export function MirrorChrome({ children }: { children: ReactNode }) {
   return <>{children}</>;
 }
-`
-  );
+`;
+  }
+  return `import { Component, type ErrorInfo, type ReactNode } from "react";
+import { Pressable, ScrollView, Text, View } from "react-native";
+
+// Injected by \`calo-design push\` — crash reporting for this prototype.
+// Returning to the Mirror launcher stays NATIVE: shake the device.
+const SENTRY_DSN = ${JSON.stringify(SENTRY_DSN)};
+const PROTOTYPE = ${JSON.stringify(slug)};
+const OWNER = ${JSON.stringify(owner || "")};
+
+let Sentry: typeof import("@sentry/react-native") | null = null;
+try {
+  Sentry = require("@sentry/react-native");
+  Sentry!.init({
+    dsn: SENTRY_DSN,
+    enableLogs: true,
+    enableAutoSessionTracking: false,
+  });
+  Sentry!.setTags({ surface: "prototype", prototype: PROTOTYPE, owner: OWNER });
+} catch {
+  Sentry = null; // reporting must never be the thing that crashes a prototype
+}
+
+type CrashState = { error: Error | null };
+
+export class MirrorChrome extends Component<{ children: ReactNode }, CrashState> {
+  state: CrashState = { error: null };
+
+  static getDerivedStateFromError(error: Error): CrashState {
+    return { error };
+  }
+
+  componentDidCatch(error: Error, info: ErrorInfo): void {
+    try {
+      Sentry?.captureException(error, {
+        contexts: { react: { componentStack: info.componentStack } },
+      });
+    } catch {}
+  }
+
+  render() {
+    const { error } = this.state;
+    if (!error) return <>{this.props.children}</>;
+    return (
+      <View style={{ flex: 1, backgroundColor: "#ffffff", padding: 24, justifyContent: "center", gap: 12 }}>
+        <Text style={{ fontSize: 20, fontWeight: "700", color: "#1a1a1a" }}>This prototype crashed</Text>
+        <Text style={{ fontSize: 14, color: "#666666" }}>
+          {Sentry ? "The error was reported" : "The error couldn't be reported"} — shake the device to return to Mirror.
+        </Text>
+        <ScrollView style={{ maxHeight: 160, backgroundColor: "#f5f5f5", borderRadius: 8 }} contentContainerStyle={{ padding: 12 }}>
+          <Text style={{ fontSize: 12, fontFamily: "Menlo", color: "#c0392b" }}>{String(error.message || error)}</Text>
+        </ScrollView>
+        <Pressable
+          onPress={() => this.setState({ error: null })}
+          style={({ pressed }) => ({
+            alignSelf: "flex-start", paddingVertical: 10, paddingHorizontal: 16,
+            borderRadius: 8, backgroundColor: "#24A170", opacity: pressed ? 0.85 : 1,
+          })}
+        >
+          <Text style={{ color: "#ffffff", fontWeight: "600" }}>Try again</Text>
+        </Pressable>
+      </View>
+    );
+  }
+}
+`;
 }
 
 // ---- publish ----------------------------------------------------------------
@@ -318,7 +457,9 @@ function tigrisCreds() {
 }
 
 // Signed PUT to the Tigris bucket (S3 API, path-style: ENDPOINT/BUCKET/key).
-async function s3Put(objectKey, body, contentType) {
+// extraHeaders (e.g. cache-control for immutable art) are included in the SigV4
+// signed-header set so the request stays verifiable end to end.
+async function s3Put(objectKey, body, contentType, extraHeaders = {}) {
   const { key, secret } = tigrisCreds();
   const region = "auto";
   const url = new URL(`${ENDPOINT}/${BUCKET}/${objectKey}`);
@@ -328,6 +469,7 @@ async function s3Put(objectKey, body, contentType) {
   const dateStamp = amzDate.slice(0, 8);
 
   const signed = {
+    ...Object.fromEntries(Object.entries(extraHeaders).map(([k, v]) => [k.toLowerCase(), String(v)])),
     "content-type": contentType,
     host: url.host,
     "x-amz-content-sha256": payloadHash,
@@ -344,12 +486,11 @@ async function s3Put(objectKey, body, contentType) {
   const signature = crypto.createHmac("sha256", signingKey).update(stringToSign).digest("hex");
 
   // Host is added by the runtime and matches the signed value, so we don't resend it.
+  const { host: _host, ...sendHeaders } = signed;
   const res = await fetch(url, {
     method: "PUT",
     headers: {
-      "content-type": contentType,
-      "x-amz-content-sha256": payloadHash,
-      "x-amz-date": amzDate,
+      ...sendHeaders,
       authorization: `AWS4-HMAC-SHA256 Credential=${key}/${scope}, SignedHeaders=${signedHeaders}, Signature=${signature}`,
     },
     body: payload,
@@ -411,7 +552,8 @@ async function cmdPush(args) {
   const stage = fs.mkdtempSync(path.join(os.tmpdir(), `calo-push-${slug}-`));
   let keepStage = false;
   try {
-    stageProject({ root, stage, slug, title, ad });
+    stageProject({ root, stage, slug, title, ad, owner });
+    preflightAssetCount(stage);
 
     if (dry) {
       keepStage = true;
@@ -489,4 +631,4 @@ async function cmdPush(args) {
   }
 }
 
-module.exports = { cmdPush, _s3Put: s3Put, _upsertRegistry: upsertRegistry };
+module.exports = { cmdPush, _s3Put: s3Put, _upsertRegistry: upsertRegistry, _publicBase: PUBLIC_BASE };

package/bin/share.js

@@ -54,8 +54,17 @@ function readPkg(root) {
   try { return JSON.parse(fs.readFileSync(path.join(root, "package.json"), "utf8")); } catch { return null; }
 }
 
+// npm/npx/wrangler are .cmd shims on Windows, and Node >= 18.20.2 (CVE-2024-27980)
+// refuses to spawn .cmd files without shell:true. With shell:true cmd.exe
+// gets the args space-joined and unescaped, so quote anything with whitespace.
+function winShell(bin, argv) {
+  if (process.platform !== "win32") return [bin, argv, false];
+  const q = (s) => (/[ \t]/.test(s) ? `"${s}"` : s);
+  return [q(bin), argv.map(q), true];
+}
 function run(bin, argv, opts = {}) {
-  const r = spawnSync(bin, argv, { stdio: "inherit", ...opts });
+  const [b, a, shell] = winShell(bin, argv);
+  const r = spawnSync(b, a, { stdio: "inherit", shell, ...opts });
   if (r.error) throw r.error;
   if (typeof r.status === "number" && r.status !== 0) throw new Error(`${bin} ${argv.join(" ")} exited ${r.status}`);
   return r;
@@ -63,7 +72,8 @@ function run(bin, argv, opts = {}) {
 
 // Run while capturing combined output (to parse the deploy URL) but still show it.
 function runCapture(bin, argv, opts = {}) {
-  const r = spawnSync(bin, argv, { encoding: "utf8", ...opts });
+  const [b, a, shell] = winShell(bin, argv);
+  const r = spawnSync(b, a, { encoding: "utf8", shell, ...opts });
   if (r.error) throw r.error;
   const out = (r.stdout || "") + (r.stderr || "");
   process.stdout.write(out);
@@ -74,9 +84,9 @@ function runCapture(bin, argv, opts = {}) {
 // Prefer an installed wrangler (project-local, then global); else npx. Only used by
 // --direct — the default path needs no wrangler on this machine.
 function wranglerCmd(root) {
-  const local = path.join(root, "node_modules", ".bin", "wrangler");
+  const local = path.join(root, "node_modules", ".bin", process.platform === "win32" ? "wrangler.cmd" : "wrangler");
   if (fs.existsSync(local)) return [local, []];
-  const probe = spawnSync("wrangler", ["--version"], { stdio: "ignore" });
+  const probe = spawnSync("wrangler", ["--version"], { stdio: "ignore", shell: process.platform === "win32" });
   if (!probe.error && probe.status === 0) return ["wrangler", []];
   return ["npx", ["--yes", "wrangler@latest"]];
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@calo-design/cli",
-  "version": "0.4.7",
+  "version": "0.5.0",
   "description": "One-line setup for Calo design tooling: logs in with your Calo email and installs the calo-design skill + design-system packages. No GitHub account needed.",
   "bin": {
     "calo-design": "bin/cli.js"