@lynxship/cli 0.1.2 → 0.1.3

package/README.md

@@ -27,11 +27,11 @@ The package exposes the `lynxship` executable.
 
 ## Requirements
 
-- Node.js 22 LTS or newer; Node.js 24 LTS is the recommended production
-  baseline.
+- Node.js 22 or 24 LTS, or Node.js 26 Current; Node.js 24 LTS is the
+  recommended production baseline.
 - A LynxJS project using Rspeedy.
-- Android builds: JDK 17, Android SDK, `adb`, build tools and the project's
-  Gradle wrapper.
+- Android builds on Windows, macOS or Linux: JDK 17, Android SDK command-line
+  tools, `adb`, build tools and an executable project Gradle wrapper.
 - iOS builds: macOS, Xcode and Xcode command-line tools.
 - Cloudflare R2 credentials for artifact storage.
 
@@ -46,7 +46,10 @@ lynxship store configure --platform android
 ```
 
 Secret inputs are hidden. Credentials are stored outside the project using the
-OS-specific secure storage path. They are never written to `lynxship.json`.
+OS-specific secure storage path. Linux uses Secret Service when `secret-tool`
+is available and otherwise uses a mode-600 owner-only fallback suitable for
+headless development; CI should use its secret manager or environment
+variables. Credentials are never written to `lynxship.json`.
 
 The project itself is initialized automatically by `build` when needed, or
 explicitly with:
@@ -55,6 +58,10 @@ explicitly with:
 lynxship init --project-dir ./my-lynx-app
 ```
 
+`init` writes a stable UUID `projectId` to `lynxship.json`. Each project gets
+its own generated ID; credentials remain machine-global and are not written
+to the project file.
+
 ## Build a signed Android artifact
 
 ```bash
@@ -77,6 +84,15 @@ Rspeedy bundle
   -> expiring download URL and QR code
 ```
 
+CI can verify the complete local build without R2 credentials by adding
+`--no-upload`. The signed artifact remains in `.lynxship/artifacts` and the
+R2 transfer is the only skipped stage.
+
+```bash
+lynxship build --platform android --profile production --no-upload \
+  --non-interactive
+```
+
 Progress percentages are shown only when LynxShip has a real measurement. Long
 Rspeedy, Gradle and Xcode operations remain visible in the event journal until
 their completion checkpoint is known; no timer-based percentage is invented.
@@ -88,9 +104,15 @@ init                 Initialize or link a project
 doctor               Check the local toolchain and project
 dev                  Run the Rspeedy development server
 preview              Preview the production bundle locally
-build                Build, sign and upload an artifact
+build create         Build, sign and upload an artifact
+build list           List build jobs
+build status <id>    Inspect one build job
+build cancel <id>    Cancel a build job
+build retry <id>     Retry a failed build job
 submit               Submit the latest successful artifact
 update               Publish a signed OTA update
+update rollback      Roll back an OTA channel to a previous release
+rollback             Compatibility alias for update rollback
 run                  Install an artifact on a target
 logs                 Stream native logs
 autolink check       Check Lynx native-library wiring
@@ -105,12 +127,34 @@ Use `lynxship --help` or `lynxship <command> --help` for the complete option
 list. `--json`, `--quiet`, `--no-color` and `--non-interactive` are available
 for automation.
 
+## OTA rollback
+
+```bash
+lynxship update rollback \
+  --platform android \
+  --release-id <release-id> \
+  --reason "Restore known-good release"
+```
+
+Rollback changes the current release pointer for the configured channel. It
+does not delete the release or its R2 artifact, and it does not undo native
+code. Native changes still require a new binary build and store submission.
+
 ## OTA safety
 
 OTA updates are for JavaScript and assets compatible with the installed native
 runtime. If native code, permissions, autolinked modules or other runtime
 inputs change, LynxShip blocks the OTA and requires a new signed binary build.
 
+## Linux host support
+
+Android builds run on Windows, macOS and Linux, with device install/logs
+through `adb` and the self-hosted control plane. Install the Android
+command-line tools with `sdkmanager`, accept the required licenses, set
+`ANDROID_HOME` or `ANDROID_SDK_ROOT` and `JAVA_HOME`, and ensure
+`android/gradlew` is executable. macOS can build both Android and iOS; Windows
+and Linux can build Android only.
+
 ## Package layout
 
 The CLI is backed by the public `@lynxship/*` runtime packages in this

package/dist/android-build.d.ts

@@ -3,12 +3,22 @@ import type { BuildProfile } from "./config.js";
 interface AndroidBuildOptions {
     root: string;
     profile: BuildProfile;
+    uploadArtifacts?: boolean;
     quiet?: boolean;
     onStep?: (message: string) => void;
     onEvent?: (message: string) => void;
     onProgress?: (value?: number, label?: string) => void;
 }
 export declare function hasAndroidHost(root: string): Promise<boolean>;
+export declare function isSupportedAndroidPlatform(): boolean;
+/**
+ * Copy the standard Rspeedy output into the Android host assets directory.
+ *
+ * This is intentionally handled by LynxShip instead of requiring every
+ * project to carry a helper script. Rspeedy writes bundles and static assets
+ * to `dist`, while the Lynx Android host reads them from `app/src/main/assets`.
+ */
+export declare function syncLynxAssets(root: string): Promise<string[]>;
 export declare function runRealAndroidBuild(job: BuildJob, options: AndroidBuildOptions): Promise<BuildJob>;
 export {};
 //# sourceMappingURL=android-build.d.ts.map

package/dist/android-build.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"android-build.d.ts","sourceRoot":"","sources":["../src/android-build.ts"],"names":[],"mappings":"AAIA,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAEpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAUhD,UAAU,mBAAmB;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,YAAY,CAAC;IACtB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,UAAU,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;CACvD;AAoID,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAU7D;AAED,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,QAAQ,EACb,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,QAAQ,CAAC,CAoInB"}
+{"version":3,"file":"android-build.d.ts","sourceRoot":"","sources":["../src/android-build.ts"],"names":[],"mappings":"AAWA,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAEpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAWhD,UAAU,mBAAmB;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,YAAY,CAAC;IACtB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,UAAU,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;CACvD;AAoID,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAa7D;AAED,wBAAgB,0BAA0B,IAAI,OAAO,CAEpD;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAsCpE;AAED,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,QAAQ,EACb,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,QAAQ,CAAC,CAyJnB"}

package/dist/android-build.js

@@ -1,13 +1,13 @@
-import { access, copyFile, mkdir, readFile } from "node:fs/promises";
+import { access, copyFile, cp, mkdir, readFile, readdir, } from "node:fs/promises";
 import { execFileSync } from "node:child_process";
-import { existsSync, readdirSync } from "node:fs";
+import { constants as fsConstants, existsSync, readdirSync } from "node:fs";
 import { join } from "node:path";
 import { assert, sha256 } from "@lynxship/contracts";
 import { transitionBuild } from "@lynxship/build-orchestrator";
 import { loadR2, uploadR2Artifact } from "./r2.js";
 import { loadCredentials } from "./secure-store.js";
 import { nativeArtifactName } from "./artifact-name.js";
-import { commandExists, packageManagerScriptCommand, runProcess, } from "./process-runner.js";
+import { commandExists, executableExists, packageManagerScriptCommand, runProcess, } from "./process-runner.js";
 async function projectBuildCommand(root) {
     try {
         const packageJson = JSON.parse(await readFile(join(root, "package.json"), "utf8"));
@@ -73,7 +73,7 @@ function androidTool(name) {
             .sort()
             .reverse()
             .map((version) => join(sdk, "build-tools", version, executable))
-            .find((candidate) => existsSync(candidate));
+            .find((candidate) => executableExists(candidate));
     }
     catch {
         return undefined;
@@ -93,15 +93,60 @@ function artifactDetails(root, profile) {
         };
 }
 export function hasAndroidHost(root) {
-    return access(join(root, "android", process.platform === "win32" ? "gradlew.bat" : "gradlew"))
+    if (!isSupportedAndroidPlatform())
+        return Promise.resolve(false);
+    const wrapper = join(root, "android", process.platform === "win32" ? "gradlew.bat" : "gradlew");
+    return access(wrapper, process.platform === "win32" ? fsConstants.F_OK : fsConstants.X_OK)
         .then(() => true)
         .catch(() => false);
 }
+export function isSupportedAndroidPlatform() {
+    return ["linux", "darwin", "win32"].includes(process.platform);
+}
+/**
+ * Copy the standard Rspeedy output into the Android host assets directory.
+ *
+ * This is intentionally handled by LynxShip instead of requiring every
+ * project to carry a helper script. Rspeedy writes bundles and static assets
+ * to `dist`, while the Lynx Android host reads them from `app/src/main/assets`.
+ */
+export async function syncLynxAssets(root) {
+    const distRoot = join(root, "dist");
+    const assetsRoot = join(root, "android", "app", "src", "main", "assets");
+    let entries;
+    try {
+        entries = await readdir(distRoot, { withFileTypes: true });
+    }
+    catch {
+        throw new Error(`Rspeedy output directory is missing: ${distRoot}. Run the project build first.`);
+    }
+    const bundles = entries
+        .filter((entry) => entry.isFile() && entry.name.endsWith(".lynx.bundle"))
+        .map((entry) => entry.name);
+    assert(bundles.length > 0, "LYNX_BUNDLE_MISSING", `No .lynx.bundle was found in ${distRoot}. Check the Rspeedy output configuration.`);
+    await mkdir(assetsRoot, { recursive: true });
+    const outputNames = [...bundles, "async", "static"];
+    const copied = [];
+    for (const name of outputNames) {
+        const source = join(distRoot, name);
+        if (!existsSync(source))
+            continue;
+        await cp(source, join(assetsRoot, name), {
+            force: true,
+            recursive: true,
+        });
+        copied.push(name);
+    }
+    return copied;
+}
 export async function runRealAndroidBuild(job, options) {
+    assert(isSupportedAndroidPlatform(), "ANDROID_PLATFORM_UNSUPPORTED", "Android builds are supported only on Linux, macOS and Windows.");
     const android = join(options.root, "android");
     const wrapper = process.platform === "win32" ? "gradlew.bat" : "./gradlew";
     const artifact = artifactDetails(options.root, options.profile);
-    await loadR2(options.root);
+    const uploadArtifacts = options.uploadArtifacts ?? true;
+    if (uploadArtifacts)
+        await loadR2(options.root);
     const environment = {
         ...(await signingEnvironment(options.root)),
         LYNXSHIP_RUNTIME_VERSION: process.env.LYNXSHIP_RUNTIME_VERSION ?? job.runtimeVersion ?? "",
@@ -137,15 +182,17 @@ export async function runRealAndroidBuild(job, options) {
         step("Checking Android SDK and Gradle toolchain…");
         transitionBuild(job, "installing_dependencies", "syncing Lynx bundle into Android assets");
         step("Syncing bundle into the Android host…");
-        await runProcess(process.execPath, [join("android", "sync-bundle.mjs")], {
-            cwd: options.root,
-            env: environment,
-            ...processOptions,
-        });
+        const copiedAssets = await syncLynxAssets(options.root);
+        for (const name of copiedAssets) {
+            options.onEvent?.(`Synced dist/${name} -> android/app/src/main/assets/${name}`);
+        }
         step("Android host synchronized", 40);
         transitionBuild(job, "building", `Gradle ${artifact.task}`);
         step(`Running real Gradle task ${artifact.task}…`);
-        await runProcess(wrapper, [artifact.task], {
+        const gradleArgs = [artifact.task];
+        if (process.env.CI)
+            gradleArgs.push("--stacktrace");
+        await runProcess(wrapper, gradleArgs, {
             cwd: android,
             env: environment,
             ...processOptions,
@@ -164,26 +211,39 @@ export async function runRealAndroidBuild(job, options) {
         const content = await readFile(artifactPath);
         const hash = sha256(content);
         job.attempts += 1;
-        step("Uploading signed artifact to Cloudflare R2…", 80);
-        const uploaded = await uploadR2Artifact(options.root, job.projectId, job.id, artifactPath, artifactName.endsWith(".aab")
+        const contentType = artifactName.endsWith(".aab")
             ? "application/octet-stream"
-            : "application/vnd.android.package-archive", undefined, {
-            onProgress: (uploadedBytes, totalBytes) => {
-                const transfer = totalBytes === 0 ? 1 : uploadedBytes / totalBytes;
-                options.onProgress?.(80 + transfer * 19, `Uploading signed artifact to Cloudflare R2… ${Math.round(transfer * 10000) / 100}%`);
-            },
-        });
-        assert(uploaded.hash === hash, "BUILD_ARTIFACT_HASH", "R2 artifact hash mismatch");
-        job.artifact = {
-            name: artifactName,
-            hash,
-            path: artifactPath,
-            key: uploaded.key,
-            size: uploaded.size,
-            contentType: uploaded.contentType,
-            url: uploaded.url,
-            expiresAt: uploaded.expiresAt,
-        };
+            : "application/vnd.android.package-archive";
+        if (!uploadArtifacts) {
+            step("Artifact collected locally; R2 upload skipped", 100);
+            job.artifact = {
+                name: artifactName,
+                hash,
+                path: artifactPath,
+                size: content.length,
+                contentType,
+            };
+        }
+        else {
+            step("Uploading signed artifact to Cloudflare R2…", 80);
+            const uploaded = await uploadR2Artifact(options.root, job.projectId, job.id, artifactPath, contentType, undefined, {
+                onProgress: (uploadedBytes, totalBytes) => {
+                    const transfer = totalBytes === 0 ? 1 : uploadedBytes / totalBytes;
+                    options.onProgress?.(80 + transfer * 19, `Uploading signed artifact to Cloudflare R2… ${Math.round(transfer * 10000) / 100}%`);
+                },
+            });
+            assert(uploaded.hash === hash, "BUILD_ARTIFACT_HASH", "R2 artifact hash mismatch");
+            job.artifact = {
+                name: artifactName,
+                hash,
+                path: artifactPath,
+                key: uploaded.key,
+                size: uploaded.size,
+                contentType: uploaded.contentType,
+                url: uploaded.url,
+                expiresAt: uploaded.expiresAt,
+            };
+        }
         step(`Artifact ready: ${artifactName}`, 100);
         return transitionBuild(job, "success", "real Android artifact created");
     }

package/dist/configure.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"configure.d.ts","sourceRoot":"","sources":["../src/configure.ts"],"names":[],"mappings":"AAMA,OAAO,EAIL,KAAK,QAAQ,EACd,MAAM,SAAS,CAAC;AAQjB,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CA2BjE;AAED,UAAU,0BAA0B;IAClC,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA6CrE;AAED,wBAAsB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAuC1E;AA+ED,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,0BAA0B,CAAC,CAoCrC"}
+{"version":3,"file":"configure.d.ts","sourceRoot":"","sources":["../src/configure.ts"],"names":[],"mappings":"AAMA,OAAO,EAIL,KAAK,QAAQ,EACd,MAAM,SAAS,CAAC;AAQjB,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CA2BjE;AAED,UAAU,0BAA0B;IAClC,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA6CrE;AAED,wBAAsB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAuC1E;AAiFD,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,0BAA0B,CAAC,CAoCrC"}

package/dist/configure.js

@@ -1,6 +1,6 @@
 import { randomBytes } from "node:crypto";
 import { existsSync } from "node:fs";
-import { access, mkdir, readFile, unlink } from "node:fs/promises";
+import { access, chmod, mkdir, readFile, unlink } from "node:fs/promises";
 import { spawn } from "node:child_process";
 import { join } from "node:path";
 import { prompt, secret } from "./prompt.js";
@@ -84,6 +84,7 @@ async function generateAndroidKeystore(root, keyAlias) {
     const path = join(directory, "android-release.jks");
     try {
         await access(path);
+        await chmod(path, 0o600).catch(() => undefined);
         throw new Error(`An Android keystore already exists at ${path}. Configure it explicitly or remove it before generating a new one.`);
     }
     catch (error) {
@@ -138,6 +139,7 @@ async function generateAndroidKeystore(root, keyAlias) {
         await unlink(path).catch(() => undefined);
         throw error;
     }
+    await chmod(path, 0o600).catch(() => undefined);
     return { path, password };
 }
 export async function configureAndroid(root) {

package/dist/index.js

@@ -1,18 +1,18 @@
 #!/usr/bin/env node
 import { access, mkdir, readFile, writeFile } from "node:fs/promises";
 import { existsSync } from "node:fs";
-import { createHash, randomBytes } from "node:crypto";
+import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { dirname, join, resolve } from "node:path";
 import { BuildOrchestrator } from "@lynxship/build-orchestrator";
 import { JsonRepository } from "@lynxship/db";
 import { assert, createId, sha256, } from "@lynxship/contracts";
 import { createSigningKey, signManifest, } from "@lynxship/signing";
 import { AppStoreConnectApiProvider, GooglePlayApiProvider, SubmissionService, } from "@lynxship/submit";
-import { DEFAULT_CONFIG, loadConfig, platformValue } from "./config.js";
-import { hasAndroidHost, runRealAndroidBuild } from "./android-build.js";
+import { DEFAULT_CONFIG, loadConfig, platformValue, } from "./config.js";
+import { hasAndroidHost, isSupportedAndroidPlatform, runRealAndroidBuild, } from "./android-build.js";
 import { hasIosHost, runRealIosBuild } from "./ios-build.js";
 import { configureAndroid, configureAppStoreConnect, configureGooglePlay, configureR2, } from "./configure.js";
-import { fetchOtaPublicKey, publishOtaRelease, submitRealArtifact, } from "./remote.js";
+import { fetchOtaPublicKey, publishOtaRelease, rollbackOtaRelease, submitRealArtifact, } from "./remote.js";
 import { uploadR2Artifact } from "./r2.js";
 import { credentialStorageDescription, loadCredentials, } from "./secure-store.js";
 import { createCliUi } from "./ui/index.js";
@@ -107,14 +107,24 @@ async function readConfigurationStatus() {
             process.env.LYNXSHIP_KEY_PASSWORD);
     return { r2: r2Configured, android: androidConfigured };
 }
-async function requireOperationalConfiguration(platform) {
+async function requireOperationalConfiguration(platform, options = {}) {
     await requireProjectRoot();
     const status = await readConfigurationStatus();
-    assert(status.r2, "CLI_R2_REQUIRED", "Cloudflare R2 must be configured first. Run `lynxship storage configure`.");
+    if (options.requireR2 !== false)
+        assert(status.r2, "CLI_R2_REQUIRED", "Cloudflare R2 must be configured first. Run `lynxship storage configure`.");
     if (platform !== "android")
         return;
     assert(status.android, "BUILD_SIGNING_REQUIRED", "Android signing must be configured first. Run `lynxship android configure` or provide an existing keystore.");
 }
+async function requireR2Configuration() {
+    await requireProjectRoot();
+    const status = await readConfigurationStatus();
+    assert(status.r2, "CLI_R2_REQUIRED", "Cloudflare R2 must be configured first. Run `lynxship storage configure`.");
+}
+function configuredProjectId(config) {
+    assert(typeof config.projectId === "string" && config.projectId.length > 0, "CLI_PROJECT_ID_REQUIRED", "lynxship.json must contain a generated projectId. Run `lynxship init` for a new project configuration.");
+    return config.projectId;
+}
 async function renderConfigurationFooter() {
     if (!ui.interactive || ui.options.quiet)
         return;
@@ -195,6 +205,7 @@ function commandTitle(command) {
         build: "Cloud Build",
         submit: "Store Submission",
         update: "OTA Update",
+        rollback: "OTA Rollback",
         "self-host": "Self-host setup",
         storage: "Cloudflare R2 setup",
         android: "Android signing setup",
@@ -216,19 +227,56 @@ Commands:
   ota doctor              Check native OTA host integration
   run                     Install an artifact on an Android/iOS target
   logs                    Stream Android/iOS native logs
-  build                   Create a local/cloud build job
+  build create            Create a local/cloud build job
+  build list              List build jobs
+  build status <id>       Show one build job
+  build cancel <id>       Cancel a build job
+  build retry <id>        Retry a failed build job
   submit                  Submit the latest successful build
   update                  Upload and publish a signed OTA update
+  update rollback         Roll back an OTA channel to a previous release
+  rollback                Alias for update rollback
   self-host init          Generate local self-host credentials
   storage configure       Configure Cloudflare R2 and encrypted R2 credentials
   android configure       Configure or generate encrypted Android signing credentials
   store configure         Configure Google Play or App Store Connect submission
 
+Build options:
+  --platform <p>          Target android or ios (default: android)
+  --profile <name>        Build profile (default: production)
+  --no-wait               Queue the build without executing it locally
+  --no-upload              Keep the signed artifact local and skip R2 (CI verification)
+  --local                 Use the contract-only build path for tests
+
+Submit options:
+  --platform <p>          Target android or ios (default: android)
+  --latest                Submit the latest successful build
+  --local                 Use the mock submission provider for tests
+
 Update options:
-  --bundle <path[,path]>  Lynx bundle/assets to publish (default: discover dist/*.lynx.bundle)
+  --platform <p>          Target android or ios (default: android)
+  --bundle <path[,path]>  Lynx bundle/assets (default: discover dist/*.lynx.bundle)
+  --message <text>        Release message
   --local                 Create a local contract-only update for tests
   --policy-approval-id    Required for an iOS OTA release
 
+Rollback options:
+  --platform <p>          Target android or ios (default: android)
+  --release-id <id>       Previously published compatible release
+  --reason <text>         Required audit reason for the rollback
+  --local                 Roll back local contract state for tests
+
+Device and diagnostics options:
+  doctor --platform <p>   Check the local toolchain (default: android)
+  autolink check --platform <p>
+                          Check native-library wiring (default: android)
+  ota doctor --platform <p>
+                          Check OTA host integration (default: android)
+  run --artifact <path>   Install a specific APK, IPA or app artifact
+  run --device <id>       Select the Android device or iOS simulator
+  run --simulator         Install an iOS .app with simctl
+  logs --device <id>      Select the device or simulator for native logs
+
 Global options:
   --json                  Emit one stable JSON result/error object
   --quiet                 Print only the final machine-relevant result
@@ -237,9 +285,10 @@ Global options:
   --non-interactive       Never prompt; fail on missing inputs
   --banner                Show the Braille LynxShip logo in a TTY
   --project-dir <path>    Use a LynxShip project from any working directory
+  --project-id <id>       Project ID used by init
+  --library-dir <path>    Native library directory for autolink codegen
   --simulator             Install an iOS .app on a simulator with simctl
-  doctor --platform <p>   Check Autolink for android or ios (default: android)
-  --local                 Use the mock submission provider for local tests only
+  --help                  Show this complete command reference
 
 Node support: Node 22/24 LTS or Node 26 Current. Use Node 24 LTS for production.`;
 }
@@ -270,7 +319,7 @@ async function initializeProject() {
     if (await exists(file))
         return file;
     await mkdir(join(root, ".lynxship"), { recursive: true });
-    await writeFile(file, `${JSON.stringify({ ...DEFAULT_CONFIG, projectId: flag("--project-id", "local_project") }, null, 2)}\n`);
+    await writeFile(file, `${JSON.stringify({ ...DEFAULT_CONFIG, projectId: flag("--project-id") ?? randomUUID() }, null, 2)}\n`);
     return file;
 }
 async function initializeBuildProject() {
@@ -452,7 +501,7 @@ async function main() {
         printValue(helpText());
         return;
     }
-    ui.header(commandTitle(command));
+    ui.header(commandTitle(command === "update" && args[0] === "rollback" ? "rollback" : command));
     ui.debug(`cwd=${root}`);
     if (command === "init") {
         ui.info("Scanning project structure…");
@@ -467,13 +516,14 @@ async function main() {
             return;
         }
         await initializeProject();
+        const initializedConfig = await loadConfig(root);
         ui.success("Created lynxship.json");
         printValue({ status: "created", file }, {
             title: "Initialized",
             rows: [
                 {
                     label: "Project ID",
-                    value: flag("--project-id", "local_project"),
+                    value: initializedConfig.projectId ?? "unassigned",
                     valueColor: "purple",
                 },
                 { label: "Configuration", value: file, valueColor: "muted" },
@@ -489,6 +539,9 @@ async function main() {
         const autolink = await inspectAutolink(root);
         const autolinkForPlatform = autolink[doctorPlatform];
         const lockfile = await findLockfile(root);
+        const credentialStore = credentialStorageDescription();
+        const nativeCredentialStore = !credentialStore.includes("owner-only");
+        const androidHost = doctorPlatform === "android" ? await hasAndroidHost(root) : false;
         const nodeMajor = Number(process.versions.node.split(".")[0]);
         const nodeSupported = nodeMajor >= 22;
         const nodeRecommended = nodeMajor % 2 === 0;
@@ -519,6 +572,26 @@ async function main() {
                 status: config.projectId ? "pass" : "fail",
                 value: config.projectId ? "found" : "missing · fix: lynxship init",
             },
+            {
+                name: "credential-store",
+                ok: true,
+                status: nativeCredentialStore ? "pass" : "warn",
+                value: nativeCredentialStore
+                    ? credentialStore
+                    : `${credentialStore} · use CI secret variables or install Linux Secret Service`,
+            },
+            ...(doctorPlatform === "android"
+                ? [
+                    {
+                        name: "android-host",
+                        ok: androidHost,
+                        status: androidHost ? "pass" : "fail",
+                        value: androidHost
+                            ? "Gradle host found"
+                            : "missing · add an Android host with android/gradlew",
+                    },
+                ]
+                : []),
             {
                 name: "cloudflare-r2",
                 ok: configuration.r2,
@@ -794,7 +867,7 @@ async function main() {
             const controlPlaneSubmission = candidate.artifact?.path
                 ? await submitRealArtifact(config, state, candidate, latest)
                 : await submissions.submit({
-                    projectId: config.projectId ?? "local_project",
+                    projectId: configuredProjectId(config),
                     organizationId: "local_org",
                     platform,
                     artifact: candidate.artifact ?? { hash: `local-${candidate.id}` },
@@ -855,11 +928,11 @@ async function main() {
         }
         return;
     }
-    if (command === "update") {
+    if (command === "update" && args[0] !== "rollback") {
         const config = await loadConfig(root);
         const platform = platformValue(flag("--platform", "android"));
         await requireOperationalConfiguration(platform);
-        const projectId = config.projectId ?? "local_project";
+        const projectId = configuredProjectId(config);
         const localMode = args.includes("--local") || process.env.LYNXSHIP_SUBMIT_MODE === "mock";
         const explicitBundles = flag("--bundle");
         const runtime = await inspectRuntimeFingerprint(root, platform, config);
@@ -974,10 +1047,82 @@ async function main() {
         }
         return;
     }
+    if (command === "rollback" ||
+        (command === "update" && args[0] === "rollback")) {
+        if (command === "update")
+            args.shift();
+        const config = await loadConfig(root);
+        const platform = platformValue(flag("--platform", "android"));
+        const releaseId = flag("--release-id");
+        const reason = flag("--reason");
+        const channel = config.update?.channel ?? "production";
+        const localMode = args.includes("--local");
+        assert(Boolean(releaseId && releaseId !== "true"), "ROLLBACK_RELEASE_REQUIRED", "Pass the release to restore with `--release-id <id>`.");
+        assert(Boolean(reason?.trim()) && reason !== "true", "ROLLBACK_REASON_REQUIRED", 'Pass an audit reason with `--reason "..."`.');
+        await requireR2Configuration();
+        const progress = ui.progress("OTA rollback");
+        try {
+            progress.update(10, `Selecting ${releaseId} for ${channel}…`);
+            if (localMode) {
+                const release = state.releases.find((candidate) => candidate.id === releaseId &&
+                    candidate.manifest.channel === channel &&
+                    candidate.manifest.platform === platform);
+                assert(release, "RELEASE_NOT_FOUND", `Local release ${releaseId} was not found in channel ${channel} for ${platform}.`);
+                state.lastRollback = {
+                    releaseId: release.id,
+                    reason: reason,
+                    at: new Date().toISOString(),
+                };
+                await saveState(state, repository, builds, submissions);
+                progress.update(100, "Local OTA channel rolled back");
+                printValue({ status: "rolled_back", release, rollback: state.lastRollback }, {
+                    title: "OTA rollback",
+                    rows: [
+                        { label: "Release ID", value: release.id, valueColor: "purple" },
+                        { label: "Platform", value: platform, valueColor: "blue" },
+                        { label: "Channel", value: channel, valueColor: "orange" },
+                        { label: "Reason", value: reason, valueColor: "muted" },
+                    ],
+                    done: "Local OTA channel now points to the selected release.",
+                });
+                return;
+            }
+            progress.update(45, "Requesting rollback through LynxShip API…");
+            const release = (await rollbackOtaRelease(config, state, {
+                projectId: configuredProjectId(config),
+                channel,
+                platform,
+                releaseId: releaseId,
+                reason: reason,
+            }));
+            state.lastRollback = {
+                releaseId: release.id,
+                reason: reason,
+                at: new Date().toISOString(),
+            };
+            await saveState(state, repository, builds, submissions);
+            progress.update(100, "OTA channel rolled back");
+            printValue({ status: "rolled_back", release, rollback: state.lastRollback }, {
+                title: "OTA rollback",
+                rows: [
+                    { label: "Release ID", value: release.id, valueColor: "purple" },
+                    { label: "Platform", value: platform, valueColor: "blue" },
+                    { label: "Channel", value: channel, valueColor: "orange" },
+                    { label: "Reason", value: reason, valueColor: "muted" },
+                ],
+                done: "Devices will receive the selected compatible release on their next OTA check.",
+            });
+        }
+        finally {
+            progress.stop();
+        }
+        return;
+    }
     assert(command === "build", "CLI_COMMAND", `Unknown command: ${command}`);
     const subcommand = args[0] && !args[0].startsWith("--") ? args.shift() : "create";
     const platform = platformValue(flag("--platform", "android"));
-    await requireOperationalConfiguration(platform);
+    const skipUpload = args.includes("--no-upload");
+    await requireOperationalConfiguration(platform, { requireR2: !skipUpload });
     if (subcommand === "list") {
         printValue(builds.list());
         return;
@@ -1005,7 +1150,7 @@ async function main() {
     await requireAutolinkReady(root, platform);
     const runtime = await inspectRuntimeFingerprint(root, platform, config);
     const job = await builds.create({
-        projectId: config.projectId ?? "local_project",
+        projectId: configuredProjectId(config),
         organizationId: "local_org",
         platform,
         profile,
@@ -1018,14 +1163,23 @@ async function main() {
     try {
         progress.update(undefined, "Preparing build pipeline…");
         if (!args.includes("--no-wait")) {
-            const realAndroid = platform === "android" && (await hasAndroidHost(root));
+            if (platform === "android" &&
+                !isSupportedAndroidPlatform() &&
+                !args.includes("--local"))
+                assert(false, "ANDROID_PLATFORM_UNSUPPORTED", "Android builds are supported only on Linux, macOS and Windows.");
+            const realAndroid = platform === "android" &&
+                isSupportedAndroidPlatform() &&
+                (await hasAndroidHost(root));
             const realIos = platform === "ios" && hasIosHost(root, config.build?.[profile]);
             if (platform === "ios" && !realIos && !args.includes("--local"))
                 assert(false, "IOS_HOST_REQUIRED", "A macOS Xcode host is required for a real iOS build. No local fake iOS build is created.");
+            if (platform === "android" && !realAndroid && !args.includes("--local"))
+                assert(false, "ANDROID_HOST_REQUIRED", "A real Android build requires an Android Gradle host. Add android/gradlew and the native Lynx host, or use --local for contract tests.");
             if (realAndroid) {
                 await runRealAndroidBuild(job, {
                     root,
                     profile: config.build?.[profile] ?? {},
+                    uploadArtifacts: !skipUpload,
                     quiet: json,
                     onEvent: (message) => progress.event(message),
                     onProgress: (value, label) => progress.update(value, label),
@@ -1035,6 +1189,7 @@ async function main() {
                 await runRealIosBuild(job, {
                     root,
                     profile: config.build?.[profile] ?? {},
+                    uploadArtifacts: !skipUpload,
                     quiet: json,
                     onEvent: (message) => progress.event(message),
                     onProgress: (value, label) => progress.update(value, label),

package/dist/ios-build.d.ts

@@ -3,6 +3,7 @@ import type { BuildProfile } from "./config.js";
 interface IosBuildOptions {
     root: string;
     profile: BuildProfile;
+    uploadArtifacts?: boolean;
     quiet?: boolean;
     onEvent?: (message: string) => void;
     onProgress?: (value?: number, label?: string) => void;

package/dist/ios-build.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ios-build.d.ts","sourceRoot":"","sources":["../src/ios-build.ts"],"names":[],"mappings":"AAGA,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAEpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAShD,UAAU,eAAe;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,YAAY,CAAC;IACtB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,UAAU,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;CACvD;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAcxE;AA0BD,wBAAsB,eAAe,CACnC,GAAG,EAAE,QAAQ,EACb,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,QAAQ,CAAC,CAsLnB"}
+{"version":3,"file":"ios-build.d.ts","sourceRoot":"","sources":["../src/ios-build.ts"],"names":[],"mappings":"AAGA,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAEpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAShD,UAAU,eAAe;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,YAAY,CAAC;IACtB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,UAAU,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;CACvD;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAcxE;AA0BD,wBAAsB,eAAe,CACnC,GAAG,EAAE,QAAQ,EACb,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,QAAQ,CAAC,CAmMnB"}

package/dist/ios-build.js

@@ -69,7 +69,9 @@ export async function runRealIosBuild(job, options) {
         options.onProgress?.(progress, message);
     };
     try {
-        await loadR2(options.root);
+        const uploadArtifacts = options.uploadArtifacts ?? true;
+        if (uploadArtifacts)
+            await loadR2(options.root);
         await mkdir(archiveDirectory, { recursive: true });
         transitionBuild(job, "uploading_source", "iOS source prepared");
         step("Building Lynx bundle with Rspeedy…", 5);
@@ -128,24 +130,37 @@ export async function runRealIosBuild(job, options) {
         await copyFile(exportedIpa, artifactPath);
         const content = await readFile(artifactPath);
         const hash = sha256(content);
-        const uploaded = await uploadR2Artifact(options.root, job.projectId, job.id, artifactPath, "application/octet-stream", undefined, {
-            onProgress: (uploadedBytes, totalBytes) => {
-                const transfer = totalBytes === 0 ? 1 : uploadedBytes / totalBytes;
-                options.onProgress?.(80 + transfer * 19, `Uploading signed artifact to Cloudflare R2… ${Math.round(transfer * 10000) / 100}%`);
-            },
-        });
-        assert(uploaded.hash === hash, "BUILD_ARTIFACT_HASH", "R2 artifact hash mismatch");
         job.attempts += 1;
-        job.artifact = {
-            name: artifactName,
-            hash,
-            path: artifactPath,
-            key: uploaded.key,
-            size: uploaded.size,
-            contentType: uploaded.contentType,
-            url: uploaded.url,
-            expiresAt: uploaded.expiresAt,
-        };
+        if (!uploadArtifacts) {
+            step("Artifact collected locally; R2 upload skipped", 100);
+            job.artifact = {
+                name: artifactName,
+                hash,
+                path: artifactPath,
+                size: content.length,
+                contentType: "application/octet-stream",
+            };
+        }
+        else {
+            step("Uploading signed artifact to Cloudflare R2…", 80);
+            const uploaded = await uploadR2Artifact(options.root, job.projectId, job.id, artifactPath, "application/octet-stream", undefined, {
+                onProgress: (uploadedBytes, totalBytes) => {
+                    const transfer = totalBytes === 0 ? 1 : uploadedBytes / totalBytes;
+                    options.onProgress?.(80 + transfer * 19, `Uploading signed artifact to Cloudflare R2… ${Math.round(transfer * 10000) / 100}%`);
+                },
+            });
+            assert(uploaded.hash === hash, "BUILD_ARTIFACT_HASH", "R2 artifact hash mismatch");
+            job.artifact = {
+                name: artifactName,
+                hash,
+                path: artifactPath,
+                key: uploaded.key,
+                size: uploaded.size,
+                contentType: uploaded.contentType,
+                url: uploaded.url,
+                expiresAt: uploaded.expiresAt,
+            };
+        }
         step(`Artifact ready: ${artifactName}`, 100);
         return transitionBuild(job, "success", "real iOS artifact created");
     }

package/dist/paths.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../src/paths.ts"],"names":[],"mappings":"AAGA,wBAAgB,uBAAuB,IAAI,MAAM,CAYhD"}
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../src/paths.ts"],"names":[],"mappings":"AAGA,wBAAgB,uBAAuB,IAAI,MAAM,CAkBhD"}

package/dist/paths.js

@@ -1,5 +1,5 @@
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { isAbsolute, join } from "node:path";
 export function globalLynxShipDirectory() {
     if (process.env.LYNXSHIP_CONFIG_DIR)
         return process.env.LYNXSHIP_CONFIG_DIR;
@@ -8,5 +8,8 @@ export function globalLynxShipDirectory() {
         return join(process.env.APPDATA ?? join(home, "AppData", "Roaming"), "LynxShip");
     if (process.platform === "darwin")
         return join(home, "Library", "Application Support", "LynxShip");
-    return join(process.env.XDG_CONFIG_HOME ?? join(home, ".config"), "lynxship");
+    const xdgConfigHome = process.env.XDG_CONFIG_HOME;
+    return join(xdgConfigHome && isAbsolute(xdgConfigHome)
+        ? xdgConfigHome
+        : join(home, ".config"), "lynxship");
 }

package/dist/process-runner.d.ts

@@ -15,4 +15,5 @@ export declare function packageManagerScriptCommand(root: string, script: string
 export declare function runProcess(command: string, args: string[], options: ProcessOptions): Promise<void>;
 export declare function runRspeedy(root: string, subcommand: string, args: string[], options: Omit<ProcessOptions, "cwd">): Promise<void>;
 export declare function commandExists(command: string): boolean;
+export declare function executableExists(file: string): boolean;
 //# sourceMappingURL=process-runner.d.ts.map

package/dist/process-runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"process-runner.d.ts","sourceRoot":"","sources":["../src/process-runner.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACnC;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG;IACnD,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB,CAcA;AAED,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,IAAI,GAAE,MAAM,EAAO,GAClB;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAGrC;AAsBD,wBAAgB,UAAU,CACxB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,IAAI,CAAC,CA8Cf;AAED,wBAAsB,UAAU,CAC9B,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,GACnC,OAAO,CAAC,IAAI,CAAC,CAOf;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAWtD"}
+{"version":3,"file":"process-runner.d.ts","sourceRoot":"","sources":["../src/process-runner.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACnC;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG;IACnD,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB,CAcA;AAED,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,IAAI,GAAE,MAAM,EAAO,GAClB;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAGrC;AAsBD,wBAAgB,UAAU,CACxB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,IAAI,CAAC,CA4Df;AAED,wBAAsB,UAAU,CAC9B,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,GACnC,OAAO,CAAC,IAAI,CAAC,CAOf;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CA4BtD;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAUtD"}

package/dist/process-runner.js

@@ -1,6 +1,5 @@
-import { execFileSync } from "node:child_process";
 import { spawn } from "node:child_process";
-import { existsSync, readFileSync } from "node:fs";
+import { accessSync, constants, existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 export function packageManagerCommand(root) {
     const configured = process.env.LYNXSHIP_PACKAGE_MANAGER ?? process.env.LYNXSHIP_PNPM_PATH;
@@ -77,8 +76,18 @@ export function runProcess(command, args, options) {
                 options.onOutput?.(pending.trim());
             if (code === 0)
                 return resolve();
-            const lastLine = output.trim().split(/\r?\n/).at(-1) ?? "";
-            reject(new Error(`${command} ${args.join(" ")} failed (${signal ?? `exit ${code}`})${lastLine ? `: ${lastLine}` : ""}`));
+            const outputLines = output
+                .trim()
+                .split(/\r?\n/)
+                .map((line) => line.trim())
+                .filter(Boolean);
+            const failureIndex = outputLines.findIndex((line) => /(?:FAILURE:|What went wrong:|Execution failed for task)/.test(line));
+            const recentOutput = (failureIndex >= 0
+                ? outputLines.slice(failureIndex)
+                : outputLines.slice(-24))
+                .slice(-24)
+                .join("\n");
+            reject(new Error(`${command} ${args.join(" ")} failed (${signal ?? `exit ${code}`})${recentOutput ? `:\n${recentOutput}` : ""}`));
         });
     });
 }
@@ -87,8 +96,38 @@ export async function runRspeedy(root, subcommand, args, options) {
     await runProcess(manager.command, [...manager.prefix, "rspeedy", subcommand, ...args], { ...options, cwd: root });
 }
 export function commandExists(command) {
+    const pathValue = process.env.PATH ?? "";
+    const pathEntries = pathValue.split(process.platform === "win32" ? ";" : ":");
+    const hasPathSeparator = /[\\/]/.test(command);
+    const candidates = hasPathSeparator
+        ? [command]
+        : pathEntries.flatMap((directory) => {
+            if (!directory)
+                return [];
+            if (process.platform !== "win32")
+                return [join(directory, command)];
+            const extensions = (process.env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD")
+                .split(";")
+                .filter(Boolean);
+            return [
+                join(directory, command),
+                ...extensions.map((extension) => join(directory, `${command}${extension}`)),
+            ];
+        });
+    const mode = process.platform === "win32" ? constants.F_OK : constants.X_OK;
+    return candidates.some((candidate) => {
+        try {
+            accessSync(candidate, mode);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    });
+}
+export function executableExists(file) {
     try {
-        execFileSync(process.platform === "win32" ? "where.exe" : "which", [command], { stdio: "ignore" });
+        accessSync(file, process.platform === "win32" ? constants.F_OK : constants.X_OK);
         return true;
     }
     catch {

package/dist/r2.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"r2.d.ts","sourceRoot":"","sources":["../src/r2.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,QAAQ,EACT,MAAM,oBAAoB,CAAC;AAI5B,OAAO,EAAmB,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAG5E,MAAM,WAAW,QAAQ;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,CAAC,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,IAAI,CAAC;CAClE;AAYD,iBAAS,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAElD;AA0BD,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAClD,MAAM,EAAE,QAAQ,CAAC;IACjB,WAAW,EAAE,WAAW,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;CACnD,CAAC,CA0CD;AAED,wBAAgB,cAAc,CAC5B,MAAM,EAAE,QAAQ,EAChB,WAAW,EAAE,WAAW,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,GAChD,QAAQ,CAMV;AAED,wBAAsB,QAAQ,CAC5B,MAAM,EAAE,QAAQ,EAChB,WAAW,EAAE,WAAW,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,GAChD,OAAO,CAAC,IAAI,CAAC,CAOf;AAED,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,UAAU,CAAC,EAAE,MAAM,EACnB,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,UAAU,CAAC,CAkDrB;AAED,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,QAAQ,EAChB,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GACjC,OAAO,CAAC,IAAI,CAAC,CAYf;AAED,OAAO,EAAE,eAAe,EAAE,CAAC"}
+{"version":3,"file":"r2.d.ts","sourceRoot":"","sources":["../src/r2.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,QAAQ,EACT,MAAM,oBAAoB,CAAC;AAI5B,OAAO,EAAmB,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAG5E,MAAM,WAAW,QAAQ;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,CAAC,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,IAAI,CAAC;CAClE;AAYD,iBAAS,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAElD;AA0BD,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAClD,MAAM,EAAE,QAAQ,CAAC;IACjB,WAAW,EAAE,WAAW,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;CACnD,CAAC,CA0CD;AAED,wBAAgB,cAAc,CAC5B,MAAM,EAAE,QAAQ,EAChB,WAAW,EAAE,WAAW,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,GAChD,QAAQ,CAMV;AAED,wBAAsB,QAAQ,CAC5B,MAAM,EAAE,QAAQ,EAChB,WAAW,EAAE,WAAW,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,GAChD,OAAO,CAAC,IAAI,CAAC,CAOf;AAED,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,UAAU,CAAC,EAAE,MAAM,EACnB,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,UAAU,CAAC,CAkDrB;AAED,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,QAAQ,EAChB,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GACjC,OAAO,CAAC,IAAI,CAAC,CAaf;AAED,OAAO,EAAE,eAAe,EAAE,CAAC"}

package/dist/r2.js

@@ -1,4 +1,4 @@
-import { access, mkdir, readFile, writeFile } from "node:fs/promises";
+import { access, chmod, mkdir, readFile, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import { GetObjectCommand, HeadBucketCommand, S3Client, } from "@aws-sdk/client-s3";
 import { Upload } from "@aws-sdk/lib-storage";
@@ -130,6 +130,7 @@ export async function writeR2Config(root, config, options = {}) {
         encoding: "utf8",
         mode: 0o600,
     });
+    await chmod(file, 0o600).catch(() => undefined);
     await access(file);
 }
 export { defaultEndpoint };

package/dist/remote.d.ts

@@ -20,12 +20,20 @@ export interface OtaPublishRequest {
     rollout?: number;
     policyApprovalId?: string | null;
 }
+export interface OtaRollbackRequest {
+    projectId: string;
+    channel: string;
+    platform: "android" | "ios";
+    releaseId: string;
+    reason: string;
+}
 export declare function ensureRemoteTarget(config: LynxShipConfig, state: RemoteCliState): Promise<{
     organizationId: string;
     projectId: string;
 }>;
 export declare function submitRealArtifact(config: LynxShipConfig, state: RemoteCliState, job: BuildJob, latest: boolean): Promise<unknown>;
 export declare function publishOtaRelease(config: LynxShipConfig, state: RemoteCliState, input: OtaPublishRequest): Promise<unknown>;
+export declare function rollbackOtaRelease(config: LynxShipConfig, state: RemoteCliState, input: OtaRollbackRequest): Promise<unknown>;
 export declare function fetchOtaPublicKey(config: LynxShipConfig): Promise<{
     keyId: string;
     publicKey: string;

package/dist/remote.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote.d.ts","sourceRoot":"","sources":["../src/remote.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD,MAAM,WAAW,cAAc;IAC7B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,SAAS,GAAG,KAAK,CAAC;IAC5B,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACzE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAsCD,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,cAAc,GACpB,OAAO,CAAC;IAAE,cAAc,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CA+CxD;AAED,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,cAAc,EACrB,GAAG,EAAE,QAAQ,EACb,MAAM,EAAE,OAAO,GACd,OAAO,CAAC,OAAO,CAAC,CAoDlB;AAED,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,cAAc,EACrB,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC,OAAO,CAAC,CAalB;AAED,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAQ/C"}
+{"version":3,"file":"remote.d.ts","sourceRoot":"","sources":["../src/remote.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD,MAAM,WAAW,cAAc;IAC7B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,SAAS,GAAG,KAAK,CAAC;IAC5B,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACzE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,SAAS,GAAG,KAAK,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAsCD,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,cAAc,GACpB,OAAO,CAAC;IAAE,cAAc,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAmDxD;AAED,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,cAAc,EACrB,GAAG,EAAE,QAAQ,EACb,MAAM,EAAE,OAAO,GACd,OAAO,CAAC,OAAO,CAAC,CAoDlB;AAED,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,cAAc,EACrB,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC,OAAO,CAAC,CAalB;AAED,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,cAAc,EACrB,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,OAAO,CAAC,CAalB;AAED,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAQ/C"}

package/dist/remote.js

@@ -18,6 +18,9 @@ async function request(options, path, init = {}) {
     return body;
 }
 export async function ensureRemoteTarget(config, state) {
+    const projectName = config.projectId;
+    if (!projectName)
+        throw new Error("lynxship.json must contain projectId. Run `lynxship init` first.");
     const options = {
         apiUrl: config.cli?.apiUrl,
         token: config.cli?.token ?? process.env.LYNXSHIP_TOKEN,
@@ -29,7 +32,7 @@ export async function ensureRemoteTarget(config, state) {
         const organization = await request(options, "/v1/organizations", {
             method: "POST",
             body: JSON.stringify({
-                name: `${config.projectId ?? "local_project"} organization`,
+                name: `${projectName} organization`,
                 ownerUserId: "cli",
             }),
         });
@@ -39,7 +42,6 @@ export async function ensureRemoteTarget(config, state) {
     let projectId = state.remoteProjectId;
     if (!projectId) {
         const projects = await request(options, `/v1/projects?organizationId=${encodeURIComponent(organizationId)}`);
-        const projectName = config.projectId ?? "local_project";
         projectId = projects.find((project) => project.name === projectName)?.id;
         if (!projectId) {
             const project = await request(options, "/v1/projects", {
@@ -108,6 +110,16 @@ export async function publishOtaRelease(config, state, input) {
         body: JSON.stringify({ ...input, ...target }),
     });
 }
+export async function rollbackOtaRelease(config, state, input) {
+    const target = await ensureRemoteTarget(config, state);
+    return request({
+        apiUrl: config.cli?.apiUrl,
+        token: config.cli?.token ?? process.env.LYNXSHIP_TOKEN,
+    }, "/v1/ota/rollback", {
+        method: "POST",
+        body: JSON.stringify({ ...input, ...target }),
+    });
+}
 export async function fetchOtaPublicKey(config) {
     return request({
         apiUrl: config.cli?.apiUrl,

package/dist/secure-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secure-store.d.ts","sourceRoot":"","sources":["../src/secure-store.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,iBAAiB;IAChC,EAAE,CAAC,EAAE;QACH,WAAW,EAAE,MAAM,CAAC;QACpB,eAAe,EAAE,MAAM,CAAC;KACzB,CAAC;IACF,OAAO,CAAC,EAAE;QACR,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,EAAE,MAAM,CAAC;QACjB,gBAAgB,EAAE,MAAM,CAAC;QACzB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,UAAU,CAAC,EAAE;QACX,kBAAkB,EAAE,MAAM,CAAC;QAC3B,aAAa,EAAE,MAAM,CAAC;QACtB,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,EAAE,OAAO,GAAG,WAAW,GAAG,YAAY,GAAG,QAAQ,CAAC;KAChE,CAAC;IACF,eAAe,CAAC,EAAE;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,MAAM,CAAC;QACnB,gBAAgB,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;CACH;AAED,wBAAgB,4BAA4B,IAAI,MAAM,CAIrD;AA6RD,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,iBAAiB,CAAC,CAM5B;AAED,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,iBAAiB,EAC9B,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GACjC,OAAO,CAAC,IAAI,CAAC,CA6Bf"}
+{"version":3,"file":"secure-store.d.ts","sourceRoot":"","sources":["../src/secure-store.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,iBAAiB;IAChC,EAAE,CAAC,EAAE;QACH,WAAW,EAAE,MAAM,CAAC;QACpB,eAAe,EAAE,MAAM,CAAC;KACzB,CAAC;IACF,OAAO,CAAC,EAAE;QACR,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,EAAE,MAAM,CAAC;QACjB,gBAAgB,EAAE,MAAM,CAAC;QACzB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,UAAU,CAAC,EAAE;QACX,kBAAkB,EAAE,MAAM,CAAC;QAC3B,aAAa,EAAE,MAAM,CAAC;QACtB,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,EAAE,OAAO,GAAG,WAAW,GAAG,YAAY,GAAG,QAAQ,CAAC;KAChE,CAAC;IACF,eAAe,CAAC,EAAE;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,MAAM,CAAC;QACnB,gBAAgB,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;CACH;AAED,wBAAgB,4BAA4B,IAAI,MAAM,CAKrD;AAmYD,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,iBAAiB,CAAC,CAM5B;AAED,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,iBAAiB,EAC9B,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GACjC,OAAO,CAAC,IAAI,CAAC,CAmCf"}

package/dist/secure-store.js

@@ -3,11 +3,14 @@ import { spawn } from "node:child_process";
 import { join, resolve } from "node:path";
 import { assert } from "@lynxship/contracts";
 import { globalLynxShipDirectory } from "./paths.js";
+import { commandExists } from "./process-runner.js";
 export function credentialStorageDescription() {
     if (process.platform === "win32")
         return "Windows DPAPI encrypted";
     if (process.platform === "darwin")
         return "macOS Keychain";
+    if (commandExists("secret-tool"))
+        return "Linux Secret Service";
     return "owner-only credential file";
 }
 const fileName = ".credentials.dpapi.json";
@@ -71,9 +74,31 @@ function runSecurity(args) {
         child.stdin.end();
     });
 }
+function runSecretTool(args, input = "") {
+    return new Promise((resolveOutput, reject) => {
+        const child = spawn("secret-tool", args, {
+            stdio: ["pipe", "pipe", "pipe"],
+        });
+        let output = "";
+        let error = "";
+        child.stdout.on("data", (chunk) => (output += chunk.toString()));
+        child.stderr.on("data", (chunk) => (error += chunk.toString()));
+        child.once("error", reject);
+        child.once("close", (code) => {
+            if (code !== 0)
+                reject(new Error(error.trim() || "Linux Secret Service operation failed"));
+            else
+                resolveOutput(output.trim());
+        });
+        child.stdin.end(input);
+    });
+}
 function keychainAccount(root, global) {
     return global ? "global" : `project:${resolve(root)}`;
 }
+function secretServiceAccount(root, global) {
+    return keychainAccount(root, global);
+}
 function credentialValues(credentials) {
     const values = {};
     if (credentials.r2) {
@@ -185,6 +210,51 @@ async function saveKeychain(root, credentials, global) {
     ]);
     await unlink(credentialFile(root, global)).catch(() => undefined);
 }
+async function readSecretService(root, global) {
+    if (process.platform !== "linux" || !commandExists("secret-tool"))
+        return undefined;
+    try {
+        const value = await runSecretTool([
+            "lookup",
+            "application",
+            keychainService,
+            "account",
+            secretServiceAccount(root, global),
+        ]);
+        if (!value)
+            return undefined;
+        const stored = JSON.parse(value);
+        assert(stored.version === 1 && stored.platform === "linux-secret-service", "CLI_CREDENTIALS_INVALID", "Unsupported LynxShip Linux Secret Service record");
+        return credentialsFromValues(stored.values);
+    }
+    catch {
+        return undefined;
+    }
+}
+async function saveSecretService(root, credentials, global) {
+    if (process.platform !== "linux" || !commandExists("secret-tool"))
+        return false;
+    const record = {
+        version: 1,
+        platform: "linux-secret-service",
+        values: credentialValues(credentials),
+    };
+    try {
+        await runSecretTool([
+            "store",
+            "--label",
+            "LynxShip CLI credentials",
+            "application",
+            keychainService,
+            "account",
+            secretServiceAccount(root, global),
+        ], JSON.stringify(record));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 function mergeCredentials(global, project) {
     return {
         r2: project.r2 ?? global.r2,
@@ -199,6 +269,7 @@ async function readCredentialFile(file) {
         assert(encrypted.version === 1 &&
             (encrypted.platform === "windows-dpapi" ||
                 encrypted.platform === "macos-keychain" ||
+                encrypted.platform === "linux-secret-service" ||
                 encrypted.platform === "file-mode-600"), "CLI_CREDENTIALS_INVALID", "Unsupported LynxShip credential store");
         const values = Object.fromEntries(await Promise.all(Object.entries(encrypted.values).map(async ([key, value]) => [
             key,
@@ -220,11 +291,24 @@ async function readCredentialStore(root, global) {
         if (keychain)
             return keychain;
     }
+    if (process.platform === "linux") {
+        const secretService = await readSecretService(root, global);
+        if (secretService)
+            return secretService;
+    }
     const legacy = await readCredentialFile(credentialFile(root, global));
     if (process.platform === "darwin" &&
         (legacy.r2 !== undefined || legacy.android !== undefined)) {
         await saveKeychain(root, legacy, global).catch(() => undefined);
     }
+    if (process.platform === "linux" &&
+        (legacy.r2 !== undefined ||
+            legacy.android !== undefined ||
+            legacy.googlePlay !== undefined ||
+            legacy.appStoreConnect !== undefined) &&
+        (await saveSecretService(root, legacy, global))) {
+        await unlink(credentialFile(root, global)).catch(() => undefined);
+    }
     return legacy;
 }
 export async function loadCredentials(root) {
@@ -240,6 +324,12 @@ export async function saveCredentials(root, credentials, options = {}) {
         await saveKeychain(root, credentials, global);
         return;
     }
+    if (process.platform === "linux") {
+        if (await saveSecretService(root, credentials, global)) {
+            await unlink(credentialFile(root, global)).catch(() => undefined);
+            return;
+        }
+    }
     const values = credentialValues(credentials);
     const encrypted = {
         version: 1,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lynxship/cli",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "Build, sign, store, submit and update LynxJS applications from the terminal.",
   "type": "module",
   "license": "MIT",
@@ -67,11 +67,11 @@
     "cli-progress": "3.12.0",
     "ora": "8.2.0",
     "qrcode-terminal": "0.12.0",
-    "@lynxship/contracts": "0.1.0",
+    "@lynxship/db": "0.1.0",
     "@lynxship/build-orchestrator": "0.1.0",
     "@lynxship/signing": "0.1.0",
-    "@lynxship/submit": "0.1.0",
-    "@lynxship/db": "0.1.0"
+    "@lynxship/contracts": "0.1.0",
+    "@lynxship/submit": "0.1.0"
   },
   "devDependencies": {
     "@types/cli-progress": "3.11.6",