@renbostudios/edge-ota 0.2.7 → 0.2.8

package/README.md

@@ -1,125 +1,26 @@
-# `@edge-ota/cli`
+# @renbostudios/edge-ota CLI
 
-> Zero-SDK, self-hostable OTA update CLI for Expo apps.  
-> Push cryptographically signed JS bundles to any EdgeOTA server — no Expo account required.
+Zero-SDK, self-hostable OTA updates for Expo.
 
-## Install
-
-```bash
-npm install -g @edge-ota/cli
-# or use without installing:
-npx @edge-ota/cli <command>
-```
-
-## Quick Start
-
-Run these commands **inside your Expo project directory**:
-
-```bash
-# 1. Generate ECDSA P-256 keys and write config
-edge-ota init
-
-# 2. Push your first update
-edge-ota push --channel production --runtime 1.0.0
-
-# 3. Check what's deployed
-edge-ota status
-```
+See the [main README](../../README.md) for full documentation.
 
 ## Commands
 
-### `edge-ota init [options]`
-
-Generates an ECDSA P-256 key pair, writes `edge-ota.config.json` and `.edge-ota.private.key`, auto-adds the private key to `.gitignore`, and automatically updates your Expo `app.json` configuration file with the new updates URL.
-
-If `--server` is not specified, you will be prompted interactively to enter the URL of your hosted or local EdgeOTA server and your optional Project ID.
-
-| Option | Default | Description |
-|--------|---------|-------------|
-| `-s, --server <url>` | — | Your EdgeOTA server URL (prompts if omitted) |
-| `--project <id>` | — | Your EdgeOTA Project ID (prompts if omitted, optional) |
-
-**Output:**
-- `edge-ota.config.json` — server URL, public key, and optional project ID (safe to commit)
-- `.edge-ota.private.key` — private signing key (**never commit this**)
-- **Auto-configured:** `app.json` is modified to point `expo.updates.url` to your server's updates endpoint. If a Project ID is configured, it points to `/api/projects/:projectId/updates`; otherwise, it falls back to the global `/api/updates` endpoint.
-
----
-
-### `edge-ota push [options]`
-
-Runs `expo export`, hashes every asset with SHA-256, signs the payload with your private key, then uploads the bundle to your server.
-
-| Option | Default | Description |
-|--------|---------|-------------|
-| `-c, --channel <name>` | `production` | Deployment channel |
-| `-r, --runtime <version>` | `1.0.0` | Native runtime version (must match `runtimeVersion` in app.json) |
-| `-p, --platform <platform>` | `all` | `ios`, `android`, or `all` |
-| `--project <id>` | — | Project ID (overrides value in `edge-ota.config.json`) |
-| `--skip-export` | — | Skip `expo export` — use existing `./dist` |
-| `--dry-run` | — | Sign the payload but don't upload |
-
-**Example — CI/CD:**
-```bash
-edge-ota push \
-  --channel production \
-  --runtime 1.2.0 \
-  --platform all
 ```
-
----
-
-### `edge-ota status [options]`
-
-Lists recent releases from the server as a table.
-
-| Option | Default | Description |
-|--------|---------|-------------|
-| `-t, --token <token>` | `$EDGE_OTA_TOKEN` | Auth token from the dashboard |
-| `-n, --limit <n>` | `10` | Number of releases to show |
-| `--project <id>` | — | Project ID to query (overrides config) |
-
-```bash
-export EDGE_OTA_TOKEN="your-dashboard-token"
-edge-ota status
+edge-ota login          # Log in globally
+edge-ota logout         # Log out
+edge-ota init           # Set up a new project
+edge-ota push           # Publish an OTA update
+edge-ota status         # View recent deployments
+edge-ota keygen         # Generate a new key pair
 ```
 
----
-
-### `edge-ota keygen`
-
-Prints a fresh ECDSA P-256 key pair to stdout without writing any files. Useful for generating secrets to store in CI/CD environment variables.
+## Install
 
 ```bash
-edge-ota keygen
+npm install -g @renbostudios/edge-ota
 ```
 
 ---
 
-## How it works
-
-1. **Build** — `expo export` produces a JS bundle + assets in `./dist/`
-2. **Hash** — every file gets a SHA-256 content hash (enables deduplication on the server)
-3. **Sign** — the upload payload (`{ channel, runtimeVersion, bundleHash, ... }`) is signed with your ECDSA P-256 private key
-4. **Upload** — `POST /api/updates` with `multipart/form-data` containing the bundle zip, payload JSON, and signature
-5. **Serve** — when your app checks for updates, the server verifies the stored signature and returns a signed manifest
-6. **Verify** — the Expo SDK verifies the manifest signature and bundle hash before swapping the active bundle
-
-## Expo App Setup
-
-Add to your `app.json`:
-
-```json
-{
-  "expo": {
-    "updates": {
-      "url": "https://your-edge-ota-server.com/api/updates",
-      "runtimeVersion": { "policy": "nativeVersion" }
-    }
-  }
-}
-```
-
-## License
-
-MIT
+by **[Renbo Studios](https://renbostudios.com)** — Mobile App Development Studio

package/dist/core/manifest.js

@@ -1,16 +1,18 @@
 /**
  * EdgeOTA Core - Expo Updates Protocol v1 Manifest Engine
  *
- * Implements the exact wire format consumed by expo-updates SDK:
+ * Implements the exact wire format consumed by expo-updates SDK,
+ * matching the official expo/custom-expo-updates-server reference:
  * - EAS Update-compatible manifest structure
- * - Multipart/mixed response body with proper boundary
+ * - Multipart/mixed response body with FormData-compatible boundary
  * - expo-signature header for ECDSA bundle verification
- * - Structured extension (extra) metadata passthrough
+ * - fileExtension on launchAsset and assets
+ * - extra.expoClient config passthrough
  */
 /**
- * Build the Expo Updates v1 manifest object.
- * The client SDK deserialises this from the `manifest` part of the
- * multipart response (or directly from the response body in non-multipart mode).
+ * Convert a hex SHA-256 hash to base64url encoding.
+ * expo-updates verifies downloaded assets by computing SHA-256, base64url-encoding it,
+ * and comparing against the manifest `hash` field.
  */
 function hexToBase64Url(hex) {
     if (hex.length !== 64 || !/^[0-9a-fA-F]+$/.test(hex)) {
@@ -30,6 +32,10 @@ function hexToBase64Url(hex) {
         .replace(/\//g, '_')
         .replace(/=+$/, '');
 }
+/**
+ * Build the Expo Updates v1 manifest object.
+ * Matches the format produced by expo/custom-expo-updates-server.
+ */
 export function generateExpoManifest(params) {
     return {
         id: params.updateId,
@@ -37,7 +43,8 @@ export function generateExpoManifest(params) {
         runtimeVersion: params.runtimeVersion,
         launchAsset: {
             hash: hexToBase64Url(params.bundleHash),
-            key: "bundle",
+            key: params.bundleKey || params.bundleHash.slice(0, 32),
+            fileExtension: ".bundle",
             contentType: "application/javascript",
             url: params.bundleUrl
         },
@@ -56,45 +63,46 @@ export function generateExpoManifest(params) {
  * expo-sfv-version: "0"       — Structured Fields version
  * cache-control               — Updates must never be stale; client always revalidates
  * expo-signature              — ECDSA P-256 + SHA-256 signature over the manifest JSON
- *                               (base64url-encoded DER). Omitted when no key is configured.
  */
 export function createExpoHeaders(signature) {
     const headers = {
         "expo-protocol-version": "1",
         "expo-sfv-version": "0",
-        "cache-control": "private, max-age=0, must-revalidate",
-        "content-type": "application/json"
+        "cache-control": "private, max-age=0",
     };
     if (signature) {
-        // EAS format: sig="<base64>", keyid="root", alg="sig-rs256"
-        // For ECDSA P-256 we use the simpler bare signature header
         headers["expo-signature"] = `sig="${signature}", keyid="root", alg="ecdsa-p256-sha256"`;
     }
     return headers;
 }
 /**
- * Build the multipart/mixed response body required when the client sends
- * `Accept: multipart/mixed` (expo-updates >=0.18).
- *
- * Layout:
- *   --<boundary>
- *   Content-Type: application/json
- *   expo-signature: sig="...", keyid="root", alg="ecdsa-p256-sha256"
+ * Build the multipart/mixed response body required by expo-updates protocol v1.
+ * Uses FormData-compatible boundary formatting matching the official Expo server.
  *
- *   <manifest JSON>
- *   --<boundary>--
+ * The expo-updates native client parses this multipart body to extract the manifest
+ * from the part named "manifest".
  */
 export function buildMultipartManifestBody(manifest, signature) {
-    const boundary = "expo-update-boundary-" + Math.random().toString(36).slice(2, 10);
+    const boundary = "ota" + Date.now().toString(36) + Math.random().toString(36).slice(2, 8);
     const manifestJson = JSON.stringify(manifest);
-    let partHeaders = "Content-Disposition: inline; name=\"manifest\"\r\n";
-    partHeaders += "Content-Type: application/json\r\n";
+    // Build the manifest part headers exactly as FormData would
+    let manifestPart = `--${boundary}\r\n`;
+    manifestPart += `Content-Disposition: form-data; name="manifest"\r\n`;
+    manifestPart += `Content-Type: application/json; charset=utf-8\r\n`;
     if (signature) {
-        partHeaders += `expo-signature: sig="${signature}", keyid="root", alg="ecdsa-p256-sha256"\r\n`;
+        manifestPart += `expo-signature: sig="${signature}", keyid="root", alg="ecdsa-p256-sha256"\r\n`;
     }
-    const body = `--${boundary}\r\n` +
-        `${partHeaders}\r\n` +
-        `${manifestJson}\r\n` +
-        `--${boundary}--\r\n`;
-    return { body, boundary };
+    manifestPart += `\r\n`;
+    manifestPart += manifestJson;
+    manifestPart += `\r\n`;
+    // Build the extensions part (included by official Expo server)
+    const extensions = { assetRequestHeaders: {} };
+    let extensionsPart = `--${boundary}\r\n`;
+    extensionsPart += `Content-Disposition: form-data; name="extensions"\r\n`;
+    extensionsPart += `Content-Type: application/json\r\n`;
+    extensionsPart += `\r\n`;
+    extensionsPart += JSON.stringify(extensions);
+    extensionsPart += `\r\n`;
+    const body = manifestPart + extensionsPart + `--${boundary}--\r\n`;
+    return { body, boundary, contentType: `multipart/mixed; boundary=${boundary}` };
 }

package/dist/index.js

@@ -1,151 +1,289 @@
 #!/usr/bin/env node
 /**
- * edge-ota CLI
+ * edge-ota CLI  — Zero-SDK, self-hostable OTA updates for Expo
+ * by Renbo Studios  —  Mobile App Development Studio
+ * https://renbostudios.com
  *
- * Phase 1: Build / Upload
- * ─────────────────────────────────────────────────────────────────────────
- * 1. `edge-ota init`   – Generate ECDSA P-256 key pair, write config + private key.
- * 2. `edge-ota push`   – Run `expo export`, collect JS bundle + assets, compute
- *                        per-asset SHA-256 hashes, sign the upload payload with the
- *                        private key, POST a multipart/form-data to /api/updates.
- * 3. `edge-ota status` – List recent releases and their channel assignments.
- *
- * The server verifies the ECDSA signature before accepting the bundle,
- * then stores assets on disk (server-node) or R2 (worker-oss) and
- * records the update in the database.
- *
- * From that point the Expo Updates SDK handshake is:
- *   GET /api/updates
- *   expo-platform: ios | android
- *   expo-runtime-version: <semver>
- *   expo-channel-name: production | staging | …
- *
- * The server responds with an Expo Updates v1 manifest JSON (signed if a
- * public key is configured) and the SDK fetches launchAsset.url to swap
- * the active bundle.
+ * Commands:
+ *   edge-ota login    — Authenticate and save credentials globally
+ *   edge-ota logout   — Remove stored credentials
+ *   edge-ota init     — Register project, generate signing keys, configure app.json
+ *   edge-ota push     — Export bundle and publish an OTA update
+ *   edge-ota status   — List recent deployments for this project
+ *   edge-ota keygen   — Generate a new ECDSA key pair (prints to stdout)
  */
 import { Command } from "commander";
-import { execSync } from "child_process";
+import { spawn } from "child_process";
 import fs from "fs";
+import os from "os";
 import path from "path";
-import { createWriteStream } from "fs";
-import archiver from "archiver";
 import readline from "readline";
+import { fileURLToPath } from "url";
 import { generateECDSAKeyPair, signPayload, sha256Hex } from "./core/index.js";
-// ─── Auto-load .env from the project root ────────────────────────────────────
-// Lets users store EDGE_OTA_TOKEN in a .env file without shell exports.
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+// ─── Global Config Paths ─────────────────────────────────────────────────────
+const GLOBAL_CONFIG_DIR = path.join(os.homedir(), ".config", "edge-ota");
+const GLOBAL_CONFIG_FILE = path.join(GLOBAL_CONFIG_DIR, "config.json");
+const GLOBAL_KEYS_DIR = path.join(GLOBAL_CONFIG_DIR, "keys");
+function loadGlobalConfig() {
+    try {
+        if (fs.existsSync(GLOBAL_CONFIG_FILE)) {
+            return JSON.parse(fs.readFileSync(GLOBAL_CONFIG_FILE, "utf-8"));
+        }
+    }
+    catch { /* ignore */ }
+    return null;
+}
+function saveGlobalConfig(config) {
+    fs.mkdirSync(GLOBAL_CONFIG_DIR, { recursive: true });
+    fs.writeFileSync(GLOBAL_CONFIG_FILE, JSON.stringify(config, null, 2), { mode: 0o600 });
+}
+function clearGlobalConfig() {
+    try {
+        fs.rmSync(GLOBAL_CONFIG_FILE);
+    }
+    catch { /* ignore */ }
+}
+function loadPrivateKey(projectId) {
+    // 1. Global key store (new location)
+    const globalKeyPath = path.join(GLOBAL_KEYS_DIR, `${projectId}.key`);
+    if (fs.existsSync(globalKeyPath)) {
+        return fs.readFileSync(globalKeyPath, "utf-8").trim();
+    }
+    // 2. Legacy local file (backward compat with deprecation notice)
+    const localKeyPath = path.resolve(process.cwd(), ".edge-ota.private.key");
+    if (fs.existsSync(localKeyPath)) {
+        spin.stop();
+        console.log(`  ${c.yellow}⚠${c.reset}  Using legacy ${c.dim}.edge-ota.private.key${c.reset} in project directory.`);
+        console.log(`     Move it to ${c.dim}${globalKeyPath}${c.reset} and delete the local copy.`);
+        return fs.readFileSync(localKeyPath, "utf-8").trim();
+    }
+    return null;
+}
+function savePrivateKey(projectId, key) {
+    fs.mkdirSync(GLOBAL_KEYS_DIR, { recursive: true });
+    const keyPath = path.join(GLOBAL_KEYS_DIR, `${projectId}.key`);
+    fs.writeFileSync(keyPath, key, { mode: 0o600 });
+}
+// ─── Auto-load .env ───────────────────────────────────────────────────────────
 try {
     const envPath = path.resolve(process.cwd(), ".env");
     if (fs.existsSync(envPath)) {
-        const lines = fs.readFileSync(envPath, "utf8").split("\n");
-        for (const line of lines) {
-            const trimmed = line.trim();
-            if (!trimmed || trimmed.startsWith("#"))
+        for (const line of fs.readFileSync(envPath, "utf8").split("\n")) {
+            const t = line.trim();
+            if (!t || t.startsWith("#"))
                 continue;
-            const eqIdx = trimmed.indexOf("=");
-            if (eqIdx === -1)
+            const eq = t.indexOf("=");
+            if (eq === -1)
                 continue;
-            const key = trimmed.slice(0, eqIdx).trim();
-            const val = trimmed.slice(eqIdx + 1).trim().replace(/^["']|["']$/g, "");
-            if (!(key in process.env))
-                process.env[key] = val;
+            const k = t.slice(0, eq).trim();
+            const v = t.slice(eq + 1).trim().replace(/^["']|["']$/g, "");
+            if (!(k in process.env))
+                process.env[k] = v;
         }
     }
 }
-catch { /* silently skip if .env is unreadable */ }
-// ─── ANSI Styling Helpers ───────────────────────────────────────────────────
-const colors = {
+catch { /* silently skip */ }
+// ─── ANSI Colors ─────────────────────────────────────────────────────────────
+const c = {
     reset: "\x1b[0m",
     bold: "\x1b[1m",
     dim: "\x1b[2m",
     underline: "\x1b[4m",
-    // Foreground Colors
-    black: "\x1b[30m",
     red: "\x1b[31m",
     green: "\x1b[32m",
     yellow: "\x1b[33m",
     blue: "\x1b[34m",
-    magenta: "\x1b[35m",
     cyan: "\x1b[36m",
     white: "\x1b[37m",
     gray: "\x1b[90m",
 };
-function printBanner() {
-    const line = `${colors.dim}${"-".repeat(48)}${colors.reset}`;
-    console.log(`\n${line}`);
-    console.log(`  ${colors.bold}${colors.white}edge-ota${colors.reset}  ${colors.dim}v0.2.4 · Zero-SDK OTA for Expo${colors.reset}`);
-    console.log(`  ${colors.dim}by Renbo Studios · renbostudios.com${colors.reset}`);
-    console.log(`${line}\n`);
+// ─── Spinner ─────────────────────────────────────────────────────────────────
+const FRAMES = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"];
+const spin = (() => {
+    let timer = null;
+    let frame = 0;
+    let label = "";
+    return {
+        start(text) {
+            label = text;
+            frame = 0;
+            if (!process.stdout.isTTY) {
+                process.stdout.write(`  ${text}...\n`);
+                return;
+            }
+            timer = setInterval(() => {
+                const f = `${c.cyan}${FRAMES[frame % FRAMES.length]}${c.reset}`;
+                process.stdout.write(`\r  ${f}  ${c.dim}${label}${c.reset}   `);
+                frame++;
+            }, 80);
+        },
+        update(text) {
+            label = text;
+        },
+        stop(successMsg) {
+            if (timer) {
+                clearInterval(timer);
+                timer = null;
+            }
+            if (process.stdout.isTTY) {
+                process.stdout.write("\r\x1b[K"); // clear line
+            }
+            if (successMsg) {
+                console.log(`  ${c.green}✓${c.reset}  ${successMsg}`);
+            }
+        },
+        fail(errMsg) {
+            if (timer) {
+                clearInterval(timer);
+                timer = null;
+            }
+            if (process.stdout.isTTY)
+                process.stdout.write("\r\x1b[K");
+            console.error(`  ${c.red}✗${c.reset}  ${errMsg}`);
+        }
+    };
+})();
+// ─── Package version ─────────────────────────────────────────────────────────
+let packageVersion = "0.2.8";
+try {
+    const pkgPath = path.join(__dirname, "..", "package.json");
+    if (fs.existsSync(pkgPath)) {
+        packageVersion = JSON.parse(fs.readFileSync(pkgPath, "utf8")).version;
+    }
 }
-function askQuestion(query) {
-    const rl = readline.createInterface({
-        input: process.stdin,
-        output: process.stdout
-    });
-    return new Promise((resolve) => {
-        rl.question(query, (answer) => {
-            rl.close();
-            resolve(answer.trim());
-        });
-    });
+catch { /* fallback */ }
+// ─── Banner ───────────────────────────────────────────────────────────────────
+function printBanner() {
+    const sep = `${c.dim}${"─".repeat(52)}${c.reset}`;
+    console.log(`\n${sep}`);
+    console.log(`  ${c.bold}${c.white}edge-ota${c.reset}  ${c.dim}v${packageVersion} · Zero-SDK OTA for Expo${c.reset}`);
+    console.log(`  ${c.dim}by ${c.reset}${c.bold}Renbo Studios${c.reset}${c.dim} — Mobile App Development Studio${c.reset}`);
+    console.log(`  ${c.dim}renbostudios.com${c.reset}`);
+    console.log(`${sep}\n`);
 }
-function updateAppJson(cwd, serverUrl, projectId) {
+function readAppJson(cwd) {
     const appJsonPath = path.resolve(cwd, "app.json");
     if (!fs.existsSync(appJsonPath)) {
-        console.log("⚠️   app.json not found in this directory. Skipping auto-update.");
-        return;
+        console.error(`\n  ${c.red}✗${c.reset}  ${c.bold}app.json not found${c.reset} in ${cwd}`);
+        console.error(`     Run this command from your Expo project root.\n`);
+        process.exit(1);
     }
+    let data;
     try {
-        const raw = fs.readFileSync(appJsonPath, "utf-8");
-        const data = JSON.parse(raw);
+        data = JSON.parse(fs.readFileSync(appJsonPath, "utf-8"));
+    }
+    catch {
+        console.error(`  ${c.red}✗${c.reset}  Failed to parse app.json`);
+        process.exit(1);
+    }
+    const expo = data?.expo ?? {};
+    // ── Runtime version ──
+    const runtimeVersion = expo.runtimeVersion;
+    if (!runtimeVersion) {
+        console.error(`  ${c.red}✗${c.reset}  ${c.bold}expo.runtimeVersion${c.reset} is not set in app.json`);
+        console.error(`     Add: ${c.dim}"runtimeVersion": "1.0.0"${c.reset} under the expo key.\n`);
+        process.exit(1);
+    }
+    // ── Updates URL ──
+    const updatesUrl = expo?.updates?.url ?? "";
+    if (!updatesUrl) {
+        console.error(`  ${c.red}✗${c.reset}  ${c.bold}expo.updates.url${c.reset} is not configured in app.json`);
+        console.error(`     Run ${c.cyan}edge-ota init${c.reset} to set this up.\n`);
+        process.exit(1);
+    }
+    // Parse serverUrl and projectId from the updates URL
+    // Expected format: https://<host>/api/projects/<uuid>/updates
+    //              or: https://<host>/api/updates
+    let serverUrl;
+    let projectId = null;
+    try {
+        const u = new URL(updatesUrl);
+        const projectMatch = u.pathname.match(/\/api\/projects\/([^/]+)\/updates/);
+        if (projectMatch) {
+            projectId = projectMatch[1];
+            serverUrl = `${u.protocol}//${u.host}`;
+        }
+        else {
+            serverUrl = `${u.protocol}//${u.host}`;
+        }
+    }
+    catch {
+        console.error(`  ${c.red}✗${c.reset}  Could not parse ${c.dim}expo.updates.url${c.reset} in app.json`);
+        process.exit(1);
+    }
+    return { serverUrl, projectId, runtimeVersion, publicKey: expo.updates?.publicKey };
+}
+function updateAppJson(cwd, serverUrl, projectId, publicKey) {
+    const appJsonPath = path.resolve(cwd, "app.json");
+    if (!fs.existsSync(appJsonPath))
+        return;
+    try {
+        const data = JSON.parse(fs.readFileSync(appJsonPath, "utf-8"));
         if (!data.expo)
             data.expo = {};
         if (!data.expo.updates)
             data.expo.updates = {};
-        const updateUrl = projectId
-            ? `${serverUrl.replace(/\/$/, "")}/api/projects/${projectId}/updates`
-            : `${serverUrl.replace(/\/$/, "")}/api/updates`;
-        data.expo.updates.url = updateUrl;
-        fs.writeFileSync(appJsonPath, JSON.stringify(data, null, 2), "utf-8");
-        console.log(`  ${colors.dim}app.json${colors.reset}  updates.url set`);
-    }
-    catch (error) {
-        console.error(`  ${colors.red}error${colors.reset}  Failed to update app.json: ${error.message}`);
+        const cleanUrl = serverUrl.replace(/\/$/, "");
+        data.expo.updates.url = projectId
+            ? `${cleanUrl}/api/projects/${projectId}/updates`
+            : `${cleanUrl}/api/updates`;
+        data.expo.updates.checkAutomatically = data.expo.updates.checkAutomatically ?? "ON_LOAD";
+        data.expo.updates.fallbackToCacheTimeout = data.expo.updates.fallbackToCacheTimeout ?? 30000;
+        data.expo.updates.requestHeaders = data.expo.updates.requestHeaders ?? { "expo-channel-name": "production" };
+        if (publicKey) {
+            data.expo.updates.codeSigningCertificate = undefined; // clear legacy
+            data.expo.extra = data.expo.extra ?? {};
+            data.expo.extra.edgeOtaPublicKey = publicKey;
+        }
+        fs.writeFileSync(appJsonPath, JSON.stringify(data, null, 2) + "\n", "utf-8");
+        console.log(`  ${c.dim}app.json${c.reset}    updated ${c.dim}expo.updates.url${c.reset}`);
     }
-}
-function loadConfig(cwd) {
-    const configPath = path.resolve(cwd, "edge-ota.config.json");
-    if (!fs.existsSync(configPath)) {
-        console.error("❌  edge-ota.config.json not found. Run `edge-ota init` first.");
-        process.exit(1);
+    catch (e) {
+        console.error(`  ${c.yellow}⚠${c.reset}   Could not update app.json: ${e.message}`);
     }
-    return JSON.parse(fs.readFileSync(configPath, "utf-8"));
 }
-function loadPrivateKey(cwd) {
-    const keyPath = path.resolve(cwd, ".edge-ota.private.key");
-    if (!fs.existsSync(keyPath)) {
-        console.error("❌  .edge-ota.private.key not found. Run `edge-ota init` first.");
-        process.exit(1);
-    }
-    return fs.readFileSync(keyPath, "utf-8");
+// ─── Readline helper ─────────────────────────────────────────────────────────
+function ask(query) {
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    return new Promise(resolve => rl.question(query, a => { rl.close(); resolve(a.trim()); }));
 }
-// ─── Archive helper ──────────────────────────────────────────────────────────
-function zipDirectory(sourceDir, outPath) {
-    return new Promise((resolve, reject) => {
-        const archive = archiver("zip", { zlib: { level: 9 } });
-        const stream = createWriteStream(outPath);
-        archive.directory(sourceDir, false);
-        archive.on("error", reject);
-        stream.on("close", resolve);
-        archive.pipe(stream);
-        archive.finalize();
+function askSecret(query) {
+    return new Promise(resolve => {
+        if (process.stdin.isTTY) {
+            process.stdout.write(query);
+            let input = "";
+            process.stdin.setRawMode(true);
+            process.stdin.resume();
+            process.stdin.setEncoding("utf8");
+            process.stdin.on("data", function onData(ch) {
+                if (ch === "\r" || ch === "\n") {
+                    process.stdin.setRawMode(false);
+                    process.stdin.removeListener("data", onData);
+                    process.stdout.write("\n");
+                    resolve(input);
+                }
+                else if (ch === "\u0003") {
+                    process.exit(0);
+                }
+                else if (ch === "\u007f") {
+                    if (input.length > 0) {
+                        input = input.slice(0, -1);
+                        process.stdout.write("\b \b");
+                    }
+                }
+                else {
+                    input += ch;
+                    process.stdout.write("•");
+                }
+            });
+        }
+        else {
+            ask(query).then(resolve);
+        }
     });
 }
-// ─── SHA-256 of a file ───────────────────────────────────────────────────────
-async function hashFile(filePath) {
-    const buffer = fs.readFileSync(filePath);
-    return sha256Hex(buffer.buffer.slice(buffer.byteOffset, buffer.byteOffset + buffer.byteLength));
-}
 const CONTENT_TYPES = {
     ".js": "application/javascript",
     ".hbc": "application/javascript",
@@ -160,290 +298,432 @@ const CONTENT_TYPES = {
     ".woff": "font/woff",
     ".woff2": "font/woff2",
     ".mp4": "video/mp4",
-    ".webm": "video/webm"
+    ".webm": "video/webm",
 };
+async function hashFile(filePath) {
+    const buffer = fs.readFileSync(filePath);
+    return sha256Hex(buffer.buffer.slice(buffer.byteOffset, buffer.byteOffset + buffer.byteLength));
+}
 async function collectAssets(distDir) {
     const entries = [];
     function walk(dir) {
         for (const name of fs.readdirSync(dir)) {
             const full = path.join(dir, name);
-            const stat = fs.statSync(full);
-            if (stat.isDirectory()) {
+            if (fs.statSync(full).isDirectory()) {
                 walk(full);
             }
             else {
                 const ext = path.extname(name).toLowerCase();
-                const ct = CONTENT_TYPES[ext] || "application/octet-stream";
-                const key = path.relative(distDir, full).replace(/\\/g, "/");
-                entries.push({ localPath: full, key, contentType: ct, hash: "" });
+                entries.push({
+                    localPath: full,
+                    key: path.relative(distDir, full).replace(/\\/g, "/"),
+                    contentType: CONTENT_TYPES[ext] || "application/octet-stream",
+                    hash: ""
+                });
             }
         }
     }
     walk(distDir);
-    // Hash all assets in parallel
-    await Promise.all(entries.map(async (e) => {
-        e.hash = await hashFile(e.localPath);
-    }));
+    await Promise.all(entries.map(async (e) => { e.hash = await hashFile(e.localPath); }));
     return entries;
 }
-// ─── Detect the JS bundle within the Expo export output ──────────────────────
 function findBundle(distDir, platform) {
-    // Expo SDK 50+ writes: dist/_expo/static/js/<platform>/<hash>.js (or .hbc)
     const expoStaticJs = path.join(distDir, "_expo", "static", "js", platform);
     if (fs.existsSync(expoStaticJs)) {
         const files = fs.readdirSync(expoStaticJs).filter(f => f.endsWith(".js") || f.endsWith(".hbc"));
         if (files.length)
             return path.join(expoStaticJs, files[0]);
     }
-    // Fallback: older SDK flat layout
     const flatJs = path.join(distDir, `index.${platform}.js`);
     if (fs.existsSync(flatJs))
         return flatJs;
     const flatHbc = path.join(distDir, `index.${platform}.hbc`);
     if (fs.existsSync(flatHbc))
         return flatHbc;
-    // Any .js or .hbc at root
     const rootJs = fs.readdirSync(distDir).find(f => f.endsWith(".js") || f.endsWith(".hbc"));
     if (rootJs)
         return path.join(distDir, rootJs);
     return null;
 }
-// ─── CLI definition ──────────────────────────────────────────────────────────
+// ─── Auth token resolution ────────────────────────────────────────────────────
+function resolveToken() {
+    // 1. Global config
+    const cfg = loadGlobalConfig();
+    if (cfg?.token)
+        return cfg.token;
+    // 2. Env var fallback
+    return process.env.EDGE_OTA_TOKEN || null;
+}
+// ─── Program ─────────────────────────────────────────────────────────────────
 const program = new Command();
 program
     .name("edge-ota")
-    .description("Zero-SDK, self-hostable OTA update platform for Expo")
-    .version("0.2.0");
-// ──────────────────────────────────────────────────────
+    .description("Zero-SDK OTA update platform for Expo — by Renbo Studios")
+    .version(packageVersion);
+// Show help + auth status when called with no arguments
+program.action(() => {
+    printBanner();
+    const cfg = loadGlobalConfig();
+    if (cfg?.email) {
+        console.log(`  ${c.green}●${c.reset}  Logged in as ${c.bold}${cfg.email}${c.reset}  ${c.dim}(${cfg.serverUrl})${c.reset}`);
+    }
+    else {
+        console.log(`  ${c.dim}○  Not logged in — run ${c.reset}${c.cyan}edge-ota login${c.reset}`);
+    }
+    console.log();
+    console.log(`  ${c.bold}Commands${c.reset}`);
+    const cmds = [
+        ["login", "Authenticate and save credentials globally"],
+        ["logout", "Remove stored credentials"],
+        ["init", "Register project, generate signing keys, configure app.json"],
+        ["push", "Export bundle and publish an OTA update"],
+        ["status", "List recent deployments for this project"],
+        ["keygen", "Generate a new ECDSA key pair (prints to stdout)"],
+    ];
+    for (const [cmd, desc] of cmds) {
+        console.log(`  ${c.cyan}${cmd.padEnd(10)}${c.reset}  ${c.dim}${desc}${c.reset}`);
+    }
+    console.log();
+    console.log(`  Run ${c.cyan}edge-ota <command> --help${c.reset} for command-specific options.`);
+    console.log();
+});
+// ──────────────────────────────────────────────────────────────────────────────
+// edge-ota login
+// ──────────────────────────────────────────────────────────────────────────────
+program
+    .command("login")
+    .description("Authenticate with your EdgeOTA account")
+    .option("-s, --server <url>", "EdgeOTA server URL", "https://api.edge-ota.renbo.site")
+    .action(async (options) => {
+    printBanner();
+    console.log(`  ${c.bold}Sign in to EdgeOTA${c.reset}\n`);
+    const serverUrl = options.server.replace(/\/$/, "");
+    const email = await ask(`  ${c.dim}email:${c.reset}    `);
+    const password = await askSecret(`  ${c.dim}password:${c.reset} `);
+    spin.start("authenticating");
+    try {
+        const res = await fetch(`${serverUrl}/api/auth/login`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ email, password }),
+        });
+        if (!res.ok) {
+            const text = await res.text();
+            spin.fail(`Login failed: ${text || res.statusText}`);
+            process.exit(1);
+        }
+        const data = await res.json();
+        saveGlobalConfig({ token: data.token, email: data.email, serverUrl });
+        spin.stop();
+        const sep = `${c.dim}${"─".repeat(52)}${c.reset}`;
+        console.log(sep);
+        console.log(`  ${c.green}✓${c.reset}  Logged in as ${c.bold}${data.email}${c.reset}`);
+        console.log(`  ${c.dim}credentials saved to ${GLOBAL_CONFIG_FILE}${c.reset}`);
+        console.log(sep + "\n");
+    }
+    catch (e) {
+        spin.fail(`Connection failed: ${e.message}`);
+        process.exit(1);
+    }
+});
+// ──────────────────────────────────────────────────────────────────────────────
+// edge-ota logout
+// ──────────────────────────────────────────────────────────────────────────────
+program
+    .command("logout")
+    .description("Remove stored credentials")
+    .action(() => {
+    printBanner();
+    const cfg = loadGlobalConfig();
+    clearGlobalConfig();
+    if (cfg?.email) {
+        console.log(`  ${c.green}✓${c.reset}  Logged out from ${c.bold}${cfg.email}${c.reset}\n`);
+    }
+    else {
+        console.log(`  ${c.dim}Already logged out.${c.reset}\n`);
+    }
+});
+// ──────────────────────────────────────────────────────────────────────────────
 // edge-ota init
-// ──────────────────────────────────────────────────────
+// ──────────────────────────────────────────────────────────────────────────────
 program
     .command("init")
-    .description("Generate an ECDSA P-256 key pair and write edge-ota.config.json")
-    .option("-s, --server <url>", "EdgeOTA server URL")
-    .option("--project <id>", "EdgeOTA Project ID (optional)")
+    .description("Register project on EdgeOTA, generate signing keys, configure app.json")
+    .option("-s, --server <url>", "EdgeOTA server URL (overrides logged-in server)")
     .action(async (options) => {
     printBanner();
-    let serverUrl = options.server;
-    let projectId = options.project;
-    if (!serverUrl) {
-        console.log(`  ${colors.dim}no --server flag provided${colors.reset}`);
-        const answer = await askQuestion(`  server url [https://api.edge-ota.renbo.site]: `);
-        serverUrl = answer.trim() || "https://api.edge-ota.renbo.site";
-    }
-    if (!projectId && !options.server) {
-        const pAnswer = await askQuestion(`  project id (optional, press Enter to skip): `);
-        if (pAnswer.trim())
-            projectId = pAnswer.trim();
-    }
-    serverUrl = serverUrl.replace(/\/$/, "");
-    console.log(`  ${colors.dim}generating ECDSA P-256 key pair...${colors.reset}`);
-    const keys = await generateECDSAKeyPair();
-    const config = { serverUrl, publicKey: keys.publicKey };
-    if (projectId)
-        config.projectId = projectId;
+    const token = resolveToken();
+    if (!token) {
+        console.error(`  ${c.red}✗${c.reset}  Not logged in. Run ${c.cyan}edge-ota login${c.reset} first.\n`);
+        process.exit(1);
+    }
+    const globalCfg = loadGlobalConfig();
+    const serverUrl = (options.server || globalCfg?.serverUrl || "https://api.edge-ota.renbo.site").replace(/\/$/, "");
     const cwd = process.cwd();
-    fs.writeFileSync("edge-ota.config.json", JSON.stringify(config, null, 2));
-    fs.writeFileSync(".edge-ota.private.key", keys.privateKey, { mode: 0o600 });
-    const gitignorePath = ".gitignore";
-    const gitignoreEntry = ".edge-ota.private.key";
-    if (fs.existsSync(gitignorePath)) {
-        const current = fs.readFileSync(gitignorePath, "utf-8");
-        if (!current.includes(gitignoreEntry)) {
-            fs.appendFileSync(gitignorePath, `\n${gitignoreEntry}\n`);
+    // Try to read existing app.json for project name suggestion
+    let suggestedName = path.basename(cwd);
+    try {
+        const data = JSON.parse(fs.readFileSync(path.resolve(cwd, "app.json"), "utf-8"));
+        suggestedName = data?.expo?.name || suggestedName;
+    }
+    catch { /* ignore */ }
+    const projectName = (await ask(`  ${c.dim}project name [${suggestedName}]:${c.reset} `)) || suggestedName;
+    spin.start("generating ECDSA P-256 key pair");
+    const keys = await generateECDSAKeyPair();
+    spin.stop("key pair generated");
+    spin.start("registering project on server");
+    let projectId;
+    try {
+        const res = await fetch(`${serverUrl}/api/projects`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
+            body: JSON.stringify({ name: projectName, publicKey: keys.publicKey }),
+        });
+        if (!res.ok) {
+            const text = await res.text();
+            spin.fail(`Failed to register project: ${text}`);
+            process.exit(1);
         }
+        const data = await res.json();
+        projectId = data.id;
+        spin.stop("project registered");
     }
-    else {
-        fs.writeFileSync(gitignorePath, `${gitignoreEntry}\n`);
+    catch (e) {
+        spin.fail(`Connection error: ${e.message}`);
+        process.exit(1);
     }
-    updateAppJson(cwd, serverUrl, projectId);
-    const targetUrlStr = projectId
-        ? `${serverUrl}/api/projects/${projectId}/updates`
-        : `${serverUrl}/api/updates`;
-    const sep = `${colors.dim}${"-".repeat(48)}${colors.reset}`;
-    console.log(`\n  ${colors.green}✓${colors.reset}  ${colors.bold}initialised${colors.reset}`);
-    console.log(sep);
-    console.log(`  config   ${colors.cyan}edge-ota.config.json${colors.reset}`);
-    console.log(`  key      ${colors.yellow}.edge-ota.private.key${colors.reset}  ${colors.dim}(keep secret)${colors.reset}`);
-    console.log(`  endpoint ${colors.dim}${targetUrlStr}${colors.reset}`);
+    // Save private key globally
+    savePrivateKey(projectId, keys.privateKey);
+    // Update app.json
+    updateAppJson(cwd, serverUrl, projectId, keys.publicKey);
+    const sep = `${c.dim}${"─".repeat(52)}${c.reset}`;
+    console.log(`\n${sep}`);
+    console.log(`  ${c.green}✓${c.reset}  ${c.bold}Initialised${c.reset}`);
     console.log(sep);
-    console.log(`\n  ${colors.bold}public key${colors.reset}  ${colors.dim}paste into dashboard → Settings → General${colors.reset}\n`);
-    console.log(`${colors.dim}${keys.publicKey}${colors.reset}\n`);
+    console.log(`  project    ${c.dim}${projectId}${c.reset}`);
+    console.log(`  server     ${c.dim}${serverUrl}${c.reset}`);
+    console.log(`  key file   ${c.dim}${path.join(GLOBAL_KEYS_DIR, `${projectId}.key`)}${c.reset}`);
+    console.log(sep + "\n");
+    console.log(`  ${c.dim}Next step:${c.reset} run ${c.cyan}edge-ota push${c.reset} to publish your first update.\n`);
 });
-// ──────────────────────────────────────────────────────
+// ──────────────────────────────────────────────────────────────────────────────
 // edge-ota push
-// ──────────────────────────────────────────────────────
+// ──────────────────────────────────────────────────────────────────────────────
 program
     .command("push")
-    .description("Export the Expo bundle, compute per-asset hashes, sign & upload to the EdgeOTA server")
+    .description("Export your Expo bundle and publish an OTA update")
     .option("-c, --channel <channel>", "Deployment channel", "production")
-    .option("-r, --runtime <version>", "React Native runtime version (semver)", "1.0.0")
     .option("-p, --platform <platform>", "Target platform: ios | android | all", "all")
-    .option("--project <id>", "Project ID (optional, overrides config)")
-    .option("-t, --token <token>", "Deploy key token (or set EDGE_OTA_TOKEN env var)")
     .option("--skip-export", "Skip expo export (use existing ./dist directory)")
     .option("--dry-run", "Build and sign the payload but do NOT upload")
     .action(async (options) => {
     const cwd = process.cwd();
-    const config = loadConfig(cwd);
-    const privateKey = loadPrivateKey(cwd);
-    // Resolve token — CLI flag > env var
-    const token = options.token || process.env.EDGE_OTA_TOKEN;
+    const token = resolveToken();
+    printBanner();
     if (!token) {
-        console.error(`${colors.bold}${colors.red}❌  Auth token required. Use --token <token> or set EDGE_OTA_TOKEN env var.${colors.reset}`);
-        console.error(`   Generate a deploy key from your dashboard → Keys page.`);
+        console.error(`  ${c.red}✗${c.reset}  Not logged in. Run ${c.cyan}edge-ota login${c.reset} first.`);
+        console.error(`     Or set ${c.dim}EDGE_OTA_TOKEN${c.reset} environment variable.\n`);
+        process.exit(1);
+    }
+    // Auto-detect from app.json
+    const appCfg = readAppJson(cwd);
+    const { serverUrl, projectId, runtimeVersion } = appCfg;
+    // Load private signing key
+    const privateKey = projectId ? loadPrivateKey(projectId) : null;
+    if (!privateKey) {
+        console.error(`  ${c.red}✗${c.reset}  No signing key found for this project.`);
+        if (projectId) {
+            console.error(`     Expected at: ${c.dim}${path.join(GLOBAL_KEYS_DIR, `${projectId}.key`)}${c.reset}`);
+        }
+        console.error(`     Run ${c.cyan}edge-ota init${c.reset} to set up code signing.\n`);
         process.exit(1);
     }
-    // Resolve project ID — CLI flag > config file
-    const projectId = options.project || config.projectId;
-    // Build the correct upload URL
     const uploadUrl = projectId
-        ? `${config.serverUrl}/api/projects/${projectId}/updates`
-        : `${config.serverUrl}/api/updates`;
-    // ── Step 1: Build ────────────────────────────────────────────────────────
-    printBanner();
+        ? `${serverUrl}/api/projects/${projectId}/updates`
+        : `${serverUrl}/api/updates`;
     const distDir = path.resolve(cwd, "dist");
+    // ── Step 1: Expo export ──────────────────────────────────────────────────
     if (!options.skipExport) {
-        console.log(`  ${colors.dim}running expo export...${colors.reset}`);
-        try {
-            execSync("npx expo export", { stdio: "inherit", cwd });
-        }
-        catch {
-            console.error(`  ${colors.red}error${colors.reset}  expo export failed`);
-            process.exit(1);
-        }
+        spin.start("running expo export");
+        await new Promise((resolve, reject) => {
+            const proc = spawn("npx", ["expo", "export"], {
+                cwd,
+                stdio: ["inherit", "pipe", "pipe"],
+                shell: process.platform === "win32",
+            });
+            // Filter stdout: only show platform bundle lines
+            proc.stdout?.on("data", (chunk) => {
+                const text = chunk.toString();
+                for (const line of text.split("\n")) {
+                    const t = line.trim();
+                    // Show platform bundle summary lines only
+                    if (t.startsWith("_expo/static/js/") || t.match(/\.(hbc|js)\s+\(\d/)) {
+                        spin.stop();
+                        console.log(`  ${c.dim}${t}${c.reset}`);
+                        spin.start("running expo export");
+                    }
+                    // Update spinner with bundling progress
+                    if (t.match(/Bundled \d+ms/)) {
+                        spin.update("expo export — " + t.replace("Bundled", "").trim());
+                    }
+                }
+            });
+            // Suppress stderr noise but capture real errors
+            let stderrBuf = "";
+            proc.stderr?.on("data", (chunk) => { stderrBuf += chunk.toString(); });
+            proc.on("close", code => {
+                if (code === 0) {
+                    spin.stop("expo export complete");
+                    resolve();
+                }
+                else {
+                    spin.fail("expo export failed");
+                    // Print last few lines of stderr for context
+                    const lines = stderrBuf.split("\n").filter(Boolean);
+                    for (const l of lines.slice(-10))
+                        console.error(`  ${c.dim}${l}${c.reset}`);
+                    reject(new Error(`expo export exited with code ${code}`));
+                }
+            });
+        }).catch(() => process.exit(1));
     }
     else {
-        console.log(`  ${colors.dim}skipping expo export (--skip-export)${colors.reset}`);
+        console.log(`  ${c.dim}skip-export — using existing ./dist${c.reset}`);
     }
     if (!fs.existsSync(distDir)) {
-        console.error(`  ${colors.red}error${colors.reset}  ./dist not found after export`);
+        console.error(`  ${c.red}✗${c.reset}  ./dist not found after export\n`);
         process.exit(1);
     }
-    console.log(`  ${colors.dim}collecting assets...${colors.reset}`);
+    // ── Step 2: Collect assets ───────────────────────────────────────────────
+    spin.start("collecting assets");
     const assets = await collectAssets(distDir);
-    console.log(`  ${colors.dim}found ${assets.length} asset(s)${projectId ? ` · project ${projectId}` : ""}${colors.reset}`);
+    spin.stop(`found ${assets.length} asset(s)`);
     const platforms = options.platform === "all" ? ["ios", "android"] : [options.platform];
-    const sep = `${colors.dim}${"-".repeat(48)}${colors.reset}`;
+    const sep = `${c.dim}${"─".repeat(52)}${c.reset}`;
+    // ── Step 3: Per-platform upload ──────────────────────────────────────────
     for (const platform of platforms) {
         console.log(`\n${sep}`);
-        console.log(`  ${colors.bold}${platform}${colors.reset}`);
+        console.log(`  ${c.bold}${platform}${c.reset}`);
         console.log(sep);
         const bundlePath = findBundle(distDir, platform);
         if (!bundlePath) {
-            console.warn(`  ${colors.yellow}warn${colors.reset}  no bundle found for ${platform}, skipping`);
+            console.warn(`  ${c.yellow}⚠${c.reset}   no bundle found for ${platform}, skipping`);
             continue;
         }
         const bundleHash = await hashFile(bundlePath);
+        const bundleSize = (fs.statSync(bundlePath).size / 1024 / 1024).toFixed(2);
+        console.log(`  bundle     ${c.dim}${bundleHash.slice(0, 16)}…  ${bundleSize} MB${c.reset}`);
         const payloadObj = {
             channel: options.channel,
-            runtimeVersion: options.runtime,
+            runtimeVersion,
             platform,
             bundleHash,
             timestamp: Date.now(),
             assetCount: assets.length,
-            publicKey: config.publicKey
+            publicKey: appCfg.publicKey,
         };
         const payloadStr = JSON.stringify(payloadObj);
-        console.log(`  signing    ECDSA P-256`);
+        spin.start("signing");
         const signature = await signPayload(payloadStr, privateKey);
-        console.log(`  sig        ${colors.dim}${signature.slice(0, 24)}…${colors.reset}`);
+        spin.stop(`signed  ${c.dim}${signature.slice(0, 20)}…${c.reset}`);
         if (options.dryRun) {
-            console.log(`  ${colors.yellow}dry-run${colors.reset}   upload skipped`);
-            console.log("  payload   ", payloadObj);
+            console.log(`  ${c.yellow}dry-run${c.reset}   upload skipped`);
             continue;
         }
-        console.log(`  packing    bundle`);
+        spin.start("uploading");
         const bundleBuffer = fs.readFileSync(bundlePath);
         const form = new FormData();
         form.append("bundle", new Blob([bundleBuffer], { type: "application/javascript" }), `bundle-${platform}.hbc`);
         form.append("payload", payloadStr);
         form.append("signature", signature);
         form.append("platform", platform);
-        console.log(`  uploading  ${colors.dim}${uploadUrl}${colors.reset}`);
         const response = await fetch(uploadUrl, {
             method: "POST",
             headers: {
-                "Authorization": `Bearer ${token}`,
+                Authorization: `Bearer ${token}`,
                 ...(projectId ? { "X-Project-Id": projectId } : {})
             },
-            body: form
+            body: form,
+        }).catch(e => {
+            spin.fail(`Upload failed: ${e.message}`);
+            process.exit(1);
         });
-        if (response.ok) {
-            const body = await response.json().catch(() => ({}));
-            const updateId = body.updateId || "unknown";
-            console.log(`  ${colors.green}✓${colors.reset}  deployed`);
-            console.log(`  id         ${colors.dim}${updateId}${colors.reset}`);
-            console.log(`  channel    ${options.channel}`);
-            console.log(`  runtime    ${options.runtime}`);
-            console.log(`  bundle     ${colors.dim}${bundleHash.slice(0, 16)}…${colors.reset}`);
-        }
-        else {
+        if (!response.ok) {
             const text = await response.text();
-            console.error(`  ${colors.red}error${colors.reset}  upload failed (HTTP ${response.status}): ${text}`);
+            spin.fail(`Upload failed (HTTP ${response.status}): ${text}`);
             process.exit(1);
         }
+        const body = await response.json().catch(() => ({}));
+        spin.stop("uploaded");
+        console.log(`  ${c.green}✓${c.reset}  deployed`);
+        console.log(`  id         ${c.dim}${body.updateId || "—"}${c.reset}`);
+        console.log(`  channel    ${options.channel}`);
+        console.log(`  runtime    ${runtimeVersion}`);
     }
-    console.log(`\n${colors.dim}${"-".repeat(48)}${colors.reset}`);
-    console.log(`  ${colors.green}✓${colors.reset}  ${colors.bold}done${colors.reset}  update will be applied on next OTA sync`);
-    console.log(`${colors.dim}${"-".repeat(48)}${colors.reset}\n`);
+    console.log(`\n${sep}`);
+    console.log(`  ${c.green}✓${c.reset}  ${c.bold}done${c.reset}  ${c.dim}update will be applied on next OTA sync${c.reset}`);
+    console.log(`${sep}\n`);
 });
-// ──────────────────────────────────────────────────────
+// ──────────────────────────────────────────────────────────────────────────────
 // edge-ota status
-// ──────────────────────────────────────────────────────
+// ──────────────────────────────────────────────────────────────────────────────
 program
     .command("status")
-    .description("List recent releases from the EdgeOTA server")
-    .option("-t, --token <token>", "Auth token (or set EDGE_OTA_TOKEN env var)")
+    .description("List recent deployments for this project")
     .option("-n, --limit <n>", "Number of releases to show", "10")
-    .option("--project <id>", "Project ID (optional)")
     .action(async (options) => {
-    const cwd = process.cwd();
-    const config = loadConfig(cwd);
-    const token = options.token || process.env.EDGE_OTA_TOKEN;
-    const projectId = options.project || config.projectId;
+    printBanner();
+    const token = resolveToken();
     if (!token) {
-        console.error(`  ${colors.red}error${colors.reset}  token required — set EDGE_OTA_TOKEN in .env or use -t`);
+        console.error(`  ${c.red}✗${c.reset}  Not logged in. Run ${c.cyan}edge-ota login${c.reset} first.\n`);
         process.exit(1);
     }
+    const cwd = process.cwd();
+    const appCfg = readAppJson(cwd);
+    const { serverUrl, projectId } = appCfg;
     const headers = { Authorization: `Bearer ${token}` };
     if (projectId)
         headers["x-project-id"] = projectId;
-    const res = await fetch(`${config.serverUrl}/api/releases`, { headers });
+    spin.start("fetching releases");
+    const res = await fetch(`${serverUrl}/api/releases`, { headers }).catch(e => {
+        spin.fail(`Connection failed: ${e.message}`);
+        process.exit(1);
+    });
     if (!res.ok) {
-        console.error(`  ${colors.red}error${colors.reset}  failed to fetch releases (HTTP ${res.status})`);
+        spin.fail(`Failed to fetch releases (HTTP ${res.status})`);
         process.exit(1);
     }
-    const releases = (await res.json());
+    const releases = await res.json();
+    spin.stop();
     if (!releases.length) {
-        console.log(`  ${colors.dim}no releases found${colors.reset}`);
+        console.log(`  ${c.dim}No releases found.${c.reset}\n`);
         return;
     }
-    const rows = releases.slice(0, parseInt(options.limit)).map((r) => ({
-        ID: r.id.slice(0, 8),
-        Channel: r.channel,
-        Runtime: r.runtime,
-        Status: r.status,
-        Published: r.published,
-        By: r.publisher
+    const limit = parseInt(options.limit);
+    const rows = releases.slice(0, limit).map((r) => ({
+        ID: r.id?.slice(0, 8) ?? "—",
+        Channel: r.channel ?? "—",
+        Runtime: r.runtime ?? "—",
+        Platform: r.platform ?? "all",
+        Created: r.created_at ? new Date(r.created_at).toLocaleString() : "—",
     }));
     console.table(rows);
 });
-// ──────────────────────────────────────────────────────
+// ──────────────────────────────────────────────────────────────────────────────
 // edge-ota keygen
-// ──────────────────────────────────────────────────────
+// ──────────────────────────────────────────────────────────────────────────────
 program
     .command("keygen")
-    .description("Generate a fresh ECDSA key pair (prints to stdout, does not write files)")
+    .description("Generate a fresh ECDSA P-256 key pair (prints to stdout, does not write files)")
     .action(async () => {
     const keys = await generateECDSAKeyPair();
-    const sep = `${colors.dim}${"-".repeat(48)}${colors.reset}`;
+    const sep = `${c.dim}${"─".repeat(52)}${c.reset}`;
     console.log(`\n${sep}`);
-    console.log(`  ${colors.bold}private key${colors.reset}  ${colors.dim}keep secret — never commit${colors.reset}`);
+    console.log(`  ${c.bold}private key${c.reset}  ${c.dim}keep secret — never commit${c.reset}`);
     console.log(sep);
     console.log(keys.privateKey);
     console.log(`\n${sep}`);
-    console.log(`  ${colors.bold}public key${colors.reset}   ${colors.dim}paste into dashboard → Settings → General${colors.reset}`);
+    console.log(`  ${c.bold}public key${c.reset}   ${c.dim}paste into dashboard → Settings → General${c.reset}`);
     console.log(sep);
     console.log(keys.publicKey);
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@renbostudios/edge-ota",
-  "version": "0.2.7",
+  "version": "0.2.8",
   "preferGlobal": true,
   "description": "Zero-SDK, self-hostable OTA update CLI for Expo — push signed JS bundles to any EdgeOTA server",
   "license": "MIT",