@scalebun-release/cli 2.5.0

package/lib/commands/quickstart.js

@@ -0,0 +1,672 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerAppsCommand = registerAppsCommand;
+exports.registerQuickstartCommand = registerQuickstartCommand;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const readline = __importStar(require("readline"));
+const chalk_1 = __importDefault(require("chalk"));
+const credentials_1 = require("../utils/credentials");
+const client_1 = require("../api/client");
+const crypto = __importStar(require("crypto"));
+const apps_1 = require("../utils/apps");
+const trustAnchor_1 = require("../utils/trustAnchor");
+const ota_keys_1 = require("./ota-keys");
+const login_1 = require("./login");
+const doctor_1 = require("./doctor");
+const ota_keys_2 = require("./ota-keys");
+const signing_1 = require("../utils/signing");
+const sdkBin_1 = require("../utils/sdkBin");
+const context_1 = require("../utils/context");
+const output_1 = require("../utils/output");
+/** client key with the middle masked — enough to recognize, useless to steal. */
+function maskKey(key) {
+    return key.length <= 16 ? key : `${key.slice(0, 12)}…${key.slice(-4)}`;
+}
+function registerAppsCommand(program) {
+    program
+        .command('apps')
+        .description('List every app you can publish to, with the IDs the other commands need')
+        .option('--keys', 'Also show each app\'s environments and SDK client keys (masked)')
+        .option('--json', 'Machine-readable output')
+        .action(async (opts) => {
+        const creds = (0, credentials_1.readCredentials)();
+        if (!creds) {
+            console.error('❌ Not logged in. Run `scalebun login` first.');
+            process.exit(1);
+        }
+        const client = new client_1.ApiClient(creds);
+        let entries;
+        try {
+            entries = await (0, apps_1.fetchAllApps)(client);
+        }
+        catch (err) {
+            console.error(`❌ Could not list apps: ${err.message}`);
+            process.exit(1);
+            return;
+        }
+        // Machine mode short-circuits before the grouped, coloured rendering —
+        // and before the per-app key fetches, which are N+1 requests nobody
+        // scripting this wants to pay for unless they asked with --keys.
+        // isJson(), not opts.json: commander does not pass root options down to
+        // subcommand handlers, and because the root also declares --json it
+        // consumes the flag before this handler ever sees it. output.ts reads it
+        // once from raw argv and is the single authority.
+        if ((0, output_1.isJson)()) {
+            (0, output_1.emit)(() => { }, {
+                ok: true,
+                count: entries.length,
+                apps: entries.map((e) => ({
+                    id: e.app.id,
+                    name: e.app.name,
+                    platform: e.app.platform ?? null,
+                    orgId: e.orgId,
+                    orgName: e.orgName,
+                    projectName: e.projectName,
+                })),
+            });
+            return;
+        }
+        if (!entries.length) {
+            console.log('\nNo apps yet. Create one in the dashboard (it takes a minute), then re-run this.\n');
+            return;
+        }
+        console.log('');
+        let lastGroup = '';
+        for (const e of entries) {
+            const group = `${e.orgName} / ${e.projectName}`;
+            if (group !== lastGroup) {
+                console.log(chalk_1.default.bold(` ${group}`));
+                lastGroup = group;
+            }
+            console.log(`   • ${e.app.name.padEnd(24)} ${chalk_1.default.dim(e.app.platform ?? '?')}  app-id: ${chalk_1.default.cyan(e.app.id)}`);
+            if (opts.keys) {
+                try {
+                    const envs = await client.get(`/apps/${e.app.id}/environments`);
+                    for (const env of envs ?? []) {
+                        const keys = await client.get(`/environments/${env.id}/sdk-keys`);
+                        const active = (keys ?? []).filter((k) => k.status === 'active');
+                        const label = `${env.name}${env.type ? ` (${env.type})` : ''}`;
+                        if (!active.length) {
+                            console.log(`       ${label}: ${chalk_1.default.dim('no active client key')}`);
+                        }
+                        for (const k of active) {
+                            console.log(`       ${label}: ${chalk_1.default.green(maskKey(k.clientKey))} ${chalk_1.default.dim(k.name ?? '')}`);
+                        }
+                    }
+                }
+                catch {
+                    console.log(chalk_1.default.dim('       (could not load environments/keys)'));
+                }
+            }
+        }
+        console.log('');
+        console.log(chalk_1.default.dim(' Next: scalebun ota publish --app-id <id> --channel production --platform android'));
+        console.log('');
+    });
+}
+function registerQuickstartCommand(program) {
+    program
+        .command('quickstart')
+        .description('Guided walkthrough: login → pick your app → keys → signing → native wiring → health check → first release')
+        .option('--app-id <id>', 'Skip app selection and use this app')
+        .action(async (opts) => {
+        const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+        // Resolves '' on EOF rather than never settling.
+        //
+        // THIS IS WHY QUICKSTART DIED AT "Which app?". The old form was
+        // `new Promise((r) => rl.question(q, r))`: if stdin reaches EOF — piped
+        // input, a closed handle, a terminal that hands the process no tty — the
+        // callback never fires, the promise never settles, and with nothing left
+        // holding the event loop open node simply exits. Mid-step, no error, no
+        // message: the shell prompt comes back and whatever the user typed next
+        // lands in the shell instead. utils/prompt.ts already guards this exact
+        // case; this one did not.
+        //
+        // Resolving '' hands control back to each call site's own default (the
+        // app picker reads '' as 1, the [Y/n] prompts as yes), so an EOF now
+        // continues the walkthrough instead of killing it.
+        // Tracked, because `rl.question()` on an ALREADY-closed interface throws
+        // ERR_USE_AFTER_CLOSE synchronously — so guarding only the close-while-
+        // waiting case turned the silent exit into a crash at the next prompt.
+        let rlClosed = false;
+        rl.on('close', () => {
+            rlClosed = true;
+        });
+        const ask = (q) => new Promise((resolve) => {
+            if (rlClosed) {
+                resolve('');
+                return;
+            }
+            let answered = false;
+            const onClose = () => {
+                if (!answered)
+                    resolve('');
+            };
+            rl.once('close', onClose);
+            try {
+                rl.question(q, (answer) => {
+                    answered = true;
+                    rl.removeListener('close', onClose);
+                    resolve(answer);
+                });
+            }
+            catch {
+                // Closed between the check above and here.
+                rl.removeListener('close', onClose);
+                resolve('');
+            }
+        });
+        const step = (n, title) => console.log(chalk_1.default.bold.cyan(`\n── Step ${n}/7 · ${title} ${'─'.repeat(Math.max(1, 44 - title.length))}`));
+        try {
+            console.log(chalk_1.default.bold('\n⚡ Scalebun quickstart — from zero to your first OTA update.\n'));
+            console.log(chalk_1.default.dim('   Everything below runs against your real account. Ctrl+C any time.'));
+            // Say it once, at the top. Without this the walkthrough looks like it is
+            // racing through the prompts on its own, which is exactly what it is doing.
+            if (!process.stdin.isTTY) {
+                console.log(chalk_1.default.yellow('   stdin is not interactive — every prompt below takes its default.'));
+                console.log(chalk_1.default.dim('   Pass --app-id to choose the app explicitly.'));
+            }
+            // ── 1. Login ────────────────────────────────────────────────────────
+            step(1, 'Sign in');
+            let creds = (0, credentials_1.readCredentials)();
+            if (creds) {
+                try {
+                    const me = await new client_1.ApiClient(creds).get('/auth/me');
+                    console.log(`✅ Already signed in as ${me.email} (${creds.apiUrl})`);
+                }
+                catch {
+                    console.log('⚠️  Stored token no longer works — signing in again.');
+                    creds = null;
+                }
+            }
+            if (!creds) {
+                await (0, login_1.runLogin)({});
+                creds = (0, credentials_1.readCredentials)();
+                if (!creds)
+                    process.exit(1);
+            }
+            const client = new client_1.ApiClient(creds);
+            // ── 2. Pick the app ─────────────────────────────────────────────────
+            step(2, 'Pick your app');
+            let appId = opts.appId ?? null;
+            let appLabel = appId ?? '';
+            // Needed to write the native trust anchor in step 4. It is NOT the appId:
+            // the device verifier compares the signed release's projectId against the
+            // embedded one and refuses on PROJECT_MISMATCH.
+            let projectId = null;
+            if (!appId) {
+                const entries = await (0, apps_1.fetchAllApps)(client);
+                if (!entries.length) {
+                    console.log('❌ Your account has no apps yet.');
+                    console.log('   Create one in the dashboard (Organization → Project → App), then re-run quickstart.');
+                    process.exit(1);
+                }
+                if (entries.length === 1) {
+                    appId = entries[0].app.id;
+                    appLabel = entries[0].app.name;
+                    projectId = entries[0].projectId;
+                    console.log(`✅ Using your only app: ${appLabel} (${appId})`);
+                }
+                else {
+                    entries.forEach((e, i) => console.log(`  ${i + 1}. ${e.orgName} / ${e.projectName} / ${chalk_1.default.bold(e.app.name)} ${chalk_1.default.dim(e.app.id)}`));
+                    const n = parseInt(await ask('\nWhich app? [1]: '), 10) || 1;
+                    const chosen = entries[Math.min(Math.max(n, 1), entries.length) - 1];
+                    appId = chosen.app.id;
+                    appLabel = chosen.app.name;
+                    projectId = chosen.projectId;
+                    console.log(`✅ ${chosen.app.name} (${appId})`);
+                }
+            }
+            // `--app-id` skips the picker above, so projectId is still unknown — and
+            // without it step 4 cannot write the trust anchor, which is the one thing
+            // the user most needs done for them. Look it up rather than silently
+            // degrading the flow for anyone who passed the flag.
+            if (appId && !projectId) {
+                try {
+                    const found = (await (0, apps_1.fetchAllApps)(client)).find((e) => e.app.id === appId);
+                    if (found) {
+                        projectId = found.projectId;
+                        if (!appLabel || appLabel === appId)
+                            appLabel = found.app.name;
+                    }
+                }
+                catch { /* non-fatal: step 4 says why the anchor was skipped */ }
+            }
+            // Bind the choice to this directory, so the rest of quickstart — and
+            // every command the user runs afterwards — stops needing --app-id.
+            // Without this the guided flow ends by printing commands that all
+            // carry a pasted cuid, which is exactly the friction `link` removes.
+            {
+                const root = (0, context_1.findProjectRoot)() ?? process.cwd();
+                try {
+                    (0, context_1.writeProjectConfig)(root, {
+                        appId: appId,
+                        ...(appLabel ? { appName: appLabel } : {}),
+                        channel: 'production',
+                    });
+                    console.log(chalk_1.default.dim(`   Linked this project — ${context_1.PROJECT_FILE} written, --app-id no longer needed here.`));
+                }
+                catch {
+                    // A read-only checkout is not a reason to abandon the walkthrough;
+                    // every later step still works with the id held in memory.
+                    console.log(chalk_1.default.dim('   (could not write scalebun.json here — continuing)'));
+                }
+            }
+            // ── 3. SDK client key ───────────────────────────────────────────────
+            step(3, 'SDK client key');
+            console.log(chalk_1.default.dim('   The client key is what your app ships with — it scopes every SDK call to this app.'));
+            let clientKeyForSnippet = null;
+            try {
+                const envs = await client.get(`/apps/${appId}/environments`);
+                for (const env of envs ?? []) {
+                    const keys = await client.get(`/environments/${env.id}/sdk-keys`);
+                    const active = (keys ?? []).filter((k) => k.status === 'active');
+                    console.log(`   ${env.name}: ${active.length ? active.map((k) => maskKey(k.clientKey)).join(', ') : chalk_1.default.dim('no active key')}`);
+                    if (active.length && !clientKeyForSnippet)
+                        clientKeyForSnippet = active[0].clientKey;
+                }
+                if (!clientKeyForSnippet && envs?.length) {
+                    const yn = (await ask('\n   No active client key. Create one now? [Y/n]: ')).trim().toLowerCase();
+                    if (yn !== 'n') {
+                        const made = await client.post(`/environments/${envs[0].id}/sdk-keys`, {
+                            name: 'quickstart key',
+                        });
+                        clientKeyForSnippet = made.clientKey;
+                        console.log(`   🔑 Created: ${made.clientKey}`);
+                        if (made.secretKey) {
+                            console.log(chalk_1.default.yellow(`   Secret key (shown ONCE, store it now): ${made.secretKey}`));
+                        }
+                    }
+                }
+            }
+            catch (err) {
+                console.log(`   ⚠️  Could not read keys (${err.message}) — grab the client key from the dashboard instead.`);
+            }
+            console.log('\n   Wire the SDK in your app entry point:\n');
+            console.log(chalk_1.default.green('     import { ScaleBunProvider } from \'@scalebun/react-native\';\n'));
+            console.log(chalk_1.default.green('     <ScaleBunProvider config={{'));
+            console.log(chalk_1.default.green(`       clientKey: '${clientKeyForSnippet ?? '<your client key>'}',`));
+            console.log(chalk_1.default.green('     }}>'));
+            console.log(chalk_1.default.green('       <App />'));
+            console.log(chalk_1.default.green('     </ScaleBunProvider>'));
+            // ── 4. Bundle signing key ───────────────────────────────────────────
+            // Default is YES: quickstart is where NEW apps are born, and new apps
+            // should come out signed. Existing apps are never touched by this —
+            // signing only binds where a key is pinned in the app's own config.
+            step(4, 'Bundle signing (recommended)');
+            const keyPath = path.resolve('.scalebun', 'ota-signing-key.pem');
+            // Drives the closing advice in step 7: an app with no signing key can
+            // publish, but only on SHA-256 integrity, and nothing stops a release
+            // the customer's key never authorised.
+            let signingReady = false;
+            if (fs.existsSync(keyPath)) {
+                // A local key file is not the same as a registered key.
+                //
+                // This branch used to print "already present" and skip the entire
+                // step — so a run that died at registration (a 403, a dropped
+                // connection) left a private key on disk that the server had never
+                // seen, and every re-run cheerfully confirmed it was fine. The next
+                // publish was the first thing to disagree, by which point nothing on
+                // screen connected the two. Check the server, not the filesystem.
+                console.log(`✅ Signing key already present: ${keyPath}`);
+                signingReady = true;
+                const localKeyId = (0, ota_keys_2.readLocalKeyId)(path.dirname(keyPath));
+                try {
+                    const rows = await client.get(`/saas/apps/${appId}/ota/signing-keys`);
+                    const match = localKeyId
+                        ? rows.find((r) => r.keyId === localKeyId && !r.revokedAt)
+                        : undefined;
+                    if (match) {
+                        console.log(chalk_1.default.dim(`   Registered with this app as "${localKeyId}".`));
+                    }
+                    else if (localKeyId) {
+                        console.log(chalk_1.default.yellow(`   ⚠️  "${localKeyId}" is NOT registered with this app.`));
+                        console.log(chalk_1.default.dim('      Publishing will work, but the release cannot be promoted until it is.'));
+                        console.log(chalk_1.default.dim(`        scalebun ota keys register --key-id ${localKeyId} --public-key ${path.join(path.dirname(keyPath), 'ota-signing-key.pub.pem')}`));
+                    }
+                    else {
+                        console.log(chalk_1.default.dim('   No local key id recorded — run `scalebun ota keys list` to check.'));
+                    }
+                }
+                catch (err) {
+                    const msg = String(err?.message ?? err ?? '').trim();
+                    console.log(chalk_1.default.dim(`   Could not confirm registration: ${msg || 'no detail returned'}. Check with \`scalebun ota keys list\`.`));
+                }
+            }
+            else {
+                const yn = (await ask('   No signing key. Create one? [Y/n]: ')).trim().toLowerCase();
+                if (yn !== 'n') {
+                    // Let the operator name the key. It is the label they will see in the
+                    // dashboard and the id every signed release carries, and it outlives
+                    // this setup by years — `quickstart-2026-09` says nothing about which
+                    // app, environment or team it belongs to once there are several.
+                    const defaultKeyId = `${(appLabel || 'app').toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-|-$/g, '').slice(0, 24) || 'app'}-${new Date().toISOString().slice(0, 7)}`;
+                    console.log('');
+                    const rawKeyId = (await ask(`   Name this signing key [${defaultKeyId}]: `)).trim();
+                    const keyId = (rawKeyId || defaultKeyId).replace(/[^A-Za-z0-9._-]+/g, '-');
+                    if (rawKeyId && keyId !== rawKeyId) {
+                        console.log(chalk_1.default.dim(`   Using "${keyId}" — a key id may only contain letters, digits, dot, dash or underscore.`));
+                    }
+                    const { privatePem, publicPem, info } = (0, signing_1.generateRsaKeyPair)();
+                    fs.mkdirSync(path.dirname(keyPath), { recursive: true });
+                    fs.writeFileSync(keyPath, privatePem, { mode: 0o600 });
+                    // Same hardening as `ota keys generate` — this inline path used to skip
+                    // both, leaving the key world-readable on Windows and its git hygiene
+                    // to a warning line.
+                    (0, credentials_1.restrictToCurrentUser)(keyPath, 'your OTA signing private key');
+                    fs.writeFileSync(path.join(path.dirname(keyPath), 'ota-signing-key.pub.pem'), publicPem);
+                    fs.writeFileSync(path.join(path.dirname(keyPath), ota_keys_2.KEY_ID_FILE), keyId + '\n');
+                    const gitignoreOutcome = (0, ota_keys_2.ensureKeyDirGitignored)(path.dirname(keyPath));
+                    // Registration is guarded because the private key is ALREADY on disk
+                    // by this point. Unguarded, a refusal here threw out of the action
+                    // handler as an unhandled rejection — which prints next to nothing —
+                    // and left a local key the server had never seen. The next publish
+                    // then failed for a reason nothing on screen had explained.
+                    let keyRow = null;
+                    try {
+                        keyRow = await client.post(`/saas/apps/${appId}/ota/signing-keys`, {
+                            publicKey: publicPem,
+                            keyId,
+                            algorithm: 'RSA_SHA256',
+                            name: keyId,
+                        });
+                    }
+                    catch (err) {
+                        const msg = String(err?.message ?? err ?? '').trim();
+                        const status = typeof err?.status === 'number' ? err.status : undefined;
+                        console.log(chalk_1.default.yellow(`   ⚠️  The key was generated but NOT registered${status ? ` (HTTP ${status})` : ''}.`));
+                        // Never print an empty reason. A blank line here is what made this
+                        // failure look like a crash rather than a refusal.
+                        console.log(chalk_1.default.dim(`      ${msg || 'the server refused the request and returned no detail'}`));
+                        if (status === 403) {
+                            console.log(chalk_1.default.dim('      A 403 here usually means the workspace is suspended or its plan lapsed.'));
+                            console.log(chalk_1.default.dim('      Check billing in the dashboard, then re-run quickstart.'));
+                        }
+                        else if (status === 401) {
+                            console.log(chalk_1.default.dim('      Run `scalebun login` and re-run quickstart.'));
+                        }
+                        console.log(chalk_1.default.dim(`      Your private key is safe at ${keyPath}. Register it later with:`));
+                        console.log(chalk_1.default.dim(`        scalebun ota keys register --key-id ${keyId} --public-key ${path.join(path.dirname(keyPath), 'ota-signing-key.pub.pem')}`));
+                    }
+                    // Registering only says "trust this key". Until possession is proven
+                    // the key is not ACTIVE and every promote is refused as high-risk
+                    // (`signing_key_ownership_unverified`) — so a guided setup that stops
+                    // at registration hands the user a key that cannot ship anything. We
+                    // are holding the private half right here; finish it.
+                    if (keyRow?.id) {
+                        try {
+                            const ok = await (0, ota_keys_1.proveOwnership)(client, appId, keyRow.id, crypto.createPrivateKey(privatePem));
+                            console.log(ok
+                                ? '   ✅ Ownership proven — the key is ACTIVE.'
+                                : '   ⚠️  Ownership not confirmed; run `scalebun ota keys verify`.');
+                        }
+                        catch (err) {
+                            console.log(chalk_1.default.yellow(`   ⚠️  Could not prove ownership: ${err.message}`));
+                            console.log(chalk_1.default.dim('      Finish it with: scalebun ota keys verify'));
+                        }
+                    }
+                    signingReady = true;
+                    console.log(`   🔏 RSA-${info.modulusBits} key generated (${keyPath}) and public half registered.`);
+                    console.log(`   Key ID: ${keyId}   Fingerprint: SHA-256:${info.fingerprintDisplay.slice(0, 23)}…`);
+                    console.log(`   Git: ${gitignoreOutcome}`);
+                    // Write the trust anchor rather than describing it.
+                    //
+                    // This step used to print the path and stop, leaving the most
+                    // error-prone action to be done by hand: a JSON file, in the right
+                    // directory, with the right projectId and the PEM inlined. Get the
+                    // projectId wrong — appId is the easy wrong guess, both are `cm…`
+                    // cuids — and the device downloads the release, refuses it with
+                    // PROJECT_MISMATCH, and reverts. The CLI knows both ids.
+                    // Embed an UNUSED standby key alongside the active one.
+                    //
+                    // Trust only changes at store speed — the anchor is compiled in, so a
+                    // key the binary does not already carry can never be added over the
+                    // air. With a single key, rotating (or recovering from a leak) means
+                    // shipping a native build and waiting for adoption while still signing
+                    // with the key you are trying to retire. A standby the device already
+                    // trusts turns that into: start signing with it.
+                    //
+                    // It is deliberately NOT registered with the server. Pre-trusted but
+                    // unusable is the point: nothing can sign with it until you choose to
+                    // register it, so it costs nothing to carry and is there when needed.
+                    //
+                    // Resolved HERE, above the per-platform writes, because it used to be
+                    // generated inside the Android branch — so an iOS app got the active
+                    // key and no standby, and the rotation path the standby exists for
+                    // did not exist on iOS at all.
+                    const standbyId = `${keyId}-standby`;
+                    const standbyPath = path.join(path.dirname(keyPath), 'ota-standby-key.pem');
+                    const standbyPubPath = path.join(path.dirname(keyPath), 'ota-standby-key.pub.pem');
+                    let standbyPem = null;
+                    let standbyIsNew = false;
+                    if (projectId) {
+                        try {
+                            if (!fs.existsSync(standbyPath)) {
+                                // Asked, not assumed — but the default is yes, and saying no
+                                // has a cost that only shows up much later: the anchor is
+                                // compiled into the binary, so a key the app does not already
+                                // carry can never be added over the air. With one key, rotating
+                                // (or recovering from a leak) means shipping a native build and
+                                // waiting for adoption. `doctor` warns about exactly this.
+                                const sb = (await ask('   Add a standby key for rotation? [Y/n]: ')).trim().toLowerCase();
+                                if (sb !== 'n') {
+                                    const standby = (0, signing_1.generateRsaKeyPair)();
+                                    fs.writeFileSync(standbyPath, standby.privatePem, { mode: 0o600 });
+                                    (0, credentials_1.restrictToCurrentUser)(standbyPath, 'your OTA standby signing key');
+                                    fs.writeFileSync(standbyPubPath, standby.publicPem);
+                                    standbyPem = standby.publicPem;
+                                    standbyIsNew = true;
+                                }
+                            }
+                            else if (fs.existsSync(standbyPubPath)) {
+                                // Already generated on an earlier run. Re-read it so a project
+                                // that gains an iOS app later still gets the standby embedded.
+                                standbyPem = fs.readFileSync(standbyPubPath, 'utf8');
+                            }
+                        }
+                        catch (err) {
+                            console.log(chalk_1.default.yellow(`   ⚠️  Could not prepare the standby key: ${err.message}`));
+                        }
+                    }
+                    /** Write active + standby into one platform's anchor. */
+                    const embedKeys = (write) => {
+                        const res = write({
+                            cwd: process.cwd(),
+                            projectId: projectId,
+                            keyId,
+                            publicKeyPem: publicPem,
+                        });
+                        if (!standbyPem)
+                            return res;
+                        return write({
+                            cwd: process.cwd(),
+                            projectId: projectId,
+                            keyId: standbyId,
+                            publicKeyPem: standbyPem,
+                        });
+                    };
+                    if (!projectId) {
+                        console.log(chalk_1.default.dim('   Trust anchor skipped — project id could not be resolved.'));
+                    }
+                    else if (!(0, trustAnchor_1.hasAndroidProject)(process.cwd())) {
+                        console.log(chalk_1.default.dim('   No android/app directory — skipping the Android trust anchor.'));
+                    }
+                    else {
+                        try {
+                            const res = embedKeys(trustAnchor_1.writeAndroidTrustAnchor);
+                            console.log(`   ✅ Android trust anchor written: ${res.path}`);
+                            console.log(chalk_1.default.dim(`      projectId ${projectId} · trusts ${res.keyIds.join(', ')}` +
+                                (res.merged ? ' (existing keys preserved)' : '')));
+                            console.log(chalk_1.default.dim('      Rebuild the app so the device enforces this key.'));
+                        }
+                        catch (err) {
+                            console.log(chalk_1.default.yellow(`   ⚠️  Could not write the trust anchor: ${err.message}`));
+                        }
+                    }
+                    // iOS, written rather than described — same reasoning as Android
+                    // above, plus one failure Android does not have. The file can be
+                    // correct and still not ship, because Xcode copies only what the
+                    // target references; the device then builds an empty registry and
+                    // refuses every release. So the one step the CLI cannot do is the
+                    // one it has to be loudest about.
+                    if (!projectId) {
+                        // Already reported above; nothing useful to add per-platform.
+                    }
+                    else if (!(0, trustAnchor_1.hasIosProject)(process.cwd())) {
+                        console.log(chalk_1.default.dim('   No ios/<App> directory — skipping the iOS trust anchor.'));
+                    }
+                    else {
+                        try {
+                            const ios = embedKeys(trustAnchor_1.writeIosTrustAnchor);
+                            console.log(`   ✅ iOS trust anchor written: ${ios.path}`);
+                            console.log(chalk_1.default.dim(`      projectId ${projectId} · trusts ${ios.keyIds.join(', ')}` +
+                                (ios.merged ? ' (existing keys preserved)' : '')));
+                            if (!ios.inXcodeResources) {
+                                console.log(chalk_1.default.yellow(`      ⚠️  Not yet in the Xcode project. Open the workspace, drag`));
+                                console.log(chalk_1.default.yellow(`         ${trustAnchor_1.IOS_ANCHOR_FILENAME} into the app group and tick your app target`));
+                                console.log(chalk_1.default.yellow('         so it lands in Build Phases → Copy Bundle Resources.'));
+                                console.log(chalk_1.default.dim('         Until then the app ships without it and refuses every'));
+                                console.log(chalk_1.default.dim('         release with UNKNOWN_KEY_ID.'));
+                            }
+                            else {
+                                console.log(chalk_1.default.dim('      Already referenced by the Xcode project — rebuild to enforce it.'));
+                            }
+                        }
+                        catch (err) {
+                            console.log(chalk_1.default.yellow(`   ⚠️  Could not write the iOS trust anchor: ${err.message}`));
+                        }
+                    }
+                    // Printed once, after both platforms: the standby is one key pair
+                    // embedded in whichever anchors exist, not a per-platform artifact.
+                    if (standbyIsNew) {
+                        console.log(`   ✅ Standby key embedded too: ${standbyId}`);
+                        console.log(chalk_1.default.dim('      Not registered, so nothing can sign with it yet. To rotate later:'));
+                        console.log(chalk_1.default.dim(`        scalebun ota keys register --key-id ${standbyId} --public-key ${standbyPubPath}`));
+                        console.log(chalk_1.default.yellow(`      Keep ${standbyPath} offline — it is your recovery key.`));
+                    }
+                    console.log(chalk_1.default.dim('   The device verifies every release against this key and refuses the rest.'));
+                }
+                else {
+                    console.log(chalk_1.default.dim('   Skipped — bundles will ship on SHA-256 integrity alone (unsigned).'));
+                }
+            }
+            // ── 5. Native wiring ────────────────────────────────────────────────
+            // The step this flow always needed: everything before here is account
+            // plumbing, but an app whose MainApplication/AppDelegate never resolves
+            // the OTA slot installs updates that NEVER RUN. `init` does the wiring;
+            // doctor (next step) verifies it. Check first, offer to fix — and if
+            // the SDK bin isn't resolvable from here, say exactly what to run
+            // instead of failing the whole guided flow.
+            step(5, 'Wire the native app for OTA');
+            const platforms = ['android', 'ios'].filter((p) => fs.existsSync(path.resolve(p)));
+            if (!platforms.length) {
+                console.log(chalk_1.default.dim('   No android/ or ios/ directory here — run quickstart from your app root'));
+                console.log(chalk_1.default.dim('   to wire the native side, or run `scalebun init android` / `init ios` there.'));
+            }
+            else {
+                const sdkBin = (0, sdkBin_1.resolveSdkBin)();
+                if (!sdkBin) {
+                    console.log('   ⚠️  @scalebun/react-native is not resolvable from this directory, so the');
+                    console.log('   wiring step cannot run. After installing the SDK, wire it with:');
+                    for (const p of platforms)
+                        console.log(chalk_1.default.green(`     npx scalebun init ${p}`));
+                }
+                else {
+                    for (const p of platforms) {
+                        // --check verifies without touching files (exit 1 = not wired).
+                        const wired = (0, sdkBin_1.runSdkBin)(sdkBin, ['init', p, '--check']) === 0;
+                        if (wired) {
+                            console.log(`   ✅ ${p}: already wired for OTA`);
+                            continue;
+                        }
+                        const yn = (await ask(`   ${p} is not wired. Wire it now? [Y/n]: `)).trim().toLowerCase();
+                        if (yn !== 'n') {
+                            const code = (0, sdkBin_1.runSdkBin)(sdkBin, ['init', p]);
+                            console.log(code === 0
+                                ? `   ✅ ${p}: wired — rebuild the app before testing OTA`
+                                : `   ⚠️  ${p}: init exited ${code} — fix the message above, or wire manually (doctor prints the exact code)`);
+                        }
+                        else {
+                            console.log(chalk_1.default.dim(`   Skipped — updates will install but never run on ${p} until it is wired.`));
+                        }
+                    }
+                }
+            }
+            // ── 6. Project health ───────────────────────────────────────────────
+            step(6, 'Project health check');
+            console.log(chalk_1.default.dim('   Running `scalebun doctor` on the current directory…'));
+            await (0, doctor_1.runDoctor)(); // exits on blocking failures, same as the standalone command
+            // ── 7. First release ────────────────────────────────────────────────
+            step(7, 'Ship your first update');
+            console.log('   From your app\'s directory:\n');
+            console.log(chalk_1.default.green(`     scalebun ota publish --app-id ${appId} --channel production --platform android \\`));
+            console.log(chalk_1.default.green('       --release-note "First OTA release"'));
+            console.log('\n   Then manage it:\n');
+            console.log(`     ${chalk_1.default.cyan('scalebun ota releases')} --app-id ${appId}    ${chalk_1.default.dim('# live state per channel')}`);
+            console.log(`     ${chalk_1.default.cyan('scalebun ota rollout')}  --app-id ${appId} --percent 10   ${chalk_1.default.dim('# staged rollout')}`);
+            console.log(`     ${chalk_1.default.cyan('scalebun ota pause')}    --app-id ${appId}    ${chalk_1.default.dim('# stop new deliveries')}`);
+            console.log(`     ${chalk_1.default.cyan('scalebun ota rollback')} --app-id ${appId}    ${chalk_1.default.dim('# revert every device')}`);
+            console.log(`     ${chalk_1.default.cyan('scalebun ci init')}                       ${chalk_1.default.dim('# generate a CI workflow (GitHub/GitLab)')}`);
+            console.log(`\n   Dashboard: releases, adoption and rollback analytics live under ${chalk_1.default.bold('OTA')} for ${chalk_1.default.bold(appLabel || appId)}.`);
+            // Say what to do next, and be specific about the cost of skipping it.
+            // Without a signing key a release still ships — SHA-256 proves the bytes
+            // arrived intact, but nothing proves WHO produced them, so a device will
+            // accept any bundle whose hash matches what the server declared.
+            if (!signingReady) {
+                console.log(chalk_1.default.yellow(`\n   ⚠️  No signing key is set up for this app.`));
+                console.log('      Releases will ship on SHA-256 integrity alone: the bytes are checked,');
+                console.log('      but nothing proves who signed them. Set one up next — one command,');
+                console.log('      and it registers and proves ownership for you:');
+                console.log(chalk_1.default.green(`\n        scalebun ota keys generate --app-id ${appId}`));
+                console.log(chalk_1.default.dim('\n      Then rebuild the app: the public key is compiled into the binary,'));
+                console.log(chalk_1.default.dim('      so it cannot be delivered over the air.'));
+            }
+            console.log('');
+        }
+        catch (err) {
+            console.error(`\n❌ Quickstart stopped: ${err?.message ?? err}`);
+            process.exit(1);
+        }
+        finally {
+            rl.close();
+        }
+    });
+}
+//# sourceMappingURL=quickstart.js.map