@scalebun-release/cli 2.5.0

package/lib/utils/bundleStore.js

@@ -0,0 +1,250 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KEEP_BUNDLES = exports.BUNDLES_DIR = void 0;
+exports.stamp = stamp;
+exports.bundleFileName = bundleFileName;
+exports.metaPathFor = metaPathFor;
+exports.sigPathFor = sigPathFor;
+exports.loadBundleAt = loadBundleAt;
+exports.listLocalBundles = listLocalBundles;
+exports.sigState = sigState;
+exports.humanSize = humanSize;
+exports.ago = ago;
+exports.validForMinutes = validForMinutes;
+exports.describeBundle = describeBundle;
+exports.pruneExpiredSignatures = pruneExpiredSignatures;
+exports.pruneBundles = pruneBundles;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+/**
+ * The local bundles/ folder: naming, listing and sign status.
+ *
+ * `ota bundle` used to write a single fixed path — bundles/index.android.bundle —
+ * so every build silently destroyed the one before it. That is fine while a
+ * bundle is a throwaway, and wrong the moment you have three builds and need the
+ * SECOND one because the newest turned out to be broken. Bundles are a working
+ * set, so they get distinct names and keep their provenance.
+ */
+exports.BUNDLES_DIR = 'bundles';
+/** Keep generously: 19MB each is cheap, deleting the build someone wanted is not. */
+exports.KEEP_BUNDLES = 10;
+/** `2026-09-10T15-42` — sortable, and legal on Windows (no colons). */
+function stamp(d = new Date()) {
+    const p = (n) => String(n).padStart(2, '0');
+    return (`${d.getFullYear()}-${p(d.getMonth() + 1)}-${p(d.getDate())}` +
+        `T${p(d.getHours())}-${p(d.getMinutes())}`);
+}
+/**
+ * `index.android.2026-09-10T15-42.a3f9c2.bundle`
+ *
+ * Time orders the list; the short git sha is what a human actually recognises
+ * ("the one before I made that change"). Without a sha the name still works,
+ * it is just less identifiable.
+ */
+function bundleFileName(platform, gitSha, at = new Date()) {
+    const short = gitSha ? `.${gitSha.slice(0, 6)}` : '';
+    return `index.${platform}.${stamp(at)}${short}.bundle`;
+}
+function metaPathFor(bundlePath) {
+    return `${bundlePath}.json`;
+}
+function sigPathFor(bundlePath) {
+    return `${bundlePath}.sbsig`;
+}
+function readJson(p) {
+    try {
+        return JSON.parse(fs.readFileSync(p, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Load one bundle by path, wherever it lives.
+ *
+ * `ota bundle build --output <dir>` puts the artifact outside bundles/, and a
+ * signature belongs beside its bundle rather than in some blessed folder. So
+ * signing reads the sidecars next to the file it was handed, and refuses to
+ * hunt for them elsewhere.
+ */
+function loadBundleAt(bundlePath) {
+    const abs = path.resolve(bundlePath);
+    if (!fs.existsSync(abs) || !fs.statSync(abs).isFile())
+        return null;
+    const st = fs.statSync(abs);
+    return {
+        bundlePath: abs,
+        metaPath: metaPathFor(abs),
+        sigPath: sigPathFor(abs),
+        name: path.basename(abs),
+        meta: readJson(metaPathFor(abs)),
+        sig: readJson(sigPathFor(abs)),
+        size: st.size,
+        mtimeMs: st.mtimeMs,
+    };
+}
+/** Every bundle in `dir`, newest first. */
+function listLocalBundles(dir = exports.BUNDLES_DIR) {
+    const abs = path.resolve(dir);
+    if (!fs.existsSync(abs))
+        return [];
+    return fs
+        .readdirSync(abs)
+        .filter((f) => f.endsWith('.bundle'))
+        .map((name) => {
+        const bundlePath = path.join(abs, name);
+        const st = fs.statSync(bundlePath);
+        return {
+            bundlePath,
+            metaPath: metaPathFor(bundlePath),
+            sigPath: sigPathFor(bundlePath),
+            name,
+            meta: readJson(metaPathFor(bundlePath)),
+            sig: readJson(sigPathFor(bundlePath)),
+            size: st.size,
+            mtimeMs: st.mtimeMs,
+        };
+    })
+        .sort((a, b) => b.mtimeMs - a.mtimeMs);
+}
+/**
+ * A signature is a short-lived ticket, not a permanent property of the file.
+ * Signing reserves an upload slot on the server, and that slot expires — so a
+ * bundle signed an hour ago is dead even though its .sbsig looks perfectly fine
+ * sitting on disk. Callers must be able to say so before someone uploads it.
+ */
+function sigState(b, now = new Date()) {
+    if (!b.sig)
+        return 'unsigned';
+    const expires = Date.parse(b.sig.uploadExpiresAt);
+    if (!Number.isFinite(expires))
+        return 'signed';
+    return expires > now.getTime() ? 'signed' : 'expired';
+}
+function humanSize(bytes) {
+    return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+}
+/** "3m", "17h", "2d" — coarse on purpose; exact times are noise in a picker. */
+function ago(iso, now = new Date()) {
+    const t = typeof iso === 'number' ? iso : Date.parse(iso);
+    if (!Number.isFinite(t))
+        return '?';
+    const s = Math.max(0, Math.round((now.getTime() - t) / 1000));
+    if (s < 60)
+        return `${s}s`;
+    if (s < 3600)
+        return `${Math.round(s / 60)}m`;
+    if (s < 86400)
+        return `${Math.round(s / 3600)}h`;
+    return `${Math.round(s / 86400)}d`;
+}
+/** Minutes until the reserved upload slot closes; 0 once it has. */
+function validForMinutes(b, now = new Date()) {
+    if (!b.sig)
+        return 0;
+    const expires = Date.parse(b.sig.uploadExpiresAt);
+    if (!Number.isFinite(expires))
+        return 0;
+    return Math.max(0, Math.round((expires - now.getTime()) / 60000));
+}
+/** One picker row: `15:42  a3f9c2  scalebun-ota (dirty)  19.0 MB  signed 3m ago - valid 12m` */
+function describeBundle(b, now = new Date()) {
+    const when = b.meta?.createdAt ? new Date(b.meta.createdAt) : new Date(b.mtimeMs);
+    const hhmm = `${String(when.getHours()).padStart(2, '0')}:${String(when.getMinutes()).padStart(2, '0')}`;
+    const sha = b.meta?.gitSha ? b.meta.gitSha.slice(0, 6) : '—'.repeat(6);
+    const branch = b.meta?.gitBranch ?? 'unknown';
+    const dirty = b.meta?.gitDirty ? ' (dirty)' : '';
+    const state = sigState(b, now);
+    const status = state === 'unsigned'
+        ? 'unsigned'
+        : state === 'expired'
+            ? `signed ${ago(b.sig.signedAt, now)} ago · EXPIRED`
+            : `signed ${ago(b.sig.signedAt, now)} ago · valid ${validForMinutes(b, now)}m`;
+    return `${hhmm}  ${sha}  ${branch}${dirty}  ${humanSize(b.size)}  ${status}`;
+}
+/**
+ * Delete signature tickets that can no longer be used.
+ *
+ * An expired ticket is not merely stale, it is impossible: the upload slot it
+ * reserved is gone, so no upload can ever succeed with it. Leaving it on disk
+ * costs nothing in space and a great deal in confusion — it still appears in a
+ * file picker, still looks like a signature, and pairing it with the wrong
+ * bundle produces a failure only the server can explain, after transferring the
+ * whole artifact. Removing it makes the folder tell the truth: every .sbsig
+ * present is one you can actually upload.
+ *
+ * Valid tickets for other bundles are left alone. Having two live signatures is
+ * legitimate; having a dead one is not.
+ */
+function pruneExpiredSignatures(dir = exports.BUNDLES_DIR, now = new Date()) {
+    const removed = [];
+    for (const b of listLocalBundles(dir)) {
+        if (sigState(b, now) !== 'expired')
+            continue;
+        try {
+            fs.unlinkSync(b.sigPath);
+            removed.push(path.basename(b.sigPath));
+        }
+        catch {
+            /* a locked file is not worth failing the signing run over */
+        }
+    }
+    return removed;
+}
+/**
+ * Drop the oldest bundles past `keep`, with their sidecars.
+ *
+ * Deliberately generous. Reclaiming a few hundred MB is worth far less than the
+ * one time someone reaches for a build and finds the CLI threw it away.
+ */
+function pruneBundles(dir = exports.BUNDLES_DIR, keep = exports.KEEP_BUNDLES) {
+    const all = listLocalBundles(dir);
+    const removed = [];
+    for (const b of all.slice(keep)) {
+        for (const p of [b.bundlePath, b.metaPath, b.sigPath]) {
+            try {
+                if (fs.existsSync(p))
+                    fs.unlinkSync(p);
+            }
+            catch {
+                /* a locked file is not worth failing a build over */
+            }
+        }
+        removed.push(b.name);
+    }
+    return removed;
+}
+//# sourceMappingURL=bundleStore.js.map

package/lib/utils/bundleStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundleStore.js","sourceRoot":"","sources":["../../src/utils/bundleStore.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4EA,sBAMC;AASD,wCAOC;AAED,kCAEC;AAED,gCAEC;AAkBD,oCAcC;AAGD,4CAqBC;AAUD,4BAKC;AAED,8BAEC;AAGD,kBAQC;AAGD,0CAKC;AAGD,wCAcC;AAgBD,wDAeC;AAQD,oCAcC;AA9QD,uCAAyB;AACzB,2CAA6B;AAE7B;;;;;;;;GAQG;AAEU,QAAA,WAAW,GAAG,SAAS,CAAC;AACrC,qFAAqF;AACxE,QAAA,YAAY,GAAG,EAAE,CAAC;AA4D/B,uEAAuE;AACvE,SAAgB,KAAK,CAAC,IAAU,IAAI,IAAI,EAAE;IACxC,MAAM,CAAC,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACpD,OAAO,CACL,GAAG,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE;QAC7D,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,EAAE,CAC3C,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,cAAc,CAC5B,QAAgB,EAChB,MAAe,EACf,KAAW,IAAI,IAAI,EAAE;IAErB,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACrD,OAAO,SAAS,QAAQ,IAAI,KAAK,CAAC,EAAE,CAAC,GAAG,KAAK,SAAS,CAAC;AACzD,CAAC;AAED,SAAgB,WAAW,CAAC,UAAkB;IAC5C,OAAO,GAAG,UAAU,OAAO,CAAC;AAC9B,CAAC;AAED,SAAgB,UAAU,CAAC,UAAkB;IAC3C,OAAO,GAAG,UAAU,QAAQ,CAAC;AAC/B,CAAC;AAED,SAAS,QAAQ,CAAI,CAAS;IAC5B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAM,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,YAAY,CAAC,UAAkB;IAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACrC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE;QAAE,OAAO,IAAI,CAAC;IACnE,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC5B,OAAO;QACL,UAAU,EAAE,GAAG;QACf,QAAQ,EAAE,WAAW,CAAC,GAAG,CAAC;QAC1B,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC;QACxB,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QACxB,IAAI,EAAE,QAAQ,CAAa,WAAW,CAAC,GAAG,CAAC,CAAC;QAC5C,GAAG,EAAE,QAAQ,CAAY,UAAU,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,EAAE,EAAE,CAAC,IAAI;QACb,OAAO,EAAE,EAAE,CAAC,OAAO;KACpB,CAAC;AACJ,CAAC;AAED,2CAA2C;AAC3C,SAAgB,gBAAgB,CAAC,MAAc,mBAAW;IACxD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,OAAO,EAAE;SACN,WAAW,CAAC,GAAG,CAAC;SAChB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;SACpC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACxC,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACnC,OAAO;YACL,UAAU;YACV,QAAQ,EAAE,WAAW,CAAC,UAAU,CAAC;YACjC,OAAO,EAAE,UAAU,CAAC,UAAU,CAAC;YAC/B,IAAI;YACJ,IAAI,EAAE,QAAQ,CAAa,WAAW,CAAC,UAAU,CAAC,CAAC;YACnD,GAAG,EAAE,QAAQ,CAAY,UAAU,CAAC,UAAU,CAAC,CAAC;YAChD,IAAI,EAAE,EAAE,CAAC,IAAI;YACb,OAAO,EAAE,EAAE,CAAC,OAAO;SACpB,CAAC;IACJ,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;AAC3C,CAAC;AAID;;;;;GAKG;AACH,SAAgB,QAAQ,CAAC,CAAc,EAAE,MAAY,IAAI,IAAI,EAAE;IAC7D,IAAI,CAAC,CAAC,CAAC,GAAG;QAAE,OAAO,UAAU,CAAC;IAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC/C,OAAO,OAAO,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AACxD,CAAC;AAED,SAAgB,SAAS,CAAC,KAAa;IACrC,OAAO,GAAG,CAAC,KAAK,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;AACpD,CAAC;AAED,gFAAgF;AAChF,SAAgB,GAAG,CAAC,GAAoB,EAAE,MAAY,IAAI,IAAI,EAAE;IAC9D,MAAM,CAAC,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,GAAG,CAAC;IACpC,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IAC9D,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,GAAG,CAAC,GAAG,CAAC;IAC3B,IAAI,CAAC,GAAG,IAAI;QAAE,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC;IAC9C,IAAI,CAAC,GAAG,KAAK;QAAE,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC;IACjD,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC;AACrC,CAAC;AAED,oEAAoE;AACpE,SAAgB,eAAe,CAAC,CAAc,EAAE,MAAY,IAAI,IAAI,EAAE;IACpE,IAAI,CAAC,CAAC,CAAC,GAAG;QAAE,OAAO,CAAC,CAAC;IACrB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,CAAC,CAAC;IACxC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,gGAAgG;AAChG,SAAgB,cAAc,CAAC,CAAc,EAAE,MAAY,IAAI,IAAI,EAAE;IACnE,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAClF,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;IACzG,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,SAAS,IAAI,SAAS,CAAC;IAC9C,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IACjD,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/B,MAAM,MAAM,GACV,KAAK,KAAK,UAAU;QAClB,CAAC,CAAC,UAAU;QACZ,CAAC,CAAC,KAAK,KAAK,SAAS;YACnB,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,GAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,gBAAgB;YACrD,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,GAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,gBAAgB,eAAe,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC;IACtF,OAAO,GAAG,IAAI,KAAK,GAAG,KAAK,MAAM,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,MAAM,EAAE,CAAC;AAC/E,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAgB,sBAAsB,CACpC,MAAc,mBAAW,EACzB,MAAY,IAAI,IAAI,EAAE;IAEtB,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,IAAI,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,SAAS;YAAE,SAAS;QAC7C,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YACzB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,6DAA6D;QAC/D,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,SAAgB,YAAY,CAAC,MAAc,mBAAW,EAAE,OAAe,oBAAY;IACjF,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;YACtD,IAAI,CAAC;gBACH,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;oBAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YACzC,CAAC;YAAC,MAAM,CAAC;gBACP,qDAAqD;YACvD,CAAC;QACH,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/lib/utils/context.d.ts

@@ -0,0 +1,88 @@
+/**
+ * Project identity and onboarding stage — the one module the resolver, the
+ * splash and the shell all read.
+ *
+ * ── The problem this solves ─────────────────────────────────────────────────
+ *
+ * The CLI had no noun for "the project you are working on". Nine commands
+ * hard-required `--app-id <uuid>`, there was no config file, no
+ * `SCALEBUN_APP_ID`, and one credentials file with no notion of which app it
+ * belonged to. Every command therefore started by pasting a 25-character id
+ * copied out of a browser.
+ *
+ * ── Derive, never store ─────────────────────────────────────────────────────
+ *
+ * The onboarding stage below is DERIVED from facts on disk, not recorded as
+ * progress flags. A stored "user finished quickstart" bit lies the moment
+ * reality moves: a new machine loses it, a deleted key contradicts it, and an
+ * experienced developer opening a brand-new repo gets told they are an expert
+ * exactly when they need the wiring steps. Deriving costs a few `existsSync`
+ * calls, is always true, and is naturally per-project — which is the right
+ * granularity, because expertise does not transfer between checkouts.
+ *
+ * Everything here is SYNCHRONOUS and LOCAL. The splash renders on every bare
+ * invocation, so a network call in this path would tax every single run.
+ */
+/** Written by `scalebun link`. Lives at the project root, beside package.json. */
+export declare const PROJECT_FILE = "scalebun.json";
+export interface ProjectConfig {
+    /** The app every command in this directory defaults to. */
+    appId?: string;
+    /** Human label, cached so the prompt can say "WZB Pay" not a cuid. */
+    appName?: string;
+    /** Channel default for publish/promote. */
+    channel?: string;
+    /**
+     * Last known release count for this app. A CACHE, not a progress flag: it is
+     * refreshed by any command that happens to fetch releases and self-corrects
+     * on the next one. Absent simply means "not seen yet".
+     */
+    releaseCount?: number;
+}
+export type Stage = 0 | 1 | 2 | 3 | 4;
+export interface Context {
+    /** 0 fresh · 1 signed in · 2 bound · 3 wired · 4 operating */
+    stage: Stage;
+    loggedIn: boolean;
+    email?: string;
+    /** Resolved app id, from flag > env > scalebun.json. Not from the network. */
+    appId?: string;
+    appName?: string;
+    channel?: string;
+    /** Directory holding scalebun.json, or null when this is not a linked project. */
+    projectRoot: string | null;
+    /** True when an android/ or ios/ directory exists here. */
+    isNativeProject: boolean;
+    platforms: Array<'android' | 'ios'>;
+    /** Per-platform OTA wiring, from the same greps `doctor` performs. */
+    wired: {
+        android: boolean | null;
+        ios: boolean | null;
+    };
+    /** True when a signing key exists locally. */
+    hasSigningKey: boolean;
+    releaseCount: number | null;
+}
+/** Walk up from `cwd` looking for scalebun.json. Stops at the filesystem root. */
+export declare function findProjectRoot(cwd?: string): string | null;
+/** Read scalebun.json from `root`, or null when absent/corrupt. */
+export declare function readProjectConfig(root: string | null): ProjectConfig | null;
+/** Write scalebun.json, merging over whatever is already there. */
+export declare function writeProjectConfig(root: string, patch: ProjectConfig): ProjectConfig;
+/**
+ * Record the release count seen by a command that already fetched releases.
+ * Best-effort: a read-only checkout must not fail a command over a cache write.
+ */
+export declare function cacheReleaseCount(count: number, cwd?: string): void;
+/**
+ * Build the context for the current directory.
+ *
+ * @param opts.appId an explicit `--app-id` flag, which always wins.
+ */
+export declare function getContext(opts?: {
+    appId?: string;
+    cwd?: string;
+}): Context;
+/** One-line label for the shell prompt and the splash: "WZB Pay/production". */
+export declare function contextLabel(ctx: Context): string | null;
+//# sourceMappingURL=context.d.ts.map

package/lib/utils/context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/utils/context.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,kFAAkF;AAClF,eAAO,MAAM,YAAY,kBAAkB,CAAC;AAE5C,MAAM,WAAW,aAAa;IAC5B,2DAA2D;IAC3D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2CAA2C;IAC3C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAEtC,MAAM,WAAW,OAAO;IACtB,8DAA8D;IAC9D,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kFAAkF;IAClF,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,2DAA2D;IAC3D,eAAe,EAAE,OAAO,CAAC;IACzB,SAAS,EAAE,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,CAAC;IACpC,sEAAsE;IACtE,KAAK,EAAE;QAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;QAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC;IACxD,8CAA8C;IAC9C,aAAa,EAAE,OAAO,CAAC;IACvB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,kFAAkF;AAClF,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAsB,GAAG,MAAM,GAAG,IAAI,CAU1E;AAED,mEAAmE;AACnE,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,aAAa,GAAG,IAAI,CAY3E;AAED,mEAAmE;AACnE,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,aAAa,CAQpF;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,GAAE,MAAsB,GAAG,IAAI,CAQlF;AA6DD;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CA2C/E;AAED,gFAAgF;AAChF,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAIxD"}

package/lib/utils/context.js

@@ -0,0 +1,247 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PROJECT_FILE = void 0;
+exports.findProjectRoot = findProjectRoot;
+exports.readProjectConfig = readProjectConfig;
+exports.writeProjectConfig = writeProjectConfig;
+exports.cacheReleaseCount = cacheReleaseCount;
+exports.getContext = getContext;
+exports.contextLabel = contextLabel;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const credentials_1 = require("./credentials");
+/**
+ * Project identity and onboarding stage — the one module the resolver, the
+ * splash and the shell all read.
+ *
+ * ── The problem this solves ─────────────────────────────────────────────────
+ *
+ * The CLI had no noun for "the project you are working on". Nine commands
+ * hard-required `--app-id <uuid>`, there was no config file, no
+ * `SCALEBUN_APP_ID`, and one credentials file with no notion of which app it
+ * belonged to. Every command therefore started by pasting a 25-character id
+ * copied out of a browser.
+ *
+ * ── Derive, never store ─────────────────────────────────────────────────────
+ *
+ * The onboarding stage below is DERIVED from facts on disk, not recorded as
+ * progress flags. A stored "user finished quickstart" bit lies the moment
+ * reality moves: a new machine loses it, a deleted key contradicts it, and an
+ * experienced developer opening a brand-new repo gets told they are an expert
+ * exactly when they need the wiring steps. Deriving costs a few `existsSync`
+ * calls, is always true, and is naturally per-project — which is the right
+ * granularity, because expertise does not transfer between checkouts.
+ *
+ * Everything here is SYNCHRONOUS and LOCAL. The splash renders on every bare
+ * invocation, so a network call in this path would tax every single run.
+ */
+/** Written by `scalebun link`. Lives at the project root, beside package.json. */
+exports.PROJECT_FILE = 'scalebun.json';
+/** Walk up from `cwd` looking for scalebun.json. Stops at the filesystem root. */
+function findProjectRoot(cwd = process.cwd()) {
+    let dir = path.resolve(cwd);
+    // Bounded by the root check below; a symlink loop cannot spin here because
+    // path.dirname always shortens or returns the same string at the root.
+    for (;;) {
+        if (fs.existsSync(path.join(dir, exports.PROJECT_FILE)))
+            return dir;
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            return null;
+        dir = parent;
+    }
+}
+/** Read scalebun.json from `root`, or null when absent/corrupt. */
+function readProjectConfig(root) {
+    if (!root)
+        return null;
+    try {
+        const raw = fs.readFileSync(path.join(root, exports.PROJECT_FILE), 'utf8');
+        const parsed = JSON.parse(raw);
+        // A hand-edited file that is valid JSON but not an object must not crash
+        // every command in the directory.
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+            return null;
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+/** Write scalebun.json, merging over whatever is already there. */
+function writeProjectConfig(root, patch) {
+    const existing = readProjectConfig(root) ?? {};
+    const merged = { ...existing, ...patch };
+    fs.writeFileSync(path.join(root, exports.PROJECT_FILE), JSON.stringify(merged, null, 2) + '\n');
+    return merged;
+}
+/**
+ * Record the release count seen by a command that already fetched releases.
+ * Best-effort: a read-only checkout must not fail a command over a cache write.
+ */
+function cacheReleaseCount(count, cwd = process.cwd()) {
+    const root = findProjectRoot(cwd);
+    if (!root)
+        return;
+    try {
+        writeProjectConfig(root, { releaseCount: count });
+    }
+    catch {
+        /* cache only */
+    }
+}
+/** Does this native source file already resolve the OTA slot? */
+function greppedWired(file, needle) {
+    try {
+        return fs.readFileSync(file, 'utf8').includes(needle);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Android wiring: MainApplication must call ScaleBunOtaModule.getJSBundleFile.
+ * Returns null when there is no android/ directory to judge.
+ */
+function androidWired(cwd) {
+    const dir = path.join(cwd, 'android');
+    if (!fs.existsSync(dir))
+        return null;
+    const candidates = [
+        'app/src/main/java',
+        'app/src/main/kotlin',
+    ].map((p) => path.join(dir, p));
+    for (const base of candidates) {
+        if (!fs.existsSync(base))
+            continue;
+        const found = findFile(base, /MainApplication\.(kt|java)$/);
+        if (found)
+            return greppedWired(found, 'ScaleBunOtaModule.getJSBundleFile');
+    }
+    return false;
+}
+/** iOS wiring: AppDelegate must resolve the slot via getBundleURL. */
+function iosWired(cwd) {
+    const dir = path.join(cwd, 'ios');
+    if (!fs.existsSync(dir))
+        return null;
+    const found = findFile(dir, /AppDelegate\.(swift|mm|m)$/, 3);
+    return found ? greppedWired(found, 'ScaleBunOtaModule.getBundleURL') : false;
+}
+/** Shallow recursive find, depth-bounded so a huge ios/Pods tree cannot stall the splash. */
+function findFile(dir, re, depth = 6) {
+    if (depth < 0)
+        return null;
+    let entries;
+    try {
+        entries = fs.readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return null;
+    }
+    for (const e of entries) {
+        const full = path.join(dir, e.name);
+        if (e.isFile() && re.test(e.name))
+            return full;
+    }
+    for (const e of entries) {
+        // Pods and build output contain thousands of files and never the app's own
+        // AppDelegate — skipping them is what keeps this under a few milliseconds.
+        if (!e.isDirectory() || e.name === 'Pods' || e.name === 'build' || e.name === 'node_modules')
+            continue;
+        const hit = findFile(path.join(dir, e.name), re, depth - 1);
+        if (hit)
+            return hit;
+    }
+    return null;
+}
+/**
+ * Build the context for the current directory.
+ *
+ * @param opts.appId an explicit `--app-id` flag, which always wins.
+ */
+function getContext(opts = {}) {
+    const cwd = opts.cwd ?? process.cwd();
+    const creds = (0, credentials_1.readCredentials)();
+    const projectRoot = findProjectRoot(cwd);
+    const project = readProjectConfig(projectRoot);
+    // Resolution order — explicit beats ambient beats stored.
+    const appId = opts.appId || process.env.SCALEBUN_APP_ID || project?.appId;
+    const platforms = [];
+    if (fs.existsSync(path.join(cwd, 'android')))
+        platforms.push('android');
+    if (fs.existsSync(path.join(cwd, 'ios')))
+        platforms.push('ios');
+    const wired = { android: androidWired(cwd), ios: iosWired(cwd) };
+    const hasSigningKey = fs.existsSync(path.join(cwd, '.scalebun', 'ota-signing-key.pem'));
+    const releaseCount = typeof project?.releaseCount === 'number' ? project.releaseCount : null;
+    // A project counts as wired when every platform it actually has is wired.
+    // An app with only android/ is fully wired once android is — demanding an
+    // ios/ directory it does not have would strand it at stage 2 forever.
+    const relevant = platforms.map((p) => wired[p]).filter((v) => v !== null);
+    const fullyWired = relevant.length > 0 && relevant.every(Boolean);
+    let stage = 0;
+    if (creds)
+        stage = 1;
+    if (creds && appId)
+        stage = 2;
+    if (creds && appId && fullyWired)
+        stage = 3;
+    if (creds && appId && fullyWired && (releaseCount ?? 0) > 0)
+        stage = 4;
+    return {
+        stage,
+        loggedIn: !!creds,
+        email: creds?.email,
+        appId,
+        appName: project?.appName,
+        channel: project?.channel,
+        projectRoot,
+        isNativeProject: platforms.length > 0,
+        platforms,
+        wired,
+        hasSigningKey,
+        releaseCount,
+    };
+}
+/** One-line label for the shell prompt and the splash: "WZB Pay/production". */
+function contextLabel(ctx) {
+    if (!ctx.appId)
+        return null;
+    const name = ctx.appName ?? ctx.appId;
+    return ctx.channel ? `${name}/${ctx.channel}` : name;
+}
+//# sourceMappingURL=context.js.map

package/lib/utils/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/utils/context.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwEA,0CAUC;AAGD,8CAYC;AAGD,gDAQC;AAMD,8CAQC;AAkED,gCA2CC;AAGD,oCAIC;AA9OD,uCAAyB;AACzB,2CAA6B;AAC7B,+CAAgD;AAEhD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,kFAAkF;AACrE,QAAA,YAAY,GAAG,eAAe,CAAC;AAwC5C,kFAAkF;AAClF,SAAgB,eAAe,CAAC,MAAc,OAAO,CAAC,GAAG,EAAE;IACzD,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5B,2EAA2E;IAC3E,uEAAuE;IACvE,SAAS,CAAC;QACR,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,oBAAY,CAAC,CAAC;YAAE,OAAO,GAAG,CAAC;QAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAChC,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;AACH,CAAC;AAED,mEAAmE;AACnE,SAAgB,iBAAiB,CAAC,IAAmB;IACnD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,oBAAY,CAAC,EAAE,MAAM,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;QAC1C,yEAAyE;QACzE,kCAAkC;QAClC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QAChF,OAAO,MAAuB,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,mEAAmE;AACnE,SAAgB,kBAAkB,CAAC,IAAY,EAAE,KAAoB;IACnE,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAC/C,MAAM,MAAM,GAAkB,EAAE,GAAG,QAAQ,EAAE,GAAG,KAAK,EAAE,CAAC;IACxD,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,oBAAY,CAAC,EAC7B,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CACvC,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,SAAgB,iBAAiB,CAAC,KAAa,EAAE,MAAc,OAAO,CAAC,GAAG,EAAE;IAC1E,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,IAAI;QAAE,OAAO;IAClB,IAAI,CAAC;QACH,kBAAkB,CAAC,IAAI,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,gBAAgB;IAClB,CAAC;AACH,CAAC;AAED,iEAAiE;AACjE,SAAS,YAAY,CAAC,IAAY,EAAE,MAAc;IAChD,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,GAAW;IAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACtC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,UAAU,GAAG;QACjB,mBAAmB;QACnB,qBAAqB;KACtB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS;QACnC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,6BAA6B,CAAC,CAAC;QAC5D,IAAI,KAAK;YAAE,OAAO,YAAY,CAAC,KAAK,EAAE,mCAAmC,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,sEAAsE;AACtE,SAAS,QAAQ,CAAC,GAAW;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAClC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,EAAE,4BAA4B,EAAE,CAAC,CAAC,CAAC;IAC7D,OAAO,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,gCAAgC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAC/E,CAAC;AAED,6FAA6F;AAC7F,SAAS,QAAQ,CAAC,GAAW,EAAE,EAAU,EAAE,KAAK,GAAG,CAAC;IAClD,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,OAAoB,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACjD,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,2EAA2E;QAC3E,2EAA2E;QAC3E,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc;YAAE,SAAS;QACvG,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QAC5D,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC;IACtB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,SAAgB,UAAU,CAAC,OAAyC,EAAE;IACpE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACtC,MAAM,KAAK,GAAG,IAAA,6BAAe,GAAE,CAAC;IAChC,MAAM,WAAW,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAE/C,0DAA0D;IAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,OAAO,EAAE,KAAK,CAAC;IAE1E,MAAM,SAAS,GAA6B,EAAE,CAAC;IAC/C,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAAE,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACxE,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAAE,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAEhE,MAAM,KAAK,GAAG,EAAE,OAAO,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;IACjE,MAAM,aAAa,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,qBAAqB,CAAC,CAAC,CAAC;IACxF,MAAM,YAAY,GAAG,OAAO,OAAO,EAAE,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;IAE7F,0EAA0E;IAC1E,0EAA0E;IAC1E,sEAAsE;IACtE,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAgB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IACxF,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAElE,IAAI,KAAK,GAAU,CAAC,CAAC;IACrB,IAAI,KAAK;QAAE,KAAK,GAAG,CAAC,CAAC;IACrB,IAAI,KAAK,IAAI,KAAK;QAAE,KAAK,GAAG,CAAC,CAAC;IAC9B,IAAI,KAAK,IAAI,KAAK,IAAI,UAAU;QAAE,KAAK,GAAG,CAAC,CAAC;IAC5C,IAAI,KAAK,IAAI,KAAK,IAAI,UAAU,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,GAAG,CAAC;QAAE,KAAK,GAAG,CAAC,CAAC;IAEvE,OAAO;QACL,KAAK;QACL,QAAQ,EAAE,CAAC,CAAC,KAAK;QACjB,KAAK,EAAE,KAAK,EAAE,KAAK;QACnB,KAAK;QACL,OAAO,EAAE,OAAO,EAAE,OAAO;QACzB,OAAO,EAAE,OAAO,EAAE,OAAO;QACzB,WAAW;QACX,eAAe,EAAE,SAAS,CAAC,MAAM,GAAG,CAAC;QACrC,SAAS;QACT,KAAK;QACL,aAAa;QACb,YAAY;KACb,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,SAAgB,YAAY,CAAC,GAAY;IACvC,IAAI,CAAC,GAAG,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC;IACtC,OAAO,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACvD,CAAC"}

package/lib/utils/credentials.d.ts

@@ -0,0 +1,59 @@
+/**
+ * The hosted ScaleBun backend. Used whenever no API URL is supplied — so login
+ * and CI need only a token. Override with --api-url or SCALEBUN_API_URL (e.g.
+ * self-hosted, staging, or http://localhost:3000/api/v1 for local dev). The
+ * /api/v1 suffix is required — without it every ingestion route 404s.
+ */
+export declare const DEFAULT_API_URL = "https://api.scalebun.com/api/v1";
+export interface Credentials {
+    apiUrl: string;
+    token: string;
+    /** Account email, captured at login for the status box. Optional: pre-1.10.1
+     *  logins and the CI env-var path don't have it. */
+    email?: string;
+}
+/**
+ * Read credentials. Priority:
+ *   1. SCALEBUN_TOKEN / SCALEBUN_API_TOKEN (+ optional SCALEBUN_API_URL) env vars (for CI)
+ *   2. ~/.scalebun/credentials.json (from `scalebun login`)
+ *
+ * `SCALEBUN_API_TOKEN` is the name the dashboard's CI/CD setup page issues and
+ * documents; `SCALEBUN_TOKEN` is the original CLI name. Both are accepted —
+ * `SCALEBUN_TOKEN` wins when both are set, so nothing that worked before breaks.
+ *
+ * The API URL is optional in both paths and defaults to DEFAULT_API_URL, so a
+ * bare token is enough to authenticate against the hosted backend.
+ */
+export declare function readCredentials(): Credentials | null;
+/**
+ * Store credentials to ~/.scalebun/credentials.json.
+ *
+ * The `mode: 0o600` below is real on macOS and Linux and a NO-OP ON WINDOWS —
+ * Node cannot express a Windows ACL through a Unix mode, so it silently drops
+ * it and the file lands with whatever the parent directory grants. That is how
+ * a token ends up readable by every other account on a shared machine while
+ * the code looks like it locked the file down. So on Windows the ACL is set
+ * explicitly afterwards, and a failure to do so is reported rather than
+ * swallowed: the user is entitled to know their token is sitting in a
+ * world-readable file.
+ */
+export declare function writeCredentials(creds: Credentials): void;
+/**
+ * Windows-only ACL tightening: drop inherited ACEs and grant the current user
+ * alone full control. On POSIX the file mode already did this and this is a
+ * no-op.
+ *
+ * Exported because the credentials file is not the only secret this CLI writes:
+ * `ota generate-key-pair` puts an RSA PRIVATE SIGNING KEY on disk, and for
+ * a while that file got only the POSIX `mode: 0o600` — which Node silently
+ * drops on Windows — while the (less valuable) access token got this full
+ * treatment. Every secret the CLI writes must go through here.
+ *
+ * @param file          absolute path of the just-written secret file
+ * @param whatItHolds   short description used in the failure warning, e.g.
+ *                      "an access token" / "your OTA signing private key"
+ */
+export declare function restrictToCurrentUser(file: string, whatItHolds: string): void;
+/** Delete stored credentials. */
+export declare function clearCredentials(): void;
+//# sourceMappingURL=credentials.d.ts.map