@scalebun-release/cli 2.5.0

package/lib/utils/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/utils/credentials.ts"],"names":[],"mappings":"AAQA;;;;;GAKG;AACH,eAAO,MAAM,eAAe,oCAAoC,CAAC;AAEjE,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd;wDACoD;IACpD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,IAAI,WAAW,GAAG,IAAI,CAiBpD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CAUzD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAuB7E;AAED,iCAAiC;AACjC,wBAAgB,gBAAgB,IAAI,IAAI,CAIvC"}

package/lib/utils/credentials.js

@@ -0,0 +1,147 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_API_URL = void 0;
+exports.readCredentials = readCredentials;
+exports.writeCredentials = writeCredentials;
+exports.restrictToCurrentUser = restrictToCurrentUser;
+exports.clearCredentials = clearCredentials;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const os = __importStar(require("os"));
+const childProcess = __importStar(require("child_process"));
+const CREDENTIALS_DIR = path.join(os.homedir(), '.scalebun');
+const CREDENTIALS_FILE = path.join(CREDENTIALS_DIR, 'credentials.json');
+/**
+ * The hosted ScaleBun backend. Used whenever no API URL is supplied — so login
+ * and CI need only a token. Override with --api-url or SCALEBUN_API_URL (e.g.
+ * self-hosted, staging, or http://localhost:3000/api/v1 for local dev). The
+ * /api/v1 suffix is required — without it every ingestion route 404s.
+ */
+exports.DEFAULT_API_URL = 'https://api.scalebun.com/api/v1';
+/**
+ * Read credentials. Priority:
+ *   1. SCALEBUN_TOKEN / SCALEBUN_API_TOKEN (+ optional SCALEBUN_API_URL) env vars (for CI)
+ *   2. ~/.scalebun/credentials.json (from `scalebun login`)
+ *
+ * `SCALEBUN_API_TOKEN` is the name the dashboard's CI/CD setup page issues and
+ * documents; `SCALEBUN_TOKEN` is the original CLI name. Both are accepted —
+ * `SCALEBUN_TOKEN` wins when both are set, so nothing that worked before breaks.
+ *
+ * The API URL is optional in both paths and defaults to DEFAULT_API_URL, so a
+ * bare token is enough to authenticate against the hosted backend.
+ */
+function readCredentials() {
+    // CI path: a token env var is enough; the URL is optional.
+    const envToken = process.env.SCALEBUN_TOKEN || process.env.SCALEBUN_API_TOKEN;
+    if (envToken) {
+        return { apiUrl: process.env.SCALEBUN_API_URL || exports.DEFAULT_API_URL, token: envToken };
+    }
+    // Interactive path: credentials file
+    if (!fs.existsSync(CREDENTIALS_FILE))
+        return null;
+    try {
+        const raw = fs.readFileSync(CREDENTIALS_FILE, 'utf-8');
+        const parsed = JSON.parse(raw);
+        if (!parsed.token)
+            return null;
+        return { apiUrl: parsed.apiUrl || exports.DEFAULT_API_URL, token: parsed.token, email: parsed.email };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Store credentials to ~/.scalebun/credentials.json.
+ *
+ * The `mode: 0o600` below is real on macOS and Linux and a NO-OP ON WINDOWS —
+ * Node cannot express a Windows ACL through a Unix mode, so it silently drops
+ * it and the file lands with whatever the parent directory grants. That is how
+ * a token ends up readable by every other account on a shared machine while
+ * the code looks like it locked the file down. So on Windows the ACL is set
+ * explicitly afterwards, and a failure to do so is reported rather than
+ * swallowed: the user is entitled to know their token is sitting in a
+ * world-readable file.
+ */
+function writeCredentials(creds) {
+    if (!fs.existsSync(CREDENTIALS_DIR)) {
+        fs.mkdirSync(CREDENTIALS_DIR, { recursive: true, mode: 0o700 });
+    }
+    fs.writeFileSync(CREDENTIALS_FILE, JSON.stringify(creds, null, 2) + '\n', { mode: 0o600 });
+    restrictToCurrentUser(CREDENTIALS_FILE, 'an access token');
+}
+/**
+ * Windows-only ACL tightening: drop inherited ACEs and grant the current user
+ * alone full control. On POSIX the file mode already did this and this is a
+ * no-op.
+ *
+ * Exported because the credentials file is not the only secret this CLI writes:
+ * `ota generate-key-pair` puts an RSA PRIVATE SIGNING KEY on disk, and for
+ * a while that file got only the POSIX `mode: 0o600` — which Node silently
+ * drops on Windows — while the (less valuable) access token got this full
+ * treatment. Every secret the CLI writes must go through here.
+ *
+ * @param file          absolute path of the just-written secret file
+ * @param whatItHolds   short description used in the failure warning, e.g.
+ *                      "an access token" / "your OTA signing private key"
+ */
+function restrictToCurrentUser(file, whatItHolds) {
+    if (process.platform !== 'win32')
+        return;
+    const user = process.env.USERNAME
+        ? `${process.env.USERDOMAIN ? `${process.env.USERDOMAIN}\\` : ''}${process.env.USERNAME}`
+        : null;
+    if (!user)
+        return;
+    try {
+        // /inheritance:r removes inherited permissions — without it the grant is
+        // added ON TOP of whatever the profile directory already allows, which is
+        // usually the point being missed.
+        childProcess.execFileSync('icacls', [file, '/inheritance:r', '/grant:r', `${user}:F`], { stdio: 'ignore', timeout: 10000 });
+    }
+    catch {
+        console.warn(`⚠️  Could not restrict permissions on ${file}.\n` +
+            `   It contains ${whatItHolds} in plaintext and may be readable by other\n` +
+            '   accounts on this machine. Fix it with:\n' +
+            `   icacls "${file}" /inheritance:r /grant:r "%USERNAME%:F"`);
+    }
+}
+/** Delete stored credentials. */
+function clearCredentials() {
+    if (fs.existsSync(CREDENTIALS_FILE)) {
+        fs.unlinkSync(CREDENTIALS_FILE);
+    }
+}
+//# sourceMappingURL=credentials.js.map

package/lib/utils/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/utils/credentials.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoCA,0CAiBC;AAcD,4CAUC;AAiBD,sDAuBC;AAGD,4CAIC;AA5HD,uCAAyB;AACzB,2CAA6B;AAC7B,uCAAyB;AACzB,4DAA8C;AAE9C,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,CAAC,CAAC;AAC7D,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,kBAAkB,CAAC,CAAC;AAExE;;;;;GAKG;AACU,QAAA,eAAe,GAAG,iCAAiC,CAAC;AAUjE;;;;;;;;;;;GAWG;AACH,SAAgB,eAAe;IAC7B,2DAA2D;IAC3D,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAC9E,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,uBAAe,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IACtF,CAAC;IAED,qCAAqC;IACrC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,uBAAe,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IAChG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAgB,gBAAgB,CAAC,KAAkB;IACjD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QACpC,EAAE,CAAC,SAAS,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,EAAE,CAAC,aAAa,CACd,gBAAgB,EAChB,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EACrC,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;IACF,qBAAqB,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAgB,qBAAqB,CAAC,IAAY,EAAE,WAAmB;IACrE,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO;IACzC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ;QAC/B,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE;QACzF,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,CAAC,IAAI;QAAE,OAAO;IAClB,IAAI,CAAC;QACH,yEAAyE;QACzE,0EAA0E;QAC1E,kCAAkC;QAClC,YAAY,CAAC,YAAY,CACvB,QAAQ,EACR,CAAC,IAAI,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,IAAI,IAAI,CAAC,EACjD,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAM,EAAE,CACrC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,IAAI,CACV,yCAAyC,IAAI,KAAK;YAChD,kBAAkB,WAAW,8CAA8C;YAC3E,6CAA6C;YAC7C,cAAc,IAAI,0CAA0C,CAC/D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,iCAAiC;AACjC,SAAgB,gBAAgB;IAC9B,IAAI,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACpC,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;IAClC,CAAC;AACH,CAAC"}

package/lib/utils/guide.d.ts

@@ -0,0 +1,63 @@
+import { Context } from './context';
+/**
+ * The command surface — one definition, three consumers.
+ *
+ * ── The problem ─────────────────────────────────────────────────────────────
+ *
+ * The old splash printed all 31 commands to everyone, every time. A first-time
+ * user could not tell which of thirty lines mattered, and `quickstart` — the
+ * one command that matters most — was line 14 of a wall of cyan.
+ *
+ * ── The fix ─────────────────────────────────────────────────────────────────
+ *
+ * Meet people where they are. Stage 0 shows ONE command; the grouped surface
+ * appears from stage 2, once a project is linked and the commands have
+ * something to act on. `scalebun help --all` always prints everything, so
+ * nobody is ever trapped in a tutorial.
+ *
+ * The stage is DERIVED (see context.ts) — never stored. A veteran opening a
+ * fresh repo is at stage 2 there, which is correct: they need the wiring steps
+ * in that checkout regardless of how many releases they have shipped elsewhere.
+ *
+ * ── Why GROUPS is data ──────────────────────────────────────────────────────
+ *
+ * The printed splash, `help --all`, and the interactive menu all describe the
+ * same commands. Written three times they drift — the menu offers a command
+ * the splash never mentions, or the splash advertises one the menu cannot
+ * reach, and nobody notices because each surface looks internally consistent.
+ * `argv` is the runnable form, so a menu entry cannot describe a command it is
+ * unable to launch.
+ */
+export interface CommandEntry {
+    /** Argv to run, e.g. ['ota', 'publish'] — the runnable truth. */
+    argv: string[];
+    desc: string;
+}
+export interface CommandGroup {
+    title: string;
+    /** One line for the group menu: what this group is for. */
+    summary: string;
+    commands: CommandEntry[];
+}
+export declare const GROUPS: CommandGroup[];
+/** How a command is written in prose and on the splash. */
+export declare function commandLabel(entry: CommandEntry): string;
+/**
+ * The stage hint as ONE line, for the interactive menu.
+ *
+ * The printed splash can afford a four-line NEXT block; a menu frame competing
+ * with the logo, the status box and five groups cannot. Losing it entirely
+ * would be worse — the ladder is what stops a newcomer from picking a command
+ * that cannot work yet — so it compresses rather than disappears.
+ */
+export declare function nextStepHint(ctx: Context): string | null;
+/** The one thing to do next, given the stage. */
+export declare function renderNextStep(ctx: Context): void;
+/** Every command, grouped by task. Printed at stage 2+ and by `help --all`. */
+export declare function renderAllCommands(): void;
+/** The stage-appropriate body of the splash. */
+export declare function renderGuide(ctx: Context): void;
+/** Context line for the splash and the session header. */
+export declare function contextLineText(ctx: Context): string | null;
+export declare function renderContextLine(ctx: Context): void;
+//# sourceMappingURL=guide.d.ts.map

package/lib/utils/guide.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guide.d.ts","sourceRoot":"","sources":["../../src/utils/guide.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAgB,MAAM,WAAW,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,MAAM,WAAW,YAAY;IAC3B,iEAAiE;IACjE,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,YAAY,EAAE,CAAC;CAC1B;AAED,eAAO,MAAM,MAAM,EAAE,YAAY,EA0DhC,CAAC;AAEF,2DAA2D;AAC3D,wBAAgB,YAAY,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,CAExD;AAKD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAkBxD;AAED,iDAAiD;AACjD,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CA4CjD;AAED,+EAA+E;AAC/E,wBAAgB,iBAAiB,IAAI,IAAI,CASxC;AAED,gDAAgD;AAChD,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAiB9C;AAED,0DAA0D;AAC1D,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAO3D;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAGpD"}

package/lib/utils/guide.js

@@ -0,0 +1,191 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GROUPS = void 0;
+exports.commandLabel = commandLabel;
+exports.nextStepHint = nextStepHint;
+exports.renderNextStep = renderNextStep;
+exports.renderAllCommands = renderAllCommands;
+exports.renderGuide = renderGuide;
+exports.contextLineText = contextLineText;
+exports.renderContextLine = renderContextLine;
+const chalk_1 = __importDefault(require("chalk"));
+const context_1 = require("./context");
+exports.GROUPS = [
+    {
+        title: 'SHIP',
+        summary: 'get a new bundle in front of devices',
+        commands: [
+            { argv: ['ota', 'publish'], desc: 'bundle, upload and publish a release' },
+            { argv: ['ota', 'promote'], desc: 'promote an uploaded bundle to a channel' },
+            { argv: ['ota', 'bundles'], desc: 'list uploaded bundles, newest first' },
+            { argv: ['ota', 'bundle', 'build'], desc: 'build a bundle file for manual upload' },
+            { argv: ['ota', 'sign'], desc: 'sign a built bundle so it can be uploaded from the dashboard' },
+        ],
+    },
+    {
+        title: 'CONTROL',
+        summary: 'change or stop what is already shipping',
+        commands: [
+            { argv: ['ota', 'rollout'], desc: 'set the rollout percentage' },
+            { argv: ['ota', 'pause'], desc: 'stop new devices receiving a release' },
+            { argv: ['ota', 'resume'], desc: 'resume a paused release' },
+            { argv: ['ota', 'rollback'], desc: 'revert a release for every device' },
+        ],
+    },
+    {
+        title: 'INSPECT',
+        summary: 'see what is live and what needs a decision',
+        commands: [
+            { argv: ['ota', 'status'], desc: 'what is live, and what needs a decision' },
+            { argv: ['ota', 'releases'], desc: 'list releases and their rollout state' },
+            { argv: ['apps'], desc: 'list your apps and their ids' },
+        ],
+    },
+    {
+        title: 'CONFIGURE',
+        summary: 'channels, signing keys, and deletions',
+        commands: [
+            { argv: ['ota', 'channels'], desc: 'list, create, rename or remove channels' },
+            { argv: ['ota', 'keys'], desc: 'list, register or revoke signing keys' },
+            { argv: ['ota', 'generate-key-pair'], desc: 'create an RSA-3072 signing key' },
+            { argv: ['ota', 'keys', 'verify'], desc: 'prove you hold the private half (activate a pending key)' },
+            { argv: ['ota', 'delete-bundle'], desc: 'delete a bundle permanently' },
+        ],
+    },
+    {
+        title: 'SETUP',
+        summary: 'sign in, bind the project, wire the native app',
+        commands: [
+            { argv: ['quickstart'], desc: 'guided first-release walkthrough' },
+            { argv: ['login'], desc: 'authenticate with an access token' },
+            { argv: ['logout'], desc: 'clear stored credentials' },
+            { argv: ['link'], desc: 'bind this project to an app' },
+            { argv: ['unlink'], desc: 'remove the app binding' },
+            { argv: ['init', 'android'], desc: 'wire the Android app for OTA' },
+            { argv: ['init', 'ios'], desc: 'wire the iOS app for OTA' },
+            { argv: ['doctor'], desc: 'check the project is OTA-ready' },
+            { argv: ['ci', 'init'], desc: 'generate a CI pipeline for publishing' },
+            { argv: ['migrate', 'codepush'], desc: 'migrate from Microsoft CodePush' },
+        ],
+    },
+];
+/** How a command is written in prose and on the splash. */
+function commandLabel(entry) {
+    return `scalebun ${entry.argv.join(' ')}`;
+}
+const cmd = (name, desc, pad = 32) => console.log(`   ${chalk_1.default.cyan(name.padEnd(pad))} ${chalk_1.default.dim(desc)}`);
+/**
+ * The stage hint as ONE line, for the interactive menu.
+ *
+ * The printed splash can afford a four-line NEXT block; a menu frame competing
+ * with the logo, the status box and five groups cannot. Losing it entirely
+ * would be worse — the ladder is what stops a newcomer from picking a command
+ * that cannot work yet — so it compresses rather than disappears.
+ */
+function nextStepHint(ctx) {
+    const line = (lead, command, why) => chalk_1.default.dim(`   ${lead}  `) + chalk_1.default.green(command) + chalk_1.default.dim(`  ${why}`);
+    switch (ctx.stage) {
+        case 0:
+            return line('start here', 'scalebun quickstart', 'sign in, pick an app, wire it, ship an update');
+        case 1:
+            return line('next', 'scalebun link', 'bind this project to an app');
+        case 2: {
+            const p = ctx.platforms.find((x) => ctx.wired[x] === false) ?? ctx.platforms[0] ?? 'android';
+            return line('next', `scalebun init ${p}`, 'updates install but never load until this is done');
+        }
+        case 3:
+            return line('next', 'scalebun ota publish', 'bundle, upload and ship your first update');
+        default:
+            return null;
+    }
+}
+/** The one thing to do next, given the stage. */
+function renderNextStep(ctx) {
+    console.log('');
+    switch (ctx.stage) {
+        case 0:
+            console.log(` ${chalk_1.default.bold.white('START HERE')}`);
+            console.log(`   ${chalk_1.default.green('scalebun quickstart')}   ${chalk_1.default.dim('sign in, pick an app, wire it, ship an update')}`);
+            console.log('');
+            console.log(chalk_1.default.dim('   One guided flow. Everything else becomes relevant once it finishes.'));
+            break;
+        case 1:
+            console.log(` ${chalk_1.default.bold.white('NEXT')}`);
+            console.log(`   ${chalk_1.default.green('scalebun link')}        ${chalk_1.default.dim('bind this project to an app — then --app-id is never needed')}`);
+            console.log('');
+            cmd('scalebun quickstart', 'or continue the guided flow', 22);
+            cmd('scalebun apps', 'list the apps you can publish to', 22);
+            break;
+        case 2: {
+            const p = ctx.platforms.find((x) => ctx.wired[x] === false) ?? ctx.platforms[0] ?? 'android';
+            console.log(` ${chalk_1.default.bold.white('NEXT')}`);
+            console.log(`   ${chalk_1.default.green('scalebun init ' + p)}   ${chalk_1.default.dim('wire the native app for OTA, then rebuild')}`);
+            console.log('');
+            console.log(chalk_1.default.dim('   Updates install but never load until this is done.'));
+            cmd('scalebun doctor', 'check what else this project needs', 22);
+            break;
+        }
+        case 3:
+            console.log(` ${chalk_1.default.bold.white('NEXT')}`);
+            console.log(`   ${chalk_1.default.green('scalebun ota publish')}   ${chalk_1.default.dim('bundle, upload and ship your first update')}`);
+            console.log('');
+            // Pad to 32 — the same column renderAllCommands uses, because the
+            // grouped surface now prints directly beneath this block.
+            if (!ctx.hasSigningKey) {
+                cmd('scalebun ota generate-key-pair', 'sign your bundles (recommended)');
+            }
+            cmd('scalebun doctor', 'verify the project once more');
+            break;
+        case 4:
+            // No hand-holding at stage 4 — the full surface follows.
+            break;
+    }
+}
+/** Every command, grouped by task. Printed at stage 2+ and by `help --all`. */
+function renderAllCommands() {
+    for (const g of exports.GROUPS) {
+        console.log('');
+        console.log(` ${chalk_1.default.bold.white(g.title)}`);
+        for (const c of g.commands)
+            cmd(commandLabel(c), c.desc);
+    }
+    console.log('');
+    console.log(chalk_1.default.dim(`   Every flag: ${chalk_1.default.cyan('scalebun <command> --help')}`));
+    console.log('');
+}
+/** The stage-appropriate body of the splash. */
+function renderGuide(ctx) {
+    renderNextStep(ctx);
+    // Stage 2 — linked — is where the map earns its space. Gating the grouped
+    // surface on stage 4 (a release already shipped) was too strict: it withheld
+    // the command list from exactly the person walking the setup path, who has
+    // committed to the tool and now wants to see what it does. Before stage 2
+    // there is no app bound, so most of the surface has nothing to act on and
+    // printing it buries the one step that does.
+    if (ctx.stage >= 2) {
+        renderAllCommands();
+        return;
+    }
+    console.log('');
+    console.log(chalk_1.default.dim(`   All commands: ${chalk_1.default.cyan('scalebun help --all')}`));
+    console.log('');
+}
+/** Context line for the splash and the session header. */
+function contextLineText(ctx) {
+    const label = (0, context_1.contextLabel)(ctx);
+    if (!label)
+        return null;
+    const wired = ctx.platforms
+        .map((p) => `${p} ${ctx.wired[p] ? chalk_1.default.green('wired') : chalk_1.default.yellow('not wired')}`)
+        .join(chalk_1.default.dim(' · '));
+    return chalk_1.default.dim('   project  ') + chalk_1.default.bold(label) + (wired ? chalk_1.default.dim('  ·  ') + wired : '');
+}
+function renderContextLine(ctx) {
+    const line = contextLineText(ctx);
+    if (line)
+        console.log(line);
+}
+//# sourceMappingURL=guide.js.map

package/lib/utils/guide.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guide.js","sourceRoot":"","sources":["../../src/utils/guide.ts"],"names":[],"mappings":";;;;;;AA2GA,oCAEC;AAaD,oCAkBC;AAGD,wCA4CC;AAGD,8CASC;AAGD,kCAiBC;AAGD,0CAOC;AAED,8CAGC;AA1OD,kDAA0B;AAC1B,uCAAkD;AA6CrC,QAAA,MAAM,GAAmB;IACpC;QACE,KAAK,EAAE,MAAM;QACb,OAAO,EAAE,sCAAsC;QAC/C,QAAQ,EAAE;YACR,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,IAAI,EAAE,sCAAsC,EAAE;YAC1E,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,IAAI,EAAE,yCAAyC,EAAE;YAC7E,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,IAAI,EAAE,qCAAqC,EAAE;YACzE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,uCAAuC,EAAE;YACnF,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,8DAA8D,EAAE;SAChG;KACF;IACD;QACE,KAAK,EAAE,SAAS;QAChB,OAAO,EAAE,yCAAyC;QAClD,QAAQ,EAAE;YACR,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,IAAI,EAAE,4BAA4B,EAAE;YAChE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,sCAAsC,EAAE;YACxE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE;YAC5D,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,IAAI,EAAE,mCAAmC,EAAE;SACzE;KACF;IACD;QACE,KAAK,EAAE,SAAS;QAChB,OAAO,EAAE,4CAA4C;QACrD,QAAQ,EAAE;YACR,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,yCAAyC,EAAE;YAC5E,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,IAAI,EAAE,uCAAuC,EAAE;YAC5E,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,8BAA8B,EAAE;SACzD;KACF;IACD;QACE,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,uCAAuC;QAChD,QAAQ,EAAE;YACR,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,IAAI,EAAE,yCAAyC,EAAE;YAC9E,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,uCAAuC,EAAE;YACxE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,mBAAmB,CAAC,EAAE,IAAI,EAAE,gCAAgC,EAAE;YAC9E,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,0DAA0D,EAAE;YACrG,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,eAAe,CAAC,EAAE,IAAI,EAAE,6BAA6B,EAAE;SACxE;KACF;IACD;QACE,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,gDAAgD;QACzD,QAAQ,EAAE;YACR,EAAE,IAAI,EAAE,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,kCAAkC,EAAE;YAClE,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,mCAAmC,EAAE;YAC9D,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE;YACtD,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,6BAA6B,EAAE;YACvD,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,wBAAwB,EAAE;YACpD,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,IAAI,EAAE,8BAA8B,EAAE;YACnE,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE;YAC3D,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,gCAAgC,EAAE;YAC5D,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,uCAAuC,EAAE;YACvE,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,IAAI,EAAE,iCAAiC,EAAE;SAC3E;KACF;CACF,CAAC;AAEF,2DAA2D;AAC3D,SAAgB,YAAY,CAAC,KAAmB;IAC9C,OAAO,YAAY,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AAC5C,CAAC;AAED,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,IAAY,EAAE,GAAG,GAAG,EAAE,EAAE,EAAE,CACnD,OAAO,CAAC,GAAG,CAAC,MAAM,eAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,eAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAEvE;;;;;;;GAOG;AACH,SAAgB,YAAY,CAAC,GAAY;IACvC,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,OAAe,EAAE,GAAW,EAAE,EAAE,CAC1D,eAAK,CAAC,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,eAAK,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,eAAK,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;IAE3E,QAAQ,GAAG,CAAC,KAAK,EAAE,CAAC;QAClB,KAAK,CAAC;YACJ,OAAO,IAAI,CAAC,YAAY,EAAE,qBAAqB,EAAE,+CAA+C,CAAC,CAAC;QACpG,KAAK,CAAC;YACJ,OAAO,IAAI,CAAC,MAAM,EAAE,eAAe,EAAE,6BAA6B,CAAC,CAAC;QACtE,KAAK,CAAC,CAAC,CAAC,CAAC;YACP,MAAM,CAAC,GAAG,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;YAC7F,OAAO,IAAI,CAAC,MAAM,EAAE,iBAAiB,CAAC,EAAE,EAAE,mDAAmD,CAAC,CAAC;QACjG,CAAC;QACD,KAAK,CAAC;YACJ,OAAO,IAAI,CAAC,MAAM,EAAE,sBAAsB,EAAE,2CAA2C,CAAC,CAAC;QAC3F;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,iDAAiD;AACjD,SAAgB,cAAc,CAAC,GAAY;IACzC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,QAAQ,GAAG,CAAC,KAAK,EAAE,CAAC;QAClB,KAAK,CAAC;YACJ,OAAO,CAAC,GAAG,CAAC,IAAI,eAAK,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;YAClD,OAAO,CAAC,GAAG,CAAC,MAAM,eAAK,CAAC,KAAK,CAAC,qBAAqB,CAAC,MAAM,eAAK,CAAC,GAAG,CAAC,+CAA+C,CAAC,EAAE,CAAC,CAAC;YACxH,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,GAAG,CAAC,wEAAwE,CAAC,CAAC,CAAC;YACjG,MAAM;QAER,KAAK,CAAC;YACJ,OAAO,CAAC,GAAG,CAAC,IAAI,eAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC5C,OAAO,CAAC,GAAG,CAAC,MAAM,eAAK,CAAC,KAAK,CAAC,eAAe,CAAC,WAAW,eAAK,CAAC,GAAG,CAAC,6DAA6D,CAAC,EAAE,CAAC,CAAC;YACrI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,GAAG,CAAC,qBAAqB,EAAE,6BAA6B,EAAE,EAAE,CAAC,CAAC;YAC9D,GAAG,CAAC,eAAe,EAAE,kCAAkC,EAAE,EAAE,CAAC,CAAC;YAC7D,MAAM;QAER,KAAK,CAAC,CAAC,CAAC,CAAC;YACP,MAAM,CAAC,GAAG,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;YAC7F,OAAO,CAAC,GAAG,CAAC,IAAI,eAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC5C,OAAO,CAAC,GAAG,CAAC,MAAM,eAAK,CAAC,KAAK,CAAC,gBAAgB,GAAG,CAAC,CAAC,MAAM,eAAK,CAAC,GAAG,CAAC,2CAA2C,CAAC,EAAE,CAAC,CAAC;YACnH,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,GAAG,CAAC,uDAAuD,CAAC,CAAC,CAAC;YAChF,GAAG,CAAC,iBAAiB,EAAE,oCAAoC,EAAE,EAAE,CAAC,CAAC;YACjE,MAAM;QACR,CAAC;QAED,KAAK,CAAC;YACJ,OAAO,CAAC,GAAG,CAAC,IAAI,eAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC5C,OAAO,CAAC,GAAG,CAAC,MAAM,eAAK,CAAC,KAAK,CAAC,sBAAsB,CAAC,MAAM,eAAK,CAAC,GAAG,CAAC,2CAA2C,CAAC,EAAE,CAAC,CAAC;YACrH,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,kEAAkE;YAClE,0DAA0D;YAC1D,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;gBACvB,GAAG,CAAC,gCAAgC,EAAE,iCAAiC,CAAC,CAAC;YAC3E,CAAC;YACD,GAAG,CAAC,iBAAiB,EAAE,8BAA8B,CAAC,CAAC;YACvD,MAAM;QAER,KAAK,CAAC;YACJ,yDAAyD;YACzD,MAAM;IACV,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,SAAgB,iBAAiB;IAC/B,KAAK,MAAM,CAAC,IAAI,cAAM,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,IAAI,eAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC7C,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ;YAAE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,GAAG,CAAC,kBAAkB,eAAK,CAAC,IAAI,CAAC,2BAA2B,CAAC,EAAE,CAAC,CAAC,CAAC;IACpF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,gDAAgD;AAChD,SAAgB,WAAW,CAAC,GAAY;IACtC,cAAc,CAAC,GAAG,CAAC,CAAC;IAEpB,0EAA0E;IAC1E,6EAA6E;IAC7E,2EAA2E;IAC3E,0EAA0E;IAC1E,0EAA0E;IAC1E,6CAA6C;IAC7C,IAAI,GAAG,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;QACnB,iBAAiB,EAAE,CAAC;QACpB,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,GAAG,CAAC,oBAAoB,eAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC,CAAC;IAChF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,0DAA0D;AAC1D,SAAgB,eAAe,CAAC,GAAY;IAC1C,MAAM,KAAK,GAAG,IAAA,sBAAY,EAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,KAAK,GAAG,GAAG,CAAC,SAAS;SACxB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,eAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,eAAK,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;SACrF,IAAI,CAAC,eAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1B,OAAO,eAAK,CAAC,GAAG,CAAC,cAAc,CAAC,GAAG,eAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,eAAK,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACnG,CAAC;AAED,SAAgB,iBAAiB,CAAC,GAAY;IAC5C,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,IAAI;QAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC"}

package/lib/utils/hash.d.ts

@@ -0,0 +1,3 @@
+/** Compute SHA-256 hex digest of a file. */
+export declare function sha256File(filePath: string): string;
+//# sourceMappingURL=hash.d.ts.map

package/lib/utils/hash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash.d.ts","sourceRoot":"","sources":["../../src/utils/hash.ts"],"names":[],"mappings":"AAGA,4CAA4C;AAC5C,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGnD"}

package/lib/utils/hash.js

@@ -0,0 +1,44 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sha256File = sha256File;
+const crypto = __importStar(require("crypto"));
+const fs = __importStar(require("fs"));
+/** Compute SHA-256 hex digest of a file. */
+function sha256File(filePath) {
+    const content = fs.readFileSync(filePath);
+    return crypto.createHash('sha256').update(content).digest('hex');
+}
+//# sourceMappingURL=hash.js.map

package/lib/utils/hash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash.js","sourceRoot":"","sources":["../../src/utils/hash.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAIA,gCAGC;AAPD,+CAAiC;AACjC,uCAAyB;AAEzB,4CAA4C;AAC5C,SAAgB,UAAU,CAAC,QAAgB;IACzC,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC1C,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC"}

package/lib/utils/native-id.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Best-effort detection of the binary's native application id — the Android
+ * `applicationId` or the iOS bundle identifier.
+ *
+ * Why the CLI cares: a signed OTA release (SB-OTA-RSA-SHA256-V1) is identified by
+ * this value, and the device's native verifier rejects any release whose
+ * `applicationId` does not equal its own package name. The server stores it as
+ * `apps.bundleId`, but that column is optional at app creation, so most apps have
+ * it null. By reading the real id out of the project and sending it at presign,
+ * the backend can self-heal the app record on the first publish — no manual data
+ * entry, and no confusing "backend did not return release identity" failure.
+ *
+ * Returns `undefined` when it cannot be determined (a monorepo layout, a
+ * non-standard project, etc.); the caller simply omits the field.
+ */
+export declare function detectNativeApplicationId(platform: string, cwd?: string): string | undefined;
+//# sourceMappingURL=native-id.d.ts.map

package/lib/utils/native-id.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-id.d.ts","sourceRoot":"","sources":["../../src/utils/native-id.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,MAAM,EAChB,GAAG,GAAE,MAAsB,GAC1B,MAAM,GAAG,SAAS,CAQpB"}

package/lib/utils/native-id.js

@@ -0,0 +1,105 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectNativeApplicationId = detectNativeApplicationId;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+/**
+ * Best-effort detection of the binary's native application id — the Android
+ * `applicationId` or the iOS bundle identifier.
+ *
+ * Why the CLI cares: a signed OTA release (SB-OTA-RSA-SHA256-V1) is identified by
+ * this value, and the device's native verifier rejects any release whose
+ * `applicationId` does not equal its own package name. The server stores it as
+ * `apps.bundleId`, but that column is optional at app creation, so most apps have
+ * it null. By reading the real id out of the project and sending it at presign,
+ * the backend can self-heal the app record on the first publish — no manual data
+ * entry, and no confusing "backend did not return release identity" failure.
+ *
+ * Returns `undefined` when it cannot be determined (a monorepo layout, a
+ * non-standard project, etc.); the caller simply omits the field.
+ */
+function detectNativeApplicationId(platform, cwd = process.cwd()) {
+    try {
+        if (platform === 'android')
+            return detectAndroidApplicationId(cwd);
+        if (platform === 'ios')
+            return detectIosBundleId(cwd);
+    }
+    catch {
+        // Detection is a convenience, never a hard dependency — never throw.
+    }
+    return undefined;
+}
+function detectAndroidApplicationId(cwd) {
+    const gradlePath = path.join(cwd, 'android', 'app', 'build.gradle');
+    if (!fs.existsSync(gradlePath))
+        return undefined;
+    const gradle = fs.readFileSync(gradlePath, 'utf8');
+    // `applicationId "com.example.app"` (or single quotes). Prefer applicationId;
+    // fall back to `namespace` which RN's defaultConfig derives the id from when
+    // applicationId is omitted.
+    const appId = matchQuoted(gradle, /applicationId\s+["']([^"']+)["']/) ??
+        matchQuoted(gradle, /namespace\s+["']([^"']+)["']/);
+    return appId;
+}
+function detectIosBundleId(cwd) {
+    const iosDir = path.join(cwd, 'ios');
+    if (!fs.existsSync(iosDir))
+        return undefined;
+    // Find the app's project.pbxproj (…/<App>.xcodeproj/project.pbxproj).
+    const xcodeproj = fs
+        .readdirSync(iosDir)
+        .find((name) => name.endsWith('.xcodeproj'));
+    if (!xcodeproj)
+        return undefined;
+    const pbxPath = path.join(iosDir, xcodeproj, 'project.pbxproj');
+    if (!fs.existsSync(pbxPath))
+        return undefined;
+    const pbx = fs.readFileSync(pbxPath, 'utf8');
+    // Collect every PRODUCT_BUNDLE_IDENTIFIER, drop test/extension targets, and
+    // prefer a literal id over an unresolved `$(...)` variable.
+    const ids = Array.from(pbx.matchAll(/PRODUCT_BUNDLE_IDENTIFIER\s*=\s*"?([^";]+)"?;/g))
+        .map((m) => m[1].trim())
+        .filter((id) => id.length > 0 &&
+        !/\.(Tests|UITests|test|ShareExtension|watchkit)/i.test(id));
+    const literal = ids.find((id) => !id.includes('$('));
+    return literal ?? ids[0];
+}
+function matchQuoted(src, re) {
+    const m = src.match(re);
+    return m ? m[1].trim() : undefined;
+}
+//# sourceMappingURL=native-id.js.map

package/lib/utils/native-id.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-id.js","sourceRoot":"","sources":["../../src/utils/native-id.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkBA,8DAWC;AA7BD,uCAAyB;AACzB,2CAA6B;AAE7B;;;;;;;;;;;;;;GAcG;AACH,SAAgB,yBAAyB,CACvC,QAAgB,EAChB,MAAc,OAAO,CAAC,GAAG,EAAE;IAE3B,IAAI,CAAC;QACH,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,0BAA0B,CAAC,GAAG,CAAC,CAAC;QACnE,IAAI,QAAQ,KAAK,KAAK;YAAE,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;IACvE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,0BAA0B,CAAC,GAAW;IAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC;IACpE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,SAAS,CAAC;IACjD,MAAM,MAAM,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAEnD,8EAA8E;IAC9E,6EAA6E;IAC7E,4BAA4B;IAC5B,MAAM,KAAK,GACT,WAAW,CAAC,MAAM,EAAE,kCAAkC,CAAC;QACvD,WAAW,CAAC,MAAM,EAAE,8BAA8B,CAAC,CAAC;IACtD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAW;IACpC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACrC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAE7C,sEAAsE;IACtE,MAAM,SAAS,GAAG,EAAE;SACjB,WAAW,CAAC,MAAM,CAAC;SACnB,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;IAC/C,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACjC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAChE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9C,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAE7C,4EAA4E;IAC5E,4DAA4D;IAC5D,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CACpB,GAAG,CAAC,QAAQ,CAAC,gDAAgD,CAAC,CAC/D;SACE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACvB,MAAM,CACL,CAAC,EAAE,EAAE,EAAE,CACL,EAAE,CAAC,MAAM,GAAG,CAAC;QACb,CAAC,iDAAiD,CAAC,IAAI,CAAC,EAAE,CAAC,CAC9D,CAAC;IACJ,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACrD,OAAO,OAAO,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,WAAW,CAAC,GAAW,EAAE,EAAU;IAC1C,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACxB,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACrC,CAAC"}