@scalebun-release/cli 2.5.0

package/lib/utils/transportSecurity.js

@@ -0,0 +1,74 @@
+"use strict";
+/**
+ * HTTPS enforcement for everything the CLI authenticates to.
+ *
+ * WHAT WAS WRONG. The API client picked its transport straight off the URL
+ * scheme — `parsed.protocol === 'https:' ? https : http` — with nothing
+ * requiring HTTPS in the first place, and every request attaches
+ * `Authorization: Bearer <token>`. `scalebun login` accepts an arbitrary
+ * `--api-url` and POSTs an email and password to it. So a CLI pointed at an
+ * `http://` URL — by a typo, a copied CI snippet, or a tampered config —
+ * would put a personal access token, or the user's actual password, on the
+ * wire in cleartext, with no warning and no failure.
+ *
+ * THE RULE. Credentials only travel over TLS. The single exception is
+ * loopback, because local development against `http://localhost:3000` is a
+ * real workflow and traffic that never leaves the machine cannot be
+ * intercepted on the network. Anything else is refused before a socket is
+ * opened, rather than warned about — a warning printed above a successful
+ * request is not a control.
+ *
+ * Loopback is matched on resolved literals, not on name. `localhost` and the
+ * reserved 127/8 and ::1 literals are loopback by definition; an arbitrary
+ * hostname that merely happens to resolve to 127.0.0.1 today is not, because
+ * whoever controls the DNS answer controls where the token goes tomorrow.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InsecureApiUrlError = void 0;
+exports.assertSecureApiUrl = assertSecureApiUrl;
+/** Hostnames that are loopback by specification rather than by resolution. */
+const LOOPBACK_HOSTNAMES = new Set(['localhost', '127.0.0.1', '::1', '[::1]']);
+function isLoopback(hostname) {
+    const h = hostname.toLowerCase();
+    if (LOOPBACK_HOSTNAMES.has(h))
+        return true;
+    // The whole of 127.0.0.0/8 is loopback, not just 127.0.0.1.
+    return /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(h);
+}
+class InsecureApiUrlError extends Error {
+    constructor(url, hostname) {
+        super(`Refusing to send credentials over an unencrypted connection to ${url}\n` +
+            `  The CLI attaches your access token to every request, and "http://" would\n` +
+            `  put it on the wire in cleartext where anyone on the network can read it.\n` +
+            `\n` +
+            `  Use https://${hostname} instead.\n` +
+            `  (Plain http:// is allowed only for localhost / 127.0.0.1 during local development.)`);
+        this.name = 'InsecureApiUrlError';
+    }
+}
+exports.InsecureApiUrlError = InsecureApiUrlError;
+/**
+ * Validate an API base URL before it is used or persisted.
+ *
+ * @returns the normalised URL (trailing slashes stripped)
+ * @throws InsecureApiUrlError for a non-loopback `http://` URL
+ * @throws Error for a URL that is malformed or uses a non-HTTP scheme
+ */
+function assertSecureApiUrl(rawUrl) {
+    let parsed;
+    try {
+        parsed = new URL(rawUrl);
+    }
+    catch {
+        throw new Error(`Not a valid API URL: ${rawUrl}`);
+    }
+    if (parsed.protocol === 'https:')
+        return rawUrl.replace(/\/+$/, '');
+    if (parsed.protocol === 'http:') {
+        if (isLoopback(parsed.hostname))
+            return rawUrl.replace(/\/+$/, '');
+        throw new InsecureApiUrlError(rawUrl, parsed.hostname);
+    }
+    throw new Error(`Unsupported API URL scheme "${parsed.protocol}" in ${rawUrl} — expected https://`);
+}
+//# sourceMappingURL=transportSecurity.js.map

package/lib/utils/transportSecurity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transportSecurity.js","sourceRoot":"","sources":["../../src/utils/transportSecurity.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;;;AAiCH,gDAkBC;AAjDD,8EAA8E;AAC9E,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AAE/E,SAAS,UAAU,CAAC,QAAgB;IAClC,MAAM,CAAC,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACjC,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,4DAA4D;IAC5D,OAAO,kCAAkC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,MAAa,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,GAAW,EAAE,QAAgB;QACvC,KAAK,CACH,kEAAkE,GAAG,IAAI;YACvE,8EAA8E;YAC9E,8EAA8E;YAC9E,IAAI;YACJ,iBAAiB,QAAQ,aAAa;YACtC,uFAAuF,CAC1F,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAZD,kDAYC;AAED;;;;;;GAMG;AACH,SAAgB,kBAAkB,CAAC,MAAc;IAC/C,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,wBAAwB,MAAM,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAEpE,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAChC,IAAI,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC;YAAE,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACnE,MAAM,IAAI,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,IAAI,KAAK,CACb,+BAA+B,MAAM,CAAC,QAAQ,QAAQ,MAAM,sBAAsB,CACnF,CAAC;AACJ,CAAC"}

package/lib/utils/trustAnchor.d.ts

@@ -0,0 +1,109 @@
+/**
+ * The native trust anchor: the public half of your signing key, compiled into
+ * the app so the device can refuse anything it did not authorise.
+ *
+ * Each platform reads a different file from a different place, and both fail
+ * the same way when it is missing — an empty registry, which means every
+ * release is refused with UNKNOWN_KEY_ID.
+ *
+ *   Android  android/app/src/main/assets/scalebun_ota_keys.json
+ *            In `assets/`, NOT `res/raw/`. The registry reads it with
+ *            `context.assets.open()`; a file in res/raw is invisible to that
+ *            call, so enforcement is silently off — the app still runs, still
+ *            updates, and simply verifies nothing.
+ *
+ *   iOS      ios/<App>/ScaleBunOtaKeys.json
+ *            Read with `Bundle.main.url(forResource:withExtension:)`, so it
+ *            must be a member of the app target's Copy Bundle Resources phase.
+ *            Writing the file is not enough: Xcode ships only what the target
+ *            references, and a file sitting beside the sources that nobody
+ *            added is not in the .app at all. isInXcodeResources() below exists
+ *            to catch exactly that.
+ *
+ * The filenames differ by platform, and the iOS one is `.json`. Earlier CLI
+ * output told people to add `ScaleBunOtaKeys.plist`, which no code has ever
+ * read — following it produced UNKNOWN_KEY_ID with nothing to point at.
+ */
+export interface TrustAnchor {
+    /**
+     * The PROJECT id, not the app id. The verifier compares this against the
+     * signed release's projectId and refuses on PROJECT_MISMATCH. Both ids are
+     * `cm…` cuids and are trivially confused, which is exactly why callers should
+     * be handed this value rather than asked for it.
+     */
+    projectId: string;
+    keys: Array<{
+        keyId: string;
+        publicKey: string;
+    }>;
+}
+export declare const ANDROID_ANCHOR_RELATIVE: string;
+/** `ScaleBunOtaKeyRegistry.defaultResource` + ".json", on the iOS side. */
+export declare const IOS_ANCHOR_FILENAME = "ScaleBunOtaKeys.json";
+export interface WriteAnchorResult {
+    path: string;
+    /** Key ids trusted after the write, in file order. */
+    keyIds: string[];
+    /** True when an existing anchor was read and its other keys preserved. */
+    merged: boolean;
+}
+export interface WriteIosAnchorResult extends WriteAnchorResult {
+    /**
+     * False when project.pbxproj does not mention the file yet.
+     *
+     * This is the iOS-specific trap, and the reason the flag exists: the anchor
+     * can be written perfectly and still not ship, because Xcode copies only what
+     * the target references. The device then finds no resource, builds an empty
+     * registry, and refuses every release with UNKNOWN_KEY_ID — while a
+     * correct-looking file sits right there in the source tree.
+     */
+    inXcodeResources: boolean;
+}
+export declare function writeAndroidTrustAnchor(opts: {
+    cwd: string;
+    projectId: string;
+    keyId: string;
+    publicKeyPem: string;
+}): WriteAnchorResult;
+/** `ios/<App>.xcodeproj`, or null when there is no iOS project here. */
+export declare function findXcodeProject(cwd: string): string | null;
+/**
+ * The folder the app's own sources live in — `ios/<App>/`.
+ *
+ * Xcode groups mirror the filesystem here by React Native convention, so that
+ * is where a new resource belongs if it is going to be easy to add to the
+ * target. Falls back to whichever folder holds the AppDelegate, for projects
+ * renamed away from their directory.
+ */
+export declare function iosAppSourceDir(cwd: string): string | null;
+/**
+ * Is the anchor already referenced by the Xcode project?
+ *
+ * A substring check over project.pbxproj rather than a real parse: the question
+ * is only "has anyone added this filename", and erring toward "no" costs one
+ * extra printing of the instructions.
+ */
+export declare function isInXcodeResources(cwd: string): boolean;
+/**
+ * Add a key to the iOS trust anchor, creating the file if needed.
+ *
+ * Writes into `ios/<App>/` and reports whether the project references it yet.
+ * Adding it to the target is left to the caller: that means editing
+ * project.pbxproj, and a corrupted pbxproj costs far more than the single drag
+ * it would save.
+ */
+export declare function writeIosTrustAnchor(opts: {
+    cwd: string;
+    projectId: string;
+    keyId: string;
+    publicKeyPem: string;
+}): WriteIosAnchorResult;
+/**
+ * Does this look like a native Android project we can write into? Used to skip
+ * the anchor with a clear message instead of scattering directories into
+ * whatever folder the user happened to run from.
+ */
+export declare function hasAndroidProject(cwd: string): boolean;
+/** The iOS counterpart: an `ios/` folder with an actual Xcode project in it. */
+export declare function hasIosProject(cwd: string): boolean;
+//# sourceMappingURL=trustAnchor.d.ts.map

package/lib/utils/trustAnchor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trustAnchor.d.ts","sourceRoot":"","sources":["../../src/utils/trustAnchor.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;;OAKG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACnD;AAED,eAAO,MAAM,uBAAuB,QAOnC,CAAC;AAEF,2EAA2E;AAC3E,eAAO,MAAM,mBAAmB,yBAAyB,CAAC;AAE1D,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,sDAAsD;IACtD,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,0EAA0E;IAC1E,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,oBAAqB,SAAQ,iBAAiB;IAC7D;;;;;;;;OAQG;IACH,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AA2CD,wBAAgB,uBAAuB,CAAC,IAAI,EAAE;IAC5C,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;CACtB,GAAG,iBAAiB,CAEpB;AAED,wEAAwE;AACxE,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAK3D;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAgB1D;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAUvD;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;CACtB,GAAG,oBAAoB,CASvB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEtD;AAED,gFAAgF;AAChF,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAElD"}

package/lib/utils/trustAnchor.js

@@ -0,0 +1,169 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IOS_ANCHOR_FILENAME = exports.ANDROID_ANCHOR_RELATIVE = void 0;
+exports.writeAndroidTrustAnchor = writeAndroidTrustAnchor;
+exports.findXcodeProject = findXcodeProject;
+exports.iosAppSourceDir = iosAppSourceDir;
+exports.isInXcodeResources = isInXcodeResources;
+exports.writeIosTrustAnchor = writeIosTrustAnchor;
+exports.hasAndroidProject = hasAndroidProject;
+exports.hasIosProject = hasIosProject;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+exports.ANDROID_ANCHOR_RELATIVE = path.join('android', 'app', 'src', 'main', 'assets', 'scalebun_ota_keys.json');
+/** `ScaleBunOtaKeyRegistry.defaultResource` + ".json", on the iOS side. */
+exports.IOS_ANCHOR_FILENAME = 'ScaleBunOtaKeys.json';
+/**
+ * Add a key to an anchor file, creating it if needed.
+ *
+ * Merges rather than overwrites: during a rotation two keys are valid at once,
+ * and clobbering the old one strands every device still running the previous
+ * build — they would refuse the next release and have no way back. A key with
+ * the same keyId is replaced in place so re-running is idempotent.
+ */
+function writeAnchorAt(anchorPath, opts) {
+    fs.mkdirSync(path.dirname(anchorPath), { recursive: true });
+    let keys = [];
+    let merged = false;
+    if (fs.existsSync(anchorPath)) {
+        try {
+            const existing = JSON.parse(fs.readFileSync(anchorPath, 'utf8'));
+            if (Array.isArray(existing?.keys)) {
+                keys = existing.keys.filter((k) => k && typeof k.keyId === 'string' && typeof k.publicKey === 'string');
+                merged = keys.length > 0;
+            }
+        }
+        catch {
+            // Unreadable or hand-mangled: start clean rather than fail setup. The
+            // file is regenerable — the private key is the irreplaceable half.
+            keys = [];
+        }
+    }
+    keys = keys.filter((k) => k.keyId !== opts.keyId);
+    keys.push({ keyId: opts.keyId, publicKey: opts.publicKeyPem.trim() });
+    const anchor = { projectId: opts.projectId, keys };
+    fs.writeFileSync(anchorPath, JSON.stringify(anchor, null, 2) + '\n');
+    return { path: anchorPath, keyIds: keys.map((k) => k.keyId), merged };
+}
+function writeAndroidTrustAnchor(opts) {
+    return writeAnchorAt(path.join(opts.cwd, exports.ANDROID_ANCHOR_RELATIVE), opts);
+}
+/** `ios/<App>.xcodeproj`, or null when there is no iOS project here. */
+function findXcodeProject(cwd) {
+    const iosDir = path.join(cwd, 'ios');
+    if (!fs.existsSync(iosDir))
+        return null;
+    const proj = fs.readdirSync(iosDir).find((name) => name.endsWith('.xcodeproj'));
+    return proj ? path.join(iosDir, proj) : null;
+}
+/**
+ * The folder the app's own sources live in — `ios/<App>/`.
+ *
+ * Xcode groups mirror the filesystem here by React Native convention, so that
+ * is where a new resource belongs if it is going to be easy to add to the
+ * target. Falls back to whichever folder holds the AppDelegate, for projects
+ * renamed away from their directory.
+ */
+function iosAppSourceDir(cwd) {
+    const proj = findXcodeProject(cwd);
+    if (!proj)
+        return null;
+    const iosDir = path.join(cwd, 'ios');
+    const byName = path.join(iosDir, path.basename(proj, '.xcodeproj'));
+    if (fs.existsSync(byName) && fs.statSync(byName).isDirectory())
+        return byName;
+    for (const entry of fs.readdirSync(iosDir)) {
+        const dir = path.join(iosDir, entry);
+        if (!fs.existsSync(dir) || !fs.statSync(dir).isDirectory())
+            continue;
+        const hasDelegate = fs
+            .readdirSync(dir)
+            .some((f) => /^AppDelegate\.(swift|mm?|h)$/.test(f));
+        if (hasDelegate)
+            return dir;
+    }
+    return null;
+}
+/**
+ * Is the anchor already referenced by the Xcode project?
+ *
+ * A substring check over project.pbxproj rather than a real parse: the question
+ * is only "has anyone added this filename", and erring toward "no" costs one
+ * extra printing of the instructions.
+ */
+function isInXcodeResources(cwd) {
+    const proj = findXcodeProject(cwd);
+    if (!proj)
+        return false;
+    const pbx = path.join(proj, 'project.pbxproj');
+    if (!fs.existsSync(pbx))
+        return false;
+    try {
+        return fs.readFileSync(pbx, 'utf8').includes(exports.IOS_ANCHOR_FILENAME);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Add a key to the iOS trust anchor, creating the file if needed.
+ *
+ * Writes into `ios/<App>/` and reports whether the project references it yet.
+ * Adding it to the target is left to the caller: that means editing
+ * project.pbxproj, and a corrupted pbxproj costs far more than the single drag
+ * it would save.
+ */
+function writeIosTrustAnchor(opts) {
+    const dir = iosAppSourceDir(opts.cwd);
+    if (!dir) {
+        throw new Error('No ios/<App> source directory found — is this a React Native project with a native iOS app?');
+    }
+    const res = writeAnchorAt(path.join(dir, exports.IOS_ANCHOR_FILENAME), opts);
+    return { ...res, inXcodeResources: isInXcodeResources(opts.cwd) };
+}
+/**
+ * Does this look like a native Android project we can write into? Used to skip
+ * the anchor with a clear message instead of scattering directories into
+ * whatever folder the user happened to run from.
+ */
+function hasAndroidProject(cwd) {
+    return fs.existsSync(path.join(cwd, 'android', 'app'));
+}
+/** The iOS counterpart: an `ios/` folder with an actual Xcode project in it. */
+function hasIosProject(cwd) {
+    return iosAppSourceDir(cwd) !== null;
+}
+//# sourceMappingURL=trustAnchor.js.map

package/lib/utils/trustAnchor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trustAnchor.js","sourceRoot":"","sources":["../../src/utils/trustAnchor.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkHA,0DAOC;AAGD,4CAKC;AAUD,0CAgBC;AASD,gDAUC;AAUD,kDAcC;AAOD,8CAEC;AAGD,sCAEC;AApND,uCAAyB;AACzB,2CAA6B;AAuChB,QAAA,uBAAuB,GAAG,IAAI,CAAC,IAAI,CAC9C,SAAS,EACT,KAAK,EACL,KAAK,EACL,MAAM,EACN,QAAQ,EACR,wBAAwB,CACzB,CAAC;AAEF,2EAA2E;AAC9D,QAAA,mBAAmB,GAAG,sBAAsB,CAAC;AAuB1D;;;;;;;GAOG;AACH,SAAS,aAAa,CACpB,UAAkB,EAClB,IAAgE;IAEhE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE5D,IAAI,IAAI,GAAwB,EAAE,CAAC;IACnC,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAyB,CAAC;YACzF,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC;gBAClC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CACzB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,CAC3E,CAAC;gBACF,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,sEAAsE;YACtE,mEAAmE;YACnE,IAAI,GAAG,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC;IAClD,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAEtE,MAAM,MAAM,GAAgB,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;IAChE,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAErE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;AACxE,CAAC;AAED,SAAgB,uBAAuB,CAAC,IAKvC;IACC,OAAO,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,+BAAuB,CAAC,EAAE,IAAI,CAAC,CAAC;AAC3E,CAAC;AAED,wEAAwE;AACxE,SAAgB,gBAAgB,CAAC,GAAW;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACrC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,IAAI,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;IAChF,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/C,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,eAAe,CAAC,GAAW;IACzC,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC;IACpE,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE;QAAE,OAAO,MAAM,CAAC;IAE9E,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;YAAE,SAAS;QACrE,MAAM,WAAW,GAAG,EAAE;aACnB,WAAW,CAAC,GAAG,CAAC;aAChB,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,8BAA8B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACvD,IAAI,WAAW;YAAE,OAAO,GAAG,CAAC;IAC9B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,kBAAkB,CAAC,GAAW;IAC5C,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;IAC/C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,2BAAmB,CAAC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,mBAAmB,CAAC,IAKnC;IACC,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,6FAA6F,CAC9F,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,2BAAmB,CAAC,EAAE,IAAI,CAAC,CAAC;IACrE,OAAO,EAAE,GAAG,GAAG,EAAE,gBAAgB,EAAE,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AACpE,CAAC;AAED;;;;GAIG;AACH,SAAgB,iBAAiB,CAAC,GAAW;IAC3C,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,gFAAgF;AAChF,SAAgB,aAAa,CAAC,GAAW;IACvC,OAAO,eAAe,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC;AACvC,CAAC"}

package/lib/utils/ui.d.ts

@@ -0,0 +1,12 @@
+/**
+ * The status box as a string.
+ *
+ * The interactive session redraws the whole screen on every keypress, and it
+ * does that with ONE write — a sequence of console.log calls would tear
+ * visibly as the terminal painted each line. Returning text lets the session
+ * compose a frame; `renderStatus` below keeps the print-and-exit path
+ * unchanged, so the two can never drift.
+ */
+export declare function statusText(): string;
+export declare function renderStatus(): void;
+//# sourceMappingURL=ui.d.ts.map

package/lib/utils/ui.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ui.d.ts","sourceRoot":"","sources":["../../src/utils/ui.ts"],"names":[],"mappings":"AAYA;;;;;;;;GAQG;AACH,wBAAgB,UAAU,IAAI,MAAM,CA8BnC;AAED,wBAAgB,YAAY,IAAI,IAAI,CAEnC"}

package/lib/utils/ui.js

@@ -0,0 +1,60 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.statusText = statusText;
+exports.renderStatus = renderStatus;
+const chalk_1 = __importDefault(require("chalk"));
+const credentials_1 = require("./credentials");
+// NOTE: the splash art (mark + wordmark) now lives in ../ui/banner.ts. This file
+// keeps only the status box and command table — the body of the no-arg command.
+// Column arithmetic must measure the RENDERED width, not the string length —
+// coloured content carries ANSI escapes that take zero columns. Strip them first,
+// or the right border lands on a different column on every row.
+const STRIP_ANSI = /\x1b\[[0-9;]*m/g;
+const visibleLen = (s) => s.replace(STRIP_ANSI, '').length;
+/**
+ * The status box as a string.
+ *
+ * The interactive session redraws the whole screen on every keypress, and it
+ * does that with ONE write — a sequence of console.log calls would tear
+ * visibly as the terminal painted each line. Returning text lets the session
+ * compose a frame; `renderStatus` below keeps the print-and-exit path
+ * unchanged, so the two can never drift.
+ */
+function statusText() {
+    const out = [];
+    const creds = (0, credentials_1.readCredentials)();
+    const verbose = process.argv.slice(2).includes('--verbose');
+    const inner = 58;
+    const border = (l, r) => out.push(chalk_1.default.gray(l + '─'.repeat(inner + 2) + r));
+    const row = (content) => {
+        const pad = ' '.repeat(Math.max(0, inner - visibleLen(content)));
+        out.push(`${chalk_1.default.gray('│')} ${content}${pad} ${chalk_1.default.gray('│')}`);
+    };
+    border('┌', '┐');
+    if (creds) {
+        row(chalk_1.default.bold.green('● AUTHENTICATED'));
+        // The account you're signed in as (captured at login; absent for pre-1.10.1
+        // logins and the CI env-var path).
+        if (creds.email)
+            row(chalk_1.default.dim(creds.email));
+        // Show the API target only when it is NOT the default production backend
+        // (someone pointed at staging / self-hosted / localhost needs to see where
+        // their deploy is going), or under --verbose. On production it is noise.
+        if (verbose || creds.apiUrl !== credentials_1.DEFAULT_API_URL) {
+            row(`${chalk_1.default.dim('API')} ${chalk_1.default.cyan(creds.apiUrl)}`);
+        }
+    }
+    else {
+        row(`${chalk_1.default.bold.yellow('○ NOT LOGGED IN')} ${chalk_1.default.dim('· run')} ${chalk_1.default.cyan('scalebun login')}`);
+    }
+    border('└', '┘');
+    out.push('');
+    return out.join('\n') + '\n';
+}
+function renderStatus() {
+    process.stdout.write(statusText());
+}
+//# sourceMappingURL=ui.js.map

package/lib/utils/ui.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ui.js","sourceRoot":"","sources":["../../src/utils/ui.ts"],"names":[],"mappings":";;;;;AAqBA,gCA8BC;AAED,oCAEC;AAvDD,kDAA0B;AAC1B,+CAAiE;AAEjE,iFAAiF;AACjF,gFAAgF;AAEhF,6EAA6E;AAC7E,kFAAkF;AAClF,gEAAgE;AAChE,MAAM,UAAU,GAAG,iBAAiB,CAAC;AACrC,MAAM,UAAU,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC;AAE3E;;;;;;;;GAQG;AACH,SAAgB,UAAU;IACxB,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,KAAK,GAAG,IAAA,6BAAe,GAAE,CAAC;IAChC,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG,EAAE,CAAC;IAEjB,MAAM,MAAM,GAAG,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,eAAK,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7F,MAAM,GAAG,GAAG,CAAC,OAAe,EAAE,EAAE;QAC9B,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACjE,GAAG,CAAC,IAAI,CAAC,GAAG,eAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,OAAO,GAAG,GAAG,IAAI,eAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACrE,CAAC,CAAC;IAEF,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACjB,IAAI,KAAK,EAAE,CAAC;QACV,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACzC,4EAA4E;QAC5E,mCAAmC;QACnC,IAAI,KAAK,CAAC,KAAK;YAAE,GAAG,CAAC,eAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7C,yEAAyE;QACzE,2EAA2E;QAC3E,yEAAyE;QACzE,IAAI,OAAO,IAAI,KAAK,CAAC,MAAM,KAAK,6BAAe,EAAE,CAAC;YAChD,GAAG,CAAC,GAAG,eAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,eAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,GAAG,eAAK,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,eAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,eAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;IACvG,CAAC;IACD,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACjB,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACb,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAC/B,CAAC;AAED,SAAgB,YAAY;IAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;AACrC,CAAC"}

package/lib/utils/validate.d.ts

@@ -0,0 +1,62 @@
+/** The allowed value closest to `raw`, when one is close enough to mean it. */
+export declare function nearest(raw: string, allowed: readonly string[]): string | null;
+export interface EnumOpts {
+    /** Accept any letter case, normalising to the allowed spelling. */
+    caseInsensitive?: boolean;
+    /** Extra guidance printed under the error. */
+    details?: string[];
+}
+/**
+ * One of `allowed`, or exit.
+ *
+ * Replaces `if (opts.x === 'known')` chains, where an unrecognised value is
+ * indistinguishable from the flag not being passed at all.
+ */
+export declare function checkedEnum<T extends string>(flag: string, raw: string, allowed: readonly T[], opts?: EnumOpts): T;
+export interface IntOpts {
+    min?: number;
+    max?: number;
+    /** Used when the flag was omitted entirely. Never used to paper over junk. */
+    fallback?: number;
+    details?: string[];
+}
+/**
+ * A whole number in range, or exit.
+ *
+ * `Number('12abc')` is NaN and `Number('')` is 0 — both of which a `|| default`
+ * turns into a plausible-looking value the user never asked for. Everything
+ * that is not cleanly an integer is refused here instead.
+ */
+export declare function checkedInt(flag: string, raw: unknown, opts?: IntOpts): number;
+/**
+ * A rollout percentage, 0-100.
+ *
+ * A trailing `%` is accepted because it is the obvious thing to type for a
+ * value the help text calls a percentage, and refusing it teaches nothing.
+ */
+export declare function checkedPercent(flag: string, raw: unknown, fallback?: number): number;
+/**
+ * An identifier, or exit.
+ *
+ * Catches the two ways ids arrive broken: an empty value from an unquoted
+ * shell variable that did not expand (`--app-id $APP` with APP unset becomes
+ * `--app-id` swallowing the NEXT flag), and a value with whitespace or a
+ * leading dash from a mis-quoted paste. Both otherwise reach the API and come
+ * back as a confusing 404.
+ */
+export declare function checkedId(flag: string, raw: unknown): string;
+/**
+ * A semver range the server will accept, or exit.
+ *
+ * Deliberately loose. Ranges legitimately look like `1.0.0`, `^1.0.0`,
+ * `>=1.0.0`, `1.x`, `>=1.0.0 <2.0.0` and `*`, and a strict grammar here would
+ * reject valid input the API would have taken. The check is only for the
+ * shapes that are certainly wrong — empty, or containing no version at all —
+ * because those come back as a 400 describing a field the user never typed.
+ */
+export declare function checkedVersionRange(flag: string, raw: unknown): string;
+/** Non-empty free text, or exit. Trims, so a whitespace-only value is empty. */
+export declare function checkedText(flag: string, raw: unknown, opts?: {
+    max?: number;
+}): string;
+//# sourceMappingURL=validate.d.ts.map

package/lib/utils/validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/utils/validate.ts"],"names":[],"mappings":"AAoDA,+EAA+E;AAC/E,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CAc9E;AAED,MAAM,WAAW,QAAQ;IACvB,mEAAmE;IACnE,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,8CAA8C;IAC9C,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,CAAC,SAAS,MAAM,EAC1C,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,SAAS,CAAC,EAAE,EACrB,IAAI,GAAE,QAAa,GAClB,CAAC,CAcH;AAED,MAAM,WAAW,OAAO;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,GAAE,OAAY,GAAG,MAAM,CAgCjF;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAQpF;AAED;;;;;;;;GAQG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,MAAM,CAgB5D;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,MAAM,CAiBtE;AAED,gFAAgF;AAChF,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,MAAM,CAO3F"}