@scalebun-release/cli 2.5.0

package/lib/commands/doctor.js

@@ -0,0 +1,559 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findStaticHostConstruction = findStaticHostConstruction;
+exports.registerDoctorCommand = registerDoctorCommand;
+exports.runDoctor = runDoctor;
+const fs = __importStar(require("fs"));
+const crypto = __importStar(require("crypto"));
+const path = __importStar(require("path"));
+const chalk_1 = __importDefault(require("chalk"));
+const output_1 = require("../utils/output");
+const credentials_1 = require("../utils/credentials");
+const client_1 = require("../api/client");
+const bundle_1 = require("../utils/bundle");
+const findings = [];
+function report(level, title, detail) {
+    findings.push({ level, title, detail });
+    // Under --json the findings array IS the output; printing icons alongside it
+    // would corrupt the document a pipeline is trying to parse.
+    if ((0, output_1.isJson)())
+        return;
+    const icon = level === 'ok' ? '✅' : level === 'warn' ? '⚠️ ' : '❌';
+    console.log(`${icon} ${title}`);
+    if (detail)
+        console.log(`     ${detail.split('\n').join('\n     ')}`);
+}
+/** Find the first file matching `names` under `dir`, skipping heavy folders. */
+function findFile(dir, names, maxDepth = 6) {
+    if (maxDepth < 0 || !fs.existsSync(dir))
+        return null;
+    let entries;
+    try {
+        entries = fs.readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return null;
+    }
+    for (const e of entries) {
+        if (e.isFile() && names.includes(e.name))
+            return path.join(dir, e.name);
+    }
+    for (const e of entries) {
+        if (!e.isDirectory())
+            continue;
+        if (['node_modules', 'Pods', 'build', '.git', '.gradle'].includes(e.name))
+            continue;
+        const hit = findFile(path.join(dir, e.name), names, maxDepth - 1);
+        if (hit)
+            return hit;
+    }
+    return null;
+}
+/**
+ * iOS app sources that build the React host with a STATIC bundle URL.
+ *
+ * RCTHost DOES re-resolve on reload — `_reloadWithShouldRestartSurfaces` calls
+ * `_bundleURLProvider()` again — but only through the provider it was handed.
+ * `initWithBundleURL:` wraps a constant in a block returning that same constant
+ * forever (RCTRootViewFactory.mm), so a host built that way can never see a
+ * bundle that did not exist at launch.
+ *
+ * The symptom is precise and very confusing: the update downloads, verifies,
+ * applies, `restartApp()` runs, every OTA metric reports success — and the app
+ * comes back on the OLD bundle, while a cold start loads it correctly.
+ *
+ * Matched on whole-file text, not per line, because these initialisers are
+ * routinely wrapped across lines. Only the STATIC forms match:
+ * `initWithBundleURLBlock:` / `initWithBundleURLProvider:` / `bundleURLProvider:`
+ * are the dynamic ones, and the trailing colon keeps them out.
+ */
+function findStaticHostConstruction(iosDir) {
+    const hits = [];
+    const patterns = [
+        /\[\s*\[\s*(?:RCTHost|RCTRootViewFactory|RCTRootViewFactoryConfiguration)\s+alloc\s*\]\s*initWithBundleURL:/g,
+        /\b(?:RCTHost|RCTRootViewFactory|RCTRootViewFactoryConfiguration)\s*\(\s*bundleURL\s*:/g,
+    ];
+    const walk = (dir, depth) => {
+        if (depth < 0)
+            return;
+        let entries;
+        try {
+            entries = fs.readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const e of entries) {
+            const full = path.join(dir, e.name);
+            if (e.isDirectory()) {
+                // Pods is RN's own source — it legitimately contains both initialisers,
+                // and reporting React Native to the user as their bug helps nobody.
+                if (['Pods', 'build', 'DerivedData', '.git'].includes(e.name))
+                    continue;
+                if (/\.(xcodeproj|xcworkspace|framework|xcframework)$/.test(e.name))
+                    continue;
+                walk(full, depth - 1);
+                continue;
+            }
+            if (!/\.(swift|m|mm)$/.test(e.name))
+                continue;
+            let src;
+            try {
+                src = fs.readFileSync(full, 'utf8');
+            }
+            catch {
+                continue;
+            }
+            for (const re of patterns) {
+                re.lastIndex = 0;
+                let m;
+                while ((m = re.exec(src)) !== null) {
+                    const line = src.slice(0, m.index).split('\n').length;
+                    hits.push({
+                        file: full,
+                        line,
+                        text: (src.split('\n')[line - 1] ?? '').trim(),
+                    });
+                }
+            }
+        }
+    };
+    walk(iosDir, 5);
+    return hits;
+}
+/**
+ * The public half of the local signing key, as the hex the SDK wants.
+ *
+ * ed25519 SPKI is a fixed 12-byte header followed by the 32-byte key, so the
+ * raw value is the tail. Returns null rather than throwing: a key file that
+ * cannot be parsed is worth reporting as "pin your key" with a placeholder,
+ * not as a crashed doctor.
+ */
+function derivePublicKeyHex(privateKeyPath) {
+    try {
+        const priv = crypto.createPrivateKey(fs.readFileSync(privateKeyPath));
+        const der = crypto.createPublicKey(priv).export({ type: 'spki', format: 'der' });
+        return Buffer.from(der.subarray(der.length - 32)).toString('hex');
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Does this project pin a signing key anywhere the SDK would read?
+ *
+ * Deliberately a text search across config and source rather than an attempt to
+ * resolve the app's real init call: the key can legitimately arrive from
+ * app.json, an Expo config plugin, a native constant or a JS literal, and a
+ * check that only understood one of those would report a false alarm for every
+ * app that chose another. A mention is enough to stop nagging; the warning's
+ * job is to catch the app that has never heard of the setting.
+ */
+function pinsSigningKey(cwd) {
+    const needle = /publicSigningKeys?\s*[:=]/;
+    const roots = ['app.json', 'app.config.js', 'app.config.ts', 'scalebun.json', 'src', 'app'];
+    const seen = (dir, depth) => {
+        if (depth < 0)
+            return false;
+        let entries;
+        try {
+            entries = fs.readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return false;
+        }
+        for (const e of entries) {
+            const full = path.join(dir, e.name);
+            if (e.isFile() && /\.(ts|tsx|js|jsx|json|kt|java|swift|m|mm)$/.test(e.name)) {
+                try {
+                    if (needle.test(fs.readFileSync(full, 'utf8')))
+                        return true;
+                }
+                catch {
+                    /* unreadable file proves nothing */
+                }
+            }
+            else if (e.isDirectory() && !['node_modules', 'Pods', 'build', '.git'].includes(e.name)) {
+                if (seen(full, depth - 1))
+                    return true;
+            }
+        }
+        return false;
+    };
+    for (const r of roots) {
+        const full = path.join(cwd, r);
+        if (!fs.existsSync(full))
+            continue;
+        if (fs.statSync(full).isDirectory()) {
+            if (seen(full, 4))
+                return true;
+        }
+        else {
+            try {
+                if (needle.test(fs.readFileSync(full, 'utf8')))
+                    return true;
+            }
+            catch {
+                /* ignore */
+            }
+        }
+    }
+    // Native config counts too — that is in fact the RIGHT place for it.
+    for (const nat of ['android/app/src/main', 'ios']) {
+        const full = path.join(cwd, nat);
+        if (fs.existsSync(full) && seen(full, 5))
+            return true;
+    }
+    return false;
+}
+function parseMinor(version) {
+    if (!version)
+        return null;
+    const m = /^(\d+)\.(\d+)/.exec(version);
+    return m ? [Number(m[1]), Number(m[2])] : null;
+}
+function registerDoctorCommand(program) {
+    program
+        .command('doctor')
+        .description('Check that this project is correctly set up for OTA updates')
+        .option('--json', 'Machine-readable findings; exit 3 when a check blocks')
+        .action(() => runDoctor());
+}
+/**
+ * All doctor checks as a reusable step (`quickstart` runs it inline).
+ * Same contract as the command: exits the process on a blocking failure.
+ */
+async function runDoctor() {
+    findings.length = 0; // reusable across calls in one process
+    {
+        const cwd = process.cwd();
+        // Guarded: a banner on stdout ahead of the JSON body makes the whole
+        // document unparseable, which is the usual way --json ships broken.
+        if (!(0, output_1.isJson)())
+            console.log('\nScalebun doctor\n');
+        // ── 1. Credentials ─────────────────────────────────────────────────────
+        const creds = (0, credentials_1.readCredentials)();
+        if (!creds) {
+            report('fail', 'Not logged in', 'Run `scalebun login`, or set SCALEBUN_TOKEN + SCALEBUN_API_URL in CI.');
+        }
+        else {
+            const source = process.env.SCALEBUN_TOKEN || process.env.SCALEBUN_API_TOKEN
+                ? 'environment variables'
+                : '~/.scalebun/credentials.json';
+            if (creds.token.startsWith('scalebun_pat_')) {
+                report('ok', `Credentials found (${source}, durable access token)`);
+            }
+            else {
+                report('warn', `Credentials found (${source}) but the token is a session JWT`, 'Session tokens expire in ~15 minutes. Run `scalebun login` again — it now mints\n' +
+                    'a durable access token automatically.');
+            }
+            try {
+                const me = await new client_1.ApiClient(creds).get('/auth/me');
+                report('ok', `Token valid — authenticated as ${me.email}`);
+            }
+            catch (err) {
+                report('fail', 'Stored token no longer works', err.message);
+            }
+        }
+        // ── 2. Project shape ───────────────────────────────────────────────────
+        const rnVersion = (0, bundle_1.detectProjectRnVersion)(cwd);
+        const expo = (0, bundle_1.isExpoProject)(cwd);
+        if (!rnVersion) {
+            report('fail', 'React Native not found in node_modules', 'Run this from your app root, after installing dependencies.');
+        }
+        else {
+            report('ok', `React Native ${rnVersion} (${expo ? 'Expo' : 'bare'} project)`);
+        }
+        const hermesc = (0, bundle_1.resolveHermesc)(cwd);
+        if (hermesc) {
+            report('ok', `hermesc found — \`--hermes\` publishes will compile bytecode`, hermesc);
+        }
+        else if (rnVersion) {
+            // Name every place that was searched. The old message named only the
+            // prebuilt path, which on RN 0.87 does not exist at all — so it read as
+            // "your install is broken" when the binary had simply moved into the
+            // hermes-engine pod and `pod install` had not been run.
+            report('warn', 'hermesc not found — searched every known location', (0, bundle_1.hermescCandidates)(cwd)
+                .map((c) => `  · ${c}`)
+                .join('\n') +
+                '\n\nOn RN 0.87+ hermesc ships in the hermes-engine pod: run `pod install`\n' +
+                'in ios/, or set HERMES_CLI_PATH to your binary.\n' +
+                'Without it, publishes fall back to plain JS: they work, but cold start is\n' +
+                '~20-30% slower, Hermes-bytecode runtime gating cannot protect these bundles,\n' +
+                'and delta patching breaks (plain JS cannot diff against a bytecode base).');
+        }
+        // ── 3. Android wiring ──────────────────────────────────────────────────
+        const gradleProps = path.join(cwd, 'android', 'gradle.properties');
+        const mainApp = findFile(path.join(cwd, 'android', 'app', 'src', 'main'), [
+            'MainApplication.kt',
+            'MainApplication.java',
+        ]);
+        const minor = parseMinor(rnVersion);
+        if (!fs.existsSync(path.join(cwd, 'android'))) {
+            report('warn', 'No android/ directory — skipping Android checks');
+        }
+        else {
+            const newArch = fs.existsSync(gradleProps) &&
+                /newArchEnabled\s*=\s*true/.test(fs.readFileSync(gradleProps, 'utf-8'));
+            // The dead zone: bridgeless ignored getJSBundleFile() until RN 0.76.1.
+            // An update installs, reports INSTALLED, and the app keeps running the
+            // APK asset — the exact failure that killed CodePush on modern RN.
+            if (newArch && minor && (minor[1] === 74 || minor[1] === 75) && minor[0] === 0) {
+                report('fail', `New Architecture is ON with React Native ${rnVersion} — OTA updates CANNOT LOAD`, 'Bridgeless did not honour getJSBundleFile() until RN 0.76.1. Updates will\n' +
+                    'install and silently never run (the SDK detects this and disables itself).\n' +
+                    'Fix: upgrade to RN >= 0.76.1, or set newArchEnabled=false.');
+            }
+            else if (newArch && rnVersion?.startsWith('0.76.0')) {
+                report('fail', 'React Native 0.76.0 exactly — one patch release short of the bridgeless fix', 'Upgrade to 0.76.1 or later.');
+            }
+            if (!mainApp) {
+                report('warn', 'MainApplication.kt/.java not found — cannot verify Android wiring');
+            }
+            else {
+                const src = fs.readFileSync(mainApp, 'utf-8');
+                const wired = src.includes('ScaleBunOtaModule.getJSBundleFile');
+                const rel = path.relative(cwd, mainApp);
+                if (!wired) {
+                    report('fail', `Android bundle resolution is NOT wired (${rel})`, 'Without it, updates download and install but the app keeps running the bundle\n' +
+                        'baked into the APK — every metric reports success and nothing changes.\n' +
+                        (minor && (minor[0] > 0 || minor[1] >= 82)
+                            ? 'RN >= 0.82 (ReactNativeHost was removed) — pass the path to the host:\n' +
+                                '  override val reactHost: ReactHost by lazy {\n' +
+                                '    getDefaultReactHost(context = applicationContext,\n' +
+                                '      packageList = PackageList(this).packages,\n' +
+                                '      jsBundleFilePath = ScaleBunOtaModule.getJSBundleFile(applicationContext))\n' +
+                                '  }'
+                            : 'Add inside your ReactNativeHost:\n' +
+                                '  override fun getJSBundleFile(): String? =\n' +
+                                '    ScaleBunOtaModule.getJSBundleFile(this@MainApplication) ?: super.getJSBundleFile()'));
+                }
+                else if (minor &&
+                    (minor[0] > 0 || minor[1] >= 82) &&
+                    !src.includes('jsBundleFilePath')) {
+                    report('fail', `RN ${rnVersion} uses the removed ReactNativeHost override (${rel})`, 'RN 0.82 deleted ReactNativeHost — the getJSBundleFile() override no longer\n' +
+                        'compiles or runs. Pass jsBundleFilePath to getDefaultReactHost(...) instead.');
+                }
+                else {
+                    report('ok', `Android bundle resolution wired (${rel})`);
+                }
+            }
+        }
+        // ── 4. iOS wiring ──────────────────────────────────────────────────────
+        if (!fs.existsSync(path.join(cwd, 'ios'))) {
+            report('warn', 'No ios/ directory — skipping iOS checks');
+        }
+        else {
+            const appDelegate = findFile(path.join(cwd, 'ios'), [
+                'AppDelegate.swift',
+                'AppDelegate.mm',
+                'AppDelegate.m',
+            ]);
+            if (!appDelegate) {
+                report('warn', 'AppDelegate not found — cannot verify iOS wiring');
+            }
+            else {
+                const src = fs.readFileSync(appDelegate, 'utf-8');
+                const rel = path.relative(cwd, appDelegate);
+                if (src.includes('ScaleBunOtaModule.getBundleURL') || src.includes('getBundleURL()')) {
+                    report('ok', `iOS bundle resolution wired (${rel})`);
+                }
+                else {
+                    report('fail', `iOS bundle resolution is NOT wired (${rel})`, 'Override bundleURL to resolve the OTA slot:\n' +
+                        '  override func bundleURL() -> URL? {\n' +
+                        '    #if DEBUG\n' +
+                        '      RCTBundleURLProvider.sharedSettings().jsBundleURL(forBundleRoot: "index")\n' +
+                        '    #else\n' +
+                        '      ScaleBunOtaModule.getBundleURL()\n' +
+                        '    #endif\n' +
+                        '  }');
+                }
+            }
+            // A wired bundleURL is necessary but NOT sufficient: it only runs again
+            // if the host asks again. This is the "update installs, restart does
+            // nothing, cold start works" report, and it is invisible from JS —
+            // download, verify, apply and restart all succeed.
+            const staticHost = findStaticHostConstruction(path.join(cwd, 'ios'));
+            if (staticHost.length) {
+                report('fail', 'React host is built with a STATIC bundle URL — restarts will not load an update', staticHost
+                    .map((h) => `  · ${path.relative(cwd, h.file)}:${h.line}  ${h.text}`)
+                    .join('\n') +
+                    '\n\ninitWithBundleURL: captures the URL once and wraps it in a block that returns\n' +
+                    'that same URL forever, so the host can never see a bundle installed later.\n' +
+                    'The update downloads, verifies, applies and reports success, restartApp()\n' +
+                    'runs — and the app comes back on the OLD bundle. A cold start loads it fine,\n' +
+                    'which is what makes this so hard to place.\n\n' +
+                    'Fix: hand the host a provider that is CALLED on every reload.\n' +
+                    '  ObjC:  [[RCTHost alloc] initWithBundleURLProvider:^{ return [self bundleURL]; }\n' +
+                    '  Swift: RCTHost(bundleURLProvider: { self.bundleURL() }, ...)\n\n' +
+                    'Or drop the custom host entirely — RCTAppDelegate / RCTReactNativeFactory\n' +
+                    'already build one from a block that calls your bundleURL override each time.');
+            }
+        }
+        // ── 5. Signing ─────────────────────────────────────────────────────────
+        const keyPath = path.join(cwd, '.scalebun', 'ota-signing-key.pem');
+        if (fs.existsSync(keyPath)) {
+            // "Publishes are signed" was true and misleading. Signing has two
+            // halves and this only ever checked the first: the CLI signs, the
+            // server stores and serves the signature — and the device accepts the
+            // bundle on SHA-256 alone unless the app pins the public key. An
+            // unpinned app gets integrity (the bytes arrived intact) and no
+            // authenticity (they came from you), which is the difference between a
+            // corrupted download and a substituted one.
+            //
+            // Reported here because this is the only place that can see both the
+            // key and the app source, and because a green tick claiming a security
+            // property the device never enforces is worse than no check at all.
+            // The trusted key under SB-OTA-RSA-SHA256-V1 lives in a NATIVE asset, not
+            // in JS config. `publicSigningKey` in init is the ed25519-era shape and is
+            // ignored by the RSA runtime, so checking for it reported a security
+            // property that no longer exists. What matters now is whether the app
+            // actually ships android/app/src/main/assets/scalebun_ota_keys.json —
+            // because an EMPTY key registry is exactly what leaves native staging
+            // unenforced, and it fails silently.
+            const assetPath = path.join(cwd, 'android', 'app', 'src', 'main', 'assets', 'scalebun_ota_keys.json');
+            const strayResRaw = path.join(cwd, 'android', 'app', 'src', 'main', 'res', 'raw', 'scalebun_ota_keys.json');
+            if (fs.existsSync(assetPath)) {
+                let embeddedKeyIds = [];
+                let embeddedProject = '';
+                let parseError = '';
+                try {
+                    const parsed = JSON.parse(fs.readFileSync(assetPath, 'utf8'));
+                    embeddedProject = String(parsed.projectId ?? '');
+                    embeddedKeyIds = Array.isArray(parsed.keys)
+                        ? parsed.keys.map((k) => String(k.keyId ?? '')).filter(Boolean)
+                        : [];
+                }
+                catch (e) {
+                    parseError = e?.message ?? 'unparseable';
+                }
+                if (parseError) {
+                    report('fail', 'scalebun_ota_keys.json is present but not valid JSON', 'The native registry cannot parse it, so it loads NO trusted keys, which leaves\n' +
+                        'signature enforcement off entirely. Parser said: ' + parseError);
+                }
+                else if (embeddedKeyIds.length === 0) {
+                    report('fail', 'scalebun_ota_keys.json contains no keys', 'An empty registry is treated as "no trusted keys", which leaves native staging\n' +
+                        'UNENFORCED. Re-embed the public half of your signing key.');
+                }
+                else {
+                    report('ok', 'Trusted key embedded natively (' + embeddedKeyIds.join(', ') + ') — the device enforces signatures');
+                    if (!embeddedProject) {
+                        report('warn', 'Embedded key file has no projectId', 'The verifier binds each release to a project id; without one that check\n' +
+                            'cannot run and cross-project replay is not detected.');
+                    }
+                    // A single trusted key makes rotation a store release.
+                    //
+                    // Trust only ever changes at store speed: the anchor is compiled in, so
+                    // a key the binary does not already carry cannot be added over the air.
+                    // With one key there is no second key to switch TO — rotating, or
+                    // recovering from a leak, means shipping a native build and waiting for
+                    // adoption, signing with the old key the whole time. Carry an unused
+                    // standby and rotation becomes a one-line change instead.
+                    //
+                    // TlsPinning enforces exactly this for certificate pins (MIN_PINS = 2,
+                    // 'that a routine key rotation will detonate'). Signing keys have the
+                    // identical failure mode.
+                    if (embeddedKeyIds.length < 2) {
+                        report('warn', 'Only one signing key is trusted — rotation will need a store release', 'The anchor is compiled into the binary, so a new key cannot be delivered over' +
+                            '\nthe air. Embed a second, UNUSED standby key now: to rotate later you simply' +
+                            '\nstart signing with it, because devices already trust it. Keep the standby' +
+                            '\nprivate key offline and do not register it until you need it.');
+                    }
+                }
+            }
+            else if (fs.existsSync(strayResRaw)) {
+                report('fail', 'Trusted key is in res/raw/ — the SDK reads assets/ and will never find it', 'ScaleBunOtaKeyRegistry loads the file with context.assets.open(), so a copy in\n' +
+                    'res/raw is invisible to it: the registry stays empty and signature enforcement\n' +
+                    'is silently OFF. Move it:\n' +
+                    '  android/app/src/main/res/raw/scalebun_ota_keys.json\n' +
+                    '  -> android/app/src/main/assets/scalebun_ota_keys.json');
+            }
+            else {
+                report('warn', 'No trusted key embedded — the device cannot verify who signed an update', 'Bundles may be signed, but nothing on the device checks the signature, so a\n' +
+                    'substituted bundle is indistinguishable from yours. Embed the PUBLIC key at\n' +
+                    '  android/app/src/main/assets/scalebun_ota_keys.json');
+            }
+            const gitignore = path.join(cwd, '.gitignore');
+            const ignored = fs.existsSync(gitignore) && /(^|\n)\s*\.scalebun\/?\s*(\n|$)/.test(fs.readFileSync(gitignore, 'utf-8'));
+            if (!ignored) {
+                report('fail', '.scalebun/ is NOT in .gitignore — the private signing key can be committed', 'Anyone with this key can sign bundles your users will trust.\n' +
+                    'Fix: echo ".scalebun/" >> .gitignore  (and rotate the key if it was ever pushed)');
+            }
+        }
+        else {
+            report('warn', 'No signing key — bundles ship on SHA-256 integrity alone', 'Integrity proves bytes arrived intact; only a signature proves they came from you.\n' +
+                'Set up: scalebun ota generate-key-pair --app-id <id> --name "release key"');
+        }
+        // ── Summary ────────────────────────────────────────────────────────────
+        const fails = findings.filter((f) => f.level === 'fail').length;
+        const warns = findings.filter((f) => f.level === 'warn').length;
+        // Machine mode: the findings ARE the output, and a blocking failure is a
+        // deliberate gate (exit 3) rather than a usage error (exit 1). That is
+        // the distinction a CI job needs — "your project is not OTA-ready" and
+        // "you typed the command wrong" want opposite responses.
+        if ((0, output_1.isJson)()) {
+            (0, output_1.emit)(() => { }, {
+                ok: fails === 0,
+                blocking: fails,
+                warnings: warns,
+                findings,
+            });
+            if (fails > 0)
+                process.exit(output_1.ExitCode.Gate);
+            return;
+        }
+        console.log('');
+        if (fails > 0) {
+            console.log(`${fails} blocking issue(s), ${warns} warning(s). Fix the ❌ items before shipping OTA.`);
+            process.exit(output_1.ExitCode.Gate);
+        }
+        console.log(warns > 0
+            ? `No blocking issues (${warns} warning(s)). You can ship OTA updates.`
+            : 'All checks passed. You can ship OTA updates.');
+        // "You can ship OTA updates" and then no way to. The signing-key warning
+        // is the one worth acting on before the first release, so offer it when
+        // that is what the warning was about.
+        (0, output_1.printNextSteps)([
+            { label: 'Ship an update', argv: ['ota', 'publish'] },
+            ...(findings.some((f) => f.title.startsWith('No signing key'))
+                ? [{ label: 'Sign your bundles', argv: ['ota', 'generate-key-pair'] }]
+                : []),
+        ], chalk_1.default.cyan);
+    }
+}
+//# sourceMappingURL=doctor.js.map

package/lib/commands/doctor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../../src/commands/doctor.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoFA,gEAmDC;AAmFD,sDAMC;AAMD,8BA6XC;AAnmBD,uCAAyB;AACzB,+CAAiC;AACjC,2CAA6B;AAE7B,kDAA0B;AAC1B,4CAAyE;AACzE,sDAAuD;AACvD,0CAA0C;AAC1C,4CAKyB;AAoBzB,MAAM,QAAQ,GAAc,EAAE,CAAC;AAE/B,SAAS,MAAM,CAAC,KAAY,EAAE,KAAa,EAAE,MAAe;IAC1D,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACxC,6EAA6E;IAC7E,4DAA4D;IAC5D,IAAI,IAAA,eAAM,GAAE;QAAE,OAAO;IACrB,MAAM,IAAI,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC;IACnE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC;IAChC,IAAI,MAAM;QAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,gFAAgF;AAChF,SAAS,QAAQ,CAAC,GAAW,EAAE,KAAe,EAAE,QAAQ,GAAG,CAAC;IAC1D,IAAI,QAAQ,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,IAAI,OAAoB,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC1E,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE;YAAE,SAAS;QAC/B,IAAI,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,SAAS;QACpF,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC;QAClE,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC;IACtB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAgB,0BAA0B,CACxC,MAAc;IAEd,MAAM,IAAI,GAAmD,EAAE,CAAC;IAChE,MAAM,QAAQ,GAAG;QACf,6GAA6G;QAC7G,wFAAwF;KACzF,CAAC;IAEF,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,KAAa,EAAQ,EAAE;QAChD,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO;QACtB,IAAI,OAAoB,CAAC;QACzB,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;gBACpB,wEAAwE;gBACxE,oEAAoE;gBACpE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;oBAAE,SAAS;gBACxE,IAAI,kDAAkD,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;oBAAE,SAAS;gBAC9E,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;gBACtB,SAAS;YACX,CAAC;YACD,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC9C,IAAI,GAAW,CAAC;YAChB,IAAI,CAAC;gBACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACtC,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;gBAC1B,EAAE,CAAC,SAAS,GAAG,CAAC,CAAC;gBACjB,IAAI,CAAyB,CAAC;gBAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;oBACnC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;oBACtD,IAAI,CAAC,IAAI,CAAC;wBACR,IAAI,EAAE,IAAI;wBACV,IAAI;wBACJ,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;qBAC/C,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAChB,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,kBAAkB,CAAC,cAAsB;IAChD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,CAAC;QACtE,MAAM,GAAG,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACjF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,cAAc,CAAC,GAAW;IACjC,MAAM,MAAM,GAAG,2BAA2B,CAAC;IAC3C,MAAM,KAAK,GAAG,CAAC,UAAU,EAAE,eAAe,EAAE,eAAe,EAAE,eAAe,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAC5F,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,KAAa,EAAW,EAAE;QACnD,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAC5B,IAAI,OAAoB,CAAC;QACzB,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,4CAA4C,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5E,IAAI,CAAC;oBACH,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;wBAAE,OAAO,IAAI,CAAC;gBAC9D,CAAC;gBAAC,MAAM,CAAC;oBACP,oCAAoC;gBACtC,CAAC;YACH,CAAC;iBAAM,IAAI,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1F,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC;oBAAE,OAAO,IAAI,CAAC;YACzC,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS;QACnC,IAAI,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YACpC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC;gBACH,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;oBAAE,OAAO,IAAI,CAAC;YAC9D,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;QACH,CAAC;IACH,CAAC;IACD,qEAAqE;IACrE,KAAK,MAAM,GAAG,IAAI,CAAC,sBAAsB,EAAE,KAAK,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACjC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IACxD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,OAAsB;IACxC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC;AAED,SAAgB,qBAAqB,CAAC,OAAgB;IACpD,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,6DAA6D,CAAC;SAC1E,MAAM,CAAC,QAAQ,EAAE,uDAAuD,CAAC;SACzE,MAAM,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;AAC/B,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,SAAS;IAC7B,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,uCAAuC;IAC5D,CAAC;QACG,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,qEAAqE;QACrE,oEAAoE;QACpE,IAAI,CAAC,IAAA,eAAM,GAAE;YAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;QAElD,0EAA0E;QAC1E,MAAM,KAAK,GAAG,IAAA,6BAAe,GAAE,CAAC;QAChC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,CACJ,MAAM,EACN,eAAe,EACf,uEAAuE,CACxE,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GACV,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB;gBAC1D,CAAC,CAAC,uBAAuB;gBACzB,CAAC,CAAC,8BAA8B,CAAC;YACrC,IAAI,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;gBAC5C,MAAM,CAAC,IAAI,EAAE,sBAAsB,MAAM,yBAAyB,CAAC,CAAC;YACtE,CAAC;iBAAM,CAAC;gBACN,MAAM,CACJ,MAAM,EACN,sBAAsB,MAAM,kCAAkC,EAC9D,mFAAmF;oBACjF,uCAAuC,CAC1C,CAAC;YACJ,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,EAAE,GAAG,MAAM,IAAI,kBAAS,CAAC,KAAK,CAAC,CAAC,GAAG,CAAoB,UAAU,CAAC,CAAC;gBACzE,MAAM,CAAC,IAAI,EAAE,kCAAkC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;YAC7D,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,MAAM,CAAC,MAAM,EAAE,8BAA8B,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;QAED,0EAA0E;QAC1E,MAAM,SAAS,GAAG,IAAA,+BAAsB,EAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,IAAA,sBAAa,EAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,CACJ,MAAM,EACN,wCAAwC,EACxC,6DAA6D,CAC9D,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,EAAE,gBAAgB,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,CAAC;QAChF,CAAC;QAED,MAAM,OAAO,GAAG,IAAA,uBAAc,EAAC,GAAG,CAAC,CAAC;QACpC,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,CAAC,IAAI,EAAE,8DAA8D,EAAE,OAAO,CAAC,CAAC;QACxF,CAAC;aAAM,IAAI,SAAS,EAAE,CAAC;YACrB,qEAAqE;YACrE,wEAAwE;YACxE,qEAAqE;YACrE,wDAAwD;YACxD,MAAM,CACJ,MAAM,EACN,mDAAmD,EACnD,IAAA,0BAAiB,EAAC,GAAG,CAAC;iBACnB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;iBACtB,IAAI,CAAC,IAAI,CAAC;gBACX,6EAA6E;gBAC7E,mDAAmD;gBACnD,6EAA6E;gBAC7E,gFAAgF;gBAChF,2EAA2E,CAC9E,CAAC;QACJ,CAAC;QAED,0EAA0E;QAC1E,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC;QACnE,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE;YACxE,oBAAoB;YACpB,sBAAsB;SACvB,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;QAEpC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;YAC9C,MAAM,CAAC,MAAM,EAAE,iDAAiD,CAAC,CAAC;QACpE,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GACX,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC;gBAC1B,2BAA2B,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;YAE1E,uEAAuE;YACvE,uEAAuE;YACvE,mEAAmE;YACnE,IAAI,OAAO,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/E,MAAM,CACJ,MAAM,EACN,4CAA4C,SAAS,4BAA4B,EACjF,6EAA6E;oBAC3E,8EAA8E;oBAC9E,4DAA4D,CAC/D,CAAC;YACJ,CAAC;iBAAM,IAAI,OAAO,IAAI,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACtD,MAAM,CACJ,MAAM,EACN,6EAA6E,EAC7E,6BAA6B,CAC9B,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,CAAC,MAAM,EAAE,mEAAmE,CAAC,CAAC;YACtF,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC9C,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,mCAAmC,CAAC,CAAC;gBAChE,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBAExC,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,MAAM,CACJ,MAAM,EACN,2CAA2C,GAAG,GAAG,EACjD,iFAAiF;wBAC/E,0EAA0E;wBAC1E,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;4BACxC,CAAC,CAAC,yEAAyE;gCACzE,iDAAiD;gCACjD,yDAAyD;gCACzD,mDAAmD;gCACnD,mFAAmF;gCACnF,KAAK;4BACP,CAAC,CAAC,oCAAoC;gCACpC,+CAA+C;gCAC/C,wFAAwF,CAAC,CAChG,CAAC;gBACJ,CAAC;qBAAM,IACL,KAAK;oBACL,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;oBAChC,CAAC,GAAG,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EACjC,CAAC;oBACD,MAAM,CACJ,MAAM,EACN,MAAM,SAAS,+CAA+C,GAAG,GAAG,EACpE,8EAA8E;wBAC5E,8EAA8E,CACjF,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,IAAI,EAAE,oCAAoC,GAAG,GAAG,CAAC,CAAC;gBAC3D,CAAC;YACH,CAAC;QACH,CAAC;QAED,0EAA0E;QAC1E,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YAC1C,MAAM,CAAC,MAAM,EAAE,yCAAyC,CAAC,CAAC;QAC5D,CAAC;aAAM,CAAC;YACN,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE;gBAClD,mBAAmB;gBACnB,gBAAgB;gBAChB,eAAe;aAChB,CAAC,CAAC;YACH,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,MAAM,CAAC,MAAM,EAAE,kDAAkD,CAAC,CAAC;YACrE,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;gBAClD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;gBAC5C,IAAI,GAAG,CAAC,QAAQ,CAAC,gCAAgC,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;oBACrF,MAAM,CAAC,IAAI,EAAE,gCAAgC,GAAG,GAAG,CAAC,CAAC;gBACvD,CAAC;qBAAM,CAAC;oBACN,MAAM,CACJ,MAAM,EACN,uCAAuC,GAAG,GAAG,EAC7C,+CAA+C;wBAC7C,yCAAyC;wBACzC,iBAAiB;wBACjB,mFAAmF;wBACnF,aAAa;wBACb,0CAA0C;wBAC1C,cAAc;wBACd,KAAK,CACR,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,wEAAwE;YACxE,qEAAqE;YACrE,mEAAmE;YACnE,mDAAmD;YACnD,MAAM,UAAU,GAAG,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;YACrE,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;gBACtB,MAAM,CACJ,MAAM,EACN,iFAAiF,EACjF,UAAU;qBACP,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;qBACpE,IAAI,CAAC,IAAI,CAAC;oBACX,qFAAqF;oBACrF,8EAA8E;oBAC9E,6EAA6E;oBAC7E,gFAAgF;oBAChF,gDAAgD;oBAChD,iEAAiE;oBACjE,qFAAqF;oBACrF,oEAAoE;oBACpE,6EAA6E;oBAC7E,8EAA8E,CACjF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,0EAA0E;QAC1E,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,qBAAqB,CAAC,CAAC;QACnE,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,kEAAkE;YAClE,kEAAkE;YAClE,sEAAsE;YACtE,iEAAiE;YACjE,gEAAgE;YAChE,uEAAuE;YACvE,4CAA4C;YAC5C,EAAE;YACF,qEAAqE;YACrE,uEAAuE;YACvE,oEAAoE;YACpE,0EAA0E;YAC1E,2EAA2E;YAC3E,qEAAqE;YACrE,sEAAsE;YACtE,sEAAsE;YACtE,sEAAsE;YACtE,qCAAqC;YACrC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CACzB,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,wBAAwB,CACzE,CAAC;YACF,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAC3B,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,CAC7E,CAAC;YAEF,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC7B,IAAI,cAAc,GAAa,EAAE,CAAC;gBAClC,IAAI,eAAe,GAAG,EAAE,CAAC;gBACzB,IAAI,UAAU,GAAG,EAAE,CAAC;gBACpB,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;oBAC9D,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;oBACjD,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;wBACzC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;wBACpE,CAAC,CAAC,EAAE,CAAC;gBACT,CAAC;gBAAC,OAAO,CAAM,EAAE,CAAC;oBAChB,UAAU,GAAG,CAAC,EAAE,OAAO,IAAI,aAAa,CAAC;gBAC3C,CAAC;gBAED,IAAI,UAAU,EAAE,CAAC;oBACf,MAAM,CACJ,MAAM,EACN,sDAAsD,EACtD,kFAAkF;wBAChF,mDAAmD,GAAG,UAAU,CACnE,CAAC;gBACJ,CAAC;qBAAM,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACvC,MAAM,CACJ,MAAM,EACN,yCAAyC,EACzC,kFAAkF;wBAChF,2DAA2D,CAC9D,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,MAAM,CACJ,IAAI,EACJ,iCAAiC,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,oCAAoC,CACrG,CAAC;oBACF,IAAI,CAAC,eAAe,EAAE,CAAC;wBACrB,MAAM,CACJ,MAAM,EACN,oCAAoC,EACpC,2EAA2E;4BACzE,sDAAsD,CACzD,CAAC;oBACJ,CAAC;oBACD,uDAAuD;oBACvD,EAAE;oBACF,wEAAwE;oBACxE,wEAAwE;oBACxE,kEAAkE;oBAClE,wEAAwE;oBACxE,qEAAqE;oBACrE,0DAA0D;oBAC1D,EAAE;oBACF,uEAAuE;oBACvE,sEAAsE;oBACtE,0BAA0B;oBAC1B,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBAC9B,MAAM,CACJ,MAAM,EACN,sEAAsE,EACtE,+EAA+E;4BAC7E,+EAA+E;4BAC/E,6EAA6E;4BAC7E,iEAAiE,CACpE,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;iBAAM,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;gBACtC,MAAM,CACJ,MAAM,EACN,2EAA2E,EAC3E,kFAAkF;oBAChF,kFAAkF;oBAClF,6BAA6B;oBAC7B,yDAAyD;oBACzD,yDAAyD,CAC5D,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,CACJ,MAAM,EACN,yEAAyE,EACzE,+EAA+E;oBAC7E,+EAA+E;oBAC/E,sDAAsD,CACzD,CAAC;YACJ,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YAC/C,MAAM,OAAO,GACX,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,iCAAiC,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;YAC1G,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,CACJ,MAAM,EACN,4EAA4E,EAC5E,gEAAgE;oBAC9D,kFAAkF,CACrF,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,CACJ,MAAM,EACN,0DAA0D,EAC1D,sFAAsF;gBACpF,2EAA2E,CAC9E,CAAC;QACJ,CAAC;QAED,0EAA0E;QAC1E,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;QAChE,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;QAChE,yEAAyE;QACzE,uEAAuE;QACvE,uEAAuE;QACvE,yDAAyD;QACzD,IAAI,IAAA,eAAM,GAAE,EAAE,CAAC;YACb,IAAA,aAAI,EACF,GAAG,EAAE,GAAE,CAAC,EACR;gBACE,EAAE,EAAE,KAAK,KAAK,CAAC;gBACf,QAAQ,EAAE,KAAK;gBACf,QAAQ,EAAE,KAAK;gBACf,QAAQ;aACT,CACF,CAAC;YACF,IAAI,KAAK,GAAG,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,iBAAQ,CAAC,IAAI,CAAC,CAAC;YAC3C,OAAO;QACT,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,uBAAuB,KAAK,mDAAmD,CAAC,CAAC;YACrG,OAAO,CAAC,IAAI,CAAC,iBAAQ,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC;QACD,OAAO,CAAC,GAAG,CACT,KAAK,GAAG,CAAC;YACP,CAAC,CAAC,uBAAuB,KAAK,yCAAyC;YACvE,CAAC,CAAC,8CAA8C,CACnD,CAAC;QACF,yEAAyE;QACzE,wEAAwE;QACxE,sCAAsC;QACtC,IAAA,uBAAc,EACZ;YACE,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE;YACrD,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;gBAC5D,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,mBAAmB,CAAC,EAAE,CAAC;gBACtE,CAAC,CAAC,EAAE,CAAC;SACR,EACD,eAAK,CAAC,IAAI,CACX,CAAC;IACN,CAAC;AACH,CAAC"}

package/lib/commands/launch.d.ts

@@ -0,0 +1,3 @@
+import { Command } from 'commander';
+export declare function registerLaunchCommand(program: Command): void;
+//# sourceMappingURL=launch.d.ts.map

package/lib/commands/launch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"launch.d.ts","sourceRoot":"","sources":["../../src/commands/launch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAe5D"}

package/lib/commands/launch.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerLaunchCommand = registerLaunchCommand;
+const child_process_1 = require("child_process");
+function registerLaunchCommand(program) {
+    program
+        .command('launch')
+        .alias('window')
+        .description('Open Scalebun CLI in a standalone external terminal window')
+        .action(() => {
+        console.log('🚀 Opening Scalebun CLI in an external terminal window…');
+        if (process.platform === 'win32') {
+            (0, child_process_1.exec)('start powershell.exe -NoExit -Command "scalebun"');
+        }
+        else if (process.platform === 'darwin') {
+            (0, child_process_1.exec)('osascript -e \'tell application "Terminal" to do script "scalebun"\'');
+        }
+        else {
+            (0, child_process_1.exec)('x-terminal-emulator -e scalebun');
+        }
+    });
+}
+//# sourceMappingURL=launch.js.map

package/lib/commands/launch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"launch.js","sourceRoot":"","sources":["../../src/commands/launch.ts"],"names":[],"mappings":";;AAGA,sDAeC;AAjBD,iDAAqC;AAErC,SAAgB,qBAAqB,CAAC,OAAgB;IACpD,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,KAAK,CAAC,QAAQ,CAAC;SACf,WAAW,CAAC,4DAA4D,CAAC;SACzE,MAAM,CAAC,GAAG,EAAE;QACX,OAAO,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;QACvE,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,IAAA,oBAAI,EAAC,kDAAkD,CAAC,CAAC;QAC3D,CAAC;aAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACzC,IAAA,oBAAI,EAAC,sEAAsE,CAAC,CAAC;QAC/E,CAAC;aAAM,CAAC;YACN,IAAA,oBAAI,EAAC,iCAAiC,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/lib/commands/link.d.ts

@@ -0,0 +1,16 @@
+import { Command } from 'commander';
+/**
+ * `scalebun link` — bind this directory to an app, once.
+ *
+ * The missing noun. Nine commands hard-required `--app-id <cuid>`, so every
+ * 3am invocation began by finding a 25-character id in a browser. Linking
+ * writes `scalebun.json` at the project root and the flag disappears from
+ * every later command in this tree.
+ *
+ * `scalebun.json` is COMMITTED, not ignored — an app id is not a secret (it
+ * appears in every dashboard URL) and the whole point is that a teammate who
+ * clones the repo inherits the binding. The signing key next to it in
+ * `.scalebun/` is the secret, and that is gitignored separately.
+ */
+export declare function registerLinkCommands(program: Command): void;
+//# sourceMappingURL=link.d.ts.map

package/lib/commands/link.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"link.d.ts","sourceRoot":"","sources":["../../src/commands/link.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAkBpC;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAuH3D"}