@scalebun-release/cli 2.5.0

package/lib/commands/link.js

@@ -0,0 +1,164 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerLinkCommands = registerLinkCommands;
+const chalk_1 = __importDefault(require("chalk"));
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const client_1 = require("../api/client");
+const credentials_1 = require("../utils/credentials");
+const apps_1 = require("../utils/apps");
+const prompt_1 = require("../utils/prompt");
+const resolve_1 = require("../utils/resolve");
+const output_1 = require("../utils/output");
+const context_1 = require("../utils/context");
+/**
+ * `scalebun link` — bind this directory to an app, once.
+ *
+ * The missing noun. Nine commands hard-required `--app-id <cuid>`, so every
+ * 3am invocation began by finding a 25-character id in a browser. Linking
+ * writes `scalebun.json` at the project root and the flag disappears from
+ * every later command in this tree.
+ *
+ * `scalebun.json` is COMMITTED, not ignored — an app id is not a secret (it
+ * appears in every dashboard URL) and the whole point is that a teammate who
+ * clones the repo inherits the binding. The signing key next to it in
+ * `.scalebun/` is the secret, and that is gitignored separately.
+ */
+function registerLinkCommands(program) {
+    program
+        .command('link')
+        .description('Bind this project to an app so --app-id is never needed again')
+        .option('--app-id <id>', 'Skip the picker and link this app')
+        .option('--channel <name>', 'Default channel for publish and promote', 'production')
+        .option('--json', 'Machine-readable output')
+        .action(async (opts) => {
+        const creds = (0, credentials_1.readCredentials)();
+        if (!creds) {
+            (0, output_1.fail)('Not signed in.', ['Run `scalebun login` first.'], output_1.ExitCode.Usage);
+        }
+        // Link the directory the user is standing in, unless an ancestor is
+        // already linked — re-linking a subdirectory of a linked project would
+        // create a second, shadowing config nobody asked for.
+        const existingRoot = (0, context_1.findProjectRoot)();
+        const root = existingRoot ?? process.cwd();
+        const existing = (0, context_1.readProjectConfig)(root);
+        let entry = null;
+        if (!opts.appId) {
+            if ((0, resolve_1.isNonInteractive)({ nonInteractive: (0, output_1.isJson)() })) {
+                (0, output_1.fail)('--app-id is required.', ['This shell is not interactive, so the app cannot be chosen here.'], output_1.ExitCode.Usage);
+            }
+            let entries;
+            try {
+                entries = await (0, apps_1.fetchAllApps)(new client_1.ApiClient(creds));
+            }
+            catch (err) {
+                (0, output_1.failFromError)('Could not list apps', err);
+            }
+            if (!entries.length) {
+                (0, output_1.fail)('This account has no apps yet.', ['Create one in the dashboard, then re-run.'], output_1.ExitCode.Usage);
+            }
+            if (entries.length === 1) {
+                entry = entries[0];
+                console.log(chalk_1.default.dim(`Using your only app: ${entry.app.name}`));
+            }
+            else {
+                entry = await (0, prompt_1.select)('Which app should this project use?', entries.map((e) => ({
+                    label: `${e.app.name}  ${chalk_1.default.dim(`${e.orgName} / ${e.projectName}`)}`,
+                    value: e,
+                })));
+                (0, prompt_1.closePrompts)();
+            }
+        }
+        const appId = opts.appId ?? entry.app.id;
+        const appName = entry?.app.name;
+        const saved = (0, context_1.writeProjectConfig)(root, {
+            appId,
+            ...(appName ? { appName } : {}),
+            channel: opts.channel ?? existing?.channel ?? 'production',
+        });
+        const rel = path.relative(process.cwd(), path.join(root, context_1.PROJECT_FILE)) || context_1.PROJECT_FILE;
+        const ctx = (0, context_1.getContext)();
+        (0, output_1.emit)(() => {
+            console.log('');
+            console.log(`🔗 Linked to ${chalk_1.default.bold(appName ?? appId)}`);
+            console.log(`   ${chalk_1.default.dim(rel)}`);
+            console.log(`   ${chalk_1.default.dim(`channel: ${saved.channel}`)}`);
+            console.log('');
+            console.log(chalk_1.default.dim('   Commit this file — an app id is not a secret, and a teammate'));
+            console.log(chalk_1.default.dim('   who clones the repo inherits the binding.'));
+            console.log('');
+            // Say what this actually bought, in the terms the user cares about.
+            console.log('   --app-id is now optional for every command here.');
+            if (!ctx.isNativeProject) {
+                console.log(chalk_1.default.dim('   No android/ or ios/ here — run this from your app root to wire OTA too.'));
+                (0, output_1.printNextSteps)([{ label: 'Check the project', argv: ['doctor'] }], chalk_1.default.cyan);
+            }
+            else if (ctx.stage < 3) {
+                (0, output_1.printNextSteps)([
+                    { label: 'Wire the native side', argv: ['init', ctx.platforms[0]] },
+                    { label: 'Check what else is needed', argv: ['doctor'] },
+                ], chalk_1.default.cyan);
+            }
+            else {
+                (0, output_1.printNextSteps)([
+                    { label: 'Ship an update', argv: ['ota', 'publish'] },
+                    { label: 'See what is live', argv: ['ota', 'status'] },
+                ], chalk_1.default.cyan);
+            }
+        }, { ok: true, appId, appName: appName ?? null, channel: saved.channel, file: path.join(root, context_1.PROJECT_FILE) });
+    });
+    program
+        .command('unlink')
+        .description('Remove the app binding from this project')
+        .action(() => {
+        const root = (0, context_1.findProjectRoot)();
+        if (!root) {
+            (0, output_1.fail)('This directory is not linked.', ['Nothing to remove.'], output_1.ExitCode.Usage);
+        }
+        const file = path.join(root, context_1.PROJECT_FILE);
+        try {
+            fs.unlinkSync(file);
+        }
+        catch (err) {
+            (0, output_1.fail)(`Could not remove ${file}: ${err?.message ?? err}`, [], output_1.ExitCode.Usage);
+        }
+        console.log(`🔗 Unlinked. Removed ${chalk_1.default.dim(file)}`);
+    });
+}
+//# sourceMappingURL=link.js.map

package/lib/commands/link.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"link.js","sourceRoot":"","sources":["../../src/commands/link.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BA,oDAuHC;AArJD,kDAA0B;AAC1B,uCAAyB;AACzB,2CAA6B;AAC7B,0CAA0C;AAC1C,sDAAuD;AACvD,wCAAuD;AACvD,4CAAuD;AACvD,8CAAoD;AACpD,4CAA8F;AAC9F,8CAM0B;AAE1B;;;;;;;;;;;;GAYG;AACH,SAAgB,oBAAoB,CAAC,OAAgB;IACnD,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,+DAA+D,CAAC;SAC5E,MAAM,CAAC,eAAe,EAAE,mCAAmC,CAAC;SAC5D,MAAM,CAAC,kBAAkB,EAAE,yCAAyC,EAAE,YAAY,CAAC;SACnF,MAAM,CAAC,QAAQ,EAAE,yBAAyB,CAAC;SAC3C,MAAM,CAAC,KAAK,EAAE,IAA0D,EAAE,EAAE;QAC3E,MAAM,KAAK,GAAG,IAAA,6BAAe,GAAE,CAAC;QAChC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAA,aAAI,EAAC,gBAAgB,EAAE,CAAC,6BAA6B,CAAC,EAAE,iBAAQ,CAAC,KAAK,CAAC,CAAC;QAC1E,CAAC;QAED,oEAAoE;QACpE,uEAAuE;QACvE,sDAAsD;QACtD,MAAM,YAAY,GAAG,IAAA,yBAAe,GAAE,CAAC;QACvC,MAAM,IAAI,GAAG,YAAY,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,IAAA,2BAAiB,EAAC,IAAI,CAAC,CAAC;QAEzC,IAAI,KAAK,GAAoB,IAAI,CAAC;QAElC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,IAAI,IAAA,0BAAgB,EAAC,EAAE,cAAc,EAAE,IAAA,eAAM,GAAE,EAAE,CAAC,EAAE,CAAC;gBACnD,IAAA,aAAI,EACF,uBAAuB,EACvB,CAAC,kEAAkE,CAAC,EACpE,iBAAQ,CAAC,KAAK,CACf,CAAC;YACJ,CAAC;YACD,IAAI,OAAmB,CAAC;YACxB,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,IAAA,mBAAY,EAAC,IAAI,kBAAS,CAAC,KAAM,CAAC,CAAC,CAAC;YACtD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAA,sBAAa,EAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC;YAC5C,CAAC;YACD,IAAI,CAAC,OAAQ,CAAC,MAAM,EAAE,CAAC;gBACrB,IAAA,aAAI,EAAC,+BAA+B,EAAE,CAAC,2CAA2C,CAAC,EAAE,iBAAQ,CAAC,KAAK,CAAC,CAAC;YACvG,CAAC;YACD,IAAI,OAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,KAAK,GAAG,OAAQ,CAAC,CAAC,CAAC,CAAC;gBACpB,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,GAAG,CAAC,wBAAwB,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YACnE,CAAC;iBAAM,CAAC;gBACN,KAAK,GAAG,MAAM,IAAA,eAAM,EAClB,oCAAoC,EACpC,OAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACnB,KAAK,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,eAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,EAAE;oBACvE,KAAK,EAAE,CAAC;iBACT,CAAC,CAAC,CACJ,CAAC;gBACF,IAAA,qBAAY,GAAE,CAAC;YACjB,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,KAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC;QAEhC,MAAM,KAAK,GAAG,IAAA,4BAAkB,EAAC,IAAI,EAAE;YACrC,KAAK;YACL,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/B,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,QAAQ,EAAE,OAAO,IAAI,YAAY;SAC3D,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,sBAAY,CAAC,CAAC,IAAI,sBAAY,CAAC;QACxF,MAAM,GAAG,GAAG,IAAA,oBAAU,GAAE,CAAC;QAEzB,IAAA,aAAI,EACF,GAAG,EAAE;YACH,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,gBAAgB,eAAK,CAAC,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,EAAE,CAAC,CAAC;YAC5D,OAAO,CAAC,GAAG,CAAC,MAAM,eAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACpC,OAAO,CAAC,GAAG,CAAC,MAAM,eAAK,CAAC,GAAG,CAAC,YAAY,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;YAC5D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC,CAAC;YAC1F,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC,CAAC;YACvE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,oEAAoE;YACpE,OAAO,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;YACnE,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC;gBACzB,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,GAAG,CAAC,4EAA4E,CAAC,CAAC,CAAC;gBACrG,IAAA,uBAAc,EAAC,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,eAAK,CAAC,IAAI,CAAC,CAAC;YACjF,CAAC;iBAAM,IAAI,GAAG,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;gBACzB,IAAA,uBAAc,EACZ;oBACE,EAAE,KAAK,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE;oBACnE,EAAE,KAAK,EAAE,2BAA2B,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE;iBACzD,EACD,eAAK,CAAC,IAAI,CACX,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,IAAA,uBAAc,EACZ;oBACE,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE;oBACrD,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE;iBACvD,EACD,eAAK,CAAC,IAAI,CACX,CAAC;YACJ,CAAC;QACH,CAAC,EACD,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,IAAI,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,sBAAY,CAAC,EAAE,CAC3G,CAAC;IACJ,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,0CAA0C,CAAC;SACvD,MAAM,CAAC,GAAG,EAAE;QACX,MAAM,IAAI,GAAG,IAAA,yBAAe,GAAE,CAAC;QAC/B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAA,aAAI,EAAC,+BAA+B,EAAE,CAAC,oBAAoB,CAAC,EAAE,iBAAQ,CAAC,KAAK,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAK,EAAE,sBAAY,CAAC,CAAC;QAC5C,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,IAAA,aAAI,EAAC,oBAAoB,IAAI,KAAK,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,EAAE,EAAE,EAAE,iBAAQ,CAAC,KAAK,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,wBAAwB,eAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;AACP,CAAC"}

package/lib/commands/login.d.ts

@@ -0,0 +1,12 @@
+import { Command } from 'commander';
+export declare function registerLoginCommand(program: Command): void;
+export interface LoginOptions {
+    apiUrl?: string;
+    token?: string;
+}
+/**
+ * The token login flow as a reusable step (`quickstart` runs it inline when no
+ * credentials are stored). Exits the process on failure.
+ */
+export declare function runLogin(opts: LoginOptions): Promise<void>;
+//# sourceMappingURL=login.d.ts.map

package/lib/commands/login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/commands/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAiCpC,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAoB3D;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,wBAAsB,QAAQ,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAkFhE"}

package/lib/commands/login.js

@@ -0,0 +1,124 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerLoginCommand = registerLoginCommand;
+exports.runLogin = runLogin;
+const credentials_1 = require("../utils/credentials");
+const client_1 = require("../api/client");
+const transportSecurity_1 = require("../utils/transportSecurity");
+const prompt_1 = require("../utils/prompt");
+const output_1 = require("../utils/output");
+const chalk_1 = __importDefault(require("chalk"));
+/**
+ * `scalebun login` — store a durable access token for this machine.
+ *
+ * ── Why token-only ──────────────────────────────────────────────────────────
+ *
+ * Login used to accept email/password, exchange them for a ~15-minute session
+ * JWT, and then spend that JWT minting a personal access token. All of that
+ * machinery existed only to end up with a PAT — the durable, scoped, revocable
+ * credential the rest of the CLI actually uses. Pasting the PAT directly removes
+ * the whole exchange, and with it: JWT-expiry surprises, a password on the wire
+ * (and in shell history), and the MFA dead-end where the interactive flow simply
+ * could not complete.
+ *
+ * The API URL is implicit — it defaults to the hosted backend
+ * (DEFAULT_API_URL). Override it with --api-url or SCALEBUN_API_URL only for
+ * self-hosted / staging / local development.
+ */
+const TOKEN_PAGE = 'https://dash.scalebun.com/settings/access-tokens';
+function registerLoginCommand(program) {
+    program
+        .command('login')
+        .description('Authenticate with your Scalebun backend (paste an access token)')
+        .option('--api-url <url>', `Backend API URL (default: ${credentials_1.DEFAULT_API_URL}; override for self-hosted/staging/local)`)
+        .option('--token <pat>', 'Personal access token (scalebun_pat_…) — skips the prompt')
+        .action((opts) => runLogin(opts));
+    program
+        .command('logout')
+        .description('Remove stored credentials from this machine')
+        .action(() => {
+        (0, credentials_1.clearCredentials)();
+        console.log('✅ Logged out. (The token still exists server-side — revoke it in the dashboard if this machine is compromised.)');
+    });
+}
+/**
+ * The token login flow as a reusable step (`quickstart` runs it inline when no
+ * credentials are stored). Exits the process on failure.
+ */
+async function runLogin(opts) {
+    const existing = (0, credentials_1.readCredentials)();
+    // API URL resolution: explicit flag > env > previous login > hosted default.
+    const apiUrl = opts.apiUrl ||
+        process.env.SCALEBUN_API_URL ||
+        existing?.apiUrl ||
+        credentials_1.DEFAULT_API_URL;
+    // Refuse a plaintext endpoint before a token is asked for or sent. The API
+    // client enforces the same rule; failing here keeps the token off the wire.
+    try {
+        (0, transportSecurity_1.assertSecureApiUrl)(apiUrl);
+    }
+    catch (err) {
+        console.error(`❌ ${err.message}`);
+        process.exit(1);
+    }
+    // Token resolution: flag > env > interactive masked paste.
+    let token = opts.token || process.env.SCALEBUN_TOKEN;
+    if (!token) {
+        if (!(0, prompt_1.canPromptHidden)()) {
+            console.error('❌ No access token provided and no interactive terminal to paste into.');
+            console.error(`   Pass --token scalebun_pat_… or set SCALEBUN_TOKEN.`);
+            console.error(`   Create a token at: ${TOKEN_PAGE}`);
+            process.exit(1);
+        }
+        console.log('');
+        console.log('Paste your ScaleBun access token to authenticate this machine.');
+        console.log(`Create one at: ${TOKEN_PAGE}`);
+        console.log('(Settings → Access Tokens → New token → scope: read, write)');
+        console.log('');
+        // Re-ask rather than exit. A paste that did not land — the clipboard was
+        // empty, or the terminal swallowed it — is the single most likely reason
+        // this prompt comes back blank, and the fix is to paste again, not to
+        // re-run the whole command. Three tries, so a non-interactive stdin that
+        // returns '' forever cannot spin.
+        for (let attempt = 1;; attempt++) {
+            token = (await (0, prompt_1.promptHidden)('Access token (scalebun_pat_…): ')).trim();
+            if (token)
+                break;
+            if (attempt >= 3) {
+                console.error('❌ No token entered.');
+                console.error(`   Create one at ${TOKEN_PAGE}, or set SCALEBUN_TOKEN.`);
+                process.exit(1);
+            }
+            console.log('  Nothing pasted — the token is hidden as you type, so a blank line');
+            console.log('  usually means the paste did not land. Try again.');
+        }
+    }
+    // Soft format check — warn, don't reject (the token prefix may evolve).
+    if (!token.startsWith('scalebun_pat_')) {
+        console.warn("⚠️  That doesn't look like a scalebun_pat_… token — continuing anyway.");
+    }
+    console.log('  Validating token…');
+    try {
+        const client = new client_1.ApiClient({ apiUrl, token });
+        const me = await client.get('/auth/me');
+        (0, credentials_1.writeCredentials)({ apiUrl, token, email: me.email });
+        console.log(`✅ Logged in as ${me.email} (${me.role ?? 'User'})`);
+        console.log('   Credentials saved to ~/.scalebun/credentials.json');
+        // `--app-id <id>` was load-bearing here before `link` and the resolver
+        // existed. Suggesting a command with a placeholder in it is suggesting
+        // homework, not a command — and `link` is what removes the need for it.
+        (0, output_1.printNextSteps)([
+            { label: 'Bind this project', argv: ['link'] },
+            { label: 'Check it is OTA-ready', argv: ['doctor'] },
+            { label: 'Ship your first update', argv: ['ota', 'publish'] },
+        ], chalk_1.default.cyan);
+    }
+    catch (err) {
+        console.error(`❌ Login failed: ${err.message}`);
+        process.exit(1);
+    }
+}
+//# sourceMappingURL=login.js.map

package/lib/commands/login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/commands/login.ts"],"names":[],"mappings":";;;;;AAiCA,oDAoBC;AAWD,4BAkFC;AAjJD,sDAK8B;AAC9B,0CAA0C;AAC1C,kEAAgE;AAChE,4CAAgE;AAChE,4CAAiD;AACjD,kDAA0B;AAE1B;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,UAAU,GAAG,kDAAkD,CAAC;AAEtE,SAAgB,oBAAoB,CAAC,OAAgB;IACnD,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,iEAAiE,CAAC;SAC9E,MAAM,CACL,iBAAiB,EACjB,6BAA6B,6BAAe,2CAA2C,CACxF;SACA,MAAM,CAAC,eAAe,EAAE,2DAA2D,CAAC;SACpF,MAAM,CAAC,CAAC,IAAkB,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAElD,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,6CAA6C,CAAC;SAC1D,MAAM,CAAC,GAAG,EAAE;QACX,IAAA,8BAAgB,GAAE,CAAC;QACnB,OAAO,CAAC,GAAG,CACT,iHAAiH,CAClH,CAAC;IACJ,CAAC,CAAC,CAAC;AACP,CAAC;AAOD;;;GAGG;AACI,KAAK,UAAU,QAAQ,CAAC,IAAkB;IAC/C,MAAM,QAAQ,GAAG,IAAA,6BAAe,GAAE,CAAC;IAEnC,6EAA6E;IAC7E,MAAM,MAAM,GACV,IAAI,CAAC,MAAM;QACX,OAAO,CAAC,GAAG,CAAC,gBAAgB;QAC5B,QAAQ,EAAE,MAAM;QAChB,6BAAe,CAAC;IAElB,2EAA2E;IAC3E,4EAA4E;IAC5E,IAAI,CAAC;QACH,IAAA,sCAAkB,EAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAClC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,2DAA2D;IAC3D,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAErD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,IAAI,CAAC,IAAA,wBAAe,GAAE,EAAE,CAAC;YACvB,OAAO,CAAC,KAAK,CAAC,uEAAuE,CAAC,CAAC;YACvF,OAAO,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;YACvE,OAAO,CAAC,KAAK,CAAC,yBAAyB,UAAU,EAAE,CAAC,CAAC;YACrD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,gEAAgE,CAAC,CAAC;QAC9E,OAAO,CAAC,GAAG,CAAC,kBAAkB,UAAU,EAAE,CAAC,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAC;QAC3E,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEhB,yEAAyE;QACzE,yEAAyE;QACzE,sEAAsE;QACtE,yEAAyE;QACzE,kCAAkC;QAClC,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;YAClC,KAAK,GAAG,CAAC,MAAM,IAAA,qBAAY,EAAC,iCAAiC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACvE,IAAI,KAAK;gBAAE,MAAM;YACjB,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;gBACjB,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;gBACrC,OAAO,CAAC,KAAK,CAAC,oBAAoB,UAAU,0BAA0B,CAAC,CAAC;gBACxE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,qEAAqE,CAAC,CAAC;YACnF,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QACvC,OAAO,CAAC,IAAI,CAAC,wEAAwE,CAAC,CAAC;IACzF,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,kBAAS,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAChD,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,GAAG,CAAkC,UAAU,CAAC,CAAC;QAEzE,IAAA,8BAAgB,EAAC,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;QACrD,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,IAAI,IAAI,MAAM,GAAG,CAAC,CAAC;QACjE,OAAO,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC;QACpE,uEAAuE;QACvE,uEAAuE;QACvE,wEAAwE;QACxE,IAAA,uBAAc,EACZ;YACE,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE;YAC9C,EAAE,KAAK,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE;YACpD,EAAE,KAAK,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE;SAC9D,EACD,eAAK,CAAC,IAAI,CACX,CAAC;IACJ,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,mBAAmB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAChD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC"}

package/lib/commands/migrate-codepush.d.ts

@@ -0,0 +1,13 @@
+import { Command } from 'commander';
+/**
+ * `scalebun migrate codepush` — Sprint 10 (S10-CLI-1).
+ *
+ * Automated codemod that scans a React Native project and migrates it from
+ * Microsoft CodePush to Scalebun OTA:
+ *   1. Scans .js, .jsx, .ts, .tsx files for `react-native-code-push` imports
+ *   2. Replaces imports with `@scalebun/react-native/compat/codepush`
+ *   3. Replaces `codePush.sync()` calls with `@scalebun/react-native` OTA
+ *   4. Prints summary of rewritten files
+ */
+export declare function registerMigrateCodepushCommand(migrate: Command): void;
+//# sourceMappingURL=migrate-codepush.d.ts.map

package/lib/commands/migrate-codepush.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate-codepush.d.ts","sourceRoot":"","sources":["../../src/commands/migrate-codepush.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC;;;;;;;;;GASG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA8BrE"}

package/lib/commands/migrate-codepush.js

@@ -0,0 +1,98 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerMigrateCodepushCommand = registerMigrateCodepushCommand;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+/**
+ * `scalebun migrate codepush` — Sprint 10 (S10-CLI-1).
+ *
+ * Automated codemod that scans a React Native project and migrates it from
+ * Microsoft CodePush to Scalebun OTA:
+ *   1. Scans .js, .jsx, .ts, .tsx files for `react-native-code-push` imports
+ *   2. Replaces imports with `@scalebun/react-native/compat/codepush`
+ *   3. Replaces `codePush.sync()` calls with `@scalebun/react-native` OTA
+ *   4. Prints summary of rewritten files
+ */
+function registerMigrateCodepushCommand(migrate) {
+    migrate
+        .command('codepush')
+        .description('Migrate a React Native project from Microsoft CodePush to Scalebun OTA')
+        .option('--dir <path>', 'Root directory of the React Native project', '.')
+        .option('--dry-run', 'Show files that would be modified without writing changes')
+        .action((opts) => {
+        const rootDir = path.resolve(opts.dir);
+        console.log(`🚀 Scanning for CodePush usages in: ${rootDir}…\n`);
+        const modifiedFiles = [];
+        scanAndMigrate(rootDir, opts.dryRun ?? false, modifiedFiles);
+        console.log('\n--- Migration Summary ---');
+        if (modifiedFiles.length === 0) {
+            console.log('✨ No CodePush imports found. Project is ready or already using Scalebun!');
+        }
+        else {
+            console.log(`✅ Migrated ${modifiedFiles.length} file(s):`);
+            for (const file of modifiedFiles) {
+                console.log(`   - ${path.relative(rootDir, file)}`);
+            }
+            if (opts.dryRun) {
+                console.log('\n(Dry run complete — no files were modified on disk)');
+            }
+            else {
+                console.log('\n🎉 Migration complete! Run `scalebun ota publish` to ship your first Scalebun update.');
+            }
+        }
+    });
+}
+function scanAndMigrate(dir, dryRun, modified) {
+    const entries = fs.readdirSync(dir, { withFileTypes: true });
+    for (const entry of entries) {
+        const fullPath = path.join(dir, entry.name);
+        if (entry.isDirectory() &&
+            !['node_modules', '.git', 'android', 'ios', 'build', 'dist', '.next'].includes(entry.name)) {
+            scanAndMigrate(fullPath, dryRun, modified);
+        }
+        else if (entry.isFile() && /\.(js|jsx|ts|tsx)$/.test(entry.name)) {
+            const content = fs.readFileSync(fullPath, 'utf-8');
+            if (content.includes('react-native-code-push')) {
+                const updated = content.replace(/['"]react-native-code-push['"]/g, "'@scalebun/react-native/compat/codepush'");
+                if (!dryRun) {
+                    fs.writeFileSync(fullPath, updated, 'utf-8');
+                }
+                modified.push(fullPath);
+            }
+        }
+    }
+}
+//# sourceMappingURL=migrate-codepush.js.map

package/lib/commands/migrate-codepush.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate-codepush.js","sourceRoot":"","sources":["../../src/commands/migrate-codepush.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAcA,wEA8BC;AA5CD,uCAAyB;AACzB,2CAA6B;AAG7B;;;;;;;;;GASG;AACH,SAAgB,8BAA8B,CAAC,OAAgB;IAC7D,OAAO;SACJ,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,wEAAwE,CAAC;SACrF,MAAM,CAAC,cAAc,EAAE,4CAA4C,EAAE,GAAG,CAAC;SACzE,MAAM,CAAC,WAAW,EAAE,2DAA2D,CAAC;SAChF,MAAM,CAAC,CAAC,IAAuC,EAAE,EAAE;QAClD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,uCAAuC,OAAO,KAAK,CAAC,CAAC;QAEjE,MAAM,aAAa,GAAa,EAAE,CAAC;QACnC,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK,EAAE,aAAa,CAAC,CAAC;QAE7D,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;QAC3C,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,CAAC,GAAG,CAAC,0EAA0E,CAAC,CAAC;QAC1F,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,cAAc,aAAa,CAAC,MAAM,WAAW,CAAC,CAAC;YAC3D,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;gBACjC,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;YACtD,CAAC;YACD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,OAAO,CAAC,GAAG,CAAC,uDAAuD,CAAC,CAAC;YACvE,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CACT,yFAAyF,CAC1F,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,cAAc,CAAC,GAAW,EAAE,MAAe,EAAE,QAAkB;IACtE,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAE7D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAE5C,IACE,KAAK,CAAC,WAAW,EAAE;YACnB,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAC1F,CAAC;YACD,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC7C,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACnE,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAEnD,IAAI,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,CAAC;gBAC/C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAC7B,iCAAiC,EACjC,0CAA0C,CAC3C,CAAC;gBAEF,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC/C,CAAC;gBACD,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC"}

package/lib/commands/ota-bundle.d.ts

@@ -0,0 +1,22 @@
+import { Command } from 'commander';
+/**
+ * `scalebun ota bundle build` — package a standalone bundle file for upload.
+ *
+ * ── Why this is `bundle build` and not `bundle` ────────────────────────────
+ *
+ * `ota bundles` (plural) lists what is on the server; `ota bundle` (singular)
+ * ran Metro and hermesc and wrote a file to disk. Two commands one character
+ * apart doing entirely different things is a footgun: reaching for the list
+ * and getting a full Hermes compile is a minute of confusion at best, and at
+ * worst it happens in a pipeline.
+ *
+ * Moving the builder under an explicit verb makes bare `ota bundle` print the
+ * group's help — which disambiguates instead of guessing. `bundle` is kept as
+ * an alias of the group, so nothing that already worked stops working.
+ *
+ * Usage:
+ *   npx scalebun ota bundle build --platform android
+ *   npx scalebun ota bundle build --platform ios --output ./bundles/my-app.bundle
+ */
+export declare function registerOtaBundleCommand(ota: Command): void;
+//# sourceMappingURL=ota-bundle.d.ts.map

package/lib/commands/ota-bundle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ota-bundle.d.ts","sourceRoot":"","sources":["../../src/commands/ota-bundle.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAwFpC;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAuJ3D"}