@scalebun-release/cli 2.5.0

package/lib/commands/ota-delete-bundle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ota-delete-bundle.js","sourceRoot":"","sources":["../../src/commands/ota-delete-bundle.ts"],"names":[],"mappings":";;;;;AA6BA,wEAyFC;AArHD,kDAA0B;AAC1B,sDAAuD;AACvD,0CAA0C;AAC1C,8CAAgD;AAChD,4CAAsE;AACtE,4CAAgE;AAUhE;;;;;;;;;;;;GAYG;AACH,SAAgB,8BAA8B,CAAC,GAAY;IACzD,GAAG;SACA,OAAO,CAAC,eAAe,CAAC;SACxB,KAAK,CAAC,QAAQ,CAAC;SACf,WAAW,CAAC,kCAAkC,CAAC;SAC/C,MAAM,CAAC,eAAe,EAAE,4DAA4D,CAAC;SACrF,MAAM,CAAC,kBAAkB,EAAE,wDAAwD,CAAC;SACpF,MAAM,CAAC,OAAO,EAAE,wEAAwE,CAAC;SACzF,MAAM,CAAC,KAAK,EAAE,IAA0D,EAAE,EAAE;QAC3E,MAAM,KAAK,GAAG,IAAA,6BAAe,GAAE,CAAC;QAChC,IAAI,CAAC,KAAK;YAAE,IAAA,aAAI,EAAC,4CAA4C,EAAE,EAAE,EAAE,iBAAQ,CAAC,KAAK,CAAC,CAAC;QAEnF,MAAM,KAAK,GAAG,MAAM,IAAA,sBAAY,EAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,IAAI,kBAAS,CAAC,KAAM,CAAC,CAAC;QAErC,qEAAqE;QACrE,IAAI,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC7B,IAAI,MAA6B,CAAC;QAClC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;gBACzB,IAAA,aAAI,EACF,0BAA0B,EAC1B;oBACE,uCAAuC;oBACvC,qEAAqE;iBACtE,EACD,iBAAQ,CAAC,KAAK,CACf,CAAC;YACJ,CAAC;YACD,IAAI,IAAiB,CAAC;YACtB,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAC1B,cAAc,KAAK,0BAA0B,CAC9C,CAAC;gBACF,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;YACtD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAA,sBAAa,EAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;YAC/C,CAAC;YACD,IAAI,CAAC,IAAK,CAAC,MAAM,EAAE,CAAC;gBAClB,IAAA,aAAI,EAAC,yBAAyB,EAAE,CAAC,oBAAoB,CAAC,EAAE,iBAAQ,CAAC,KAAK,CAAC,CAAC;YAC1E,CAAC;YACD,MAAM,GAAG,MAAM,IAAA,eAAM,EACnB,6CAA6C,EAC7C,IAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC7B,KAAK,EACH,GAAG,CAAC,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI;oBAC7D,eAAK,CAAC,GAAG,CACP,GAAG,CAAC,CAAC,QAAQ,IAAI,GAAG,MAAM,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,SAAS,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,EAAE,CAClG;gBACH,KAAK,EAAE,CAAC;aACT,CAAC,CAAC,CACJ,CAAC;YACF,IAAA,qBAAY,GAAE,CAAC;YACf,QAAQ,GAAG,MAAM,CAAC,EAAE,CAAC;QACvB,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,EAAE,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,QAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAErF,2EAA2E;QAC3E,qDAAqD;QACrD,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YACd,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;gBACzB,IAAA,aAAI,EACF,qEAAqE,EACrE,CAAC,2CAA2C,CAAC,EAC7C,iBAAQ,CAAC,KAAK,CACf,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,GAAG,CACT,yCAAyC,KAAK,KAAK,QAAQ,cAAc,KAAK,KAAK;gBACjF,0EAA0E;gBAC1E,uEAAuE,CAC1E,CAAC;YACF,MAAM,EAAE,GAAG,MAAM,IAAA,sBAAa,EAAC,gCAAgC,EAAE,QAAS,CAAC,CAAC;YAC5E,IAAA,qBAAY,GAAE,CAAC;YACf,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;gBAC9C,OAAO;YACT,CAAC;QACH,CAAC;QAED,IAAI,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,aAAa,KAAK,GAAG,CAAC,CAAC;YAChE,MAAM,MAAM,CAAC,MAAM,CAAU,cAAc,KAAK,gBAAgB,QAAQ,EAAE,CAAC,CAAC;YAC5E,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,wBAAwB,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAA,sBAAa,EAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;QAChD,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/lib/commands/ota-inspect.d.ts

@@ -0,0 +1,3 @@
+import { Command } from 'commander';
+export declare function registerOtaInspectCommands(ota: Command): void;
+//# sourceMappingURL=ota-inspect.d.ts.map

package/lib/commands/ota-inspect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ota-inspect.d.ts","sourceRoot":"","sources":["../../src/commands/ota-inspect.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA6GpC,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAkN7D"}

package/lib/commands/ota-inspect.js

@@ -0,0 +1,258 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerOtaInspectCommands = registerOtaInspectCommands;
+const chalk_1 = __importDefault(require("chalk"));
+const client_1 = require("../api/client");
+const validate_1 = require("../utils/validate");
+const output_1 = require("../utils/output");
+/** Kept beside the flags that accept them so the help text cannot drift. */
+const PLATFORMS = ['android', 'ios'];
+const BUNDLE_SORTS = ['newest', 'oldest', 'version', 'largest'];
+const credentials_1 = require("../utils/credentials");
+const resolve_1 = require("../utils/resolve");
+const context_1 = require("../utils/context");
+const output_2 = require("../utils/output");
+/** Decimal MB, defined once. The dashboard reported MiB on one tab and MB on
+ *  another, both labelled "MB", so the same bundle showed two sizes. */
+function mb(bytes) {
+    if (typeof bytes !== 'number')
+        return '—';
+    return `${(bytes / 1000000).toFixed(2)} MB`;
+}
+function age(iso) {
+    if (!iso)
+        return '—';
+    const ms = Date.now() - new Date(iso).getTime();
+    if (!Number.isFinite(ms) || ms < 0)
+        return '—';
+    const h = ms / 3600000;
+    if (h < 1)
+        return `${Math.max(1, Math.round(ms / 60000))}m`;
+    if (h < 48)
+        return `${Math.round(h)}h`;
+    return `${Math.round(h / 24)}d`;
+}
+/**
+ * One vocabulary for a rate, used everywhere.
+ *
+ * The dashboard rendered this five different ways — "no data", "not measured",
+ * "too early", a green "0.00% ✓" and a flat "0%". Two of those manufactured a
+ * passing grade out of zero installs. Three states only: a number, "collecting"
+ * below the floor, or a named reason.
+ */
+const RATE_FLOOR = 25;
+function rate(installs = 0, rollbacks = 0) {
+    if (installs === 0)
+        return chalk_1.default.dim('no installs');
+    if (installs < RATE_FLOOR)
+        return chalk_1.default.dim(`collecting · ${installs}/${RATE_FLOOR}`);
+    const pct = (rollbacks / installs) * 100;
+    const s = `${pct.toFixed(1)}%`;
+    return pct >= 5 ? chalk_1.default.red(s) : pct >= 2 ? chalk_1.default.yellow(s) : chalk_1.default.green(s);
+}
+function statusLabel(s) {
+    switch (s) {
+        case 'ACTIVE': return chalk_1.default.cyan('live');
+        case 'PAUSED': return chalk_1.default.yellow('paused');
+        case 'ROLLED_BACK': return chalk_1.default.red('rolled back');
+        // Superseded is the NORMAL end of every release, so it is never coloured
+        // like a failure. Painting it red made 7 of 8 rows look like disasters.
+        case 'SUPERSEDED': return chalk_1.default.dim('superseded');
+        default: return chalk_1.default.dim(s.toLowerCase());
+    }
+}
+function registerOtaInspectCommands(ota) {
+    // ── ota bundles ───────────────────────────────────────────────────────────
+    ota
+        .command('bundles')
+        .alias('bundle-list')
+        .description('List uploaded bundles — the only way to learn a --bundle-id')
+        .option('--app-id <id>', 'Scalebun app ID (resolved from scalebun.json when omitted)')
+        .option('--platform <p>', 'ios | android')
+        .option('--signed <v>', 'signed | unsigned')
+        .option('--search <q>', 'Match version, hash or note')
+        .option('--sort <s>', 'newest | oldest | version | largest', 'newest')
+        .option('--limit <n>', 'How many to show', '20')
+        .option('--latest', 'Print only the newest bundle id, for scripting')
+        .option('--json', 'Machine-readable output')
+        .action(async (opts) => {
+        const creds = (0, credentials_1.readCredentials)();
+        if (!creds)
+            (0, output_2.fail)('Not signed in.', ['Run `scalebun login`.'], output_2.ExitCode.Usage);
+        const appId = await (0, resolve_1.resolveAppId)({ appId: opts.appId, nonInteractive: opts.json });
+        // Everything is checked BEFORE the round trip: a typo should cost a
+        // second, not a request. (--limit was validated after the fetch, so junk
+        // still paid for the network.)
+        const limit = (0, validate_1.checkedInt)('--limit', opts.limit, { min: 1, max: 1000, fallback: 20 });
+        // Every one of these was forwarded to the API verbatim. A typo did not
+        // fail — it produced a filtered list that looked authoritative, which is
+        // the worst outcome for a command whose whole job is telling you what
+        // exists.
+        const qs = new URLSearchParams();
+        if (opts.platform)
+            qs.set('platform', (0, validate_1.checkedEnum)('--platform', opts.platform, PLATFORMS, { caseInsensitive: true }));
+        if (opts.signed)
+            qs.set('signed', (0, validate_1.checkedEnum)('--signed', opts.signed, ['signed', 'unsigned'], { caseInsensitive: true }));
+        if (opts.search)
+            qs.set('search', opts.search);
+        if (opts.sort)
+            qs.set('sort', (0, validate_1.checkedEnum)('--sort', opts.sort, BUNDLE_SORTS, { caseInsensitive: true }));
+        let rows;
+        try {
+            const res = await new client_1.ApiClient(creds).get(`/saas/apps/${appId}/ota/bundles${qs.toString() ? `?${qs}` : ''}`);
+            // The endpoint returns a plain array without `page` and an envelope
+            // with it — accept both rather than pinning one shape.
+            rows = Array.isArray(res) ? res : (res?.rows ?? []);
+        }
+        catch (err) {
+            (0, output_2.failFromError)('Could not list bundles', err);
+        }
+        const shown = rows.slice(0, limit);
+        // --latest exists so a pipeline can do the thing that was impossible:
+        //   BUNDLE=$(scalebun ota bundles --latest)
+        if (opts.latest) {
+            const newest = shown[0];
+            if (!newest)
+                (0, output_2.fail)('No bundles on this app.', [], output_2.ExitCode.Usage);
+            (0, output_2.emit)(() => console.log(newest.id), { ok: true, bundleId: newest.id, version: newest.version ?? null });
+            return;
+        }
+        (0, output_2.emit)(() => {
+            if (!shown.length) {
+                console.log('\nNo bundles match.');
+                // The early return skipped the block at the end of this function,
+                // so the empty state — the one place a next step is worth most,
+                // because there is nothing on screen to act on — offered nothing.
+                (0, output_1.printNextSteps)([{ label: 'Build and ship one', argv: ['ota', 'publish'] }], chalk_1.default.cyan);
+                return;
+            }
+            console.log('');
+            for (const b of shown) {
+                const v = b.version != null ? `v${b.version}` : b.id.slice(0, 8);
+                const sig = b.signature ? chalk_1.default.green('signed') : chalk_1.default.yellow('unsigned');
+                console.log(`  ${chalk_1.default.bold(v.padEnd(6))} ${chalk_1.default.dim((b.platform ?? '?').padEnd(8))} ` +
+                    `${mb(b.sizeBytes).padStart(9)}  ${sig.padEnd(18)} ${chalk_1.default.dim(age(b.createdAt).padStart(4))}  ${chalk_1.default.dim(b.id)}`);
+            }
+            if (rows.length > shown.length) {
+                console.log(chalk_1.default.dim(`\n  ${rows.length - shown.length} more — raise --limit to see them.`));
+            }
+            console.log('');
+            // This list exists to find something to promote — its own help text
+            // calls it "the only way to learn a --bundle-id". The empty case
+            // returned above, so there is nothing to branch on here.
+            (0, output_1.printNextSteps)([
+                { label: 'Make one live', argv: ['ota', 'promote'] },
+                { label: 'See what is live', argv: ['ota', 'status'] },
+            ], chalk_1.default.cyan);
+        }, { ok: true, count: shown.length, total: rows.length, bundles: shown });
+    });
+    // ── ota status ────────────────────────────────────────────────────────────
+    ota
+        .command('status')
+        .description('What is live, and what needs a decision')
+        .option('--app-id <id>', 'Scalebun app ID (resolved from scalebun.json when omitted)')
+        .option('--fail-on <level>', 'Exit 3 when an item at this level exists: act | read')
+        .option('--json', 'Machine-readable output')
+        .action(async (opts) => {
+        // Checked here rather than where it is used, at the bottom of the action:
+        // a typo used to disable the gate silently — `--fail-on acts` matched no
+        // branch, the command exited 0, and the pipeline went green having
+        // checked nothing. A gate that a typo can switch off is not a gate. And
+        // validating up here means the whole report is not printed before the
+        // usage error that invalidates it.
+        const failOn = opts.failOn
+            ? (0, validate_1.checkedEnum)('--fail-on', opts.failOn, ['act', 'read'], { caseInsensitive: true })
+            : undefined;
+        const creds = (0, credentials_1.readCredentials)();
+        if (!creds)
+            (0, output_2.fail)('Not signed in.', ['Run `scalebun login`.'], output_2.ExitCode.Usage);
+        const appId = await (0, resolve_1.resolveAppId)({ appId: opts.appId, nonInteractive: opts.json });
+        const client = new client_1.ApiClient(creds);
+        // Composed from endpoints that already exist. Attention evaluates guards
+        // DRY, so asking for status can never pause a live release.
+        const [releases, attention] = await Promise.all([
+            client.get(`/saas/apps/${appId}/ota/releases`).catch(() => []),
+            client.get(`/saas/apps/${appId}/ota/attention`).catch(() => null),
+        ]);
+        // Any command that fetched releases refreshes the cache the splash reads.
+        if (Array.isArray(releases))
+            (0, context_1.cacheReleaseCount)(releases.length, process.cwd());
+        const live = (releases ?? []).filter((r) => r.status === 'ACTIVE');
+        const items = attention?.items ?? [];
+        const actItems = items.filter((i) => i.severity === 'act');
+        (0, output_2.emit)(() => {
+            console.log('');
+            if (!live.length) {
+                console.log(chalk_1.default.dim('  Nothing is live on this app.'));
+            }
+            for (const r of live) {
+                const v = r.bundle?.version != null ? `v${r.bundle.version}` : r.id.slice(0, 8);
+                const s = r.stats ?? {};
+                console.log(`  ${chalk_1.default.bold(v)} ${statusLabel(r.status)} ${chalk_1.default.dim('@')} ${chalk_1.default.bold(`${r.rolloutPercent ?? 0}%`)}` +
+                    chalk_1.default.dim(`  ${r.bundle?.platform ?? ''} · ${r.bundle?.channel?.name ?? 'default'} · ${age(r.createdAt)} old`));
+                console.log(chalk_1.default.dim(`     installs `) + String(s.installs ?? 0).padEnd(8) +
+                    chalk_1.default.dim('rollback rate ') + rate(s.installs, s.rollbacks));
+            }
+            console.log('');
+            if (!attention) {
+                console.log(chalk_1.default.yellow('  Could not evaluate what needs a decision.'));
+            }
+            else {
+                const g = attention.guards;
+                if (g) {
+                    // NEVER collapse an unevaluated guard into "0 breaching" — an app
+                    // that was not measured has not been found clean.
+                    const breach = g.evaluated
+                        ? `${g.breaching ?? 0} breaching`
+                        : chalk_1.default.dim(`not evaluated${g.reason ? ` (${g.reason})` : ''}`);
+                    console.log(chalk_1.default.dim(`  guards  ${g.armed} armed · ${breach}`));
+                }
+                if (!items.length) {
+                    console.log(chalk_1.default.green('  Nothing needs a decision.'));
+                }
+                else {
+                    for (const i of items) {
+                        const tag = i.severity === 'act' ? chalk_1.default.yellow('act ') : chalk_1.default.dim('read');
+                        console.log(`  ${tag}  ${i.title}`);
+                        if (i.facts?.length)
+                            console.log(chalk_1.default.dim(`        ${i.facts.join(' · ')}`));
+                    }
+                }
+            }
+            // Offer the levers that match the state. With a release live these
+            // are the three things you can do about it; with nothing live the
+            // only honest suggestion is to ship something.
+            (0, output_1.printNextSteps)(live.length
+                ? [
+                    { label: 'Change the share', argv: ['ota', 'rollout', '--percent', '100'] },
+                    { label: 'Stop new deliveries', argv: ['ota', 'pause'] },
+                    { label: 'Revert every device', argv: ['ota', 'rollback'] },
+                ]
+                : [{ label: 'Ship an update', argv: ['ota', 'publish'] }], chalk_1.default.cyan);
+        }, {
+            ok: true,
+            live: live.map((r) => ({
+                id: r.id, version: r.bundle?.version ?? null,
+                rolloutPercent: r.rolloutPercent ?? 0, stats: r.stats ?? {},
+            })),
+            guards: attention?.guards ?? null,
+            attention: items,
+        });
+        // --fail-on turns status into a CI gate. Exit 3 is "a check you asked for
+        // said no" — distinct from a 4xx (2) and from the API being down (4).
+        if (failOn === 'act' && actItems.length) {
+            if (!(0, output_2.isJson)())
+                console.error(chalk_1.default.yellow(`  ${actItems.length} decision(s) waiting.`));
+            process.exit(output_2.ExitCode.Gate);
+        }
+        if (failOn === 'read' && items.length) {
+            if (!(0, output_2.isJson)())
+                console.error(chalk_1.default.yellow(`  ${items.length} item(s) to review.`));
+            process.exit(output_2.ExitCode.Gate);
+        }
+    });
+}
+//# sourceMappingURL=ota-inspect.js.map

package/lib/commands/ota-inspect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ota-inspect.js","sourceRoot":"","sources":["../../src/commands/ota-inspect.ts"],"names":[],"mappings":";;;;;AA6GA,gEAkNC;AA9TD,kDAA0B;AAC1B,0CAA0C;AAC1C,gDAA4D;AAC5D,4CAAiD;AAEjD,4EAA4E;AAC5E,MAAM,SAAS,GAAG,CAAC,SAAS,EAAE,KAAK,CAAU,CAAC;AAC9C,MAAM,YAAY,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAU,CAAC;AACzE,sDAAuD;AACvD,8CAAgD;AAChD,8CAAqD;AACrD,4CAA8E;AAmD9E;wEACwE;AACxE,SAAS,EAAE,CAAC,KAAc;IACxB,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IAC1C,OAAO,GAAG,CAAC,KAAK,GAAG,OAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;AAChD,CAAC;AAED,SAAS,GAAG,CAAC,GAAY;IACvB,IAAI,CAAC,GAAG;QAAE,OAAO,GAAG,CAAC;IACrB,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;IAChD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IAC/C,MAAM,CAAC,GAAG,EAAE,GAAG,OAAS,CAAC;IACzB,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,KAAM,CAAC,CAAC,GAAG,CAAC;IAC7D,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC;IACvC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC;AAClC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,SAAS,IAAI,CAAC,QAAQ,GAAG,CAAC,EAAE,SAAS,GAAG,CAAC;IACvC,IAAI,QAAQ,KAAK,CAAC;QAAE,OAAO,eAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACpD,IAAI,QAAQ,GAAG,UAAU;QAAE,OAAO,eAAK,CAAC,GAAG,CAAC,gBAAgB,QAAQ,IAAI,UAAU,EAAE,CAAC,CAAC;IACtF,MAAM,GAAG,GAAG,CAAC,SAAS,GAAG,QAAQ,CAAC,GAAG,GAAG,CAAC;IACzC,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC;IAC/B,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,eAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,eAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,eAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,WAAW,CAAC,CAAS;IAC5B,QAAQ,CAAC,EAAE,CAAC;QACV,KAAK,QAAQ,CAAC,CAAC,OAAO,eAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzC,KAAK,QAAQ,CAAC,CAAC,OAAO,eAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC7C,KAAK,aAAa,CAAC,CAAC,OAAO,eAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACpD,yEAAyE;QACzE,wEAAwE;QACxE,KAAK,YAAY,CAAC,CAAC,OAAO,eAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAClD,OAAO,CAAC,CAAC,OAAO,eAAK,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC;AAED,SAAgB,0BAA0B,CAAC,GAAY;IACrD,6EAA6E;IAC7E,GAAG;SACA,OAAO,CAAC,SAAS,CAAC;SAClB,KAAK,CAAC,aAAa,CAAC;SACpB,WAAW,CAAC,6DAA6D,CAAC;SAC1E,MAAM,CAAC,eAAe,EAAE,4DAA4D,CAAC;SACrF,MAAM,CAAC,gBAAgB,EAAE,eAAe,CAAC;SACzC,MAAM,CAAC,cAAc,EAAE,mBAAmB,CAAC;SAC3C,MAAM,CAAC,cAAc,EAAE,6BAA6B,CAAC;SACrD,MAAM,CAAC,YAAY,EAAE,qCAAqC,EAAE,QAAQ,CAAC;SACrE,MAAM,CAAC,aAAa,EAAE,kBAAkB,EAAE,IAAI,CAAC;SAC/C,MAAM,CAAC,UAAU,EAAE,gDAAgD,CAAC;SACpE,MAAM,CAAC,QAAQ,EAAE,yBAAyB,CAAC;SAC3C,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,KAAK,GAAG,IAAA,6BAAe,GAAE,CAAC;QAChC,IAAI,CAAC,KAAK;YAAE,IAAA,aAAI,EAAC,gBAAgB,EAAE,CAAC,uBAAuB,CAAC,EAAE,iBAAQ,CAAC,KAAK,CAAC,CAAC;QAC9E,MAAM,KAAK,GAAG,MAAM,IAAA,sBAAY,EAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,cAAc,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAEnF,oEAAoE;QACpE,yEAAyE;QACzE,+BAA+B;QAC/B,MAAM,KAAK,GAAG,IAAA,qBAAU,EAAC,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;QAErF,uEAAuE;QACvE,yEAAyE;QACzE,sEAAsE;QACtE,UAAU;QACV,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;QACjC,IAAI,IAAI,CAAC,QAAQ;YAAE,EAAE,CAAC,GAAG,CAAC,UAAU,EAAE,IAAA,sBAAW,EAAC,YAAY,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACtH,IAAI,IAAI,CAAC,MAAM;YAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAA,sBAAW,EAAC,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,UAAU,CAAU,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACpI,IAAI,IAAI,CAAC,MAAM;YAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,IAAI,CAAC,IAAI;YAAE,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,IAAA,sBAAW,EAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAEzG,IAAI,IAAiB,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,kBAAS,CAAC,KAAM,CAAC,CAAC,GAAG,CACzC,cAAc,KAAK,eAAe,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAClE,CAAC;YACF,oEAAoE;YACpE,uDAAuD;YACvD,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAA,sBAAa,EAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,KAAK,GAAG,IAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAEpC,sEAAsE;QACtE,4CAA4C;QAC5C,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,CAAC,MAAM;gBAAE,IAAA,aAAI,EAAC,yBAAyB,EAAE,EAAE,EAAE,iBAAQ,CAAC,KAAK,CAAC,CAAC;YACjE,IAAA,aAAI,EAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAO,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAO,CAAC,EAAE,EAAE,OAAO,EAAE,MAAO,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC,CAAC;YAC1G,OAAO;QACT,CAAC;QAED,IAAA,aAAI,EACF,GAAG,EAAE;YACH,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;gBAClB,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;gBACnC,kEAAkE;gBAClE,gEAAgE;gBAChE,kEAAkE;gBAClE,IAAA,uBAAc,EAAC,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC,EAAE,eAAK,CAAC,IAAI,CAAC,CAAC;gBACxF,OAAO;YACT,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;gBACtB,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBACjE,MAAM,GAAG,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,eAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;gBAC3E,OAAO,CAAC,GAAG,CACT,KAAK,eAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,eAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG;oBACzE,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,eAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,eAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CACrH,CAAC;YACJ,CAAC;YACD,IAAI,IAAK,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;gBAChC,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,GAAG,CAAC,OAAO,IAAK,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,oCAAoC,CAAC,CAAC,CAAC;YACjG,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,oEAAoE;YACpE,iEAAiE;YACjE,yDAAyD;YACzD,IAAA,uBAAc,EACZ;gBACE,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE;gBACpD,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE;aACvD,EACD,eAAK,CAAC,IAAI,CACX,CAAC;QACJ,CAAC,EACD,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,IAAK,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CACvE,CAAC;IACJ,CAAC,CAAC,CAAC;IAEL,6EAA6E;IAC7E,GAAG;SACA,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,yCAAyC,CAAC;SACtD,MAAM,CAAC,eAAe,EAAE,4DAA4D,CAAC;SACrF,MAAM,CAAC,mBAAmB,EAAE,sDAAsD,CAAC;SACnF,MAAM,CAAC,QAAQ,EAAE,yBAAyB,CAAC;SAC3C,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,0EAA0E;QAC1E,yEAAyE;QACzE,mEAAmE;QACnE,wEAAwE;QACxE,sEAAsE;QACtE,mCAAmC;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM;YACxB,CAAC,CAAC,IAAA,sBAAW,EAAC,WAAW,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,CAAU,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;YAC5F,CAAC,CAAC,SAAS,CAAC;QAEd,MAAM,KAAK,GAAG,IAAA,6BAAe,GAAE,CAAC;QAChC,IAAI,CAAC,KAAK;YAAE,IAAA,aAAI,EAAC,gBAAgB,EAAE,CAAC,uBAAuB,CAAC,EAAE,iBAAQ,CAAC,KAAK,CAAC,CAAC;QAC9E,MAAM,KAAK,GAAG,MAAM,IAAA,sBAAY,EAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,cAAc,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACnF,MAAM,MAAM,GAAG,IAAI,kBAAS,CAAC,KAAM,CAAC,CAAC;QAErC,yEAAyE;QACzE,4DAA4D;QAC5D,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC9C,MAAM,CAAC,GAAG,CAAe,cAAc,KAAK,eAAe,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAkB,CAAC;YAC5F,MAAM,CAAC,GAAG,CAAkB,cAAc,KAAK,gBAAgB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;SACnF,CAAC,CAAC;QAEH,0EAA0E;QAC1E,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;YAAE,IAAA,2BAAiB,EAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAE/E,MAAM,IAAI,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;QACnE,MAAM,KAAK,GAAG,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC;QAE3D,IAAA,aAAI,EACF,GAAG,EAAE;YACH,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACjB,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC,CAAC;YAC3D,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;gBACrB,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBAChF,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACxB,OAAO,CAAC,GAAG,CACT,KAAK,eAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,eAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,eAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,cAAc,IAAI,CAAC,GAAG,CAAC,EAAE;oBACxG,eAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,QAAQ,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,IAAI,SAAS,MAAM,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CACjH,CAAC;gBACF,OAAO,CAAC,GAAG,CACT,eAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;oBAC7D,eAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,SAAS,CAAC,CAC9D,CAAC;YACJ,CAAC;YAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,MAAM,CAAC,6CAA6C,CAAC,CAAC,CAAC;YAC3E,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC;gBAC3B,IAAI,CAAC,EAAE,CAAC;oBACN,kEAAkE;oBAClE,kDAAkD;oBAClD,MAAM,MAAM,GAAG,CAAC,CAAC,SAAS;wBACxB,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,IAAI,CAAC,YAAY;wBACjC,CAAC,CAAC,eAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBAClE,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,KAAK,YAAY,MAAM,EAAE,CAAC,CAAC,CAAC;gBACnE,CAAC;gBACD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;oBAClB,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC,CAAC;gBAC1D,CAAC;qBAAM,CAAC;oBACN,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;wBACtB,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,eAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,eAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;wBAC5E,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;wBACpC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM;4BAAE,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;oBAChF,CAAC;gBACH,CAAC;YACH,CAAC;YACD,mEAAmE;YACnE,kEAAkE;YAClE,+CAA+C;YAC/C,IAAA,uBAAc,EACZ,IAAI,CAAC,MAAM;gBACT,CAAC,CAAC;oBACE,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC,EAAE;oBAC3E,EAAE,KAAK,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE;oBACxD,EAAE,KAAK,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE;iBAC5D;gBACH,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC,EAC3D,eAAK,CAAC,IAAI,CACX,CAAC;QACJ,CAAC,EACD;YACE,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACrB,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,IAAI,IAAI;gBAC5C,cAAc,EAAE,CAAC,CAAC,cAAc,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE;aAC5D,CAAC,CAAC;YACH,MAAM,EAAE,SAAS,EAAE,MAAM,IAAI,IAAI;YACjC,SAAS,EAAE,KAAK;SACjB,CACF,CAAC;QAEF,0EAA0E;QAC1E,sEAAsE;QACtE,IAAI,MAAM,KAAK,KAAK,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;YACxC,IAAI,CAAC,IAAA,eAAM,GAAE;gBAAE,OAAO,CAAC,KAAK,CAAC,eAAK,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,MAAM,uBAAuB,CAAC,CAAC,CAAC;YACxF,OAAO,CAAC,IAAI,CAAC,iBAAQ,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC;QACD,IAAI,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACtC,IAAI,CAAC,IAAA,eAAM,GAAE;gBAAE,OAAO,CAAC,KAAK,CAAC,eAAK,CAAC,MAAM,CAAC,KAAK,KAAK,CAAC,MAAM,qBAAqB,CAAC,CAAC,CAAC;YACnF,OAAO,CAAC,IAAI,CAAC,iBAAQ,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/lib/commands/ota-keys.d.ts

@@ -0,0 +1,91 @@
+import { Command } from 'commander';
+import * as crypto from 'crypto';
+import { ApiClient } from '../api/client';
+import { spkiFingerprint } from '../utils/signing';
+/**
+ * OTA signing keys for SB-OTA-RSA-SHA256-V1 (RSA-3072 / SHA-256).
+ *
+ * The security model, and the reason this command exists: the private key is
+ * generated on the developer's machine and NEVER leaves it. Only the SPKI PUBLIC
+ * key is uploaded/registered. A server that cannot sign cannot forge a release,
+ * so a compromise of ScaleBun's infrastructure still cannot push code to a
+ * customer's users.
+ *
+ * (Pre-1.14 ScaleBun signed with ed25519 over the bundle's SHA-256. That path is
+ * removed: the protocol is now native-verifiable RSA on every supported Android
+ * API level. Legacy ed25519 key ROWS remain readable in the dashboard, labelled
+ * "Ed25519 — Legacy"; new keys are RSA only.)
+ */
+export declare const KEY_DIR = ".scalebun";
+export declare const PRIVATE_KEY_FILE = "ota-signing-key.pem";
+export declare const PUBLIC_KEY_FILE = "ota-signing-key.pub.pem";
+export declare const KEY_ID_FILE = "ota-key-id.txt";
+/** Absolute path to the private key for a key dir (default ./.scalebun). */
+export declare function privateKeyPath(keyDir?: string): string;
+/** The locally stored keyId, if any (written next to the private key at generate). */
+export declare function readLocalKeyId(keyDir?: string): string | null;
+/** The local private key PEM, if present. */
+export declare function readLocalPrivatePem(keyDir?: string): string | null;
+/** SPKI public-key PEM derived from the local private key, if present. */
+export declare function localPublicPem(keyDir?: string): string | null;
+export declare const ENV_SIGNING_PRIVATE_KEY = "SCALEBUN_SIGNING_PRIVATE_KEY";
+export declare const ENV_SIGNING_KEY_PASSPHRASE = "SCALEBUN_SIGNING_KEY_PASSPHRASE";
+export declare const ENV_KEY_ID = "SCALEBUN_KEY_ID";
+export declare const ENV_REQUIRE_SIGNING = "SCALEBUN_REQUIRE_SIGNING";
+export type MaterialSource = 'flag' | 'env' | 'file' | 'none';
+export interface SigningMaterial {
+    /** PKCS#8 private-key PEM (possibly encrypted), or null when none is configured. */
+    privatePem: string | null;
+    privateSource: MaterialSource;
+    keyId: string | null;
+    keyIdSource: MaterialSource;
+    /** Passphrase for an encrypted private key, if supplied. */
+    passphrase: string | undefined;
+}
+/**
+ * Resolve the RSA signing material with precedence **CLI flag > env var > local
+ * .scalebun file**, for each of: private key, key id, passphrase.
+ *
+ *   private key : --key-dir <dir>/ota-signing-key.pem
+ *                 → $SCALEBUN_SIGNING_PRIVATE_KEY (PEM contents)
+ *                 → ./.scalebun/ota-signing-key.pem
+ *   key id      : --key-id → $SCALEBUN_KEY_ID → ./.scalebun/ota-key-id.txt
+ *   passphrase  : --passphrase → $SCALEBUN_SIGNING_KEY_PASSPHRASE
+ */
+export declare function resolveSigningMaterial(opts: {
+    keyDir?: string;
+    keyId?: string;
+    passphrase?: string;
+}): SigningMaterial;
+/**
+ * Whether this publish must be signed (so a missing key fails closed instead of
+ * silently shipping an unsigned release a signature-enforcing device rejects).
+ *
+ * True when: --require-signing / $SCALEBUN_REQUIRE_SIGNING is set, OR a key id is
+ * configured by any source (a configured key id means "sign with this key").
+ */
+export declare function signingRequired(opts: {
+    requireSigning?: boolean;
+}, material: SigningMaterial): boolean;
+/**
+ * Keep the private key out of version control WITHOUT relying on the operator
+ * reading a warning. An existing .gitignore is appended to; a missing one is
+ * created only inside an actual git repo. Returns a human-readable outcome.
+ */
+export declare function ensureKeyDirGitignored(outDir: string, cwd?: string): string;
+/**
+ * Prove possession of a signing key without leaving the terminal.
+ *
+ * Registering a public key only asserts "trust this key". Proving possession
+ * shows the caller actually holds the private half — and until that happens the
+ * key is not ACTIVE and every promote is refused as high-risk. It is not
+ * optional in practice, so it should not be a separate errand.
+ *
+ * The private key never leaves this machine: the server mints the bytes, we sign
+ * those exact bytes, and only the signature goes back.
+ */
+export declare function proveOwnership(client: ApiClient, appId: string, keyRowId: string, privateKey: crypto.KeyObject): Promise<boolean>;
+export declare function registerOtaKeysCommand(ota: Command): void;
+/** Re-export so callers can compute a fingerprint without importing signing.ts. */
+export { spkiFingerprint };
+//# sourceMappingURL=ota-keys.d.ts.map

package/lib/commands/ota-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ota-keys.d.ts","sourceRoot":"","sources":["../../src/commands/ota-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AASjC,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAwC,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEzF;;;;;;;;;;;;;GAaG;AAEH,eAAO,MAAM,OAAO,cAAc,CAAC;AACnC,eAAO,MAAM,gBAAgB,wBAAwB,CAAC;AACtD,eAAO,MAAM,eAAe,4BAA4B,CAAC;AACzD,eAAO,MAAM,WAAW,mBAAmB,CAAC;AAE5C,4EAA4E;AAC5E,wBAAgB,cAAc,CAAC,MAAM,GAAE,MAAgB,GAAG,MAAM,CAE/D;AAED,sFAAsF;AACtF,wBAAgB,cAAc,CAAC,MAAM,GAAE,MAAgB,GAAG,MAAM,GAAG,IAAI,CAStE;AAED,6CAA6C;AAC7C,wBAAgB,mBAAmB,CAAC,MAAM,GAAE,MAAgB,GAAG,MAAM,GAAG,IAAI,CAG3E;AAED,0EAA0E;AAC1E,wBAAgB,cAAc,CAAC,MAAM,GAAE,MAAgB,GAAG,MAAM,GAAG,IAAI,CAQtE;AAOD,eAAO,MAAM,uBAAuB,iCAAiC,CAAC;AACtE,eAAO,MAAM,0BAA0B,oCAAoC,CAAC;AAC5E,eAAO,MAAM,UAAU,oBAAoB,CAAC;AAC5C,eAAO,MAAM,mBAAmB,6BAA6B,CAAC;AAY9D,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC;AAE9D,MAAM,WAAW,eAAe;IAC9B,oFAAoF;IACpF,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,aAAa,EAAE,cAAc,CAAC;IAC9B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,WAAW,EAAE,cAAc,CAAC;IAC5B,4DAA4D;IAC5D,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,eAAe,CAsClB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE;IAAE,cAAc,CAAC,EAAE,OAAO,CAAA;CAAE,EAClC,QAAQ,EAAE,eAAe,GACxB,OAAO,CAKT;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,GAAE,MAAsB,GAAG,MAAM,CA4B1F;AA2BD;;;;;;;;;;GAUG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,SAAS,EACjB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,CAAC,SAAS,GAC3B,OAAO,CAAC,OAAO,CAAC,CAalB;AA0ND,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CA2JzD;AA4MD,mFAAmF;AACnF,OAAO,EAAE,eAAe,EAAE,CAAC"}