@scalebun-release/cli 2.5.0

package/lib/commands/ota-keys.js

@@ -0,0 +1,765 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.spkiFingerprint = exports.ENV_REQUIRE_SIGNING = exports.ENV_KEY_ID = exports.ENV_SIGNING_KEY_PASSPHRASE = exports.ENV_SIGNING_PRIVATE_KEY = exports.KEY_ID_FILE = exports.PUBLIC_KEY_FILE = exports.PRIVATE_KEY_FILE = exports.KEY_DIR = void 0;
+exports.privateKeyPath = privateKeyPath;
+exports.readLocalKeyId = readLocalKeyId;
+exports.readLocalPrivatePem = readLocalPrivatePem;
+exports.localPublicPem = localPublicPem;
+exports.resolveSigningMaterial = resolveSigningMaterial;
+exports.signingRequired = signingRequired;
+exports.ensureKeyDirGitignored = ensureKeyDirGitignored;
+exports.proveOwnership = proveOwnership;
+exports.registerOtaKeysCommand = registerOtaKeysCommand;
+const crypto = __importStar(require("crypto"));
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const chalk_1 = __importDefault(require("chalk"));
+const credentials_1 = require("../utils/credentials");
+const resolve_1 = require("../utils/resolve");
+const context_1 = require("../utils/context");
+const prompt_1 = require("../utils/prompt");
+const output_1 = require("../utils/output");
+const client_1 = require("../api/client");
+const signing_1 = require("../utils/signing");
+Object.defineProperty(exports, "spkiFingerprint", { enumerable: true, get: function () { return signing_1.spkiFingerprint; } });
+/**
+ * OTA signing keys for SB-OTA-RSA-SHA256-V1 (RSA-3072 / SHA-256).
+ *
+ * The security model, and the reason this command exists: the private key is
+ * generated on the developer's machine and NEVER leaves it. Only the SPKI PUBLIC
+ * key is uploaded/registered. A server that cannot sign cannot forge a release,
+ * so a compromise of ScaleBun's infrastructure still cannot push code to a
+ * customer's users.
+ *
+ * (Pre-1.14 ScaleBun signed with ed25519 over the bundle's SHA-256. That path is
+ * removed: the protocol is now native-verifiable RSA on every supported Android
+ * API level. Legacy ed25519 key ROWS remain readable in the dashboard, labelled
+ * "Ed25519 — Legacy"; new keys are RSA only.)
+ */
+exports.KEY_DIR = '.scalebun';
+exports.PRIVATE_KEY_FILE = 'ota-signing-key.pem';
+exports.PUBLIC_KEY_FILE = 'ota-signing-key.pub.pem';
+exports.KEY_ID_FILE = 'ota-key-id.txt';
+/** Absolute path to the private key for a key dir (default ./.scalebun). */
+function privateKeyPath(keyDir = exports.KEY_DIR) {
+    return path.join(path.resolve(keyDir), exports.PRIVATE_KEY_FILE);
+}
+/** The locally stored keyId, if any (written next to the private key at generate). */
+function readLocalKeyId(keyDir = exports.KEY_DIR) {
+    try {
+        const p = path.join(path.resolve(keyDir), exports.KEY_ID_FILE);
+        if (!fs.existsSync(p))
+            return null;
+        const v = fs.readFileSync(p, 'utf8').trim();
+        return v || null;
+    }
+    catch {
+        return null;
+    }
+}
+/** The local private key PEM, if present. */
+function readLocalPrivatePem(keyDir = exports.KEY_DIR) {
+    const p = privateKeyPath(keyDir);
+    return fs.existsSync(p) ? fs.readFileSync(p, 'utf8') : null;
+}
+/** SPKI public-key PEM derived from the local private key, if present. */
+function localPublicPem(keyDir = exports.KEY_DIR) {
+    const priv = readLocalPrivatePem(keyDir);
+    if (!priv)
+        return null;
+    try {
+        return crypto.createPublicKey(priv).export({ type: 'spki', format: 'pem' });
+    }
+    catch {
+        return null;
+    }
+}
+// ─── CI signing material (env vars the dashboard CI/CD page issues) ─────────────
+//
+// The dashboard's CI/CD setup page documents these exact names. Honouring them
+// here is what lets a publish that works locally (key on disk) work headless in
+// CI (key in a secret) with no bridging step in the workflow.
+exports.ENV_SIGNING_PRIVATE_KEY = 'SCALEBUN_SIGNING_PRIVATE_KEY';
+exports.ENV_SIGNING_KEY_PASSPHRASE = 'SCALEBUN_SIGNING_KEY_PASSPHRASE';
+exports.ENV_KEY_ID = 'SCALEBUN_KEY_ID';
+exports.ENV_REQUIRE_SIGNING = 'SCALEBUN_REQUIRE_SIGNING';
+/**
+ * A private-key secret often arrives with literal `\n` instead of real newlines
+ * (single-line CI secrets, some UIs). A PEM without real line breaks is invalid,
+ * so restore them — but only when there are no real newlines already.
+ */
+function normalizePem(raw) {
+    const s = raw.trim();
+    return s.includes('\\n') && !s.includes('\n') ? s.replace(/\\n/g, '\n') : s;
+}
+/**
+ * Resolve the RSA signing material with precedence **CLI flag > env var > local
+ * .scalebun file**, for each of: private key, key id, passphrase.
+ *
+ *   private key : --key-dir <dir>/ota-signing-key.pem
+ *                 → $SCALEBUN_SIGNING_PRIVATE_KEY (PEM contents)
+ *                 → ./.scalebun/ota-signing-key.pem
+ *   key id      : --key-id → $SCALEBUN_KEY_ID → ./.scalebun/ota-key-id.txt
+ *   passphrase  : --passphrase → $SCALEBUN_SIGNING_KEY_PASSPHRASE
+ */
+function resolveSigningMaterial(opts) {
+    let privatePem = null;
+    let privateSource = 'none';
+    if (opts.keyDir) {
+        privatePem = readLocalPrivatePem(opts.keyDir);
+        privateSource = privatePem ? 'flag' : 'none';
+    }
+    else if (process.env[exports.ENV_SIGNING_PRIVATE_KEY]) {
+        privatePem = normalizePem(process.env[exports.ENV_SIGNING_PRIVATE_KEY]);
+        privateSource = 'env';
+    }
+    else {
+        privatePem = readLocalPrivatePem();
+        privateSource = privatePem ? 'file' : 'none';
+    }
+    // Key id: --key-id > (the id file inside an explicit --key-dir) > SCALEBUN_KEY_ID
+    // > the default .scalebun id file. An explicit --key-dir binds the key AND its
+    // id together (both flag-level), so an unrelated SCALEBUN_KEY_ID in the env
+    // cannot pair a dir's key with the wrong id — a mismatch the device rejects.
+    let keyId = null;
+    let keyIdSource = 'none';
+    if (opts.keyId) {
+        keyId = opts.keyId;
+        keyIdSource = 'flag';
+    }
+    else if (opts.keyDir) {
+        keyId = readLocalKeyId(opts.keyDir);
+        keyIdSource = keyId ? 'flag' : 'none';
+    }
+    else if (process.env[exports.ENV_KEY_ID]) {
+        keyId = process.env[exports.ENV_KEY_ID].trim() || null;
+        keyIdSource = keyId ? 'env' : 'none';
+    }
+    else {
+        keyId = readLocalKeyId();
+        keyIdSource = keyId ? 'file' : 'none';
+    }
+    const passphrase = opts.passphrase ?? process.env[exports.ENV_SIGNING_KEY_PASSPHRASE] ?? undefined;
+    return { privatePem, privateSource, keyId, keyIdSource, passphrase };
+}
+/**
+ * Whether this publish must be signed (so a missing key fails closed instead of
+ * silently shipping an unsigned release a signature-enforcing device rejects).
+ *
+ * True when: --require-signing / $SCALEBUN_REQUIRE_SIGNING is set, OR a key id is
+ * configured by any source (a configured key id means "sign with this key").
+ */
+function signingRequired(opts, material) {
+    if (opts.requireSigning)
+        return true;
+    const envFlag = process.env[exports.ENV_REQUIRE_SIGNING];
+    if (envFlag && envFlag !== '0' && envFlag.toLowerCase() !== 'false')
+        return true;
+    return material.keyId != null;
+}
+/**
+ * Keep the private key out of version control WITHOUT relying on the operator
+ * reading a warning. An existing .gitignore is appended to; a missing one is
+ * created only inside an actual git repo. Returns a human-readable outcome.
+ */
+function ensureKeyDirGitignored(outDir, cwd = process.cwd()) {
+    const rel = path.relative(cwd, outDir);
+    if (rel === '' || rel.startsWith('..') || path.isAbsolute(rel)) {
+        return `outside this project — add ${outDir} to that location's .gitignore yourself`;
+    }
+    const entry = rel.split(path.sep).join('/') + '/';
+    const gitignorePath = path.join(cwd, '.gitignore');
+    try {
+        if (fs.existsSync(gitignorePath)) {
+            const lines = fs.readFileSync(gitignorePath, 'utf8').split(/\r?\n/);
+            const covered = lines.some((l) => {
+                const t = l.trim();
+                return t === entry || t === entry.slice(0, -1) || t === '/' + entry || t === '/' + entry.slice(0, -1);
+            });
+            if (covered)
+                return `already ignored by .gitignore (${entry})`;
+            const body = fs.readFileSync(gitignorePath, 'utf8');
+            const sep = body.length === 0 || body.endsWith('\n') ? '' : '\n';
+            fs.appendFileSync(gitignorePath, `${sep}\n# ScaleBun OTA signing key — never commit\n${entry}\n`);
+            return `added ${entry} to .gitignore`;
+        }
+        if (fs.existsSync(path.join(cwd, '.git'))) {
+            fs.writeFileSync(gitignorePath, `# ScaleBun OTA signing key — never commit\n${entry}\n`);
+            return `created .gitignore with ${entry}`;
+        }
+        return `no git repo detected — if you version this directory, ignore ${entry}`;
+    }
+    catch (err) {
+        return `could not update .gitignore (${err?.message ?? err}) — add ${entry} yourself`;
+    }
+}
+/** A friendly default keyId like `production-2026-01`. */
+function defaultKeyId() {
+    const d = new Date();
+    return `key-${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, '0')}`;
+}
+async function registerPublicKey(client, appId, body) {
+    return client.post(`/saas/apps/${appId}/ota/signing-keys`, body);
+}
+/**
+ * Prove possession of a signing key without leaving the terminal.
+ *
+ * Registering a public key only asserts "trust this key". Proving possession
+ * shows the caller actually holds the private half — and until that happens the
+ * key is not ACTIVE and every promote is refused as high-risk. It is not
+ * optional in practice, so it should not be a separate errand.
+ *
+ * The private key never leaves this machine: the server mints the bytes, we sign
+ * those exact bytes, and only the signature goes back.
+ */
+async function proveOwnership(client, appId, keyRowId, privateKey) {
+    const opened = await client.post(`/saas/apps/${appId}/ota/signing-keys/${keyRowId}/challenges`, {});
+    const signature = crypto
+        .sign('sha256', Buffer.from(opened.payload, 'base64'), privateKey)
+        .toString('base64');
+    const res = await client.post(`/saas/apps/${appId}/ota/signing-keys/${keyRowId}/verify`, { challengeId: opened.challengeId, signature });
+    return res.verified !== false;
+}
+// ─── generate ─────────────────────────────────────────────────────────────────
+async function runGenerate(opts) {
+    const algorithm = (opts.algorithm ?? 'rsa-3072').toLowerCase();
+    const m = /^rsa-(\d+)$/.exec(algorithm);
+    if (!m) {
+        (0, output_1.fail)(`Unsupported --algorithm "${opts.algorithm}".`, ['Use rsa-3072 (recommended) or rsa-2048.'], output_1.ExitCode.Usage);
+    }
+    const bits = parseInt(m[1], 10);
+    const outDir = path.resolve(opts.out ?? exports.KEY_DIR);
+    const privatePath = opts.privateKeyOut ? path.resolve(opts.privateKeyOut) : path.join(outDir, exports.PRIVATE_KEY_FILE);
+    const publicPath = opts.publicKeyOut ? path.resolve(opts.publicKeyOut) : path.join(outDir, exports.PUBLIC_KEY_FILE);
+    // Ask for the name when one was not supplied and a human is present. The key
+    // id is the label in the dashboard AND the id every signed release carries;
+    // it outlives this command by years, and `key-2026-09` says nothing about
+    // which app, environment or team it belongs to once there are several. A flag
+    // still wins, so scripts and CI are unaffected.
+    let keyId = (opts.keyId ?? defaultKeyId()).trim();
+    if (!opts.keyId && process.stdin.isTTY) {
+        const suggested = keyId;
+        const answer = (await (0, prompt_1.text)(`Name this signing key [${suggested}]`, { allowEmpty: true })).trim();
+        const cleaned = (answer || suggested).replace(/[^A-Za-z0-9._-]+/g, '-');
+        if (answer && cleaned !== answer) {
+            console.log(chalk_1.default.dim(`  Using "${cleaned}" — a key id may contain only letters, digits, dot, dash or underscore.`));
+        }
+        keyId = cleaned;
+    }
+    if (fs.existsSync(privatePath) && !opts.force) {
+        // Telling someone to re-run with --force is a dead end when a human is
+        // sitting right there: it makes them retype the command to answer a
+        // yes/no question the CLI could simply ask. Ask it — and make the
+        // destructive option an explicit second confirmation, because overwriting
+        // strands every app that embeds only the old public key.
+        if (!process.stdin.isTTY) {
+            (0, output_1.fail)(`A signing key already exists at ${privatePath}.`, [
+                'Overwriting it means releases signed with the old key can no longer be verified',
+                'by apps that embed only the old public key. Pass --force if that is intended.',
+            ], output_1.ExitCode.Usage);
+        }
+        console.log(`\n⚠️  A signing key already exists at ${privatePath}`);
+        const choice = await (0, prompt_1.select)('What would you like to do?', [
+            { label: 'Keep the existing key', value: 'keep', hint: 'nothing is written' },
+            {
+                label: 'Overwrite it with a new keypair',
+                value: 'overwrite',
+                hint: 'apps embedding only the old public key stop accepting releases',
+            },
+        ]);
+        if (choice === 'keep') {
+            console.log('\nKept the existing key. Nothing was written.\n');
+            (0, prompt_1.closePrompts)();
+            return;
+        }
+        const sure = await (0, prompt_1.confirm)('Overwrite the existing signing key? Releases signed with the old key will no longer verify on apps that embed only it.');
+        if (!sure) {
+            console.log('\nCancelled. The existing key is untouched.\n');
+            (0, prompt_1.closePrompts)();
+            return;
+        }
+    }
+    const { privatePem, publicPem, info } = (0, signing_1.generateRsaKeyPair)({ modulusBits: bits });
+    fs.mkdirSync(path.dirname(privatePath), { recursive: true });
+    // 0600 on POSIX; the ACL call is what actually protects it on Windows.
+    fs.writeFileSync(privatePath, privatePem, { mode: 0o600 });
+    (0, credentials_1.restrictToCurrentUser)(privatePath, 'your OTA signing private key');
+    fs.writeFileSync(publicPath, publicPem);
+    // Persist the keyId next to the key so publish/register can find it.
+    fs.writeFileSync(path.join(path.dirname(privatePath), exports.KEY_ID_FILE), keyId + '\n');
+    const gitignoreOutcome = ensureKeyDirGitignored(path.dirname(privatePath));
+    console.log(`\n🔑 RSA-${info.modulusBits} signing keypair generated.\n`);
+    console.log(`  Key ID       : ${keyId}`);
+    console.log(`  Algorithm    : RSA-${info.modulusBits} / SHA-256  (SB-OTA-RSA-SHA256-V1)`);
+    console.log(`  Fingerprint  : SHA-256:${info.fingerprintDisplay}`);
+    console.log(`  Private key  : ${privatePath}`);
+    console.log(`                 NEVER commit or share this file.`);
+    console.log(`  Public key   : ${publicPath}`);
+    console.log(`  Git          : ${gitignoreOutcome}\n`);
+    const appId = opts.appId || (0, context_1.getContext)().appId;
+    if (appId) {
+        const creds = (0, credentials_1.readCredentials)();
+        if (!creds) {
+            console.log('ℹ️  Not logged in — the keypair was written but not registered.');
+            console.log(`   Register it later with:\n   scalebun ota keys register --key-id ${keyId} --public-key ${publicPath}\n`);
+            return;
+        }
+        const client = new client_1.ApiClient(creds);
+        try {
+            const row = await registerPublicKey(client, appId, {
+                publicKey: publicPem,
+                keyId,
+                algorithm: 'RSA_SHA256',
+                name: opts.name ?? `CLI ${new Date().toISOString().slice(0, 10)}`,
+            });
+            console.log('✅ Public key registered with ScaleBun.');
+            // Registration alone leaves the key UNVERIFIED, and an unverified key is
+            // refused at promote (`signing_key_ownership_unverified`). We are holding
+            // the private half at this exact moment, so finish the job here instead of
+            // sending the user to the dashboard to open a challenge by hand.
+            // Prefer the id the register call returned, but do not depend on its shape:
+            // fall back to matching our own public fingerprint against the app's keys,
+            // which is how `keys verify` resolves a row anyway.
+            const privateKeyObj = crypto.createPrivateKey(privatePem);
+            let rowId = row?.id;
+            if (!rowId) {
+                try {
+                    rowId = await resolveKeyRowId(client, appId, undefined, crypto.createPublicKey(privateKeyObj));
+                }
+                catch { /* fall through to the manual hint below */ }
+            }
+            if (rowId) {
+                try {
+                    const ok = await proveOwnership(client, appId, rowId, privateKeyObj);
+                    console.log(ok
+                        ? '✅ Ownership proven — the key is ACTIVE and can sign releases.\n'
+                        : '⚠️  Ownership was not confirmed; run `scalebun ota keys verify`.\n');
+                }
+                catch (err) {
+                    console.log(chalk_1.default.yellow(`⚠️  Could not prove ownership automatically: ${err.message}`));
+                    console.log('   Finish it with: scalebun ota keys verify\n');
+                }
+            }
+            else {
+                console.log(chalk_1.default.dim('   Prove ownership with: scalebun ota keys verify\n'));
+            }
+        }
+        catch (err) {
+            console.log(chalk_1.default.yellow(`⚠️  Could not register the public key: ${err.message}`));
+            console.log(`   Retry: scalebun ota keys register --key-id ${keyId} --public-key ${publicPath}\n`);
+        }
+    }
+    else {
+        console.log('ℹ️  Not a linked project — run `scalebun link` (or pass --app-id) to register this public key.\n');
+    }
+    console.log('Next: embed the PUBLIC key in your native app (Android assets/, iOS bundle');
+    console.log('resource) and pin its key ID. The SDK verifies every release against the');
+    console.log('embedded key and REFUSES any that does not match. See');
+    console.log('docs/ota/SB-OTA-RSA-SHA256-V1.md.\n');
+}
+async function runList(opts) {
+    const creds = (0, credentials_1.readCredentials)();
+    if (!creds)
+        (0, output_1.fail)('Not logged in. Run `scalebun login` first.', [], output_1.ExitCode.Usage);
+    const appId = await (0, resolve_1.resolveAppId)({ appId: opts.appId });
+    const client = new client_1.ApiClient(creds);
+    try {
+        const rows = await client.get(`/saas/apps/${appId}/ota/signing-keys`);
+        console.log(`\n🔑 Signing keys for app ${appId}:\n`);
+        if (!rows?.length) {
+            console.log('  (none — run `scalebun ota keys generate`)\n');
+            return;
+        }
+        for (const k of rows) {
+            const state = k.revokedAt ? 'REVOKED' : 'active';
+            const alg = k.algorithm === 'ED25519' ? 'Ed25519 (legacy)' : k.algorithm ? k.algorithm.replace('_', '/') : 'unknown';
+            console.log(`  • ${(k.name ?? 'unnamed').padEnd(22)} ${state.padEnd(8)} ${alg}`);
+            console.log(`    id=${k.id}${k.keyId ? `  keyId=${k.keyId}` : ''}`);
+        }
+        console.log('');
+    }
+    catch (err) {
+        (0, output_1.fail)(`Failed to list keys: ${err.message}`, [], output_1.ExitCode.Rejected);
+    }
+}
+/**
+ * Pull `--app-id` down from whichever command actually parsed it.
+ *
+ * THIS WAS SILENT AND IT MATTERED. `keys` is a three-level command
+ * (`ota keys list`), and the group declares `--app-id` so that a bare
+ * `ota keys --app-id X` works. Commander binds an option to the command whose
+ * declaration it matches, and the leaf then receives `appId: undefined` — so
+ * `ota keys register --app-id <other app>` fell back to scalebun.json and
+ * registered the public signing key against the WRONG APP, reporting success.
+ * `--app-id` was not rejected, not warned about, just ignored.
+ *
+ * Walking the parent chain fixes it wherever the flag landed, and keeps working
+ * if the nesting changes again. Explicit still beats ambient: this only fills in
+ * when the leaf's own value is absent.
+ */
+function mergeAppId(opts, cmd) {
+    if (opts?.appId)
+        return opts;
+    let node = cmd;
+    while (node) {
+        const o = typeof node.opts === 'function' ? node.opts() : null;
+        if (o && typeof o.appId === 'string' && o.appId)
+            return { ...(opts ?? {}), appId: o.appId };
+        node = node.parent;
+    }
+    return opts;
+}
+function registerOtaKeysCommand(ota) {
+    const keys = ota
+        .command('keys')
+        .description('Manage OTA release signing keys (RSA-3072 / SHA-256)')
+        // Declared on the GROUP, not only on `list`. Commander rejects a flag the
+        // command it lands on has not declared, so `ota keys --app-id X` died with
+        // "unknown option '--app-id'" even though the group defaults to list and
+        // runList needs exactly that flag. The default action is only useful if the
+        // options it consumes are accepted here too.
+        .option('--app-id <id>', 'Scalebun app ID (resolved from scalebun.json when omitted)')
+        .option('--json', 'Machine-readable output');
+    // Running `scalebun ota keys` with no subcommand — which is exactly what the
+    // interactive menu's "keys" entry does — used to print help and exit 1, a
+    // dead end. Default the group to `list`, the sensible landing action, so it
+    // shows the registered keys instead of a usage dump.
+    keys.action((opts, cmd) => runList(mergeAppId(opts ?? {}, cmd)));
+    keys
+        .command('generate')
+        .description('Generate an RSA signing keypair locally and register the public half')
+        .option('--algorithm <alg>', 'rsa-3072 (recommended) or rsa-2048', 'rsa-3072')
+        .option('--key-id <id>', 'Stable key identifier (e.g. production-2026-01)')
+        .option('--private-key-out <path>', 'Where to write the PKCS#8 private key')
+        .option('--public-key-out <path>', 'Where to write the SPKI public key')
+        .option('--out <dir>', `Directory for both keys (default: ./${exports.KEY_DIR})`)
+        .option('--app-id <id>', 'Register the public key against this app')
+        .option('--name <name>', 'Label for the key in the dashboard')
+        .option('--force', 'Overwrite an existing private key')
+        .action((o, c) => runGenerate(mergeAppId(o, c)));
+    keys
+        .command('inspect')
+        .description('Validate a public key and print its algorithm, size, and fingerprint')
+        .requiredOption('--public-key <path>', 'Path to an SPKI public-key PEM')
+        .action((opts) => {
+        const p = path.resolve(opts.publicKey);
+        if (!fs.existsSync(p))
+            (0, output_1.fail)(`No such file: ${p}`, [], output_1.ExitCode.Usage);
+        try {
+            const info = (0, signing_1.inspectPublicKey)(fs.readFileSync(p));
+            console.log('');
+            console.log(`  Algorithm    : RSA-${info.modulusBits} / SHA-256`);
+            console.log(`  Modulus      : ${info.modulusBits} bits${info.modulusBits < 3072 ? '  (2048 accepted; 3072 recommended)' : ''}`);
+            console.log(`  Fingerprint  : SHA-256:${info.fingerprintDisplay}`);
+            console.log(`  Fingerprint  : ${info.fingerprint}  (hex)`);
+            console.log('');
+        }
+        catch (err) {
+            (0, output_1.fail)(`Invalid public key: ${err.message}`, [], output_1.ExitCode.Rejected);
+        }
+    });
+    keys
+        .command('register')
+        .description('Register an existing RSA public key (SPKI PEM) with an app')
+        .option('--app-id <id>', 'Scalebun app ID (resolved from scalebun.json when omitted)')
+        .option('--key-id <id>', 'Stable key identifier (defaults to the local key id)')
+        .option('--public-key <path>', 'SPKI public-key PEM path (defaults to the local ./.scalebun key)')
+        .option('--name <name>', 'Label for the key in the dashboard')
+        .action(async (opts) => {
+        const creds = (0, credentials_1.readCredentials)();
+        if (!creds)
+            (0, output_1.fail)('Not logged in. Run `scalebun login` first.', [], output_1.ExitCode.Usage);
+        const client = new client_1.ApiClient(creds);
+        const nonInteractive = (0, resolve_1.isNonInteractive)();
+        const appId = await (0, resolve_1.resolveAppId)({ appId: opts.appId });
+        let pem;
+        if (opts.publicKey) {
+            const p = path.resolve(opts.publicKey);
+            if (!fs.existsSync(p))
+                (0, output_1.fail)(`No such file: ${p}`, [], output_1.ExitCode.Usage);
+            pem = fs.readFileSync(p, 'utf8');
+        }
+        else {
+            pem = localPublicPem() ?? undefined;
+            if (!pem) {
+                (0, output_1.fail)('A public key is required.', ['Pass --public-key <path> to an SPKI PEM.'], output_1.ExitCode.Usage);
+            }
+        }
+        let info;
+        try {
+            info = (0, signing_1.inspectPublicKey)(pem);
+        }
+        catch (err) {
+            (0, output_1.fail)(`Not a usable RSA public key: ${err.message}`, [], output_1.ExitCode.Rejected);
+        }
+        const keyId = (opts.keyId ?? readLocalKeyId() ?? defaultKeyId()).trim();
+        let name = opts.name?.trim();
+        if (!name && !nonInteractive) {
+            name = (await (0, prompt_1.text)('Key name (label shown in the dashboard)', { default: 'cli', allowEmpty: true })).trim();
+        }
+        (0, prompt_1.closePrompts)();
+        try {
+            await registerPublicKey(client, appId, {
+                publicKey: info.spkiPem,
+                keyId,
+                algorithm: 'RSA_SHA256',
+                name: name || 'CLI',
+            });
+            console.log(`\n✅ Public key registered (key ID ${keyId}, SHA-256:${info.fingerprintDisplay.slice(0, 23)}…).\n`);
+        }
+        catch (err) {
+            (0, output_1.fail)(`Failed to register public key: ${err.message}`, [], output_1.ExitCode.Rejected);
+        }
+    });
+    keys
+        .command('list')
+        .description('List signing keys registered for an app')
+        .option('--app-id <id>', 'Scalebun app ID (resolved from scalebun.json when omitted)')
+        .action((o, c) => runList(mergeAppId(o, c)));
+    keys
+        .command('verify')
+        .description('Prove possession of a signing key private half (proof-of-possession)')
+        .option('--challenge <id>', 'Challenge id to answer. Omit to open one automatically (the usual case).')
+        .option('--private-key <path>', 'PKCS#8 private-key PEM (defaults to the local ./.scalebun key)')
+        .option('--app-id <id>', 'Scalebun app ID (resolved from scalebun.json when omitted)')
+        .option('--key-id <id>', 'Signing key ROW id (auto-resolved from the local key when omitted)')
+        .option('--json', 'Machine-readable output')
+        .action((o, c) => runVerify(mergeAppId(o, c)));
+    keys
+        .command('revoke')
+        .description('Revoke a signing key — releases signed with it stop verifying')
+        .requiredOption('--key-id <id>', 'Signing key row id to revoke (from `scalebun ota keys list`)')
+        .option('--app-id <id>', 'Scalebun app ID (resolved from scalebun.json when omitted)')
+        .option('--reason <text>', 'Why the key is being revoked (recorded in the audit trail)')
+        .option('--yes', 'Skip the confirmation (required off a TTY)')
+        .option('--json', 'Machine-readable output')
+        .action((o, c) => runRevoke(mergeAppId(o, c)));
+    // ── Back-compat aliases (pre-1.14 top-level commands) ─────────────────────────
+    // These kept working across every prior release; forward them so scripts and
+    // muscle memory survive the move under `keys`.
+    ota
+        .command('generate-key-pair')
+        .description('(alias of `ota keys generate`)')
+        .option('--algorithm <alg>', 'rsa-3072 (recommended) or rsa-2048', 'rsa-3072')
+        .option('--key-id <id>', 'Stable key identifier')
+        .option('--app-id <id>', 'Register the public key against this app')
+        .option('--name <name>', 'Label for the key in the dashboard')
+        .option('--out <dir>', `Directory for the keys (default: ./${exports.KEY_DIR})`)
+        .option('--force', 'Overwrite an existing private key')
+        .action((o, c) => runGenerate(mergeAppId(o, c)));
+    ota
+        .command('revoke-key')
+        .description('(alias of `ota keys revoke`)')
+        .requiredOption('--key-id <id>', 'Signing key row id to revoke')
+        .option('--app-id <id>', 'Scalebun app ID')
+        .option('--yes', 'Skip the confirmation')
+        .option('--json', 'Machine-readable output')
+        .action((o, c) => runRevoke(mergeAppId(o, c)));
+}
+/**
+ * Resolve the signing-key ROW id for a verify: prefer --key-id, else match the
+ * local private key's public fingerprint against the app's registered keys.
+ */
+async function resolveKeyRowId(client, appId, explicitKeyId, localPubKey) {
+    if (explicitKeyId)
+        return explicitKeyId;
+    if (!localPubKey) {
+        (0, output_1.fail)('Could not determine which signing key to verify.', ['Pass --key-id <row id> (see `scalebun ota keys list`), or run from a project with ./.scalebun.'], output_1.ExitCode.Usage);
+    }
+    const localFp = (0, signing_1.spkiFingerprint)(localPubKey).hex;
+    let rows;
+    try {
+        rows = await client.get(`/saas/apps/${appId}/ota/signing-keys`);
+    }
+    catch (err) {
+        (0, output_1.failFromError)('Could not list signing keys', err);
+    }
+    const match = (rows ?? []).find((k) => (k.fingerprint ?? '').toLowerCase() === localFp.toLowerCase());
+    if (!match) {
+        (0, output_1.fail)('No registered key matches your local signing key.', ['Pass --key-id <row id> explicitly (from `scalebun ota keys list`).'], output_1.ExitCode.Usage);
+    }
+    return match.id;
+}
+async function runVerify(opts) {
+    const creds = (0, credentials_1.readCredentials)();
+    if (!creds)
+        (0, output_1.fail)('Not signed in.', ['Run `scalebun login` first.'], output_1.ExitCode.Usage);
+    const appId = await (0, resolve_1.resolveAppId)({ appId: opts.appId, nonInteractive: opts.json });
+    const client = new client_1.ApiClient(creds);
+    // Load the private key locally — it NEVER leaves this machine.
+    let privatePem;
+    if (opts.privateKey) {
+        const p = path.resolve(opts.privateKey);
+        if (!fs.existsSync(p))
+            (0, output_1.fail)(`No such file: ${p}`, [], output_1.ExitCode.Usage);
+        privatePem = fs.readFileSync(p, 'utf8');
+    }
+    else {
+        privatePem = readLocalPrivatePem();
+        if (!privatePem) {
+            (0, output_1.fail)('A private key is required.', ['Pass --private-key <path> to a PKCS#8 PEM.'], output_1.ExitCode.Usage);
+        }
+    }
+    let privateKey;
+    let localPubKey = null;
+    try {
+        privateKey = crypto.createPrivateKey(privatePem);
+        localPubKey = crypto.createPublicKey(privateKey);
+    }
+    catch (err) {
+        (0, output_1.fail)(`Could not read the private key: ${err.message}`, [], output_1.ExitCode.Rejected);
+        return;
+    }
+    const keyRowId = await resolveKeyRowId(client, appId, opts.keyId, localPubKey);
+    // Either bytes the server already stored, or bytes it mints for us now. Either
+    // way they come FROM the server and are signed unmodified — nothing is invented
+    // locally, which is the whole point of proof-of-possession.
+    //
+    // `--challenge` used to be required, and only the dashboard could open one. That
+    // made a key registered from the CLI unverifiable from the CLI: you had to leave
+    // the terminal, find the key in the console, click through a wizard, and paste an
+    // id back. Worse, the challenge UI lived only inside the *register* wizard, so a
+    // key created by `ota keys generate` had no route to verification at all — and an
+    // unverified key is refused at promote (`signing_key_ownership_unverified`)
+    // forever. The endpoint was always callable with these same credentials; nothing
+    // but wiring was missing.
+    let challenge;
+    let challengeId = opts.challenge;
+    if (opts.challenge) {
+        try {
+            challenge = await client.get(`/saas/apps/${appId}/ota/signing-keys/${keyRowId}/challenges/${opts.challenge}`);
+        }
+        catch (err) {
+            (0, output_1.failFromError)('Could not fetch the challenge', err, [
+                'Check the challenge id and that it has not expired.',
+            ]);
+        }
+    }
+    else {
+        try {
+            const opened = await client.post(`/saas/apps/${appId}/ota/signing-keys/${keyRowId}/challenges`, {});
+            challenge = { payload: opened.payload, expiresAt: opened.expiresAt };
+            challengeId = opened.challengeId;
+        }
+        catch (err) {
+            (0, output_1.failFromError)('Could not open a verification challenge', err, [
+                'You need the ota.keys.verify permission on this app.',
+                'Or pass --challenge <id> for one opened from the dashboard.',
+            ]);
+        }
+    }
+    if (challenge.consumed) {
+        (0, output_1.fail)('This challenge was already used.', ['Request a fresh challenge and retry.'], output_1.ExitCode.Rejected);
+    }
+    const signature = crypto
+        .sign('sha256', Buffer.from(challenge.payload, 'base64'), privateKey)
+        .toString('base64');
+    let result;
+    try {
+        result = await client.post(`/saas/apps/${appId}/ota/signing-keys/${keyRowId}/verify`, { challengeId, signature });
+    }
+    catch (err) {
+        (0, output_1.failFromError)('Ownership verification failed', err, [
+            'The signature did not verify against the registered public key, or the challenge expired.',
+        ]);
+    }
+    (0, output_1.emit)(() => {
+        console.log(`\n✅ Ownership verified for key ${keyRowId}.`);
+        if (result.activated)
+            console.log('   The key is now ACTIVE.');
+        else if (result.status)
+            console.log(`   Key status: ${result.status}`);
+        console.log('');
+    }, { ok: true, keyId: keyRowId, verified: !!result.verified, activated: !!result.activated, status: result.status });
+}
+async function runRevoke(opts) {
+    const creds = (0, credentials_1.readCredentials)();
+    if (!creds)
+        (0, output_1.fail)('Not signed in.', ['Run `scalebun login` first.'], output_1.ExitCode.Usage);
+    const appId = await (0, resolve_1.resolveAppId)({ appId: opts.appId, nonInteractive: opts.json });
+    const client = new client_1.ApiClient(creds);
+    let rows;
+    try {
+        rows = await client.get(`/saas/apps/${appId}/ota/signing-keys`);
+    }
+    catch (err) {
+        (0, output_1.failFromError)('Could not list signing keys', err);
+    }
+    const target = (rows ?? []).find((k) => k.id === opts.keyId);
+    if (!target) {
+        (0, output_1.fail)(`No signing key ${opts.keyId} on this app.`, (rows ?? []).map((k) => `  ${k.id}  ${k.name ?? 'unnamed'}`), output_1.ExitCode.Usage);
+    }
+    if (target.revokedAt) {
+        (0, output_1.emit)(() => console.log(`\n${chalk_1.default.dim(`${target.name ?? target.id} is already revoked.`)}\n`), {
+            ok: true,
+            keyId: target.id,
+            alreadyRevoked: true,
+        });
+        return;
+    }
+    if (!opts.yes) {
+        if ((0, resolve_1.isNonInteractive)({ nonInteractive: opts.json })) {
+            (0, output_1.fail)('Refusing to revoke a signing key without confirmation.', ['Pass --yes if this is intentional.'], output_1.ExitCode.Usage);
+        }
+        console.log('');
+        console.log(chalk_1.default.yellow(`⚠️  Revoking ${chalk_1.default.bold(target.name ?? target.id)}.\n` +
+            '   Apps pinning ONLY this key will refuse every future update — fail-closed by\n' +
+            '   design. Register the replacement and ship a build embedding both first.'));
+        const ok = await (0, prompt_1.confirmPhrase)('   Type "revoke" to confirm: ', 'revoke', { caseInsensitive: true });
+        (0, prompt_1.closePrompts)();
+        if (!ok) {
+            console.log('Cancelled — the key is still active.');
+            process.exit(output_1.ExitCode.Ok);
+        }
+    }
+    try {
+        await client.post(`/saas/apps/${appId}/ota/signing-keys/${target.id}/revoke`, {
+            reason: (opts.reason ?? '').trim() || 'Revoked via CLI',
+        });
+    }
+    catch (err) {
+        (0, output_1.failFromError)('Could not revoke the key', err, ['Revoking a signing key requires the ota.keys.revoke permission.']);
+    }
+    (0, output_1.emit)(() => console.log(`\n🔒 Revoked ${chalk_1.default.bold(target.name ?? target.id)}\n`), {
+        ok: true,
+        keyId: target.id,
+        revoked: true,
+    });
+}
+//# sourceMappingURL=ota-keys.js.map