@scalebun-release/cli 2.5.0

package/lib/commands/ota-publish.js

@@ -0,0 +1,892 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseRolloutPercent = parseRolloutPercent;
+exports.registerOtaPublishCommand = registerOtaPublishCommand;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const crypto = __importStar(require("crypto"));
+const chalk_1 = __importDefault(require("chalk"));
+const credentials_1 = require("../utils/credentials");
+const client_1 = require("../api/client");
+const validate_1 = require("../utils/validate");
+const resolve_1 = require("../utils/resolve");
+const context_1 = require("../utils/context");
+const output_1 = require("../utils/output");
+const bundle_1 = require("../utils/bundle");
+const hash_1 = require("../utils/hash");
+const native_id_1 = require("../utils/native-id");
+const provenance_1 = require("../utils/provenance");
+const ota_keys_1 = require("./ota-keys");
+const signing_1 = require("../utils/signing");
+const signer_1 = require("../utils/signer");
+const apps_1 = require("../utils/apps");
+const prompt_1 = require("../utils/prompt");
+const browser_1 = require("../utils/browser");
+const login_1 = require("./login");
+const DASHBOARD_OTA_URL = 'https://dash.scalebun.com/ota/publish';
+/**
+ * `scalebun ota publish` — the flagship CLI command.
+ *
+ * Flow:
+ *   1. Build the RN JS bundle (npx react-native bundle, Hermes default)
+ *   2. Compute SHA-256 of the output
+ *   3. POST /saas/apps/:appId/ota/bundles/presign → presigned PUT URL
+ *   4. PUT the bytes directly to storage (R2/S3)
+ *   5. POST /saas/apps/:appId/ota/bundles/:id/finalize → version assigned
+ *   6. POST /saas/apps/:appId/ota/bundles/:id/promote → configure installMode & rollout
+ *   7. Print success
+ */
+/**
+ * Parse `--rollout`, refusing anything that isn't 0-100.
+ *
+ * This was `parseInt(x, 10) || 100`, which turned BOTH `--rollout 0` and any
+ * typo into a 100% rollout — the opposite of what the operator asked for. A
+ * dark release (0%) is a documented, legitimate way to promote a bundle without
+ * exposing it, so silently inverting it exposes every production device to an
+ * untested bundle. Exits rather than guessing.
+ */
+function parseRolloutPercent(raw) {
+    // Delegates so this flag, the promote flag, and the interactive prompt all
+    // accept the same things — including a trailing `%`, which Number() reads as
+    // NaN and which is the obvious thing to type for a percentage.
+    return (0, validate_1.checkedPercent)('--rollout', raw, 100);
+}
+function registerOtaPublishCommand(ota) {
+    ota
+        .command('publish')
+        .description('Bundle, hash, upload, and finalize an OTA update release')
+        // Not requiredOption: when it (and other flags) are missing in a TTY, the
+        // interactive wizard fills them in. Non-interactive runs still require it.
+        .option('--app-id <id>', 'Scalebun application ID')
+        .option('--channel <nameOrId>', 'OTA channel name (e.g. default, beta, production) or channel ID', 'default')
+        .option('--channel-id <id>', 'OTA channel ID (legacy alias)')
+        .option('--platform <platform>', 'Target platform: android | ios', 'android')
+        .option('--install-mode <mode>', 'IMMEDIATE (SDK restarts the app right after install; also marked mandatory) | ' +
+        'ON_NEXT_RESTART (default: activates on next cold boot) | ' +
+        'ON_NEXT_RESUME (SDK restarts when the app next returns to the foreground)', 'ON_NEXT_RESTART')
+        .option('--target-version <semver>', 'Target app native semver range (e.g. ">=1.0.0", "1.0.0")', '>=1.0.0')
+        .option('--rollout <percent>', 'Target rollout percentage (1-100)', '100')
+        .option('--entry-file <path>', 'JS entry file', 'index.js')
+        .option('--release-note <text>', 'Release note for dashboard display and device changelog')
+        .option('--hermes', 'Compile to Hermes bytecode (the default — flag kept for compatibility)')
+        .option('--hermes-disabled', 'Ship plain JS instead of Hermes bytecode (~20-30% slower cold start)')
+        .option('--allow-plain-js', 'Publish uncompiled JS if hermesc fails, instead of aborting')
+        .option('--key-dir <dir>', 'Directory holding the RSA signing key (default: ./.scalebun)')
+        .option('--key-id <id>', 'Signing key id (defaults to $SCALEBUN_KEY_ID or the local ./.scalebun key id)')
+        .option('--passphrase <pass>', 'Passphrase for an encrypted signing key (defaults to $SCALEBUN_SIGNING_KEY_PASSPHRASE)')
+        .option('--require-signing', 'Fail if the release cannot be signed (also via $SCALEBUN_REQUIRE_SIGNING). Prevents silently shipping an unsigned release a signature-enforcing device would reject.')
+        .option('--skip-bundle', 'Skip react-native bundle (provide --bundle-path instead)')
+        .option('--bundle-path <path>', 'Path to a pre-built bundle file')
+        .option('--custom-bundle-path <path>', 'Alias for --bundle-path (explicit naming)')
+        .option('--sourcemap', 'Generate and upload sourcemap for crash symbolication')
+        .option('--keep-artifacts', 'Keep build artifacts (bundle + sourcemap) after upload')
+        .option('--skip-promote', 'Upload and finalize only — do not make the release live')
+        .option('--yes', 'Skip the interactive wizard\'s final confirmation')
+        .action(async (opts, cmd) => {
+        // Interactive wizard: in a terminal with no --app-id (and no pre-built
+        // bundle), guide the user through the flags. The Dashboard and Cancel
+        // paths exit inside the wizard; the CLI path fills `opts` and returns.
+        if (process.stdout.isTTY &&
+            !opts.appId &&
+            !opts.skipBundle &&
+            !opts.bundlePath &&
+            !opts.customBundlePath) {
+            await runPublishWizard(opts, cmd);
+        }
+        // publish was the ONE command that never adopted the resolver. It
+        // demanded --app-id even with a scalebun.json sitting beside it, so the
+        // flagship command was the only one that failed on a correctly linked
+        // project. The wizard above still fills opts.appId when it runs; this
+        // covers every other path, including CI.
+        opts.appId = await (0, resolve_1.resolveAppId)({ appId: opts.appId, nonInteractive: opts.yes });
+        // commander cannot tell "--channel default" from the option's own
+        // default, so ask it: only a value that came from the CLI outranks the
+        // project's configured channel.
+        const explicitChannel = cmd?.getOptionValueSource?.('channel') === 'cli' ? opts.channel : undefined;
+        const creds = (0, credentials_1.readCredentials)();
+        if (!creds) {
+            console.error('❌ Not logged in. Run `scalebun login` first.');
+            process.exit(1);
+        }
+        const installMode = (0, validate_1.checkedEnum)('--install-mode', opts.installMode || 'ON_NEXT_RESTART', ['IMMEDIATE', 'ON_NEXT_RESTART', 'ON_NEXT_RESUME'], { caseInsensitive: true });
+        // Validate BEFORE building: a bad --rollout should cost a second, not a
+        // full Hermes compile.
+        const rolloutPercent = parseRolloutPercent(opts.rollout);
+        // The channel default was a hardcoded 'default' while `scalebun link`
+        // had already written the project's real channel to scalebun.json.
+        // Publishing on a linked project therefore aimed at a channel that did
+        // not exist — and said so only after a full Hermes build.
+        // explicit flag > legacy --channel-id > project config > 'default'.
+        const projectChannel = (0, context_1.getContext)({ appId: opts.appId }).channel;
+        const targetChannel = opts.channelId || explicitChannel || projectChannel || 'default';
+        const client = new client_1.ApiClient(creds);
+        // Was a bare cast, so `--platform windows` reached the bundler and
+        // failed later with an error about a missing entry file.
+        const platform = (0, validate_1.checkedEnum)('--platform', opts.platform, ['android', 'ios'], {
+            caseInsensitive: true,
+        });
+        // Fail closed BEFORE the expensive bundle: if this release must be signed
+        // (--require-signing / SCALEBUN_REQUIRE_SIGNING / a configured key id) but
+        // no signing key can be resolved, stop now rather than after a full Hermes
+        // compile. A signature-enforcing device rejects an unsigned release, so
+        // shipping unsigned here would be a broken deploy.
+        {
+            const early = (0, ota_keys_1.resolveSigningMaterial)({
+                keyDir: opts.keyDir,
+                keyId: opts.keyId,
+                passphrase: opts.passphrase,
+            });
+            if ((0, ota_keys_1.signingRequired)({ requireSigning: opts.requireSigning }, early) &&
+                !early.privatePem) {
+                (0, output_1.fail)('Signing is required for this release, but no signing key is available.', [
+                    'Provide the key via --key-dir, the SCALEBUN_SIGNING_PRIVATE_KEY secret,',
+                    'or ./.scalebun/ota-signing-key.pem.',
+                    'To publish unsigned (SHA-256 only), drop --require-signing / --key-id and',
+                    'unset SCALEBUN_REQUIRE_SIGNING / SCALEBUN_KEY_ID.',
+                ], output_1.ExitCode.Usage);
+            }
+        }
+        // Check the channel EXISTS before building anything.
+        //
+        // The presign call is what rejects an unknown channel, and it happens
+        // after Metro and Hermes have run — so a name that was never going to
+        // work cost a full 50-second compile before saying so. Every flag in
+        // this command already validates before the network; the channel is the
+        // one piece of state that needs a round trip to check, and one cheap GET
+        // is worth far less than the build it saves.
+        //
+        // Best-effort: a listing that fails for any other reason must not block
+        // a publish that would have succeeded, so this only ever fires on a
+        // definite "that channel is not there".
+        //
+        // The try/catch wraps ONLY the network listing. The abort below is
+        // deliberately OUTSIDE it: inside the interactive shell `fail()` ->
+        // process.exit is replaced by a throw (so one command can't kill the
+        // session), and a `fail()` raised inside this catch was swallowed as if
+        // it were a listing error — the guard printed "no bundle was compiled"
+        // and then built anyway. Deciding after the try keeps the abort real.
+        let knownChannels = null;
+        try {
+            const known = await client.get(`/saas/apps/${opts.appId}/ota/channels`);
+            knownChannels = Array.isArray(known) ? known : [];
+        }
+        catch {
+            // Listing failed for some other reason. Let the publish proceed and
+            // let presign be the authority, exactly as before.
+            knownChannels = null;
+        }
+        if (knownChannels && knownChannels.length) {
+            const hit = knownChannels.find((c) => c.id === targetChannel || c.name.toLowerCase() === targetChannel.toLowerCase());
+            if (!hit) {
+                (0, output_1.fail)(`No OTA channel named "${targetChannel}" on this app.`, [
+                    `Existing: ${knownChannels.map((c) => c.name).join(', ')}`,
+                    `Pass --channel <name>, or create it: scalebun ota channels create --name ${targetChannel}`,
+                    'Checked before building — no bundle was compiled.',
+                ], output_1.ExitCode.Usage);
+            }
+        }
+        // Runtime binding. `targetAppVersion` gates on a marketing string; these
+        // are the actual contract between the bundle and the binary that runs
+        // it. The backend withholds a bundle from a device whose runtime does
+        // not match — see runtime-compat.ts.
+        const rnVersion = (0, bundle_1.detectProjectRnVersion)();
+        // Generated here, before the build, so it can be compiled into the JS.
+        // The SDK reads it back at boot to prove the bundle it installed is the
+        // one actually executing.
+        const identityToken = crypto.randomBytes(16).toString('hex');
+        // Sourcemap outcome tracking — the publish summary must report what
+        // actually happened, not what was requested.
+        let sourcemapStored = false;
+        let sourcemapRegistered = false;
+        // Step 1: Build the bundle (or use pre-built)
+        let bundlePath;
+        let hermesBytecodeVersion = null;
+        let bundleCarriesMarker = false;
+        // The `--assets-dest` directory from buildBundle, walked into the asset
+        // manifest. Undefined for a pre-built bundle (no assets to enumerate).
+        let assetsDir;
+        if (opts.skipBundle && (opts.bundlePath || opts.customBundlePath)) {
+            bundlePath = opts.bundlePath || opts.customBundlePath;
+            if (!fs.existsSync(bundlePath)) {
+                console.error(`❌ Bundle file not found: ${bundlePath}`);
+                process.exit(1);
+            }
+            console.log(`📦 Using pre-built bundle: ${bundlePath}`);
+            // A pre-built artifact is taken as-is: injecting a marker would mean
+            // rewriting someone else's build output, and if it is already Hermes
+            // bytecode a text prefix would corrupt it outright.
+            hermesBytecodeVersion = (0, bundle_1.readHermesBytecodeVersion)(bundlePath);
+            console.log('  ℹ️  Pre-built bundle — no identity marker injected. Install verification ' +
+                'will be unavailable for this release.');
+        }
+        else {
+            // Hermes is the DEFAULT. The docs have always said "compiled to Hermes
+            // bytecode by default (--hermes)" while the flag was actually opt-in —
+            // so every publish that didn't know the flag shipped plain JS with a
+            // slower cold start and no HBC version for the runtime gate to check.
+            // Making the code match the docs is the right direction: bytecode is
+            // what production wants, and `--hermes-disabled` remains the opt-out.
+            const useHermes = opts.hermesDisabled ? false : true;
+            console.log(`📦 Building ${platform} bundle${useHermes ? ' (Hermes bytecode)' : ''}…`);
+            const result = (0, bundle_1.buildBundle)({
+                platform,
+                entryFile: opts.entryFile,
+                dev: false,
+                hermes: useHermes,
+                allowPlainJs: opts.allowPlainJs ?? false,
+                sourcemap: opts.sourcemap,
+                identityToken,
+            });
+            bundlePath = result.bundlePath;
+            hermesBytecodeVersion = result.hermesBytecodeVersion;
+            bundleCarriesMarker = true;
+            assetsDir = result.assetsPath;
+            console.log(`  ✅ Bundle built: ${bundlePath}`);
+            // ASSETS DO NOT SHIP OVER OTA.
+            //
+            // An update is one artifact: the JS/bytecode bundle. Images and fonts
+            // are resolved from what the INSTALLED BINARY already contains, so an
+            // asset added since the last store build is referenced by the new JS
+            // and is not on the device. The update installs cleanly, reports
+            // success, and renders a missing image — the worst kind of failure.
+            // Metro writes those files next to the bundle and the publish flow
+            // has always discarded them without a word. Now it says so.
+            if (result.assets.length) {
+                const shown = result.assets.slice(0, 5);
+                console.log(`  ℹ️  This bundle references ${result.assets.length} asset(s). ` +
+                    'OTA ships JS only — assets resolve from the installed binary.');
+                console.log(`      ${shown.join(', ')}${result.assets.length > shown.length ? `, +${result.assets.length - shown.length} more` : ''}`);
+                console.log('      Any image or font ADDED since your last store build will be ' +
+                    'missing on device. Changing which existing asset you use is fine; ' +
+                    'a new one needs a native release (fonts always do).');
+            }
+            // You asked for bytecode and didn't get it: that is a failed build,
+            // not a warning. This degradation has shipped silently twice now —
+            // first via `npx hermesc` (not a real package), then via spawnSync's
+            // 1MB maxBuffer killing the compiler — and a plain-JS bundle both
+            // starts ~20-30% slower and carries no HBC version for the runtime
+            // gate to check. If plain JS is what you want, say so.
+            if (useHermes && !result.hermesCompiled) {
+                console.error('❌ --hermes was requested but the bundle is NOT Hermes bytecode (see the hermesc error above).\n' +
+                    '   To intentionally publish plain JS, use --hermes-disabled.');
+                process.exit(1);
+            }
+        }
+        console.log(`  Runtime: RN ${rnVersion ?? 'unknown'}` +
+            (hermesBytecodeVersion !== null
+                ? `, Hermes HBC v${hermesBytecodeVersion}`
+                : ', plain JS'));
+        if (!rnVersion) {
+            console.warn('  ⚠️  React Native version could not be detected — this bundle will not be ' +
+                'runtime-gated, and can reach binaries that cannot run it.');
+        }
+        // The sourcemap must be located BEFORE presign, because sourcemaps are
+        // uploaded through a presigned URL requested alongside the bundle's.
+        const sourcemapPath = opts.sourcemap && fs.existsSync(bundlePath + '.map')
+            ? bundlePath + '.map'
+            : null;
+        if (opts.sourcemap && !sourcemapPath) {
+            console.warn('  ⚠️  --sourcemap was passed but no .map file was produced — continuing without one.');
+        }
+        // Step 2: Hash the bundle
+        console.log('🔒 Computing SHA-256…');
+        const sha256 = (0, hash_1.sha256File)(bundlePath);
+        const sizeBytes = fs.statSync(bundlePath).size;
+        console.log(`  Hash: ${sha256}`);
+        console.log(`  Size: ${(sizeBytes / 1024 / 1024).toFixed(2)} MB`);
+        if (sizeBytes > 50000000) {
+            console.error(`❌ Bundle is ${(sizeBytes / 1024 / 1024).toFixed(1)} MB — exceeds 50 MB limit`);
+            process.exit(1);
+        }
+        // Provenance (git + CI) and the asset manifest — best-effort metadata so
+        // the dashboard can show Git SHA / PR / CI build and per-asset size diffs.
+        // Both are optional on the backend; sending them changes nothing about
+        // delivery, only what the Bundles page can display.
+        const provenance = (0, provenance_1.collectProvenance)();
+        const assetManifest = (0, provenance_1.collectAssetManifest)(bundlePath, sha256, sizeBytes, assetsDir);
+        if (provenance.gitSha) {
+            console.log(`  Source: ${provenance.gitSha.slice(0, 7)}${provenance.gitBranch ? ` (${provenance.gitBranch})` : ''}` +
+                `${provenance.ciProvider ? ` · ${provenance.ciProvider}` : ''}`);
+        }
+        console.log(`  Assets: ${assetManifest.length} (bundle + ${assetManifest.length - 1} files)`);
+        // The binary's native application id (Android applicationId / iOS bundle
+        // id). Signed releases are identified by it and the device verifies it
+        // against its own package name. Sending it lets the server adopt it as the
+        // app's bundleId when that field is still empty (the common case), so the
+        // first signed publish just works instead of failing with an empty
+        // applicationId.
+        const nativeApplicationId = (0, native_id_1.detectNativeApplicationId)(platform);
+        if (nativeApplicationId) {
+            console.log(`  Native app id: ${nativeApplicationId}`);
+        }
+        // Step 3: Get presigned upload URL
+        console.log('🔗 Requesting presigned upload URL…');
+        let presigned;
+        try {
+            presigned = await client.post(`/saas/apps/${opts.appId}/ota/bundles/presign`, {
+                channelId: targetChannel,
+                platform,
+                nativeApplicationId,
+                sha256,
+                sizeBytes,
+                releaseNote: opts.releaseNote,
+                rnVersion: rnVersion ?? undefined,
+                hermes: hermesBytecodeVersion !== null,
+                hermesBytecodeVersion: hermesBytecodeVersion ?? undefined,
+                identityToken: bundleCarriesMarker ? identityToken : undefined,
+                // Provenance + asset manifest — optional; the backend stores them
+                // for the dashboard and ignores them if omitted.
+                ...provenance,
+                assets: assetManifest,
+                // Sourcemaps ride the presign flow: declaring them here returns a
+                // second presigned PUT URL. This CLI used to skip these fields and
+                // instead POST base64 JSON to /bundles/:id/sourcemap after promote
+                // — an endpoint that DOES NOT EXIST and never has. The error was
+                // caught and printed as a "non-fatal" warning, so every
+                // `--sourcemap` publish ever made silently uploaded nothing while
+                // the summary implied symbolication would work.
+                ...(sourcemapPath
+                    ? {
+                        sourcemapSha256: (0, hash_1.sha256File)(sourcemapPath),
+                        sourcemapSizeBytes: fs.statSync(sourcemapPath).size,
+                    }
+                    : {}),
+            }, 
+            // Presign is safe to retry: it never got an answer if the socket
+            // dropped, and a stray UPLOADING row is superseded by the retry. A
+            // single "socket hang up" must not sink an already-built bundle.
+            { retry: true });
+        }
+        catch (err) {
+            console.error(`❌ Presign failed: ${err.message}`);
+            process.exit(1);
+        }
+        console.log(`  Bundle ID: ${presigned.bundleId}`);
+        console.log(`  Upload URL expires in ${presigned.expiresIn}s`);
+        // Step 4: Upload to R2/S3
+        console.log('⬆️  Uploading bundle to storage…');
+        const bundleData = fs.readFileSync(bundlePath);
+        try {
+            await client.putBytes(presigned.uploadUrl, bundleData, 'application/octet-stream');
+        }
+        catch (err) {
+            console.error(`❌ Upload failed: ${err.message}`);
+            process.exit(1);
+        }
+        console.log('  ✅ Upload complete');
+        // Step 5: Finalize — server-side SHA-256 verification + version assignment
+        console.log('🔍 Finalizing (server-side hash verification)…');
+        let finalized;
+        try {
+            // Sign under SB-OTA-RSA-SHA256-V1 with the locally-held RSA private key,
+            // if this project has adopted signing. The key never leaves this machine:
+            // we build the binary signed-release payload from the identity the server
+            // RESERVED at presign (releaseId/bundleId/releaseSequence/project/app) plus
+            // the artifact's own size + SHA-256, RSA-sign it, self-verify, and upload
+            // only { signedPayload, signature }. ScaleBun serves a signature it could
+            // not itself have produced. Unsigned publishes stay valid; the device only
+            // enforces once the app embeds a trusted public key.
+            const signing = (0, ota_keys_1.resolveSigningMaterial)({
+                keyDir: opts.keyDir,
+                keyId: opts.keyId,
+                passphrase: opts.passphrase,
+            });
+            let finalizeBody = undefined;
+            // Fail closed: a release that must be signed but has no key must not
+            // silently ship unsigned — a signature-enforcing device rejects it, so
+            // "unsigned" here is a broken deploy, not a lenient fallback.
+            if ((0, ota_keys_1.signingRequired)({ requireSigning: opts.requireSigning }, signing) && !signing.privatePem) {
+                (0, output_1.fail)('Signing is required for this release, but no signing key is available.', [
+                    'Provide the key via --key-dir, the SCALEBUN_SIGNING_PRIVATE_KEY secret,',
+                    'or ./.scalebun/ota-signing-key.pem.',
+                    'To publish unsigned (SHA-256 only), drop --require-signing / --key-id and',
+                    'unset SCALEBUN_REQUIRE_SIGNING / SCALEBUN_KEY_ID.',
+                ], output_1.ExitCode.Usage);
+            }
+            if (signing.privatePem) {
+                const keyId = signing.keyId;
+                if (!keyId) {
+                    (0, output_1.fail)('A signing key is present but its key id is unknown.', [
+                        'Pass --key-id <id> or set SCALEBUN_KEY_ID, or regenerate with',
+                        '`scalebun ota keys generate` which writes the key id alongside the key.',
+                    ], output_1.ExitCode.Usage);
+                }
+                // Distinguish the two failure modes so the message points at the
+                // real cause instead of always blaming the backend version.
+                if (!presigned.applicationId) {
+                    // The app has no bundleId, and the server could not adopt one.
+                    (0, output_1.fail)("This app has no bundleId (native application id), so a signed release can't be identified.", nativeApplicationId
+                        ? [
+                            `The CLI detected '${nativeApplicationId}' and sent it, but the backend did not`,
+                            'adopt it — the deployed backend predates bundleId self-heal. Set the app',
+                            "bundleId in the dashboard (app settings), then re-run publish.",
+                        ]
+                        : [
+                            'Could not read the native applicationId from this project (looked for',
+                            'android/app/build.gradle applicationId / the iOS bundle identifier).',
+                            'Set the app bundleId in the dashboard (app settings), or run publish from',
+                            'the app root so the id can be detected, then re-run.',
+                        ], output_1.ExitCode.Rejected);
+                }
+                if (!presigned.projectId ||
+                    !presigned.releaseId ||
+                    presigned.releaseSequence === undefined ||
+                    presigned.releaseSequence === null) {
+                    (0, output_1.fail)('This ScaleBun backend did not return SB-OTA-RSA-SHA256-V1 release identity.', [
+                        'The RSA signing protocol needs the server to reserve releaseId + releaseSequence',
+                        'at presign. Update the ScaleBun backend, or publish without a local signing key',
+                        'to ship on SHA-256 integrity only.',
+                    ], output_1.ExitCode.Rejected);
+                }
+                const payload = {
+                    signatureAlgorithm: 'SB-OTA-RSA-SHA256-V1',
+                    hashAlgorithm: 'SHA-256',
+                    keyId: keyId,
+                    projectId: presigned.projectId,
+                    applicationId: presigned.applicationId,
+                    releaseId: presigned.releaseId,
+                    bundleId: presigned.bundleId,
+                    platform,
+                    artifactType: 'full',
+                    targetAppVersion: opts.targetVersion || '>=1.0.0',
+                    targetRuntimeVersion: rnVersion ?? '',
+                    minimumSdkVersion: presigned.minimumSdkVersion ?? '',
+                    releaseSequence: presigned.releaseSequence,
+                    issuedAtEpochSeconds: Math.floor(Date.now() / 1000),
+                    expiresAtEpochSeconds: 0,
+                    artifactSize: sizeBytes,
+                    artifactSha256: sha256,
+                    baseBundleId: '',
+                    baseArtifactSha256: '',
+                    // A full download IS the final bundle, so the installed result hash
+                    // equals the downloaded artifact hash.
+                    resultArtifactSha256: sha256,
+                };
+                // An external signer is used only when one is configured. With
+                // nothing set this is the same local-PEM path as before, byte for
+                // byte — the point of the change is that a customer who has not
+                // asked for an HSM cannot tell it exists.
+                const externalSigner = process.env.SCALEBUN_SIGNER_COMMAND?.trim();
+                const displayMetadata = {
+                    releaseId: presigned.releaseId,
+                    releaseNote: opts.releaseNote,
+                };
+                const envelope = externalSigner
+                    ? await (0, signing_1.buildReleaseEnvelopeWith)(payload, (0, signer_1.resolveSigner)({ privateKeyPem: signing.privatePem }), { displayMetadata })
+                    : (0, signing_1.buildReleaseEnvelope)(payload, signing.privatePem, {
+                        passphrase: signing.passphrase,
+                        displayMetadata,
+                    });
+                const via = externalSigner
+                    ? ' (external signer)'
+                    : signing.privateSource === 'env'
+                        ? ' (key from SCALEBUN_SIGNING_PRIVATE_KEY)'
+                        : signing.privateSource === 'flag'
+                            ? ' (key from --key-dir)'
+                            : '';
+                console.log(`  🔏 Signed with RSA key (SB-OTA-RSA-SHA256-V1)${via}`);
+                finalizeBody = {
+                    protocol: envelope.protocol,
+                    keyId: envelope.keyId,
+                    signedPayload: envelope.signedPayload,
+                    signature: envelope.signature,
+                };
+            }
+            finalized = await client.post(`/saas/apps/${opts.appId}/ota/bundles/${presigned.bundleId}/finalize`, finalizeBody);
+        }
+        catch (err) {
+            console.error(`❌ Finalize failed: ${err.message}`);
+            process.exit(1);
+        }
+        // Step 6: Promote release to ACTIVE status with installMode
+        if (opts.skipPromote) {
+            console.log('⏭️  Skipping promotion (--skip-promote) — bundle is uploaded but NOT live.');
+            console.log(`   Promote later from the dashboard, or re-run without --skip-promote.`);
+        }
+        else {
+            console.log('🚀 Promoting release to active target channel…');
+            try {
+                await client.post(`/saas/apps/${opts.appId}/ota/bundles/${presigned.bundleId}/promote`, {
+                    targetAppVersion: opts.targetVersion || '>=1.0.0',
+                    rolloutPercent,
+                    isMandatory: installMode === 'IMMEDIATE',
+                    installMode,
+                    releaseNote: opts.releaseNote,
+                });
+            }
+            catch (err) {
+                // This used to warn and exit 0 — so a CI pipeline printed
+                // "published successfully" while no device would ever receive the
+                // update (promotion is what makes a bundle live). A pipeline must
+                // fail when its purpose failed.
+                console.error(`❌ Promotion failed: ${err.message}`);
+                console.error(`   The bundle IS uploaded (v pending, id ${presigned.bundleId}) but is NOT live.\n` +
+                    '   Fix the error and promote from the dashboard, or publish again.\n' +
+                    '   To upload without promoting on purpose, use --skip-promote.');
+                process.exit(1);
+            }
+        }
+        // Step 7: Upload the sourcemap through its presigned URL.
+        // (The old code POSTed base64 JSON to /bundles/:id/sourcemap — a route
+        // that has never existed — and downgraded the 404 to a "non-fatal"
+        // warning, so symbolication silently never worked for OTA bundles.)
+        if (sourcemapPath && presigned.sourcemapUploadUrl) {
+            console.log('🗺️  Uploading sourcemap for crash symbolication…');
+            try {
+                await client.putBytes(presigned.sourcemapUploadUrl, fs.readFileSync(sourcemapPath), 'application/json');
+                console.log('  ✅ Sourcemap uploaded');
+                sourcemapStored = true;
+                // Cleanup happens AFTER symbolication registration below — the
+                // symbols upload reads this same file.
+            }
+            catch (err) {
+                console.warn(`  ⚠️  Sourcemap upload failed: ${err.message}\n` +
+                    '      Stack traces from this bundle will not symbolicate. Re-publish to retry.');
+            }
+        }
+        else if (sourcemapPath && !presigned.sourcemapUploadUrl) {
+            console.warn('  ⚠️  Backend did not return a sourcemap upload URL — is it up to date?');
+        }
+        // D6: register the map with SYMBOLICATION, not just storage. The
+        // presigned PUT above lands the map in the OTA bundle bucket —
+        // `OtaBundle.sourcemapKey` — which NOTHING reads: the symbolication
+        // worker only consumes `symbolUpload` rows, written by
+        // POST /apps/:appId/symbols. Without this second upload, every
+        // `--sourcemap` publish paid to store a map no crash could ever use.
+        // That endpoint authenticates with the app's SDK SECRET key (a server
+        // credential, deliberately not the client key baked into the binary),
+        // so this step is opt-in via SCALEBUN_SDK_SECRET.
+        if (sourcemapPath && fs.existsSync(sourcemapPath)) {
+            const sdkSecret = process.env.SCALEBUN_SDK_SECRET;
+            if (!sdkSecret) {
+                console.warn('  ⚠️  SCALEBUN_SDK_SECRET not set — the sourcemap was stored but NOT ' +
+                    'registered for crash symbolication. Set the app\'s SDK secret key ' +
+                    'in that env var to enable symbolicated stack traces.');
+            }
+            else {
+                console.log('🔣 Registering sourcemap for crash symbolication…');
+                try {
+                    const boundary = `----scalebun${Date.now().toString(16)}`;
+                    const mapBytes = fs.readFileSync(sourcemapPath);
+                    const field = (name, value) => `--${boundary}\r\nContent-Disposition: form-data; name="${name}"\r\n\r\n${value}\r\n`;
+                    const head = Buffer.from(field('platform', 'js') +
+                        (rnVersion ? field('version', opts.targetVersion ?? '') : '') +
+                        field('buildUuid', sha256) +
+                        `--${boundary}\r\nContent-Disposition: form-data; name="file"; filename="bundle.jsbundle.map"\r\nContent-Type: application/json\r\n\r\n`, 'utf-8');
+                    const tail = Buffer.from(`\r\n--${boundary}--\r\n`, 'utf-8');
+                    await client.postMultipart(`/apps/${opts.appId}/symbols`, Buffer.concat([head, mapBytes, tail]), `multipart/form-data; boundary=${boundary}`, { 'x-scalebun-secret-key': sdkSecret });
+                    console.log('  ✅ Sourcemap registered — crashes from this bundle will symbolicate');
+                    sourcemapRegistered = true;
+                }
+                catch (err) {
+                    console.warn(`  ⚠️  Symbolication registration failed: ${err.message}`);
+                }
+            }
+            if (!opts.keepArtifacts) {
+                try {
+                    fs.unlinkSync(sourcemapPath);
+                }
+                catch {
+                    /* non-fatal */
+                }
+            }
+        }
+        // Step 8: Print detailed success summary
+        const installModeLabel = installMode === 'IMMEDIATE'
+            ? '⚡ IMMEDIATE (SDK restarts the app right after install)'
+            : installMode === 'ON_NEXT_RESUME'
+                ? '🔄 ON_NEXT_RESUME (SDK restarts on next return to foreground)'
+                : '🌙 ON_NEXT_RESTART (activates silently on next launch)';
+        console.log('');
+        console.log(`✅ Bundle v${finalized.version} published successfully!`);
+        console.log(`   Channel:      ${finalized.channelName} (${finalized.environmentName})`);
+        console.log(`   Platform:     ${finalized.platform}`);
+        console.log(`   Install Mode: ${installModeLabel}`);
+        console.log(`   SHA-256:      ${finalized.sha256}`);
+        console.log(`   Size:         ${(finalized.sizeBytes / 1024).toFixed(1)} KB`);
+        if (opts.sourcemap) {
+            // Report what actually happened. This line used to print success
+            // whenever --sourcemap was passed — even when no map was produced,
+            // the upload failed, or SCALEBUN_SDK_SECRET was unset so nothing was
+            // registered for symbolication. CI logs then certified symbolication
+            // that would not happen, and the first production crash arrived
+            // minified.
+            const smState = sourcemapRegistered
+                ? 'Uploaded and registered ✓ (stack traces will symbolicate)'
+                : sourcemapStored
+                    ? 'Uploaded, NOT registered — set SCALEBUN_SDK_SECRET to symbolicate'
+                    : 'NOT uploaded — stack traces from this bundle stay minified';
+            console.log(`   Sourcemap:    ${smState}`);
+        }
+        const rolloutNow = opts.skipPromote ? 0 : rolloutPercent;
+        // The --app-id on every line here was load-bearing before `link` and
+        // the resolver existed. It is now noise: the id resolves from
+        // scalebun.json, and a suggestion carrying a 25-character cuid reads as
+        // something you must paste rather than something you can just run.
+        (0, output_1.printNextSteps)([
+            { label: 'See live state', argv: ['ota', 'status'] },
+            ...(!opts.skipPromote && rolloutNow < 100
+                ? [{ label: 'Widen the rollout', argv: ['ota', 'rollout', '--percent', '100'] }]
+                : []),
+            ...(opts.skipPromote
+                ? [{ label: 'Make it live', argv: ['ota', 'promote'] }]
+                : []),
+            { label: 'Stop new deliveries', argv: ['ota', 'pause'] },
+            { label: 'Revert every device', argv: ['ota', 'rollback'] },
+        ], chalk_1.default.cyan);
+        if (!opts.skipPromote && rolloutNow === 100) {
+            console.log('');
+            console.log('   Tip: production releases usually start staged — `--rollout 10`, watch the');
+            console.log('   health page, then `ota rollout --percent 100` once it looks clean.');
+        }
+        // Clean up bundle unless --keep-artifacts or using pre-built
+        if (!opts.keepArtifacts && !opts.skipBundle) {
+            try {
+                fs.unlinkSync(bundlePath);
+            }
+            catch {
+                // non-fatal
+            }
+        }
+    });
+}
+/**
+ * Fill `opts` interactively. Picks the publish method first: the Dashboard and
+ * Cancel branches finish inside here (process.exit); the CLI branch mutates
+ * `opts` and returns so the normal publish flow runs.
+ */
+async function runPublishWizard(opts, cmd) {
+    console.log(chalk_1.default.bold.cyan('\n⚡ ScaleBun — publish an OTA update\n'));
+    const method = await (0, prompt_1.select)('How do you want to publish?', [
+        { label: 'Publish now (CLI)', value: 'cli', hint: 'bundle, upload & promote this release' },
+        { label: 'Build a bundle for the Dashboard', value: 'dashboard', hint: `drag & drop at ${DASHBOARD_OTA_URL}` },
+        { label: 'Cancel', value: 'cancel' },
+    ]);
+    if (method === 'cancel') {
+        console.log('Cancelled — nothing published.');
+        process.exit(0);
+    }
+    if (method === 'dashboard') {
+        await runDashboardBundleFlow(opts);
+        process.exit(0);
+    }
+    // ── CLI path ────────────────────────────────────────────────────────────────
+    let creds = (0, credentials_1.readCredentials)();
+    if (!creds) {
+        console.log('\nYou need to sign in first.\n');
+        await (0, login_1.runLogin)({});
+        creds = (0, credentials_1.readCredentials)();
+        if (!creds)
+            process.exit(1);
+    }
+    const client = new client_1.ApiClient(creds);
+    opts.appId = await pickApp(client);
+    opts.platform = await (0, prompt_1.select)('Platform', [
+        { label: 'Android', value: 'android' },
+        { label: 'iOS', value: 'ios' },
+    ], { default: opts.platform === 'ios' ? 1 : 0 });
+    opts.channel = await pickChannel(client, opts.appId, opts.channel);
+    // The wizard fills opts by mutation, but the action decides whether to trust
+    // opts.channel by asking commander where the value came from
+    // (getOptionValueSource === 'cli'). A bare `ota publish` leaves that source at
+    // 'default', so a wizard-picked channel was silently dropped in favour of
+    // scalebun.json's channel. Register the pick through commander so the single
+    // resolution path sees it as explicit — every other wizard answer is read off
+    // opts directly, only the channel is gated on the source.
+    cmd?.setOptionValueWithSource('channel', opts.channel, 'cli');
+    opts.installMode = await (0, prompt_1.select)('Install mode', [
+        { label: 'ON_NEXT_RESTART', value: 'ON_NEXT_RESTART', hint: 'applies on the next cold launch (default)' },
+        { label: 'ON_NEXT_RESUME', value: 'ON_NEXT_RESUME', hint: 'applies when the app next returns to the foreground' },
+        { label: 'IMMEDIATE', value: 'IMMEDIATE', hint: 'reloads the app right away — for hotfixes' },
+    ]);
+    opts.rollout = String(await (0, prompt_1.number)('Rollout %', { default: 100, min: 0, max: 100 }));
+    opts.targetVersion = await (0, prompt_1.text)('Target native app version range', {
+        default: opts.targetVersion || '>=1.0.0',
+    });
+    const note = await (0, prompt_1.text)('Release note (optional)', {
+        default: opts.releaseNote || '',
+        allowEmpty: true,
+    });
+    opts.releaseNote = note || undefined;
+    const useHermes = await (0, prompt_1.confirm)('Compile to Hermes bytecode? (smaller, faster cold start)', {
+        default: true,
+    });
+    if (useHermes)
+        opts.hermes = true;
+    else
+        opts.hermesDisabled = true;
+    if (await (0, prompt_1.confirm)('Configure advanced options?', { default: false })) {
+        opts.entryFile = await (0, prompt_1.text)('JS entry file', { default: opts.entryFile || 'index.js' });
+        opts.sourcemap = await (0, prompt_1.confirm)('Generate & upload a sourcemap (crash symbolication)?', {
+            default: !!opts.sourcemap,
+        });
+        opts.keepArtifacts = await (0, prompt_1.confirm)('Keep build artifacts after upload?', {
+            default: !!opts.keepArtifacts,
+        });
+        opts.skipPromote = await (0, prompt_1.confirm)('Upload only — do NOT make it live yet (skip promote)?', {
+            default: !!opts.skipPromote,
+        });
+    }
+    printReview(opts);
+    if (!opts.yes) {
+        // No default: the wizard has just collected every answer, and Enter
+        // meaning "throw it away" is the same trap as the promote confirmation.
+        const go = await (0, prompt_1.confirm)('Publish now?');
+        if (!go) {
+            (0, prompt_1.closePrompts)();
+            console.log('Aborted — nothing published.');
+            process.exit(0);
+        }
+    }
+    (0, prompt_1.closePrompts)();
+    console.log('');
+}
+/** App pick-list from the account, with a manual-entry fallback. */
+async function pickApp(client) {
+    let entries;
+    try {
+        entries = await (0, apps_1.fetchAllApps)(client);
+    }
+    catch {
+        entries = [];
+    }
+    if (!entries.length) {
+        console.log(chalk_1.default.yellow('  Could not list your apps — enter the app id manually.'));
+        // Was: `if (!id) process.exit(1)` — a silent exit 1 from a prompt that had
+        // just asked for an app id, with nothing said about why it stopped.
+        return (0, prompt_1.text)('App id', {
+            help: 'Find it in the dashboard URL, or run `scalebun apps` from another terminal.',
+            validate: (v) => (/\s/.test(v) ? 'An app id has no spaces.' : null),
+        });
+    }
+    return (0, prompt_1.select)('App', entries.map((e) => ({
+        label: e.app.name,
+        value: e.app.id,
+        hint: `${e.app.id}  ·  ${e.orgName}/${e.projectName}${e.app.platform ? ` · ${e.app.platform}` : ''}`,
+    })));
+}
+/** Channel pick-list for the app (falls back to typing a name). */
+async function pickChannel(client, appId, current) {
+    let channels = [];
+    try {
+        channels = (await client.get(`/saas/apps/${appId}/ota/channels`)) ?? [];
+    }
+    catch {
+        channels = [];
+    }
+    const choices = channels.map((c) => ({
+        label: c.name,
+        value: c.name,
+        hint: c.environment?.name ? `env: ${c.environment.name}` : undefined,
+    }));
+    if (!choices.some((c) => c.value === 'default')) {
+        choices.unshift({ label: 'default', value: 'default', hint: 'created automatically on first publish' });
+    }
+    const OTHER = '__other__';
+    choices.push({ label: 'Other (type a name)…', value: OTHER, hint: undefined });
+    const defaultIdx = current ? Math.max(0, choices.findIndex((c) => c.value === current)) : 0;
+    const picked = await (0, prompt_1.select)('Channel', choices, { default: defaultIdx });
+    if (picked === OTHER)
+        return (await (0, prompt_1.text)('Channel name', { default: 'default' })) || 'default';
+    return picked;
+}
+/** The Dashboard path: build a standalone bundle and point the user at the dashboard. */
+async function runDashboardBundleFlow(opts) {
+    const platform = await (0, prompt_1.select)('Platform', [
+        { label: 'Android', value: 'android' },
+        { label: 'iOS', value: 'ios' },
+    ], { default: opts.platform === 'ios' ? 1 : 0 });
+    const useHermes = await (0, prompt_1.confirm)('Compile to Hermes bytecode? (smaller, faster cold start)', {
+        default: true,
+    });
+    const entryFile = await (0, prompt_1.text)('JS entry file', { default: opts.entryFile || 'index.js' });
+    const sourcemap = await (0, prompt_1.confirm)('Generate a sourcemap alongside the bundle?', { default: false });
+    // Release stdin BEFORE spawning `react-native bundle`. buildBundle runs Metro
+    // with stdio:'inherit'; on Windows an inherited child sharing a still-open
+    // readline on the console gets a corrupt stdin handle and is killed (exit code
+    // null). The CLI-publish path already closes prompts before building — do the
+    // same here.
+    (0, prompt_1.closePrompts)();
+    console.log(`\n📦 Building ${platform} bundle${useHermes ? ' (Hermes bytecode)' : ''}…`);
+    const result = (0, bundle_1.buildBundle)({
+        platform,
+        entryFile,
+        dev: false,
+        hermes: useHermes,
+        allowPlainJs: false,
+        sourcemap,
+    });
+    const outPath = path.resolve(`./index.${platform}.bundle`);
+    fs.copyFileSync(result.bundlePath, outPath);
+    const sizeMb = (fs.statSync(outPath).size / (1024 * 1024)).toFixed(2);
+    console.log(`\n✅ Bundle created: ${chalk_1.default.cyan(outPath)}  (${sizeMb} MB)`);
+    console.log(chalk_1.default.dim(`   (equivalent: scalebun ota bundle --platform ${platform} ${useHermes ? '--hermes' : '--hermes-disabled'}${sourcemap ? ' --sourcemap' : ''})`));
+    console.log(`\n👉 Drag & drop it into the Scalebun Dashboard: ${chalk_1.default.cyan(DASHBOARD_OTA_URL)}`);
+    const open = await (0, prompt_1.confirm)('Open the dashboard now?', { default: true });
+    (0, prompt_1.closePrompts)();
+    if (open)
+        (0, browser_1.openUrl)(DASHBOARD_OTA_URL);
+}
+/** Show the equivalent command before the irreversible publish. */
+function printReview(opts) {
+    const parts = [
+        'scalebun ota publish',
+        `--app-id ${opts.appId}`,
+        `--platform ${opts.platform}`,
+        `--channel ${opts.channel}`,
+        `--install-mode ${opts.installMode}`,
+        `--rollout ${opts.rollout}`,
+        `--target-version "${opts.targetVersion}"`,
+    ];
+    if (opts.releaseNote)
+        parts.push(`--release-note "${opts.releaseNote}"`);
+    parts.push(opts.hermesDisabled ? '--hermes-disabled' : '--hermes');
+    if (opts.sourcemap)
+        parts.push('--sourcemap');
+    if (opts.keepArtifacts)
+        parts.push('--keep-artifacts');
+    if (opts.skipPromote)
+        parts.push('--skip-promote');
+    if (opts.entryFile && opts.entryFile !== 'index.js')
+        parts.push(`--entry-file ${opts.entryFile}`);
+    console.log('\n' + chalk_1.default.bold('Review'));
+    console.log('  ' + chalk_1.default.green(parts.join(' \\\n    ')));
+    console.log('');
+}
+//# sourceMappingURL=ota-publish.js.map