@scalebun/cli 1.0.0 → 1.0.1

package/lib/commands/login.js

@@ -35,21 +35,37 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerLoginCommand = registerLoginCommand;
 const readline = __importStar(require("readline"));
+const os = __importStar(require("os"));
 const credentials_1 = require("../utils/credentials");
 const client_1 = require("../api/client");
 /**
- * `scalebun login` — authenticate via Personal Access Token (PAT).
+ * `scalebun login` — authenticate and store a DURABLE credential.
  *
- * 1. Prompt for backend URL and PAT
- * 2. Validate by calling GET /auth/me
- * 3. Store in ~/.scalebun/credentials.json
+ * ── Why the PAT exchange matters ────────────────────────────────────────────
+ *
+ * The backend's session JWTs expire in ~15 minutes. This command used to store
+ * that JWT directly, so every publish that started more than a few minutes
+ * after login failed with an opaque 401 — hit live during the first real
+ * device-test run. Meanwhile the backend has had a full personal-access-token
+ * system all along (`POST /auth/tokens`, hashed at rest, scoped, revocable)
+ * that the CLI never used.
+ *
+ * Now: email/password buys a short-lived JWT, which is immediately spent on
+ * minting a PAT named after this machine. The PAT is what gets stored — it
+ * survives for `--expires-days` (default 90) and is revocable from the
+ * dashboard (Settings → Access Tokens) if this machine is ever lost.
+ *
+ * Pasting an existing `scalebun_pat_…` still works and skips the exchange.
  */
 function registerLoginCommand(program) {
     program
         .command('login')
-        .description('Authenticate with your Scalebun backend using a PAT')
+        .description('Authenticate with your Scalebun backend (stores a durable access token)')
         .option('--api-url <url>', 'Backend API URL (e.g. https://api.scalebun.com/api/v1)')
         .option('--token <pat>', 'Personal access token (scalebun_pat_…)')
+        .option('--email <email>', 'Account email (prompts for password unless --password is set)')
+        .option('--password <password>', 'Account password (prefer the prompt — flags leak into shell history)')
+        .option('--expires-days <n>', 'Lifetime of the minted CLI token in days (0 = never expires)', '90')
         .action(async (opts) => {
         const rl = readline.createInterface({
             input: process.stdin,
@@ -66,37 +82,72 @@ function registerLoginCommand(program) {
                 process.exit(1);
             }
             let token = opts.token;
-            if (!token) {
-                const input = await ask('Email or Token (scalebun_pat_…): ');
+            let email = opts.email;
+            if (!token && !email) {
+                const input = await ask('Email or token (scalebun_pat_…): ');
                 if (!input) {
-                    console.error('❌ Email or Token is required');
+                    console.error('❌ Email or token is required');
+                    process.exit(1);
+                }
+                if (input.includes('@'))
+                    email = input;
+                else
+                    token = input;
+            }
+            // ── Email/password → JWT → durable PAT ────────────────────────────
+            if (!token && email) {
+                const password = opts.password || (await ask('Password: '));
+                if (!password) {
+                    console.error('❌ Password is required');
                     process.exit(1);
                 }
-                if (input.includes('@')) {
-                    const password = await ask('Password: ');
-                    if (!password) {
-                        console.error('❌ Password is required');
-                        process.exit(1);
+                console.log('  Signing in…');
+                const unauthClient = new client_1.ApiClient({ apiUrl, token: '' });
+                const loginRes = await unauthClient.post('/auth/login', { email, password });
+                if (!loginRes.accessToken) {
+                    if (loginRes.mfaRequired) {
+                        console.error('❌ This account has MFA enabled, which the CLI cannot complete.\n' +
+                            '   Create a token in the dashboard instead (Settings → Access Tokens)\n' +
+                            '   and run:  scalebun login --token scalebun_pat_…');
+                    }
+                    else {
+                        console.error('❌ Sign-in did not return a token.');
                     }
-                    console.log('  Logging in with credentials…');
-                    const unauthClient = new client_1.ApiClient({ apiUrl, token: '' });
-                    const loginRes = await unauthClient.post('/auth/login', {
-                        email: input,
-                        password,
+                    process.exit(1);
+                }
+                // Spend the 15-minute JWT on something durable.
+                const expiresDays = Math.max(0, parseInt(opts.expiresDays, 10) || 0);
+                const jwtClient = new client_1.ApiClient({ apiUrl, token: loginRes.accessToken });
+                try {
+                    const pat = await jwtClient.post('/auth/tokens', {
+                        name: `Scalebun CLI on ${os.hostname()}`,
+                        scopes: ['read', 'write'],
+                        expiresInDays: expiresDays > 0 ? expiresDays : null,
                     });
-                    token = loginRes.accessToken;
+                    token = pat.token;
+                    console.log(`  🔑 Created CLI access token (…${pat.last4}, ` +
+                        `${expiresDays > 0 ? `expires in ${expiresDays} days` : 'no expiry'}). ` +
+                        'Revocable from the dashboard.');
                 }
-                else {
-                    token = input;
+                catch (patErr) {
+                    // An older backend without /auth/tokens still logs in — but the
+                    // session dies in minutes, and pretending otherwise reproduces
+                    // the exact bug this exchange exists to fix. Say so.
+                    token = loginRes.accessToken;
+                    console.warn(`  ⚠️  Could not create a durable token (${patErr.message}).\n` +
+                        '      Falling back to the session token, which EXPIRES IN ~15 MINUTES.');
                 }
             }
-            // Validate the token
+            // ── Validate whatever we ended up with ─────────────────────────────
             console.log('  Validating token…');
-            const client = new client_1.ApiClient({ apiUrl, token });
+            const client = new client_1.ApiClient({ apiUrl, token: token });
             const me = await client.get('/auth/me');
-            (0, credentials_1.writeCredentials)({ apiUrl, token });
+            (0, credentials_1.writeCredentials)({ apiUrl, token: token });
             console.log(`✅ Logged in as ${me.email} (${me.role ?? 'User'})`);
-            console.log(`   Credentials saved to ~/.scalebun/credentials.json`);
+            console.log('   Credentials saved to ~/.scalebun/credentials.json');
+            console.log('\nNext steps:');
+            console.log('  scalebun doctor                     # verify your project is OTA-ready');
+            console.log('  scalebun ota publish --app-id <id>  # ship your first update');
         }
         catch (err) {
             console.error(`❌ Login failed: ${err.message}`);
@@ -106,5 +157,12 @@ function registerLoginCommand(program) {
             rl.close();
         }
     });
+    program
+        .command('logout')
+        .description('Remove stored credentials from this machine')
+        .action(() => {
+        (0, credentials_1.clearCredentials)();
+        console.log('✅ Logged out. (The token still exists server-side — revoke it in the dashboard if this machine is compromised.)');
+    });
 }
 //# sourceMappingURL=login.js.map

package/lib/commands/login.js.map

@@ -1 +1 @@
-{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/commands/login.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAYA,oDAuEC;AAlFD,mDAAqC;AACrC,sDAAyE;AACzE,0CAA0C;AAE1C;;;;;;GAMG;AACH,SAAgB,oBAAoB,CAAC,OAAgB;IACnD,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,qDAAqD,CAAC;SAClE,MAAM,CAAC,iBAAiB,EAAE,wDAAwD,CAAC;SACnF,MAAM,CAAC,eAAe,EAAE,wCAAwC,CAAC;SACjE,MAAM,CAAC,KAAK,EAAE,IAAyC,EAAE,EAAE;QAC1D,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC;YAClC,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,CAAC,CAAS,EAAmB,EAAE,CACzC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QAEpD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAA,6BAAe,GAAE,CAAC;YAEnC,MAAM,MAAM,GACV,IAAI,CAAC,MAAM;gBACX,CAAC,MAAM,GAAG,CACR,UAAU,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,CAC9D,CAAC;gBACF,QAAQ,EAAE,MAAM,CAAC;YAEnB,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;gBACvC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YAED,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;YACvB,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,mCAAmC,CAAC,CAAC;gBAC7D,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;oBAC9C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,CAAC;gBAED,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBACxB,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC,CAAC;oBACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;wBACd,OAAO,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;wBACxC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBAClB,CAAC;oBACD,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;oBAC9C,MAAM,YAAY,GAAG,IAAI,kBAAS,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;oBAC1D,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,IAAI,CAA0B,aAAa,EAAE;wBAC/E,KAAK,EAAE,KAAK;wBACZ,QAAQ;qBACT,CAAC,CAAC;oBACH,KAAK,GAAG,QAAQ,CAAC,WAAW,CAAC;gBAC/B,CAAC;qBAAM,CAAC;oBACN,KAAK,GAAG,KAAK,CAAC;gBAChB,CAAC;YACH,CAAC;YAED,qBAAqB;YACrB,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;YACnC,MAAM,MAAM,GAAG,IAAI,kBAAS,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAChD,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,GAAG,CAAkC,UAAU,CAAC,CAAC;YAEzE,IAAA,8BAAgB,EAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YACpC,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,IAAI,IAAI,MAAM,GAAG,CAAC,CAAC;YACjE,OAAO,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC;QACtE,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,mBAAmB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YAChD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,KAAK,EAAE,CAAC;QACb,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/commands/login.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyBA,oDA4IC;AApKD,mDAAqC;AACrC,uCAAyB;AACzB,sDAA2F;AAC3F,0CAA0C;AAE1C;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAgB,oBAAoB,CAAC,OAAgB;IACnD,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,yEAAyE,CAAC;SACtF,MAAM,CAAC,iBAAiB,EAAE,wDAAwD,CAAC;SACnF,MAAM,CAAC,eAAe,EAAE,wCAAwC,CAAC;SACjE,MAAM,CAAC,iBAAiB,EAAE,+DAA+D,CAAC;SAC1F,MAAM,CAAC,uBAAuB,EAAE,sEAAsE,CAAC;SACvG,MAAM,CACL,oBAAoB,EACpB,8DAA8D,EAC9D,IAAI,CACL;SACA,MAAM,CACL,KAAK,EAAE,IAMN,EAAE,EAAE;QACH,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC;YAClC,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,CAAC,CAAS,EAAmB,EAAE,CACzC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QAEpD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAA,6BAAe,GAAE,CAAC;YAEnC,MAAM,MAAM,GACV,IAAI,CAAC,MAAM;gBACX,CAAC,MAAM,GAAG,CAAC,UAAU,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;gBAC1E,QAAQ,EAAE,MAAM,CAAC;YAEnB,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;gBACvC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YAED,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;YACvB,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;YAEvB,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;gBACrB,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,mCAAmC,CAAC,CAAC;gBAC7D,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;oBAC9C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,CAAC;gBACD,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;oBAAE,KAAK,GAAG,KAAK,CAAC;;oBAClC,KAAK,GAAG,KAAK,CAAC;YACrB,CAAC;YAED,qEAAqE;YACrE,IAAI,CAAC,KAAK,IAAI,KAAK,EAAE,CAAC;gBACpB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;gBAC5D,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,OAAO,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;oBACxC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,CAAC;gBAED,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;gBAC7B,MAAM,YAAY,GAAG,IAAI,kBAAS,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;gBAC1D,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,IAAI,CAGrC,aAAa,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAEvC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;oBAC1B,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;wBACzB,OAAO,CAAC,KAAK,CACX,kEAAkE;4BAChE,yEAAyE;4BACzE,oDAAoD,CACvD,CAAC;oBACJ,CAAC;yBAAM,CAAC;wBACN,OAAO,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;oBACrD,CAAC;oBACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,CAAC;gBAED,gDAAgD;gBAChD,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;gBACrE,MAAM,SAAS,GAAG,IAAI,kBAAS,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;gBACzE,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,IAAI,CAC9B,cAAc,EACd;wBACE,IAAI,EAAE,mBAAmB,EAAE,CAAC,QAAQ,EAAE,EAAE;wBACxC,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;wBACzB,aAAa,EAAE,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI;qBACpD,CACF,CAAC;oBACF,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;oBAClB,OAAO,CAAC,GAAG,CACT,mCAAmC,GAAG,CAAC,KAAK,IAAI;wBAC9C,GAAG,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,WAAW,OAAO,CAAC,CAAC,CAAC,WAAW,KAAK;wBACxE,+BAA+B,CAClC,CAAC;gBACJ,CAAC;gBAAC,OAAO,MAAW,EAAE,CAAC;oBACrB,gEAAgE;oBAChE,+DAA+D;oBAC/D,qDAAqD;oBACrD,KAAK,GAAG,QAAQ,CAAC,WAAW,CAAC;oBAC7B,OAAO,CAAC,IAAI,CACV,2CAA2C,MAAM,CAAC,OAAO,MAAM;wBAC7D,wEAAwE,CAC3E,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,sEAAsE;YACtE,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;YACnC,MAAM,MAAM,GAAG,IAAI,kBAAS,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,KAAM,EAAE,CAAC,CAAC;YACxD,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,GAAG,CAAkC,UAAU,CAAC,CAAC;YAEzE,IAAA,8BAAgB,EAAC,EAAE,MAAM,EAAE,KAAK,EAAE,KAAM,EAAE,CAAC,CAAC;YAC5C,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,IAAI,IAAI,MAAM,GAAG,CAAC,CAAC;YACjE,OAAO,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC;YACpE,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YAC7B,OAAO,CAAC,GAAG,CAAC,0EAA0E,CAAC,CAAC;YACxF,OAAO,CAAC,GAAG,CAAC,gEAAgE,CAAC,CAAC;QAChF,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,mBAAmB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YAChD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,KAAK,EAAE,CAAC;QACb,CAAC;IACH,CAAC,CACF,CAAC;IAEJ,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,6CAA6C,CAAC;SAC1D,MAAM,CAAC,GAAG,EAAE;QACX,IAAA,8BAAgB,GAAE,CAAC;QACnB,OAAO,CAAC,GAAG,CAAC,iHAAiH,CAAC,CAAC;IACjI,CAAC,CAAC,CAAC;AACP,CAAC"}

package/lib/commands/ota-keys.d.ts

@@ -0,0 +1,11 @@
+import { Command } from 'commander';
+export declare function registerOtaKeysCommand(ota: Command): void;
+/**
+ * Sign a bundle hash with the locally-held private key.
+ *
+ * Returns null when no key is present — publishing without signing stays valid
+ * for apps that have not adopted it, and `ota publish` reports which happened
+ * rather than failing.
+ */
+export declare function signBundleHash(sha256Hex: string, keyDir?: string): string | null;
+//# sourceMappingURL=ota-keys.d.ts.map

package/lib/commands/ota-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ota-keys.d.ts","sourceRoot":"","sources":["../../src/commands/ota-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAuCpC,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CA0JzD;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,GACd,MAAM,GAAG,IAAI,CAcf"}

package/lib/commands/ota-keys.js

@@ -0,0 +1,199 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerOtaKeysCommand = registerOtaKeysCommand;
+exports.signBundleHash = signBundleHash;
+const crypto = __importStar(require("crypto"));
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const credentials_1 = require("../utils/credentials");
+const client_1 = require("../api/client");
+/**
+ * Bundle signing keys (OTA-03).
+ *
+ * The security model, which is the reason this command exists at all: the
+ * private key is generated on the developer's machine and NEVER leaves it. Only
+ * the public half is uploaded. A server that cannot sign cannot forge a bundle,
+ * so a compromise of ScaleBun's infrastructure still cannot push code to a
+ * customer's users.
+ *
+ * `scalebun ota generate-key-pair` was referenced in the product documentation
+ * before it existed — the docs described verification the SDK never performed
+ * and a command the CLI never registered. This implements it.
+ */
+const KEY_DIR = '.scalebun';
+const PRIVATE_KEY_FILE = 'ota-signing-key.pem';
+/** Hex-encoded raw 32-byte ed25519 public key from a Node KeyObject. */
+function rawPublicKeyHex(publicKey) {
+    // SPKI for ed25519 is a fixed 12-byte header followed by the 32-byte key.
+    const spki = publicKey.export({ type: 'spki', format: 'der' });
+    return spki.subarray(spki.length - 32).toString('hex');
+}
+function registerOtaKeysCommand(ota) {
+    ota
+        .command('generate-key-pair')
+        .description('Generate an ed25519 signing keypair locally and register the public half')
+        .option('--app-id <id>', 'Register the public key against this app')
+        .option('--name <name>', 'Label for the key in the dashboard')
+        .option('--out <dir>', `Directory for the private key (default: ./${KEY_DIR})`)
+        .option('--force', 'Overwrite an existing private key')
+        .action(async (opts) => {
+        const outDir = path.resolve(opts.out ?? KEY_DIR);
+        const privatePath = path.join(outDir, PRIVATE_KEY_FILE);
+        if (fs.existsSync(privatePath) && !opts.force) {
+            console.error(`❌ A signing key already exists at ${privatePath}.\n` +
+                `   Overwriting it means every bundle signed with the old key can no longer be\n` +
+                `   verified by apps carrying the old public key. Pass --force if that is intended.`);
+            process.exit(1);
+        }
+        const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519');
+        fs.mkdirSync(outDir, { recursive: true });
+        fs.writeFileSync(privatePath, privateKey.export({ type: 'pkcs8', format: 'pem' }), 
+        // Owner read/write only. Irrelevant on Windows, correct everywhere else.
+        { mode: 0o600 });
+        const publicHex = rawPublicKeyHex(publicKey);
+        console.log(`\n🔑 ed25519 signing keypair generated.\n`);
+        console.log(`  Private key : ${privatePath}`);
+        console.log(`                NEVER commit this. Add ${KEY_DIR}/ to .gitignore.`);
+        console.log(`  Public key  : ${publicHex}\n`);
+        if (opts.appId) {
+            const creds = (0, credentials_1.readCredentials)();
+            if (!creds) {
+                console.error('❌ Not logged in. Run `scalebun login` first.');
+                console.error('   The keypair was still written; register it later with:');
+                console.error(`   scalebun ota register-key --app-id <id> --public-key ${publicHex}`);
+                process.exit(1);
+            }
+            const client = new client_1.ApiClient(creds);
+            try {
+                await client.post(`/saas/apps/${opts.appId}/ota/signing-keys`, {
+                    publicKey: publicHex,
+                    name: opts.name ?? `CLI ${new Date().toISOString().slice(0, 10)}`,
+                });
+                console.log('✅ Public key registered with ScaleBun.\n');
+            }
+            catch (err) {
+                console.error(`❌ Failed to register public key: ${err.message}`);
+                console.error(`   Retry with: scalebun ota register-key --app-id ${opts.appId} --public-key ${publicHex}\n`);
+                process.exit(1);
+            }
+        }
+        else {
+            console.log('ℹ️  Pass --app-id to register the public key automatically.\n');
+        }
+        console.log('Next: embed the PUBLIC key in your app and enforce it at init:\n');
+        console.log('  ScaleBun.init({');
+        console.log('    // …');
+        console.log('    ota: {');
+        console.log(`      publicSigningKey: '${publicHex}',`);
+        console.log('      verifySignature: myEd25519Verifier,');
+        console.log('    },');
+        console.log('  })\n');
+    });
+    ota
+        .command('register-key')
+        .description('Register an existing ed25519 public key with an app')
+        .requiredOption('--app-id <id>', 'Scalebun app ID')
+        .requiredOption('--public-key <hex>', 'ed25519 public key (hex or base64)')
+        .option('--name <name>', 'Label for the key in the dashboard')
+        .action(async (opts) => {
+        const creds = (0, credentials_1.readCredentials)();
+        if (!creds) {
+            console.error('❌ Not logged in. Run `scalebun login` first.');
+            process.exit(1);
+        }
+        const client = new client_1.ApiClient(creds);
+        try {
+            await client.post(`/saas/apps/${opts.appId}/ota/signing-keys`, {
+                publicKey: opts.publicKey,
+                name: opts.name ?? 'CLI',
+            });
+            console.log('✅ Public key registered.\n');
+        }
+        catch (err) {
+            console.error(`❌ Failed to register public key: ${err.message}`);
+            process.exit(1);
+        }
+    });
+    ota
+        .command('keys')
+        .description('List signing keys registered for an app')
+        .requiredOption('--app-id <id>', 'Scalebun app ID')
+        .action(async (opts) => {
+        const creds = (0, credentials_1.readCredentials)();
+        if (!creds) {
+            console.error('❌ Not logged in. Run `scalebun login` first.');
+            process.exit(1);
+        }
+        const client = new client_1.ApiClient(creds);
+        try {
+            const keys = await client.get(`/saas/apps/${opts.appId}/ota/signing-keys`);
+            console.log(`\n🔑 Signing keys for app ${opts.appId}:\n`);
+            if (!keys?.length) {
+                console.log('  (none — run `scalebun ota generate-key-pair --app-id <id>`)\n');
+                return;
+            }
+            for (const k of keys) {
+                const state = k.revokedAt ? 'REVOKED' : 'active';
+                console.log(`  • ${(k.name ?? 'unnamed').padEnd(20)} ${state.padEnd(8)} ${k.publicKey.slice(0, 16)}…`);
+            }
+            console.log('');
+        }
+        catch (err) {
+            console.error(`❌ Failed to list keys: ${err.message}`);
+            process.exit(1);
+        }
+    });
+}
+/**
+ * Sign a bundle hash with the locally-held private key.
+ *
+ * Returns null when no key is present — publishing without signing stays valid
+ * for apps that have not adopted it, and `ota publish` reports which happened
+ * rather than failing.
+ */
+function signBundleHash(sha256Hex, keyDir) {
+    const privatePath = path.join(path.resolve(keyDir ?? KEY_DIR), PRIVATE_KEY_FILE);
+    if (!fs.existsSync(privatePath))
+        return null;
+    const privateKey = crypto.createPrivateKey(fs.readFileSync(privatePath));
+    // The signature covers the bundle's SHA-256, which the device already has from
+    // the check response and re-computes from the downloaded bytes. Signing the
+    // hash rather than the bundle keeps the CLI from re-reading 20 MB, and gives
+    // the device one value to verify that transitively covers the whole artifact.
+    const signature = crypto.sign(null, Buffer.from(sha256Hex, 'hex'), privateKey);
+    return signature.toString('hex');
+}
+//# sourceMappingURL=ota-keys.js.map

package/lib/commands/ota-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ota-keys.js","sourceRoot":"","sources":["../../src/commands/ota-keys.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuCA,wDA0JC;AASD,wCAiBC;AA1ND,+CAAiC;AACjC,uCAAyB;AACzB,2CAA6B;AAC7B,sDAAuD;AACvD,0CAA0C;AAE1C;;;;;;;;;;;;GAYG;AAEH,MAAM,OAAO,GAAG,WAAW,CAAC;AAC5B,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;AAU/C,wEAAwE;AACxE,SAAS,eAAe,CAAC,SAA2B;IAClD,0EAA0E;IAC1E,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAW,CAAC;IACzE,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,SAAgB,sBAAsB,CAAC,GAAY;IACjD,GAAG;SACA,OAAO,CAAC,mBAAmB,CAAC;SAC5B,WAAW,CACV,0EAA0E,CAC3E;SACA,MAAM,CAAC,eAAe,EAAE,0CAA0C,CAAC;SACnE,MAAM,CAAC,eAAe,EAAE,oCAAoC,CAAC;SAC7D,MAAM,CACL,aAAa,EACb,6CAA6C,OAAO,GAAG,CACxD;SACA,MAAM,CAAC,SAAS,EAAE,mCAAmC,CAAC;SACtD,MAAM,CACL,KAAK,EAAE,IAKN,EAAE,EAAE;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,CAAC;QACjD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QAExD,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9C,OAAO,CAAC,KAAK,CACX,qCAAqC,WAAW,KAAK;gBACnD,iFAAiF;gBACjF,oFAAoF,CACvF,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAExE,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,EAAE,CAAC,aAAa,CACd,WAAW,EACX,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAW;QAC7D,yEAAyE;QACzE,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;QAEF,MAAM,SAAS,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;QAE7C,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;QACzD,OAAO,CAAC,GAAG,CAAC,mBAAmB,WAAW,EAAE,CAAC,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,0CAA0C,OAAO,kBAAkB,CAAC,CAAC;QACjF,OAAO,CAAC,GAAG,CAAC,mBAAmB,SAAS,IAAI,CAAC,CAAC;QAE9C,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,KAAK,GAAG,IAAA,6BAAe,GAAE,CAAC;YAChC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;gBAC9D,OAAO,CAAC,KAAK,CACX,2DAA2D,CAC5D,CAAC;gBACF,OAAO,CAAC,KAAK,CACX,2DAA2D,SAAS,EAAE,CACvE,CAAC;gBACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,kBAAS,CAAC,KAAK,CAAC,CAAC;YACpC,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,KAAK,mBAAmB,EAAE;oBAC7D,SAAS,EAAE,SAAS;oBACpB,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;iBAClE,CAAC,CAAC;gBACH,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;YAC1D,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,OAAO,CAAC,KAAK,CAAC,oCAAoC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBACjE,OAAO,CAAC,KAAK,CACX,qDAAqD,IAAI,CAAC,KAAK,iBAAiB,SAAS,IAAI,CAC9F,CAAC;gBACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CACT,+DAA+D,CAChE,CAAC;QACJ,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC;QAChF,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QACjC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,4BAA4B,SAAS,IAAI,CAAC,CAAC;QACvD,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;QACzD,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACxB,CAAC,CACF,CAAC;IAEJ,GAAG;SACA,OAAO,CAAC,cAAc,CAAC;SACvB,WAAW,CAAC,qDAAqD,CAAC;SAClE,cAAc,CAAC,eAAe,EAAE,iBAAiB,CAAC;SAClD,cAAc,CAAC,oBAAoB,EAAE,oCAAoC,CAAC;SAC1E,MAAM,CAAC,eAAe,EAAE,oCAAoC,CAAC;SAC7D,MAAM,CACL,KAAK,EAAE,IAAyD,EAAE,EAAE;QAClE,MAAM,KAAK,GAAG,IAAA,6BAAe,GAAE,CAAC;QAChC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;YAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,kBAAS,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,KAAK,mBAAmB,EAAE;gBAC7D,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,KAAK;aACzB,CAAC,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,oCAAoC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACjE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CACF,CAAC;IAEJ,GAAG;SACA,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,yCAAyC,CAAC;SACtD,cAAc,CAAC,eAAe,EAAE,iBAAiB,CAAC;SAClD,MAAM,CAAC,KAAK,EAAE,IAAuB,EAAE,EAAE;QACxC,MAAM,KAAK,GAAG,IAAA,6BAAe,GAAE,CAAC;QAChC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;YAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,kBAAS,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAC3B,cAAc,IAAI,CAAC,KAAK,mBAAmB,CAC5C,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,6BAA6B,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC;YAC1D,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;gBAClB,OAAO,CAAC,GAAG,CACT,iEAAiE,CAClE,CAAC;gBACF,OAAO;YACT,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;gBACrB,MAAM,KAAK,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;gBACjD,OAAO,CAAC,GAAG,CACT,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,SAAS,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAC1F,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,0BAA0B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACvD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,cAAc,CAC5B,SAAiB,EACjB,MAAe;IAEf,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAC3B,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,EAC/B,gBAAgB,CACjB,CAAC;IACF,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IAE7C,MAAM,UAAU,GAAG,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC;IACzE,+EAA+E;IAC/E,4EAA4E;IAC5E,6EAA6E;IAC7E,8EAA8E;IAC9E,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,UAAU,CAAC,CAAC;IAC/E,OAAO,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC"}

package/lib/commands/ota-publish.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ota-publish.d.ts","sourceRoot":"","sources":["../../src/commands/ota-publish.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAsBpC,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,iBAAiB,GAAG,gBAAgB,CAAC;AAE7E;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAwN5D"}
+{"version":3,"file":"ota-publish.d.ts","sourceRoot":"","sources":["../../src/commands/ota-publish.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA6BpC,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,iBAAiB,GAAG,gBAAgB,CAAC;AAE7E;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAuW5D"}