@scalebun/cli 1.0.0 → 1.4.0

package/lib/commands/doctor.js

@@ -0,0 +1,252 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerDoctorCommand = registerDoctorCommand;
+exports.runDoctor = runDoctor;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const credentials_1 = require("../utils/credentials");
+const client_1 = require("../api/client");
+const bundle_1 = require("../utils/bundle");
+const findings = [];
+function report(level, title, detail) {
+    findings.push({ level, title, detail });
+    const icon = level === 'ok' ? '✅' : level === 'warn' ? '⚠️ ' : '❌';
+    console.log(`${icon} ${title}`);
+    if (detail)
+        console.log(`     ${detail.split('\n').join('\n     ')}`);
+}
+/** Find the first file matching `names` under `dir`, skipping heavy folders. */
+function findFile(dir, names, maxDepth = 6) {
+    if (maxDepth < 0 || !fs.existsSync(dir))
+        return null;
+    let entries;
+    try {
+        entries = fs.readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return null;
+    }
+    for (const e of entries) {
+        if (e.isFile() && names.includes(e.name))
+            return path.join(dir, e.name);
+    }
+    for (const e of entries) {
+        if (!e.isDirectory())
+            continue;
+        if (['node_modules', 'Pods', 'build', '.git', '.gradle'].includes(e.name))
+            continue;
+        const hit = findFile(path.join(dir, e.name), names, maxDepth - 1);
+        if (hit)
+            return hit;
+    }
+    return null;
+}
+function parseMinor(version) {
+    if (!version)
+        return null;
+    const m = /^(\d+)\.(\d+)/.exec(version);
+    return m ? [Number(m[1]), Number(m[2])] : null;
+}
+function registerDoctorCommand(program) {
+    program
+        .command('doctor')
+        .description('Check that this project is correctly set up for OTA updates')
+        .action(() => runDoctor());
+}
+/**
+ * All doctor checks as a reusable step (`quickstart` runs it inline).
+ * Same contract as the command: exits the process on a blocking failure.
+ */
+async function runDoctor() {
+    findings.length = 0; // reusable across calls in one process
+    {
+        const cwd = process.cwd();
+        console.log('\nScalebun doctor\n');
+        // ── 1. Credentials ─────────────────────────────────────────────────────
+        const creds = (0, credentials_1.readCredentials)();
+        if (!creds) {
+            report('fail', 'Not logged in', 'Run `scalebun login`, or set SCALEBUN_TOKEN + SCALEBUN_API_URL in CI.');
+        }
+        else {
+            const source = process.env.SCALEBUN_TOKEN ? 'environment variables' : '~/.scalebun/credentials.json';
+            if (creds.token.startsWith('scalebun_pat_')) {
+                report('ok', `Credentials found (${source}, durable access token)`);
+            }
+            else {
+                report('warn', `Credentials found (${source}) but the token is a session JWT`, 'Session tokens expire in ~15 minutes. Run `scalebun login` again — it now mints\n' +
+                    'a durable access token automatically.');
+            }
+            try {
+                const me = await new client_1.ApiClient(creds).get('/auth/me');
+                report('ok', `Token valid — authenticated as ${me.email}`);
+            }
+            catch (err) {
+                report('fail', 'Stored token no longer works', err.message);
+            }
+        }
+        // ── 2. Project shape ───────────────────────────────────────────────────
+        const rnVersion = (0, bundle_1.detectProjectRnVersion)(cwd);
+        const expo = (0, bundle_1.isExpoProject)(cwd);
+        if (!rnVersion) {
+            report('fail', 'React Native not found in node_modules', 'Run this from your app root, after installing dependencies.');
+        }
+        else {
+            report('ok', `React Native ${rnVersion} (${expo ? 'Expo' : 'bare'} project)`);
+        }
+        const hermesc = (0, bundle_1.resolveHermesc)(cwd);
+        if (hermesc) {
+            report('ok', 'hermesc found — `--hermes` publishes will compile bytecode');
+        }
+        else if (rnVersion) {
+            report('warn', 'hermesc not found under node_modules/react-native/sdks/hermesc', 'Publishes fall back to plain JS: they work, but cold start is ~20-30% slower\n' +
+                'and Hermes-bytecode runtime gating cannot protect these bundles.');
+        }
+        // ── 3. Android wiring ──────────────────────────────────────────────────
+        const gradleProps = path.join(cwd, 'android', 'gradle.properties');
+        const mainApp = findFile(path.join(cwd, 'android', 'app', 'src', 'main'), [
+            'MainApplication.kt',
+            'MainApplication.java',
+        ]);
+        const minor = parseMinor(rnVersion);
+        if (!fs.existsSync(path.join(cwd, 'android'))) {
+            report('warn', 'No android/ directory — skipping Android checks');
+        }
+        else {
+            const newArch = fs.existsSync(gradleProps) &&
+                /newArchEnabled\s*=\s*true/.test(fs.readFileSync(gradleProps, 'utf-8'));
+            // The dead zone: bridgeless ignored getJSBundleFile() until RN 0.76.1.
+            // An update installs, reports INSTALLED, and the app keeps running the
+            // APK asset — the exact failure that killed CodePush on modern RN.
+            if (newArch && minor && (minor[1] === 74 || minor[1] === 75) && minor[0] === 0) {
+                report('fail', `New Architecture is ON with React Native ${rnVersion} — OTA updates CANNOT LOAD`, 'Bridgeless did not honour getJSBundleFile() until RN 0.76.1. Updates will\n' +
+                    'install and silently never run (the SDK detects this and disables itself).\n' +
+                    'Fix: upgrade to RN >= 0.76.1, or set newArchEnabled=false.');
+            }
+            else if (newArch && rnVersion?.startsWith('0.76.0')) {
+                report('fail', 'React Native 0.76.0 exactly — one patch release short of the bridgeless fix', 'Upgrade to 0.76.1 or later.');
+            }
+            if (!mainApp) {
+                report('warn', 'MainApplication.kt/.java not found — cannot verify Android wiring');
+            }
+            else {
+                const src = fs.readFileSync(mainApp, 'utf-8');
+                const wired = src.includes('ScaleBunOtaModule.getJSBundleFile');
+                const rel = path.relative(cwd, mainApp);
+                if (!wired) {
+                    report('fail', `Android bundle resolution is NOT wired (${rel})`, 'Without it, updates download and install but the app keeps running the bundle\n' +
+                        'baked into the APK — every metric reports success and nothing changes.\n' +
+                        (minor && (minor[0] > 0 || minor[1] >= 82)
+                            ? 'RN >= 0.82 (ReactNativeHost was removed) — pass the path to the host:\n' +
+                                '  override val reactHost: ReactHost by lazy {\n' +
+                                '    getDefaultReactHost(context = applicationContext,\n' +
+                                '      packageList = PackageList(this).packages,\n' +
+                                '      jsBundleFilePath = ScaleBunOtaModule.getJSBundleFile(applicationContext))\n' +
+                                '  }'
+                            : 'Add inside your ReactNativeHost:\n' +
+                                '  override fun getJSBundleFile(): String? =\n' +
+                                '    ScaleBunOtaModule.getJSBundleFile(this@MainApplication) ?: super.getJSBundleFile()'));
+                }
+                else if (minor &&
+                    (minor[0] > 0 || minor[1] >= 82) &&
+                    !src.includes('jsBundleFilePath')) {
+                    report('fail', `RN ${rnVersion} uses the removed ReactNativeHost override (${rel})`, 'RN 0.82 deleted ReactNativeHost — the getJSBundleFile() override no longer\n' +
+                        'compiles or runs. Pass jsBundleFilePath to getDefaultReactHost(...) instead.');
+                }
+                else {
+                    report('ok', `Android bundle resolution wired (${rel})`);
+                }
+            }
+        }
+        // ── 4. iOS wiring ──────────────────────────────────────────────────────
+        if (!fs.existsSync(path.join(cwd, 'ios'))) {
+            report('warn', 'No ios/ directory — skipping iOS checks');
+        }
+        else {
+            const appDelegate = findFile(path.join(cwd, 'ios'), [
+                'AppDelegate.swift',
+                'AppDelegate.mm',
+                'AppDelegate.m',
+            ]);
+            if (!appDelegate) {
+                report('warn', 'AppDelegate not found — cannot verify iOS wiring');
+            }
+            else {
+                const src = fs.readFileSync(appDelegate, 'utf-8');
+                const rel = path.relative(cwd, appDelegate);
+                if (src.includes('ScaleBunOtaModule.getBundleURL') || src.includes('getBundleURL()')) {
+                    report('ok', `iOS bundle resolution wired (${rel})`);
+                }
+                else {
+                    report('fail', `iOS bundle resolution is NOT wired (${rel})`, 'Override bundleURL to resolve the OTA slot:\n' +
+                        '  override func bundleURL() -> URL? {\n' +
+                        '    #if DEBUG\n' +
+                        '      RCTBundleURLProvider.sharedSettings().jsBundleURL(forBundleRoot: "index")\n' +
+                        '    #else\n' +
+                        '      ScaleBunOtaModule.getBundleURL()\n' +
+                        '    #endif\n' +
+                        '  }');
+                }
+            }
+        }
+        // ── 5. Signing ─────────────────────────────────────────────────────────
+        const keyPath = path.join(cwd, '.scalebun', 'ota-signing-key.pem');
+        if (fs.existsSync(keyPath)) {
+            report('ok', 'ed25519 signing key present — publishes are signed');
+            const gitignore = path.join(cwd, '.gitignore');
+            const ignored = fs.existsSync(gitignore) && /(^|\n)\s*\.scalebun\/?\s*(\n|$)/.test(fs.readFileSync(gitignore, 'utf-8'));
+            if (!ignored) {
+                report('fail', '.scalebun/ is NOT in .gitignore — the private signing key can be committed', 'Anyone with this key can sign bundles your users will trust.\n' +
+                    'Fix: echo ".scalebun/" >> .gitignore  (and rotate the key if it was ever pushed)');
+            }
+        }
+        else {
+            report('warn', 'No signing key — bundles ship on SHA-256 integrity alone', 'Integrity proves bytes arrived intact; only a signature proves they came from you.\n' +
+                'Set up: scalebun ota generate-key-pair --app-id <id> --name "release key"');
+        }
+        // ── Summary ────────────────────────────────────────────────────────────
+        const fails = findings.filter((f) => f.level === 'fail').length;
+        const warns = findings.filter((f) => f.level === 'warn').length;
+        console.log('');
+        if (fails > 0) {
+            console.log(`${fails} blocking issue(s), ${warns} warning(s). Fix the ❌ items before shipping OTA.`);
+            process.exit(1);
+        }
+        console.log(warns > 0
+            ? `No blocking issues (${warns} warning(s)). You can ship OTA updates.`
+            : 'All checks passed. You can ship OTA updates.');
+    }
+}
+//# sourceMappingURL=doctor.js.map

package/lib/commands/doctor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../../src/commands/doctor.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6DA,sDAKC;AAMD,8BA6MC;AArRD,uCAAyB;AACzB,2CAA6B;AAE7B,sDAAuD;AACvD,0CAA0C;AAC1C,4CAAwF;AAoBxF,MAAM,QAAQ,GAAc,EAAE,CAAC;AAE/B,SAAS,MAAM,CAAC,KAAY,EAAE,KAAa,EAAE,MAAe;IAC1D,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC;IACnE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC;IAChC,IAAI,MAAM;QAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,gFAAgF;AAChF,SAAS,QAAQ,CAAC,GAAW,EAAE,KAAe,EAAE,QAAQ,GAAG,CAAC;IAC1D,IAAI,QAAQ,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,IAAI,OAAoB,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC1E,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE;YAAE,SAAS;QAC/B,IAAI,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,SAAS;QACpF,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC;QAClE,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC;IACtB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,UAAU,CAAC,OAAsB;IACxC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC;AAED,SAAgB,qBAAqB,CAAC,OAAgB;IACpD,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,6DAA6D,CAAC;SAC1E,MAAM,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;AAC/B,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,SAAS;IAC7B,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,uCAAuC;IAC5D,CAAC;QACG,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;QAEnC,0EAA0E;QAC1E,MAAM,KAAK,GAAG,IAAA,6BAAe,GAAE,CAAC;QAChC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,CACJ,MAAM,EACN,eAAe,EACf,uEAAuE,CACxE,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,8BAA8B,CAAC;YACrG,IAAI,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;gBAC5C,MAAM,CAAC,IAAI,EAAE,sBAAsB,MAAM,yBAAyB,CAAC,CAAC;YACtE,CAAC;iBAAM,CAAC;gBACN,MAAM,CACJ,MAAM,EACN,sBAAsB,MAAM,kCAAkC,EAC9D,mFAAmF;oBACjF,uCAAuC,CAC1C,CAAC;YACJ,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,EAAE,GAAG,MAAM,IAAI,kBAAS,CAAC,KAAK,CAAC,CAAC,GAAG,CAAoB,UAAU,CAAC,CAAC;gBACzE,MAAM,CAAC,IAAI,EAAE,kCAAkC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;YAC7D,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,MAAM,CAAC,MAAM,EAAE,8BAA8B,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;QAED,0EAA0E;QAC1E,MAAM,SAAS,GAAG,IAAA,+BAAsB,EAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,IAAA,sBAAa,EAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,CACJ,MAAM,EACN,wCAAwC,EACxC,6DAA6D,CAC9D,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,EAAE,gBAAgB,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,CAAC;QAChF,CAAC;QAED,MAAM,OAAO,GAAG,IAAA,uBAAc,EAAC,GAAG,CAAC,CAAC;QACpC,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,CAAC,IAAI,EAAE,4DAA4D,CAAC,CAAC;QAC7E,CAAC;aAAM,IAAI,SAAS,EAAE,CAAC;YACrB,MAAM,CACJ,MAAM,EACN,gEAAgE,EAChE,gFAAgF;gBAC9E,kEAAkE,CACrE,CAAC;QACJ,CAAC;QAED,0EAA0E;QAC1E,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC;QACnE,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE;YACxE,oBAAoB;YACpB,sBAAsB;SACvB,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;QAEpC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;YAC9C,MAAM,CAAC,MAAM,EAAE,iDAAiD,CAAC,CAAC;QACpE,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GACX,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC;gBAC1B,2BAA2B,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;YAE1E,uEAAuE;YACvE,uEAAuE;YACvE,mEAAmE;YACnE,IAAI,OAAO,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/E,MAAM,CACJ,MAAM,EACN,4CAA4C,SAAS,4BAA4B,EACjF,6EAA6E;oBAC3E,8EAA8E;oBAC9E,4DAA4D,CAC/D,CAAC;YACJ,CAAC;iBAAM,IAAI,OAAO,IAAI,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACtD,MAAM,CACJ,MAAM,EACN,6EAA6E,EAC7E,6BAA6B,CAC9B,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,CAAC,MAAM,EAAE,mEAAmE,CAAC,CAAC;YACtF,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC9C,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,mCAAmC,CAAC,CAAC;gBAChE,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBAExC,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,MAAM,CACJ,MAAM,EACN,2CAA2C,GAAG,GAAG,EACjD,iFAAiF;wBAC/E,0EAA0E;wBAC1E,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;4BACxC,CAAC,CAAC,yEAAyE;gCACzE,iDAAiD;gCACjD,yDAAyD;gCACzD,mDAAmD;gCACnD,mFAAmF;gCACnF,KAAK;4BACP,CAAC,CAAC,oCAAoC;gCACpC,+CAA+C;gCAC/C,wFAAwF,CAAC,CAChG,CAAC;gBACJ,CAAC;qBAAM,IACL,KAAK;oBACL,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;oBAChC,CAAC,GAAG,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EACjC,CAAC;oBACD,MAAM,CACJ,MAAM,EACN,MAAM,SAAS,+CAA+C,GAAG,GAAG,EACpE,8EAA8E;wBAC5E,8EAA8E,CACjF,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,IAAI,EAAE,oCAAoC,GAAG,GAAG,CAAC,CAAC;gBAC3D,CAAC;YACH,CAAC;QACH,CAAC;QAED,0EAA0E;QAC1E,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YAC1C,MAAM,CAAC,MAAM,EAAE,yCAAyC,CAAC,CAAC;QAC5D,CAAC;aAAM,CAAC;YACN,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE;gBAClD,mBAAmB;gBACnB,gBAAgB;gBAChB,eAAe;aAChB,CAAC,CAAC;YACH,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,MAAM,CAAC,MAAM,EAAE,kDAAkD,CAAC,CAAC;YACrE,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;gBAClD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;gBAC5C,IAAI,GAAG,CAAC,QAAQ,CAAC,gCAAgC,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;oBACrF,MAAM,CAAC,IAAI,EAAE,gCAAgC,GAAG,GAAG,CAAC,CAAC;gBACvD,CAAC;qBAAM,CAAC;oBACN,MAAM,CACJ,MAAM,EACN,uCAAuC,GAAG,GAAG,EAC7C,+CAA+C;wBAC7C,yCAAyC;wBACzC,iBAAiB;wBACjB,mFAAmF;wBACnF,aAAa;wBACb,0CAA0C;wBAC1C,cAAc;wBACd,KAAK,CACR,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,0EAA0E;QAC1E,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,qBAAqB,CAAC,CAAC;QACnE,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,MAAM,CAAC,IAAI,EAAE,oDAAoD,CAAC,CAAC;YACnE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YAC/C,MAAM,OAAO,GACX,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,iCAAiC,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;YAC1G,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,CACJ,MAAM,EACN,4EAA4E,EAC5E,gEAAgE;oBAC9D,kFAAkF,CACrF,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,CACJ,MAAM,EACN,0DAA0D,EAC1D,sFAAsF;gBACpF,2EAA2E,CAC9E,CAAC;QACJ,CAAC;QAED,0EAA0E;QAC1E,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;QAChE,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;QAChE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,uBAAuB,KAAK,mDAAmD,CAAC,CAAC;YACrG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,CAAC,GAAG,CACT,KAAK,GAAG,CAAC;YACP,CAAC,CAAC,uBAAuB,KAAK,yCAAyC;YACvE,CAAC,CAAC,8CAA8C,CACnD,CAAC;IACN,CAAC;AACH,CAAC"}

package/lib/commands/login.d.ts

@@ -1,10 +1,34 @@
 import { Command } from 'commander';
 /**
- * `scalebun login` — authenticate via Personal Access Token (PAT).
+ * `scalebun login` — authenticate and store a DURABLE credential.
  *
- * 1. Prompt for backend URL and PAT
- * 2. Validate by calling GET /auth/me
- * 3. Store in ~/.scalebun/credentials.json
+ * ── Why the PAT exchange matters ────────────────────────────────────────────
+ *
+ * The backend's session JWTs expire in ~15 minutes. This command used to store
+ * that JWT directly, so every publish that started more than a few minutes
+ * after login failed with an opaque 401 — hit live during the first real
+ * device-test run. Meanwhile the backend has had a full personal-access-token
+ * system all along (`POST /auth/tokens`, hashed at rest, scoped, revocable)
+ * that the CLI never used.
+ *
+ * Now: email/password buys a short-lived JWT, which is immediately spent on
+ * minting a PAT named after this machine. The PAT is what gets stored — it
+ * survives for `--expires-days` (default 90) and is revocable from the
+ * dashboard (Settings → Access Tokens) if this machine is ever lost.
+ *
+ * Pasting an existing `scalebun_pat_…` still works and skips the exchange.
  */
 export declare function registerLoginCommand(program: Command): void;
+export interface LoginOptions {
+    apiUrl?: string;
+    token?: string;
+    email?: string;
+    password?: string;
+    expiresDays: string;
+}
+/**
+ * The full interactive login flow as a reusable step (`quickstart` runs it
+ * inline when no credentials are stored). Exits the process on failure.
+ */
+export declare function runLogin(opts: LoginOptions): Promise<void>;
 //# sourceMappingURL=login.d.ts.map

package/lib/commands/login.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/commands/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKpC;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAuE3D"}
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/commands/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAOpC;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAsB3D;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,wBAAsB,QAAQ,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA8HhE"}

package/lib/commands/login.js

@@ -34,77 +34,158 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerLoginCommand = registerLoginCommand;
+exports.runLogin = runLogin;
 const readline = __importStar(require("readline"));
+const os = __importStar(require("os"));
 const credentials_1 = require("../utils/credentials");
 const client_1 = require("../api/client");
+const transportSecurity_1 = require("../utils/transportSecurity");
 /**
- * `scalebun login` — authenticate via Personal Access Token (PAT).
+ * `scalebun login` — authenticate and store a DURABLE credential.
  *
- * 1. Prompt for backend URL and PAT
- * 2. Validate by calling GET /auth/me
- * 3. Store in ~/.scalebun/credentials.json
+ * ── Why the PAT exchange matters ────────────────────────────────────────────
+ *
+ * The backend's session JWTs expire in ~15 minutes. This command used to store
+ * that JWT directly, so every publish that started more than a few minutes
+ * after login failed with an opaque 401 — hit live during the first real
+ * device-test run. Meanwhile the backend has had a full personal-access-token
+ * system all along (`POST /auth/tokens`, hashed at rest, scoped, revocable)
+ * that the CLI never used.
+ *
+ * Now: email/password buys a short-lived JWT, which is immediately spent on
+ * minting a PAT named after this machine. The PAT is what gets stored — it
+ * survives for `--expires-days` (default 90) and is revocable from the
+ * dashboard (Settings → Access Tokens) if this machine is ever lost.
+ *
+ * Pasting an existing `scalebun_pat_…` still works and skips the exchange.
  */
 function registerLoginCommand(program) {
     program
         .command('login')
-        .description('Authenticate with your Scalebun backend using a PAT')
+        .description('Authenticate with your Scalebun backend (stores a durable access token)')
         .option('--api-url <url>', 'Backend API URL (e.g. https://api.scalebun.com/api/v1)')
         .option('--token <pat>', 'Personal access token (scalebun_pat_…)')
-        .action(async (opts) => {
-        const rl = readline.createInterface({
-            input: process.stdin,
-            output: process.stdout,
-        });
-        const ask = (q) => new Promise((resolve) => rl.question(q, resolve));
-        try {
-            const existing = (0, credentials_1.readCredentials)();
-            const apiUrl = opts.apiUrl ||
-                (await ask(`API URL${existing?.apiUrl ? ` [${existing.apiUrl}]` : ''}: `)) ||
-                existing?.apiUrl;
-            if (!apiUrl) {
-                console.error('❌ API URL is required');
-                process.exit(1);
-            }
-            let token = opts.token;
-            if (!token) {
-                const input = await ask('Email or Token (scalebun_pat_…): ');
-                if (!input) {
-                    console.error('❌ Email or Token is required');
+        .option('--email <email>', 'Account email (prompts for password unless --password is set)')
+        .option('--password <password>', 'Account password (prefer the prompt — flags leak into shell history)')
+        .option('--expires-days <n>', 'Lifetime of the minted CLI token in days (0 = never expires)', '90')
+        .action((opts) => runLogin(opts));
+    program
+        .command('logout')
+        .description('Remove stored credentials from this machine')
+        .action(() => {
+        (0, credentials_1.clearCredentials)();
+        console.log('✅ Logged out. (The token still exists server-side — revoke it in the dashboard if this machine is compromised.)');
+    });
+}
+/**
+ * The full interactive login flow as a reusable step (`quickstart` runs it
+ * inline when no credentials are stored). Exits the process on failure.
+ */
+async function runLogin(opts) {
+    {
+        {
+            const rl = readline.createInterface({
+                input: process.stdin,
+                output: process.stdout,
+            });
+            const ask = (q) => new Promise((resolve) => rl.question(q, resolve));
+            try {
+                const existing = (0, credentials_1.readCredentials)();
+                const apiUrl = opts.apiUrl ||
+                    (await ask(`API URL${existing?.apiUrl ? ` [${existing.apiUrl}]` : ''}: `)) ||
+                    existing?.apiUrl;
+                if (!apiUrl) {
+                    console.error('❌ API URL is required');
                     process.exit(1);
                 }
-                if (input.includes('@')) {
-                    const password = await ask('Password: ');
+                // Check the scheme HERE, before a password is prompted for. The API
+                // client enforces the same rule, but by then the user has already
+                // typed a password that we would only then refuse to send — and a
+                // password typed at a prompt is a password the user now has to
+                // consider changing. Fail before asking for it.
+                try {
+                    (0, transportSecurity_1.assertSecureApiUrl)(apiUrl);
+                }
+                catch (err) {
+                    console.error(`❌ ${err.message}`);
+                    process.exit(1);
+                }
+                let token = opts.token;
+                let email = opts.email;
+                if (!token && !email) {
+                    const input = await ask('Email or token (scalebun_pat_…): ');
+                    if (!input) {
+                        console.error('❌ Email or token is required');
+                        process.exit(1);
+                    }
+                    if (input.includes('@'))
+                        email = input;
+                    else
+                        token = input;
+                }
+                // ── Email/password → JWT → durable PAT ────────────────────────────
+                if (!token && email) {
+                    const password = opts.password || (await ask('Password: '));
                     if (!password) {
                         console.error('❌ Password is required');
                         process.exit(1);
                     }
-                    console.log('  Logging in with credentials…');
+                    console.log('  Signing in…');
                     const unauthClient = new client_1.ApiClient({ apiUrl, token: '' });
-                    const loginRes = await unauthClient.post('/auth/login', {
-                        email: input,
-                        password,
-                    });
-                    token = loginRes.accessToken;
-                }
-                else {
-                    token = input;
+                    const loginRes = await unauthClient.post('/auth/login', { email, password });
+                    if (!loginRes.accessToken) {
+                        if (loginRes.mfaRequired) {
+                            console.error('❌ This account has MFA enabled, which the CLI cannot complete.\n' +
+                                '   Create a token in the dashboard instead (Settings → Access Tokens)\n' +
+                                '   and run:  scalebun login --token scalebun_pat_…');
+                        }
+                        else {
+                            console.error('❌ Sign-in did not return a token.');
+                        }
+                        process.exit(1);
+                    }
+                    // Spend the 15-minute JWT on something durable.
+                    const expiresDays = Math.max(0, parseInt(opts.expiresDays, 10) || 0);
+                    const jwtClient = new client_1.ApiClient({ apiUrl, token: loginRes.accessToken });
+                    try {
+                        const pat = await jwtClient.post('/auth/tokens', {
+                            name: `Scalebun CLI on ${os.hostname()}`,
+                            scopes: ['read', 'write'],
+                            expiresInDays: expiresDays > 0 ? expiresDays : null,
+                        });
+                        token = pat.token;
+                        console.log(`  🔑 Created CLI access token (…${pat.last4}, ` +
+                            `${expiresDays > 0 ? `expires in ${expiresDays} days` : 'no expiry'}). ` +
+                            'Revocable from the dashboard.');
+                    }
+                    catch (patErr) {
+                        // An older backend without /auth/tokens still logs in — but the
+                        // session dies in minutes, and pretending otherwise reproduces
+                        // the exact bug this exchange exists to fix. Say so.
+                        token = loginRes.accessToken;
+                        console.warn(`  ⚠️  Could not create a durable token (${patErr.message}).\n` +
+                            '      Falling back to the session token, which EXPIRES IN ~15 MINUTES.');
+                    }
                 }
+                // ── Validate whatever we ended up with ─────────────────────────────
+                console.log('  Validating token…');
+                const client = new client_1.ApiClient({ apiUrl, token: token });
+                const me = await client.get('/auth/me');
+                (0, credentials_1.writeCredentials)({ apiUrl, token: token });
+                console.log(`✅ Logged in as ${me.email} (${me.role ?? 'User'})`);
+                console.log('   Credentials saved to ~/.scalebun/credentials.json');
+                console.log('\nNext steps:');
+                console.log('  scalebun doctor                     # verify your project is OTA-ready');
+                console.log('  scalebun ota publish --app-id <id>  # ship your first update');
+            }
+            catch (err) {
+                console.error(`❌ Login failed: ${err.message}`);
+                process.exit(1);
+            }
+            finally {
+                rl.close();
             }
-            // Validate the token
-            console.log('  Validating token…');
-            const client = new client_1.ApiClient({ apiUrl, token });
-            const me = await client.get('/auth/me');
-            (0, credentials_1.writeCredentials)({ apiUrl, token });
-            console.log(`✅ Logged in as ${me.email} (${me.role ?? 'User'})`);
-            console.log(`   Credentials saved to ~/.scalebun/credentials.json`);
-        }
-        catch (err) {
-            console.error(`❌ Login failed: ${err.message}`);
-            process.exit(1);
-        }
-        finally {
-            rl.close();
         }
-    });
+    }
 }
 //# sourceMappingURL=login.js.map

package/lib/commands/login.js.map

@@ -1 +1 @@
-{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/commands/login.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAYA,oDAuEC;AAlFD,mDAAqC;AACrC,sDAAyE;AACzE,0CAA0C;AAE1C;;;;;;GAMG;AACH,SAAgB,oBAAoB,CAAC,OAAgB;IACnD,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,qDAAqD,CAAC;SAClE,MAAM,CAAC,iBAAiB,EAAE,wDAAwD,CAAC;SACnF,MAAM,CAAC,eAAe,EAAE,wCAAwC,CAAC;SACjE,MAAM,CAAC,KAAK,EAAE,IAAyC,EAAE,EAAE;QAC1D,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC;YAClC,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,CAAC,CAAS,EAAmB,EAAE,CACzC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QAEpD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAA,6BAAe,GAAE,CAAC;YAEnC,MAAM,MAAM,GACV,IAAI,CAAC,MAAM;gBACX,CAAC,MAAM,GAAG,CACR,UAAU,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,CAC9D,CAAC;gBACF,QAAQ,EAAE,MAAM,CAAC;YAEnB,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;gBACvC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YAED,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;YACvB,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,mCAAmC,CAAC,CAAC;gBAC7D,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;oBAC9C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,CAAC;gBAED,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBACxB,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC,CAAC;oBACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;wBACd,OAAO,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;wBACxC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBAClB,CAAC;oBACD,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;oBAC9C,MAAM,YAAY,GAAG,IAAI,kBAAS,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;oBAC1D,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,IAAI,CAA0B,aAAa,EAAE;wBAC/E,KAAK,EAAE,KAAK;wBACZ,QAAQ;qBACT,CAAC,CAAC;oBACH,KAAK,GAAG,QAAQ,CAAC,WAAW,CAAC;gBAC/B,CAAC;qBAAM,CAAC;oBACN,KAAK,GAAG,KAAK,CAAC;gBAChB,CAAC;YACH,CAAC;YAED,qBAAqB;YACrB,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;YACnC,MAAM,MAAM,GAAG,IAAI,kBAAS,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAChD,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,GAAG,CAAkC,UAAU,CAAC,CAAC;YAEzE,IAAA,8BAAgB,EAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YACpC,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,IAAI,IAAI,MAAM,GAAG,CAAC,CAAC;YACjE,OAAO,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC;QACtE,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,mBAAmB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YAChD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,KAAK,EAAE,CAAC;QACb,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/commands/login.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0BA,oDAsBC;AAcD,4BA8HC;AA3LD,mDAAqC;AACrC,uCAAyB;AACzB,sDAA2F;AAC3F,0CAA0C;AAC1C,kEAAgE;AAEhE;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAgB,oBAAoB,CAAC,OAAgB;IACnD,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,yEAAyE,CAAC;SACtF,MAAM,CAAC,iBAAiB,EAAE,wDAAwD,CAAC;SACnF,MAAM,CAAC,eAAe,EAAE,wCAAwC,CAAC;SACjE,MAAM,CAAC,iBAAiB,EAAE,+DAA+D,CAAC;SAC1F,MAAM,CAAC,uBAAuB,EAAE,sEAAsE,CAAC;SACvG,MAAM,CACL,oBAAoB,EACpB,8DAA8D,EAC9D,IAAI,CACL;SACA,MAAM,CAAC,CAAC,IAAkB,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAElD,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,6CAA6C,CAAC;SAC1D,MAAM,CAAC,GAAG,EAAE;QACX,IAAA,8BAAgB,GAAE,CAAC;QACnB,OAAO,CAAC,GAAG,CAAC,iHAAiH,CAAC,CAAC;IACjI,CAAC,CAAC,CAAC;AACP,CAAC;AAUD;;;GAGG;AACI,KAAK,UAAU,QAAQ,CAAC,IAAkB;IAC/C,CAAC;QACC,CAAC;YACG,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC;gBAClC,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAC,CAAC;YAEH,MAAM,GAAG,GAAG,CAAC,CAAS,EAAmB,EAAE,CACzC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;YAEpD,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,IAAA,6BAAe,GAAE,CAAC;gBAEnC,MAAM,MAAM,GACV,IAAI,CAAC,MAAM;oBACX,CAAC,MAAM,GAAG,CAAC,UAAU,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;oBAC1E,QAAQ,EAAE,MAAM,CAAC;gBAEnB,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,OAAO,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;oBACvC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,CAAC;gBAED,oEAAoE;gBACpE,kEAAkE;gBAClE,kEAAkE;gBAClE,+DAA+D;gBAC/D,gDAAgD;gBAChD,IAAI,CAAC;oBACH,IAAA,sCAAkB,EAAC,MAAM,CAAC,CAAC;gBAC7B,CAAC;gBAAC,OAAO,GAAQ,EAAE,CAAC;oBAClB,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;oBAClC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,CAAC;gBAED,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;gBACvB,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;gBAEvB,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;oBACrB,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,mCAAmC,CAAC,CAAC;oBAC7D,IAAI,CAAC,KAAK,EAAE,CAAC;wBACX,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;wBAC9C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBAClB,CAAC;oBACD,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;wBAAE,KAAK,GAAG,KAAK,CAAC;;wBAClC,KAAK,GAAG,KAAK,CAAC;gBACrB,CAAC;gBAED,qEAAqE;gBACrE,IAAI,CAAC,KAAK,IAAI,KAAK,EAAE,CAAC;oBACpB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;oBAC5D,IAAI,CAAC,QAAQ,EAAE,CAAC;wBACd,OAAO,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;wBACxC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBAClB,CAAC;oBAED,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;oBAC7B,MAAM,YAAY,GAAG,IAAI,kBAAS,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;oBAC1D,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,IAAI,CAGrC,aAAa,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;oBAEvC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;wBAC1B,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;4BACzB,OAAO,CAAC,KAAK,CACX,kEAAkE;gCAChE,yEAAyE;gCACzE,oDAAoD,CACvD,CAAC;wBACJ,CAAC;6BAAM,CAAC;4BACN,OAAO,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;wBACrD,CAAC;wBACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBAClB,CAAC;oBAED,gDAAgD;oBAChD,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;oBACrE,MAAM,SAAS,GAAG,IAAI,kBAAS,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;oBACzE,IAAI,CAAC;wBACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,IAAI,CAC9B,cAAc,EACd;4BACE,IAAI,EAAE,mBAAmB,EAAE,CAAC,QAAQ,EAAE,EAAE;4BACxC,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;4BACzB,aAAa,EAAE,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI;yBACpD,CACF,CAAC;wBACF,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;wBAClB,OAAO,CAAC,GAAG,CACT,mCAAmC,GAAG,CAAC,KAAK,IAAI;4BAC9C,GAAG,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,WAAW,OAAO,CAAC,CAAC,CAAC,WAAW,KAAK;4BACxE,+BAA+B,CAClC,CAAC;oBACJ,CAAC;oBAAC,OAAO,MAAW,EAAE,CAAC;wBACrB,gEAAgE;wBAChE,+DAA+D;wBAC/D,qDAAqD;wBACrD,KAAK,GAAG,QAAQ,CAAC,WAAW,CAAC;wBAC7B,OAAO,CAAC,IAAI,CACV,2CAA2C,MAAM,CAAC,OAAO,MAAM;4BAC7D,wEAAwE,CAC3E,CAAC;oBACJ,CAAC;gBACH,CAAC;gBAED,sEAAsE;gBACtE,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;gBACnC,MAAM,MAAM,GAAG,IAAI,kBAAS,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,KAAM,EAAE,CAAC,CAAC;gBACxD,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,GAAG,CAAkC,UAAU,CAAC,CAAC;gBAEzE,IAAA,8BAAgB,EAAC,EAAE,MAAM,EAAE,KAAK,EAAE,KAAM,EAAE,CAAC,CAAC;gBAC5C,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,IAAI,IAAI,MAAM,GAAG,CAAC,CAAC;gBACjE,OAAO,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC;gBACpE,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;gBAC7B,OAAO,CAAC,GAAG,CAAC,0EAA0E,CAAC,CAAC;gBACxF,OAAO,CAAC,GAAG,CAAC,gEAAgE,CAAC,CAAC;YAChF,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,OAAO,CAAC,KAAK,CAAC,mBAAmB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBAChD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;oBAAS,CAAC;gBACT,EAAE,CAAC,KAAK,EAAE,CAAC;YACb,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC"}

package/lib/commands/ota-bundle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ota-bundle.d.ts","sourceRoot":"","sources":["../../src/commands/ota-bundle.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAqD3D"}
+{"version":3,"file":"ota-bundle.d.ts","sourceRoot":"","sources":["../../src/commands/ota-bundle.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAwD3D"}

package/lib/commands/ota-bundle.js

@@ -52,6 +52,7 @@ function registerOtaBundleCommand(ota) {
         .option('--output <path>', 'Output bundle destination path', './index.android.bundle')
         .option('--hermes', 'Compile to Hermes bytecode (recommended for production)')
         .option('--hermes-disabled', 'Explicitly disable Hermes bytecode compilation')
+        .option('--allow-plain-js', 'Emit uncompiled JS if hermesc fails, instead of aborting')
         .option('--sourcemap', 'Generate sourcemap alongside the bundle')
         .action(async (opts) => {
         const platform = opts.platform;
@@ -63,6 +64,7 @@ function registerOtaBundleCommand(ota) {
                 entryFile: opts.entryFile,
                 dev: false,
                 hermes: useHermes,
+                allowPlainJs: opts.allowPlainJs ?? false,
                 sourcemap: opts.sourcemap,
             });
             const destPath = path.resolve(opts.output);

package/lib/commands/ota-bundle.js.map

@@ -1 +1 @@
-{"version":3,"file":"ota-bundle.js","sourceRoot":"","sources":["../../src/commands/ota-bundle.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAWA,4DAqDC;AAhED,uCAAyB;AACzB,2CAA6B;AAE7B,4CAA8C;AAE9C;;;;;GAKG;AACH,SAAgB,wBAAwB,CAAC,GAAY;IACnD,GAAG;SACA,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,gFAAgF,CAAC;SAC7F,MAAM,CAAC,uBAAuB,EAAE,gCAAgC,EAAE,SAAS,CAAC;SAC5E,MAAM,CAAC,qBAAqB,EAAE,eAAe,EAAE,UAAU,CAAC;SAC1D,MAAM,CAAC,iBAAiB,EAAE,gCAAgC,EAAE,wBAAwB,CAAC;SACrF,MAAM,CAAC,UAAU,EAAE,yDAAyD,CAAC;SAC7E,MAAM,CAAC,mBAAmB,EAAE,gDAAgD,CAAC;SAC7E,MAAM,CAAC,aAAa,EAAE,yCAAyC,CAAC;SAChE,MAAM,CACL,KAAK,EAAE,IAON,EAAE,EAAE;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,QAA6B,CAAC;QACpD,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;QAE5D,OAAO,CAAC,GAAG,CAAC,eAAe,QAAQ,eAAe,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAE5F,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAA,oBAAW,EAAC;gBACzB,QAAQ;gBACR,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,GAAG,EAAE,KAAK;gBACV,MAAM,EAAE,SAAS;gBACjB,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACvC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5B,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7C,CAAC;YAED,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YAC7C,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACpC,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAEvD,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;YAChD,OAAO,CAAC,GAAG,CAAC,mBAAmB,QAAQ,EAAE,CAAC,CAAC;YAC3C,OAAO,CAAC,GAAG,CAAC,mBAAmB,MAAM,QAAQ,KAAK,CAAC,IAAI,SAAS,CAAC,CAAC;YAClE,OAAO,CAAC,GAAG,CAAC,iGAAiG,CAAC,CAAC;QACjH,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,sBAAsB,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,CAAC,CAAC;YAC3D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CACF,CAAC;AACN,CAAC"}
+{"version":3,"file":"ota-bundle.js","sourceRoot":"","sources":["../../src/commands/ota-bundle.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAWA,4DAwDC;AAnED,uCAAyB;AACzB,2CAA6B;AAE7B,4CAA8C;AAE9C;;;;;GAKG;AACH,SAAgB,wBAAwB,CAAC,GAAY;IACnD,GAAG;SACA,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,gFAAgF,CAAC;SAC7F,MAAM,CAAC,uBAAuB,EAAE,gCAAgC,EAAE,SAAS,CAAC;SAC5E,MAAM,CAAC,qBAAqB,EAAE,eAAe,EAAE,UAAU,CAAC;SAC1D,MAAM,CAAC,iBAAiB,EAAE,gCAAgC,EAAE,wBAAwB,CAAC;SACrF,MAAM,CAAC,UAAU,EAAE,yDAAyD,CAAC;SAC7E,MAAM,CAAC,mBAAmB,EAAE,gDAAgD,CAAC;SAC7E,MAAM,CAAC,kBAAkB,EAAE,0DAA0D,CAAC;SACtF,MAAM,CAAC,aAAa,EAAE,yCAAyC,CAAC;SAChE,MAAM,CACL,KAAK,EAAE,IAQN,EAAE,EAAE;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,QAA6B,CAAC;QACpD,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;QAE5D,OAAO,CAAC,GAAG,CAAC,eAAe,QAAQ,eAAe,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAE5F,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAA,oBAAW,EAAC;gBACzB,QAAQ;gBACR,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,GAAG,EAAE,KAAK;gBACV,MAAM,EAAE,SAAS;gBACjB,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,KAAK;gBACxC,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACvC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5B,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7C,CAAC;YAED,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YAC7C,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACpC,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAEvD,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;YAChD,OAAO,CAAC,GAAG,CAAC,mBAAmB,QAAQ,EAAE,CAAC,CAAC;YAC3C,OAAO,CAAC,GAAG,CAAC,mBAAmB,MAAM,QAAQ,KAAK,CAAC,IAAI,SAAS,CAAC,CAAC;YAClE,OAAO,CAAC,GAAG,CAAC,iGAAiG,CAAC,CAAC;QACjH,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,sBAAsB,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,CAAC,CAAC;YAC3D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CACF,CAAC;AACN,CAAC"}

package/lib/commands/ota-delete-bundle.d.ts

@@ -1,3 +1,11 @@
 import { Command } from 'commander';
+/**
+ * `scalebun ota delete-bundle` — permanent, irreversible artifact deletion.
+ *
+ * It asks first. This used to delete on sight: one mis-pasted --bundle-id and
+ * the artifact was gone, with devices possibly still running it. `ota rollback`
+ * already had this shape (prompt on a TTY, explicit --yes off-TTY); a command
+ * whose own description says "permanently" needs it at least as much.
+ */
 export declare function registerOtaDeleteBundleCommand(ota: Command): void;
 //# sourceMappingURL=ota-delete-bundle.d.ts.map

package/lib/commands/ota-delete-bundle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ota-delete-bundle.d.ts","sourceRoot":"","sources":["../../src/commands/ota-delete-bundle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIpC,wBAAgB,8BAA8B,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAwBjE"}
+{"version":3,"file":"ota-delete-bundle.d.ts","sourceRoot":"","sources":["../../src/commands/ota-delete-bundle.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIpC;;;;;;;GAOG;AACH,wBAAgB,8BAA8B,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAiDjE"}