@scalebun/cli 1.0.0 → 1.4.0

package/lib/utils/bundle.d.ts

@@ -19,13 +19,78 @@ export interface BundleOptions {
      * step will be mandatory when the patch engine ships.
      */
     hermes?: boolean;
+    /**
+     * Permit shipping a plain-JS bundle when `--hermes` was asked for but
+     * hermesc could not run. Default false: a failed compile is an ERROR.
+     *
+     * It used to warn and ship the uncompiled bundle, which is a silent
+     * downgrade of the artifact — the publish "succeeds" and nothing downstream
+     * can tell that what shipped is not what was requested. Two concrete costs:
+     * cold start is 20-30% slower for every user on that release, and the delta
+     * engine diffs the new bundle against the previous one, so a channel that
+     * flips between bytecode and plain JS produces patches with nothing in
+     * common and every device falls back to a full download.
+     *
+     * A broken toolchain should stop the publish, not quietly change what it
+     * publishes. The escape hatch stays available for anyone who genuinely
+     * wants the uncompiled artifact — it just has to be asked for.
+     */
+    allowPlainJs?: boolean;
     /** If true, generate a sourcemap alongside the bundle. */
     sourcemap?: boolean;
+    /**
+     * Identity marker to compile into the bundle. Injected into the JS source
+     * BEFORE hermesc runs — Hermes bytecode is a binary format, so text cannot be
+     * prepended after compilation without corrupting the file.
+     *
+     * At runtime the SDK reads `globalThis.__SCALEBUN_OTA_ID__` and compares it
+     * against the slot it believes is active. That comparison is the only way to
+     * prove from JS that the bundle we installed is the bundle actually running —
+     * which catches a host app that never wired `getJSBundleFile()`, and the
+     * bridgeless runtimes below RN 0.76.1 that ignore it entirely.
+     */
+    identityToken?: string;
 }
 export interface BundleResult {
     bundlePath: string;
     assetsPath: string;
+    /**
+     * Asset files Metro emitted for this bundle, relative to `assetsPath`.
+     * OTA ships the JS artifact only — these resolve from the installed binary,
+     * so the list exists to WARN about assets added since the last store build.
+     */
+    assets: string[];
+    /** True when the artifact really is Hermes bytecode (verified from the header). */
+    hermesCompiled: boolean;
+    /** HBC format version read from the compiled header, or null for plain JS. */
+    hermesBytecodeVersion: number | null;
 }
+/**
+ * Read the HBC format version straight out of the compiled file header.
+ *
+ * Parsed from the artifact rather than from `hermesc --version` output, because
+ * the header is what the device's VM actually compares against — and its format
+ * is stable, whereas the CLI's version banner is not.
+ *
+ * Returns null when the file is not Hermes bytecode.
+ */
+export declare function readHermesBytecodeVersion(filePath: string): number | null;
+/**
+ * Locate the `hermesc` binary that ships inside React Native.
+ *
+ * `hermesc` is NOT an npm package — `npx hermesc` fails with
+ * "No versions available for hermesc" on every project, which meant `--hermes`
+ * silently degraded to a plain JS bundle every single time it was used. React
+ * Native ships a prebuilt binary per host platform under `sdks/hermesc/`.
+ *
+ * Using the copy inside the project's own `react-native` is also the correct
+ * choice for a second reason: it is the compiler matched to the Hermes runtime
+ * in that app's binary. Compiling with any other hermesc is what produces
+ * "Wrong bytecode version. Expected 96 but got 98" on device.
+ */
+export declare function resolveHermesc(cwd?: string): string | null;
+/** React Native version of the project being published, from its node_modules. */
+export declare function detectProjectRnVersion(cwd?: string): string | null;
 /**
  * Shell out to `npx react-native bundle` to produce a JS bundle.
  *
@@ -33,5 +98,26 @@ export interface BundleResult {
  * The native runtime detects the format from magic bytes (\x1f\x\xbc —
  * Hermes bytecode header), so the same .jsbundle extension works for both.
  */
+/**
+ * True when this project is an Expo app.
+ *
+ * Expo projects do not ship `@react-native-community/cli`, so `npx react-native
+ * bundle` fails outright with a "react-native depends on
+ * @react-native-community/cli" error. Expo's equivalent is `expo export:embed`,
+ * which takes the same flags and produces the same artifact. Detecting this is
+ * not a nicety — without it `ota publish` cannot build a bundle in an Expo app
+ * at all, which is a large share of the React Native ecosystem.
+ */
+export declare function isExpoProject(cwd?: string): boolean;
 export declare function buildBundle(opts: BundleOptions): BundleResult;
+/**
+ * Every asset file Metro emitted for this bundle, relative to the assets root.
+ *
+ * OTA ships ONE artifact: the JS/bytecode bundle. Assets are resolved from what
+ * the installed binary already contains, so an image or font added since the
+ * last store build is referenced by the new JS and is simply not there — the
+ * update installs cleanly and renders a missing image. `ota publish` uses this
+ * list to say so out loud rather than discarding the directory in silence.
+ */
+export declare function listAssets(root: string): string[];
 //# sourceMappingURL=bundle.d.ts.map

package/lib/utils/bundle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bundle.d.ts","sourceRoot":"","sources":["../../src/utils/bundle.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,SAAS,GAAG,KAAK,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,OAAO,CAAC;IACb;;;;;;;;;;;;;;;OAeG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,0DAA0D;IAC1D,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,aAAa,GAAG,YAAY,CA+D7D"}
+{"version":3,"file":"bundle.d.ts","sourceRoot":"","sources":["../../src/utils/bundle.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,SAAS,GAAG,KAAK,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,OAAO,CAAC;IACb;;;;;;;;;;;;;;;OAeG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;;;;;;;;;;;;OAeG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,0DAA0D;IAC1D,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;;;;;;;OAUG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,mFAAmF;IACnF,cAAc,EAAE,OAAO,CAAC;IACxB,8EAA8E;IAC9E,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;CACtC;AAQD;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAoBzE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAsB,GAAG,MAAM,GAAG,IAAI,CAkBzE;AAED,kFAAkF;AAClF,wBAAgB,sBAAsB,CAAC,GAAG,GAAE,MAAsB,GAAG,MAAM,GAAG,IAAI,CASjF;AAED;;;;;;GAMG;AACH;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,GAAG,GAAE,MAAsB,GAAG,OAAO,CAelE;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,aAAa,GAAG,YAAY,CAwK7D;AAED;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAiBjD"}

package/lib/utils/bundle.js

@@ -33,11 +33,92 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.readHermesBytecodeVersion = readHermesBytecodeVersion;
+exports.resolveHermesc = resolveHermesc;
+exports.detectProjectRnVersion = detectProjectRnVersion;
+exports.isExpoProject = isExpoProject;
 exports.buildBundle = buildBundle;
+exports.listAssets = listAssets;
 const childProcess = __importStar(require("child_process"));
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const os = __importStar(require("os"));
+/**
+ * Hermes bytecode file magic, little-endian on disk.
+ * Source: `const uint64_t MAGIC = 0x1F1903C103BC1FC6` in Hermes.
+ */
+const HBC_MAGIC = Buffer.from([0xc6, 0x1f, 0xbc, 0x03, 0xc1, 0x03, 0x19, 0x1f]);
+/**
+ * Read the HBC format version straight out of the compiled file header.
+ *
+ * Parsed from the artifact rather than from `hermesc --version` output, because
+ * the header is what the device's VM actually compares against — and its format
+ * is stable, whereas the CLI's version banner is not.
+ *
+ * Returns null when the file is not Hermes bytecode.
+ */
+function readHermesBytecodeVersion(filePath) {
+    let fd;
+    try {
+        fd = fs.openSync(filePath, 'r');
+        const header = Buffer.alloc(12);
+        const read = fs.readSync(fd, header, 0, 12, 0);
+        if (read < 12)
+            return null;
+        if (!header.subarray(0, 8).equals(HBC_MAGIC))
+            return null;
+        return header.readUInt32LE(8);
+    }
+    catch {
+        return null;
+    }
+    finally {
+        if (fd !== undefined) {
+            try {
+                fs.closeSync(fd);
+            }
+            catch {
+                /* ignore */
+            }
+        }
+    }
+}
+/**
+ * Locate the `hermesc` binary that ships inside React Native.
+ *
+ * `hermesc` is NOT an npm package — `npx hermesc` fails with
+ * "No versions available for hermesc" on every project, which meant `--hermes`
+ * silently degraded to a plain JS bundle every single time it was used. React
+ * Native ships a prebuilt binary per host platform under `sdks/hermesc/`.
+ *
+ * Using the copy inside the project's own `react-native` is also the correct
+ * choice for a second reason: it is the compiler matched to the Hermes runtime
+ * in that app's binary. Compiling with any other hermesc is what produces
+ * "Wrong bytecode version. Expected 96 but got 98" on device.
+ */
+function resolveHermesc(cwd = process.cwd()) {
+    const dir = process.platform === 'win32'
+        ? 'win64-bin'
+        : process.platform === 'darwin'
+            ? 'osx-bin'
+            : 'linux64-bin';
+    const bin = process.platform === 'win32' ? 'hermesc.exe' : 'hermesc';
+    const candidate = path.join(cwd, 'node_modules', 'react-native', 'sdks', 'hermesc', dir, bin);
+    return fs.existsSync(candidate) ? candidate : null;
+}
+/** React Native version of the project being published, from its node_modules. */
+function detectProjectRnVersion(cwd = process.cwd()) {
+    try {
+        const pkgPath = path.join(cwd, 'node_modules', 'react-native', 'package.json');
+        if (!fs.existsSync(pkgPath))
+            return null;
+        const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));
+        return typeof pkg.version === 'string' ? pkg.version : null;
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * Shell out to `npx react-native bundle` to produce a JS bundle.
  *
@@ -45,23 +126,49 @@ const os = __importStar(require("os"));
  * The native runtime detects the format from magic bytes (\x1f\x\xbc —
  * Hermes bytecode header), so the same .jsbundle extension works for both.
  */
+/**
+ * True when this project is an Expo app.
+ *
+ * Expo projects do not ship `@react-native-community/cli`, so `npx react-native
+ * bundle` fails outright with a "react-native depends on
+ * @react-native-community/cli" error. Expo's equivalent is `expo export:embed`,
+ * which takes the same flags and produces the same artifact. Detecting this is
+ * not a nicety — without it `ota publish` cannot build a bundle in an Expo app
+ * at all, which is a large share of the React Native ecosystem.
+ */
+function isExpoProject(cwd = process.cwd()) {
+    try {
+        if (fs.existsSync(path.join(cwd, 'node_modules', 'expo', 'package.json'))) {
+            return true;
+        }
+        const pkgPath = path.join(cwd, 'package.json');
+        if (!fs.existsSync(pkgPath))
+            return false;
+        const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));
+        return Boolean(pkg.dependencies?.expo ?? pkg.devDependencies?.expo);
+    }
+    catch {
+        return false;
+    }
+}
 function buildBundle(opts) {
     const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'scalebun-bundle-'));
     const bundlePath = path.join(tmpDir, 'bundle.jsbundle');
     const assetsPath = path.join(tmpDir, 'assets');
     fs.mkdirSync(assetsPath, { recursive: true });
-    const args = [
-        'react-native', 'bundle',
-        '--platform', opts.platform,
-        '--dev', String(opts.dev),
-        '--entry-file', opts.entryFile,
-        '--bundle-output', bundlePath,
-        '--assets-dest', assetsPath,
-    ];
+    // `expo export:embed` is the Expo-side equivalent of `react-native bundle`
+    // and accepts the same flags. Both emit a plain JS bundle; Hermes compilation
+    // is a separate step below in either case.
+    const expo = isExpoProject();
+    const args = expo
+        ? ['expo', 'export:embed']
+        : ['react-native', 'bundle'];
+    args.push('--platform', opts.platform, '--dev', String(opts.dev), '--entry-file', opts.entryFile, '--bundle-output', bundlePath, '--assets-dest', assetsPath);
     // Sprint 8: Generate sourcemap if requested
     if (opts.sourcemap) {
         args.push('--sourcemap-output', bundlePath + '.map');
     }
+    console.log(`  Detected ${expo ? 'Expo' : 'bare React Native'} project`);
     console.log(`  Running: npx ${args.join(' ')}`);
     const result = childProcess.spawnSync('npx', args, {
         stdio: 'inherit',
@@ -69,26 +176,149 @@ function buildBundle(opts) {
         timeout: 300000, // 5 minutes
     });
     if (result.status !== 0) {
-        throw new Error(`react-native bundle failed with exit code ${result.status}`);
+        throw new Error(`${expo ? 'expo export:embed' : 'react-native bundle'} failed with exit code ${result.status}`);
     }
     if (!fs.existsSync(bundlePath)) {
         throw new Error(`Bundle file not found at ${bundlePath}`);
     }
+    // Identity marker — injected into the JS source, before any Hermes step
+    // (after hermesc the artifact is binary and text would corrupt the header).
+    //
+    // APPENDED, not prepended. Metro has already written the sourcemap by this
+    // point, and a prepended line shifts every generated line down by one —
+    // silently corrupting the line numbers of every symbolicated stack trace
+    // from this bundle. An appended statement adds no mappings and moves none;
+    // it still executes during bundle evaluation, and the SDK reads the global
+    // at init(), long after evaluation completes.
+    if (opts.identityToken) {
+        const marker = `\nglobalThis.__SCALEBUN_OTA_ID__=${JSON.stringify(opts.identityToken)};\n`;
+        fs.appendFileSync(bundlePath, marker, 'utf-8');
+    }
     // Hermes bytecode compilation (opt-in)
     if (opts.hermes) {
         console.log('  Compiling to Hermes bytecode…');
-        const hbcPath = bundlePath; // overwrite in-place — same extension
-        const hermescResult = childProcess.spawnSync('npx', ['hermesc', '-emit-binary', '-out', hbcPath, bundlePath], { stdio: 'inherit', shell: true, timeout: 120000 });
-        if (hermescResult.status !== 0) {
-            console.warn(`  ⚠️  hermesc failed (exit ${hermescResult.status}) — shipping plain JS bundle`);
+        // Compile to a sibling path, then rename. hermesc reading and writing the
+        // same path in one invocation is not guaranteed to be safe, and a truncated
+        // in-place write would produce a bundle that hashes fine and never loads.
+        const hbcPath = bundlePath + '.hbc';
+        const hermesc = resolveHermesc();
+        // A missing hermesc is handled with the compile failures below, so that
+        // "cannot compile" has exactly one outcome regardless of the reason.
+        // Output is CAPTURED, not inherited. hermesc emits one warning per
+        // undeclared global per module ("the variable Buffer was not declared…"),
+        // and each warning quotes the offending source line — which in a minified
+        // bundle is a single line of 100KB+. Two consequences shaped this code:
+        //   1. Inherited stdio drowned the publish summary in megabytes of noise.
+        //   2. spawnSync's DEFAULT maxBuffer is 1MB; the quoted warnings blow past
+        //      it, Node kills hermesc (ENOBUFS), and `--hermes` silently degrades
+        //      to plain JS — the same bug as `npx hermesc`, via a different door.
+        //      Hit live on the very first publish after the capture change.
+        const hermescResult = hermesc
+            ? childProcess.spawnSync(hermesc, ['-emit-binary', '-out', hbcPath, bundlePath], {
+                stdio: ['ignore', 'pipe', 'pipe'],
+                shell: false,
+                timeout: 120000,
+                encoding: 'utf-8',
+                maxBuffer: 256 * 1024 * 1024,
+            })
+            : { status: 1 };
+        if (hermesc && hermescResult.status === 0) {
+            const warnings = `${hermescResult.stdout ?? ''}${hermescResult.stderr ?? ''}`
+                .split('\n')
+                .filter((l) => l.includes('warning:')).length;
+            if (warnings > 0) {
+                console.log(`  (${warnings} hermesc warnings suppressed — expected for RN bundles)`);
+            }
+        }
+        if (hermescResult.status !== 0 || !fs.existsSync(hbcPath)) {
+            // Collect the reason before deciding what to do with it — the same
+            // detail is worth printing whether this ends as an error or a warning.
+            const reason = hermesc
+                ? `hermesc failed (exit ${hermescResult.status}` +
+                    `${hermescResult.error ? `, ${hermescResult.error.message}` : ''})`
+                : 'hermesc not found under node_modules/react-native/sdks/hermesc';
+            // Only lines that carry the error itself, each clipped: a quoted
+            // minified source line is 100KB of noise per line.
+            const errLines = `${hermescResult.stderr ?? ''}`
+                .split('\n')
+                .filter((l) => l.includes('error:'))
+                .slice(0, 5)
+                .map((l) => (l.length > 200 ? l.slice(0, 200) + '…' : l));
+            try {
+                if (fs.existsSync(hbcPath))
+                    fs.unlinkSync(hbcPath);
+            }
+            catch {
+                /* ignore */
+            }
+            if (!opts.allowPlainJs) {
+                // STOP. --hermes was explicitly requested; shipping the uncompiled
+                // bundle instead would publish a different artifact than the one
+                // asked for, and nothing downstream could tell.
+                for (const l of errLines)
+                    console.error(`      ${l}`);
+                throw new Error(`${reason}.\n` +
+                    '  --hermes was requested, so this is a hard failure rather than a silent\n' +
+                    '  downgrade: shipping plain JS would slow every user\'s cold start by\n' +
+                    '  20-30% and break delta patching against previous bytecode releases.\n' +
+                    '  Fix the toolchain, or pass --allow-plain-js to publish uncompiled.');
+            }
+            console.warn(`  ⚠️  ${reason} — shipping plain JS bundle (--allow-plain-js)`);
+            for (const l of errLines)
+                console.warn(`      ${l}`);
         }
         else {
+            fs.renameSync(hbcPath, bundlePath);
             console.log('  ✅ Hermes bytecode compiled');
         }
     }
     else {
         console.log('  ℹ️  Shipping plain JS (no hermesc). Use --hermes for bytecode compilation.');
     }
-    return { bundlePath, assetsPath };
+    // Read the format back off the artifact rather than trusting the flag. When
+    // hermesc fails we fall back to plain JS, and recording `hermes: true` anyway
+    // would tell the backend to gate devices on a bytecode version this bundle
+    // does not have.
+    const hermesBytecodeVersion = readHermesBytecodeVersion(bundlePath);
+    if (opts.hermes && hermesBytecodeVersion === null) {
+        console.warn('  ⚠️  Artifact is not Hermes bytecode — recording it as plain JS.');
+    }
+    return {
+        bundlePath,
+        assetsPath,
+        assets: listAssets(assetsPath),
+        hermesCompiled: hermesBytecodeVersion !== null,
+        hermesBytecodeVersion,
+    };
+}
+/**
+ * Every asset file Metro emitted for this bundle, relative to the assets root.
+ *
+ * OTA ships ONE artifact: the JS/bytecode bundle. Assets are resolved from what
+ * the installed binary already contains, so an image or font added since the
+ * last store build is referenced by the new JS and is simply not there — the
+ * update installs cleanly and renders a missing image. `ota publish` uses this
+ * list to say so out loud rather than discarding the directory in silence.
+ */
+function listAssets(root) {
+    const out = [];
+    const walk = (dir, prefix) => {
+        let entries;
+        try {
+            entries = fs.readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return; // no assets dir at all is the common, healthy case
+        }
+        for (const entry of entries) {
+            const rel = prefix ? `${prefix}/${entry.name}` : entry.name;
+            if (entry.isDirectory())
+                walk(path.join(dir, entry.name), rel);
+            else
+                out.push(rel);
+        }
+    };
+    walk(root, '');
+    return out;
 }
 //# sourceMappingURL=bundle.js.map

package/lib/utils/bundle.js.map

@@ -1 +1 @@
-{"version":3,"file":"bundle.js","sourceRoot":"","sources":["../../src/utils/bundle.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0CA,kCA+DC;AAzGD,4DAA8C;AAC9C,uCAAyB;AACzB,2CAA6B;AAC7B,uCAAyB;AAgCzB;;;;;;GAMG;AACH,SAAgB,WAAW,CAAC,IAAmB;IAC7C,MAAM,MAAM,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAC1E,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAE/C,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE9C,MAAM,IAAI,GAAG;QACX,cAAc,EAAE,QAAQ;QACxB,YAAY,EAAE,IAAI,CAAC,QAAQ;QAC3B,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QACzB,cAAc,EAAE,IAAI,CAAC,SAAS;QAC9B,iBAAiB,EAAE,UAAU;QAC7B,eAAe,EAAE,UAAU;KAC5B,CAAC;IAEF,4CAA4C;IAC5C,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,UAAU,GAAG,MAAM,CAAC,CAAC;IACvD,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhD,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;QACjD,KAAK,EAAE,SAAS;QAChB,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,MAAO,EAAE,YAAY;KAC/B,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,6CAA6C,MAAM,CAAC,MAAM,EAAE,CAC7D,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,4BAA4B,UAAU,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,uCAAuC;IACvC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,sCAAsC;QAClE,MAAM,aAAa,GAAG,YAAY,CAAC,SAAS,CAC1C,KAAK,EACL,CAAC,SAAS,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,EACxD,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,MAAO,EAAE,CACpD,CAAC;QAEF,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,CAAC,IAAI,CACV,8BAA8B,aAAa,CAAC,MAAM,8BAA8B,CACjF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CACT,8EAA8E,CAC/E,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;AACpC,CAAC"}
+{"version":3,"file":"bundle.js","sourceRoot":"","sources":["../../src/utils/bundle.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyFA,8DAoBC;AAeD,wCAkBC;AAGD,wDASC;AAmBD,sCAeC;AAED,kCAwKC;AAWD,gCAiBC;AAlYD,4DAA8C;AAC9C,uCAAyB;AACzB,2CAA6B;AAC7B,uCAAyB;AAuEzB;;;GAGG;AACH,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAEhF;;;;;;;;GAQG;AACH,SAAgB,yBAAyB,CAAC,QAAgB;IACxD,IAAI,EAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAC/C,IAAI,IAAI,GAAG,EAAE;YAAE,OAAO,IAAI,CAAC;QAC3B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1D,OAAO,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YACrB,IAAI,CAAC;gBACH,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YACnB,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAgB,cAAc,CAAC,MAAc,OAAO,CAAC,GAAG,EAAE;IACxD,MAAM,GAAG,GACP,OAAO,CAAC,QAAQ,KAAK,OAAO;QAC1B,CAAC,CAAC,WAAW;QACb,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,QAAQ;YAC7B,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,aAAa,CAAC;IACtB,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;IACrE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CACzB,GAAG,EACH,cAAc,EACd,cAAc,EACd,MAAM,EACN,SAAS,EACT,GAAG,EACH,GAAG,CACJ,CAAC;IACF,OAAO,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AACrD,CAAC;AAED,kFAAkF;AAClF,SAAgB,sBAAsB,CAAC,MAAc,OAAO,CAAC,GAAG,EAAE;IAChE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC;QAC/E,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QACzC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAyB,CAAC;QAClF,OAAO,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH;;;;;;;;;GASG;AACH,SAAgB,aAAa,CAAC,MAAc,OAAO,CAAC,GAAG,EAAE;IACvD,IAAI,CAAC;QACH,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC;YAC1E,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAC/C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAGvD,CAAC;QACF,OAAO,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,IAAI,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAgB,WAAW,CAAC,IAAmB;IAC7C,MAAM,MAAM,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAC1E,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAE/C,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE9C,2EAA2E;IAC3E,8EAA8E;IAC9E,2CAA2C;IAC3C,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,IAAI;QACf,CAAC,CAAC,CAAC,MAAM,EAAE,cAAc,CAAC;QAC1B,CAAC,CAAC,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;IAE/B,IAAI,CAAC,IAAI,CACP,YAAY,EAAE,IAAI,CAAC,QAAQ,EAC3B,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EACzB,cAAc,EAAE,IAAI,CAAC,SAAS,EAC9B,iBAAiB,EAAE,UAAU,EAC7B,eAAe,EAAE,UAAU,CAC5B,CAAC;IAEF,4CAA4C;IAC5C,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,UAAU,GAAG,MAAM,CAAC,CAAC;IACvD,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,mBAAmB,UAAU,CAAC,CAAC;IACzE,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhD,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;QACjD,KAAK,EAAE,SAAS;QAChB,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,MAAO,EAAE,YAAY;KAC/B,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,qBAAqB,0BAA0B,MAAM,CAAC,MAAM,EAAE,CAC/F,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,4BAA4B,UAAU,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,wEAAwE;IACxE,4EAA4E;IAC5E,EAAE;IACF,2EAA2E;IAC3E,wEAAwE;IACxE,yEAAyE;IACzE,2EAA2E;IAC3E,2EAA2E;IAC3E,8CAA8C;IAC9C,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,oCAAoC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;QAC3F,EAAE,CAAC,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC;IAED,uCAAuC;IACvC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;QAC/C,0EAA0E;QAC1E,4EAA4E;QAC5E,0EAA0E;QAC1E,MAAM,OAAO,GAAG,UAAU,GAAG,MAAM,CAAC;QACpC,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;QAEjC,wEAAwE;QACxE,qEAAqE;QAErE,mEAAmE;QACnE,0EAA0E;QAC1E,0EAA0E;QAC1E,wEAAwE;QACxE,0EAA0E;QAC1E,2EAA2E;QAC3E,0EAA0E;QAC1E,0EAA0E;QAC1E,oEAAoE;QACpE,MAAM,aAAa,GAAG,OAAO;YAC3B,CAAC,CAAC,YAAY,CAAC,SAAS,CACpB,OAAO,EACP,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,EAC7C;gBACE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;gBACjC,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE,MAAO;gBAChB,QAAQ,EAAE,OAAO;gBACjB,SAAS,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI;aAC7B,CACF;YACH,CAAC,CAAE,EAAE,MAAM,EAAE,CAAC,EAA4C,CAAC;QAE7D,IAAI,OAAO,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1C,MAAM,QAAQ,GAAG,GAAG,aAAa,CAAC,MAAM,IAAI,EAAE,GAAG,aAAa,CAAC,MAAM,IAAI,EAAE,EAAE;iBAC1E,KAAK,CAAC,IAAI,CAAC;iBACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC;YAChD,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;gBACjB,OAAO,CAAC,GAAG,CAAC,MAAM,QAAQ,yDAAyD,CAAC,CAAC;YACvF,CAAC;QACH,CAAC;QAED,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1D,mEAAmE;YACnE,uEAAuE;YACvE,MAAM,MAAM,GAAG,OAAO;gBACpB,CAAC,CAAC,wBAAwB,aAAa,CAAC,MAAM,EAAE;oBAC9C,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG;gBACrE,CAAC,CAAC,gEAAgE,CAAC;YACrE,iEAAiE;YACjE,mDAAmD;YACnD,MAAM,QAAQ,GAAG,GAAG,aAAa,CAAC,MAAM,IAAI,EAAE,EAAE;iBAC7C,KAAK,CAAC,IAAI,CAAC;iBACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;iBACnC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;iBACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAE5D,IAAI,CAAC;gBACH,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;oBAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YACrD,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;gBACvB,mEAAmE;gBACnE,iEAAiE;gBACjE,gDAAgD;gBAChD,KAAK,MAAM,CAAC,IAAI,QAAQ;oBAAE,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;gBACtD,MAAM,IAAI,KAAK,CACb,GAAG,MAAM,KAAK;oBACZ,4EAA4E;oBAC5E,yEAAyE;oBACzE,yEAAyE;oBACzE,sEAAsE,CACzE,CAAC;YACJ,CAAC;YAED,OAAO,CAAC,IAAI,CAAC,SAAS,MAAM,gDAAgD,CAAC,CAAC;YAC9E,KAAK,MAAM,CAAC,IAAI,QAAQ;gBAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACvD,CAAC;aAAM,CAAC;YACN,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;YACnC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CACT,8EAA8E,CAC/E,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,8EAA8E;IAC9E,2EAA2E;IAC3E,iBAAiB;IACjB,MAAM,qBAAqB,GAAG,yBAAyB,CAAC,UAAU,CAAC,CAAC;IACpE,IAAI,IAAI,CAAC,MAAM,IAAI,qBAAqB,KAAK,IAAI,EAAE,CAAC;QAClD,OAAO,CAAC,IAAI,CAAC,mEAAmE,CAAC,CAAC;IACpF,CAAC;IAED,OAAO;QACL,UAAU;QACV,UAAU;QACV,MAAM,EAAE,UAAU,CAAC,UAAU,CAAC;QAC9B,cAAc,EAAE,qBAAqB,KAAK,IAAI;QAC9C,qBAAqB;KACtB,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,UAAU,CAAC,IAAY;IACrC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,MAAc,EAAE,EAAE;QAC3C,IAAI,OAAoB,CAAC;QACzB,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,mDAAmD;QAC7D,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;YAC5D,IAAI,KAAK,CAAC,WAAW,EAAE;gBAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;;gBAC1D,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACf,OAAO,GAAG,CAAC;AACb,CAAC"}

package/lib/utils/credentials.d.ts

@@ -8,7 +8,18 @@ export interface Credentials {
  *   2. ~/.scalebun/credentials.json (from `scalebun login`)
  */
 export declare function readCredentials(): Credentials | null;
-/** Store credentials to ~/.scalebun/credentials.json */
+/**
+ * Store credentials to ~/.scalebun/credentials.json.
+ *
+ * The `mode: 0o600` below is real on macOS and Linux and a NO-OP ON WINDOWS —
+ * Node cannot express a Windows ACL through a Unix mode, so it silently drops
+ * it and the file lands with whatever the parent directory grants. That is how
+ * a token ends up readable by every other account on a shared machine while
+ * the code looks like it locked the file down. So on Windows the ACL is set
+ * explicitly afterwards, and a failure to do so is reported rather than
+ * swallowed: the user is entitled to know their token is sitting in a
+ * world-readable file.
+ */
 export declare function writeCredentials(creds: Credentials): void;
 /** Delete stored credentials. */
 export declare function clearCredentials(): void;

package/lib/utils/credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/utils/credentials.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,wBAAgB,eAAe,IAAI,WAAW,GAAG,IAAI,CAkBpD;AAED,wDAAwD;AACxD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CASzD;AAED,iCAAiC;AACjC,wBAAgB,gBAAgB,IAAI,IAAI,CAIvC"}
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/utils/credentials.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,wBAAgB,eAAe,IAAI,WAAW,GAAG,IAAI,CAkBpD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CAUzD;AAgCD,iCAAiC;AACjC,wBAAgB,gBAAgB,IAAI,IAAI,CAIvC"}

package/lib/utils/credentials.js

@@ -39,6 +39,7 @@ exports.clearCredentials = clearCredentials;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const os = __importStar(require("os"));
+const childProcess = __importStar(require("child_process"));
 const CREDENTIALS_DIR = path.join(os.homedir(), '.scalebun');
 const CREDENTIALS_FILE = path.join(CREDENTIALS_DIR, 'credentials.json');
 /**
@@ -67,12 +68,50 @@ function readCredentials() {
         return null;
     }
 }
-/** Store credentials to ~/.scalebun/credentials.json */
+/**
+ * Store credentials to ~/.scalebun/credentials.json.
+ *
+ * The `mode: 0o600` below is real on macOS and Linux and a NO-OP ON WINDOWS —
+ * Node cannot express a Windows ACL through a Unix mode, so it silently drops
+ * it and the file lands with whatever the parent directory grants. That is how
+ * a token ends up readable by every other account on a shared machine while
+ * the code looks like it locked the file down. So on Windows the ACL is set
+ * explicitly afterwards, and a failure to do so is reported rather than
+ * swallowed: the user is entitled to know their token is sitting in a
+ * world-readable file.
+ */
 function writeCredentials(creds) {
     if (!fs.existsSync(CREDENTIALS_DIR)) {
         fs.mkdirSync(CREDENTIALS_DIR, { recursive: true, mode: 0o700 });
     }
     fs.writeFileSync(CREDENTIALS_FILE, JSON.stringify(creds, null, 2) + '\n', { mode: 0o600 });
+    restrictToCurrentUser(CREDENTIALS_FILE);
+}
+/**
+ * Windows-only ACL tightening: drop inherited ACEs and grant the current user
+ * alone full control. On POSIX the file mode already did this and this is a
+ * no-op.
+ */
+function restrictToCurrentUser(file) {
+    if (process.platform !== 'win32')
+        return;
+    const user = process.env.USERNAME
+        ? `${process.env.USERDOMAIN ? `${process.env.USERDOMAIN}\\` : ''}${process.env.USERNAME}`
+        : null;
+    if (!user)
+        return;
+    try {
+        // /inheritance:r removes inherited permissions — without it the grant is
+        // added ON TOP of whatever the profile directory already allows, which is
+        // usually the point being missed.
+        childProcess.execFileSync('icacls', [file, '/inheritance:r', '/grant:r', `${user}:F`], { stdio: 'ignore', timeout: 10000 });
+    }
+    catch {
+        console.warn(`⚠️  Could not restrict permissions on ${file}.\n` +
+            '   It contains an access token in plaintext and may be readable by other\n' +
+            '   accounts on this machine. Fix it with:\n' +
+            `   icacls "${file}" /inheritance:r /grant:r "%USERNAME%:F"`);
+    }
 }
 /** Delete stored credentials. */
 function clearCredentials() {

package/lib/utils/credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/utils/credentials.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiBA,0CAkBC;AAGD,4CASC;AAGD,4CAIC;AAtDD,uCAAyB;AACzB,2CAA6B;AAC7B,uCAAyB;AAEzB,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,CAAC,CAAC;AAC7D,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,kBAAkB,CAAC,CAAC;AAOxE;;;;GAIG;AACH,SAAgB,eAAe;IAC7B,oCAAoC;IACpC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC5C,IAAI,QAAQ,IAAI,MAAM,EAAE,CAAC;QACvB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IAC7C,CAAC;IAED,qCAAqC;IACrC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACjD,OAAO,MAAqB,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,wDAAwD;AACxD,SAAgB,gBAAgB,CAAC,KAAkB;IACjD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QACpC,EAAE,CAAC,SAAS,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,EAAE,CAAC,aAAa,CACd,gBAAgB,EAChB,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EACrC,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;AACJ,CAAC;AAED,iCAAiC;AACjC,SAAgB,gBAAgB;IAC9B,IAAI,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACpC,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;IAClC,CAAC;AACH,CAAC"}
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/utils/credentials.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkBA,0CAkBC;AAcD,4CAUC;AAiCD,4CAIC;AAjGD,uCAAyB;AACzB,2CAA6B;AAC7B,uCAAyB;AACzB,4DAA8C;AAE9C,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,CAAC,CAAC;AAC7D,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,kBAAkB,CAAC,CAAC;AAOxE;;;;GAIG;AACH,SAAgB,eAAe;IAC7B,oCAAoC;IACpC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC5C,IAAI,QAAQ,IAAI,MAAM,EAAE,CAAC;QACvB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IAC7C,CAAC;IAED,qCAAqC;IACrC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACjD,OAAO,MAAqB,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAgB,gBAAgB,CAAC,KAAkB;IACjD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QACpC,EAAE,CAAC,SAAS,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,EAAE,CAAC,aAAa,CACd,gBAAgB,EAChB,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EACrC,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;IACF,qBAAqB,CAAC,gBAAgB,CAAC,CAAC;AAC1C,CAAC;AAED;;;;GAIG;AACH,SAAS,qBAAqB,CAAC,IAAY;IACzC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO;IACzC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ;QAC/B,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE;QACzF,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,CAAC,IAAI;QAAE,OAAO;IAClB,IAAI,CAAC;QACH,yEAAyE;QACzE,0EAA0E;QAC1E,kCAAkC;QAClC,YAAY,CAAC,YAAY,CACvB,QAAQ,EACR,CAAC,IAAI,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,IAAI,IAAI,CAAC,EACjD,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAM,EAAE,CACrC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,IAAI,CACV,yCAAyC,IAAI,KAAK;YAChD,4EAA4E;YAC5E,6CAA6C;YAC7C,cAAc,IAAI,0CAA0C,CAC/D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,iCAAiC;AACjC,SAAgB,gBAAgB;IAC9B,IAAI,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACpC,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;IAClC,CAAC;AACH,CAAC"}

package/lib/utils/transportSecurity.d.ts

@@ -0,0 +1,36 @@
+/**
+ * HTTPS enforcement for everything the CLI authenticates to.
+ *
+ * WHAT WAS WRONG. The API client picked its transport straight off the URL
+ * scheme — `parsed.protocol === 'https:' ? https : http` — with nothing
+ * requiring HTTPS in the first place, and every request attaches
+ * `Authorization: Bearer <token>`. `scalebun login` accepts an arbitrary
+ * `--api-url` and POSTs an email and password to it. So a CLI pointed at an
+ * `http://` URL — by a typo, a copied CI snippet, or a tampered config —
+ * would put a personal access token, or the user's actual password, on the
+ * wire in cleartext, with no warning and no failure.
+ *
+ * THE RULE. Credentials only travel over TLS. The single exception is
+ * loopback, because local development against `http://localhost:3000` is a
+ * real workflow and traffic that never leaves the machine cannot be
+ * intercepted on the network. Anything else is refused before a socket is
+ * opened, rather than warned about — a warning printed above a successful
+ * request is not a control.
+ *
+ * Loopback is matched on resolved literals, not on name. `localhost` and the
+ * reserved 127/8 and ::1 literals are loopback by definition; an arbitrary
+ * hostname that merely happens to resolve to 127.0.0.1 today is not, because
+ * whoever controls the DNS answer controls where the token goes tomorrow.
+ */
+export declare class InsecureApiUrlError extends Error {
+    constructor(url: string, hostname: string);
+}
+/**
+ * Validate an API base URL before it is used or persisted.
+ *
+ * @returns the normalised URL (trailing slashes stripped)
+ * @throws InsecureApiUrlError for a non-loopback `http://` URL
+ * @throws Error for a URL that is malformed or uses a non-HTTP scheme
+ */
+export declare function assertSecureApiUrl(rawUrl: string): string;
+//# sourceMappingURL=transportSecurity.d.ts.map

package/lib/utils/transportSecurity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transportSecurity.d.ts","sourceRoot":"","sources":["../../src/utils/transportSecurity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAYH,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;CAW1C;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAkBzD"}