@scalebun/cli 1.10.1 → 1.11.0

package/lib/commands/ota-inspect.js

@@ -0,0 +1,258 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerOtaInspectCommands = registerOtaInspectCommands;
+const chalk_1 = __importDefault(require("chalk"));
+const client_1 = require("../api/client");
+const validate_1 = require("../utils/validate");
+const output_1 = require("../utils/output");
+/** Kept beside the flags that accept them so the help text cannot drift. */
+const PLATFORMS = ['android', 'ios'];
+const BUNDLE_SORTS = ['newest', 'oldest', 'version', 'largest'];
+const credentials_1 = require("../utils/credentials");
+const resolve_1 = require("../utils/resolve");
+const context_1 = require("../utils/context");
+const output_2 = require("../utils/output");
+/** Decimal MB, defined once. The dashboard reported MiB on one tab and MB on
+ *  another, both labelled "MB", so the same bundle showed two sizes. */
+function mb(bytes) {
+    if (typeof bytes !== 'number')
+        return '—';
+    return `${(bytes / 1000000).toFixed(2)} MB`;
+}
+function age(iso) {
+    if (!iso)
+        return '—';
+    const ms = Date.now() - new Date(iso).getTime();
+    if (!Number.isFinite(ms) || ms < 0)
+        return '—';
+    const h = ms / 3600000;
+    if (h < 1)
+        return `${Math.max(1, Math.round(ms / 60000))}m`;
+    if (h < 48)
+        return `${Math.round(h)}h`;
+    return `${Math.round(h / 24)}d`;
+}
+/**
+ * One vocabulary for a rate, used everywhere.
+ *
+ * The dashboard rendered this five different ways — "no data", "not measured",
+ * "too early", a green "0.00% ✓" and a flat "0%". Two of those manufactured a
+ * passing grade out of zero installs. Three states only: a number, "collecting"
+ * below the floor, or a named reason.
+ */
+const RATE_FLOOR = 25;
+function rate(installs = 0, rollbacks = 0) {
+    if (installs === 0)
+        return chalk_1.default.dim('no installs');
+    if (installs < RATE_FLOOR)
+        return chalk_1.default.dim(`collecting · ${installs}/${RATE_FLOOR}`);
+    const pct = (rollbacks / installs) * 100;
+    const s = `${pct.toFixed(1)}%`;
+    return pct >= 5 ? chalk_1.default.red(s) : pct >= 2 ? chalk_1.default.yellow(s) : chalk_1.default.green(s);
+}
+function statusLabel(s) {
+    switch (s) {
+        case 'ACTIVE': return chalk_1.default.cyan('live');
+        case 'PAUSED': return chalk_1.default.yellow('paused');
+        case 'ROLLED_BACK': return chalk_1.default.red('rolled back');
+        // Superseded is the NORMAL end of every release, so it is never coloured
+        // like a failure. Painting it red made 7 of 8 rows look like disasters.
+        case 'SUPERSEDED': return chalk_1.default.dim('superseded');
+        default: return chalk_1.default.dim(s.toLowerCase());
+    }
+}
+function registerOtaInspectCommands(ota) {
+    // ── ota bundles ───────────────────────────────────────────────────────────
+    ota
+        .command('bundles')
+        .alias('bundle-list')
+        .description('List uploaded bundles — the only way to learn a --bundle-id')
+        .option('--app-id <id>', 'Scalebun app ID (resolved from scalebun.json when omitted)')
+        .option('--platform <p>', 'ios | android')
+        .option('--signed <v>', 'signed | unsigned')
+        .option('--search <q>', 'Match version, hash or note')
+        .option('--sort <s>', 'newest | oldest | version | largest', 'newest')
+        .option('--limit <n>', 'How many to show', '20')
+        .option('--latest', 'Print only the newest bundle id, for scripting')
+        .option('--json', 'Machine-readable output')
+        .action(async (opts) => {
+        const creds = (0, credentials_1.readCredentials)();
+        if (!creds)
+            (0, output_2.fail)('Not signed in.', ['Run `scalebun login`.'], output_2.ExitCode.Usage);
+        const appId = await (0, resolve_1.resolveAppId)({ appId: opts.appId, nonInteractive: opts.json });
+        // Everything is checked BEFORE the round trip: a typo should cost a
+        // second, not a request. (--limit was validated after the fetch, so junk
+        // still paid for the network.)
+        const limit = (0, validate_1.checkedInt)('--limit', opts.limit, { min: 1, max: 1000, fallback: 20 });
+        // Every one of these was forwarded to the API verbatim. A typo did not
+        // fail — it produced a filtered list that looked authoritative, which is
+        // the worst outcome for a command whose whole job is telling you what
+        // exists.
+        const qs = new URLSearchParams();
+        if (opts.platform)
+            qs.set('platform', (0, validate_1.checkedEnum)('--platform', opts.platform, PLATFORMS, { caseInsensitive: true }));
+        if (opts.signed)
+            qs.set('signed', (0, validate_1.checkedEnum)('--signed', opts.signed, ['signed', 'unsigned'], { caseInsensitive: true }));
+        if (opts.search)
+            qs.set('search', opts.search);
+        if (opts.sort)
+            qs.set('sort', (0, validate_1.checkedEnum)('--sort', opts.sort, BUNDLE_SORTS, { caseInsensitive: true }));
+        let rows;
+        try {
+            const res = await new client_1.ApiClient(creds).get(`/saas/apps/${appId}/ota/bundles${qs.toString() ? `?${qs}` : ''}`);
+            // The endpoint returns a plain array without `page` and an envelope
+            // with it — accept both rather than pinning one shape.
+            rows = Array.isArray(res) ? res : (res?.rows ?? []);
+        }
+        catch (err) {
+            (0, output_2.failFromError)('Could not list bundles', err);
+        }
+        const shown = rows.slice(0, limit);
+        // --latest exists so a pipeline can do the thing that was impossible:
+        //   BUNDLE=$(scalebun ota bundles --latest)
+        if (opts.latest) {
+            const newest = shown[0];
+            if (!newest)
+                (0, output_2.fail)('No bundles on this app.', [], output_2.ExitCode.Usage);
+            (0, output_2.emit)(() => console.log(newest.id), { ok: true, bundleId: newest.id, version: newest.version ?? null });
+            return;
+        }
+        (0, output_2.emit)(() => {
+            if (!shown.length) {
+                console.log('\nNo bundles match.');
+                // The early return skipped the block at the end of this function,
+                // so the empty state — the one place a next step is worth most,
+                // because there is nothing on screen to act on — offered nothing.
+                (0, output_1.printNextSteps)([{ label: 'Build and ship one', argv: ['ota', 'publish'] }], chalk_1.default.cyan);
+                return;
+            }
+            console.log('');
+            for (const b of shown) {
+                const v = b.version != null ? `v${b.version}` : b.id.slice(0, 8);
+                const sig = b.signature ? chalk_1.default.green('signed') : chalk_1.default.yellow('unsigned');
+                console.log(`  ${chalk_1.default.bold(v.padEnd(6))} ${chalk_1.default.dim((b.platform ?? '?').padEnd(8))} ` +
+                    `${mb(b.sizeBytes).padStart(9)}  ${sig.padEnd(18)} ${chalk_1.default.dim(age(b.createdAt).padStart(4))}  ${chalk_1.default.dim(b.id)}`);
+            }
+            if (rows.length > shown.length) {
+                console.log(chalk_1.default.dim(`\n  ${rows.length - shown.length} more — raise --limit to see them.`));
+            }
+            console.log('');
+            // This list exists to find something to promote — its own help text
+            // calls it "the only way to learn a --bundle-id". The empty case
+            // returned above, so there is nothing to branch on here.
+            (0, output_1.printNextSteps)([
+                { label: 'Make one live', argv: ['ota', 'promote'] },
+                { label: 'See what is live', argv: ['ota', 'status'] },
+            ], chalk_1.default.cyan);
+        }, { ok: true, count: shown.length, total: rows.length, bundles: shown });
+    });
+    // ── ota status ────────────────────────────────────────────────────────────
+    ota
+        .command('status')
+        .description('What is live, and what needs a decision')
+        .option('--app-id <id>', 'Scalebun app ID (resolved from scalebun.json when omitted)')
+        .option('--fail-on <level>', 'Exit 3 when an item at this level exists: act | read')
+        .option('--json', 'Machine-readable output')
+        .action(async (opts) => {
+        // Checked here rather than where it is used, at the bottom of the action:
+        // a typo used to disable the gate silently — `--fail-on acts` matched no
+        // branch, the command exited 0, and the pipeline went green having
+        // checked nothing. A gate that a typo can switch off is not a gate. And
+        // validating up here means the whole report is not printed before the
+        // usage error that invalidates it.
+        const failOn = opts.failOn
+            ? (0, validate_1.checkedEnum)('--fail-on', opts.failOn, ['act', 'read'], { caseInsensitive: true })
+            : undefined;
+        const creds = (0, credentials_1.readCredentials)();
+        if (!creds)
+            (0, output_2.fail)('Not signed in.', ['Run `scalebun login`.'], output_2.ExitCode.Usage);
+        const appId = await (0, resolve_1.resolveAppId)({ appId: opts.appId, nonInteractive: opts.json });
+        const client = new client_1.ApiClient(creds);
+        // Composed from endpoints that already exist. Attention evaluates guards
+        // DRY, so asking for status can never pause a live release.
+        const [releases, attention] = await Promise.all([
+            client.get(`/saas/apps/${appId}/ota/releases`).catch(() => []),
+            client.get(`/saas/apps/${appId}/ota/attention`).catch(() => null),
+        ]);
+        // Any command that fetched releases refreshes the cache the splash reads.
+        if (Array.isArray(releases))
+            (0, context_1.cacheReleaseCount)(releases.length, process.cwd());
+        const live = (releases ?? []).filter((r) => r.status === 'ACTIVE');
+        const items = attention?.items ?? [];
+        const actItems = items.filter((i) => i.severity === 'act');
+        (0, output_2.emit)(() => {
+            console.log('');
+            if (!live.length) {
+                console.log(chalk_1.default.dim('  Nothing is live on this app.'));
+            }
+            for (const r of live) {
+                const v = r.bundle?.version != null ? `v${r.bundle.version}` : r.id.slice(0, 8);
+                const s = r.stats ?? {};
+                console.log(`  ${chalk_1.default.bold(v)} ${statusLabel(r.status)} ${chalk_1.default.dim('@')} ${chalk_1.default.bold(`${r.rolloutPercent ?? 0}%`)}` +
+                    chalk_1.default.dim(`  ${r.bundle?.platform ?? ''} · ${r.bundle?.channel?.name ?? 'default'} · ${age(r.createdAt)} old`));
+                console.log(chalk_1.default.dim(`     installs `) + String(s.installs ?? 0).padEnd(8) +
+                    chalk_1.default.dim('rollback rate ') + rate(s.installs, s.rollbacks));
+            }
+            console.log('');
+            if (!attention) {
+                console.log(chalk_1.default.yellow('  Could not evaluate what needs a decision.'));
+            }
+            else {
+                const g = attention.guards;
+                if (g) {
+                    // NEVER collapse an unevaluated guard into "0 breaching" — an app
+                    // that was not measured has not been found clean.
+                    const breach = g.evaluated
+                        ? `${g.breaching ?? 0} breaching`
+                        : chalk_1.default.dim(`not evaluated${g.reason ? ` (${g.reason})` : ''}`);
+                    console.log(chalk_1.default.dim(`  guards  ${g.armed} armed · ${breach}`));
+                }
+                if (!items.length) {
+                    console.log(chalk_1.default.green('  Nothing needs a decision.'));
+                }
+                else {
+                    for (const i of items) {
+                        const tag = i.severity === 'act' ? chalk_1.default.yellow('act ') : chalk_1.default.dim('read');
+                        console.log(`  ${tag}  ${i.title}`);
+                        if (i.facts?.length)
+                            console.log(chalk_1.default.dim(`        ${i.facts.join(' · ')}`));
+                    }
+                }
+            }
+            // Offer the levers that match the state. With a release live these
+            // are the three things you can do about it; with nothing live the
+            // only honest suggestion is to ship something.
+            (0, output_1.printNextSteps)(live.length
+                ? [
+                    { label: 'Change the share', argv: ['ota', 'rollout', '--percent', '100'] },
+                    { label: 'Stop new deliveries', argv: ['ota', 'pause'] },
+                    { label: 'Revert every device', argv: ['ota', 'rollback'] },
+                ]
+                : [{ label: 'Ship an update', argv: ['ota', 'publish'] }], chalk_1.default.cyan);
+        }, {
+            ok: true,
+            live: live.map((r) => ({
+                id: r.id, version: r.bundle?.version ?? null,
+                rolloutPercent: r.rolloutPercent ?? 0, stats: r.stats ?? {},
+            })),
+            guards: attention?.guards ?? null,
+            attention: items,
+        });
+        // --fail-on turns status into a CI gate. Exit 3 is "a check you asked for
+        // said no" — distinct from a 4xx (2) and from the API being down (4).
+        if (failOn === 'act' && actItems.length) {
+            if (!(0, output_2.isJson)())
+                console.error(chalk_1.default.yellow(`  ${actItems.length} decision(s) waiting.`));
+            process.exit(output_2.ExitCode.Gate);
+        }
+        if (failOn === 'read' && items.length) {
+            if (!(0, output_2.isJson)())
+                console.error(chalk_1.default.yellow(`  ${items.length} item(s) to review.`));
+            process.exit(output_2.ExitCode.Gate);
+        }
+    });
+}
+//# sourceMappingURL=ota-inspect.js.map

package/lib/commands/ota-inspect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ota-inspect.js","sourceRoot":"","sources":["../../src/commands/ota-inspect.ts"],"names":[],"mappings":";;;;;AA6GA,gEAkNC;AA9TD,kDAA0B;AAC1B,0CAA0C;AAC1C,gDAA4D;AAC5D,4CAAiD;AAEjD,4EAA4E;AAC5E,MAAM,SAAS,GAAG,CAAC,SAAS,EAAE,KAAK,CAAU,CAAC;AAC9C,MAAM,YAAY,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAU,CAAC;AACzE,sDAAuD;AACvD,8CAAgD;AAChD,8CAAqD;AACrD,4CAA8E;AAmD9E;wEACwE;AACxE,SAAS,EAAE,CAAC,KAAc;IACxB,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IAC1C,OAAO,GAAG,CAAC,KAAK,GAAG,OAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;AAChD,CAAC;AAED,SAAS,GAAG,CAAC,GAAY;IACvB,IAAI,CAAC,GAAG;QAAE,OAAO,GAAG,CAAC;IACrB,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;IAChD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IAC/C,MAAM,CAAC,GAAG,EAAE,GAAG,OAAS,CAAC;IACzB,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,KAAM,CAAC,CAAC,GAAG,CAAC;IAC7D,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC;IACvC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC;AAClC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,SAAS,IAAI,CAAC,QAAQ,GAAG,CAAC,EAAE,SAAS,GAAG,CAAC;IACvC,IAAI,QAAQ,KAAK,CAAC;QAAE,OAAO,eAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACpD,IAAI,QAAQ,GAAG,UAAU;QAAE,OAAO,eAAK,CAAC,GAAG,CAAC,gBAAgB,QAAQ,IAAI,UAAU,EAAE,CAAC,CAAC;IACtF,MAAM,GAAG,GAAG,CAAC,SAAS,GAAG,QAAQ,CAAC,GAAG,GAAG,CAAC;IACzC,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC;IAC/B,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,eAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,eAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,eAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,WAAW,CAAC,CAAS;IAC5B,QAAQ,CAAC,EAAE,CAAC;QACV,KAAK,QAAQ,CAAC,CAAC,OAAO,eAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzC,KAAK,QAAQ,CAAC,CAAC,OAAO,eAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC7C,KAAK,aAAa,CAAC,CAAC,OAAO,eAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACpD,yEAAyE;QACzE,wEAAwE;QACxE,KAAK,YAAY,CAAC,CAAC,OAAO,eAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAClD,OAAO,CAAC,CAAC,OAAO,eAAK,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC;AAED,SAAgB,0BAA0B,CAAC,GAAY;IACrD,6EAA6E;IAC7E,GAAG;SACA,OAAO,CAAC,SAAS,CAAC;SAClB,KAAK,CAAC,aAAa,CAAC;SACpB,WAAW,CAAC,6DAA6D,CAAC;SAC1E,MAAM,CAAC,eAAe,EAAE,4DAA4D,CAAC;SACrF,MAAM,CAAC,gBAAgB,EAAE,eAAe,CAAC;SACzC,MAAM,CAAC,cAAc,EAAE,mBAAmB,CAAC;SAC3C,MAAM,CAAC,cAAc,EAAE,6BAA6B,CAAC;SACrD,MAAM,CAAC,YAAY,EAAE,qCAAqC,EAAE,QAAQ,CAAC;SACrE,MAAM,CAAC,aAAa,EAAE,kBAAkB,EAAE,IAAI,CAAC;SAC/C,MAAM,CAAC,UAAU,EAAE,gDAAgD,CAAC;SACpE,MAAM,CAAC,QAAQ,EAAE,yBAAyB,CAAC;SAC3C,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,KAAK,GAAG,IAAA,6BAAe,GAAE,CAAC;QAChC,IAAI,CAAC,KAAK;YAAE,IAAA,aAAI,EAAC,gBAAgB,EAAE,CAAC,uBAAuB,CAAC,EAAE,iBAAQ,CAAC,KAAK,CAAC,CAAC;QAC9E,MAAM,KAAK,GAAG,MAAM,IAAA,sBAAY,EAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,cAAc,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAEnF,oEAAoE;QACpE,yEAAyE;QACzE,+BAA+B;QAC/B,MAAM,KAAK,GAAG,IAAA,qBAAU,EAAC,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;QAErF,uEAAuE;QACvE,yEAAyE;QACzE,sEAAsE;QACtE,UAAU;QACV,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;QACjC,IAAI,IAAI,CAAC,QAAQ;YAAE,EAAE,CAAC,GAAG,CAAC,UAAU,EAAE,IAAA,sBAAW,EAAC,YAAY,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACtH,IAAI,IAAI,CAAC,MAAM;YAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAA,sBAAW,EAAC,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,UAAU,CAAU,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACpI,IAAI,IAAI,CAAC,MAAM;YAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,IAAI,CAAC,IAAI;YAAE,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,IAAA,sBAAW,EAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAEzG,IAAI,IAAiB,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,kBAAS,CAAC,KAAM,CAAC,CAAC,GAAG,CACzC,cAAc,KAAK,eAAe,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAClE,CAAC;YACF,oEAAoE;YACpE,uDAAuD;YACvD,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAA,sBAAa,EAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,KAAK,GAAG,IAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAEpC,sEAAsE;QACtE,4CAA4C;QAC5C,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,CAAC,MAAM;gBAAE,IAAA,aAAI,EAAC,yBAAyB,EAAE,EAAE,EAAE,iBAAQ,CAAC,KAAK,CAAC,CAAC;YACjE,IAAA,aAAI,EAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAO,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAO,CAAC,EAAE,EAAE,OAAO,EAAE,MAAO,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC,CAAC;YAC1G,OAAO;QACT,CAAC;QAED,IAAA,aAAI,EACF,GAAG,EAAE;YACH,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;gBAClB,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;gBACnC,kEAAkE;gBAClE,gEAAgE;gBAChE,kEAAkE;gBAClE,IAAA,uBAAc,EAAC,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC,EAAE,eAAK,CAAC,IAAI,CAAC,CAAC;gBACxF,OAAO;YACT,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;gBACtB,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBACjE,MAAM,GAAG,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,eAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;gBAC3E,OAAO,CAAC,GAAG,CACT,KAAK,eAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,eAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG;oBACzE,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,eAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,eAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CACrH,CAAC;YACJ,CAAC;YACD,IAAI,IAAK,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;gBAChC,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,GAAG,CAAC,OAAO,IAAK,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,oCAAoC,CAAC,CAAC,CAAC;YACjG,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,oEAAoE;YACpE,iEAAiE;YACjE,yDAAyD;YACzD,IAAA,uBAAc,EACZ;gBACE,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE;gBACpD,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE;aACvD,EACD,eAAK,CAAC,IAAI,CACX,CAAC;QACJ,CAAC,EACD,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,IAAK,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CACvE,CAAC;IACJ,CAAC,CAAC,CAAC;IAEL,6EAA6E;IAC7E,GAAG;SACA,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,yCAAyC,CAAC;SACtD,MAAM,CAAC,eAAe,EAAE,4DAA4D,CAAC;SACrF,MAAM,CAAC,mBAAmB,EAAE,sDAAsD,CAAC;SACnF,MAAM,CAAC,QAAQ,EAAE,yBAAyB,CAAC;SAC3C,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,0EAA0E;QAC1E,yEAAyE;QACzE,mEAAmE;QACnE,wEAAwE;QACxE,sEAAsE;QACtE,mCAAmC;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM;YACxB,CAAC,CAAC,IAAA,sBAAW,EAAC,WAAW,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,CAAU,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;YAC5F,CAAC,CAAC,SAAS,CAAC;QAEd,MAAM,KAAK,GAAG,IAAA,6BAAe,GAAE,CAAC;QAChC,IAAI,CAAC,KAAK;YAAE,IAAA,aAAI,EAAC,gBAAgB,EAAE,CAAC,uBAAuB,CAAC,EAAE,iBAAQ,CAAC,KAAK,CAAC,CAAC;QAC9E,MAAM,KAAK,GAAG,MAAM,IAAA,sBAAY,EAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,cAAc,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACnF,MAAM,MAAM,GAAG,IAAI,kBAAS,CAAC,KAAM,CAAC,CAAC;QAErC,yEAAyE;QACzE,4DAA4D;QAC5D,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC9C,MAAM,CAAC,GAAG,CAAe,cAAc,KAAK,eAAe,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAkB,CAAC;YAC5F,MAAM,CAAC,GAAG,CAAkB,cAAc,KAAK,gBAAgB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;SACnF,CAAC,CAAC;QAEH,0EAA0E;QAC1E,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;YAAE,IAAA,2BAAiB,EAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAE/E,MAAM,IAAI,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;QACnE,MAAM,KAAK,GAAG,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC;QAE3D,IAAA,aAAI,EACF,GAAG,EAAE;YACH,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACjB,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC,CAAC;YAC3D,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;gBACrB,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBAChF,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACxB,OAAO,CAAC,GAAG,CACT,KAAK,eAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,eAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,eAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,cAAc,IAAI,CAAC,GAAG,CAAC,EAAE;oBACxG,eAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,QAAQ,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,IAAI,SAAS,MAAM,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CACjH,CAAC;gBACF,OAAO,CAAC,GAAG,CACT,eAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;oBAC7D,eAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,SAAS,CAAC,CAC9D,CAAC;YACJ,CAAC;YAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,MAAM,CAAC,6CAA6C,CAAC,CAAC,CAAC;YAC3E,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC;gBAC3B,IAAI,CAAC,EAAE,CAAC;oBACN,kEAAkE;oBAClE,kDAAkD;oBAClD,MAAM,MAAM,GAAG,CAAC,CAAC,SAAS;wBACxB,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,IAAI,CAAC,YAAY;wBACjC,CAAC,CAAC,eAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBAClE,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,KAAK,YAAY,MAAM,EAAE,CAAC,CAAC,CAAC;gBACnE,CAAC;gBACD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;oBAClB,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC,CAAC;gBAC1D,CAAC;qBAAM,CAAC;oBACN,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;wBACtB,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,eAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,eAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;wBAC5E,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;wBACpC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM;4BAAE,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;oBAChF,CAAC;gBACH,CAAC;YACH,CAAC;YACD,mEAAmE;YACnE,kEAAkE;YAClE,+CAA+C;YAC/C,IAAA,uBAAc,EACZ,IAAI,CAAC,MAAM;gBACT,CAAC,CAAC;oBACE,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC,EAAE;oBAC3E,EAAE,KAAK,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE;oBACxD,EAAE,KAAK,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE;iBAC5D;gBACH,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC,EAC3D,eAAK,CAAC,IAAI,CACX,CAAC;QACJ,CAAC,EACD;YACE,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACrB,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,IAAI,IAAI;gBAC5C,cAAc,EAAE,CAAC,CAAC,cAAc,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE;aAC5D,CAAC,CAAC;YACH,MAAM,EAAE,SAAS,EAAE,MAAM,IAAI,IAAI;YACjC,SAAS,EAAE,KAAK;SACjB,CACF,CAAC;QAEF,0EAA0E;QAC1E,sEAAsE;QACtE,IAAI,MAAM,KAAK,KAAK,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;YACxC,IAAI,CAAC,IAAA,eAAM,GAAE;gBAAE,OAAO,CAAC,KAAK,CAAC,eAAK,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,MAAM,uBAAuB,CAAC,CAAC,CAAC;YACxF,OAAO,CAAC,IAAI,CAAC,iBAAQ,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC;QACD,IAAI,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACtC,IAAI,CAAC,IAAA,eAAM,GAAE;gBAAE,OAAO,CAAC,KAAK,CAAC,eAAK,CAAC,MAAM,CAAC,KAAK,KAAK,CAAC,MAAM,qBAAqB,CAAC,CAAC,CAAC;YACnF,OAAO,CAAC,IAAI,CAAC,iBAAQ,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/lib/commands/ota-keys.d.ts

@@ -1,5 +1,23 @@
 import { Command } from 'commander';
 import * as crypto from 'crypto';
+/**
+ * Keep the private key out of version control WITHOUT relying on the operator
+ * reading a warning. The previous behaviour printed "NEVER commit this — add
+ * .scalebun/ to .gitignore" and stopped; anyone who scrolled past that line
+ * committed their signing key, and a signing key in git history is compromised
+ * even after the file is deleted.
+ *
+ * Rules, in order of caution:
+ *   - Only the key's directory relative to cwd can be ignored by cwd's
+ *     .gitignore; if --out points outside the project, we cannot help — report
+ *     the manual step instead of writing a useless entry.
+ *   - An existing .gitignore is appended to, never rewritten.
+ *   - A missing .gitignore is created only when cwd is actually a git repo
+ *     (a `.git` entry exists) — creating one in a non-repo would be litter.
+ *
+ * @returns a human-readable sentence describing what happened, for the summary.
+ */
+export declare function ensureKeyDirGitignored(outDir: string, cwd?: string): string;
 /** Hex-encoded raw 32-byte ed25519 public key from a Node KeyObject. */
 export declare function rawPublicKeyHex(publicKey: crypto.KeyObject): string;
 export declare function registerOtaKeysCommand(ota: Command): void;

package/lib/commands/ota-keys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ota-keys.d.ts","sourceRoot":"","sources":["../../src/commands/ota-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AA+BjC,wEAAwE;AACxE,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,GAAG,MAAM,CAInE;AAED,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CA0JzD;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,GACd,MAAM,GAAG,IAAI,CAcf"}
+{"version":3,"file":"ota-keys.d.ts","sourceRoot":"","sources":["../../src/commands/ota-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AA2BjC;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,GAAE,MAAsB,GAAG,MAAM,CA8B1F;AAUD,wEAAwE;AACxE,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,GAAG,MAAM,CAInE;AAED,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAwQzD;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,GACd,MAAM,GAAG,IAAI,CAcf"}

package/lib/commands/ota-keys.js

@@ -32,14 +32,22 @@ var __importStar = (this && this.__importStar) || (function () {
         return result;
     };
 })();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.ensureKeyDirGitignored = ensureKeyDirGitignored;
 exports.rawPublicKeyHex = rawPublicKeyHex;
 exports.registerOtaKeysCommand = registerOtaKeysCommand;
 exports.signBundleHash = signBundleHash;
 const crypto = __importStar(require("crypto"));
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
+const chalk_1 = __importDefault(require("chalk"));
 const credentials_1 = require("../utils/credentials");
+const resolve_1 = require("../utils/resolve");
+const prompt_1 = require("../utils/prompt");
+const output_1 = require("../utils/output");
 const client_1 = require("../api/client");
 /**
  * Bundle signing keys (OTA-03).
@@ -56,6 +64,55 @@ const client_1 = require("../api/client");
  */
 const KEY_DIR = '.scalebun';
 const PRIVATE_KEY_FILE = 'ota-signing-key.pem';
+/**
+ * Keep the private key out of version control WITHOUT relying on the operator
+ * reading a warning. The previous behaviour printed "NEVER commit this — add
+ * .scalebun/ to .gitignore" and stopped; anyone who scrolled past that line
+ * committed their signing key, and a signing key in git history is compromised
+ * even after the file is deleted.
+ *
+ * Rules, in order of caution:
+ *   - Only the key's directory relative to cwd can be ignored by cwd's
+ *     .gitignore; if --out points outside the project, we cannot help — report
+ *     the manual step instead of writing a useless entry.
+ *   - An existing .gitignore is appended to, never rewritten.
+ *   - A missing .gitignore is created only when cwd is actually a git repo
+ *     (a `.git` entry exists) — creating one in a non-repo would be litter.
+ *
+ * @returns a human-readable sentence describing what happened, for the summary.
+ */
+function ensureKeyDirGitignored(outDir, cwd = process.cwd()) {
+    const rel = path.relative(cwd, outDir);
+    if (rel === '' || rel.startsWith('..') || path.isAbsolute(rel)) {
+        return `outside this project — add ${outDir} to that location's .gitignore yourself`;
+    }
+    // Normalise to forward slashes: gitignore patterns use `/` on every platform.
+    const entry = rel.split(path.sep).join('/') + '/';
+    const gitignorePath = path.join(cwd, '.gitignore');
+    try {
+        if (fs.existsSync(gitignorePath)) {
+            const lines = fs.readFileSync(gitignorePath, 'utf8').split(/\r?\n/);
+            const covered = lines.some((l) => {
+                const t = l.trim();
+                return t === entry || t === entry.slice(0, -1) || t === '/' + entry || t === '/' + entry.slice(0, -1);
+            });
+            if (covered)
+                return `already ignored by .gitignore (${entry})`;
+            const body = fs.readFileSync(gitignorePath, 'utf8');
+            const sep = body.length === 0 || body.endsWith('\n') ? '' : '\n';
+            fs.appendFileSync(gitignorePath, `${sep}\n# ScaleBun OTA signing key — never commit\n${entry}\n`);
+            return `added ${entry} to .gitignore`;
+        }
+        if (fs.existsSync(path.join(cwd, '.git'))) {
+            fs.writeFileSync(gitignorePath, `# ScaleBun OTA signing key — never commit\n${entry}\n`);
+            return `created .gitignore with ${entry}`;
+        }
+        return `no git repo detected — if you version this directory, ignore ${entry}`;
+    }
+    catch (err) {
+        return `could not update .gitignore (${err?.message ?? err}) — add ${entry} yourself`;
+    }
+}
 /** Hex-encoded raw 32-byte ed25519 public key from a Node KeyObject. */
 function rawPublicKeyHex(publicKey) {
     // SPKI for ed25519 is a fixed 12-byte header followed by the 32-byte key.
@@ -82,12 +139,19 @@ function registerOtaKeysCommand(ota) {
         const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519');
         fs.mkdirSync(outDir, { recursive: true });
         fs.writeFileSync(privatePath, privateKey.export({ type: 'pkcs8', format: 'pem' }), 
-        // Owner read/write only. Irrelevant on Windows, correct everywhere else.
+        // Owner read/write only on POSIX. On Windows Node silently DROPS this
+        // mode, so the explicit ACL below is what actually protects the key
+        // there — the same treatment the credentials file already gets. A
+        // signing key with weaker protection than the login token would be
+        // backwards: this file is what proves your code is yours.
         { mode: 0o600 });
+        (0, credentials_1.restrictToCurrentUser)(privatePath, 'your OTA signing private key');
+        const gitignoreOutcome = ensureKeyDirGitignored(outDir);
         const publicHex = rawPublicKeyHex(publicKey);
         console.log(`\n🔑 ed25519 signing keypair generated.\n`);
         console.log(`  Private key : ${privatePath}`);
-        console.log(`                NEVER commit this. Add ${KEY_DIR}/ to .gitignore.`);
+        console.log(`                NEVER commit or share this file.`);
+        console.log(`  Git         : ${gitignoreOutcome}`);
         console.log(`  Public key  : ${publicHex}\n`);
         if (opts.appId) {
             const creds = (0, credentials_1.readCredentials)();
@@ -114,14 +178,24 @@ function registerOtaKeysCommand(ota) {
         else {
             console.log('ℹ️  Pass --app-id to register the public key automatically.\n');
         }
-        console.log('Next: embed the PUBLIC key in your app and enforce it at init:\n');
+        // This used to print `verifySignature: myEd25519Verifier` — a
+        // placeholder that left every adopter to hand-write ~100 lines of
+        // crypto plumbing for the most security-critical path in the product.
+        // The SDK now ships that verifier; all the developer owes is one
+        // install and the pinned key.
+        console.log('Next: install the verifier peers (once per app):\n');
+        console.log('  npm install @noble/ed25519 @noble/hashes\n');
+        console.log('Then embed the PUBLIC key in your app and enforce it at init:\n');
         console.log('  ScaleBun.init({');
         console.log('    // …');
         console.log('    ota: {');
+        console.log('      enabled: true,');
         console.log(`      publicSigningKey: '${publicHex}',`);
-        console.log('      verifySignature: myEd25519Verifier,');
         console.log('    },');
         console.log('  })\n');
+        console.log('The SDK verifies every bundle against that key and REFUSES any update\n' +
+            'that does not match. Supply `ota.verifySignature` only if you need to\n' +
+            'override it — your own function always takes precedence.\n');
     });
     ota
         .command('register-key')
@@ -169,6 +243,7 @@ function registerOtaKeysCommand(ota) {
             for (const k of keys) {
                 const state = k.revokedAt ? 'REVOKED' : 'active';
                 console.log(`  • ${(k.name ?? 'unnamed').padEnd(20)} ${state.padEnd(8)} ${k.publicKey.slice(0, 16)}…`);
+                console.log(`    ${k.id}`);
             }
             console.log('');
         }
@@ -177,6 +252,76 @@ function registerOtaKeysCommand(ota) {
             process.exit(1);
         }
     });
+    /**
+     * `scalebun ota keys revoke` — the missing half of the state above.
+     *
+     * `ota keys` has always RENDERED a `REVOKED` state that the CLI itself could
+     * never produce: the route existed and was role-gated, and only the dashboard
+     * could reach it. Key compromise is the one signing operation that is
+     * time-critical, and a key ceremony typically runs from a hardened box with
+     * no browser session — so "open the dashboard" is exactly the wrong answer.
+     *
+     * Revocation is a soft delete server-side: the row survives for the audit
+     * trail, which is why this is a POST to /revoke and not a DELETE.
+     */
+    ota
+        .command('revoke-key')
+        .description('Revoke a signing key — bundles signed with it stop verifying')
+        .requiredOption('--key-id <id>', 'Signing key to revoke (from `scalebun ota keys`)')
+        .option('--app-id <id>', 'Scalebun app ID (resolved from scalebun.json when omitted)')
+        .option('--yes', 'Skip the confirmation (required off a TTY)')
+        .option('--json', 'Machine-readable output')
+        .action(async (opts) => {
+        const creds = (0, credentials_1.readCredentials)();
+        if (!creds)
+            (0, output_1.fail)('Not signed in.', ['Run `scalebun login` first.'], output_1.ExitCode.Usage);
+        const appId = await (0, resolve_1.resolveAppId)({ appId: opts.appId, nonInteractive: opts.json });
+        const client = new client_1.ApiClient(creds);
+        let keys;
+        try {
+            keys = await client.get(`/saas/apps/${appId}/ota/signing-keys`);
+        }
+        catch (err) {
+            (0, output_1.failFromError)('Could not list signing keys', err);
+        }
+        const target = (keys ?? []).find((k) => k.id === opts.keyId);
+        if (!target) {
+            (0, output_1.fail)(`No signing key ${opts.keyId} on this app.`, (keys ?? []).map((k) => `  ${k.id}  ${k.name ?? 'unnamed'}`), output_1.ExitCode.Usage);
+        }
+        if (target.revokedAt) {
+            // Already revoked is not a failure — a rotation script re-running must
+            // not fail the pipeline for reaching the state it wanted.
+            (0, output_1.emit)(() => console.log(`\n${chalk_1.default.dim(`${target.name ?? target.id} is already revoked.`)}\n`), { ok: true, keyId: target.id, alreadyRevoked: true });
+            return;
+        }
+        if (!opts.yes) {
+            if ((0, resolve_1.isNonInteractive)({ nonInteractive: opts.json })) {
+                (0, output_1.fail)('Refusing to revoke a signing key without confirmation.', ['Pass --yes if this is intentional.'], output_1.ExitCode.Usage);
+            }
+            console.log('');
+            console.log(chalk_1.default.yellow(`⚠️  Revoking ${chalk_1.default.bold(target.name ?? target.id)}.\n` +
+                '   Apps pinning ONLY this key will refuse every future update — that is\n' +
+                '   fail-closed by design. Register the replacement and ship a build\n' +
+                '   pinning both before revoking the old one.'));
+            const ok = await (0, prompt_1.confirmPhrase)('   Type "revoke" to confirm: ', 'revoke', {
+                caseInsensitive: true,
+            });
+            (0, prompt_1.closePrompts)();
+            if (!ok) {
+                console.log('Cancelled — the key is still active.');
+                process.exit(output_1.ExitCode.Ok);
+            }
+        }
+        try {
+            await client.post(`/saas/apps/${appId}/ota/signing-keys/${target.id}/revoke`, {});
+        }
+        catch (err) {
+            (0, output_1.failFromError)('Could not revoke the key', err, [
+                'Revoking a signing key requires an owner or admin role.',
+            ]);
+        }
+        (0, output_1.emit)(() => console.log(`\n🔒 Revoked ${chalk_1.default.bold(target.name ?? target.id)}\n`), { ok: true, keyId: target.id, revoked: true });
+    });
 }
 /**
  * Sign a bundle hash with the locally-held private key.

package/lib/commands/ota-keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"ota-keys.js","sourceRoot":"","sources":["../../src/commands/ota-keys.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiCA,0CAIC;AAED,wDA0JC;AASD,wCAiBC;AA1ND,+CAAiC;AACjC,uCAAyB;AACzB,2CAA6B;AAC7B,sDAAuD;AACvD,0CAA0C;AAE1C;;;;;;;;;;;;GAYG;AAEH,MAAM,OAAO,GAAG,WAAW,CAAC;AAC5B,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;AAU/C,wEAAwE;AACxE,SAAgB,eAAe,CAAC,SAA2B;IACzD,0EAA0E;IAC1E,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAW,CAAC;IACzE,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,SAAgB,sBAAsB,CAAC,GAAY;IACjD,GAAG;SACA,OAAO,CAAC,mBAAmB,CAAC;SAC5B,WAAW,CACV,0EAA0E,CAC3E;SACA,MAAM,CAAC,eAAe,EAAE,0CAA0C,CAAC;SACnE,MAAM,CAAC,eAAe,EAAE,oCAAoC,CAAC;SAC7D,MAAM,CACL,aAAa,EACb,6CAA6C,OAAO,GAAG,CACxD;SACA,MAAM,CAAC,SAAS,EAAE,mCAAmC,CAAC;SACtD,MAAM,CACL,KAAK,EAAE,IAKN,EAAE,EAAE;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,CAAC;QACjD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QAExD,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9C,OAAO,CAAC,KAAK,CACX,qCAAqC,WAAW,KAAK;gBACnD,iFAAiF;gBACjF,oFAAoF,CACvF,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAExE,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,EAAE,CAAC,aAAa,CACd,WAAW,EACX,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAW;QAC7D,yEAAyE;QACzE,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;QAEF,MAAM,SAAS,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;QAE7C,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;QACzD,OAAO,CAAC,GAAG,CAAC,mBAAmB,WAAW,EAAE,CAAC,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,0CAA0C,OAAO,kBAAkB,CAAC,CAAC;QACjF,OAAO,CAAC,GAAG,CAAC,mBAAmB,SAAS,IAAI,CAAC,CAAC;QAE9C,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,KAAK,GAAG,IAAA,6BAAe,GAAE,CAAC;YAChC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;gBAC9D,OAAO,CAAC,KAAK,CACX,2DAA2D,CAC5D,CAAC;gBACF,OAAO,CAAC,KAAK,CACX,2DAA2D,SAAS,EAAE,CACvE,CAAC;gBACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,kBAAS,CAAC,KAAK,CAAC,CAAC;YACpC,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,KAAK,mBAAmB,EAAE;oBAC7D,SAAS,EAAE,SAAS;oBACpB,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;iBAClE,CAAC,CAAC;gBACH,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;YAC1D,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,OAAO,CAAC,KAAK,CAAC,oCAAoC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBACjE,OAAO,CAAC,KAAK,CACX,qDAAqD,IAAI,CAAC,KAAK,iBAAiB,SAAS,IAAI,CAC9F,CAAC;gBACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CACT,+DAA+D,CAChE,CAAC;QACJ,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC;QAChF,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QACjC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,4BAA4B,SAAS,IAAI,CAAC,CAAC;QACvD,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;QACzD,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACxB,CAAC,CACF,CAAC;IAEJ,GAAG;SACA,OAAO,CAAC,cAAc,CAAC;SACvB,WAAW,CAAC,qDAAqD,CAAC;SAClE,cAAc,CAAC,eAAe,EAAE,iBAAiB,CAAC;SAClD,cAAc,CAAC,oBAAoB,EAAE,oCAAoC,CAAC;SAC1E,MAAM,CAAC,eAAe,EAAE,oCAAoC,CAAC;SAC7D,MAAM,CACL,KAAK,EAAE,IAAyD,EAAE,EAAE;QAClE,MAAM,KAAK,GAAG,IAAA,6BAAe,GAAE,CAAC;QAChC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;YAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,kBAAS,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,KAAK,mBAAmB,EAAE;gBAC7D,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,KAAK;aACzB,CAAC,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,oCAAoC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACjE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CACF,CAAC;IAEJ,GAAG;SACA,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,yCAAyC,CAAC;SACtD,cAAc,CAAC,eAAe,EAAE,iBAAiB,CAAC;SAClD,MAAM,CAAC,KAAK,EAAE,IAAuB,EAAE,EAAE;QACxC,MAAM,KAAK,GAAG,IAAA,6BAAe,GAAE,CAAC;QAChC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;YAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,kBAAS,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAC3B,cAAc,IAAI,CAAC,KAAK,mBAAmB,CAC5C,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,6BAA6B,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC;YAC1D,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;gBAClB,OAAO,CAAC,GAAG,CACT,iEAAiE,CAClE,CAAC;gBACF,OAAO;YACT,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;gBACrB,MAAM,KAAK,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;gBACjD,OAAO,CAAC,GAAG,CACT,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,SAAS,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAC1F,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,0BAA0B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACvD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,cAAc,CAC5B,SAAiB,EACjB,MAAe;IAEf,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAC3B,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,EAC/B,gBAAgB,CACjB,CAAC;IACF,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IAE7C,MAAM,UAAU,GAAG,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC;IACzE,+EAA+E;IAC/E,4EAA4E;IAC5E,6EAA6E;IAC7E,8EAA8E;IAC9E,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,UAAU,CAAC,CAAC;IAC/E,OAAO,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC"}
+{"version":3,"file":"ota-keys.js","sourceRoot":"","sources":["../../src/commands/ota-keys.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6CA,wDA8BC;AAWD,0CAIC;AAED,wDAwQC;AASD,wCAiBC;AA7XD,+CAAiC;AACjC,uCAAyB;AACzB,2CAA6B;AAC7B,kDAA0B;AAC1B,sDAA8E;AAC9E,8CAAkE;AAClE,4CAA8D;AAC9D,4CAAsE;AACtE,0CAA0C;AAE1C;;;;;;;;;;;;GAYG;AAEH,MAAM,OAAO,GAAG,WAAW,CAAC;AAC5B,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;AAE/C;;;;;;;;;;;;;;;;GAgBG;AACH,SAAgB,sBAAsB,CAAC,MAAc,EAAE,MAAc,OAAO,CAAC,GAAG,EAAE;IAChF,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACvC,IAAI,GAAG,KAAK,EAAE,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/D,OAAO,8BAA8B,MAAM,yCAAyC,CAAC;IACvF,CAAC;IACD,8EAA8E;IAC9E,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IAClD,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAEnD,IAAI,CAAC;QACH,IAAI,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,EAAE,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACpE,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;gBAC/B,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;gBACnB,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,GAAG,KAAK,IAAI,CAAC,KAAK,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YACxG,CAAC,CAAC,CAAC;YACH,IAAI,OAAO;gBAAE,OAAO,kCAAkC,KAAK,GAAG,CAAC;YAC/D,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;YACpD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YACjE,EAAE,CAAC,cAAc,CAAC,aAAa,EAAE,GAAG,GAAG,gDAAgD,KAAK,IAAI,CAAC,CAAC;YAClG,OAAO,SAAS,KAAK,gBAAgB,CAAC;QACxC,CAAC;QACD,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;YAC1C,EAAE,CAAC,aAAa,CAAC,aAAa,EAAE,8CAA8C,KAAK,IAAI,CAAC,CAAC;YACzF,OAAO,2BAA2B,KAAK,EAAE,CAAC;QAC5C,CAAC;QACD,OAAO,gEAAgE,KAAK,EAAE,CAAC;IACjF,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,gCAAgC,GAAG,EAAE,OAAO,IAAI,GAAG,WAAW,KAAK,WAAW,CAAC;IACxF,CAAC;AACH,CAAC;AAUD,wEAAwE;AACxE,SAAgB,eAAe,CAAC,SAA2B;IACzD,0EAA0E;IAC1E,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAW,CAAC;IACzE,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,SAAgB,sBAAsB,CAAC,GAAY;IACjD,GAAG;SACA,OAAO,CAAC,mBAAmB,CAAC;SAC5B,WAAW,CACV,0EAA0E,CAC3E;SACA,MAAM,CAAC,eAAe,EAAE,0CAA0C,CAAC;SACnE,MAAM,CAAC,eAAe,EAAE,oCAAoC,CAAC;SAC7D,MAAM,CACL,aAAa,EACb,6CAA6C,OAAO,GAAG,CACxD;SACA,MAAM,CAAC,SAAS,EAAE,mCAAmC,CAAC;SACtD,MAAM,CACL,KAAK,EAAE,IAKN,EAAE,EAAE;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,CAAC;QACjD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QAExD,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9C,OAAO,CAAC,KAAK,CACX,qCAAqC,WAAW,KAAK;gBACnD,iFAAiF;gBACjF,oFAAoF,CACvF,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAExE,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,EAAE,CAAC,aAAa,CACd,WAAW,EACX,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAW;QAC7D,sEAAsE;QACtE,oEAAoE;QACpE,kEAAkE;QAClE,mEAAmE;QACnE,0DAA0D;QAC1D,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;QACF,IAAA,mCAAqB,EAAC,WAAW,EAAE,8BAA8B,CAAC,CAAC;QACnE,MAAM,gBAAgB,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;QAExD,MAAM,SAAS,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;QAE7C,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;QACzD,OAAO,CAAC,GAAG,CAAC,mBAAmB,WAAW,EAAE,CAAC,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;QAChE,OAAO,CAAC,GAAG,CAAC,mBAAmB,gBAAgB,EAAE,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,mBAAmB,SAAS,IAAI,CAAC,CAAC;QAE9C,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,KAAK,GAAG,IAAA,6BAAe,GAAE,CAAC;YAChC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;gBAC9D,OAAO,CAAC,KAAK,CACX,2DAA2D,CAC5D,CAAC;gBACF,OAAO,CAAC,KAAK,CACX,2DAA2D,SAAS,EAAE,CACvE,CAAC;gBACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,kBAAS,CAAC,KAAK,CAAC,CAAC;YACpC,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,KAAK,mBAAmB,EAAE;oBAC7D,SAAS,EAAE,SAAS;oBACpB,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;iBAClE,CAAC,CAAC;gBACH,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;YAC1D,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,OAAO,CAAC,KAAK,CAAC,oCAAoC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBACjE,OAAO,CAAC,KAAK,CACX,qDAAqD,IAAI,CAAC,KAAK,iBAAiB,SAAS,IAAI,CAC9F,CAAC;gBACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CACT,+DAA+D,CAChE,CAAC;QACJ,CAAC;QAED,8DAA8D;QAC9D,kEAAkE;QAClE,sEAAsE;QACtE,iEAAiE;QACjE,8BAA8B;QAC9B,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;QAC5D,OAAO,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC;QAC/E,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QACjC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,4BAA4B,SAAS,IAAI,CAAC,CAAC;QACvD,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACtB,OAAO,CAAC,GAAG,CACT,yEAAyE;YACvE,yEAAyE;YACzE,4DAA4D,CAC/D,CAAC;IACJ,CAAC,CACF,CAAC;IAEJ,GAAG;SACA,OAAO,CAAC,cAAc,CAAC;SACvB,WAAW,CAAC,qDAAqD,CAAC;SAClE,cAAc,CAAC,eAAe,EAAE,iBAAiB,CAAC;SAClD,cAAc,CAAC,oBAAoB,EAAE,oCAAoC,CAAC;SAC1E,MAAM,CAAC,eAAe,EAAE,oCAAoC,CAAC;SAC7D,MAAM,CACL,KAAK,EAAE,IAAyD,EAAE,EAAE;QAClE,MAAM,KAAK,GAAG,IAAA,6BAAe,GAAE,CAAC;QAChC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;YAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,kBAAS,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,KAAK,mBAAmB,EAAE;gBAC7D,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,KAAK;aACzB,CAAC,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,oCAAoC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACjE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CACF,CAAC;IAEJ,GAAG;SACA,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,yCAAyC,CAAC;SACtD,cAAc,CAAC,eAAe,EAAE,iBAAiB,CAAC;SAClD,MAAM,CAAC,KAAK,EAAE,IAAuB,EAAE,EAAE;QACxC,MAAM,KAAK,GAAG,IAAA,6BAAe,GAAE,CAAC;QAChC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;YAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,kBAAS,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAC3B,cAAc,IAAI,CAAC,KAAK,mBAAmB,CAC5C,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,6BAA6B,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC;YAC1D,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;gBAClB,OAAO,CAAC,GAAG,CACT,iEAAiE,CAClE,CAAC;gBACF,OAAO;YACT,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;gBACrB,MAAM,KAAK,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;gBACjD,OAAO,CAAC,GAAG,CACT,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,SAAS,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAC1F,CAAC;gBACF,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC7B,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,0BAA0B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACvD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL;;;;;;;;;;;OAWG;IACH,GAAG;SACA,OAAO,CAAC,YAAY,CAAC;SACrB,WAAW,CAAC,8DAA8D,CAAC;SAC3E,cAAc,CAAC,eAAe,EAAE,kDAAkD,CAAC;SACnF,MAAM,CAAC,eAAe,EAAE,4DAA4D,CAAC;SACrF,MAAM,CAAC,OAAO,EAAE,4CAA4C,CAAC;SAC7D,MAAM,CAAC,QAAQ,EAAE,yBAAyB,CAAC;SAC3C,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,KAAK,GAAG,IAAA,6BAAe,GAAE,CAAC;QAChC,IAAI,CAAC,KAAK;YAAE,IAAA,aAAI,EAAC,gBAAgB,EAAE,CAAC,6BAA6B,CAAC,EAAE,iBAAQ,CAAC,KAAK,CAAC,CAAC;QACpF,MAAM,KAAK,GAAG,MAAM,IAAA,sBAAY,EAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,cAAc,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACnF,MAAM,MAAM,GAAG,IAAI,kBAAS,CAAC,KAAM,CAAC,CAAC;QAErC,IAAI,IAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAAkB,cAAc,KAAK,mBAAmB,CAAC,CAAC;QACnF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAA,sBAAa,EAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAA,aAAI,EACF,kBAAkB,IAAI,CAAC,KAAK,eAAe,EAC3C,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,IAAI,SAAS,EAAE,CAAC,EAC5D,iBAAQ,CAAC,KAAK,CACf,CAAC;QACJ,CAAC;QACD,IAAI,MAAO,CAAC,SAAS,EAAE,CAAC;YACtB,uEAAuE;YACvE,0DAA0D;YAC1D,IAAA,aAAI,EACF,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,eAAK,CAAC,GAAG,CAAC,GAAG,MAAO,CAAC,IAAI,IAAI,MAAO,CAAC,EAAE,sBAAsB,CAAC,IAAI,CAAC,EAC1F,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAO,CAAC,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CACtD,CAAC;YACF,OAAO;QACT,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YACd,IAAI,IAAA,0BAAgB,EAAC,EAAE,cAAc,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;gBACpD,IAAA,aAAI,EACF,wDAAwD,EACxD,CAAC,oCAAoC,CAAC,EACtC,iBAAQ,CAAC,KAAK,CACf,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CACT,eAAK,CAAC,MAAM,CACV,gBAAgB,eAAK,CAAC,IAAI,CAAC,MAAO,CAAC,IAAI,IAAI,MAAO,CAAC,EAAE,CAAC,KAAK;gBACzD,2EAA2E;gBAC3E,uEAAuE;gBACvE,8CAA8C,CACjD,CACF,CAAC;YACF,MAAM,EAAE,GAAG,MAAM,IAAA,sBAAa,EAAC,+BAA+B,EAAE,QAAQ,EAAE;gBACxE,eAAe,EAAE,IAAI;aACtB,CAAC,CAAC;YACH,IAAA,qBAAY,GAAE,CAAC;YACf,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,OAAO,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;gBACpD,OAAO,CAAC,IAAI,CAAC,iBAAQ,CAAC,EAAE,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,cAAc,KAAK,qBAAqB,MAAO,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QACrF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAA,sBAAa,EAAC,0BAA0B,EAAE,GAAG,EAAE;gBAC7C,yDAAyD;aAC1D,CAAC,CAAC;QACL,CAAC;QAED,IAAA,aAAI,EACF,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,eAAK,CAAC,IAAI,CAAC,MAAO,CAAC,IAAI,IAAI,MAAO,CAAC,EAAE,CAAC,IAAI,CAAC,EAC7E,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAO,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAC/C,CAAC;IACJ,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,cAAc,CAC5B,SAAiB,EACjB,MAAe;IAEf,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAC3B,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,EAC/B,gBAAgB,CACjB,CAAC;IACF,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IAE7C,MAAM,UAAU,GAAG,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC;IACzE,+EAA+E;IAC/E,4EAA4E;IAC5E,6EAA6E;IAC7E,8EAA8E;IAC9E,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,UAAU,CAAC,CAAC;IAC/E,OAAO,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC"}

package/lib/commands/ota-promote.d.ts

@@ -0,0 +1,3 @@
+import { Command } from 'commander';
+export declare function registerOtaPromoteCommand(ota: Command): void;
+//# sourceMappingURL=ota-promote.d.ts.map

package/lib/commands/ota-promote.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ota-promote.d.ts","sourceRoot":"","sources":["../../src/commands/ota-promote.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAqDpC,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CA6M5D"}