@scalebun/cli 1.13.0 → 2.0.1

package/lib/vendor/ota-protocol/hex.js

@@ -0,0 +1,31 @@
+"use strict";
+/** Strict lowercase-hex helpers (no `0x`, even length, exact alphabet). */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.bytesToHex = bytesToHex;
+exports.hexToBytes = hexToBytes;
+const types_1 = require("./types");
+function bytesToHex(bytes) {
+    let out = '';
+    for (let i = 0; i < bytes.length; i++) {
+        out += bytes[i].toString(16).padStart(2, '0');
+    }
+    return out;
+}
+/**
+ * Parse hex to bytes, rejecting anything that is not canonical lowercase-or-mixed
+ * hex of even length. `expectedLen`, when given, pins the output byte count.
+ */
+function hexToBytes(hex, expectedLen) {
+    if (typeof hex !== 'string' || hex.length % 2 !== 0 || !/^[0-9a-fA-F]*$/.test(hex)) {
+        throw new types_1.OtaProtocolError('INVALID_SIGNED_PAYLOAD', 'malformed hex string');
+    }
+    const out = new Uint8Array(hex.length / 2);
+    for (let i = 0; i < out.length; i++) {
+        out[i] = parseInt(hex.substr(i * 2, 2), 16);
+    }
+    if (expectedLen !== undefined && out.length !== expectedLen) {
+        throw new types_1.OtaProtocolError('INVALID_SIGNED_PAYLOAD', `expected ${expectedLen} bytes of hex, got ${out.length}`);
+    }
+    return out;
+}
+//# sourceMappingURL=hex.js.map

package/lib/vendor/ota-protocol/hex.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hex.js","sourceRoot":"","sources":["../../../src/vendor/ota-protocol/hex.ts"],"names":[],"mappings":";AAAA,2EAA2E;;AAI3E,gCAMC;AAMD,gCAeC;AA7BD,mCAA2C;AAE3C,SAAgB,UAAU,CAAC,KAAiB;IAC1C,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,SAAgB,UAAU,CAAC,GAAW,EAAE,WAAoB;IAC1D,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACnF,MAAM,IAAI,wBAAgB,CAAC,wBAAwB,EAAE,sBAAsB,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,GAAG,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,WAAW,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QAC5D,MAAM,IAAI,wBAAgB,CACxB,wBAAwB,EACxB,YAAY,WAAW,sBAAsB,GAAG,CAAC,MAAM,EAAE,CAC1D,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/lib/vendor/ota-protocol/index.d.ts

@@ -0,0 +1,17 @@
+/**
+ * @scalebun/ota-protocol — the SB-OTA-RSA-SHA256-V1 signed-release codec.
+ *
+ * Dependency-free reference implementation of the binary payload format, its
+ * limits, the transport-envelope + failure-code types, and strict hex/base64
+ * helpers. The Android (Kotlin) and iOS (Swift) verifiers and the backend
+ * signer/verifier mirror this module byte-for-byte; the fixtures under
+ * `fixtures/` are the shared conformance oracle.
+ *
+ * See docs/ota/SB-OTA-RSA-SHA256-V1.md.
+ */
+export * from './limits';
+export * from './types';
+export { serializeSignedRelease, parseSignedRelease, peekKeyId } from './codec';
+export { bytesToHex, hexToBytes } from './hex';
+export { encodeBase64, decodeBase64Strict } from './base64';
+//# sourceMappingURL=index.d.ts.map

package/lib/vendor/ota-protocol/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/vendor/ota-protocol/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,cAAc,UAAU,CAAC;AACzB,cAAc,SAAS,CAAC;AACxB,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAChF,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC"}

package/lib/vendor/ota-protocol/index.js

@@ -0,0 +1,41 @@
+"use strict";
+/**
+ * @scalebun/ota-protocol — the SB-OTA-RSA-SHA256-V1 signed-release codec.
+ *
+ * Dependency-free reference implementation of the binary payload format, its
+ * limits, the transport-envelope + failure-code types, and strict hex/base64
+ * helpers. The Android (Kotlin) and iOS (Swift) verifiers and the backend
+ * signer/verifier mirror this module byte-for-byte; the fixtures under
+ * `fixtures/` are the shared conformance oracle.
+ *
+ * See docs/ota/SB-OTA-RSA-SHA256-V1.md.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.decodeBase64Strict = exports.encodeBase64 = exports.hexToBytes = exports.bytesToHex = exports.peekKeyId = exports.parseSignedRelease = exports.serializeSignedRelease = void 0;
+__exportStar(require("./limits"), exports);
+__exportStar(require("./types"), exports);
+var codec_1 = require("./codec");
+Object.defineProperty(exports, "serializeSignedRelease", { enumerable: true, get: function () { return codec_1.serializeSignedRelease; } });
+Object.defineProperty(exports, "parseSignedRelease", { enumerable: true, get: function () { return codec_1.parseSignedRelease; } });
+Object.defineProperty(exports, "peekKeyId", { enumerable: true, get: function () { return codec_1.peekKeyId; } });
+var hex_1 = require("./hex");
+Object.defineProperty(exports, "bytesToHex", { enumerable: true, get: function () { return hex_1.bytesToHex; } });
+Object.defineProperty(exports, "hexToBytes", { enumerable: true, get: function () { return hex_1.hexToBytes; } });
+var base64_1 = require("./base64");
+Object.defineProperty(exports, "encodeBase64", { enumerable: true, get: function () { return base64_1.encodeBase64; } });
+Object.defineProperty(exports, "decodeBase64Strict", { enumerable: true, get: function () { return base64_1.decodeBase64Strict; } });
+//# sourceMappingURL=index.js.map

package/lib/vendor/ota-protocol/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/vendor/ota-protocol/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;;;;;;;;;;;;;;;AAEH,2CAAyB;AACzB,0CAAwB;AACxB,iCAAgF;AAAvE,+GAAA,sBAAsB,OAAA;AAAE,2GAAA,kBAAkB,OAAA;AAAE,kGAAA,SAAS,OAAA;AAC9D,6BAA+C;AAAtC,iGAAA,UAAU,OAAA;AAAE,iGAAA,UAAU,OAAA;AAC/B,mCAA4D;AAAnD,sGAAA,YAAY,OAAA;AAAE,4GAAA,kBAAkB,OAAA"}

package/lib/vendor/ota-protocol/limits.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Explicit protocol limits for SB-OTA-RSA-SHA256-V1.
+ *
+ * These are part of the wire contract: the Kotlin and Swift verifiers and the
+ * backend signer/verifier MUST use the identical values. Changing any of them is
+ * a protocol change. See docs/ota/SB-OTA-RSA-SHA256-V1.md §3.4.
+ */
+/** 8-byte ASCII magic that opens every signed payload. */
+export declare const MAGIC = "SBOTA001";
+/** Raw bytes of {@link MAGIC}. */
+export declare const MAGIC_BYTES: Uint8Array<ArrayBuffer>;
+/** The only schema version this codec accepts. */
+export declare const SCHEMA_VERSION = 1;
+/** Canonical algorithm identifiers (also the values carried in the payload). */
+export declare const SIGNATURE_ALGORITHM = "SB-OTA-RSA-SHA256-V1";
+export declare const HASH_ALGORITHM = "SHA-256";
+/** Whole binary payload must fit in this many bytes (before/after base64). */
+export declare const MAX_SIGNED_PAYLOAD_BYTES = 8192;
+/** RSA signature bytes (RSA-3072 = 384 bytes; headroom for larger moduli). */
+export declare const MAX_SIGNATURE_BYTES = 1024;
+/** Transport envelope JSON size cap, enforced before decoding. */
+export declare const MAX_ENVELOPE_JSON_BYTES = 65536;
+/** Each individual length-prefixed UTF-8 string field. */
+export declare const MAX_STRING_FIELD_BYTES = 256;
+/** SHA-256 digest length. */
+export declare const SHA256_LEN = 32;
+/** RSA modulus policy. */
+export declare const MIN_RSA_MODULUS_BITS = 2048;
+export declare const RECOMMENDED_RSA_MODULUS_BITS = 3072;
+/**
+ * uint64 values above this are rejected — JavaScript cannot represent them
+ * losslessly as a Number, and the native mirrors treat the same ceiling as the
+ * safe range so a payload that parses in one place parses everywhere.
+ */
+export declare const MAX_SAFE_UINT64: number;
+/** Allowed enum values. */
+export declare const PLATFORMS: readonly ["android", "ios"];
+export declare const ARTIFACT_TYPES: readonly ["full", "patch"];
+//# sourceMappingURL=limits.d.ts.map

package/lib/vendor/ota-protocol/limits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"limits.d.ts","sourceRoot":"","sources":["../../../src/vendor/ota-protocol/limits.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,0DAA0D;AAC1D,eAAO,MAAM,KAAK,aAAa,CAAC;AAChC,kCAAkC;AAClC,eAAO,MAAM,WAAW,yBAEvB,CAAC;AAEF,kDAAkD;AAClD,eAAO,MAAM,cAAc,IAAI,CAAC;AAEhC,gFAAgF;AAChF,eAAO,MAAM,mBAAmB,yBAAyB,CAAC;AAC1D,eAAO,MAAM,cAAc,YAAY,CAAC;AAExC,8EAA8E;AAC9E,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAC7C,8EAA8E;AAC9E,eAAO,MAAM,mBAAmB,OAAO,CAAC;AACxC,kEAAkE;AAClE,eAAO,MAAM,uBAAuB,QAAQ,CAAC;AAC7C,0DAA0D;AAC1D,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAC1C,6BAA6B;AAC7B,eAAO,MAAM,UAAU,KAAK,CAAC;AAE7B,0BAA0B;AAC1B,eAAO,MAAM,oBAAoB,OAAO,CAAC;AACzC,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAEjD;;;;GAIG;AACH,eAAO,MAAM,eAAe,QAA0B,CAAC;AAEvD,2BAA2B;AAC3B,eAAO,MAAM,SAAS,6BAA8B,CAAC;AACrD,eAAO,MAAM,cAAc,4BAA6B,CAAC"}

package/lib/vendor/ota-protocol/limits.js

@@ -0,0 +1,42 @@
+"use strict";
+/**
+ * Explicit protocol limits for SB-OTA-RSA-SHA256-V1.
+ *
+ * These are part of the wire contract: the Kotlin and Swift verifiers and the
+ * backend signer/verifier MUST use the identical values. Changing any of them is
+ * a protocol change. See docs/ota/SB-OTA-RSA-SHA256-V1.md §3.4.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ARTIFACT_TYPES = exports.PLATFORMS = exports.MAX_SAFE_UINT64 = exports.RECOMMENDED_RSA_MODULUS_BITS = exports.MIN_RSA_MODULUS_BITS = exports.SHA256_LEN = exports.MAX_STRING_FIELD_BYTES = exports.MAX_ENVELOPE_JSON_BYTES = exports.MAX_SIGNATURE_BYTES = exports.MAX_SIGNED_PAYLOAD_BYTES = exports.HASH_ALGORITHM = exports.SIGNATURE_ALGORITHM = exports.SCHEMA_VERSION = exports.MAGIC_BYTES = exports.MAGIC = void 0;
+/** 8-byte ASCII magic that opens every signed payload. */
+exports.MAGIC = 'SBOTA001';
+/** Raw bytes of {@link MAGIC}. */
+exports.MAGIC_BYTES = Uint8Array.from(Array.from(exports.MAGIC, (c) => c.charCodeAt(0)));
+/** The only schema version this codec accepts. */
+exports.SCHEMA_VERSION = 1;
+/** Canonical algorithm identifiers (also the values carried in the payload). */
+exports.SIGNATURE_ALGORITHM = 'SB-OTA-RSA-SHA256-V1';
+exports.HASH_ALGORITHM = 'SHA-256';
+/** Whole binary payload must fit in this many bytes (before/after base64). */
+exports.MAX_SIGNED_PAYLOAD_BYTES = 8192;
+/** RSA signature bytes (RSA-3072 = 384 bytes; headroom for larger moduli). */
+exports.MAX_SIGNATURE_BYTES = 1024;
+/** Transport envelope JSON size cap, enforced before decoding. */
+exports.MAX_ENVELOPE_JSON_BYTES = 65536;
+/** Each individual length-prefixed UTF-8 string field. */
+exports.MAX_STRING_FIELD_BYTES = 256;
+/** SHA-256 digest length. */
+exports.SHA256_LEN = 32;
+/** RSA modulus policy. */
+exports.MIN_RSA_MODULUS_BITS = 2048;
+exports.RECOMMENDED_RSA_MODULUS_BITS = 3072;
+/**
+ * uint64 values above this are rejected — JavaScript cannot represent them
+ * losslessly as a Number, and the native mirrors treat the same ceiling as the
+ * safe range so a payload that parses in one place parses everywhere.
+ */
+exports.MAX_SAFE_UINT64 = Number.MAX_SAFE_INTEGER; // 2^53 - 1
+/** Allowed enum values. */
+exports.PLATFORMS = ['android', 'ios'];
+exports.ARTIFACT_TYPES = ['full', 'patch'];
+//# sourceMappingURL=limits.js.map

package/lib/vendor/ota-protocol/limits.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"limits.js","sourceRoot":"","sources":["../../../src/vendor/ota-protocol/limits.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;AAEH,0DAA0D;AAC7C,QAAA,KAAK,GAAG,UAAU,CAAC;AAChC,kCAAkC;AACrB,QAAA,WAAW,GAAG,UAAU,CAAC,IAAI,CACxC,KAAK,CAAC,IAAI,CAAC,aAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAC1C,CAAC;AAEF,kDAAkD;AACrC,QAAA,cAAc,GAAG,CAAC,CAAC;AAEhC,gFAAgF;AACnE,QAAA,mBAAmB,GAAG,sBAAsB,CAAC;AAC7C,QAAA,cAAc,GAAG,SAAS,CAAC;AAExC,8EAA8E;AACjE,QAAA,wBAAwB,GAAG,IAAI,CAAC;AAC7C,8EAA8E;AACjE,QAAA,mBAAmB,GAAG,IAAI,CAAC;AACxC,kEAAkE;AACrD,QAAA,uBAAuB,GAAG,KAAK,CAAC;AAC7C,0DAA0D;AAC7C,QAAA,sBAAsB,GAAG,GAAG,CAAC;AAC1C,6BAA6B;AAChB,QAAA,UAAU,GAAG,EAAE,CAAC;AAE7B,0BAA0B;AACb,QAAA,oBAAoB,GAAG,IAAI,CAAC;AAC5B,QAAA,4BAA4B,GAAG,IAAI,CAAC;AAEjD;;;;GAIG;AACU,QAAA,eAAe,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC,WAAW;AAEnE,2BAA2B;AACd,QAAA,SAAS,GAAG,CAAC,SAAS,EAAE,KAAK,CAAU,CAAC;AACxC,QAAA,cAAc,GAAG,CAAC,MAAM,EAAE,OAAO,CAAU,CAAC"}

package/lib/vendor/ota-protocol/types.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Shared types for SB-OTA-RSA-SHA256-V1.
+ *
+ * The decoded `ScaleBunSignedReleaseV1` structure, the platform/artifact enums,
+ * and the stable verification failure codes. Kept dependency-free so this module
+ * imports cleanly into the CLI, the React Native SDK (Metro), and Node tests.
+ */
+import { PLATFORMS, ARTIFACT_TYPES } from './limits';
+export type OtaPlatform = (typeof PLATFORMS)[number];
+export type OtaArtifactType = (typeof ARTIFACT_TYPES)[number];
+/**
+ * The decoded signed release. Field names and order mirror the wire format in
+ * docs/ota/SB-OTA-RSA-SHA256-V1.md §3.2.
+ *
+ * Hash fields are exposed as lowercase-hex strings for ergonomics; the codec
+ * converts to/from the raw 32-byte on-wire representation. uint64 fields are
+ * JavaScript numbers, guaranteed ≤ MAX_SAFE_UINT64 by the parser.
+ */
+export interface ScaleBunSignedReleaseV1 {
+    /** Always {@link SIGNATURE_ALGORITHM}. */
+    readonly signatureAlgorithm: string;
+    /** Always {@link HASH_ALGORITHM}. */
+    readonly hashAlgorithm: string;
+    readonly keyId: string;
+    readonly projectId: string;
+    /** Android applicationId / iOS bundle identifier. */
+    readonly applicationId: string;
+    readonly releaseId: string;
+    readonly bundleId: string;
+    readonly platform: OtaPlatform;
+    readonly artifactType: OtaArtifactType;
+    readonly targetAppVersion: string;
+    readonly targetRuntimeVersion: string;
+    readonly minimumSdkVersion: string;
+    readonly releaseSequence: number;
+    readonly issuedAtEpochSeconds: number;
+    /** 0 = never expires. */
+    readonly expiresAtEpochSeconds: number;
+    readonly artifactSize: number;
+    /** SHA-256 of the exact downloaded artifact, lowercase hex (64 chars). */
+    readonly artifactSha256: string;
+    /** Empty string for `full`; the base bundle id for `patch`. */
+    readonly baseBundleId: string;
+    /** Empty string for `full`; base bundle SHA-256 (lowercase hex) for `patch`. */
+    readonly baseArtifactSha256: string;
+    /** SHA-256 of the final normalized bundle, lowercase hex (64 chars). */
+    readonly resultArtifactSha256: string;
+}
+/**
+ * The transport envelope carried over JSON. `signedPayload` and `signature` are
+ * standard Base64. `signedPayload` is the sole security authority; every field in
+ * `displayMetadata` is informational only.
+ */
+export interface OtaReleaseEnvelope {
+    readonly protocol: string;
+    readonly keyId: string;
+    readonly signedPayload: string;
+    readonly signature: string;
+    readonly downloadUrl?: string;
+    readonly displayMetadata?: Record<string, unknown>;
+}
+/** Stable verification failure codes (docs §6). */
+export type OtaVerificationFailureCode = 'INVALID_ENVELOPE' | 'INVALID_BASE64' | 'UNSUPPORTED_PROTOCOL' | 'UNSUPPORTED_SCHEMA' | 'UNSUPPORTED_SIGNATURE_ALGORITHM' | 'UNSUPPORTED_HASH_ALGORITHM' | 'UNKNOWN_KEY_ID' | 'INVALID_PUBLIC_KEY' | 'INVALID_SIGNATURE' | 'INVALID_SIGNED_PAYLOAD' | 'PROJECT_MISMATCH' | 'APPLICATION_MISMATCH' | 'PLATFORM_MISMATCH' | 'APP_VERSION_MISMATCH' | 'RUNTIME_VERSION_MISMATCH' | 'RELEASE_DOWNGRADE_REJECTED' | 'RELEASE_EXPIRED' | 'DOWNLOAD_FAILED' | 'DOWNLOAD_TOO_LARGE' | 'ARTIFACT_SIZE_MISMATCH' | 'ARTIFACT_HASH_MISMATCH' | 'PATCH_BASE_MISMATCH' | 'PATCH_RESULT_MISMATCH' | 'UNSAFE_ARCHIVE' | 'STAGING_FAILED' | 'ACTIVATION_FAILED' | 'INTERNAL_VERIFICATION_ERROR';
+/**
+ * Error thrown by the parser. `code` is one of the payload-related failure codes
+ * (INVALID_SIGNED_PAYLOAD / UNSUPPORTED_*), so callers can map parse failures to
+ * the same stable vocabulary the native verifiers use.
+ */
+export declare class OtaProtocolError extends Error {
+    readonly code: OtaVerificationFailureCode;
+    constructor(code: OtaVerificationFailureCode, message: string);
+}
+//# sourceMappingURL=types.d.ts.map

package/lib/vendor/ota-protocol/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/vendor/ota-protocol/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAErD,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC;AACrD,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9D;;;;;;;GAOG;AACH,MAAM,WAAW,uBAAuB;IACtC,0CAA0C;IAC1C,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,qCAAqC;IACrC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAE/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,qDAAqD;IACrD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC;IAEvC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IAEnC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,yBAAyB;IACzB,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAE9B,0EAA0E;IAC1E,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAEhC,+DAA+D;IAC/D,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,gFAAgF;IAChF,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IAEpC,wEAAwE;IACxE,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;CACvC;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpD;AAED,mDAAmD;AACnD,MAAM,MAAM,0BAA0B,GAClC,kBAAkB,GAClB,gBAAgB,GAChB,sBAAsB,GACtB,oBAAoB,GACpB,iCAAiC,GACjC,4BAA4B,GAC5B,gBAAgB,GAChB,oBAAoB,GACpB,mBAAmB,GACnB,wBAAwB,GACxB,kBAAkB,GAClB,sBAAsB,GACtB,mBAAmB,GACnB,sBAAsB,GACtB,0BAA0B,GAC1B,4BAA4B,GAC5B,iBAAiB,GACjB,iBAAiB,GACjB,oBAAoB,GACpB,wBAAwB,GACxB,wBAAwB,GACxB,qBAAqB,GACrB,uBAAuB,GACvB,gBAAgB,GAChB,gBAAgB,GAChB,mBAAmB,GACnB,6BAA6B,CAAC;AAElC;;;;GAIG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,IAAI,EAAE,0BAA0B,CAAC;gBAC9B,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,MAAM;CAK9D"}

package/lib/vendor/ota-protocol/types.js

@@ -0,0 +1,24 @@
+"use strict";
+/**
+ * Shared types for SB-OTA-RSA-SHA256-V1.
+ *
+ * The decoded `ScaleBunSignedReleaseV1` structure, the platform/artifact enums,
+ * and the stable verification failure codes. Kept dependency-free so this module
+ * imports cleanly into the CLI, the React Native SDK (Metro), and Node tests.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OtaProtocolError = void 0;
+/**
+ * Error thrown by the parser. `code` is one of the payload-related failure codes
+ * (INVALID_SIGNED_PAYLOAD / UNSUPPORTED_*), so callers can map parse failures to
+ * the same stable vocabulary the native verifiers use.
+ */
+class OtaProtocolError extends Error {
+    constructor(code, message) {
+        super(`${code}: ${message}`);
+        this.name = 'OtaProtocolError';
+        this.code = code;
+    }
+}
+exports.OtaProtocolError = OtaProtocolError;
+//# sourceMappingURL=types.js.map

package/lib/vendor/ota-protocol/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/vendor/ota-protocol/types.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;AAgGH;;;;GAIG;AACH,MAAa,gBAAiB,SAAQ,KAAK;IAEzC,YAAY,IAAgC,EAAE,OAAe;QAC3D,KAAK,CAAC,GAAG,IAAI,KAAK,OAAO,EAAE,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAPD,4CAOC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scalebun/cli",
-  "version": "1.13.0",
+  "version": "2.0.1",
   "description": "Scalebun CLI — OTA bundle publishing and management",
   "license": "MIT",
   "bin": {