@scalebun/cli 2.0.7 → 2.0.9

package/lib/commands/ci-init.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ci-init.d.ts","sourceRoot":"","sources":["../../src/commands/ci-init.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA+PpC,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAsE5D"}
+{"version":3,"file":"ci-init.d.ts","sourceRoot":"","sources":["../../src/commands/ci-init.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAwRpC,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAyE5D"}

package/lib/commands/ci-init.js

@@ -43,13 +43,21 @@ const resolve_1 = require("../utils/resolve");
  * `scalebun ci init` — generate working CI/CD pipelines for OTA publishing.
  *
  * Credentials in CI are environment variables, no login step:
- *   SCALEBUN_TOKEN    a personal access token (scalebun_pat_…) — create one in
- *                     the dashboard (Settings → Access Tokens) or via
- *                     `scalebun login` locally and copy from the output
- *   SCALEBUN_API_URL  the backend API base, e.g. https://api.scalebun.com/api/v1
+ *   SCALEBUN_API_TOKEN  a personal access token (scalebun_pat_…) — create one in
+ *                       the dashboard (OTA Settings → Access Tokens) or via
+ *                       `scalebun login` locally and copy from the output.
+ *                       (SCALEBUN_TOKEN is still accepted for back-compat.)
+ *   SCALEBUN_API_URL    the backend API base, e.g. https://api.scalebun.com/api/v1
  *
- * `readCredentials()` picks both up automatically, so every command that works
- * locally works headless: publish, rollout, pause, rollback.
+ * Signing (a signature-enforcing app) also reads, straight from the env:
+ *   SCALEBUN_SIGNING_PRIVATE_KEY      RSA private-key PEM — signs in the runner,
+ *                                     never sent to ScaleBun
+ *   SCALEBUN_SIGNING_KEY_PASSPHRASE   passphrase, only if the key is encrypted
+ *   SCALEBUN_KEY_ID                   the signing key id
+ *
+ * `readCredentials()` + `resolveSigningMaterial()` pick these up automatically, so
+ * every command that works locally works headless: publish, rollout, pause,
+ * rollback — signed, with no key file written in CI.
  */
 const GITHUB_ACTIONS_WORKFLOW = `name: Scalebun OTA
 
@@ -69,12 +77,20 @@ on:
         default: '100'
 
 env:
-  # Create a PAT in the Scalebun dashboard (Settings -> Access Tokens) and add
-  # both values as repository secrets. Session JWTs expire in minutes - always
-  # use a scalebun_pat_... token here.
-  SCALEBUN_TOKEN: \${{ secrets.SCALEBUN_TOKEN }}
+  # Add these as repository secrets (Settings -> Secrets and variables -> Actions).
+  # SCALEBUN_API_TOKEN is a scalebun_pat_... token from the dashboard (OTA Settings
+  # -> Access Tokens). Session JWTs expire in minutes - always use a PAT here.
+  SCALEBUN_API_TOKEN: \${{ secrets.SCALEBUN_API_TOKEN }}
   SCALEBUN_API_URL: \${{ secrets.SCALEBUN_API_URL }}
   SCALEBUN_APP_ID: \${{ secrets.SCALEBUN_APP_ID }}
+  # Signing — the private key signs locally in the runner and NEVER reaches
+  # ScaleBun; only the signature it produces is uploaded. A signature-enforcing
+  # app rejects unsigned releases, so --require-signing below fails the job rather
+  # than shipping a release no device will install. Omit these three for an
+  # unsigned (SHA-256-only) app.
+  SCALEBUN_SIGNING_PRIVATE_KEY: \${{ secrets.SCALEBUN_SIGNING_PRIVATE_KEY }}
+  SCALEBUN_SIGNING_KEY_PASSPHRASE: \${{ secrets.SCALEBUN_SIGNING_KEY_PASSPHRASE }}
+  SCALEBUN_KEY_ID: \${{ secrets.SCALEBUN_KEY_ID }}
   # Required by --sourcemap: without it the map uploads but is never
   # registered for symbolication, so production stack traces stay minified.
   SCALEBUN_SDK_SECRET: \${{ secrets.SCALEBUN_SDK_SECRET }}
@@ -102,7 +118,7 @@ jobs:
         if: github.event_name == 'push' || inputs.action == 'publish'
         # The commit message is UNTRUSTED input. Interpolating \${{ }} straight
         # into run: splices it into the shell — a message with a quote breaks the
-        # job, and one with ";cmd;" executes with SCALEBUN_TOKEN in scope.
+        # job, and one with ";cmd;" executes with SCALEBUN_API_TOKEN in scope.
         # Passing it through env keeps it data.
         env:
           COMMIT_MESSAGE: \${{ github.event.head_commit.message || 'Manual publish' }}
@@ -113,6 +129,7 @@ jobs:
             --platform android \\
             --hermes \\
             --sourcemap \\
+            --require-signing \\
             --rollout 10 \\
             --release-note "$COMMIT_MESSAGE"
 
@@ -121,7 +138,7 @@ jobs:
         if: inputs.action == 'rollout'
         # Same rule as COMMIT_MESSAGE above: workflow inputs are attacker-typed
         # strings, and \${{ }} inside run: splices them into the shell with
-        # SCALEBUN_TOKEN in scope. env keeps the value data. (The CLI validates
+        # SCALEBUN_API_TOKEN in scope. env keeps the value data. (The CLI validates
         # 0-100 anyway, but validation there is no reason to splice here.)
         env:
           ROLLOUT_PERCENT: \${{ inputs.percent }}
@@ -137,12 +154,17 @@ jobs:
 `;
 const GITLAB_CI_TEMPLATE = `# Scalebun OTA — GitLab CI
 #
-# Set these CI/CD variables (Settings -> CI/CD -> Variables, masked):
-#   SCALEBUN_TOKEN     scalebun_pat_...  (dashboard -> Settings -> Access Tokens)
-#   SCALEBUN_API_URL   e.g. https://api.scalebun.com/api/v1
-#   SCALEBUN_APP_ID    your application id
+# Set these CI/CD variables (Settings -> CI/CD -> Variables):
+#   SCALEBUN_API_TOKEN               scalebun_pat_... (dashboard -> OTA Settings -> Access Tokens)
+#   SCALEBUN_API_URL                 e.g. https://api.scalebun.com/api/v1
+#   SCALEBUN_APP_ID                  your application id
+#   SCALEBUN_SIGNING_PRIVATE_KEY     RSA private-key PEM — signs locally, never sent to ScaleBun
+#   SCALEBUN_SIGNING_KEY_PASSPHRASE  passphrase for the key (only if it is encrypted)
+#   SCALEBUN_KEY_ID                  the signing key id
 #
 # Session JWTs expire in minutes - always use a scalebun_pat_... token in CI.
+# For an unsigned (SHA-256-only) app, omit the three SIGNING_/KEY_ID vars and
+# drop --require-signing below.
 
 stages: [ota]
 
@@ -164,6 +186,7 @@ ota-publish:
       --platform android
       --hermes
       --sourcemap
+      --require-signing
       --rollout 10
       --release-note "$CI_COMMIT_TITLE"
 
@@ -242,7 +265,9 @@ function printNextSteps(provider, file) {
     console.log('Next steps:');
     console.log('  1. Create an access token: dashboard → Settings → Access Tokens');
     console.log('     (or run `scalebun login` locally and copy the scalebun_pat_… it prints)');
-    console.log('  2. Add SCALEBUN_TOKEN, SCALEBUN_API_URL and SCALEBUN_APP_ID as CI secrets.');
+    console.log('  2. Add these CI secrets: SCALEBUN_API_TOKEN, SCALEBUN_API_URL, SCALEBUN_APP_ID,');
+    console.log('     and (for a signed app) SCALEBUN_SIGNING_PRIVATE_KEY, SCALEBUN_KEY_ID');
+    console.log('     (+ SCALEBUN_SIGNING_KEY_PASSPHRASE if the key is encrypted).');
     console.log('  3. Make sure the target channel exists (`scalebun ota channels --app-id <id>`).');
     console.log('  4. Push — the release goes out staged at 10%; widen it from the CI UI.');
 }
@@ -308,11 +333,14 @@ function registerCiInitCommand(program) {
             // Any other system: the commands are plain npx calls over env-var
             // credentials, so print the recipe instead of pretending to support it.
             console.log(`ℹ️  No template for "${provider}" — but any CI works. Set these env vars:`);
-            console.log('     SCALEBUN_TOKEN     (scalebun_pat_… from the dashboard)');
-            console.log('     SCALEBUN_API_URL   (your backend, e.g. https://api.scalebun.com/api/v1)');
+            console.log('     SCALEBUN_API_TOKEN              (scalebun_pat_… from the dashboard)');
+            console.log('     SCALEBUN_API_URL               (your backend, e.g. https://api.scalebun.com/api/v1)');
+            console.log('     SCALEBUN_SIGNING_PRIVATE_KEY   (RSA private-key PEM — signed app only)');
+            console.log('     SCALEBUN_KEY_ID                (the signing key id — signed app only)');
+            console.log('     SCALEBUN_SIGNING_KEY_PASSPHRASE (only if the key is encrypted)');
             console.log('');
             console.log('   Then script the commands directly:');
-            console.log('     npx scalebun ota publish  --app-id $APP_ID --channel production --hermes --rollout 10');
+            console.log('     npx scalebun ota publish  --app-id $APP_ID --channel production --hermes --require-signing --rollout 10');
             console.log('     npx scalebun ota rollout  --app-id $APP_ID --percent 100');
             console.log('     npx scalebun ota pause    --app-id $APP_ID');
             console.log('     npx scalebun ota rollback --app-id $APP_ID --yes');

package/lib/commands/ci-init.js.map

@@ -1 +1 @@
-{"version":3,"file":"ci-init.js","sourceRoot":"","sources":["../../src/commands/ci-init.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiQA,sDAsEC;AAvUD,uCAAyB;AACzB,2CAA6B;AAE7B,sDAAuD;AACvD,0CAA0C;AAC1C,8CAAgD;AAEhD;;;;;;;;;;;GAWG;AAEH,MAAM,uBAAuB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmF/B,CAAC;AAEF,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkD1B,CAAC;AAsCF,KAAK,UAAU,UAAU,CAAC,QAAiB;IACzC,MAAM,KAAK,GAAG,IAAA,6BAAe,GAAE,CAAC;IAChC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,IAAA,sBAAY,EAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5E,MAAM,GAAG,GAAG,IAAI,kBAAS,CAAC,KAAK,CAAC,CAAC;QACjC,OAAO,MAAM,GAAG,CAAC,GAAG,CAAU,cAAc,KAAK,eAAe,CAAC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,oEAAoE;QACpE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC;SAC1B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;SACvD,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC;IAC1F,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IAClC,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,EAAE,CAAC,CAAC;IACtC,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,4CAA4C,EAAE,CAAC,CAAC;IAC/G,IAAI,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;QAC5C,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAChC,wEAAwE;YACxE,qEAAqE;YACrE,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,iBAAiB,CAAC;YACtD,OAAO,CAAC,GAAG,CAAC,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;YACjD,IAAI,GAAG,CAAC,GAAG;gBAAE,OAAO,CAAC,GAAG,CAAC,OAAO,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,UAAkB,EAAE,OAAe;IACxD,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,OAAO,CAAC,KAAK,CACX,KAAK,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,UAAU,CAAC,4CAA4C;YACvF,kDAAkD,CACrD,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/C,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB,EAAE,IAAY;IACpD,OAAO,CAAC,GAAG,CAAC,KAAK,QAAQ,wBAAwB,IAAI,EAAE,CAAC,CAAC;IACzD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC3B,OAAO,CAAC,GAAG,CAAC,mEAAmE,CAAC,CAAC;IACjF,OAAO,CAAC,GAAG,CAAC,8EAA8E,CAAC,CAAC;IAC5F,OAAO,CAAC,GAAG,CAAC,8EAA8E,CAAC,CAAC;IAC5F,OAAO,CAAC,GAAG,CAAC,mFAAmF,CAAC,CAAC;IACjG,OAAO,CAAC,GAAG,CAAC,0EAA0E,CAAC,CAAC;AAC1F,CAAC;AAED,SAAgB,qBAAqB,CAAC,OAAgB;IACpD,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,yBAAyB,CAAC,CAAC;IAExE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,qFAAqF,CAAC;SAClG,MAAM,CAAC,mBAAmB,EAAE,8BAA8B,EAAE,QAAQ,CAAC;SACrE,MAAM,CAAC,eAAe,EAAE,4DAA4D,CAAC;SACrF,MAAM,CAAC,WAAW,EAAE,gDAAgD,CAAC;SACrE,MAAM,CAAC,KAAK,EAAE,IAA6D,EAAE,EAAE;QAC9E,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAE7C,yEAAyE;QACzE,kDAAkD;QAClD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAEjE,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,kBAAkB,CAAC,CAAC;YACpF,MAAM,QAAQ,GAAG,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC;YAC1C,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,IAAI;oBAC9B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAC/C,CAAC,CAAC,MAAM,CAAC;gBACX,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,QAAQ,CAAC;oBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClD,OAAO,CAAC,GAAG,CAAC,wCAAwC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;gBACxF,eAAe,CAAC,KAAM,CAAC,CAAC;gBACxB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAChB,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;gBAC3B,OAAO,CAAC,GAAG,CAAC,mEAAmE,CAAC,CAAC;gBACjF,OAAO,CAAC,GAAG,CAAC,8EAA8E,CAAC,CAAC;gBAC5F,OAAO,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAC;gBAC9D,OAAO,CAAC,GAAG,CAAC,oFAAoF,CAAC,CAAC;gBAClG,OAAO;YACT,CAAC;YACD,IAAI,aAAa,CAAC,MAAM,EAAE,uBAAuB,CAAC,EAAE,CAAC;gBACnD,cAAc,CAAC,gBAAgB,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;gBACvE,sEAAsE;gBACtE,oEAAoE;gBACpE,sCAAsC;gBACtC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAChB,OAAO,CAAC,GAAG,CAAC,uEAAuE,CAAC,CAAC;gBACrF,OAAO,CAAC,GAAG,CAAC,oEAAoE,CAAC,CAAC;gBAClF,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;YACnD,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;aAAM,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,6BAA6B,CAAC,CAAC;YACvE,IAAI,aAAa,CAAC,MAAM,EAAE,kBAAkB,CAAC,EAAE,CAAC;gBAC9C,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;gBAClE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAChB,OAAO,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;gBACtD,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;gBAC5B,OAAO,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC;YAC5D,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,kEAAkE;YAClE,wEAAwE;YACxE,OAAO,CAAC,GAAG,CAAC,wBAAwB,QAAQ,2CAA2C,CAAC,CAAC;YACzF,OAAO,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAC;YAC3E,OAAO,CAAC,GAAG,CAAC,8EAA8E,CAAC,CAAC;YAC5F,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;YACrD,OAAO,CAAC,GAAG,CAAC,4FAA4F,CAAC,CAAC;YAC1G,OAAO,CAAC,GAAG,CAAC,+DAA+D,CAAC,CAAC;YAC7E,OAAO,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC;YAC/D,OAAO,CAAC,GAAG,CAAC,uDAAuD,CAAC,CAAC;QACvE,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"ci-init.js","sourceRoot":"","sources":["../../src/commands/ci-init.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0RA,sDAyEC;AAnWD,uCAAyB;AACzB,2CAA6B;AAE7B,sDAAuD;AACvD,0CAA0C;AAC1C,8CAAgD;AAEhD;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,uBAAuB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4F/B,CAAC;AAEF,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwD1B,CAAC;AAsCF,KAAK,UAAU,UAAU,CAAC,QAAiB;IACzC,MAAM,KAAK,GAAG,IAAA,6BAAe,GAAE,CAAC;IAChC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,IAAA,sBAAY,EAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5E,MAAM,GAAG,GAAG,IAAI,kBAAS,CAAC,KAAK,CAAC,CAAC;QACjC,OAAO,MAAM,GAAG,CAAC,GAAG,CAAU,cAAc,KAAK,eAAe,CAAC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,oEAAoE;QACpE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC;SAC1B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;SACvD,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC;IAC1F,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IAClC,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,EAAE,CAAC,CAAC;IACtC,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,4CAA4C,EAAE,CAAC,CAAC;IAC/G,IAAI,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;QAC5C,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAChC,wEAAwE;YACxE,qEAAqE;YACrE,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,iBAAiB,CAAC;YACtD,OAAO,CAAC,GAAG,CAAC,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;YACjD,IAAI,GAAG,CAAC,GAAG;gBAAE,OAAO,CAAC,GAAG,CAAC,OAAO,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,UAAkB,EAAE,OAAe;IACxD,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,OAAO,CAAC,KAAK,CACX,KAAK,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,UAAU,CAAC,4CAA4C;YACvF,kDAAkD,CACrD,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/C,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB,EAAE,IAAY;IACpD,OAAO,CAAC,GAAG,CAAC,KAAK,QAAQ,wBAAwB,IAAI,EAAE,CAAC,CAAC;IACzD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC3B,OAAO,CAAC,GAAG,CAAC,mEAAmE,CAAC,CAAC;IACjF,OAAO,CAAC,GAAG,CAAC,8EAA8E,CAAC,CAAC;IAC5F,OAAO,CAAC,GAAG,CAAC,mFAAmF,CAAC,CAAC;IACjG,OAAO,CAAC,GAAG,CAAC,2EAA2E,CAAC,CAAC;IACzF,OAAO,CAAC,GAAG,CAAC,mEAAmE,CAAC,CAAC;IACjF,OAAO,CAAC,GAAG,CAAC,mFAAmF,CAAC,CAAC;IACjG,OAAO,CAAC,GAAG,CAAC,0EAA0E,CAAC,CAAC;AAC1F,CAAC;AAED,SAAgB,qBAAqB,CAAC,OAAgB;IACpD,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,yBAAyB,CAAC,CAAC;IAExE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,qFAAqF,CAAC;SAClG,MAAM,CAAC,mBAAmB,EAAE,8BAA8B,EAAE,QAAQ,CAAC;SACrE,MAAM,CAAC,eAAe,EAAE,4DAA4D,CAAC;SACrF,MAAM,CAAC,WAAW,EAAE,gDAAgD,CAAC;SACrE,MAAM,CAAC,KAAK,EAAE,IAA6D,EAAE,EAAE;QAC9E,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAE7C,yEAAyE;QACzE,kDAAkD;QAClD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAEjE,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,kBAAkB,CAAC,CAAC;YACpF,MAAM,QAAQ,GAAG,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC;YAC1C,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,IAAI;oBAC9B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAC/C,CAAC,CAAC,MAAM,CAAC;gBACX,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,QAAQ,CAAC;oBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClD,OAAO,CAAC,GAAG,CAAC,wCAAwC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;gBACxF,eAAe,CAAC,KAAM,CAAC,CAAC;gBACxB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAChB,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;gBAC3B,OAAO,CAAC,GAAG,CAAC,mEAAmE,CAAC,CAAC;gBACjF,OAAO,CAAC,GAAG,CAAC,8EAA8E,CAAC,CAAC;gBAC5F,OAAO,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAC;gBAC9D,OAAO,CAAC,GAAG,CAAC,oFAAoF,CAAC,CAAC;gBAClG,OAAO;YACT,CAAC;YACD,IAAI,aAAa,CAAC,MAAM,EAAE,uBAAuB,CAAC,EAAE,CAAC;gBACnD,cAAc,CAAC,gBAAgB,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;gBACvE,sEAAsE;gBACtE,oEAAoE;gBACpE,sCAAsC;gBACtC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAChB,OAAO,CAAC,GAAG,CAAC,uEAAuE,CAAC,CAAC;gBACrF,OAAO,CAAC,GAAG,CAAC,oEAAoE,CAAC,CAAC;gBAClF,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;YACnD,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;aAAM,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,6BAA6B,CAAC,CAAC;YACvE,IAAI,aAAa,CAAC,MAAM,EAAE,kBAAkB,CAAC,EAAE,CAAC;gBAC9C,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;gBAClE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAChB,OAAO,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;gBACtD,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;gBAC5B,OAAO,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC;YAC5D,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,kEAAkE;YAClE,wEAAwE;YACxE,OAAO,CAAC,GAAG,CAAC,wBAAwB,QAAQ,2CAA2C,CAAC,CAAC;YACzF,OAAO,CAAC,GAAG,CAAC,0EAA0E,CAAC,CAAC;YACxF,OAAO,CAAC,GAAG,CAAC,0FAA0F,CAAC,CAAC;YACxG,OAAO,CAAC,GAAG,CAAC,6EAA6E,CAAC,CAAC;YAC3F,OAAO,CAAC,GAAG,CAAC,4EAA4E,CAAC,CAAC;YAC1F,OAAO,CAAC,GAAG,CAAC,qEAAqE,CAAC,CAAC;YACnF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;YACrD,OAAO,CAAC,GAAG,CAAC,8GAA8G,CAAC,CAAC;YAC5H,OAAO,CAAC,GAAG,CAAC,+DAA+D,CAAC,CAAC;YAC7E,OAAO,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC;YAC/D,OAAO,CAAC,GAAG,CAAC,uDAAuD,CAAC,CAAC;QACvE,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/lib/commands/doctor.d.ts

@@ -1,4 +1,27 @@
 import { Command } from 'commander';
+/**
+ * iOS app sources that build the React host with a STATIC bundle URL.
+ *
+ * RCTHost DOES re-resolve on reload — `_reloadWithShouldRestartSurfaces` calls
+ * `_bundleURLProvider()` again — but only through the provider it was handed.
+ * `initWithBundleURL:` wraps a constant in a block returning that same constant
+ * forever (RCTRootViewFactory.mm), so a host built that way can never see a
+ * bundle that did not exist at launch.
+ *
+ * The symptom is precise and very confusing: the update downloads, verifies,
+ * applies, `restartApp()` runs, every OTA metric reports success — and the app
+ * comes back on the OLD bundle, while a cold start loads it correctly.
+ *
+ * Matched on whole-file text, not per line, because these initialisers are
+ * routinely wrapped across lines. Only the STATIC forms match:
+ * `initWithBundleURLBlock:` / `initWithBundleURLProvider:` / `bundleURLProvider:`
+ * are the dynamic ones, and the trailing colon keeps them out.
+ */
+export declare function findStaticHostConstruction(iosDir: string): {
+    file: string;
+    line: number;
+    text: string;
+}[];
 export declare function registerDoctorCommand(program: Command): void;
 /**
  * All doctor checks as a reusable step (`quickstart` runs it inline).

package/lib/commands/doctor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/commands/doctor.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA2IpC,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAM5D;AAED;;;GAGG;AACH,wBAAsB,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAwV/C"}
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/commands/doctor.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA+DpC;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,MAAM,GACb;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,CAiDhD;AAmFD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAM5D;AAED;;;GAGG;AACH,wBAAsB,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CA6X/C"}

package/lib/commands/doctor.js

@@ -36,6 +36,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.findStaticHostConstruction = findStaticHostConstruction;
 exports.registerDoctorCommand = registerDoctorCommand;
 exports.runDoctor = runDoctor;
 const fs = __importStar(require("fs"));
@@ -84,6 +85,78 @@ function findFile(dir, names, maxDepth = 6) {
     }
     return null;
 }
+/**
+ * iOS app sources that build the React host with a STATIC bundle URL.
+ *
+ * RCTHost DOES re-resolve on reload — `_reloadWithShouldRestartSurfaces` calls
+ * `_bundleURLProvider()` again — but only through the provider it was handed.
+ * `initWithBundleURL:` wraps a constant in a block returning that same constant
+ * forever (RCTRootViewFactory.mm), so a host built that way can never see a
+ * bundle that did not exist at launch.
+ *
+ * The symptom is precise and very confusing: the update downloads, verifies,
+ * applies, `restartApp()` runs, every OTA metric reports success — and the app
+ * comes back on the OLD bundle, while a cold start loads it correctly.
+ *
+ * Matched on whole-file text, not per line, because these initialisers are
+ * routinely wrapped across lines. Only the STATIC forms match:
+ * `initWithBundleURLBlock:` / `initWithBundleURLProvider:` / `bundleURLProvider:`
+ * are the dynamic ones, and the trailing colon keeps them out.
+ */
+function findStaticHostConstruction(iosDir) {
+    const hits = [];
+    const patterns = [
+        /\[\s*\[\s*(?:RCTHost|RCTRootViewFactory|RCTRootViewFactoryConfiguration)\s+alloc\s*\]\s*initWithBundleURL:/g,
+        /\b(?:RCTHost|RCTRootViewFactory|RCTRootViewFactoryConfiguration)\s*\(\s*bundleURL\s*:/g,
+    ];
+    const walk = (dir, depth) => {
+        if (depth < 0)
+            return;
+        let entries;
+        try {
+            entries = fs.readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const e of entries) {
+            const full = path.join(dir, e.name);
+            if (e.isDirectory()) {
+                // Pods is RN's own source — it legitimately contains both initialisers,
+                // and reporting React Native to the user as their bug helps nobody.
+                if (['Pods', 'build', 'DerivedData', '.git'].includes(e.name))
+                    continue;
+                if (/\.(xcodeproj|xcworkspace|framework|xcframework)$/.test(e.name))
+                    continue;
+                walk(full, depth - 1);
+                continue;
+            }
+            if (!/\.(swift|m|mm)$/.test(e.name))
+                continue;
+            let src;
+            try {
+                src = fs.readFileSync(full, 'utf8');
+            }
+            catch {
+                continue;
+            }
+            for (const re of patterns) {
+                re.lastIndex = 0;
+                let m;
+                while ((m = re.exec(src)) !== null) {
+                    const line = src.slice(0, m.index).split('\n').length;
+                    hits.push({
+                        file: full,
+                        line,
+                        text: (src.split('\n')[line - 1] ?? '').trim(),
+                    });
+                }
+            }
+        }
+    };
+    walk(iosDir, 5);
+    return hits;
+}
 /**
  * The public half of the local signing key, as the hex the SDK wants.
  *
@@ -200,7 +273,9 @@ async function runDoctor() {
             report('fail', 'Not logged in', 'Run `scalebun login`, or set SCALEBUN_TOKEN + SCALEBUN_API_URL in CI.');
         }
         else {
-            const source = process.env.SCALEBUN_TOKEN ? 'environment variables' : '~/.scalebun/credentials.json';
+            const source = process.env.SCALEBUN_TOKEN || process.env.SCALEBUN_API_TOKEN
+                ? 'environment variables'
+                : '~/.scalebun/credentials.json';
             if (creds.token.startsWith('scalebun_pat_')) {
                 report('ok', `Credentials found (${source}, durable access token)`);
             }
@@ -227,11 +302,21 @@ async function runDoctor() {
         }
         const hermesc = (0, bundle_1.resolveHermesc)(cwd);
         if (hermesc) {
-            report('ok', 'hermesc found — `--hermes` publishes will compile bytecode');
+            report('ok', `hermesc found — \`--hermes\` publishes will compile bytecode`, hermesc);
         }
         else if (rnVersion) {
-            report('warn', 'hermesc not found under node_modules/react-native/sdks/hermesc', 'Publishes fall back to plain JS: they work, but cold start is ~20-30% slower\n' +
-                'and Hermes-bytecode runtime gating cannot protect these bundles.');
+            // Name every place that was searched. The old message named only the
+            // prebuilt path, which on RN 0.87 does not exist at all — so it read as
+            // "your install is broken" when the binary had simply moved into the
+            // hermes-engine pod and `pod install` had not been run.
+            report('warn', 'hermesc not found — searched every known location', (0, bundle_1.hermescCandidates)(cwd)
+                .map((c) => `  · ${c}`)
+                .join('\n') +
+                '\n\nOn RN 0.87+ hermesc ships in the hermes-engine pod: run `pod install`\n' +
+                'in ios/, or set HERMES_CLI_PATH to your binary.\n' +
+                'Without it, publishes fall back to plain JS: they work, but cold start is\n' +
+                '~20-30% slower, Hermes-bytecode runtime gating cannot protect these bundles,\n' +
+                'and delta patching breaks (plain JS cannot diff against a bytecode base).');
         }
         // ── 3. Android wiring ──────────────────────────────────────────────────
         const gradleProps = path.join(cwd, 'android', 'gradle.properties');
@@ -319,6 +404,26 @@ async function runDoctor() {
                         '  }');
                 }
             }
+            // A wired bundleURL is necessary but NOT sufficient: it only runs again
+            // if the host asks again. This is the "update installs, restart does
+            // nothing, cold start works" report, and it is invisible from JS —
+            // download, verify, apply and restart all succeed.
+            const staticHost = findStaticHostConstruction(path.join(cwd, 'ios'));
+            if (staticHost.length) {
+                report('fail', 'React host is built with a STATIC bundle URL — restarts will not load an update', staticHost
+                    .map((h) => `  · ${path.relative(cwd, h.file)}:${h.line}  ${h.text}`)
+                    .join('\n') +
+                    '\n\ninitWithBundleURL: captures the URL once and wraps it in a block that returns\n' +
+                    'that same URL forever, so the host can never see a bundle installed later.\n' +
+                    'The update downloads, verifies, applies and reports success, restartApp()\n' +
+                    'runs — and the app comes back on the OLD bundle. A cold start loads it fine,\n' +
+                    'which is what makes this so hard to place.\n\n' +
+                    'Fix: hand the host a provider that is CALLED on every reload.\n' +
+                    '  ObjC:  [[RCTHost alloc] initWithBundleURLProvider:^{ return [self bundleURL]; }\n' +
+                    '  Swift: RCTHost(bundleURLProvider: { self.bundleURL() }, ...)\n\n' +
+                    'Or drop the custom host entirely — RCTAppDelegate / RCTReactNativeFactory\n' +
+                    'already build one from a block that calls your bundleURL override each time.');
+            }
         }
         // ── 5. Signing ─────────────────────────────────────────────────────────
         const keyPath = path.join(cwd, '.scalebun', 'ota-signing-key.pem');

package/lib/commands/doctor.js.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../../src/commands/doctor.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8IA,sDAMC;AAMD,8BAwVC;AAlfD,uCAAyB;AACzB,+CAAiC;AACjC,2CAA6B;AAE7B,kDAA0B;AAC1B,4CAAyE;AACzE,sDAAuD;AACvD,0CAA0C;AAC1C,4CAAwF;AAoBxF,MAAM,QAAQ,GAAc,EAAE,CAAC;AAE/B,SAAS,MAAM,CAAC,KAAY,EAAE,KAAa,EAAE,MAAe;IAC1D,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACxC,6EAA6E;IAC7E,4DAA4D;IAC5D,IAAI,IAAA,eAAM,GAAE;QAAE,OAAO;IACrB,MAAM,IAAI,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC;IACnE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC;IAChC,IAAI,MAAM;QAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,gFAAgF;AAChF,SAAS,QAAQ,CAAC,GAAW,EAAE,KAAe,EAAE,QAAQ,GAAG,CAAC;IAC1D,IAAI,QAAQ,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,IAAI,OAAoB,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC1E,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE;YAAE,SAAS;QAC/B,IAAI,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,SAAS;QACpF,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC;QAClE,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC;IACtB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,kBAAkB,CAAC,cAAsB;IAChD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,CAAC;QACtE,MAAM,GAAG,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACjF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,cAAc,CAAC,GAAW;IACjC,MAAM,MAAM,GAAG,2BAA2B,CAAC;IAC3C,MAAM,KAAK,GAAG,CAAC,UAAU,EAAE,eAAe,EAAE,eAAe,EAAE,eAAe,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAC5F,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,KAAa,EAAW,EAAE;QACnD,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAC5B,IAAI,OAAoB,CAAC;QACzB,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,4CAA4C,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5E,IAAI,CAAC;oBACH,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;wBAAE,OAAO,IAAI,CAAC;gBAC9D,CAAC;gBAAC,MAAM,CAAC;oBACP,oCAAoC;gBACtC,CAAC;YACH,CAAC;iBAAM,IAAI,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1F,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC;oBAAE,OAAO,IAAI,CAAC;YACzC,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS;QACnC,IAAI,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YACpC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC;gBACH,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;oBAAE,OAAO,IAAI,CAAC;YAC9D,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;QACH,CAAC;IACH,CAAC;IACD,qEAAqE;IACrE,KAAK,MAAM,GAAG,IAAI,CAAC,sBAAsB,EAAE,KAAK,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACjC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IACxD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,OAAsB;IACxC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC;AAED,SAAgB,qBAAqB,CAAC,OAAgB;IACpD,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,6DAA6D,CAAC;SAC1E,MAAM,CAAC,QAAQ,EAAE,uDAAuD,CAAC;SACzE,MAAM,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;AAC/B,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,SAAS;IAC7B,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,uCAAuC;IAC5D,CAAC;QACG,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,qEAAqE;QACrE,oEAAoE;QACpE,IAAI,CAAC,IAAA,eAAM,GAAE;YAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;QAElD,0EAA0E;QAC1E,MAAM,KAAK,GAAG,IAAA,6BAAe,GAAE,CAAC;QAChC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,CACJ,MAAM,EACN,eAAe,EACf,uEAAuE,CACxE,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,8BAA8B,CAAC;YACrG,IAAI,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;gBAC5C,MAAM,CAAC,IAAI,EAAE,sBAAsB,MAAM,yBAAyB,CAAC,CAAC;YACtE,CAAC;iBAAM,CAAC;gBACN,MAAM,CACJ,MAAM,EACN,sBAAsB,MAAM,kCAAkC,EAC9D,mFAAmF;oBACjF,uCAAuC,CAC1C,CAAC;YACJ,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,EAAE,GAAG,MAAM,IAAI,kBAAS,CAAC,KAAK,CAAC,CAAC,GAAG,CAAoB,UAAU,CAAC,CAAC;gBACzE,MAAM,CAAC,IAAI,EAAE,kCAAkC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;YAC7D,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,MAAM,CAAC,MAAM,EAAE,8BAA8B,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;QAED,0EAA0E;QAC1E,MAAM,SAAS,GAAG,IAAA,+BAAsB,EAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,IAAA,sBAAa,EAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,CACJ,MAAM,EACN,wCAAwC,EACxC,6DAA6D,CAC9D,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,EAAE,gBAAgB,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,CAAC;QAChF,CAAC;QAED,MAAM,OAAO,GAAG,IAAA,uBAAc,EAAC,GAAG,CAAC,CAAC;QACpC,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,CAAC,IAAI,EAAE,4DAA4D,CAAC,CAAC;QAC7E,CAAC;aAAM,IAAI,SAAS,EAAE,CAAC;YACrB,MAAM,CACJ,MAAM,EACN,gEAAgE,EAChE,gFAAgF;gBAC9E,kEAAkE,CACrE,CAAC;QACJ,CAAC;QAED,0EAA0E;QAC1E,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC;QACnE,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE;YACxE,oBAAoB;YACpB,sBAAsB;SACvB,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;QAEpC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;YAC9C,MAAM,CAAC,MAAM,EAAE,iDAAiD,CAAC,CAAC;QACpE,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GACX,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC;gBAC1B,2BAA2B,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;YAE1E,uEAAuE;YACvE,uEAAuE;YACvE,mEAAmE;YACnE,IAAI,OAAO,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/E,MAAM,CACJ,MAAM,EACN,4CAA4C,SAAS,4BAA4B,EACjF,6EAA6E;oBAC3E,8EAA8E;oBAC9E,4DAA4D,CAC/D,CAAC;YACJ,CAAC;iBAAM,IAAI,OAAO,IAAI,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACtD,MAAM,CACJ,MAAM,EACN,6EAA6E,EAC7E,6BAA6B,CAC9B,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,CAAC,MAAM,EAAE,mEAAmE,CAAC,CAAC;YACtF,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC9C,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,mCAAmC,CAAC,CAAC;gBAChE,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBAExC,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,MAAM,CACJ,MAAM,EACN,2CAA2C,GAAG,GAAG,EACjD,iFAAiF;wBAC/E,0EAA0E;wBAC1E,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;4BACxC,CAAC,CAAC,yEAAyE;gCACzE,iDAAiD;gCACjD,yDAAyD;gCACzD,mDAAmD;gCACnD,mFAAmF;gCACnF,KAAK;4BACP,CAAC,CAAC,oCAAoC;gCACpC,+CAA+C;gCAC/C,wFAAwF,CAAC,CAChG,CAAC;gBACJ,CAAC;qBAAM,IACL,KAAK;oBACL,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;oBAChC,CAAC,GAAG,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EACjC,CAAC;oBACD,MAAM,CACJ,MAAM,EACN,MAAM,SAAS,+CAA+C,GAAG,GAAG,EACpE,8EAA8E;wBAC5E,8EAA8E,CACjF,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,IAAI,EAAE,oCAAoC,GAAG,GAAG,CAAC,CAAC;gBAC3D,CAAC;YACH,CAAC;QACH,CAAC;QAED,0EAA0E;QAC1E,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YAC1C,MAAM,CAAC,MAAM,EAAE,yCAAyC,CAAC,CAAC;QAC5D,CAAC;aAAM,CAAC;YACN,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE;gBAClD,mBAAmB;gBACnB,gBAAgB;gBAChB,eAAe;aAChB,CAAC,CAAC;YACH,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,MAAM,CAAC,MAAM,EAAE,kDAAkD,CAAC,CAAC;YACrE,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;gBAClD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;gBAC5C,IAAI,GAAG,CAAC,QAAQ,CAAC,gCAAgC,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;oBACrF,MAAM,CAAC,IAAI,EAAE,gCAAgC,GAAG,GAAG,CAAC,CAAC;gBACvD,CAAC;qBAAM,CAAC;oBACN,MAAM,CACJ,MAAM,EACN,uCAAuC,GAAG,GAAG,EAC7C,+CAA+C;wBAC7C,yCAAyC;wBACzC,iBAAiB;wBACjB,mFAAmF;wBACnF,aAAa;wBACb,0CAA0C;wBAC1C,cAAc;wBACd,KAAK,CACR,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,0EAA0E;QAC1E,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,qBAAqB,CAAC,CAAC;QACnE,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,kEAAkE;YAClE,kEAAkE;YAClE,sEAAsE;YACtE,iEAAiE;YACjE,gEAAgE;YAChE,uEAAuE;YACvE,4CAA4C;YAC5C,EAAE;YACF,qEAAqE;YACrE,uEAAuE;YACvE,oEAAoE;YACpE,0EAA0E;YAC1E,2EAA2E;YAC3E,qEAAqE;YACrE,sEAAsE;YACtE,sEAAsE;YACtE,sEAAsE;YACtE,qCAAqC;YACrC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CACzB,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,wBAAwB,CACzE,CAAC;YACF,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAC3B,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,CAC7E,CAAC;YAEF,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC7B,IAAI,cAAc,GAAa,EAAE,CAAC;gBAClC,IAAI,eAAe,GAAG,EAAE,CAAC;gBACzB,IAAI,UAAU,GAAG,EAAE,CAAC;gBACpB,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;oBAC9D,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;oBACjD,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;wBACzC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;wBACpE,CAAC,CAAC,EAAE,CAAC;gBACT,CAAC;gBAAC,OAAO,CAAM,EAAE,CAAC;oBAChB,UAAU,GAAG,CAAC,EAAE,OAAO,IAAI,aAAa,CAAC;gBAC3C,CAAC;gBAED,IAAI,UAAU,EAAE,CAAC;oBACf,MAAM,CACJ,MAAM,EACN,sDAAsD,EACtD,kFAAkF;wBAChF,mDAAmD,GAAG,UAAU,CACnE,CAAC;gBACJ,CAAC;qBAAM,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACvC,MAAM,CACJ,MAAM,EACN,yCAAyC,EACzC,kFAAkF;wBAChF,2DAA2D,CAC9D,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,MAAM,CACJ,IAAI,EACJ,iCAAiC,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,oCAAoC,CACrG,CAAC;oBACF,IAAI,CAAC,eAAe,EAAE,CAAC;wBACrB,MAAM,CACJ,MAAM,EACN,oCAAoC,EACpC,2EAA2E;4BACzE,sDAAsD,CACzD,CAAC;oBACJ,CAAC;oBACD,uDAAuD;oBACvD,EAAE;oBACF,wEAAwE;oBACxE,wEAAwE;oBACxE,kEAAkE;oBAClE,wEAAwE;oBACxE,qEAAqE;oBACrE,0DAA0D;oBAC1D,EAAE;oBACF,uEAAuE;oBACvE,sEAAsE;oBACtE,0BAA0B;oBAC1B,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBAC9B,MAAM,CACJ,MAAM,EACN,sEAAsE,EACtE,+EAA+E;4BAC7E,+EAA+E;4BAC/E,6EAA6E;4BAC7E,iEAAiE,CACpE,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;iBAAM,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;gBACtC,MAAM,CACJ,MAAM,EACN,2EAA2E,EAC3E,kFAAkF;oBAChF,kFAAkF;oBAClF,6BAA6B;oBAC7B,yDAAyD;oBACzD,yDAAyD,CAC5D,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,CACJ,MAAM,EACN,yEAAyE,EACzE,+EAA+E;oBAC7E,+EAA+E;oBAC/E,sDAAsD,CACzD,CAAC;YACJ,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YAC/C,MAAM,OAAO,GACX,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,iCAAiC,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;YAC1G,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,CACJ,MAAM,EACN,4EAA4E,EAC5E,gEAAgE;oBAC9D,kFAAkF,CACrF,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,CACJ,MAAM,EACN,0DAA0D,EAC1D,sFAAsF;gBACpF,2EAA2E,CAC9E,CAAC;QACJ,CAAC;QAED,0EAA0E;QAC1E,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;QAChE,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;QAChE,yEAAyE;QACzE,uEAAuE;QACvE,uEAAuE;QACvE,yDAAyD;QACzD,IAAI,IAAA,eAAM,GAAE,EAAE,CAAC;YACb,IAAA,aAAI,EACF,GAAG,EAAE,GAAE,CAAC,EACR;gBACE,EAAE,EAAE,KAAK,KAAK,CAAC;gBACf,QAAQ,EAAE,KAAK;gBACf,QAAQ,EAAE,KAAK;gBACf,QAAQ;aACT,CACF,CAAC;YACF,IAAI,KAAK,GAAG,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,iBAAQ,CAAC,IAAI,CAAC,CAAC;YAC3C,OAAO;QACT,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,uBAAuB,KAAK,mDAAmD,CAAC,CAAC;YACrG,OAAO,CAAC,IAAI,CAAC,iBAAQ,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC;QACD,OAAO,CAAC,GAAG,CACT,KAAK,GAAG,CAAC;YACP,CAAC,CAAC,uBAAuB,KAAK,yCAAyC;YACvE,CAAC,CAAC,8CAA8C,CACnD,CAAC;QACF,yEAAyE;QACzE,wEAAwE;QACxE,sCAAsC;QACtC,IAAA,uBAAc,EACZ;YACE,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE;YACrD,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;gBAC5D,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,mBAAmB,CAAC,EAAE,CAAC;gBACtE,CAAC,CAAC,EAAE,CAAC;SACR,EACD,eAAK,CAAC,IAAI,CACX,CAAC;IACN,CAAC;AACH,CAAC"}
+{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../../src/commands/doctor.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoFA,gEAmDC;AAmFD,sDAMC;AAMD,8BA6XC;AAnmBD,uCAAyB;AACzB,+CAAiC;AACjC,2CAA6B;AAE7B,kDAA0B;AAC1B,4CAAyE;AACzE,sDAAuD;AACvD,0CAA0C;AAC1C,4CAKyB;AAoBzB,MAAM,QAAQ,GAAc,EAAE,CAAC;AAE/B,SAAS,MAAM,CAAC,KAAY,EAAE,KAAa,EAAE,MAAe;IAC1D,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACxC,6EAA6E;IAC7E,4DAA4D;IAC5D,IAAI,IAAA,eAAM,GAAE;QAAE,OAAO;IACrB,MAAM,IAAI,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC;IACnE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC;IAChC,IAAI,MAAM;QAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,gFAAgF;AAChF,SAAS,QAAQ,CAAC,GAAW,EAAE,KAAe,EAAE,QAAQ,GAAG,CAAC;IAC1D,IAAI,QAAQ,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,IAAI,OAAoB,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC1E,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE;YAAE,SAAS;QAC/B,IAAI,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,SAAS;QACpF,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC;QAClE,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC;IACtB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAgB,0BAA0B,CACxC,MAAc;IAEd,MAAM,IAAI,GAAmD,EAAE,CAAC;IAChE,MAAM,QAAQ,GAAG;QACf,6GAA6G;QAC7G,wFAAwF;KACzF,CAAC;IAEF,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,KAAa,EAAQ,EAAE;QAChD,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO;QACtB,IAAI,OAAoB,CAAC;QACzB,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;gBACpB,wEAAwE;gBACxE,oEAAoE;gBACpE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;oBAAE,SAAS;gBACxE,IAAI,kDAAkD,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;oBAAE,SAAS;gBAC9E,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;gBACtB,SAAS;YACX,CAAC;YACD,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC9C,IAAI,GAAW,CAAC;YAChB,IAAI,CAAC;gBACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACtC,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;gBAC1B,EAAE,CAAC,SAAS,GAAG,CAAC,CAAC;gBACjB,IAAI,CAAyB,CAAC;gBAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;oBACnC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;oBACtD,IAAI,CAAC,IAAI,CAAC;wBACR,IAAI,EAAE,IAAI;wBACV,IAAI;wBACJ,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;qBAC/C,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAChB,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,kBAAkB,CAAC,cAAsB;IAChD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,CAAC;QACtE,MAAM,GAAG,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACjF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,cAAc,CAAC,GAAW;IACjC,MAAM,MAAM,GAAG,2BAA2B,CAAC;IAC3C,MAAM,KAAK,GAAG,CAAC,UAAU,EAAE,eAAe,EAAE,eAAe,EAAE,eAAe,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAC5F,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,KAAa,EAAW,EAAE;QACnD,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAC5B,IAAI,OAAoB,CAAC;QACzB,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,4CAA4C,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5E,IAAI,CAAC;oBACH,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;wBAAE,OAAO,IAAI,CAAC;gBAC9D,CAAC;gBAAC,MAAM,CAAC;oBACP,oCAAoC;gBACtC,CAAC;YACH,CAAC;iBAAM,IAAI,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1F,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC;oBAAE,OAAO,IAAI,CAAC;YACzC,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS;QACnC,IAAI,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YACpC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC;gBACH,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;oBAAE,OAAO,IAAI,CAAC;YAC9D,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;QACH,CAAC;IACH,CAAC;IACD,qEAAqE;IACrE,KAAK,MAAM,GAAG,IAAI,CAAC,sBAAsB,EAAE,KAAK,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACjC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IACxD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,OAAsB;IACxC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC;AAED,SAAgB,qBAAqB,CAAC,OAAgB;IACpD,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,6DAA6D,CAAC;SAC1E,MAAM,CAAC,QAAQ,EAAE,uDAAuD,CAAC;SACzE,MAAM,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;AAC/B,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,SAAS;IAC7B,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,uCAAuC;IAC5D,CAAC;QACG,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,qEAAqE;QACrE,oEAAoE;QACpE,IAAI,CAAC,IAAA,eAAM,GAAE;YAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;QAElD,0EAA0E;QAC1E,MAAM,KAAK,GAAG,IAAA,6BAAe,GAAE,CAAC;QAChC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,CACJ,MAAM,EACN,eAAe,EACf,uEAAuE,CACxE,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GACV,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB;gBAC1D,CAAC,CAAC,uBAAuB;gBACzB,CAAC,CAAC,8BAA8B,CAAC;YACrC,IAAI,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;gBAC5C,MAAM,CAAC,IAAI,EAAE,sBAAsB,MAAM,yBAAyB,CAAC,CAAC;YACtE,CAAC;iBAAM,CAAC;gBACN,MAAM,CACJ,MAAM,EACN,sBAAsB,MAAM,kCAAkC,EAC9D,mFAAmF;oBACjF,uCAAuC,CAC1C,CAAC;YACJ,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,EAAE,GAAG,MAAM,IAAI,kBAAS,CAAC,KAAK,CAAC,CAAC,GAAG,CAAoB,UAAU,CAAC,CAAC;gBACzE,MAAM,CAAC,IAAI,EAAE,kCAAkC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;YAC7D,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,MAAM,CAAC,MAAM,EAAE,8BAA8B,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;QAED,0EAA0E;QAC1E,MAAM,SAAS,GAAG,IAAA,+BAAsB,EAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,IAAA,sBAAa,EAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,CACJ,MAAM,EACN,wCAAwC,EACxC,6DAA6D,CAC9D,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,EAAE,gBAAgB,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,CAAC;QAChF,CAAC;QAED,MAAM,OAAO,GAAG,IAAA,uBAAc,EAAC,GAAG,CAAC,CAAC;QACpC,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,CAAC,IAAI,EAAE,8DAA8D,EAAE,OAAO,CAAC,CAAC;QACxF,CAAC;aAAM,IAAI,SAAS,EAAE,CAAC;YACrB,qEAAqE;YACrE,wEAAwE;YACxE,qEAAqE;YACrE,wDAAwD;YACxD,MAAM,CACJ,MAAM,EACN,mDAAmD,EACnD,IAAA,0BAAiB,EAAC,GAAG,CAAC;iBACnB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;iBACtB,IAAI,CAAC,IAAI,CAAC;gBACX,6EAA6E;gBAC7E,mDAAmD;gBACnD,6EAA6E;gBAC7E,gFAAgF;gBAChF,2EAA2E,CAC9E,CAAC;QACJ,CAAC;QAED,0EAA0E;QAC1E,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC;QACnE,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE;YACxE,oBAAoB;YACpB,sBAAsB;SACvB,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;QAEpC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;YAC9C,MAAM,CAAC,MAAM,EAAE,iDAAiD,CAAC,CAAC;QACpE,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GACX,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC;gBAC1B,2BAA2B,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;YAE1E,uEAAuE;YACvE,uEAAuE;YACvE,mEAAmE;YACnE,IAAI,OAAO,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/E,MAAM,CACJ,MAAM,EACN,4CAA4C,SAAS,4BAA4B,EACjF,6EAA6E;oBAC3E,8EAA8E;oBAC9E,4DAA4D,CAC/D,CAAC;YACJ,CAAC;iBAAM,IAAI,OAAO,IAAI,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACtD,MAAM,CACJ,MAAM,EACN,6EAA6E,EAC7E,6BAA6B,CAC9B,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,CAAC,MAAM,EAAE,mEAAmE,CAAC,CAAC;YACtF,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC9C,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,mCAAmC,CAAC,CAAC;gBAChE,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBAExC,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,MAAM,CACJ,MAAM,EACN,2CAA2C,GAAG,GAAG,EACjD,iFAAiF;wBAC/E,0EAA0E;wBAC1E,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;4BACxC,CAAC,CAAC,yEAAyE;gCACzE,iDAAiD;gCACjD,yDAAyD;gCACzD,mDAAmD;gCACnD,mFAAmF;gCACnF,KAAK;4BACP,CAAC,CAAC,oCAAoC;gCACpC,+CAA+C;gCAC/C,wFAAwF,CAAC,CAChG,CAAC;gBACJ,CAAC;qBAAM,IACL,KAAK;oBACL,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;oBAChC,CAAC,GAAG,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EACjC,CAAC;oBACD,MAAM,CACJ,MAAM,EACN,MAAM,SAAS,+CAA+C,GAAG,GAAG,EACpE,8EAA8E;wBAC5E,8EAA8E,CACjF,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,IAAI,EAAE,oCAAoC,GAAG,GAAG,CAAC,CAAC;gBAC3D,CAAC;YACH,CAAC;QACH,CAAC;QAED,0EAA0E;QAC1E,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YAC1C,MAAM,CAAC,MAAM,EAAE,yCAAyC,CAAC,CAAC;QAC5D,CAAC;aAAM,CAAC;YACN,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE;gBAClD,mBAAmB;gBACnB,gBAAgB;gBAChB,eAAe;aAChB,CAAC,CAAC;YACH,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,MAAM,CAAC,MAAM,EAAE,kDAAkD,CAAC,CAAC;YACrE,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;gBAClD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;gBAC5C,IAAI,GAAG,CAAC,QAAQ,CAAC,gCAAgC,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;oBACrF,MAAM,CAAC,IAAI,EAAE,gCAAgC,GAAG,GAAG,CAAC,CAAC;gBACvD,CAAC;qBAAM,CAAC;oBACN,MAAM,CACJ,MAAM,EACN,uCAAuC,GAAG,GAAG,EAC7C,+CAA+C;wBAC7C,yCAAyC;wBACzC,iBAAiB;wBACjB,mFAAmF;wBACnF,aAAa;wBACb,0CAA0C;wBAC1C,cAAc;wBACd,KAAK,CACR,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,wEAAwE;YACxE,qEAAqE;YACrE,mEAAmE;YACnE,mDAAmD;YACnD,MAAM,UAAU,GAAG,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;YACrE,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;gBACtB,MAAM,CACJ,MAAM,EACN,iFAAiF,EACjF,UAAU;qBACP,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;qBACpE,IAAI,CAAC,IAAI,CAAC;oBACX,qFAAqF;oBACrF,8EAA8E;oBAC9E,6EAA6E;oBAC7E,gFAAgF;oBAChF,gDAAgD;oBAChD,iEAAiE;oBACjE,qFAAqF;oBACrF,oEAAoE;oBACpE,6EAA6E;oBAC7E,8EAA8E,CACjF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,0EAA0E;QAC1E,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,qBAAqB,CAAC,CAAC;QACnE,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,kEAAkE;YAClE,kEAAkE;YAClE,sEAAsE;YACtE,iEAAiE;YACjE,gEAAgE;YAChE,uEAAuE;YACvE,4CAA4C;YAC5C,EAAE;YACF,qEAAqE;YACrE,uEAAuE;YACvE,oEAAoE;YACpE,0EAA0E;YAC1E,2EAA2E;YAC3E,qEAAqE;YACrE,sEAAsE;YACtE,sEAAsE;YACtE,sEAAsE;YACtE,qCAAqC;YACrC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CACzB,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,wBAAwB,CACzE,CAAC;YACF,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAC3B,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,CAC7E,CAAC;YAEF,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC7B,IAAI,cAAc,GAAa,EAAE,CAAC;gBAClC,IAAI,eAAe,GAAG,EAAE,CAAC;gBACzB,IAAI,UAAU,GAAG,EAAE,CAAC;gBACpB,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;oBAC9D,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;oBACjD,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;wBACzC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;wBACpE,CAAC,CAAC,EAAE,CAAC;gBACT,CAAC;gBAAC,OAAO,CAAM,EAAE,CAAC;oBAChB,UAAU,GAAG,CAAC,EAAE,OAAO,IAAI,aAAa,CAAC;gBAC3C,CAAC;gBAED,IAAI,UAAU,EAAE,CAAC;oBACf,MAAM,CACJ,MAAM,EACN,sDAAsD,EACtD,kFAAkF;wBAChF,mDAAmD,GAAG,UAAU,CACnE,CAAC;gBACJ,CAAC;qBAAM,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACvC,MAAM,CACJ,MAAM,EACN,yCAAyC,EACzC,kFAAkF;wBAChF,2DAA2D,CAC9D,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,MAAM,CACJ,IAAI,EACJ,iCAAiC,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,oCAAoC,CACrG,CAAC;oBACF,IAAI,CAAC,eAAe,EAAE,CAAC;wBACrB,MAAM,CACJ,MAAM,EACN,oCAAoC,EACpC,2EAA2E;4BACzE,sDAAsD,CACzD,CAAC;oBACJ,CAAC;oBACD,uDAAuD;oBACvD,EAAE;oBACF,wEAAwE;oBACxE,wEAAwE;oBACxE,kEAAkE;oBAClE,wEAAwE;oBACxE,qEAAqE;oBACrE,0DAA0D;oBAC1D,EAAE;oBACF,uEAAuE;oBACvE,sEAAsE;oBACtE,0BAA0B;oBAC1B,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBAC9B,MAAM,CACJ,MAAM,EACN,sEAAsE,EACtE,+EAA+E;4BAC7E,+EAA+E;4BAC/E,6EAA6E;4BAC7E,iEAAiE,CACpE,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;iBAAM,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;gBACtC,MAAM,CACJ,MAAM,EACN,2EAA2E,EAC3E,kFAAkF;oBAChF,kFAAkF;oBAClF,6BAA6B;oBAC7B,yDAAyD;oBACzD,yDAAyD,CAC5D,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,CACJ,MAAM,EACN,yEAAyE,EACzE,+EAA+E;oBAC7E,+EAA+E;oBAC/E,sDAAsD,CACzD,CAAC;YACJ,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YAC/C,MAAM,OAAO,GACX,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,iCAAiC,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;YAC1G,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,CACJ,MAAM,EACN,4EAA4E,EAC5E,gEAAgE;oBAC9D,kFAAkF,CACrF,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,CACJ,MAAM,EACN,0DAA0D,EAC1D,sFAAsF;gBACpF,2EAA2E,CAC9E,CAAC;QACJ,CAAC;QAED,0EAA0E;QAC1E,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;QAChE,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;QAChE,yEAAyE;QACzE,uEAAuE;QACvE,uEAAuE;QACvE,yDAAyD;QACzD,IAAI,IAAA,eAAM,GAAE,EAAE,CAAC;YACb,IAAA,aAAI,EACF,GAAG,EAAE,GAAE,CAAC,EACR;gBACE,EAAE,EAAE,KAAK,KAAK,CAAC;gBACf,QAAQ,EAAE,KAAK;gBACf,QAAQ,EAAE,KAAK;gBACf,QAAQ;aACT,CACF,CAAC;YACF,IAAI,KAAK,GAAG,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,iBAAQ,CAAC,IAAI,CAAC,CAAC;YAC3C,OAAO;QACT,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,uBAAuB,KAAK,mDAAmD,CAAC,CAAC;YACrG,OAAO,CAAC,IAAI,CAAC,iBAAQ,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC;QACD,OAAO,CAAC,GAAG,CACT,KAAK,GAAG,CAAC;YACP,CAAC,CAAC,uBAAuB,KAAK,yCAAyC;YACvE,CAAC,CAAC,8CAA8C,CACnD,CAAC;QACF,yEAAyE;QACzE,wEAAwE;QACxE,sCAAsC;QACtC,IAAA,uBAAc,EACZ;YACE,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE;YACrD,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;gBAC5D,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,mBAAmB,CAAC,EAAE,CAAC;gBACtE,CAAC,CAAC,EAAE,CAAC;SACR,EACD,eAAK,CAAC,IAAI,CACX,CAAC;IACN,CAAC;AACH,CAAC"}

package/lib/commands/ota-keys.d.ts

@@ -28,6 +28,45 @@ export declare function readLocalKeyId(keyDir?: string): string | null;
 export declare function readLocalPrivatePem(keyDir?: string): string | null;
 /** SPKI public-key PEM derived from the local private key, if present. */
 export declare function localPublicPem(keyDir?: string): string | null;
+export declare const ENV_SIGNING_PRIVATE_KEY = "SCALEBUN_SIGNING_PRIVATE_KEY";
+export declare const ENV_SIGNING_KEY_PASSPHRASE = "SCALEBUN_SIGNING_KEY_PASSPHRASE";
+export declare const ENV_KEY_ID = "SCALEBUN_KEY_ID";
+export declare const ENV_REQUIRE_SIGNING = "SCALEBUN_REQUIRE_SIGNING";
+export type MaterialSource = 'flag' | 'env' | 'file' | 'none';
+export interface SigningMaterial {
+    /** PKCS#8 private-key PEM (possibly encrypted), or null when none is configured. */
+    privatePem: string | null;
+    privateSource: MaterialSource;
+    keyId: string | null;
+    keyIdSource: MaterialSource;
+    /** Passphrase for an encrypted private key, if supplied. */
+    passphrase: string | undefined;
+}
+/**
+ * Resolve the RSA signing material with precedence **CLI flag > env var > local
+ * .scalebun file**, for each of: private key, key id, passphrase.
+ *
+ *   private key : --key-dir <dir>/ota-signing-key.pem
+ *                 → $SCALEBUN_SIGNING_PRIVATE_KEY (PEM contents)
+ *                 → ./.scalebun/ota-signing-key.pem
+ *   key id      : --key-id → $SCALEBUN_KEY_ID → ./.scalebun/ota-key-id.txt
+ *   passphrase  : --passphrase → $SCALEBUN_SIGNING_KEY_PASSPHRASE
+ */
+export declare function resolveSigningMaterial(opts: {
+    keyDir?: string;
+    keyId?: string;
+    passphrase?: string;
+}): SigningMaterial;
+/**
+ * Whether this publish must be signed (so a missing key fails closed instead of
+ * silently shipping an unsigned release a signature-enforcing device rejects).
+ *
+ * True when: --require-signing / $SCALEBUN_REQUIRE_SIGNING is set, OR a key id is
+ * configured by any source (a configured key id means "sign with this key").
+ */
+export declare function signingRequired(opts: {
+    requireSigning?: boolean;
+}, material: SigningMaterial): boolean;
 /**
  * Keep the private key out of version control WITHOUT relying on the operator
  * reading a warning. An existing .gitignore is appended to; a missing one is

package/lib/commands/ota-keys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ota-keys.d.ts","sourceRoot":"","sources":["../../src/commands/ota-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AASjC,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAwC,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEzF;;;;;;;;;;;;;GAaG;AAEH,eAAO,MAAM,OAAO,cAAc,CAAC;AACnC,eAAO,MAAM,gBAAgB,wBAAwB,CAAC;AACtD,eAAO,MAAM,eAAe,4BAA4B,CAAC;AACzD,eAAO,MAAM,WAAW,mBAAmB,CAAC;AAE5C,4EAA4E;AAC5E,wBAAgB,cAAc,CAAC,MAAM,GAAE,MAAgB,GAAG,MAAM,CAE/D;AAED,sFAAsF;AACtF,wBAAgB,cAAc,CAAC,MAAM,GAAE,MAAgB,GAAG,MAAM,GAAG,IAAI,CAStE;AAED,6CAA6C;AAC7C,wBAAgB,mBAAmB,CAAC,MAAM,GAAE,MAAgB,GAAG,MAAM,GAAG,IAAI,CAG3E;AAED,0EAA0E;AAC1E,wBAAgB,cAAc,CAAC,MAAM,GAAE,MAAgB,GAAG,MAAM,GAAG,IAAI,CAQtE;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,GAAE,MAAsB,GAAG,MAAM,CA4B1F;AA2BD;;;;;;;;;;GAUG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,SAAS,EACjB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,CAAC,SAAS,GAC3B,OAAO,CAAC,OAAO,CAAC,CAalB;AAgMD,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CA2JzD;AA4MD,mFAAmF;AACnF,OAAO,EAAE,eAAe,EAAE,CAAC"}
+{"version":3,"file":"ota-keys.d.ts","sourceRoot":"","sources":["../../src/commands/ota-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AASjC,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAwC,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEzF;;;;;;;;;;;;;GAaG;AAEH,eAAO,MAAM,OAAO,cAAc,CAAC;AACnC,eAAO,MAAM,gBAAgB,wBAAwB,CAAC;AACtD,eAAO,MAAM,eAAe,4BAA4B,CAAC;AACzD,eAAO,MAAM,WAAW,mBAAmB,CAAC;AAE5C,4EAA4E;AAC5E,wBAAgB,cAAc,CAAC,MAAM,GAAE,MAAgB,GAAG,MAAM,CAE/D;AAED,sFAAsF;AACtF,wBAAgB,cAAc,CAAC,MAAM,GAAE,MAAgB,GAAG,MAAM,GAAG,IAAI,CAStE;AAED,6CAA6C;AAC7C,wBAAgB,mBAAmB,CAAC,MAAM,GAAE,MAAgB,GAAG,MAAM,GAAG,IAAI,CAG3E;AAED,0EAA0E;AAC1E,wBAAgB,cAAc,CAAC,MAAM,GAAE,MAAgB,GAAG,MAAM,GAAG,IAAI,CAQtE;AAOD,eAAO,MAAM,uBAAuB,iCAAiC,CAAC;AACtE,eAAO,MAAM,0BAA0B,oCAAoC,CAAC;AAC5E,eAAO,MAAM,UAAU,oBAAoB,CAAC;AAC5C,eAAO,MAAM,mBAAmB,6BAA6B,CAAC;AAY9D,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC;AAE9D,MAAM,WAAW,eAAe;IAC9B,oFAAoF;IACpF,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,aAAa,EAAE,cAAc,CAAC;IAC9B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,WAAW,EAAE,cAAc,CAAC;IAC5B,4DAA4D;IAC5D,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,eAAe,CAsClB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE;IAAE,cAAc,CAAC,EAAE,OAAO,CAAA;CAAE,EAClC,QAAQ,EAAE,eAAe,GACxB,OAAO,CAKT;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,GAAE,MAAsB,GAAG,MAAM,CA4B1F;AA2BD;;;;;;;;;;GAUG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,SAAS,EACjB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,CAAC,SAAS,GAC3B,OAAO,CAAC,OAAO,CAAC,CAalB;AAgMD,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CA2JzD;AA4MD,mFAAmF;AACnF,OAAO,EAAE,eAAe,EAAE,CAAC"}

package/lib/commands/ota-keys.js

@@ -36,11 +36,13 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.spkiFingerprint = exports.KEY_ID_FILE = exports.PUBLIC_KEY_FILE = exports.PRIVATE_KEY_FILE = exports.KEY_DIR = void 0;
+exports.spkiFingerprint = exports.ENV_REQUIRE_SIGNING = exports.ENV_KEY_ID = exports.ENV_SIGNING_KEY_PASSPHRASE = exports.ENV_SIGNING_PRIVATE_KEY = exports.KEY_ID_FILE = exports.PUBLIC_KEY_FILE = exports.PRIVATE_KEY_FILE = exports.KEY_DIR = void 0;
 exports.privateKeyPath = privateKeyPath;
 exports.readLocalKeyId = readLocalKeyId;
 exports.readLocalPrivatePem = readLocalPrivatePem;
 exports.localPublicPem = localPublicPem;
+exports.resolveSigningMaterial = resolveSigningMaterial;
+exports.signingRequired = signingRequired;
 exports.ensureKeyDirGitignored = ensureKeyDirGitignored;
 exports.proveOwnership = proveOwnership;
 exports.registerOtaKeysCommand = registerOtaKeysCommand;
@@ -108,6 +110,89 @@ function localPublicPem(keyDir = exports.KEY_DIR) {
         return null;
     }
 }
+// ─── CI signing material (env vars the dashboard CI/CD page issues) ─────────────
+//
+// The dashboard's CI/CD setup page documents these exact names. Honouring them
+// here is what lets a publish that works locally (key on disk) work headless in
+// CI (key in a secret) with no bridging step in the workflow.
+exports.ENV_SIGNING_PRIVATE_KEY = 'SCALEBUN_SIGNING_PRIVATE_KEY';
+exports.ENV_SIGNING_KEY_PASSPHRASE = 'SCALEBUN_SIGNING_KEY_PASSPHRASE';
+exports.ENV_KEY_ID = 'SCALEBUN_KEY_ID';
+exports.ENV_REQUIRE_SIGNING = 'SCALEBUN_REQUIRE_SIGNING';
+/**
+ * A private-key secret often arrives with literal `\n` instead of real newlines
+ * (single-line CI secrets, some UIs). A PEM without real line breaks is invalid,
+ * so restore them — but only when there are no real newlines already.
+ */
+function normalizePem(raw) {
+    const s = raw.trim();
+    return s.includes('\\n') && !s.includes('\n') ? s.replace(/\\n/g, '\n') : s;
+}
+/**
+ * Resolve the RSA signing material with precedence **CLI flag > env var > local
+ * .scalebun file**, for each of: private key, key id, passphrase.
+ *
+ *   private key : --key-dir <dir>/ota-signing-key.pem
+ *                 → $SCALEBUN_SIGNING_PRIVATE_KEY (PEM contents)
+ *                 → ./.scalebun/ota-signing-key.pem
+ *   key id      : --key-id → $SCALEBUN_KEY_ID → ./.scalebun/ota-key-id.txt
+ *   passphrase  : --passphrase → $SCALEBUN_SIGNING_KEY_PASSPHRASE
+ */
+function resolveSigningMaterial(opts) {
+    let privatePem = null;
+    let privateSource = 'none';
+    if (opts.keyDir) {
+        privatePem = readLocalPrivatePem(opts.keyDir);
+        privateSource = privatePem ? 'flag' : 'none';
+    }
+    else if (process.env[exports.ENV_SIGNING_PRIVATE_KEY]) {
+        privatePem = normalizePem(process.env[exports.ENV_SIGNING_PRIVATE_KEY]);
+        privateSource = 'env';
+    }
+    else {
+        privatePem = readLocalPrivatePem();
+        privateSource = privatePem ? 'file' : 'none';
+    }
+    // Key id: --key-id > (the id file inside an explicit --key-dir) > SCALEBUN_KEY_ID
+    // > the default .scalebun id file. An explicit --key-dir binds the key AND its
+    // id together (both flag-level), so an unrelated SCALEBUN_KEY_ID in the env
+    // cannot pair a dir's key with the wrong id — a mismatch the device rejects.
+    let keyId = null;
+    let keyIdSource = 'none';
+    if (opts.keyId) {
+        keyId = opts.keyId;
+        keyIdSource = 'flag';
+    }
+    else if (opts.keyDir) {
+        keyId = readLocalKeyId(opts.keyDir);
+        keyIdSource = keyId ? 'flag' : 'none';
+    }
+    else if (process.env[exports.ENV_KEY_ID]) {
+        keyId = process.env[exports.ENV_KEY_ID].trim() || null;
+        keyIdSource = keyId ? 'env' : 'none';
+    }
+    else {
+        keyId = readLocalKeyId();
+        keyIdSource = keyId ? 'file' : 'none';
+    }
+    const passphrase = opts.passphrase ?? process.env[exports.ENV_SIGNING_KEY_PASSPHRASE] ?? undefined;
+    return { privatePem, privateSource, keyId, keyIdSource, passphrase };
+}
+/**
+ * Whether this publish must be signed (so a missing key fails closed instead of
+ * silently shipping an unsigned release a signature-enforcing device rejects).
+ *
+ * True when: --require-signing / $SCALEBUN_REQUIRE_SIGNING is set, OR a key id is
+ * configured by any source (a configured key id means "sign with this key").
+ */
+function signingRequired(opts, material) {
+    if (opts.requireSigning)
+        return true;
+    const envFlag = process.env[exports.ENV_REQUIRE_SIGNING];
+    if (envFlag && envFlag !== '0' && envFlag.toLowerCase() !== 'false')
+        return true;
+    return material.keyId != null;
+}
 /**
  * Keep the private key out of version control WITHOUT relying on the operator
  * reading a warning. An existing .gitignore is appended to; a missing one is