ubriot 1.2.0 → 1.4.0

package/dist/signing-commands.js

@@ -0,0 +1,609 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resignGroups = resignGroups;
+exports.registerSigningCommands = registerSigningCommands;
+const fs_1 = require("fs");
+const path_1 = require("path");
+const api_1 = require("./api");
+const config_1 = require("./config");
+const readline_1 = require("./readline");
+const ota_signing_1 = require("./ota-signing");
+const app_config_signing_1 = require("./app-config-signing");
+const publish_signing_1 = require("./publish-signing");
+const binary_certificate_1 = require("./binary-certificate");
+function collect(value, previous) {
+    return [...previous, value];
+}
+function safeName(value) {
+    return value.replace(/[^A-Za-z0-9._-]/g, "-");
+}
+function todayKeyid(prefix) {
+    return `${prefix}-${new Date().toISOString().slice(0, 10).replace(/-/g, "")}`;
+}
+function projectRelative(projectDir, path) {
+    const rel = (0, path_1.relative)(projectDir, path);
+    return rel.startsWith("..") ? rel : `./${rel}`;
+}
+function interactive() {
+    return Boolean(process.stdin.isTTY && process.stdout.isTTY);
+}
+async function requireStatus(client, app) {
+    const status = await (0, publish_signing_1.fetchSigningStatus)(client, app);
+    if (!status)
+        throw new Error("This Ubriot API does not support OTA code signing yet.");
+    return status;
+}
+function findKey(status, keyid) {
+    const key = status.keys.find((k) => k.keyid === keyid && k.status !== "revoked") ?? status.keys.find((k) => k.keyid === keyid);
+    if (!key)
+        throw new Error(`No signing key with keyid "${keyid}" on this app`);
+    return key;
+}
+async function registerKey(client, app, body) {
+    const { data } = await client.post(`/ubriot/apps/${encodeURIComponent(app)}/ota-signing/keys`, body);
+    return data;
+}
+async function resignGroups(client, app, materials, groupId) {
+    const { data: targets } = await client.get(`/ubriot/apps/${encodeURIComponent(app)}/ota-signing/resign-targets`);
+    const selected = groupId ? targets.filter((t) => t.updateGroupId === groupId) : targets;
+    if (groupId && selected.length === 0) {
+        const { data } = await client.get(`/ubriot/apps/${encodeURIComponent(app)}/updates`);
+        if (!Array.isArray(data) || !data.some((g) => g.id === groupId))
+            throw new Error(`Update group #${groupId} not found`);
+        throw new Error(`Update group #${groupId} is not live on any channel. Only groups a channel points at, now or as its rollback target, are re-signed.`);
+    }
+    const byGroup = new Map();
+    for (const target of selected) {
+        const entries = byGroup.get(target.updateGroupId) ?? [];
+        entries.push({ platform: target.platform, signatures: materials.map((m) => (0, ota_signing_1.signManifest)(target.manifestJson, m)) });
+        byGroup.set(target.updateGroupId, entries);
+    }
+    for (const [id, platforms] of byGroup) {
+        await client.post(`/ubriot/apps/${encodeURIComponent(app)}/updates/${id}/signatures`, { platforms });
+    }
+    return [...byGroup.keys()];
+}
+async function confirmBackup(paths, yes) {
+    console.log("\nBack up these private keys now (password manager or offline storage). If they are lost, devices that trust them can only be fixed with a new native build:");
+    for (const path of paths)
+        console.log(`  ${path}`);
+    if (yes)
+        return true;
+    const answer = await (0, readline_1.readlineSync)('Type "backed up" once the keys are stored safely: ');
+    return answer.trim().toLowerCase() === "backed up";
+}
+function printNextSteps(app) {
+    console.log("\nNext steps:");
+    console.log(`  1. ubriot signing configure --app ${app}`);
+    console.log("  2. Bump runtimeVersion and ship a new native build. Old binaries keep updating unsigned.");
+    console.log(`  3. Publish as usual; updates are signed automatically. When old binaries are gone: ubriot signing require --app ${app}`);
+}
+async function createIdentity(opts) {
+    if (!opts.yes && !interactive())
+        throw new Error("Run this in a terminal to confirm the key backup, or pass --yes once you have a backup plan.");
+    const status = await requireStatus(opts.client, opts.app);
+    if (status.custody === "managed")
+        throw new Error("This app uses Ubriot-managed signing keys. Customer keys and managed keys are never mixed on one app.");
+    if (status.keys.some((k) => k.keyid === opts.keyid && k.status !== "revoked"))
+        throw new Error(`keyid "${opts.keyid}" is already registered. Pick another --keyid.`);
+    (0, ota_signing_1.assertKeyDirOutsideGit)(opts.keyDir, opts.allowInRepo);
+    const certificatePath = (0, path_1.join)(opts.certDir, `ubriot-ota-${safeName(opts.keyid)}.pem`);
+    const privateKeyPath = (0, path_1.join)(opts.keyDir, `${safeName(opts.app)}-${safeName(opts.keyid)}.private.pem`);
+    const written = [];
+    let body;
+    let rootCertificatePath;
+    if (opts.mode === "simple") {
+        const identity = (0, ota_signing_1.generateSimpleIdentity)({ commonName: `${opts.app} OTA ${opts.keyid}`, validityYears: opts.validityYears });
+        (0, ota_signing_1.writePrivateKey)(privateKeyPath, identity.privateKeyPem);
+        (0, ota_signing_1.writePublicFile)(certificatePath, identity.certificatePem);
+        written.push(privateKeyPath);
+        body = { keyid: opts.keyid, mode: "simple", certificatePem: identity.certificatePem };
+    }
+    else {
+        const root = (0, ota_signing_1.generateChainRoot)({ commonName: `${opts.app} OTA root`, validityYears: opts.validityYears });
+        const rootKeyPath = (0, path_1.join)(opts.keyDir, `${safeName(opts.app)}-root.private.pem`);
+        rootCertificatePath = (0, path_1.join)(opts.certDir, "ubriot-ota-root.pem");
+        const leaf = (0, ota_signing_1.issueLeaf)({ rootPrivateKeyPem: root.privateKeyPem, rootCertificatePem: root.certificatePem, commonName: `${opts.app} OTA ${opts.keyid}`, validityDays: opts.leafValidityDays });
+        (0, ota_signing_1.writePrivateKey)(rootKeyPath, root.privateKeyPem);
+        (0, ota_signing_1.writePrivateKey)(privateKeyPath, leaf.privateKeyPem);
+        (0, ota_signing_1.writePublicFile)(rootCertificatePath, root.certificatePem);
+        (0, ota_signing_1.writePublicFile)(certificatePath, leaf.certificatePem);
+        written.push(rootKeyPath, privateKeyPath);
+        console.log(`\nChain mode: keep ${rootKeyPath} offline. It is only needed to issue new signing leaves (ubriot signing issue-leaf).`);
+        body = { keyid: opts.keyid, mode: "chain", certificatePem: leaf.certificatePem, rootCertificatePem: root.certificatePem };
+    }
+    if (!(await confirmBackup(written, opts.yes))) {
+        console.log(`Keys were written but not registered. Register them later with: ubriot signing import --app ${opts.app} --keyid ${opts.keyid} --certificate ${certificatePath}`);
+        process.exitCode = 1;
+        return null;
+    }
+    const registered = await registerKey(opts.client, opts.app, body);
+    (0, ota_signing_1.upsertSigningConfigKey)(opts.projectDir, opts.app, {
+        keyid: opts.keyid,
+        mode: opts.mode,
+        privateKeyPath: projectRelative(opts.projectDir, privateKeyPath),
+        certificatePath: projectRelative(opts.projectDir, certificatePath),
+        ...(rootCertificatePath ? { rootCertificatePath: projectRelative(opts.projectDir, rootCertificatePath) } : {}),
+    });
+    console.log(`Registered ${opts.mode} signing key "${opts.keyid}" (SHA-256 ${registered.fingerprintSha256}). Certificate: ${certificatePath}`);
+    return registered;
+}
+function registerSigningCommands(program, updates) {
+    const signing = program.command("signing").description("Manage OTA code signing keys");
+    signing
+        .command("init")
+        .description("Generate a signing key and certificate, keep the private key locally, register the certificate")
+        .requiredOption("--app <appIdOrSlug>")
+        .option("--mode <mode>", "simple or chain", "simple")
+        .option("--keyid <keyid>", "Key id embedded in the app (simple mode default: main)")
+        .option("--key-dir <dir>", "Where private keys are written; must be outside the git repository", "../ubriot-keys")
+        .option("--cert-dir <dir>", "Where public certificates are written, inside the project", "certs")
+        .option("--project-dir <dir>", "App project directory", ".")
+        .option("--validity-years <n>", "Certificate validity (root validity in chain mode)", "10")
+        .option("--leaf-validity-days <n>", "Chain mode leaf validity in days", "365")
+        .option("--allow-in-repo", "Allow writing private keys inside the git working tree", false)
+        .option("--yes", "Skip the backup confirmation prompt", false)
+        .action(async (opts) => {
+        (0, config_1.requireAuth)();
+        try {
+            if (opts.mode !== "simple" && opts.mode !== "chain")
+                throw new Error("--mode must be simple or chain");
+            const projectDir = (0, path_1.resolve)(opts.projectDir);
+            const registered = await createIdentity({
+                client: (0, api_1.makeClient)(),
+                app: opts.app,
+                mode: opts.mode,
+                keyid: opts.keyid ?? (opts.mode === "simple" ? "main" : todayKeyid("leaf")),
+                projectDir,
+                keyDir: (0, path_1.resolve)(projectDir, opts.keyDir),
+                certDir: (0, path_1.resolve)(projectDir, opts.certDir),
+                validityYears: Number(opts.validityYears),
+                leafValidityDays: Number(opts.leafValidityDays),
+                yes: opts.yes === true,
+                allowInRepo: opts.allowInRepo === true,
+            });
+            if (registered)
+                printNextSteps(opts.app);
+        }
+        catch (err) {
+            (0, api_1.handleError)(err);
+        }
+    });
+    signing
+        .command("import")
+        .description("Register an existing certificate, for example one from EAS Update code signing")
+        .requiredOption("--app <appIdOrSlug>")
+        .requiredOption("--certificate <path>")
+        .requiredOption("--keyid <keyid>")
+        .option("--mode <mode>", "simple or chain", "simple")
+        .option("--root-certificate <path>", "Chain mode: the root certificate embedded in the app")
+        .option("--chain <path>", "Chain mode: intermediate certificates")
+        .option("--private-key-path <path>", "Local private key path to remember in .ubriot/signing.json (never uploaded)")
+        .option("--project-dir <dir>", "App project directory", ".")
+        .action(async (opts) => {
+        (0, config_1.requireAuth)();
+        try {
+            const projectDir = (0, path_1.resolve)(opts.projectDir);
+            const certificatePem = (0, fs_1.readFileSync)((0, path_1.resolve)(projectDir, opts.certificate), "utf8");
+            if (opts.privateKeyPath) {
+                const privateKeyPem = (0, fs_1.readFileSync)((0, path_1.resolve)(projectDir, opts.privateKeyPath), "utf8");
+                if (!(0, ota_signing_1.privateKeyMatchesCertificate)(privateKeyPem, certificatePem))
+                    throw new Error("The private key does not match the certificate");
+            }
+            const registered = await registerKey((0, api_1.makeClient)(), opts.app, {
+                keyid: opts.keyid,
+                mode: opts.mode,
+                certificatePem,
+                ...(opts.rootCertificate ? { rootCertificatePem: (0, fs_1.readFileSync)((0, path_1.resolve)(projectDir, opts.rootCertificate), "utf8") } : {}),
+                ...(opts.chain ? { chainPem: (0, fs_1.readFileSync)((0, path_1.resolve)(projectDir, opts.chain), "utf8") } : {}),
+            });
+            if (opts.privateKeyPath) {
+                (0, ota_signing_1.upsertSigningConfigKey)(projectDir, opts.app, {
+                    keyid: opts.keyid,
+                    mode: opts.mode,
+                    privateKeyPath: projectRelative(projectDir, (0, path_1.resolve)(projectDir, opts.privateKeyPath)),
+                    certificatePath: projectRelative(projectDir, (0, path_1.resolve)(projectDir, opts.certificate)),
+                    ...(opts.rootCertificate ? { rootCertificatePath: projectRelative(projectDir, (0, path_1.resolve)(projectDir, opts.rootCertificate)) } : {}),
+                });
+            }
+            console.log(`Registered "${registered.keyid}" (SHA-256 ${registered.fingerprintSha256}). Binaries that embed this certificate keep receiving updates signed with it.`);
+        }
+        catch (err) {
+            (0, api_1.handleError)(err);
+        }
+    });
+    signing
+        .command("configure")
+        .description("Write the code signing certificate into app.json (expo-updates or ubriot-updates-rn)")
+        .requiredOption("--app <appIdOrSlug>")
+        .option("--keyid <keyid>", "Key from .ubriot/signing.json to embed")
+        .option("--expo-config <path>", "Path to app.json", "app.json")
+        .option("--also-trust <keyid>", "ubriot-updates-rn only: also embed this local key as a pre-provisioned rotation key (repeatable)", collect, [])
+        .option("--certificate <path>", "Embed this certificate instead of a key from .ubriot/signing.json (for Ubriot-managed keys)")
+        .option("--mode <mode>", "With --certificate: simple or chain", "simple")
+        .option("--project-dir <dir>", "App project directory", ".")
+        .action((opts) => {
+        try {
+            const projectDir = (0, path_1.resolve)(opts.projectDir);
+            const config = (0, ota_signing_1.readSigningConfig)(projectDir) ?? { keys: [] };
+            if (opts.certificate && opts.mode !== "simple" && opts.mode !== "chain")
+                throw new Error("--mode must be simple or chain");
+            const key = opts.certificate
+                ? { keyid: opts.keyid ?? "root", mode: opts.mode, certificatePath: opts.certificate, rootCertificatePath: opts.certificate, privateKeyPath: "" }
+                : opts.keyid
+                    ? config.keys.find((k) => k.keyid === opts.keyid)
+                    : config.keys[config.keys.length - 1];
+            if (!key)
+                throw new Error(opts.keyid ? `No local key "${opts.keyid}" in .ubriot/signing.json` : `No keys in .ubriot/signing.json. Run: ubriot signing init --app ${opts.app}`);
+            const certificatePath = key.mode === "chain" ? key.rootCertificatePath : key.certificatePath;
+            if (!certificatePath)
+                throw new Error("Chain mode needs rootCertificatePath in .ubriot/signing.json");
+            const additionalCertificates = opts.alsoTrust.map((keyid) => {
+                const extra = config.keys.find((k) => k.keyid === keyid);
+                if (!extra)
+                    throw new Error(`No local key "${keyid}" in .ubriot/signing.json`);
+                return { certificate: extra.certificatePath, keyid: extra.keyid };
+            });
+            const input = { certificatePath, keyid: key.mode === "chain" ? "root" : key.keyid, mode: key.mode, additionalCertificates };
+            const appJsonPath = (0, path_1.resolve)(projectDir, opts.expoConfig);
+            if (["app.config.js", "app.config.ts"].some((name) => (0, fs_1.existsSync)((0, path_1.join)(projectDir, name))) || !(0, fs_1.existsSync)(appJsonPath)) {
+                console.log("This project uses a dynamic app config. Add these settings yourself:");
+                console.log(JSON.stringify((0, app_config_signing_1.applyExpoSigningConfig)({}, input).expo, null, 2));
+                return;
+            }
+            const appJson = JSON.parse((0, fs_1.readFileSync)(appJsonPath, "utf8"));
+            const bare = (0, app_config_signing_1.hasUpdatesRnPlugin)(appJson);
+            if (!bare && additionalCertificates.length)
+                throw new Error("--also-trust needs ubriot-updates-rn. expo-updates trusts exactly one certificate.");
+            const next = bare ? (0, app_config_signing_1.applyBareSigningConfig)(appJson, input) : (0, app_config_signing_1.applyExpoSigningConfig)(appJson, input);
+            (0, fs_1.writeFileSync)(appJsonPath, `${JSON.stringify(next, null, 2)}\n`, "utf8");
+            console.log(`Updated ${opts.expoConfig} to trust ${certificatePath} (${key.mode} mode).`);
+            console.log("Bump runtimeVersion and ship a new native build. Code signing takes effect only in binaries built after this change.");
+        }
+        catch (err) {
+            (0, api_1.handleError)(err);
+        }
+    });
+    signing
+        .command("status")
+        .description("Show signing keys, device counts, rejections and recent unsigned publishes")
+        .requiredOption("--app <appIdOrSlug>")
+        .action(async (opts) => {
+        (0, config_1.requireAuth)();
+        try {
+            const status = await requireStatus((0, api_1.makeClient)(), opts.app);
+            console.log(`Signed updates required: ${status.required ? "yes" : "no"}${status.custody ? `   Custody: ${status.custody}` : ""}${status.servingEnabled ? "" : "   Serving: DISABLED"}`);
+            if (!status.keys.length)
+                console.log("No signing keys. Run: ubriot signing init --app " + opts.app);
+            for (const key of status.keys) {
+                console.log(`  ${key.keyid.padEnd(20)} ${key.mode.padEnd(7)} ${key.status.padEnd(8)} expires ${key.notAfter.slice(0, 10)}  devices(30d) ${key.devicesLast30Days}  sha256 ${key.fingerprintSha256.slice(0, 16)}`);
+            }
+            for (const warning of (0, ota_signing_1.expiryWarnings)(status.keys))
+                console.log(`  ! ${warning}`);
+            if (status.rejections.length) {
+                console.log("Rejections (30 days):");
+                for (const r of status.rejections)
+                    console.log(`  ${r.source.padEnd(7)} ${r.platform.padEnd(8)} ${r.reason.padEnd(24)} x${r.count}${r.manifestId ? ` update ${r.manifestId}` : ""}`);
+            }
+            if (status.recentUnsignedUpdates.length) {
+                console.log("Recent unsigned publishes:");
+                for (const u of status.recentUnsignedUpdates)
+                    console.log(`  group #${u.updateGroupId} ${u.platform} runtime ${u.runtimeVersion} at ${u.createdAt}`);
+            }
+        }
+        catch (err) {
+            (0, api_1.handleError)(err);
+        }
+    });
+    signing
+        .command("retire")
+        .description("Stop accepting new publishes signed by a key; existing signatures keep being served")
+        .requiredOption("--app <appIdOrSlug>")
+        .requiredOption("--keyid <keyid>")
+        .action(async (opts) => {
+        (0, config_1.requireAuth)();
+        try {
+            const client = (0, api_1.makeClient)();
+            const key = findKey(await requireStatus(client, opts.app), opts.keyid);
+            await client.post(`/ubriot/apps/${encodeURIComponent(opts.app)}/ota-signing/keys/${key.id}/retire`);
+            console.log(`Key "${opts.keyid}" retired.`);
+        }
+        catch (err) {
+            (0, api_1.handleError)(err);
+        }
+    });
+    signing
+        .command("revoke")
+        .description("Stop serving signatures from a key and refuse publishes signed by it")
+        .requiredOption("--app <appIdOrSlug>")
+        .requiredOption("--keyid <keyid>")
+        .option("--confirm <keyid>", "Repeat the keyid to confirm without a prompt")
+        .action(async (opts) => {
+        (0, config_1.requireAuth)();
+        try {
+            const client = (0, api_1.makeClient)();
+            const key = findKey(await requireStatus(client, opts.app), opts.keyid);
+            const confirm = opts.confirm ?? (interactive() ? await (0, readline_1.readlineSync)(`Type ${opts.keyid} to revoke it: `) : "");
+            if (confirm !== opts.keyid)
+                throw new Error("Confirmation did not match. Nothing was revoked.");
+            await client.post(`/ubriot/apps/${encodeURIComponent(opts.app)}/ota-signing/keys/${key.id}/revoke`, { confirm });
+            console.log(`Key "${opts.keyid}" revoked. Devices asking for it now get no update until you publish or re-sign with another trusted key.`);
+        }
+        catch (err) {
+            (0, api_1.handleError)(err);
+        }
+    });
+    signing
+        .command("require")
+        .description("Refuse unsigned publishes for an app (use --off to allow them again)")
+        .requiredOption("--app <appIdOrSlug>")
+        .option("--off", "Allow unsigned publishes again", false)
+        .action(async (opts) => {
+        (0, config_1.requireAuth)();
+        try {
+            const required = opts.off !== true;
+            await (0, api_1.makeClient)().patch(`/ubriot/apps/${encodeURIComponent(opts.app)}/ota-signing`, { required });
+            console.log(required ? "Unsigned publishes are now refused for this app." : "Unsigned publishes are allowed again. The app owner was notified.");
+        }
+        catch (err) {
+            (0, api_1.handleError)(err);
+        }
+    });
+    const issueLeafCommand = async (opts) => {
+        const projectDir = (0, path_1.resolve)(opts.projectDir);
+        const config = (0, ota_signing_1.readSigningConfig)(projectDir);
+        const chainEntry = config?.keys.filter((k) => k.mode === "chain").at(-1);
+        const rootCertificatePath = opts.rootCertificate ? (0, path_1.resolve)(projectDir, opts.rootCertificate) : chainEntry?.rootCertificatePath ? (0, path_1.resolve)(projectDir, chainEntry.rootCertificatePath) : null;
+        if (!rootCertificatePath)
+            throw new Error("Pass --root-certificate (the root certificate embedded in the app)");
+        const rootCertificatePem = (0, fs_1.readFileSync)(rootCertificatePath, "utf8");
+        const rootPrivateKeyPem = (0, fs_1.readFileSync)((0, path_1.resolve)(projectDir, opts.rootKey), "utf8");
+        const keyid = opts.keyid ?? todayKeyid("leaf");
+        const keyDir = (0, path_1.resolve)(projectDir, opts.keyDir);
+        (0, ota_signing_1.assertKeyDirOutsideGit)(keyDir, opts.allowInRepo === true);
+        const client = (0, api_1.makeClient)();
+        const status = await requireStatus(client, opts.app);
+        if (status.keys.some((k) => k.keyid === keyid && k.status !== "revoked"))
+            throw new Error(`keyid "${keyid}" is already registered`);
+        const leaf = (0, ota_signing_1.issueLeaf)({ rootPrivateKeyPem, rootCertificatePem, commonName: `${opts.app} OTA ${keyid}`, validityDays: Number(opts.validityDays) });
+        const privateKeyPath = (0, path_1.join)(keyDir, `${safeName(opts.app)}-${safeName(keyid)}.private.pem`);
+        const certificatePath = (0, path_1.resolve)(projectDir, opts.certDir, `ubriot-ota-${safeName(keyid)}.pem`);
+        (0, ota_signing_1.writePrivateKey)(privateKeyPath, leaf.privateKeyPem);
+        (0, ota_signing_1.writePublicFile)(certificatePath, leaf.certificatePem);
+        await registerKey(client, opts.app, { keyid, mode: "chain", certificatePem: leaf.certificatePem, rootCertificatePem });
+        (0, ota_signing_1.upsertSigningConfigKey)(projectDir, opts.app, {
+            keyid,
+            mode: "chain",
+            privateKeyPath: projectRelative(projectDir, privateKeyPath),
+            certificatePath: projectRelative(projectDir, certificatePath),
+            rootCertificatePath: projectRelative(projectDir, rootCertificatePath),
+        });
+        const groups = await resignGroups(client, opts.app, [{ keyid, privateKeyPem: leaf.privateKeyPem, certificatePem: leaf.certificatePem }]);
+        console.log(`Issued and registered leaf "${keyid}" (SHA-256 ${(0, ota_signing_1.fingerprintSha256)(leaf.certificatePem)}). Re-signed ${groups.length} live update group(s).`);
+        if (opts.keepOld !== true) {
+            for (const old of status.keys.filter((k) => k.mode === "chain" && k.status === "active" && k.custody === "customer")) {
+                await client.post(`/ubriot/apps/${encodeURIComponent(opts.app)}/ota-signing/keys/${old.id}/retire`);
+                console.log(`Retired previous leaf "${old.keyid}".`);
+            }
+        }
+        console.log("No new binary is needed: devices trust the root, and the new leaf chains to it.");
+    };
+    signing
+        .command("issue-leaf")
+        .description("Chain mode: issue a new signing leaf from the offline root, register it and re-sign live updates")
+        .requiredOption("--app <appIdOrSlug>")
+        .requiredOption("--root-key <path>", "Path to the offline root private key")
+        .option("--root-certificate <path>", "Root certificate (defaults to the one in .ubriot/signing.json)")
+        .option("--keyid <keyid>", "New leaf keyid (default leaf-YYYYMMDD)")
+        .option("--validity-days <n>", "Leaf validity in days", "365")
+        .option("--key-dir <dir>", "Where the new leaf private key is written", "../ubriot-keys")
+        .option("--cert-dir <dir>", "Where the new leaf certificate is written", "certs")
+        .option("--project-dir <dir>", "App project directory", ".")
+        .option("--keep-old", "Keep the previous leaf active", false)
+        .option("--allow-in-repo", "Allow writing private keys inside the git working tree", false)
+        .action(async (opts) => {
+        (0, config_1.requireAuth)();
+        try {
+            await issueLeafCommand(opts);
+        }
+        catch (err) {
+            (0, api_1.handleError)(err);
+        }
+    });
+    signing
+        .command("rotate")
+        .description("Guided key rotation. Chain mode issues a new leaf; simple mode creates the next key for a new binary")
+        .requiredOption("--app <appIdOrSlug>")
+        .option("--root-key <path>", "Chain mode: offline root private key")
+        .option("--root-certificate <path>", "Chain mode: root certificate")
+        .option("--keyid <keyid>", "New keyid")
+        .option("--validity-days <n>", "Chain mode leaf validity in days", "365")
+        .option("--validity-years <n>", "Simple mode certificate validity", "10")
+        .option("--key-dir <dir>", "Where private keys are written", "../ubriot-keys")
+        .option("--cert-dir <dir>", "Where certificates are written", "certs")
+        .option("--project-dir <dir>", "App project directory", ".")
+        .option("--keep-old", "Keep the previous leaf active", false)
+        .option("--allow-in-repo", "Allow writing private keys inside the git working tree", false)
+        .option("--yes", "Skip the backup confirmation prompt", false)
+        .action(async (opts) => {
+        (0, config_1.requireAuth)();
+        try {
+            const client = (0, api_1.makeClient)();
+            const status = await requireStatus(client, opts.app);
+            const current = status.keys.find((k) => k.status === "active" && k.custody === "customer");
+            if (!current)
+                throw new Error(`No active customer key to rotate. Run: ubriot signing init --app ${opts.app}`);
+            if (current.mode === "chain") {
+                if (!opts.rootKey)
+                    throw new Error("Chain mode rotation needs --root-key (the offline root private key)");
+                await issueLeafCommand(opts);
+                return;
+            }
+            if (!opts.keyid)
+                throw new Error("Pass --keyid for the next key, for example --keyid main-2");
+            const projectDir = (0, path_1.resolve)(opts.projectDir);
+            const registered = await createIdentity({
+                client,
+                app: opts.app,
+                mode: "simple",
+                keyid: opts.keyid,
+                projectDir,
+                keyDir: (0, path_1.resolve)(projectDir, opts.keyDir),
+                certDir: (0, path_1.resolve)(projectDir, opts.certDir),
+                validityYears: Number(opts.validityYears),
+                leafValidityDays: 365,
+                yes: opts.yes === true,
+                allowInRepo: opts.allowInRepo === true,
+            });
+            if (!registered)
+                return;
+            console.log("\nSimple mode rotation needs a new binary:");
+            console.log(`  1. ubriot signing configure --app ${opts.app} --keyid ${opts.keyid}, bump runtimeVersion, ship a new build.`);
+            console.log(`  2. Until old binaries are gone, publish with both keys: --sign-with ${current.keyid} --sign-with ${opts.keyid}`);
+            console.log(`  3. When "ubriot signing status" shows no devices on "${current.keyid}": ubriot signing retire --app ${opts.app} --keyid ${current.keyid}`);
+        }
+        catch (err) {
+            (0, api_1.handleError)(err);
+        }
+    });
+    signing
+        .command("verify-binary <file>")
+        .description("List the code signing certificates embedded in an .ipa, .apk or .aab and check them against your keys")
+        .option("--app <appIdOrSlug>", "Also compare with the keys registered for this app")
+        .option("--project-dir <dir>", "App project directory", ".")
+        .action(async (file, opts) => {
+        try {
+            const anchors = [];
+            const projectDir = (0, path_1.resolve)(opts.projectDir);
+            for (const key of (0, ota_signing_1.readSigningConfig)(projectDir)?.keys ?? []) {
+                for (const path of [key.certificatePath, key.rootCertificatePath].filter((p) => !!p)) {
+                    const full = (0, path_1.resolve)(projectDir, path);
+                    if ((0, fs_1.existsSync)(full))
+                        anchors.push({ label: `local ${key.keyid} (${path})`, fingerprintSha256: (0, ota_signing_1.fingerprintSha256)((0, fs_1.readFileSync)(full, "utf8")) });
+                }
+            }
+            if (opts.app) {
+                (0, config_1.requireAuth)();
+                const status = await requireStatus((0, api_1.makeClient)(), opts.app);
+                for (const key of status.keys.filter((k) => k.status !== "revoked")) {
+                    anchors.push({ label: `registered ${key.keyid}`, fingerprintSha256: key.fingerprintSha256 });
+                    if (key.rootFingerprintSha256)
+                        anchors.push({ label: `registered ${key.keyid} root`, fingerprintSha256: key.rootFingerprintSha256 });
+                }
+            }
+            const embedded = (0, binary_certificate_1.matchAnchors)((0, binary_certificate_1.extractEmbeddedCertificates)((0, path_1.resolve)(file)), anchors);
+            if (!embedded.length) {
+                console.log("No code signing certificate is embedded in this binary. It accepts unsigned updates.");
+                process.exitCode = 1;
+                return;
+            }
+            for (const certificate of embedded) {
+                console.log(`${certificate.subject.replace(/\n/g, ", ")}  sha256 ${certificate.fingerprintSha256}  expires ${certificate.notAfter}`);
+                console.log(`  found in ${certificate.foundIn.join(", ")}`);
+                console.log(certificate.matches.length ? `  trusted key: ${certificate.matches.join(", ")}` : "  ! does not match any of your keys");
+            }
+            if (embedded.some((certificate) => certificate.matches.length === 0))
+                process.exitCode = 1;
+        }
+        catch (err) {
+            (0, api_1.handleError)(err);
+        }
+    });
+    const managed = signing.command("managed").description("Ubriot-managed signing keys (paid plans). Ubriot holds the private key.");
+    managed
+        .command("create")
+        .description("Create a Ubriot-managed signing key and save its certificate for embedding in the app")
+        .requiredOption("--app <appIdOrSlug>")
+        .option("--mode <mode>", "chain (recommended, rotates without new binaries) or simple", "chain")
+        .option("--keyid <keyid>", "Key id")
+        .option("--cert-dir <dir>", "Where the certificate to embed is written", "certs")
+        .option("--project-dir <dir>", "App project directory", ".")
+        .action(async (opts) => {
+        (0, config_1.requireAuth)();
+        try {
+            const { data } = await (0, api_1.makeClient)().post(`/ubriot/apps/${encodeURIComponent(opts.app)}/ota-signing/managed-keys`, {
+                mode: opts.mode,
+                ...(opts.keyid ? { keyid: opts.keyid } : {}),
+            });
+            const embedPem = data.mode === "chain" ? data.rootCertificatePem : data.certificatePem;
+            const path = (0, path_1.resolve)(opts.projectDir, opts.certDir, data.mode === "chain" ? "ubriot-managed-root.pem" : `ubriot-managed-${safeName(data.keyid)}.pem`);
+            (0, ota_signing_1.writePublicFile)(path, embedPem);
+            console.log(`Created Ubriot-managed ${data.mode} key "${data.keyid}". Certificate to embed: ${path}`);
+            console.log("Ubriot-managed keys stop tampering in storage and transit, but not a compromised Ubriot account. Use customer-held keys (ubriot signing init) for that.");
+            console.log(`Next: ubriot signing configure --app ${opts.app} --certificate ${projectRelative((0, path_1.resolve)(opts.projectDir), path)} --mode ${data.mode}${data.mode === "simple" ? ` --keyid ${data.keyid}` : ""}`);
+        }
+        catch (err) {
+            (0, api_1.handleError)(err);
+        }
+    });
+    managed
+        .command("rotate")
+        .description("Rotate the Ubriot-managed key. Chain mode needs no new binary")
+        .requiredOption("--app <appIdOrSlug>")
+        .option("--cert-dir <dir>", "Where a new simple mode certificate is written", "certs")
+        .option("--project-dir <dir>", "App project directory", ".")
+        .action(async (opts) => {
+        (0, config_1.requireAuth)();
+        try {
+            const { data } = await (0, api_1.makeClient)().post(`/ubriot/apps/${encodeURIComponent(opts.app)}/ota-signing/managed-keys/rotate`);
+            console.log(`Rotated to "${data.key.keyid}". Re-signed ${data.resignedUpdates} live update(s).${data.retired.length ? ` Retired: ${data.retired.join(", ")}.` : ""}`);
+            if (data.newBinaryRequired) {
+                const path = (0, path_1.resolve)(opts.projectDir, opts.certDir, `ubriot-managed-${safeName(data.key.keyid)}.pem`);
+                (0, ota_signing_1.writePublicFile)(path, data.key.certificatePem);
+                console.log(`Simple mode: embed ${path} in a new build, then retire the old key once its devices are gone.`);
+            }
+        }
+        catch (err) {
+            (0, api_1.handleError)(err);
+        }
+    });
+    managed
+        .command("audit")
+        .description("Show the signing audit log: every managed signature and every key change")
+        .requiredOption("--app <appIdOrSlug>")
+        .action(async (opts) => {
+        (0, config_1.requireAuth)();
+        try {
+            const { data } = await (0, api_1.makeClient)().get(`/ubriot/apps/${encodeURIComponent(opts.app)}/ota-signing/audit`);
+            if (!data.length)
+                console.log("No signing activity yet.");
+            for (const entry of data)
+                console.log(`${entry.createdAt}  ${entry.action.padEnd(36)} ${JSON.stringify(entry.metadata ?? {})}`);
+        }
+        catch (err) {
+            (0, api_1.handleError)(err);
+        }
+    });
+    updates
+        .command("resign")
+        .description("Sign live update groups again with the current key (rotation, or before a leaf expires)")
+        .requiredOption("--app <appIdOrSlug>")
+        .option("--group <id>", "Only this update group")
+        .option("--sign-with <keyid>", "Local key to sign with (repeatable)", collect, [])
+        .option("--private-key-path <path>", "Private key PEM")
+        .option("--certificate-path <path>", "Certificate PEM matching the private key")
+        .option("--project-dir <dir>", "App project directory", ".")
+        .action(async (opts) => {
+        (0, config_1.requireAuth)();
+        try {
+            const client = (0, api_1.makeClient)();
+            const status = await requireStatus(client, opts.app);
+            const materials = (0, ota_signing_1.loadSigningMaterial)({
+                projectDir: (0, path_1.resolve)(opts.projectDir),
+                env: process.env,
+                privateKeyPath: opts.privateKeyPath,
+                certificatePath: opts.certificatePath,
+                signWith: opts.signWith,
+                registeredKeys: status.keys,
+            });
+            if (!materials.length)
+                throw new Error("No signing key found. Pass --private-key-path or set UBRIOT_OTA_PRIVATE_KEY.");
+            const groups = await resignGroups(client, opts.app, materials, opts.group ? Number(opts.group) : undefined);
+            console.log(`Re-signed ${groups.length} update group(s) with ${materials.map((m) => m.keyid).join(", ")}.`);
+        }
+        catch (err) {
+            (0, api_1.handleError)(err);
+        }
+    });
+    return signing;
+}