CLI commands

Every bedrock command that exists today.

Auth

Command	What it does
`bedrock login`	Opens your browser to sign in with GitHub, then waits for approval. On success, writes a long-lived credential to `~/.bedrock/credentials`.
`bedrock logout`	Clears the local credential.
`bedrock whoami`	Shows the signed-in user.

Command	What it does
`bedrock org list`	Lists organizations you belong to.
`bedrock org create <name>`	Creates a new organization and makes it the current one.
`bedrock org use <slug>`	Sets the default organization (`~/.bedrock/config.json`) for commands run outside a linked project directory.

Command	What it does
`bedrock project create <name>`	Creates a project in the current organization.
`bedrock project list`	Lists projects in the current organization.
`bedrock project delete <id> [-y]`	Deletes a project, and every app and build in it.
`bedrock app create <name> --package <id>`	Creates an Android app in a project (Android is the only platform bedrock supports today).
`bedrock app list`	Lists apps in a project.
`bedrock app delete <id> [-y]`	Deletes an app, and every build, signing credential, and env var in it.
`bedrock init`	Interactive wizard: pick or create an org, project, and app, then write `bedrock.json` to the current directory. This links the directory to that app for every command below. Every project/app-scoped command reads its org, project, and app IDs from this file.

Command	What it does
`bedrock build [--profile release\|debug] [--aab]`	Packs the current directory (skipping `node_modules`, `.git`, `android`, `ios`), uploads it, and runs a real Android build in the cloud. Opens a full-screen TUI: a sidebar of builds plus a live log pane for whichever one's selected, and prints a dashboard link to watch from the browser instead. Remote-only today; local builds (`--local`) are designed but not implemented yet.
`bedrock build list`	This app's full build history, with status and step.
`bedrock build status <id>`	A single build's status/step/error, as a summary block.
`bedrock build logs <id>`	Streams a build's logs live as it runs.
`bedrock build delete <id> [-y]`	Deletes a build and its stored artifact.

A release keystore is uploaded once per app and reused across builds. See Security for exactly how it's protected at rest and during a build.

Command	What it does
`bedrock signing upload --keystore <path> --alias <alias>`	Uploads a keystore. Prompts interactively for the keystore and key passwords, never accepted as flags or args, so they never land in shell history. Re-uploading under an existing alias rotates it (replaces the stored credential).
`bedrock signing list`	Lists this app's signing credentials: alias, fingerprint, upload date. Passwords and the keystore itself are never returned by any API call once uploaded.

Command	What it does
`bedrock env set KEY=value [--secret] [--profile release\|debug]`	Sets an env var for this app. Upsert semantics: setting an existing key (and profile) overwrites it. Omitting `--profile` applies to every profile, unless a profile-specific row for the same key exists, which wins. `--secret` prompts for the value interactively instead of taking it from the argument.
`bedrock env list [--profile release\|debug]`	Lists this app's env vars. Secret values always print as `(secret)`, never the real value.
`bedrock env delete KEY [--profile release\|debug] [-y]`	Deletes a single env var.

Not app config: both point the CLI itself somewhere else. You won't need these unless you're told to.

Variable	Purpose
`BEDROCK_API_URL`	Overrides where the CLI sends requests.
`BEDROCK_DASHBOARD_URL`	Overrides the dashboard link `bedrock build` prints after starting.

Path	Contents
`~/.bedrock/credentials`	The API token from `bedrock login`, mode `0600`.
`~/.bedrock/config.json`	The default org set via `bedrock org use`, consulted when a directory has no `bedrock.json` of its own.
`bedrock.json`	Written by `bedrock init` in a project directory. Links it to a specific org/project/app by ID (same spirit as `app.json`/`eas.json`).