@better-update/cli 0.24.2 → 0.26.1

package/dist/index.mjs

@@ -2,7 +2,7 @@
 import { createRequire } from "node:module";
 import { execFile, spawn, spawnSync } from "node:child_process";
 import { defineCommand, runMain } from "citty";
-import { Console, Context, Data, Deferred, Duration, Effect, Either, Layer, Match, Option, ParseResult, Schedule, Schema } from "effect";
+import { Clock, Console, Context, Data, Deferred, Duration, Effect, Either, Layer, Match, Option, ParseResult, Schedule, Schema } from "effect";
 import { Command, FetchHttpClient, FileSystem, Headers as Headers$1, HttpApi, HttpApiClient, HttpApiEndpoint, HttpApiGroup, HttpApiMiddleware, HttpApiSchema, HttpApiSecurity, HttpClient, HttpClientRequest, OpenApi, Path } from "@effect/platform";
 import { NodeContext } from "@effect/platform-node";
 import path from "node:path";
@@ -11,7 +11,8 @@ import AppleUtils from "@expo/apple-utils";
 import { autocomplete, cancel, confirm, isCancel, multiselect, password, select, text } from "@clack/prompts";
 import { open, readFile, writeFile } from "node:fs/promises";
 import { X509Certificate, createHash, createSign, createVerify, randomBytes, randomUUID } from "node:crypto";
-import { accessSync, chmodSync, constants, createReadStream, existsSync, promises, readFileSync, writeFileSync } from "node:fs";
+import { accessSync, chmodSync, constants, createReadStream, promises } from "node:fs";
+import { Entry } from "@napi-rs/keyring";
 import { once } from "node:events";
 import { createServer } from "node:http";
 import { maxBy, uniqBy } from "es-toolkit";
@@ -33,7 +34,7 @@ var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 //#endregion
 //#region package.json
-var version = "0.24.2";
+var version = "0.26.1";
 
 //#endregion
 //#region src/lib/interactive-mode.ts
@@ -255,7 +256,7 @@ var AnalyticsGroup = class extends HttpApiGroup.make("analytics").add(HttpApiEnd
 
 //#endregion
 //#region ../../packages/api/src/domain/android-application-identifier.ts
-const AndroidPackageName = Schema.String.pipe(Schema.pattern(/^[A-Za-z][A-Za-z0-9_]*(\.[A-Za-z][A-Za-z0-9_]*)+$/u, { message: () => "Package name must be reverse-domain style (e.g., com.acme.app)" }));
+const AndroidPackageName = Schema.String.pipe(Schema.pattern(/^[A-Za-z][A-Za-z0-9_]*(?:\.[A-Za-z][A-Za-z0-9_]*)+$/u, { message: () => "Package name must be reverse-domain style (e.g., com.acme.app)" }));
 var AndroidApplicationIdentifier = class extends Schema.Class("AndroidApplicationIdentifier")({
 	id: Id,
 	organizationId: Id,
@@ -2929,6 +2930,81 @@ const UpdateAssetUploaderLive = Layer.effect(UpdateAssetUploader, Effect.gen(fun
 	}) };
 }));
 
+//#endregion
+//#region src/services/vault-cache.ts
+/**
+* "Unlock once, reuse" for the credential vault — the analog of macOS
+* `security unlock-keychain`. The first vault operation in a session prompts for
+* the device passphrase, unwraps the vault key, and stows it in the OS keychain
+* (`@napi-rs/keyring`: macOS Keychain / Windows Credential Manager / Linux
+* libsecret) with a short TTL; subsequent commands read it back and skip the
+* prompt + Argon2id derivation entirely until it expires.
+*
+* What is cached is the unwrapped **vault key**, never the passphrase or the age
+* private key — so the blast radius of a leaked keychain entry is one vault
+* version's credentials, and only until the TTL lapses.
+*/
+/** How long a cached vault key stays valid before a fresh passphrase is required. */
+const VAULT_CACHE_TTL_MS = 900 * 1e3;
+/** Keychain service name; the account is the recipient's public key. */
+const KEYCHAIN_SERVICE = "better-update-vault";
+const isCachedVaultEntry = (value) => isRecord(value) && typeof value["vaultKey"] === "string" && typeof value["vaultVersion"] === "number" && typeof value["keyId"] === "string" && typeof value["exp"] === "number";
+/** Serialize an unlocked vault into a keychain blob, stamping a TTL from `now`. */
+const encodeCacheEntry = (vault, now, ttlMs = VAULT_CACHE_TTL_MS) => JSON.stringify({
+	vaultKey: toBase64(vault.vaultKey),
+	vaultVersion: vault.vaultVersion,
+	keyId: vault.keyId,
+	exp: now + ttlMs
+});
+/**
+* Parse a keychain blob back into an unlocked vault, or `undefined` when it is
+* malformed or has expired as of `now` — so an expired entry reads exactly like
+* a missing one (and is evicted by the caller).
+*/
+const decodeCacheEntry = (raw, now) => {
+	const parsed = safeJsonParse(raw);
+	if (!isCachedVaultEntry(parsed) || now >= parsed.exp) return;
+	return {
+		vault: {
+			vaultKey: fromBase64(parsed.vaultKey),
+			vaultVersion: parsed.vaultVersion,
+			keyId: parsed.keyId
+		},
+		remainingMs: parsed.exp - now
+	};
+};
+var VaultCache = class extends Context.Tag("cli/VaultCache")() {};
+const VaultCacheLive = Layer.effect(VaultCache, Effect.gen(function* () {
+	const runtime = yield* CliRuntime;
+	const cacheDisabled = Effect.gen(function* () {
+		const flag = yield* runtime.getEnv("BETTER_UPDATE_NO_CACHE");
+		return flag !== void 0 && flag.length > 0 && flag !== "0" && flag !== "false";
+	});
+	const readRaw = (publicKey) => Effect.try(() => new Entry(KEYCHAIN_SERVICE, publicKey).getPassword()).pipe(Effect.catchAll(() => Effect.succeed(null)));
+	const writeRaw = (publicKey, blob) => Effect.try(() => {
+		new Entry(KEYCHAIN_SERVICE, publicKey).setPassword(blob);
+	}).pipe(Effect.ignore);
+	const deleteRaw = (publicKey) => Effect.try(() => new Entry(KEYCHAIN_SERVICE, publicKey).deletePassword()).pipe(Effect.ignore);
+	return {
+		get: (publicKey) => Effect.gen(function* () {
+			if (yield* cacheDisabled) return;
+			const raw = yield* readRaw(publicKey);
+			if (raw === null) return;
+			const decoded = decodeCacheEntry(raw, yield* Clock.currentTimeMillis);
+			if (decoded === void 0) {
+				yield* deleteRaw(publicKey);
+				return;
+			}
+			return decoded;
+		}),
+		set: (publicKey, vault) => Effect.gen(function* () {
+			if (yield* cacheDisabled) return;
+			yield* writeRaw(publicKey, encodeCacheEntry(vault, yield* Clock.currentTimeMillis));
+		}),
+		clear: (publicKey) => deleteRaw(publicKey)
+	};
+}));
+
 //#endregion
 //#region src/services/version-check.ts
 const NPM_REGISTRY_URL = "https://registry.npmjs.org/@better-update/cli/latest";
@@ -2979,7 +3055,7 @@ const VersionCheckLive = Layer.effect(VersionCheck, Effect.gen(function* () {
 //#endregion
 //#region src/app-layer.ts
 const CliPlatformLayer = Layer.mergeAll(CliRuntimeLive, NodeContext.layer, FetchHttpClient.layer);
-const CliStoreLayer = Layer.mergeAll(AuthStoreLive, ConfigStoreLive, AppleSessionStoreLive, IdentityStoreLive).pipe(Layer.provide(CliPlatformLayer));
+const CliStoreLayer = Layer.mergeAll(AuthStoreLive, ConfigStoreLive, AppleSessionStoreLive, IdentityStoreLive, VaultCacheLive).pipe(Layer.provide(CliPlatformLayer));
 const CliAdapterDependencies = Layer.mergeAll(CliPlatformLayer, CliStoreLayer);
 const ApiClientLayer = ApiClientLive.pipe(Layer.provide(CliAdapterDependencies));
 const AppleAuthLayer = AppleAuthLive.pipe(Layer.provide(CliAdapterDependencies));
@@ -4675,8 +4751,31 @@ const findIosArtifact = ({ exportPath }) => Effect.gen(function* () {
 	if (!picked) return yield* new ArtifactNotFoundError({ message: `No .ipa file found under "${exportPath}".` });
 	return picked.path;
 });
-const findAndroidArtifact = ({ projectRoot, format, flavor, buildType, minMtimeMs }) => Effect.gen(function* () {
-	const outputsRoot = path.join(projectRoot, "android", "app", "build", "outputs");
+/**
+* Resolve a custom-command build artifact from a user-supplied path. A pattern
+* without wildcards is treated as a literal path (relative to `baseDir`);
+* otherwise the fixed leading directory + file extension are extracted and the
+* newest matching file under that directory is returned.
+*/
+const findArtifactByGlob = ({ baseDir, pattern, minMtimeMs }) => Effect.gen(function* () {
+	const fs = yield* FileSystem.FileSystem;
+	if (!/[*?[]/u.test(pattern)) {
+		const full = path.isAbsolute(pattern) ? pattern : path.join(baseDir, pattern);
+		if (yield* fs.exists(full).pipe(Effect.orElseSucceed(() => false))) return full;
+		return yield* new ArtifactNotFoundError({ message: `No artifact found at "${full}".` });
+	}
+	const extension = path.extname(pattern).toLowerCase();
+	if (extension === "") return yield* new ArtifactNotFoundError({ message: `artifactPath "${pattern}" must end in a file extension (e.g. **/*.aab).` });
+	const wildcardIndex = pattern.search(/[*?[]/u);
+	const fixedPrefix = pattern.slice(0, wildcardIndex);
+	const prefixDir = fixedPrefix.includes("/") ? fixedPrefix.slice(0, fixedPrefix.lastIndexOf("/")) : "";
+	const searchRoot = prefixDir === "" ? baseDir : path.join(baseDir, prefixDir);
+	const picked = newest(yield* walkAndFind(searchRoot, extension), minMtimeMs);
+	if (!picked) return yield* new ArtifactNotFoundError({ message: `No file matching "${pattern}" found under "${searchRoot}".` });
+	return picked.path;
+});
+const findAndroidArtifact = ({ projectRoot, format, flavor, buildType, minMtimeMs, module: gradleModule = "app" }) => Effect.gen(function* () {
+	const outputsRoot = path.join(projectRoot, "android", gradleModule, "build", "outputs");
 	const subdir = format === "aab" ? "bundle" : "apk";
 	const variantDir = flavor ? `${flavor}${capitalize(buildType)}` : buildType;
 	const pickedDirect = newest(yield* walkAndFind(path.join(outputsRoot, subdir, variantDir), `.${format}`), minMtimeMs);
@@ -18373,6 +18472,25 @@ const grantRecipient = (args) => Effect.gen(function* () {
 const resolveVaultPassphrase = Effect.gen(function* () {
 	return (yield* activeRecipient).source === "file" ? yield* promptPassword("Passphrase to unlock this device's identity:") : void 0;
 });
+/**
+* Unlock the org vault key for an interactive command, reusing a cached vault key
+* from the OS keychain when one is present and unexpired — so the device
+* passphrase is prompted at most once per cache TTL rather than on every command
+* (`better-update credentials unlock` / `lock` drive that session explicitly).
+* The CI `BETTER_UPDATE_IDENTITY` key carries no passphrase and is never cached:
+* it skips straight to the raw unwrap. On a cache miss the full unlock runs —
+* prompt, Argon2id, fetch + unwrap — and the result is cached for next time.
+*/
+const unlockVaultKeyInteractive = (api) => Effect.gen(function* () {
+	const recipient = yield* activeRecipient;
+	if (recipient.source !== "file") return yield* unlockVaultKey(api, void 0);
+	const cache = yield* VaultCache;
+	const cached = yield* cache.get(recipient.publicKey);
+	if (cached !== void 0) return cached.vault;
+	const vault = yield* unlockVaultKey(api, yield* promptPassword("Passphrase to unlock this device's identity:"));
+	yield* cache.set(recipient.publicKey, vault);
+	return vault;
+}).pipe(Effect.provide(VaultCacheLive));
 /** Look up a registered recipient by its key id or full `SHA256:` fingerprint. */
 const findRecipient = (api, selector) => Effect.gen(function* () {
 	const { items } = yield* api.userEncryptionKeys.list();
@@ -18420,11 +18538,15 @@ const openVaultSession = (api, passphrase) => Effect.gen(function* () {
 	};
 });
 /**
-* {@link openVaultSession} that first resolves the device passphrase — prompting
-* when the active identity is the on-disk file, none for the CI env key.
+* {@link openVaultSession} that unlocks the vault key interactively — reusing the
+* OS-keychain-cached key when one is live (no prompt), prompting for the device
+* passphrase only on a cache miss, and none at all for the CI env key.
 */
 const openVaultSessionInteractive = (api) => Effect.gen(function* () {
-	return yield* openVaultSession(api, yield* resolveVaultPassphrase);
+	return {
+		orgId: yield* getActiveOrgId(api),
+		vault: yield* unlockVaultKeyInteractive(api)
+	};
 });
 /** Reshape a sealed envelope into the `{ id, …opaque fields }` an upload body carries. */
 const toUploadEnvelope = (envelope) => ({
@@ -18841,7 +18963,7 @@ const stringField = (cert, name) => {
 	return typeof value === "string" ? value : null;
 };
 const matchTeamFromCommonName = (cn) => {
-	const match = /\(([A-Z0-9]{10})\)/u.exec(cn);
+	const match = /\((?<team>[A-Z0-9]{10})\)/u.exec(cn);
 	if (match === null) return null;
 	const [, captured] = match;
 	return captured === void 0 ? null : captured;
@@ -19926,56 +20048,44 @@ const gradleTaskName = (format, flavor, buildType) => {
 	const verb = format === "aab" ? "bundle" : "assemble";
 	return flavor ? `${verb}${capitalize(flavor)}${capitalize(buildType)}` : `${verb}${capitalize(buildType)}`;
 };
-const runAndroidBuild = (input) => Effect.gen(function* () {
-	const { api, tempDir, projectRoot, androidProfile, applicationIdentifier, envVars, projectId } = input;
-	const runtime = yield* CliRuntime;
+/** Resolve the signing keystore (remote or local), or `undefined` when skipped. */
+const resolveAndroidCredentials = (input) => {
+	if (input.skipCredentials) return Effect.succeed(void 0);
+	return input.credentialsSource === "local" ? loadLocalAndroidCredentials({ projectRoot: input.projectRoot }) : downloadAndroidCredentials(input.api, {
+		projectId: input.projectId,
+		applicationIdentifier: input.applicationIdentifier,
+		tempDir: input.tempDir,
+		buildProfile: input.profileName
+	});
+};
+/** Gradle build against the (already-prepared) `android/` dir. */
+const runGradleBuild = (input, commandEnv) => Effect.gen(function* () {
 	const buildStartMs = Date.now();
-	const { format } = androidProfile;
-	const { flavor } = androidProfile;
-	const buildType = androidProfile.buildType ?? "release";
-	const androidDir = path.join(projectRoot, "android");
-	const commandEnv = yield* runtime.commandEnvironment(envVars);
-	yield* runStep({
-		command: "bunx",
-		args: [
-			"expo",
-			"prebuild",
-			"--platform",
-			"android",
-			"--clean"
-		],
-		cwd: projectRoot,
-		env: commandEnv
-	}, "expo prebuild android");
-	const gradleArgs = yield* input.skipCredentials ? Effect.succeed([]) : Effect.gen(function* () {
-		const credentials = input.credentialsSource === "local" ? yield* loadLocalAndroidCredentials({ projectRoot }) : yield* downloadAndroidCredentials(api, {
-			projectId,
-			applicationIdentifier,
-			tempDir,
-			buildProfile: input.profileName
-		});
+	const { format, flavor } = input.androidProfile;
+	const buildType = input.androidProfile.buildType ?? "release";
+	const moduleName = input.androidProfile.module ?? "app";
+	const androidDir = path.join(input.projectRoot, "android");
+	const credentials = yield* resolveAndroidCredentials(input);
+	const gradleArgs = credentials === void 0 ? [] : yield* Effect.gen(function* () {
 		const fs = yield* FileSystem.FileSystem;
-		const signingGradlePath = path.join(tempDir, "signing.gradle");
-		yield* fs.writeFileString(signingGradlePath, renderSigningGradle({
-			keystorePath: credentials.keystorePath,
-			storePassword: credentials.storePassword,
-			keyAlias: credentials.keyAlias,
-			keyPassword: credentials.keyPassword
-		}));
+		const signingGradlePath = path.join(input.tempDir, "signing.gradle");
+		yield* fs.writeFileString(signingGradlePath, renderSigningGradle(credentials));
 		return ["--init-script", signingGradlePath];
 	});
-	const taskName = gradleTaskName(format, flavor, buildType);
+	const taskName = input.androidProfile.gradleTask ?? gradleTaskName(format, flavor, buildType);
+	const taskArg = taskName.startsWith(":") ? taskName : `:${moduleName}:${taskName}`;
 	yield* runStep({
 		command: "./gradlew",
-		args: [...gradleArgs, `:app:${taskName}`],
+		args: [...gradleArgs, taskArg],
 		cwd: androidDir,
 		env: commandEnv
 	}, "gradlew");
 	const artifactPath = yield* findAndroidArtifact({
-		projectRoot,
+		projectRoot: input.projectRoot,
 		format,
 		buildType,
 		minMtimeMs: buildStartMs,
+		module: moduleName,
 		...compact({ flavor })
 	});
 	const { sha256, byteSize } = yield* sha256File(artifactPath);
@@ -19985,6 +20095,71 @@ const runAndroidBuild = (input) => Effect.gen(function* () {
 		sha256
 	};
 });
+/**
+* Custom-command build. We can't inject signing into an arbitrary build, so the
+* resolved keystore + passwords are exposed to the command as `BETTER_UPDATE_*`
+* env vars; the user's script consumes them. The artifact is located via the
+* profile's `artifactPath` glob.
+*/
+const runAndroidCustom = (input, commandEnv) => Effect.gen(function* () {
+	const buildStartMs = Date.now();
+	const custom = input.customCommand;
+	if (custom === void 0) return yield* new BuildFailedError({
+		step: "custom android build",
+		exitCode: 1,
+		message: "Internal: custom Android strategy selected without a custom command."
+	});
+	if (custom.artifactPath === void 0) return yield* new BuildFailedError({
+		step: "custom android build",
+		exitCode: 1,
+		message: "Custom Android build requires \"artifactPath\" (e.g. \"**/*.aab\") in better-update.json."
+	});
+	const credentials = yield* resolveAndroidCredentials(input);
+	const credEnv = credentials === void 0 ? {} : {
+		BETTER_UPDATE_ANDROID_KEYSTORE_PATH: credentials.keystorePath,
+		BETTER_UPDATE_ANDROID_KEYSTORE_PASSWORD: credentials.storePassword,
+		BETTER_UPDATE_ANDROID_KEY_ALIAS: credentials.keyAlias,
+		BETTER_UPDATE_ANDROID_KEY_PASSWORD: credentials.keyPassword
+	};
+	const cwd = custom.cwd === void 0 ? input.projectRoot : path.join(input.projectRoot, custom.cwd);
+	yield* runStep({
+		command: "sh",
+		args: ["-c", custom.command],
+		cwd,
+		env: {
+			...commandEnv,
+			...credEnv,
+			...custom.env
+		}
+	}, "custom android build");
+	const artifactPath = yield* findArtifactByGlob({
+		baseDir: cwd,
+		pattern: custom.artifactPath,
+		minMtimeMs: buildStartMs
+	});
+	const { sha256, byteSize } = yield* sha256File(artifactPath);
+	return {
+		artifactPath,
+		byteSize,
+		sha256
+	};
+});
+const runAndroidBuild = (input) => Effect.gen(function* () {
+	const commandEnv = yield* (yield* CliRuntime).commandEnvironment(input.envVars);
+	if (input.strategy === "expo") yield* runStep({
+		command: "bunx",
+		args: [
+			"expo",
+			"prebuild",
+			"--platform",
+			"android",
+			"--clean"
+		],
+		cwd: input.projectRoot,
+		env: commandEnv
+	}, "expo prebuild android");
+	return input.strategy === "custom" ? yield* runAndroidCustom(input, commandEnv) : yield* runGradleBuild(input, commandEnv);
+});
 
 //#endregion
 //#region src/lib/credentials-generator-apple-id.ts
@@ -20699,7 +20874,7 @@ const listCurrentKeychains = Effect.gen(function* () {
 const parseSigningIdentity = (output) => {
 	const lines = output.split("\n");
 	for (const line of lines) {
-		const match = /"([^"]+)"/u.exec(line);
+		const match = /"(?<identity>[^"]+)"/u.exec(line);
 		if (match?.[1]) return match[1];
 	}
 };
@@ -21002,36 +21177,85 @@ const createXcodebuildFormatter = (projectRoot) => {
 };
 
 //#endregion
-//#region src/commands/build/ios.ts
-const findXcworkspace = (iosDir) => Effect.gen(function* () {
-	const workspace = (yield* (yield* FileSystem.FileSystem).readDirectory(iosDir)).find((entry) => entry.endsWith(".xcworkspace"));
-	if (!workspace) return yield* new BuildFailedError({
-		step: "detect xcworkspace",
+//#region src/commands/build/ios-prepare.ts
+const baseName = (entry) => entry.replace(/\.(?<ext>xcworkspace|xcodeproj)$/u, "");
+/**
+* Resolve the Xcode container to build: an explicit `workspace`/`project` from
+* the profile, else an auto-discovered `.xcworkspace` (CocoaPods), else the
+* `.xcodeproj` (pure-native apps without Pods).
+*/
+const resolveXcodeContainer = (projectRoot, iosDir, iosProfile) => Effect.gen(function* () {
+	if (iosProfile.workspace !== void 0) {
+		const containerPath = path.resolve(projectRoot, iosProfile.workspace);
+		return {
+			flag: "-workspace",
+			containerPath,
+			schemeBase: baseName(path.basename(containerPath))
+		};
+	}
+	if (iosProfile.project !== void 0) {
+		const containerPath = path.resolve(projectRoot, iosProfile.project);
+		return {
+			flag: "-project",
+			containerPath,
+			schemeBase: baseName(path.basename(containerPath))
+		};
+	}
+	const entries = yield* (yield* FileSystem.FileSystem).readDirectory(iosDir).pipe(Effect.orElseSucceed(() => []));
+	const workspace = entries.find((entry) => entry.endsWith(".xcworkspace"));
+	if (workspace !== void 0) return {
+		flag: "-workspace",
+		containerPath: path.join(iosDir, workspace),
+		schemeBase: baseName(workspace)
+	};
+	const project = entries.find((entry) => entry.endsWith(".xcodeproj"));
+	if (project !== void 0) return {
+		flag: "-project",
+		containerPath: path.join(iosDir, project),
+		schemeBase: baseName(project)
+	};
+	return yield* new BuildFailedError({
+		step: "resolve Xcode container",
 		exitCode: 1,
-		message: `No .xcworkspace found under ${iosDir}. Did "pod install" run?`
+		message: `No .xcworkspace or .xcodeproj found under ${iosDir}. Set ios.workspace / ios.project in better-update.json.`
 	});
-	return workspace;
 });
-const prebuildAndPods = (params) => Effect.gen(function* () {
-	yield* runStep({
-		command: "bunx",
-		args: [
-			"expo",
-			"prebuild",
-			"--platform",
-			"ios",
-			"--clean"
-		],
-		cwd: params.projectRoot,
-		env: params.commandEnv
-	}, "expo prebuild ios");
-	yield* runStep({
+/**
+* Prepare the `ios/` dir for an xcodebuild. Expo regenerates it from app.json
+* via prebuild then runs `pod install`; bare/KMP/native build the committed dir
+* and only run `pod install` when a Podfile is present (unless disabled).
+*/
+const prepareIosNative = (params) => Effect.gen(function* () {
+	if (params.strategy === "expo") {
+		yield* runStep({
+			command: "bunx",
+			args: [
+				"expo",
+				"prebuild",
+				"--platform",
+				"ios",
+				"--clean"
+			],
+			cwd: params.projectRoot,
+			env: params.commandEnv
+		}, "expo prebuild ios");
+		yield* runStep({
+			command: "pod",
+			args: ["install"],
+			cwd: params.iosDir,
+			env: params.commandEnv
+		}, "pod install");
+		return;
+	}
+	if (params.iosProfile.podInstall === false) return;
+	if (yield* (yield* FileSystem.FileSystem).exists(path.join(params.iosDir, "Podfile")).pipe(Effect.orElseSucceed(() => false))) yield* runStep({
 		command: "pod",
 		args: ["install"],
 		cwd: params.iosDir,
 		env: params.commandEnv
 	}, "pod install");
 });
+/** Recursively locate the first `.app` bundle under `root` (simulator output). */
 const findAppDirectory = (root) => Effect.gen(function* () {
 	const fs = yield* FileSystem.FileSystem;
 	const stack = [root];
@@ -21051,25 +21275,30 @@ const findAppDirectory = (root) => Effect.gen(function* () {
 	}
 	return yield* new ArtifactNotFoundError({ message: `No .app bundle found under "${root}".` });
 });
+
+//#endregion
+//#region src/commands/build/ios.ts
 const runIosSimulatorBuild = (input) => Effect.gen(function* () {
 	const { projectRoot, iosProfile, envVars, tempDir } = input;
 	const runtime = yield* CliRuntime;
 	const iosDir = path.join(projectRoot, "ios");
 	const commandEnv = yield* runtime.commandEnvironment(envVars);
-	yield* prebuildAndPods({
+	yield* prepareIosNative({
+		strategy: input.strategy,
 		projectRoot,
 		iosDir,
+		iosProfile,
 		commandEnv
 	});
-	const workspaceFilename = yield* findXcworkspace(iosDir);
-	const scheme = iosProfile.scheme ?? workspaceFilename.replace(/\.xcworkspace$/u, "");
+	const container = yield* resolveXcodeContainer(projectRoot, iosDir, iosProfile);
+	const scheme = iosProfile.scheme ?? container.schemeBase;
 	const configuration = iosProfile.buildConfiguration ?? "Release";
 	const derivedDataPath = path.join(tempDir, "derived-data");
 	const buildCmd = {
 		command: "xcodebuild",
 		args: [
-			"-workspace",
-			workspaceFilename,
+			container.flag,
+			container.containerPath,
 			"-scheme",
 			scheme,
 			"-configuration",
@@ -21157,13 +21386,15 @@ const runIosDeviceBuild = (input) => Effect.gen(function* () {
 	const iosDir = path.join(projectRoot, "ios");
 	const { distribution } = iosProfile;
 	const commandEnv = yield* runtime.commandEnvironment(envVars);
-	yield* prebuildAndPods({
+	yield* prepareIosNative({
+		strategy: input.strategy,
 		projectRoot,
 		iosDir,
+		iosProfile,
 		commandEnv
 	});
-	const workspaceFilename = yield* findXcworkspace(iosDir);
-	const scheme = iosProfile.scheme ?? workspaceFilename.replace(/\.xcworkspace$/u, "");
+	const container = yield* resolveXcodeContainer(projectRoot, iosDir, iosProfile);
+	const scheme = iosProfile.scheme ?? container.schemeBase;
 	const configuration = iosProfile.buildConfiguration ?? "Release";
 	const signedTargets = yield* discoverSignedTargets({
 		iosDir,
@@ -21210,8 +21441,8 @@ const runIosDeviceBuild = (input) => Effect.gen(function* () {
 	const archiveCmd = {
 		command: "xcodebuild",
 		args: [
-			"-workspace",
-			workspaceFilename,
+			container.flag,
+			container.containerPath,
 			"-scheme",
 			scheme,
 			"-configuration",
@@ -21275,19 +21506,76 @@ const runIosDeviceBuild = (input) => Effect.gen(function* () {
 		sha256
 	};
 });
-const runIosBuild = (input) => input.iosProfile.simulator === true ? runIosSimulatorBuild(input) : runIosDeviceBuild(input);
+/**
+* Custom-command iOS build. The resolved p12 + provisioning profiles are written
+* to `tempDir` and their paths exposed via `BETTER_UPDATE_IOS_*` env vars; the
+* user's command performs the actual signing/archive. The artifact is located
+* via the profile's `artifactPath` glob.
+*/
+const runIosCustom = (input) => Effect.gen(function* () {
+	const commandEnv = yield* (yield* CliRuntime).commandEnvironment(input.envVars);
+	const custom = input.customCommand;
+	if (custom === void 0) return yield* new BuildFailedError({
+		step: "custom ios build",
+		exitCode: 1,
+		message: "Internal: custom iOS strategy selected without a custom command."
+	});
+	if (custom.artifactPath === void 0) return yield* new BuildFailedError({
+		step: "custom ios build",
+		exitCode: 1,
+		message: "Custom iOS build requires \"artifactPath\" (e.g. \"build/*.ipa\") in better-update.json."
+	});
+	const credentials = yield* fetchAllCredentials({
+		api: input.api,
+		input,
+		mainBundleIdentifier: input.bundleId,
+		allBundleIdentifiers: [input.bundleId]
+	});
+	const credEnv = {
+		BETTER_UPDATE_IOS_P12_PATH: credentials.p12Path,
+		BETTER_UPDATE_IOS_P12_PASSWORD: credentials.p12Password,
+		BETTER_UPDATE_IOS_PROVISIONING_PROFILES: credentials.profiles.map((profile) => profile.profilePath).join(":")
+	};
+	const cwd = custom.cwd === void 0 ? input.projectRoot : path.join(input.projectRoot, custom.cwd);
+	const buildStartMs = Date.now();
+	yield* runStep({
+		command: "sh",
+		args: ["-c", custom.command],
+		cwd,
+		env: {
+			...commandEnv,
+			...credEnv,
+			...custom.env
+		}
+	}, "custom ios build");
+	const artifactPath = yield* findArtifactByGlob({
+		baseDir: cwd,
+		pattern: custom.artifactPath,
+		minMtimeMs: buildStartMs
+	});
+	const { sha256, byteSize } = yield* sha256File(artifactPath);
+	return {
+		artifactPath,
+		byteSize,
+		sha256
+	};
+});
+const runIosBuild = (input) => {
+	if (input.strategy === "custom") return runIosCustom(input);
+	return input.iosProfile.simulator === true ? runIosSimulatorBuild(input) : runIosDeviceBuild(input);
+};
 
 //#endregion
 //#region src/commands/build/reserve-and-upload.ts
 const buildReserveCommon = (input) => ({
 	projectId: input.projectId,
 	profile: input.profileName,
-	runtimeVersion: input.runtimeVersion,
 	bundleId: input.bundleId,
 	sha256: input.sha256,
 	byteSize: input.byteSize,
 	gitDirty: input.gitContext.dirty,
 	...compact({
+		runtimeVersion: input.runtimeVersion,
 		appVersion: input.appVersion,
 		buildNumber: input.buildNumber,
 		gitRef: input.gitContext.ref,
@@ -21363,7 +21651,7 @@ const bumpVersionCode = (current) => Effect.gen(function* () {
 	if (!Number.isInteger(value) || value < 0) return yield* new BuildProfileError({ message: `Cannot autoIncrement android.versionCode: current value ${String(value)} is not a non-negative integer.` });
 	return value + 1;
 });
-const SEMVER_PATCH = /^(\d+)\.(\d+)\.(\d+)(.*)$/u;
+const SEMVER_PATCH = /^(?<major>\d+)\.(?<minor>\d+)\.(?<patch>\d+)(?<suffix>.*)$/u;
 const bumpVersion = (current) => Effect.gen(function* () {
 	if (current === void 0) return yield* new BuildProfileError({ message: "Cannot autoIncrement version: no `version` field set in Expo config." });
 	const match = SEMVER_PATCH.exec(current);
@@ -21444,20 +21732,21 @@ const stripExtends = (profile) => {
 };
 const resolveExtendsChain = (params) => Effect.gen(function* () {
 	const { profiles, profileName, label, maxDepth, makeError } = params;
+	const sourceLabel = params.sourceLabel ?? "eas.json";
 	const noun = label === "build" ? "Build" : "Submit";
 	const chain = [];
 	const visited = /* @__PURE__ */ new Set();
 	let current = profileName;
 	let depth = 0;
 	while (current !== void 0) {
-		if (visited.has(current)) return yield* Effect.fail(makeError(`Cycle detected in eas.json ${label}.${profileName} extends chain at "${current}".`));
+		if (visited.has(current)) return yield* Effect.fail(makeError(`Cycle detected in ${sourceLabel} ${label}.${profileName} extends chain at "${current}".`));
 		visited.add(current);
 		const profile = profiles[current];
-		if (!profile) return yield* Effect.fail(makeError(current === profileName ? `${noun} profile "${profileName}" not found in eas.json.` : `${noun} profile "${profileName}" extends missing profile "${current}".`));
+		if (!profile) return yield* Effect.fail(makeError(current === profileName ? `${noun} profile "${profileName}" not found in ${sourceLabel}.` : `${noun} profile "${profileName}" extends missing profile "${current}".`));
 		chain.unshift(profile);
 		current = profile.extends;
 		depth += 1;
-		if (depth > maxDepth) return yield* Effect.fail(makeError(`Too many "extends" levels (max ${String(maxDepth)}) in eas.json ${label}.${profileName}.`));
+		if (depth > maxDepth) return yield* Effect.fail(makeError(`Too many "extends" levels (max ${String(maxDepth)}) in ${sourceLabel} ${label}.${profileName}.`));
 	}
 	return chain;
 });
@@ -21524,13 +21813,14 @@ const mergeSubmitProfile = (base, overlay) => {
 		android
 	});
 };
-const resolveEasSubmitProfile = (profiles, profileName) => Effect.gen(function* () {
-	if (!profiles) return yield* new BuildProfileError({ message: "eas.json has no \"submit\" section. Add at least one submit profile." });
+const resolveEasSubmitProfile = (profiles, profileName, sourceLabel = "eas.json") => Effect.gen(function* () {
+	if (!profiles) return yield* new BuildProfileError({ message: `${sourceLabel} has no "submit" section. Add at least one submit profile.` });
 	return stripExtends((yield* resolveExtendsChain({
 		profiles,
 		profileName,
 		label: "submit",
 		maxDepth: MAX_SUBMIT_EXTENDS_DEPTH,
+		sourceLabel,
 		makeError: (message) => new BuildProfileError({ message })
 	})).reduce((acc, next, index) => index === 0 ? next : mergeSubmitProfile(acc, next), {}));
 });
@@ -21597,7 +21887,13 @@ const parseIosProfile = (raw) => {
 		scheme: asStringValue(record["scheme"]),
 		simulator: asBooleanValue(record["simulator"]),
 		enterpriseProvisioning: asEnterpriseProvisioning(record["enterpriseProvisioning"]),
-		autoIncrement: asIosAutoIncrement(record["autoIncrement"])
+		autoIncrement: asIosAutoIncrement(record["autoIncrement"]),
+		workspace: asStringValue(record["workspace"]),
+		project: asStringValue(record["project"]),
+		podInstall: asBooleanValue(record["podInstall"]),
+		bundleIdentifier: asStringValue(record["bundleIdentifier"]),
+		version: asStringValue(record["version"]),
+		buildNumber: asStringValue(record["buildNumber"])
 	});
 };
 const parseAndroidProfile = (raw) => {
@@ -21609,9 +21905,35 @@ const parseAndroidProfile = (raw) => {
 		gradleCommand: asStringValue(record["gradleCommand"]),
 		format: asAndroidFormat(record["format"]),
 		distribution: asAndroidDistribution(record["distribution"]),
-		autoIncrement: asAndroidAutoIncrement(record["autoIncrement"])
+		autoIncrement: asAndroidAutoIncrement(record["autoIncrement"]),
+		module: asStringValue(record["module"]),
+		gradleTask: asStringValue(record["gradleTask"]),
+		applicationId: asStringValue(record["applicationId"]),
+		version: asStringValue(record["version"]),
+		versionCode: asStringValue(record["versionCode"])
 	});
 };
+const parseCustomCommandSpec = (raw) => {
+	const record = asRecord(raw);
+	if (!record) return;
+	const command = asStringValue(record["command"]);
+	if (command === void 0) return;
+	return compact({
+		command,
+		cwd: asStringValue(record["cwd"]),
+		env: asEnv(record["env"]),
+		artifactPath: asStringValue(record["artifactPath"])
+	});
+};
+const parseCustomCommandProfile = (raw) => {
+	const record = asRecord(raw);
+	if (!record) return;
+	const result = compact({
+		ios: parseCustomCommandSpec(record["ios"]),
+		android: parseCustomCommandSpec(record["android"])
+	});
+	return Object.keys(result).length === 0 ? void 0 : result;
+};
 const parseBuildProfile = (raw) => {
 	const record = asRecord(raw);
 	if (!record) return;
@@ -21626,15 +21948,16 @@ const parseBuildProfile = (raw) => {
 		android: parseAndroidProfile(record["android"]),
 		credentialsSource: asCredentialsSource(record["credentialsSource"]),
 		autoIncrement: asAutoIncrement(record["autoIncrement"]),
-		withoutCredentials: asBooleanValue(record["withoutCredentials"])
+		withoutCredentials: asBooleanValue(record["withoutCredentials"]),
+		custom: parseCustomCommandProfile(record["custom"])
 	});
 };
-const parseEasConfig = (text) => Effect.gen(function* () {
-	const root = asRecord(yield* Effect.try({
-		try: () => JSON.parse(text),
-		catch: (cause) => new BuildProfileError({ message: `eas.json is not valid JSON: ${formatCause(cause)}` })
-	}));
-	if (!root) return yield* new BuildProfileError({ message: "eas.json must be a JSON object at the top level." });
+/**
+* Parse an already-decoded JSON object into an {@link EasConfig}. Shared by the
+* `eas.json` reader and the `better-update.json` build-config reader — both hold
+* the same `build`/`submit`/`cli` shape, only the source file differs.
+*/
+const parseConfigFromRecord = (root) => {
 	const buildRecord = asRecord(root["build"]);
 	if (!buildRecord) return asRecord(root["cli"]) ? { cli: parseCli(root["cli"]) } : {};
 	const profiles = {};
@@ -21653,6 +21976,14 @@ const parseEasConfig = (text) => Effect.gen(function* () {
 		build: profiles,
 		...Object.keys(submit).length === 0 ? {} : { submit }
 	};
+};
+const parseEasConfig = (text) => Effect.gen(function* () {
+	const root = asRecord(yield* Effect.try({
+		try: () => JSON.parse(text),
+		catch: (cause) => new BuildProfileError({ message: `eas.json is not valid JSON: ${formatCause(cause)}` })
+	}));
+	if (!root) return yield* new BuildProfileError({ message: "eas.json must be a JSON object at the top level." });
+	return parseConfigFromRecord(root);
 });
 const parseCli = (raw) => {
 	const record = asRecord(raw);
@@ -21667,10 +21998,15 @@ const readEasJson = (projectRoot) => Effect.gen(function* () {
 	const filePath = yield* easJsonPath(projectRoot);
 	return yield* parseEasConfig(yield* fs.readFileString(filePath).pipe(Effect.catchAll((cause) => Effect.fail(new BuildProfileError({ message: cause._tag === "SystemError" && cause.reason === "NotFound" ? `No eas.json found at ${filePath}. Create one with a "build" section.` : `Failed to read eas.json: ${cause.message}` })))));
 });
+const mergeCustom = (base, overlay) => {
+	const merged = shallowMerge(base, overlay);
+	return merged === void 0 || Object.keys(merged).length === 0 ? void 0 : merged;
+};
 const mergeProfile = (base, overlay) => {
 	const ios = shallowMerge(base.ios, overlay.ios);
 	const android = shallowMerge(base.android, overlay.android);
 	const env = shallowMerge(base.env, overlay.env);
+	const custom = mergeCustom(base.custom, overlay.custom);
 	const developmentClient = overlay.developmentClient ?? base.developmentClient;
 	const distribution = overlay.distribution ?? base.distribution;
 	const channel = overlay.channel ?? base.channel;
@@ -21689,21 +22025,41 @@ const mergeProfile = (base, overlay) => {
 		android,
 		credentialsSource,
 		autoIncrement,
-		withoutCredentials
+		withoutCredentials,
+		custom
 	});
 };
-const resolveEasBuildProfile = (config, profileName) => Effect.gen(function* () {
+const resolveEasBuildProfile = (config, profileName, sourceLabel = "eas.json") => Effect.gen(function* () {
 	const profiles = config.build;
-	if (!profiles) return yield* new BuildProfileError({ message: "eas.json has no \"build\" section. Add at least one profile." });
+	if (!profiles) return yield* new BuildProfileError({ message: `${sourceLabel} has no "build" section. Add at least one profile.` });
 	return stripExtends((yield* resolveExtendsChain({
 		profiles,
 		profileName,
 		label: "build",
 		maxDepth: MAX_EXTENDS_DEPTH,
+		sourceLabel,
 		makeError: (message) => new BuildProfileError({ message })
 	})).reduce((acc, next, index) => index === 0 ? next : mergeProfile(acc, next), {}));
 });
 
+//#endregion
+//#region src/lib/better-update-build-config.ts
+/** Label used in profile-resolution error copy when config comes from this file. */
+const BETTER_UPDATE_SOURCE_LABEL = "better-update.json";
+/**
+* Read the `build`/`submit`/`cli` config from `better-update.json`. Returns an
+* empty config (no `build` key) when the file is absent or carries no build
+* section. Shares the parser with {@link file://./eas-config.ts}; only the
+* source file and the error `sourceLabel` differ.
+*/
+const readBuildConfig = (projectRoot) => readBetterUpdateConfig(projectRoot).pipe(Effect.map((config) => config === void 0 ? {} : parseConfigFromRecord(config)));
+/** List available build-profile names declared in `better-update.json`. */
+const listBuildProfileNames = (projectRoot) => readBuildConfig(projectRoot).pipe(Effect.map((config) => Object.keys(config.build ?? {})));
+/** Resolve a submit profile from `better-update.json`'s `submit` section. */
+const readSubmitProfile = (projectRoot, profileName) => Effect.gen(function* () {
+	return yield* resolveEasSubmitProfile((yield* readBuildConfig(projectRoot)).submit, profileName, BETTER_UPDATE_SOURCE_LABEL);
+});
+
 //#endregion
 //#region src/lib/build-profile.ts
 const deriveIosDistribution = (eas) => {
@@ -21750,12 +22106,22 @@ const toIosProfile = (eas) => {
 	if (!distribution) return;
 	const ios = eas.ios ?? {};
 	const autoIncrement = resolveIosAutoIncrement(eas);
+	const buildConfiguration = ios.buildConfiguration ?? (eas.developmentClient === true ? "Debug" : void 0);
+	const metaOverride = compact({
+		bundleIdentifier: ios.bundleIdentifier,
+		version: ios.version,
+		buildNumber: ios.buildNumber
+	});
 	return compact({
 		distribution,
-		buildConfiguration: ios.buildConfiguration ?? (eas.developmentClient === true ? "Debug" : void 0),
+		buildConfiguration,
 		scheme: ios.scheme,
 		simulator: ios.simulator,
-		autoIncrement
+		autoIncrement,
+		workspace: ios.workspace,
+		project: ios.project,
+		podInstall: ios.podInstall,
+		metaOverride: Object.keys(metaOverride).length === 0 ? void 0 : metaOverride
 	});
 };
 const toAndroidProfile = (eas) => {
@@ -21765,16 +22131,25 @@ const toAndroidProfile = (eas) => {
 	const android = eas.android ?? {};
 	const distribution = deriveAndroidDistribution(eas, format);
 	const autoIncrement = resolveAndroidAutoIncrement(eas);
+	const buildType = android.buildType ?? (eas.developmentClient === true ? "debug" : void 0);
+	const metaOverride = compact({
+		applicationId: android.applicationId,
+		version: android.version,
+		versionCode: android.versionCode
+	});
 	return compact({
 		format,
 		distribution,
-		buildType: android.buildType ?? (eas.developmentClient === true ? "debug" : void 0),
+		buildType,
 		flavor: android.flavor,
 		gradleCommand: android.gradleCommand,
-		autoIncrement
+		autoIncrement,
+		module: android.module,
+		gradleTask: android.gradleTask,
+		metaOverride: Object.keys(metaOverride).length === 0 ? void 0 : metaOverride
 	});
 };
-const fromEasProfile = (eas, profileName) => {
+const fromGenericProfile = (eas, profileName) => {
 	const ios = toIosProfile(eas);
 	const android = toAndroidProfile(eas);
 	return compact({
@@ -21786,11 +22161,13 @@ const fromEasProfile = (eas, profileName) => {
 		android,
 		credentialsSource: eas.credentialsSource,
 		developmentClient: eas.developmentClient,
-		withoutCredentials: eas.withoutCredentials
+		withoutCredentials: eas.withoutCredentials,
+		customCommand: eas.custom
 	});
 };
+/** Resolve a build profile from `better-update.json`'s `build` section. */
 const readBuildProfile = (projectRoot, profileName) => Effect.gen(function* () {
-	return fromEasProfile(yield* resolveEasBuildProfile(yield* readEasJson(projectRoot), profileName), profileName);
+	return fromGenericProfile(yield* resolveEasBuildProfile(yield* readBuildConfig(projectRoot), profileName, "better-update.json"), profileName);
 });
 const readRuntimeVersionMeta = (config, platform) => ({
 	platform,
@@ -21800,6 +22177,17 @@ const readRuntimeVersionMeta = (config, platform) => ({
 	rawRuntimeVersion: extractRawRuntimeVersion(config, platform)
 });
 
+//#endregion
+//#region src/lib/build-strategy.ts
+const resolveAndroidStrategy = (profile, projectType) => {
+	if (profile.customCommand?.android !== void 0) return "custom";
+	return projectType === "expo" ? "expo" : "gradle";
+};
+const resolveIosStrategy = (profile, projectType) => {
+	if (profile.customCommand?.ios !== void 0) return "custom";
+	return projectType === "expo" ? "expo" : "xcode";
+};
+
 //#endregion
 //#region src/lib/clear-cache.ts
 /**
@@ -21827,6 +22215,64 @@ const clearBuildCaches = (projectRoot) => Effect.gen(function* () {
 	if (removed.length > 0) yield* Console.error(`Cleared caches: ${removed.join(", ")}`);
 });
 
+//#endregion
+//#region src/lib/detect-project-type.ts
+const PROJECT_TYPES = [
+	"expo",
+	"bare",
+	"kmp",
+	"native",
+	"custom"
+];
+/** Narrow an arbitrary `projectType` override (e.g. from better-update.json) to a valid value. */
+const asProjectType = (raw) => PROJECT_TYPES.find((type) => type === raw);
+const exists = (filePath) => Effect.gen(function* () {
+	return yield* (yield* FileSystem.FileSystem).exists(filePath).pipe(Effect.orElseSucceed(() => false));
+});
+const readText = (filePath) => Effect.gen(function* () {
+	return yield* (yield* FileSystem.FileSystem).readFileString(filePath).pipe(Effect.orElseSucceed(() => ""));
+});
+const hasExpoDependency = (projectRoot) => Effect.gen(function* () {
+	const text = yield* readText(path.join(projectRoot, "package.json"));
+	if (text.length === 0) return false;
+	const pkg = asRecord(yield* Effect.try(() => JSON.parse(text)).pipe(Effect.orElseSucceed(() => void 0)));
+	const deps = asRecord(pkg?.["dependencies"]);
+	const devDeps = asRecord(pkg?.["devDependencies"]);
+	return deps?.["expo"] !== void 0 || devDeps?.["expo"] !== void 0;
+});
+const hasAnyExpoConfigFile = (projectRoot) => Effect.gen(function* () {
+	for (const name of [
+		"app.json",
+		"app.config.js",
+		"app.config.ts"
+	]) if (yield* exists(path.join(projectRoot, name))) return true;
+	return false;
+});
+const looksKmp = (projectRoot) => Effect.gen(function* () {
+	if (yield* exists(path.join(projectRoot, "composeApp"))) return true;
+	for (const name of ["settings.gradle.kts", "settings.gradle"]) {
+		const text = yield* readText(path.join(projectRoot, name));
+		if (text.includes("composeApp") || text.includes(":shared")) return true;
+	}
+	return yield* exists(path.join(projectRoot, "android", "app", "build.gradle.kts"));
+});
+/**
+* Resolve a project's build-system family. An explicit override always wins;
+* otherwise the filesystem shape is inspected. `custom` is never auto-detected —
+* it is intent expressed via override or a profile `custom` block.
+*/
+const detectProjectType = (params) => Effect.gen(function* () {
+	if (params.override !== void 0) return params.override;
+	const { projectRoot } = params;
+	if (isExpoConfigInstalled() && ((yield* hasExpoDependency(projectRoot)) || (yield* hasAnyExpoConfigFile(projectRoot)))) return "expo";
+	if (yield* looksKmp(projectRoot)) return "kmp";
+	const hasAndroid = yield* exists(path.join(projectRoot, "android"));
+	const hasIos = yield* exists(path.join(projectRoot, "ios"));
+	const hasPackageJson = yield* exists(path.join(projectRoot, "package.json"));
+	if (hasAndroid && hasIos && hasPackageJson) return "bare";
+	return "native";
+});
+
 //#endregion
 //#region src/lib/dev-client-check.ts
 const readDeps = (filePath) => Effect.gen(function* () {
@@ -22192,6 +22638,28 @@ const detectPlatform = (explicit, config) => Effect.gen(function* () {
 		label: entry
 	})));
 });
+/**
+* Resolve a build platform for non-Expo projects from an explicit flag, or by
+* intersecting the profile's declared platform sections with the native dirs
+* present on disk. Prompts when both remain; fails when ambiguous and prompts
+* are disallowed.
+*/
+const detectPlatformGeneric = (explicit, context) => Effect.gen(function* () {
+	if (explicit !== void 0) return explicit;
+	const candidates = [];
+	const wantsIos = context.profile.ios !== void 0 || context.profile.customCommand?.ios !== void 0;
+	const wantsAndroid = context.profile.android !== void 0 || context.profile.customCommand?.android !== void 0;
+	if (wantsIos && (context.hasIosDir || context.profile.customCommand?.ios !== void 0)) candidates.push("ios");
+	if (wantsAndroid && (context.hasAndroidDir || context.profile.customCommand?.android !== void 0)) candidates.push("android");
+	if (candidates.length === 0) return yield* new BuildProfileError({ message: "Cannot infer build platform. Add an `ios` or `android` section to the build profile in better-update.json, or pass --platform." });
+	const [only] = candidates;
+	if (candidates.length === 1 && only !== void 0) return only;
+	if (!(yield* InteractiveMode).allow) return yield* new BuildProfileError({ message: `Multiple platforms available (${candidates.join(", ")}). Pass --platform explicitly when running non-interactively.` });
+	return yield* promptSelect("Which platform to build?", candidates.map((entry) => ({
+		value: entry,
+		label: entry
+	})));
+});
 
 //#endregion
 //#region src/lib/project-staging.ts
@@ -22204,24 +22672,30 @@ const LOCKFILES = [
 	["package-lock.json", "npm"]
 ];
 /**
-* Paths never copied into staging — covers generated native build outputs and
-* dependency dirs that must be reinstalled fresh in staging.
+* Generated native build outputs / dependency dirs that must never be copied —
+* they are regenerated in staging (Pods via `pod install`, build/ via gradle).
 */
-const ALWAYS_IGNORE = [
-	"node_modules",
-	".git",
+const NATIVE_BUILD_OUTPUTS = [
 	"ios/build",
 	"ios/Pods",
 	"ios/DerivedData",
 	"android/build",
 	"android/app/build",
 	"android/.gradle",
-	"android/.kotlin",
+	"android/.kotlin"
+];
+/**
+* Paths never copied into staging — covers generated native build outputs and
+* dependency dirs that must be reinstalled fresh in staging.
+*/
+const ALWAYS_IGNORE = [...[
+	"node_modules",
+	".git",
 	".expo",
 	".gradle",
 	".turbo",
 	"dist"
-];
+], ...NATIVE_BUILD_OUTPUTS];
 const findLockfile = (fs, dir) => Effect.gen(function* () {
 	for (const [name, pm] of LOCKFILES) if (yield* fs.exists(path.join(dir, name)).pipe(Effect.catchAll(() => Effect.succeed(false)))) return pm;
 });
@@ -22249,8 +22723,12 @@ const detectWorkspaceRoot = (cwd) => walkUpForLockfile(cwd, cwd);
 * Build an `Ignore` matcher for the workspace root. `.easignore` REPLACES
 * `.gitignore` when present (matches EAS semantics); otherwise `.gitignore`
 * is layered on top of the always-ignore baseline.
+*
+* When `includeNativeSource` is set, the native source dirs are re-included
+* after the ignore files are applied, then their build outputs re-excluded, so
+* a committed `ios/`/`android/` reaches staging intact.
 */
-const buildIgnoreInstance = (workspaceRoot) => Effect.gen(function* () {
+const buildIgnoreInstance = (workspaceRoot, options = {}) => Effect.gen(function* () {
 	const fs = yield* FileSystem.FileSystem;
 	const ig = ignore();
 	ig.add([...ALWAYS_IGNORE]);
@@ -22258,12 +22736,17 @@ const buildIgnoreInstance = (workspaceRoot) => Effect.gen(function* () {
 	if (yield* fs.exists(easignorePath).pipe(Effect.catchAll(() => Effect.succeed(false)))) {
 		const content = yield* fs.readFileString(easignorePath).pipe(Effect.catchAll(() => Effect.succeed("")));
 		ig.add(content);
-		return ig;
+	} else {
+		const gitignorePath = path.join(workspaceRoot, ".gitignore");
+		if (yield* fs.exists(gitignorePath).pipe(Effect.catchAll(() => Effect.succeed(false)))) {
+			const content = yield* fs.readFileString(gitignorePath).pipe(Effect.catchAll(() => Effect.succeed("")));
+			ig.add(content);
+		}
 	}
-	const gitignorePath = path.join(workspaceRoot, ".gitignore");
-	if (yield* fs.exists(gitignorePath).pipe(Effect.catchAll(() => Effect.succeed(false)))) {
-		const content = yield* fs.readFileString(gitignorePath).pipe(Effect.catchAll(() => Effect.succeed("")));
-		ig.add(content);
+	if (options.includeNativeSource === true) {
+		const base = options.appRelPath === void 0 || options.appRelPath === "" ? "" : `${options.appRelPath}/`;
+		ig.add([`!${base}android`, `!${base}ios`]);
+		ig.add(NATIVE_BUILD_OUTPUTS.map((entry) => `${base}${entry}`));
 	}
 	return ig;
 });
@@ -22311,6 +22794,7 @@ const runInstall = (params) => runStep({
 * regardless of what `expo prebuild`, `pod install`, or `gradlew` write.
 */
 const prepareStagingProject = (input) => Effect.gen(function* () {
+	const fs = yield* FileSystem.FileSystem;
 	const runtime = yield* CliRuntime;
 	const { workspaceRoot, packageManager } = yield* detectWorkspaceRoot(input.userCwd);
 	const relAppPath = path.relative(workspaceRoot, input.userCwd);
@@ -22320,14 +22804,18 @@ const prepareStagingProject = (input) => Effect.gen(function* () {
 	yield* copyProjectTree({
 		source: workspaceRoot,
 		dest: stagingRoot,
-		ig: yield* buildIgnoreInstance(workspaceRoot)
+		ig: yield* buildIgnoreInstance(workspaceRoot, {
+			includeNativeSource: input.projectType !== void 0 && input.projectType !== "expo",
+			appRelPath: relAppPath
+		})
 	});
 	yield* initGitRepo(stagingRoot);
-	yield* runInstall({
+	if (yield* fs.exists(path.join(workspaceRoot, "package.json")).pipe(Effect.catchAll(() => Effect.succeed(false)))) yield* runInstall({
 		stagingRoot,
 		packageManager,
 		env: yield* runtime.commandEnvironment(input.envVars)
 	});
+	else yield* printHuman("No package.json at the staging root — skipping dependency install.");
 	return {
 		stagingRoot,
 		projectRoot,
@@ -22927,7 +23415,7 @@ const runAndroidGooglePlayUpload = (inputs) => Effect.gen(function* () {
 });
 
 //#endregion
-//#region src/application/build-workflow.ts
+//#region src/application/build-auto-submit.ts
 const buildAutoSubmitIosConfig = (iosProfile, whatToTest) => {
 	if (iosProfile?.bundleIdentifier === void 0) return;
 	return compact({
@@ -22953,9 +23441,10 @@ const buildAutoSubmitAndroidConfig = (androidProfile) => {
 		rollout: androidProfile.rollout
 	});
 };
+/** Submit a freshly-built artifact to the store using the profile's submit config. */
 const runAutoSubmit = (input) => Effect.gen(function* () {
 	yield* printHuman(`\nAuto-submitting build ${input.buildId} (profile ${input.profileName})...`);
-	const easProfile = yield* resolveEasSubmitProfile((yield* readEasJson(process.cwd())).submit, input.profileName);
+	const easProfile = yield* readSubmitProfile(yield* (yield* CliRuntime).cwd, input.profileName);
 	const archiveUrl = (yield* input.api.builds.getInstallLink({ path: { id: input.buildId } })).artifactUrl;
 	const iosConfig = input.platform === "ios" ? buildAutoSubmitIosConfig(easProfile.ios, input.whatToTest) : void 0;
 	const androidConfig = input.platform === "android" ? buildAutoSubmitAndroidConfig(easProfile.android) : void 0;
@@ -22983,15 +23472,146 @@ const runAutoSubmit = (input) => Effect.gen(function* () {
 	}
 	yield* printHuman(`Submission final status: ${(yield* pollSubmissionUntilTerminal(input.api, submission.id)).status}`);
 });
+
+//#endregion
+//#region src/lib/ios-native-meta.ts
+const APPLICATION_PRODUCT_TYPE = "com.apple.product-type.application";
+/**
+* A build setting that is an unresolved reference (`$(MARKETING_VERSION)`) or a
+* variable interpolation tells us nothing concrete — treat it as absent so the
+* profile `metaOverride` can supply a real value.
+*/
+const concreteSetting = (raw) => {
+	if (typeof raw === "number") return String(raw);
+	if (typeof raw !== "string") return;
+	const value = unquote$1(raw);
+	return value.length === 0 || value.includes("$(") ? void 0 : value;
+};
+const findApplicationTarget = (project) => {
+	const nativeTargets = project.pbxNativeTargetSection();
+	for (const [uuid, entry] of Object.entries(nativeTargets)) {
+		if (uuid.endsWith("_comment") || typeof entry === "string") continue;
+		if (unquote$1(entry.productType) === APPLICATION_PRODUCT_TYPE) return entry;
+	}
+};
+const configUuidForName = (project, target, configurationName) => {
+	const configList = project.pbxXCConfigurationList()[target.buildConfigurationList];
+	if (!configList || typeof configList === "string") return;
+	const buildConfigSection = project.pbxXCBuildConfigurationSection();
+	return configList.buildConfigurations.map((entry) => entry.value).find((uuid) => {
+		const cfg = buildConfigSection[uuid];
+		return cfg !== void 0 && typeof cfg !== "string" && unquote$1(cfg.name) === configurationName;
+	});
+};
+/**
+* Read app metadata (bundle id, marketing version, build number) for the main
+* application target of the single `.xcodeproj` under `iosDir`, for a given build
+* configuration. Used for non-Expo (bare/native) projects where there is no
+* `app.json`. Missing or unresolved settings come back `undefined` so the caller
+* can fall back to profile `metaOverride`.
+*/
+const readIosNativeMeta = (params) => Effect.gen(function* () {
+	const projectDir = yield* findXcodeProjectDir(params.iosDir);
+	const project = yield* parseProject(path.join(projectDir, "project.pbxproj"));
+	const target = findApplicationTarget(project);
+	if (target === void 0) return {};
+	const configUuid = configUuidForName(project, target, params.configurationName);
+	if (configUuid === void 0) return {};
+	const cfg = project.pbxXCBuildConfigurationSection()[configUuid];
+	if (cfg === void 0 || typeof cfg === "string") return {};
+	const settings = cfg.buildSettings;
+	return compact({
+		bundleId: concreteSetting(settings["PRODUCT_BUNDLE_IDENTIFIER"]),
+		marketingVersion: concreteSetting(settings["MARKETING_VERSION"]),
+		currentProjectVersion: concreteSetting(settings["CURRENT_PROJECT_VERSION"])
+	});
+});
+
+//#endregion
+//#region src/application/resolve-app-meta.ts
+const EMPTY = {
+	bundleId: void 0,
+	androidPackage: void 0,
+	appVersion: void 0,
+	buildNumber: void 0,
+	rawRuntimeVersion: void 0
+};
+const warnIfMismatch = (label, override, native) => override !== void 0 && native !== void 0 && override !== native ? printWarn(`${label} override "${override}" differs from the native value "${native}". The better-update.json value will be used for build metadata.`) : Effect.void;
+const resolveAndroidMeta = (projectRoot, profile) => Effect.gen(function* () {
+	const gradle = yield* readGradleConfig(path.join(projectRoot, "android"));
+	const override = profile.android?.metaOverride;
+	yield* warnIfMismatch("android.applicationId", override?.applicationId, gradle?.applicationId);
+	const androidPackage = override?.applicationId ?? gradle?.applicationId;
+	if (androidPackage === void 0) return yield* new BuildProfileError({ message: "Could not determine the Android applicationId. Set android.applicationId under this build profile in better-update.json, or ensure android/app/build.gradle defines it." });
+	const versionCode = override?.versionCode ?? (gradle?.versionCode === void 0 ? void 0 : String(gradle.versionCode));
+	return {
+		...EMPTY,
+		androidPackage,
+		appVersion: override?.version ?? gradle?.versionName,
+		buildNumber: versionCode
+	};
+});
+const resolveIosMeta = (projectRoot, profile) => Effect.gen(function* () {
+	const configurationName = profile.ios?.buildConfiguration ?? "Release";
+	const native = yield* readIosNativeMeta({
+		iosDir: path.join(projectRoot, "ios"),
+		configurationName
+	}).pipe(Effect.orElseSucceed(() => ({})));
+	const override = profile.ios?.metaOverride;
+	yield* warnIfMismatch("ios.bundleIdentifier", override?.bundleIdentifier, native.bundleId);
+	const bundleId = override?.bundleIdentifier ?? native.bundleId;
+	if (bundleId === void 0) return yield* new BuildProfileError({ message: "Could not determine the iOS bundle identifier. Set ios.bundleIdentifier under this build profile in better-update.json, or ensure the Xcode project defines PRODUCT_BUNDLE_IDENTIFIER for the build configuration." });
+	return {
+		...EMPTY,
+		bundleId,
+		appVersion: override?.version ?? native.marketingVersion,
+		buildNumber: override?.buildNumber ?? native.currentProjectVersion
+	};
+});
+const overlayExpoOverride = (meta, platform, profile) => {
+	if (platform === "ios") {
+		const override = profile.ios?.metaOverride;
+		return {
+			...meta,
+			bundleId: override?.bundleIdentifier ?? meta.bundleId,
+			appVersion: override?.version ?? meta.appVersion,
+			buildNumber: override?.buildNumber ?? meta.buildNumber
+		};
+	}
+	const override = profile.android?.metaOverride;
+	return {
+		...meta,
+		androidPackage: override?.applicationId ?? meta.androidPackage,
+		appVersion: override?.version ?? meta.appVersion,
+		buildNumber: override?.versionCode ?? meta.buildNumber
+	};
+};
+/**
+* Resolve app metadata (bundle id / package, version, build number) in a
+* project-type-aware way. Expo reads from app.json; bare/native read from native
+* files (build.gradle / pbxproj); KMP/custom rely on profile `metaOverride`,
+* which also overrides native values when both are present.
+*/
+const resolveAppMeta = (params) => {
+	if (params.projectType === "expo") {
+		if (params.expoAppMeta === void 0) return Effect.fail(new BuildProfileError({ message: "Internal: missing Expo app metadata for expo project." }));
+		return Effect.succeed(overlayExpoOverride(params.expoAppMeta, params.platform, params.profile));
+	}
+	return params.platform === "ios" ? resolveIosMeta(params.projectRoot, params.profile) : resolveAndroidMeta(params.projectRoot, params.profile);
+};
+
+//#endregion
+//#region src/application/build-workflow.ts
 const runIosPlatformBuild = (input) => Effect.gen(function* () {
 	const { api, appMeta, envVars, options, profile, projectId, projectRoot, tempDir } = input;
 	if (!profile.ios) return yield* new BuildProfileError({ message: `Profile "${profile.name}" has no ios section.` });
 	const iosProfile = profile.ios;
 	const iosBundleId = appMeta.bundleId;
-	if (!iosBundleId) return yield* new BuildProfileError({ message: "Missing ios.bundleIdentifier in your Expo config." });
+	if (!iosBundleId) return yield* new BuildProfileError({ message: "Missing iOS bundle identifier (set ios.bundleIdentifier or your Expo config)." });
+	const strategy = resolveIosStrategy(profile, input.projectType);
 	const isSimulator = iosProfile.simulator === true;
 	const credentialsSource = profile.credentialsSource ?? "remote";
-	if (!isSimulator && credentialsSource === "remote") yield* ensureIosCredentials(api, {
+	if (strategy !== "custom" && !isSimulator && credentialsSource === "remote") yield* ensureIosCredentials(api, {
 		projectId,
 		bundleIdentifier: iosBundleId,
 		distribution: iosProfile.distribution
@@ -23006,8 +23626,10 @@ const runIosPlatformBuild = (input) => Effect.gen(function* () {
 			envVars,
 			projectId,
 			credentialsSource,
+			strategy,
 			rawOutput: options.rawOutput,
-			freezeCredentials: options.freezeCredentials ?? false
+			freezeCredentials: options.freezeCredentials ?? false,
+			...compact({ customCommand: profile.customCommand?.ios })
 		}),
 		target: isSimulator ? {
 			platform: "ios",
@@ -23026,7 +23648,8 @@ const runAndroidPlatformBuild = (input) => Effect.gen(function* () {
 	if (!profile.android) return yield* new BuildProfileError({ message: `Profile "${profile.name}" has no android section.` });
 	const androidProfile = profile.android;
 	const androidBundleId = appMeta.androidPackage;
-	if (!androidBundleId) return yield* new BuildProfileError({ message: "Missing android.package in your Expo config." });
+	if (!androidBundleId) return yield* new BuildProfileError({ message: "Missing Android applicationId (set android.applicationId or your Expo config)." });
+	const strategy = resolveAndroidStrategy(profile, input.projectType);
 	const gradleConfig = yield* readGradleConfig(`${projectRoot}/android`);
 	yield* warnOnGradleMismatch(gradleConfig, androidBundleId);
 	const applicationIdentifier = gradleConfig?.applicationId ?? androidBundleId;
@@ -23047,7 +23670,9 @@ const runAndroidPlatformBuild = (input) => Effect.gen(function* () {
 			projectId,
 			credentialsSource,
 			profileName: profile.name,
-			skipCredentials
+			skipCredentials,
+			strategy,
+			...compact({ customCommand: profile.customCommand?.android })
 		}),
 		target: androidProfile.format === "aab" ? {
 			platform: "android",
@@ -23062,12 +23687,48 @@ const runAndroidPlatformBuild = (input) => Effect.gen(function* () {
 	};
 });
 const runPlatformBuild = (input) => input.platform === "ios" ? runIosPlatformBuild(input) : runAndroidPlatformBuild(input);
+const dirExists = (root, name) => Effect.gen(function* () {
+	return yield* (yield* FileSystem.FileSystem).exists(path.join(root, name)).pipe(Effect.orElseSucceed(() => false));
+});
+/**
+* Expo metadata path: read app.json (with the env overlay so dynamic configs
+* resolve), apply autoIncrement to the user's tree, re-read, then derive the OTA
+* runtimeVersion. Mirrors the original managed flow.
+*/
+const resolveExpoBuildMeta = (params) => Effect.gen(function* () {
+	const { userCwd, platform, profile, envVars } = params;
+	yield* applyAutoIncrement({
+		projectRoot: userCwd,
+		platform,
+		config: yield* readExpoConfig(userCwd, envVars),
+		...platform === "ios" && profile.ios?.autoIncrement !== void 0 ? { iosMode: profile.ios.autoIncrement } : {},
+		...platform === "android" && profile.android?.autoIncrement !== void 0 ? { androidMode: profile.android.autoIncrement } : {}
+	});
+	const bumpedConfig = yield* readExpoConfig(userCwd, envVars);
+	const appMeta = yield* resolveAppMeta({
+		projectType: "expo",
+		platform,
+		projectRoot: userCwd,
+		profile,
+		expoAppMeta: yield* readAppMeta(bumpedConfig, platform)
+	});
+	return {
+		appMeta,
+		runtimeVersion: yield* resolveRuntimeVersion({
+			raw: appMeta.rawRuntimeVersion,
+			appVersion: appMeta.appVersion,
+			projectRoot: userCwd,
+			platform,
+			buildNumber: appMeta.buildNumber,
+			sdkVersion: bumpedConfig.sdkVersion
+		})
+	};
+});
 const resolveProfileName = (projectRoot, requested) => Effect.gen(function* () {
-	const easConfig = yield* readEasJson(projectRoot);
-	const available = Object.keys(easConfig.build ?? {});
+	const available = yield* listBuildProfileNames(projectRoot);
 	if (available.includes(requested)) return requested;
 	if (!(yield* InteractiveMode).allow || available.length === 0) return requested;
-	yield* printHuman(`Build profile "${requested}" not found in eas.json.`);
+	yield* printHuman(`Build profile "${requested}" not found in better-update.json.`);
 	return yield* promptSelect("Pick a build profile:", available.map((name) => ({
 		value: name,
 		label: name
@@ -23081,11 +23742,19 @@ const runBuildWorkflow = (options) => Effect.scoped(Effect.gen(function* () {
 		allowDirty: options.allowDirty ?? false,
 		label: "build"
 	});
-	const baseConfig = yield* readExpoConfig(userCwd);
-	const projectId = yield* extractProjectId(baseConfig);
-	const platform = yield* detectPlatform(options.platform, baseConfig);
+	const projectType = yield* detectProjectType({
+		projectRoot: userCwd,
+		override: asProjectType((yield* readBetterUpdateConfig(userCwd))?.["projectType"])
+	});
+	const isExpo = projectType === "expo";
+	const projectId = yield* readProjectId;
 	const profile = yield* readBuildProfile(userCwd, yield* resolveProfileName(userCwd, options.profileName));
 	if (profile.developmentClient === true) yield* warnIfDevClientMissing(userCwd);
+	const platform = isExpo ? yield* detectPlatform(options.platform, yield* readExpoConfig(userCwd)) : yield* detectPlatformGeneric(options.platform, {
+		profile,
+		hasAndroidDir: yield* dirExists(userCwd, "android"),
+		hasIosDir: yield* dirExists(userCwd, "ios")
+	});
 	const envVars = {
 		...yield* pullEnvVars(api, {
 			projectId,
@@ -23093,36 +23762,35 @@ const runBuildWorkflow = (options) => Effect.scoped(Effect.gen(function* () {
 		}),
 		...profile.env
 	};
-	yield* applyAutoIncrement({
-		projectRoot: userCwd,
-		platform,
-		config: yield* readExpoConfig(userCwd, envVars),
-		...platform === "ios" && profile.ios?.autoIncrement !== void 0 ? { iosMode: profile.ios.autoIncrement } : {},
-		...platform === "android" && profile.android?.autoIncrement !== void 0 ? { androidMode: profile.android.autoIncrement } : {}
-	});
-	const bumpedConfig = yield* readExpoConfig(userCwd, envVars);
-	const appMeta = yield* readAppMeta(bumpedConfig, platform);
-	const runtimeVersion = yield* resolveRuntimeVersion({
-		raw: appMeta.rawRuntimeVersion,
-		appVersion: appMeta.appVersion,
-		projectRoot: userCwd,
+	const { appMeta, runtimeVersion } = isExpo ? yield* resolveExpoBuildMeta({
+		userCwd,
 		platform,
-		buildNumber: appMeta.buildNumber,
-		sdkVersion: bumpedConfig.sdkVersion
-	});
+		profile,
+		envVars
+	}) : {
+		appMeta: yield* resolveAppMeta({
+			projectType,
+			platform,
+			projectRoot: userCwd,
+			profile
+		}),
+		runtimeVersion: void 0
+	};
 	if (options.clearCache) yield* clearBuildCaches(userCwd);
 	const tempDir = yield* acquireBuildTempDir;
 	const staging = yield* prepareStagingProject({
 		userCwd,
 		tempDir,
-		envVars
+		envVars,
+		projectType
 	});
-	yield* printHuman(`Building ${platform} artifact for profile "${profile.name}" (runtimeVersion=${runtimeVersion})`);
+	yield* printHuman(`Building ${platform} artifact for profile "${profile.name}"${runtimeVersion === void 0 ? "" : ` (runtimeVersion=${runtimeVersion})`}`);
 	const { build, target, bundleId } = yield* runPlatformBuild({
 		api,
 		options,
 		platform,
 		profile,
+		projectType,
 		appMeta,
 		envVars,
 		projectId,
@@ -23156,18 +23824,18 @@ const runBuildWorkflow = (options) => Effect.scoped(Effect.gen(function* () {
 		commit: rawGitContext.commit,
 		dirty: rawGitContext.dirty
 	});
-	const fingerprintHash = yield* runFingerprintForPlatform(userCwd, platform).pipe(Effect.map((entry) => entry.hash), Effect.catchAll(() => Effect.succeed(void 0)));
+	const fingerprintHash = isExpo ? yield* runFingerprintForPlatform(userCwd, platform).pipe(Effect.map((entry) => entry.hash), Effect.catchAll(() => Effect.succeed(void 0))) : void 0;
 	const result = yield* reserveAndUpload(api, {
 		target,
 		projectId,
 		profileName: profile.name,
-		runtimeVersion,
 		bundleId,
 		gitContext,
 		artifactPath: build.artifactPath,
 		sha256: build.sha256,
 		byteSize: build.byteSize,
 		...compact({
+			runtimeVersion,
 			appVersion: appMeta.appVersion,
 			buildNumber: appMeta.buildNumber,
 			message: options.message,
@@ -23180,7 +23848,7 @@ const runBuildWorkflow = (options) => Effect.scoped(Effect.gen(function* () {
 		["Status", result.status],
 		["Platform", platform],
 		["Profile", profile.name],
-		["Runtime version", runtimeVersion],
+		...runtimeVersion === void 0 ? [] : [["Runtime version", runtimeVersion]],
 		["Artifact", build.artifactPath],
 		["SHA-256", build.sha256],
 		["Bytes", String(build.byteSize)]
@@ -23225,7 +23893,7 @@ const DEFAULT_PROFILES = [
 	"preview",
 	"production"
 ];
-const writeEasJson$1 = (filePath, value) => Effect.gen(function* () {
+const writeEasJson = (filePath, value) => Effect.gen(function* () {
 	yield* (yield* FileSystem.FileSystem).writeFileString(filePath, `${JSON.stringify(value, null, 2)}\n`).pipe(Effect.mapError((cause) => new BuildProfileError({ message: `Failed to write eas.json: ${cause.message}` })));
 });
 const configureBuildCommand = defineCommand({
@@ -23243,7 +23911,7 @@ const configureBuildCommand = defineCommand({
 		const easJsonPath = path.join(projectRoot, "eas.json");
 		const fs = yield* FileSystem.FileSystem;
 		if (!(yield* fs.exists(easJsonPath))) {
-			yield* writeEasJson$1(easJsonPath, DEFAULT_EAS_JSON);
+			yield* writeEasJson(easJsonPath, DEFAULT_EAS_JSON);
 			yield* printHuman(`Wrote eas.json with default profiles to ${easJsonPath}.`);
 			yield* printHumanKeyValue([["Profiles", DEFAULT_PROFILES.join(", ")], ["Path", easJsonPath]]);
 			return {
@@ -23260,7 +23928,7 @@ const configureBuildCommand = defineCommand({
 					path: easJsonPath
 				};
 			}
-			yield* writeEasJson$1(easJsonPath, DEFAULT_EAS_JSON);
+			yield* writeEasJson(easJsonPath, DEFAULT_EAS_JSON);
 			yield* printHuman(`Overwrote eas.json with default profiles.`);
 			return {
 				action: "overwritten",
@@ -23288,7 +23956,7 @@ const configureBuildCommand = defineCommand({
 			};
 		}
 		const additions = Object.fromEntries(missing.map((name) => [name, DEFAULT_EAS_JSON.build[name]]));
-		yield* writeEasJson$1(easJsonPath, {
+		yield* writeEasJson(easJsonPath, {
 			build: {
 				...config.build,
 				...additions
@@ -23888,7 +24556,7 @@ const tryReadApkPackageWith = (bin, apkPath) => Effect.gen(function* () {
 	if (!(yield* which(bin).pipe(Effect.catchAll(() => Effect.succeed(null))))) return;
 	const raw = yield* execCapture(`${bin} dump`, bin, "dump", "badging", apkPath).pipe(Effect.catchAll(() => Effect.succeed(null)));
 	if (!raw) return;
-	return /package: name='([^']+)'/u.exec(raw)?.[1];
+	return /package: name='(?<packageName>[^']+)'/u.exec(raw)?.[1];
 });
 const readApkPackageName = (apkPath) => Effect.gen(function* () {
 	return yield* Effect.reduce(["aapt2", "aapt"], void 0, (acc, bin) => acc === void 0 ? tryReadApkPackageWith(bin, apkPath) : Effect.succeed(acc));
@@ -24101,7 +24769,7 @@ const runCommand$1 = defineCommand({
 //#region src/application/upload-workflow.ts
 const resolveIosTarget = (profile, appMeta) => Effect.gen(function* () {
 	if (!profile.ios) return yield* new BuildProfileError({ message: `Profile "${profile.name}" has no ios section.` });
-	if (!appMeta.bundleId) return yield* new BuildProfileError({ message: "Missing ios.bundleIdentifier in your Expo config." });
+	if (!appMeta.bundleId) return yield* new BuildProfileError({ message: "Missing iOS bundle identifier (set ios.bundleIdentifier or your Expo config)." });
 	return {
 		target: {
 			platform: "ios",
@@ -24113,7 +24781,7 @@ const resolveIosTarget = (profile, appMeta) => Effect.gen(function* () {
 });
 const resolveAndroidTarget = (profile, appMeta, projectRoot) => Effect.gen(function* () {
 	if (!profile.android) return yield* new BuildProfileError({ message: `Profile "${profile.name}" has no android section.` });
-	if (!appMeta.androidPackage) return yield* new BuildProfileError({ message: "Missing android.package in your Expo config." });
+	if (!appMeta.androidPackage) return yield* new BuildProfileError({ message: "Missing Android applicationId (set android.applicationId or your Expo config)." });
 	const gradleConfig = yield* readGradleConfig(`${projectRoot}/android`);
 	yield* warnOnGradleMismatch(gradleConfig, appMeta.androidPackage);
 	const bundleId = gradleConfig?.applicationId ?? appMeta.androidPackage;
@@ -24130,27 +24798,56 @@ const resolveAndroidTarget = (profile, appMeta, projectRoot) => Effect.gen(funct
 		bundleId
 	};
 });
+/** Resolve app metadata + OTA runtimeVersion for an upload (project-type aware). */
+const resolveUploadMeta = (params) => Effect.gen(function* () {
+	const { projectType, platform, projectRoot, profile, envVars } = params;
+	const expoConfig = projectType === "expo" ? yield* readExpoConfig(projectRoot, envVars) : void 0;
+	const appMeta = yield* resolveAppMeta({
+		projectType,
+		platform,
+		projectRoot,
+		profile,
+		...compact({
+			expoConfig,
+			expoAppMeta: expoConfig === void 0 ? void 0 : yield* readAppMeta(expoConfig, platform)
+		})
+	});
+	return {
+		appMeta,
+		runtimeVersion: expoConfig === void 0 ? void 0 : yield* resolveRuntimeVersion({
+			raw: appMeta.rawRuntimeVersion,
+			appVersion: appMeta.appVersion,
+			projectRoot,
+			platform,
+			buildNumber: appMeta.buildNumber,
+			sdkVersion: expoConfig.sdkVersion
+		}),
+		isExpo: expoConfig !== void 0
+	};
+});
 const runUploadWorkflow = (options) => Effect.gen(function* () {
 	const api = yield* apiClient;
 	const projectRoot = yield* (yield* CliRuntime).cwd;
 	if (!(yield* (yield* FileSystem.FileSystem).exists(options.artifactPath).pipe(Effect.orElseSucceed(() => false)))) yield* new ArtifactNotFoundError({ message: `Artifact not found at ${options.artifactPath}.` });
-	const projectId = yield* extractProjectId(yield* readExpoConfig(projectRoot));
+	const projectType = yield* detectProjectType({
+		projectRoot,
+		override: asProjectType((yield* readBetterUpdateConfig(projectRoot))?.["projectType"])
+	});
+	const projectId = yield* readProjectId;
 	const profile = yield* readBuildProfile(projectRoot, options.profileName);
-	const expoConfig = yield* readExpoConfig(projectRoot, {
+	const envVars = {
 		...yield* pullEnvVars(api, {
 			projectId,
 			environment: profile.environment
 		}),
 		...profile.env
-	});
-	const appMeta = yield* readAppMeta(expoConfig, options.platform);
-	const runtimeVersion = yield* resolveRuntimeVersion({
-		raw: appMeta.rawRuntimeVersion,
-		appVersion: appMeta.appVersion,
-		projectRoot,
+	};
+	const { appMeta, runtimeVersion, isExpo } = yield* resolveUploadMeta({
+		projectType,
 		platform: options.platform,
-		buildNumber: appMeta.buildNumber,
-		sdkVersion: expoConfig.sdkVersion
+		projectRoot,
+		profile,
+		envVars
 	});
 	const { target, bundleId } = options.platform === "ios" ? yield* resolveIosTarget(profile, appMeta) : yield* resolveAndroidTarget(profile, appMeta, projectRoot);
 	yield* printHuman(`Hashing ${options.artifactPath}...`);
@@ -24161,7 +24858,7 @@ const runUploadWorkflow = (options) => Effect.gen(function* () {
 		commit: rawGitContext.commit,
 		dirty: rawGitContext.dirty
 	});
-	const fingerprintHash = yield* runFingerprintForPlatform(projectRoot, options.platform).pipe(Effect.map((entry) => entry.hash), Effect.catchAll(() => Effect.succeed(void 0)));
+	const fingerprintHash = isExpo ? yield* runFingerprintForPlatform(projectRoot, options.platform).pipe(Effect.map((entry) => entry.hash), Effect.catchAll(() => Effect.succeed(void 0))) : void 0;
 	const result = yield* reserveAndUpload(api, compact({
 		target,
 		projectId,
@@ -24183,7 +24880,7 @@ const runUploadWorkflow = (options) => Effect.gen(function* () {
 		["Status", result.status],
 		["Platform", options.platform],
 		["Profile", profile.name],
-		["Runtime version", runtimeVersion],
+		...runtimeVersion === void 0 ? [] : [["Runtime version", runtimeVersion]],
 		["Artifact", options.artifactPath],
 		["SHA-256", sha256],
 		["Bytes", String(byteSize)]
@@ -24792,7 +25489,7 @@ const parseGoogleServiceAccountKey = (jsonText) => Effect.gen(function* () {
 const APPLE_TEAM_ID_RE = /^[A-Z0-9]{10}$/u;
 const extractTeamId = (params) => {
 	if (params.orgUnit && APPLE_TEAM_ID_RE.test(params.orgUnit)) return params.orgUnit;
-	return /\(([A-Z0-9]{10})\)\s*$/u.exec(params.signingIdentity)?.[1];
+	return /\((?<team>[A-Z0-9]{10})\)\s*$/u.exec(params.signingIdentity)?.[1];
 };
 /**
 * Parse a PKCS#12 (.p12) buffer and extract certificate metadata.
@@ -26102,13 +26799,11 @@ const currentRecipients = (api) => Effect.gen(function* () {
 //#endregion
 //#region src/commands/credentials/vault-session.ts
 /**
-* Unlock the vault key, prompting for the device passphrase only when the active
-* identity is the on-disk file — the CI `BETTER_UPDATE_IDENTITY` env key is raw
-* and needs none.
+* Unlock the vault key for an interactive command: reuse the OS-keychain-cached
+* key when live, prompt for the device passphrase only on a cache miss, and none
+* at all for the CI `BETTER_UPDATE_IDENTITY` env key.
 */
-const unlockVaultInteractively = (api) => Effect.gen(function* () {
-	return yield* unlockVaultKey(api, yield* resolveVaultPassphrase);
-});
+const unlockVaultInteractively = (api) => unlockVaultKeyInteractive(api);
 /** Resolve a recipient selector (key id or fingerprint) from a flag, prompting if absent. */
 const resolveSelector = (flag, message) => Effect.gen(function* () {
 	if (flag && flag.trim().length > 0) return flag.trim();
@@ -27740,6 +28435,56 @@ const revokeCommand = defineCommand({
 	subCommands: { "distribution-certificate": distributionCertificateCommand }
 });
 
+//#endregion
+//#region src/commands/credentials/session.ts
+/** Whole minutes left, rounded up so "<1 min remaining" still reads as 1. */
+const remainingMinutes = (remainingMs) => Math.max(1, Math.ceil(remainingMs / 6e4));
+const unlockCommand = defineCommand({
+	meta: {
+		name: "unlock",
+		description: "Unlock the credential vault and cache the key in your OS keychain, so later commands don't re-prompt"
+	},
+	run: async () => runEffect(Effect.gen(function* () {
+		const recipient = yield* activeRecipient;
+		if (recipient.source !== "file") {
+			yield* printHuman("Active identity is the BETTER_UPDATE_IDENTITY (CI) key — it has no passphrase and isn't cached.");
+			return;
+		}
+		const api = yield* apiClient;
+		const cache = yield* VaultCache;
+		yield* cache.clear(recipient.publicKey);
+		yield* unlockVaultKeyInteractive(api);
+		const cached = yield* cache.get(recipient.publicKey);
+		yield* printHuman(`Vault unlocked${cached === void 0 ? " (no OS keychain available — commands will keep prompting)" : ` for ~${remainingMinutes(cached.remainingMs)} min; run \`better-update credentials lock\` to clear it`}.`);
+	}))
+});
+const lockCommand = defineCommand({
+	meta: {
+		name: "lock",
+		description: "Forget the cached vault key — the next credential command will prompt again"
+	},
+	run: async () => runEffect(Effect.gen(function* () {
+		const recipient = yield* activeRecipient;
+		yield* (yield* VaultCache).clear(recipient.publicKey);
+		yield* printHuman("Vault locked — the cached key was cleared from your OS keychain.");
+	}))
+});
+const statusCommand$1 = defineCommand({
+	meta: {
+		name: "status",
+		description: "Show whether the vault is currently unlocked (cached) and for how much longer"
+	},
+	run: async () => runEffect(Effect.gen(function* () {
+		const recipient = yield* activeRecipient;
+		if (recipient.source !== "file") {
+			yield* printHuman("Active identity is the BETTER_UPDATE_IDENTITY (CI) key — caching not used.");
+			return;
+		}
+		const cached = yield* (yield* VaultCache).get(recipient.publicKey);
+		yield* printHuman(cached === void 0 ? "Locked — the next credential command will prompt for your passphrase." : `Unlocked — cached vault key expires in ~${remainingMinutes(cached.remainingMs)} min.`);
+	}))
+});
+
 //#endregion
 //#region src/commands/credentials/sync/helpers.ts
 const SYNC_EXIT_EXTRAS = {
@@ -28599,6 +29344,9 @@ const credentialsCommand = defineCommand({
 		identity: identityCommand,
 		access: accessCommand,
 		device: deviceCommand,
+		unlock: unlockCommand,
+		lock: lockCommand,
+		status: statusCommand$1,
 		list: listCommand$3,
 		view: viewCommand$1,
 		download: downloadCommand,
@@ -28626,7 +29374,7 @@ const DEVICE_CLASS_VALUES = [
 const isDeviceClass = (value) => DEVICE_CLASS_VALUES.includes(value);
 const ttlHours = (value) => {
 	if (value === void 0) return;
-	const match = /^([0-9]+)([hd])?$/u.exec(value);
+	const match = /^(?<value>[0-9]+)(?<unit>[hd])?$/u.exec(value);
 	if (!match?.[1]) return;
 	const num = Number.parseInt(match[1], 10);
 	return match[2] === "d" ? num * 24 : num;
@@ -29036,11 +29784,18 @@ const checkProjectLink = Effect.gen(function* () {
 	const source = (yield* readLinkedProjectId(root)) === void 0 ? "Expo config" : "better-update.json";
 	return pass("project-linked", "Project linked", `projectId=${resolved.right} (via ${source})`);
 });
-const checkEasJson = Effect.gen(function* () {
-	const result = yield* readEasJson(yield* (yield* CliRuntime).cwd).pipe(Effect.either);
-	if (result._tag === "Left") return warn("eas-json", "eas.json", result.left.message);
-	const count = Object.keys(result.right.build ?? {}).length;
-	return pass("eas-json", "eas.json", `${count} profile(s) defined`);
+const checkProjectType = Effect.gen(function* () {
+	const root = yield* (yield* CliRuntime).cwd;
+	const override = asProjectType((yield* readBetterUpdateConfig(root))?.["projectType"]);
+	return pass("project-type", "Project type", `${yield* detectProjectType({
+		projectRoot: root,
+		override
+	})} (${override === void 0 ? "auto-detected" : "better-update.json override"})`);
+});
+const checkBuildConfig = Effect.gen(function* () {
+	const names = yield* listBuildProfileNames(yield* (yield* CliRuntime).cwd);
+	if (names.length === 0) return warn("build-config", "Build config", "No build profiles found. Add a \"build\" section to better-update.json.");
+	return pass("build-config", "Build config", `${names.length} profile(s) defined`);
 });
 const runChecks = Effect.gen(function* () {
 	const xcode = (yield* CliRuntime).platform === "darwin" ? [yield* checkCommand("xcode", "Xcode CLI tools", "xcode-select", ["-p"])] : [];
@@ -29051,7 +29806,8 @@ const runChecks = Effect.gen(function* () {
 		yield* checkServerHealth,
 		yield* checkAuth,
 		yield* checkProjectLink,
-		yield* checkEasJson
+		yield* checkProjectType,
+		yield* checkBuildConfig
 	];
 });
 const statusIcon = (status) => {
@@ -29110,7 +29866,7 @@ const parseSingleEnvironmentArg = (raw) => Effect.gen(function* () {
 	return raw;
 });
 const formatEnvironments = (environments) => [...environments].toSorted((left, right) => left.localeCompare(right)).join(",");
-const DOTENV_LINE = /^\s*(?:export\s+)?([A-Z][A-Z0-9_]*)\s*=\s*(.*?)\s*$/u;
+const DOTENV_LINE = /^\s*(?:export\s+)?(?<key>[A-Z][A-Z0-9_]*)\s*=\s*(?<value>.*?)\s*$/u;
 const stripQuotes = (raw) => {
 	if (raw.length < 2) return raw;
 	const [first] = raw;
@@ -30219,49 +30975,40 @@ const logoutCommand = defineCommand({
 
 //#endregion
 //#region src/commands/migrate-config.ts
-const readAppJson = (projectRoot) => {
-	const path$1 = path.join(projectRoot, "app.json");
-	if (!existsSync(path$1)) return null;
-	const raw = readFileSync(path$1, "utf8");
-	return JSON.parse(raw);
-};
-const writeAppJson = (projectRoot, content) => {
-	writeFileSync(path.join(projectRoot, "app.json"), `${JSON.stringify(content, null, 2)}\n`);
-};
-const writeEasJson = (projectRoot, profiles) => {
-	writeFileSync(path.join(projectRoot, "eas.json"), `${JSON.stringify({ build: profiles }, null, 2)}\n`);
-};
 const migrateConfigCommand = defineCommand({
 	meta: {
 		name: "migrate-config",
-		description: "Migrate legacy `extra.betterUpdate.profiles` (in app.json) to a sibling `eas.json` file"
+		description: "Migrate `build`/`submit` profiles from a legacy eas.json into better-update.json"
 	},
 	args: { yes: {
 		type: "boolean",
 		description: "Skip the confirmation prompt"
 	} },
 	run: async ({ args }) => runEffect(Effect.gen(function* () {
-		const root = yield* (yield* CliRuntime).cwd;
-		const appJson = readAppJson(root);
-		if (!appJson) return yield* new InvalidArgumentError({ message: `No app.json found at ${root}.` });
-		const profiles = appJson.expo?.extra?.betterUpdate?.profiles;
-		if (profiles === void 0) {
-			yield* printHuman("No legacy `extra.betterUpdate.profiles` found in app.json — nothing to migrate.");
+		const runtime = yield* CliRuntime;
+		const fs = yield* FileSystem.FileSystem;
+		const root = yield* runtime.cwd;
+		const easPath = path.join(root, "eas.json");
+		if (!(yield* fs.exists(easPath).pipe(Effect.orElseSucceed(() => false)))) return yield* new InvalidArgumentError({ message: `No eas.json found at ${root}.` });
+		const config = yield* readEasJson(root);
+		const patch = compact({
+			build: config.build,
+			submit: config.submit,
+			cli: config.cli
+		});
+		if (Object.keys(patch).length === 0) {
+			yield* printHuman("eas.json has no build/submit/cli sections — nothing to migrate.");
 			return;
 		}
-		if (existsSync(path.join(root, "eas.json"))) return yield* new InvalidArgumentError({ message: "eas.json already exists. Manual review required — refusing to overwrite. Remove eas.json first if you want to regenerate." });
-		if (!args.yes) {
-			if (!(yield* promptConfirm(`Move profiles to eas.json and strip from app.json?`, { initialValue: true }))) {
+		const existingBuild = (yield* readBetterUpdateConfig(root))?.["build"];
+		if (typeof existingBuild === "object" && existingBuild !== null && config.build !== void 0 && !args.yes) {
+			if (!(yield* promptConfirm("better-update.json already has a build section — overwrite it from eas.json?", { initialValue: false }))) {
 				yield* printHuman("Cancelled.");
 				return;
 			}
 		}
-		writeEasJson(root, profiles);
-		const clone = structuredClone(appJson);
-		const betterUpdate = (clone.expo?.extra)?.betterUpdate;
-		if (betterUpdate) delete betterUpdate["profiles"];
-		writeAppJson(root, clone);
-		yield* printHuman("Migrated profiles into eas.json. Legacy field removed from app.json.");
+		yield* writeBetterUpdateConfig(root, patch);
+		yield* printHuman("Merged eas.json build/submit into better-update.json. You can now delete eas.json.");
 	}))
 });
 
@@ -30706,7 +31453,7 @@ const submitCommand = defineCommand({
 		}
 		const projectId = yield* readProjectId;
 		const api = yield* apiClient;
-		const easProfile = yield* resolveEasSubmitProfile((yield* readEasJson(process.cwd())).submit, args.profile);
+		const easProfile = yield* readSubmitProfile(yield* (yield* CliRuntime).cwd, args.profile);
 		const archive = yield* resolveArchive(api, projectId, platform, {
 			id: args.id,
 			path: args.path,