@better-update/cli 0.33.2 → 0.34.0

package/dist/index.mjs

@@ -34,7 +34,7 @@ var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 //#endregion
 //#region package.json
-var version = "0.33.2";
+var version = "0.34.0";
 
 //#endregion
 //#region src/lib/interactive-mode.ts
@@ -355,7 +355,15 @@ var OrgVault = class extends Schema.Class("OrgVault")({
 	organizationId: Id,
 	vaultVersion: VaultVersion,
 	createdAt: DateTimeString,
-	updatedAt: DateTimeString
+	updatedAt: DateTimeString,
+	/**
+	* A recipient was dropped out-of-band (member removed/downgraded); the live key
+	* is considered compromised and must be rotated. While true, credential-download
+	* paths fail closed (409). `rotate` clears it.
+	*/
+	rotationPending: Schema.Boolean,
+	rotationPendingSince: Schema.NullOr(DateTimeString),
+	rotationPendingReason: Schema.NullOr(Schema.String)
 }) {};
 /**
 * One wrap of the org vault key to a recipient's public key — an `age` blob the
@@ -1045,7 +1053,7 @@ const projectIdParam$5 = HttpApiSchema.param("projectId", Schema.String);
 var BuildCredentialsGroup = class extends HttpApiGroup.make("buildCredentials").add(HttpApiEndpoint.post("resolve")`/api/projects/${projectIdParam$5}/build-credentials/resolve`.setPayload(ResolveBuildCredentialsBody).addSuccess(ResolveBuildCredentialsResult).annotateContext(OpenApi.annotations({
 	title: "Resolve build credentials",
 	description: "Return decrypted signing assets for a project build. Regenerates the iOS provisioning profile via Apple ASC when the registered device roster has changed since the profile was last generated."
-}))).addError(NotFound).addError(BadRequest).addError(Forbidden).annotateContext(OpenApi.annotations({
+}))).addError(NotFound).addError(BadRequest).addError(Forbidden).addError(Conflict).annotateContext(OpenApi.annotations({
 	title: "Build Credentials",
 	description: "Materialize signing assets needed by a CLI build run"
 })) {};
@@ -22279,12 +22287,14 @@ const exportDecryptedEnvVars = (api, projectId, environment) => Effect.gen(funct
 });
 /**
 * Pull + decrypt environment variables flattened into a key/value map for
-* injection into a build/subprocess.
+* injection into a build/subprocess. Reports which variables were loaded (names
+* only — values stay secret) so users can see what the server contributed.
 */
 const pullEnvVars = (api, { projectId, environment }) => Effect.gen(function* () {
 	const validated = coerceEnvironment(environment);
 	if (!validated) return yield* new EnvExportError({ message: `Invalid environment "${environment}": must be lowercase letters, digits, and hyphens, starting with a letter.` });
 	const items = yield* exportDecryptedEnvVars(api, projectId, validated);
+	yield* printHuman(items.length === 0 ? `No environment variables found for the "${validated}" environment.` : `Environment variables loaded from the "${validated}" environment: ${items.map((item) => item.key).join(", ")}`);
 	return Object.fromEntries(items.map((item) => [item.key, item.value]));
 });
 /**
@@ -22552,13 +22562,14 @@ const inferPlatforms = (config) => {
 };
 /**
 * Resolve a build platform from an explicit flag, or fall back to the Expo
-* config (`expo.platforms` or the presence of `ios`/`android` sections). Prompts
-* when the config declares both platforms; fails when ambiguous and prompts are
-* disallowed.
+* config (`expo.platforms` or the presence of `ios`/`android` sections). The
+* config is loaded lazily so an explicit `--platform` skips evaluating
+* `app.config.js`/`.ts` entirely. Prompts when the config declares both
+* platforms; fails when ambiguous and prompts are disallowed.
 */
-const detectPlatform = (explicit, config) => Effect.gen(function* () {
+const detectPlatform = (explicit, loadConfig) => Effect.gen(function* () {
 	if (explicit !== void 0) return explicit;
-	const candidates = inferPlatforms(config);
+	const candidates = inferPlatforms(yield* loadConfig);
 	if (candidates.length === 0) return yield* new BuildProfileError({ message: "Cannot infer build platform. Add an `ios` or `android` section to your Expo config, or pass --platform." });
 	if (candidates.length === 1) {
 		const [only] = candidates;
@@ -23680,11 +23691,6 @@ const runBuildWorkflow = (options) => Effect.scoped(Effect.gen(function* () {
 	const projectId = yield* readProjectId;
 	const profile = yield* readBuildProfile(userCwd, yield* resolveProfileName(userCwd, options.profileName));
 	if (profile.developmentClient === true) yield* warnIfDevClientMissing(userCwd);
-	const platform = isExpo ? yield* detectPlatform(options.platform, yield* readExpoConfig(userCwd)) : yield* detectPlatformGeneric(options.platform, {
-		profile,
-		hasAndroidDir: yield* dirExists(userCwd, "android"),
-		hasIosDir: yield* dirExists(userCwd, "ios")
-	});
 	const envVars = {
 		...yield* pullEnvVars(api, {
 			projectId,
@@ -23692,6 +23698,11 @@ const runBuildWorkflow = (options) => Effect.scoped(Effect.gen(function* () {
 		}),
 		...profile.env
 	};
+	const platform = isExpo ? yield* detectPlatform(options.platform, readExpoConfig(userCwd, envVars)) : yield* detectPlatformGeneric(options.platform, {
+		profile,
+		hasAndroidDir: yield* dirExists(userCwd, "android"),
+		hasIosDir: yield* dirExists(userCwd, "ios")
+	});
 	const { appMeta, runtimeVersion } = isExpo ? yield* resolveExpoBuildMeta({
 		userCwd,
 		platform,
@@ -26842,9 +26853,14 @@ const listCommand$6 = defineCommand({
 	},
 	run: async () => runEffect(Effect.gen(function* () {
 		const api = yield* apiClient;
-		const [{ recipients, vaultVersion }, { items }] = yield* Effect.all([api.orgVault.listWraps(), api.userEncryptionKeys.list()]);
+		const [{ recipients, vaultVersion }, { items }, vault] = yield* Effect.all([
+			api.orgVault.listWraps(),
+			api.userEncryptionKeys.list(),
+			api.orgVault.get()
+		]);
 		const byId = new Map(items.map((key) => [key.id, key]));
 		yield* printHuman(`Vault version ${vaultVersion}`);
+		if (vault.rotationPending) yield* printHuman(`⚠ Rotation pending — a recipient was removed (${vault.rotationPendingReason ?? "vault access revoked"}). Credential downloads are blocked until you run \`credentials access rotate\`.`);
 		yield* printHumanList([
 			"Key ID",
 			"Kind",
@@ -26861,6 +26877,7 @@ const listCommand$6 = defineCommand({
 		}), "No recipients hold the vault key yet.");
 		return {
 			vaultVersion,
+			rotationPending: vault.rotationPending,
 			recipients: recipients.map((recipient) => toRecipientView(recipient.userEncryptionKeyId, byId.get(recipient.userEncryptionKeyId)))
 		};
 	}), { json: "value" })