@better-update/cli 0.33.2 → 0.35.0

package/dist/index.mjs

@@ -3,7 +3,7 @@ import { createRequire } from "node:module";
 import { execFile, spawn, spawnSync } from "node:child_process";
 import { defineCommand, runMain } from "citty";
 import { Clock, Console, Context, Data, Deferred, Duration, Effect, Either, Layer, Match, Option, ParseResult, Schedule, Schema } from "effect";
-import { Command, FetchHttpClient, FileSystem, Headers as Headers$1, HttpApi, HttpApiClient, HttpApiEndpoint, HttpApiGroup, HttpApiMiddleware, HttpApiSchema, HttpApiSecurity, HttpClient, HttpClientRequest, OpenApi, Path } from "@effect/platform";
+import { Command, FetchHttpClient, FileSystem, Headers as Headers$1, HttpApi, HttpApiClient, HttpApiEndpoint, HttpApiGroup, HttpApiMiddleware, HttpApiSchema, HttpApiSecurity, HttpClient, HttpClientRequest, OpenApi } from "@effect/platform";
 import { NodeContext } from "@effect/platform-node";
 import path from "node:path";
 import process$1 from "node:process";
@@ -17,10 +17,11 @@ import { once } from "node:events";
 import { createServer } from "node:http";
 import { maxBy, uniqBy } from "es-toolkit";
 import forge from "node-forge";
+import { AndroidConfig } from "@expo/config-plugins";
+import plist from "@expo/plist";
 import { spawn as spawn$1 } from "node-pty";
 import chalk from "chalk";
 import os, { tmpdir } from "node:os";
-import plistMod from "@expo/plist";
 import { ExpoRunFormatter } from "@expo/xcpretty";
 import { promisify } from "node:util";
 import ignore from "ignore";
@@ -34,7 +35,7 @@ var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 //#endregion
 //#region package.json
-var version = "0.33.2";
+var version = "0.35.0";
 
 //#endregion
 //#region src/lib/interactive-mode.ts
@@ -355,7 +356,15 @@ var OrgVault = class extends Schema.Class("OrgVault")({
 	organizationId: Id,
 	vaultVersion: VaultVersion,
 	createdAt: DateTimeString,
-	updatedAt: DateTimeString
+	updatedAt: DateTimeString,
+	/**
+	* A recipient was dropped out-of-band (member removed/downgraded); the live key
+	* is considered compromised and must be rotated. While true, credential-download
+	* paths fail closed (409). `rotate` clears it.
+	*/
+	rotationPending: Schema.Boolean,
+	rotationPendingSince: Schema.NullOr(DateTimeString),
+	rotationPendingReason: Schema.NullOr(Schema.String)
 }) {};
 /**
 * One wrap of the org vault key to a recipient's public key — an `age` blob the
@@ -1045,7 +1054,7 @@ const projectIdParam$5 = HttpApiSchema.param("projectId", Schema.String);
 var BuildCredentialsGroup = class extends HttpApiGroup.make("buildCredentials").add(HttpApiEndpoint.post("resolve")`/api/projects/${projectIdParam$5}/build-credentials/resolve`.setPayload(ResolveBuildCredentialsBody).addSuccess(ResolveBuildCredentialsResult).annotateContext(OpenApi.annotations({
 	title: "Resolve build credentials",
 	description: "Return decrypted signing assets for a project build. Regenerates the iOS provisioning profile via Apple ASC when the registered device roster has changed since the profile was last generated."
-}))).addError(NotFound).addError(BadRequest).addError(Forbidden).annotateContext(OpenApi.annotations({
+}))).addError(NotFound).addError(BadRequest).addError(Forbidden).addError(Conflict).annotateContext(OpenApi.annotations({
 	title: "Build Credentials",
 	description: "Materialize signing assets needed by a CLI build run"
 })) {};
@@ -3463,8 +3472,11 @@ const UpdateAssetUploaderLive = Layer.effect(UpdateAssetUploader, Effect.gen(fun
 * private key — so the blast radius of a leaked keychain entry is one vault
 * version's credentials, and only until the TTL lapses.
 */
-/** How long a cached vault key stays valid before a fresh passphrase is required. */
+/** Default for how long a cached vault key stays valid before a fresh passphrase is required. */
 const VAULT_CACHE_TTL_MS = 900 * 1e3;
+/** Bounds for a user-chosen TTL (`credentials unlock --duration`). */
+const VAULT_CACHE_TTL_MIN_MS = 60 * 1e3;
+const VAULT_CACHE_TTL_MAX_MS = 1440 * 60 * 1e3;
 /** Keychain service name; the account is the recipient's public key. */
 const KEYCHAIN_SERVICE = "better-update-vault";
 const isCachedVaultEntry = (value) => isRecord$1(value) && typeof value["vaultKey"] === "string" && typeof value["vaultVersion"] === "number" && typeof value["keyId"] === "string" && typeof value["exp"] === "number";
@@ -3516,9 +3528,9 @@ const VaultCacheLive = Layer.effect(VaultCache, Effect.gen(function* () {
 			}
 			return decoded;
 		}),
-		set: (publicKey, vault) => Effect.gen(function* () {
+		set: (publicKey, vault, ttlMs) => Effect.gen(function* () {
 			if (yield* cacheDisabled) return;
-			yield* writeRaw(publicKey, encodeCacheEntry(vault, yield* Clock.currentTimeMillis));
+			yield* writeRaw(publicKey, encodeCacheEntry(vault, yield* Clock.currentTimeMillis, ttlMs));
 		}),
 		clear: (publicKey) => deleteRaw(publicKey)
 	};
@@ -4122,53 +4134,401 @@ const printHumanList = (headers, rows, emptyMessage) => Effect.gen(function* ()
 });
 
 //#endregion
-//#region src/lib/better-update-config.ts
+//#region src/lib/eas-profile-extends.ts
+const asStringValue = (value) => typeof value === "string" ? value : void 0;
+const asBooleanValue = (value) => typeof value === "boolean" ? value : void 0;
+const asNumberValue = (raw) => typeof raw === "number" && Number.isFinite(raw) ? raw : void 0;
+const shallowMerge = (base, overlay) => {
+	if (!base) return overlay;
+	if (!overlay) return base;
+	return {
+		...base,
+		...overlay
+	};
+};
+const stripExtends = (profile) => {
+	if (profile.extends === void 0) return profile;
+	const { extends: _omit, ...rest } = profile;
+	return rest;
+};
+const resolveExtendsChain = (params) => Effect.gen(function* () {
+	const { profiles, profileName, label, maxDepth, makeError } = params;
+	const sourceLabel = params.sourceLabel ?? "eas.json";
+	const noun = label === "build" ? "Build" : "Submit";
+	const chain = [];
+	const visited = /* @__PURE__ */ new Set();
+	let current = profileName;
+	let depth = 0;
+	while (current !== void 0) {
+		if (visited.has(current)) return yield* Effect.fail(makeError(`Cycle detected in ${sourceLabel} ${label}.${profileName} extends chain at "${current}".`));
+		visited.add(current);
+		const profile = profiles[current];
+		if (!profile) return yield* Effect.fail(makeError(current === profileName ? `${noun} profile "${profileName}" not found in ${sourceLabel}.` : `${noun} profile "${profileName}" extends missing profile "${current}".`));
+		chain.unshift(profile);
+		current = profile.extends;
+		depth += 1;
+		if (depth > maxDepth) return yield* Effect.fail(makeError(`Too many "extends" levels (max ${String(maxDepth)}) in ${sourceLabel} ${label}.${profileName}.`));
+	}
+	return chain;
+});
+
+//#endregion
+//#region src/lib/eas-submit-config.ts
+const MAX_SUBMIT_EXTENDS_DEPTH = 10;
+const asStringArray = (raw) => {
+	if (!Array.isArray(raw)) return;
+	const items = raw.filter((item) => typeof item === "string");
+	return items.length === 0 ? void 0 : items;
+};
+const asAndroidReleaseStatus = (raw) => {
+	const value = asStringValue(raw);
+	return value === "completed" || value === "draft" || value === "halted" || value === "inProgress" ? value : void 0;
+};
+const parseIosSubmitProfile = (raw) => {
+	const record = asRecord(raw);
+	if (!record) return;
+	return compact({
+		appleId: asStringValue(record["appleId"]),
+		ascAppId: asStringValue(record["ascAppId"]),
+		appleTeamId: asStringValue(record["appleTeamId"]),
+		ascApiKeyPath: asStringValue(record["ascApiKeyPath"]),
+		ascApiKeyId: asStringValue(record["ascApiKeyId"]),
+		ascApiKeyIssuerId: asStringValue(record["ascApiKeyIssuerId"]),
+		sku: asStringValue(record["sku"]),
+		language: asStringValue(record["language"]),
+		companyName: asStringValue(record["companyName"]),
+		appName: asStringValue(record["appName"]),
+		bundleIdentifier: asStringValue(record["bundleIdentifier"]),
+		metadataPath: asStringValue(record["metadataPath"]),
+		groups: asStringArray(record["groups"])
+	});
+};
+const parseAndroidSubmitProfile = (raw) => {
+	const record = asRecord(raw);
+	if (!record) return;
+	return compact({
+		serviceAccountKeyPath: asStringValue(record["serviceAccountKeyPath"]),
+		serviceAccountKeyId: asStringValue(record["serviceAccountKeyId"]),
+		track: asStringValue(record["track"]),
+		releaseStatus: asAndroidReleaseStatus(record["releaseStatus"]),
+		changesNotSentForReview: asBooleanValue(record["changesNotSentForReview"]),
+		rollout: asNumberValue(record["rollout"]),
+		applicationId: asStringValue(record["applicationId"])
+	});
+};
+const parseSubmitProfile = (raw) => {
+	const record = asRecord(raw);
+	if (!record) return;
+	return compact({
+		extends: asStringValue(record["extends"]),
+		ios: parseIosSubmitProfile(record["ios"]),
+		android: parseAndroidSubmitProfile(record["android"])
+	});
+};
+const mergeSubmitProfile = (base, overlay) => {
+	const ios = shallowMerge(base.ios, overlay.ios);
+	const android = shallowMerge(base.android, overlay.android);
+	return compact({
+		extends: overlay.extends,
+		ios,
+		android
+	});
+};
+const resolveEasSubmitProfile = (profiles, profileName, sourceLabel = "eas.json") => Effect.gen(function* () {
+	if (!profiles) return yield* new BuildProfileError({ message: `${sourceLabel} has no "submit" section. Add at least one submit profile.` });
+	return stripExtends((yield* resolveExtendsChain({
+		profiles,
+		profileName,
+		label: "submit",
+		maxDepth: MAX_SUBMIT_EXTENDS_DEPTH,
+		sourceLabel,
+		makeError: (message) => new BuildProfileError({ message })
+	})).reduce((acc, next, index) => index === 0 ? next : mergeSubmitProfile(acc, next), {}));
+});
+
+//#endregion
+//#region src/lib/eas-config.ts
+const MAX_EXTENDS_DEPTH = 10;
+const asEnv = (value) => {
+	const record = asRecord(value);
+	if (!record) return;
+	const env = {};
+	for (const [key, raw] of Object.entries(record)) if (typeof raw === "string") env[key] = raw;
+	return Object.keys(env).length === 0 ? void 0 : env;
+};
+const asIosDistribution = (raw) => {
+	const value = asStringValue(raw);
+	if (value === "app-store" || value === "ad-hoc" || value === "development" || value === "enterprise") return value;
+};
+const asEnterpriseProvisioning = (raw) => {
+	const value = asStringValue(raw);
+	return value === "adhoc" || value === "universal" ? value : void 0;
+};
+const asAndroidBuildType = (raw) => {
+	const value = asStringValue(raw);
+	return value === "debug" || value === "release" ? value : void 0;
+};
+const asAndroidFormat = (raw) => {
+	const value = asStringValue(raw);
+	return value === "apk" || value === "aab" ? value : void 0;
+};
+const asAndroidDistribution = (raw) => {
+	const value = asStringValue(raw);
+	return value === "play-store" || value === "direct" ? value : void 0;
+};
+const asIosAutoIncrement = (raw) => {
+	if (typeof raw === "boolean") return raw;
+	const value = asStringValue(raw);
+	return value === "buildNumber" || value === "version" ? value : void 0;
+};
+const asAndroidAutoIncrement = (raw) => {
+	if (typeof raw === "boolean") return raw;
+	const value = asStringValue(raw);
+	return value === "versionCode" || value === "version" ? value : void 0;
+};
+const asAutoIncrement = (raw) => {
+	if (typeof raw === "boolean") return raw;
+	const value = asStringValue(raw);
+	return value === "buildNumber" || value === "versionCode" || value === "version" ? value : void 0;
+};
+const asEasDistribution = (raw) => {
+	const value = asStringValue(raw);
+	return value === "internal" || value === "store" ? value : void 0;
+};
+const asCredentialsSource = (raw) => {
+	const value = asStringValue(raw);
+	return value === "remote" || value === "local" ? value : void 0;
+};
+const parseIosProfile = (raw) => {
+	const record = asRecord(raw);
+	if (!record) return;
+	return compact({
+		distribution: asIosDistribution(record["distribution"]),
+		buildConfiguration: asStringValue(record["buildConfiguration"]),
+		scheme: asStringValue(record["scheme"]),
+		simulator: asBooleanValue(record["simulator"]),
+		enterpriseProvisioning: asEnterpriseProvisioning(record["enterpriseProvisioning"]),
+		autoIncrement: asIosAutoIncrement(record["autoIncrement"]),
+		workspace: asStringValue(record["workspace"]),
+		project: asStringValue(record["project"]),
+		podInstall: asBooleanValue(record["podInstall"]),
+		bundleIdentifier: asStringValue(record["bundleIdentifier"]),
+		version: asStringValue(record["version"]),
+		buildNumber: asStringValue(record["buildNumber"])
+	});
+};
+const parseAndroidProfile = (raw) => {
+	const record = asRecord(raw);
+	if (!record) return;
+	return compact({
+		buildType: asAndroidBuildType(record["buildType"]),
+		flavor: asStringValue(record["flavor"]),
+		gradleCommand: asStringValue(record["gradleCommand"]),
+		format: asAndroidFormat(record["format"]),
+		distribution: asAndroidDistribution(record["distribution"]),
+		autoIncrement: asAndroidAutoIncrement(record["autoIncrement"]),
+		module: asStringValue(record["module"]),
+		gradleTask: asStringValue(record["gradleTask"]),
+		applicationId: asStringValue(record["applicationId"]),
+		version: asStringValue(record["version"]),
+		versionCode: asStringValue(record["versionCode"])
+	});
+};
+const parseCustomCommandSpec = (raw) => {
+	const record = asRecord(raw);
+	if (!record) return;
+	const command = asStringValue(record["command"]);
+	if (command === void 0) return;
+	return compact({
+		command,
+		cwd: asStringValue(record["cwd"]),
+		env: asEnv(record["env"]),
+		artifactPath: asStringValue(record["artifactPath"])
+	});
+};
+const parseCustomCommandProfile = (raw) => {
+	const record = asRecord(raw);
+	if (!record) return;
+	const result = compact({
+		ios: parseCustomCommandSpec(record["ios"]),
+		android: parseCustomCommandSpec(record["android"])
+	});
+	return Object.keys(result).length === 0 ? void 0 : result;
+};
+const parseBuildProfile = (raw) => {
+	const record = asRecord(raw);
+	if (!record) return;
+	return compact({
+		extends: asStringValue(record["extends"]),
+		developmentClient: asBooleanValue(record["developmentClient"]),
+		distribution: asEasDistribution(record["distribution"]),
+		channel: asStringValue(record["channel"]),
+		environment: asStringValue(record["environment"]),
+		env: asEnv(record["env"]),
+		ios: parseIosProfile(record["ios"]),
+		android: parseAndroidProfile(record["android"]),
+		credentialsSource: asCredentialsSource(record["credentialsSource"]),
+		autoIncrement: asAutoIncrement(record["autoIncrement"]),
+		withoutCredentials: asBooleanValue(record["withoutCredentials"]),
+		custom: parseCustomCommandProfile(record["custom"])
+	});
+};
+/**
+* Parse an already-decoded JSON object into an {@link EasConfig}. Shared by the
+* `eas.json` reader and any legacy build-config reader — both hold
+* the same `build`/`submit`/`cli` shape, only the source file differs.
+*/
+const parseConfigFromRecord = (root) => {
+	const buildRecord = asRecord(root["build"]);
+	if (!buildRecord) return asRecord(root["cli"]) ? { cli: parseCli(root["cli"]) } : {};
+	const profiles = {};
+	for (const [name, value] of Object.entries(buildRecord)) {
+		const profile = parseBuildProfile(value);
+		if (profile) profiles[name] = profile;
+	}
+	const submitRecord = asRecord(root["submit"]);
+	const submit = {};
+	if (submitRecord) for (const [name, value] of Object.entries(submitRecord)) {
+		const profile = parseSubmitProfile(value);
+		if (profile !== void 0) submit[name] = profile;
+	}
+	return {
+		...asRecord(root["cli"]) ? { cli: parseCli(root["cli"]) } : {},
+		build: profiles,
+		...Object.keys(submit).length === 0 ? {} : { submit }
+	};
+};
+const parseEasConfig = (text) => Effect.gen(function* () {
+	const root = asRecord(yield* Effect.try({
+		try: () => JSON.parse(text),
+		catch: (cause) => new BuildProfileError({ message: `eas.json is not valid JSON: ${formatCause(cause)}` })
+	}));
+	if (!root) return yield* new BuildProfileError({ message: "eas.json must be a JSON object at the top level." });
+	return parseConfigFromRecord(root);
+});
+const parseCli = (raw) => {
+	const record = asRecord(raw);
+	if (!record) return {};
+	return compact({ version: asStringValue(record["version"]) });
+};
+const easJsonPath = (projectRoot) => path.join(projectRoot, "eas.json");
+const readEasJson = (projectRoot) => Effect.gen(function* () {
+	const fs = yield* FileSystem.FileSystem;
+	const filePath = easJsonPath(projectRoot);
+	return yield* parseEasConfig(yield* fs.readFileString(filePath).pipe(Effect.mapError((cause) => new BuildProfileError({ message: cause._tag === "SystemError" && cause.reason === "NotFound" ? `No eas.json found at ${filePath}. Create one with a "build" section.` : `Failed to read eas.json: ${cause.message}` }))));
+});
+const mergeCustom = (base, overlay) => {
+	const merged = shallowMerge(base, overlay);
+	return merged === void 0 || Object.keys(merged).length === 0 ? void 0 : merged;
+};
+const mergeProfile = (base, overlay) => {
+	const ios = shallowMerge(base.ios, overlay.ios);
+	const android = shallowMerge(base.android, overlay.android);
+	const env = shallowMerge(base.env, overlay.env);
+	const custom = mergeCustom(base.custom, overlay.custom);
+	const developmentClient = overlay.developmentClient ?? base.developmentClient;
+	const distribution = overlay.distribution ?? base.distribution;
+	const channel = overlay.channel ?? base.channel;
+	const environment = overlay.environment ?? base.environment;
+	const credentialsSource = overlay.credentialsSource ?? base.credentialsSource;
+	const autoIncrement = overlay.autoIncrement ?? base.autoIncrement;
+	const withoutCredentials = overlay.withoutCredentials ?? base.withoutCredentials;
+	return compact({
+		extends: overlay.extends,
+		developmentClient,
+		distribution,
+		channel,
+		environment,
+		env,
+		ios,
+		android,
+		credentialsSource,
+		autoIncrement,
+		withoutCredentials,
+		custom
+	});
+};
+const resolveEasBuildProfile = (config, profileName, sourceLabel = "eas.json") => Effect.gen(function* () {
+	const profiles = config.build;
+	if (!profiles) return yield* new BuildProfileError({ message: `${sourceLabel} has no "build" section. Add at least one profile.` });
+	return stripExtends((yield* resolveExtendsChain({
+		profiles,
+		profileName,
+		label: "build",
+		maxDepth: MAX_EXTENDS_DEPTH,
+		sourceLabel,
+		makeError: (message) => new BuildProfileError({ message })
+	})).reduce((acc, next, index) => index === 0 ? next : mergeProfile(acc, next), {}));
+});
+
+//#endregion
+//#region src/lib/eas-json.ts
+/**
+* `eas.json` is better-update's single project config file — for every build
+* system, not just Expo. Besides the EAS-shaped `cli`/`build`/`submit`
+* sections it carries two CLI-owned top-level extension keys:
+*
+* - `projectId`   — the better-update project link (non-Expo projects; Expo
+*                   projects may keep it in app.json `extra.betterUpdate`).
+* - `projectType` — build-system override ("expo" | "bare" | "kmp" | "native"
+*                   | "custom") for projects auto-detection gets wrong.
+*
+* Helpers here read/write the file as a raw record so unknown keys (and the
+* extension keys) survive round-trips untouched.
+*/
 /**
 * Environment variable that overrides project-id resolution. Highest precedence
 * so CI and ephemeral checkouts can target a project without writing any file.
 */
 const BETTER_UPDATE_PROJECT_ID_ENV = "BETTER_UPDATE_PROJECT_ID";
 /**
-* Build-system-neutral project link file. Lives at the project root and lets a
-* non-Expo project (KMP, Flutter, native, …) carry a better-update project id
-* without an `app.json` / `@expo/config`.
-*/
-const BETTER_UPDATE_CONFIG_FILENAME = "better-update.json";
-const configPath = (projectRoot) => path.join(projectRoot, BETTER_UPDATE_CONFIG_FILENAME);
-/**
-* Read the project-local `better-update.json` if present. Returns `undefined`
-* when the file is missing or holds invalid JSON — an unlinked project is a
-* normal state, not an error. Mirrors {@link file://./../services/config-store.ts}'s
-* graceful `readConfig`.
+* Read `eas.json` as a raw record if present. Returns `undefined` when the
+* file is missing or holds invalid JSON — an unlinked project is a normal
+* state, not an error (profile readers surface parse errors separately).
 */
-const readBetterUpdateConfig = (projectRoot) => Effect.gen(function* () {
-	const content = yield* (yield* FileSystem.FileSystem).readFileString(configPath(projectRoot)).pipe(Effect.orElseSucceed(() => ""));
+const readEasJsonRaw = (projectRoot) => Effect.gen(function* () {
+	const content = yield* (yield* FileSystem.FileSystem).readFileString(easJsonPath(projectRoot)).pipe(Effect.orElseSucceed(() => ""));
 	if (content.length === 0) return;
 	return yield* Effect.try(() => JSON.parse(content)).pipe(Effect.map((parsed) => isRecord$1(parsed) ? parsed : void 0), Effect.orElseSucceed(() => void 0));
 });
 /**
-* Resolve the linked project id from `better-update.json`, or `undefined` when
-* the file is absent / has no usable `projectId`.
-*/
-const readLinkedProjectId = (projectRoot) => readBetterUpdateConfig(projectRoot).pipe(Effect.map((config) => {
-	const id = config?.["projectId"];
-	return typeof id === "string" && id.length > 0 ? id : void 0;
-}));
-/**
-* Merge `patch` into the existing `better-update.json` (creating it if absent)
-* and write it back, returning the absolute file path. Used by `init` to persist
-* a project link for build-system-neutral projects.
+* Merge `patch` into the existing `eas.json` (creating it if absent) and write
+* it back, returning the absolute file path. Shallow merge: patched keys win,
+* all other keys are preserved verbatim.
 */
-const writeBetterUpdateConfig = (projectRoot, patch) => Effect.gen(function* () {
+const writeEasJsonPatch = (projectRoot, patch) => Effect.gen(function* () {
 	const fs = yield* FileSystem.FileSystem;
-	const filePath = configPath(projectRoot);
+	const filePath = easJsonPath(projectRoot);
 	const merged = {
-		...yield* readBetterUpdateConfig(projectRoot),
+		...yield* readEasJsonRaw(projectRoot),
 		...patch
 	};
-	yield* fs.writeFileString(filePath, `${JSON.stringify(merged, null, 2)}\n`).pipe(Effect.mapError((cause) => new ProjectNotLinkedError({ message: `Failed to write ${BETTER_UPDATE_CONFIG_FILENAME}: ${formatCause(cause)}` })));
+	yield* fs.writeFileString(filePath, `${JSON.stringify(merged, null, 2)}\n`).pipe(Effect.mapError((cause) => new ProjectNotLinkedError({ message: `Failed to write eas.json: ${formatCause(cause)}` })));
 	return filePath;
 });
+/**
+* Resolve the linked project id from `eas.json`'s top-level `projectId`, or
+* `undefined` when the file is absent / has no usable value.
+*/
+const readEasLinkedProjectId = (projectRoot) => readEasJsonRaw(projectRoot).pipe(Effect.map((config) => {
+	const id = config?.["projectId"];
+	return typeof id === "string" && id.length > 0 ? id : void 0;
+}));
+/**
+* Raw `projectType` override from `eas.json`, for `detectProjectType`.
+* Callers narrow it via `asProjectType`.
+*/
+const readEasProjectType = (projectRoot) => readEasJsonRaw(projectRoot).pipe(Effect.map((config) => config?.["projectType"]));
+/** List available build-profile names; `[]` when no eas.json exists. */
+const listBuildProfileNames = (projectRoot) => Effect.gen(function* () {
+	if (!(yield* (yield* FileSystem.FileSystem).exists(easJsonPath(projectRoot)).pipe(Effect.orElseSucceed(() => false)))) return [];
+	const config = yield* readEasJson(projectRoot);
+	return Object.keys(config.build ?? {});
+});
+/** Resolve a submit profile from `eas.json`'s `submit` section. */
+const readSubmitProfile = (projectRoot, profileName) => Effect.gen(function* () {
+	return yield* resolveEasSubmitProfile((yield* readEasJson(projectRoot)).submit, profileName, "eas.json");
+});
 
 //#endregion
 //#region ../../node_modules/.bun/structured-headers@2.0.2/node_modules/structured-headers/dist/util.js
@@ -4333,10 +4693,10 @@ const isExpoConfigInstalled = () => {
 };
 /**
 * Build-system-neutral "project not linked" guidance, listing every supported
-* project-id source (env override, better-update.json, Expo config) so the
+* project-id source (env override, eas.json, Expo config) so the
 * message is correct for Expo and non-Expo projects alike.
 */
-const PROJECT_NOT_LINKED_MESSAGE = `Project not linked. Run \`better-update init\` to link this project, set the ${BETTER_UPDATE_PROJECT_ID_ENV} environment variable, add a "projectId" to better-update.json, or set extra.betterUpdate.projectId in your Expo config.`;
+const PROJECT_NOT_LINKED_MESSAGE = `Project not linked. Run \`better-update init\` to link this project, set the ${BETTER_UPDATE_PROJECT_ID_ENV} environment variable, add a top-level "projectId" to eas.json, or set extra.betterUpdate.projectId in your Expo config.`;
 const clearDynamicConfigCache = (projectRoot) => {
 	const { dynamicConfigPath } = loadExpoConfigModule().getConfigFilePaths(projectRoot);
 	if (dynamicConfigPath) delete __require.cache[dynamicConfigPath];
@@ -4545,19 +4905,19 @@ const readAppMeta = (config, platform) => Effect.gen(function* () {
 /**
 * Resolve the active better-update project id, build-system-agnostically.
 *
-* Precedence: `BETTER_UPDATE_PROJECT_ID` env > `better-update.json` >
-* `@expo/config` (`extra.betterUpdate.projectId`). The Expo branch is taken only
-* when `@expo/config` is installed, so a non-Expo project (no app.json, Expo not
-* installed) never crashes at module load — it simply falls through to the
-* `ProjectNotLinkedError`. Every `env`/`credentials`/`status` command reaches the
-* vault through this single resolver.
+* Precedence: `BETTER_UPDATE_PROJECT_ID` env > `eas.json` top-level `projectId`
+* > `@expo/config` (`extra.betterUpdate.projectId`). The Expo branch is taken
+* only when `@expo/config` is installed, so a non-Expo project (no app.json,
+* Expo not installed) never crashes at module load — it simply falls through to
+* the `ProjectNotLinkedError`. Every `env`/`credentials`/`status` command
+* reaches the vault through this single resolver.
 */
 const readProjectId = Effect.gen(function* () {
 	const runtime = yield* CliRuntime;
 	const fromEnv = yield* runtime.getEnv(BETTER_UPDATE_PROJECT_ID_ENV);
 	if (fromEnv !== void 0 && fromEnv.length > 0) return fromEnv;
 	const projectRoot = yield* runtime.cwd;
-	const fromConfig = yield* readLinkedProjectId(projectRoot);
+	const fromConfig = yield* readEasLinkedProjectId(projectRoot);
 	if (fromConfig !== void 0) return fromConfig;
 	if (isExpoConfigInstalled()) {
 		const fromExpo = yield* readExpoConfig(projectRoot).pipe(Effect.flatMap(extractProjectId), Effect.option);
@@ -4569,7 +4929,7 @@ const readProjectId = Effect.gen(function* () {
 * Read the Expo config without failing: `Option.some(config)` when an Expo
 * project is present and loads, otherwise `Option.none()` (no `@expo/config`
 * installed, no config file, or a config that errors). Lets `init` decide
-* whether to write the link into the Expo config vs `better-update.json`.
+* whether to write the link into the Expo config vs `eas.json`.
 */
 const readExpoConfigOptional = (projectRoot) => Effect.suspend(() => {
 	if (!isExpoConfigInstalled()) return Effect.succeed(Option.none());
@@ -18204,15 +18564,18 @@ const grantRecipient = (args) => Effect.gen(function* () {
 * operation: download/build-resolve reads, seal-for-upload + generate writes, and
 * rotation. There is no read-only cache: an unlock makes the next write seamless
 * too.
+*
+* `cacheTtlMs` overrides how long the unlocked key stays cached (default 15 min)
+* — `credentials unlock --duration` is the one caller that sets it.
 */
-const unlockVaultKeyInteractive = (api) => Effect.gen(function* () {
+const unlockVaultKeyInteractive = (api, options) => Effect.gen(function* () {
 	const recipient = yield* activeRecipient;
 	if (recipient.source !== "file") return yield* unlockVaultKey(api, void 0);
 	const cache = yield* VaultCache;
 	const cached = yield* cache.get(recipient.publicKey);
 	if (cached !== void 0) return cached.vault;
 	const vault = yield* unlockVaultKey(api, yield* promptPassword("Passphrase to unlock this device's identity:"));
-	yield* cache.set(recipient.publicKey, vault);
+	yield* cache.set(recipient.publicKey, vault, options?.cacheTtlMs);
 	return vault;
 }).pipe(Effect.provide(VaultCacheLive));
 /**
@@ -19641,6 +20004,106 @@ const loadLocalAndroidCredentials = (options) => Effect.gen(function* () {
 	};
 });
 
+//#endregion
+//#region src/lib/update-channel-native.ts
+/**
+* EAS parity: after `expo prebuild`, bake the build profile's `channel` into
+* the generated native projects as the `expo-channel-name` request header —
+* exactly what EAS Build does (`androidSetChannelNativelyAsync` /
+* `iosSetChannelNativelyAsync` in eas-build). Writing the native files instead
+* of app.json works for dynamic configs (`app.config.ts`) too, which
+* `modifyConfigAsync` cannot patch.
+*/
+/** AndroidManifest meta-data key expo-updates reads extra request headers from. */
+const ANDROID_REQUEST_HEADERS_META_KEY = "expo.modules.updates.UPDATES_CONFIGURATION_REQUEST_HEADERS_KEY";
+/** Expo.plist key holding the same request-header map on iOS. */
+const IOS_REQUEST_HEADERS_PLIST_KEY = "EXUpdatesRequestHeaders";
+/** Request header expo-updates sends to select the OTA channel. */
+const EXPO_CHANNEL_HEADER = "expo-channel-name";
+const asStringRecord = (value) => {
+	if (!isRecord$1(value)) return {};
+	const out = {};
+	for (const [key, raw] of Object.entries(value)) if (typeof raw === "string") out[key] = raw;
+	return out;
+};
+/** Merge the channel header into an existing request-header map (channel wins). */
+const withChannelHeader = (existing, channel) => ({
+	...asStringRecord(existing),
+	[EXPO_CHANNEL_HEADER]: channel
+});
+/**
+* Whether the app declares `expo-updates` as a (dev)dependency. Channel
+* injection only makes sense when the updates module ships in the binary —
+* mirrors eas-build's `isExpoUpdatesInstalledAsync` gate.
+*/
+const isExpoUpdatesInstalled = (projectRoot) => Effect.gen(function* () {
+	const parsed = safeJsonParse(yield* (yield* FileSystem.FileSystem).readFileString(path.join(projectRoot, "package.json")).pipe(Effect.orElseSucceed(() => "")));
+	if (!isRecord$1(parsed)) return false;
+	const dependencies = isRecord$1(parsed["dependencies"]) ? parsed["dependencies"] : {};
+	const devDependencies = isRecord$1(parsed["devDependencies"]) ? parsed["devDependencies"] : {};
+	return "expo-updates" in dependencies || "expo-updates" in devDependencies;
+});
+/**
+* Write the channel into the prebuilt `android/` project: merge it into the
+* request-headers JSON carried by the manifest meta-data entry (creating the
+* entry when prebuild emitted none).
+*/
+const setAndroidUpdateChannel = (params) => Effect.tryPromise({
+	try: async () => {
+		const manifestPath = await AndroidConfig.Paths.getAndroidManifestAsync(params.projectRoot);
+		const manifest = await AndroidConfig.Manifest.readAndroidManifestAsync(manifestPath);
+		const mainApplication = AndroidConfig.Manifest.getMainApplicationOrThrow(manifest);
+		const existing = AndroidConfig.Manifest.getMainApplicationMetaDataValue(manifest, ANDROID_REQUEST_HEADERS_META_KEY);
+		const headers = withChannelHeader(existing === null ? void 0 : safeJsonParse(existing), params.channel);
+		AndroidConfig.Manifest.addMetaDataItemToMainApplication(mainApplication, ANDROID_REQUEST_HEADERS_META_KEY, JSON.stringify(headers));
+		await AndroidConfig.Manifest.writeAndroidManifestAsync(manifestPath, manifest);
+	},
+	catch: (cause) => new BuildFailedError({
+		step: "set android update channel",
+		exitCode: 1,
+		message: `Failed to write the update channel into AndroidManifest.xml: ${formatCause(cause)}`
+	})
+});
+/** Locate `ios/<target>/Supporting/Expo.plist` in a prebuilt iOS project. */
+const findExpoPlist = (iosDir) => Effect.gen(function* () {
+	const fs = yield* FileSystem.FileSystem;
+	const entries = yield* fs.readDirectory(iosDir).pipe(Effect.orElseSucceed(() => []));
+	for (const entry of entries) {
+		const candidate = path.join(iosDir, entry, "Supporting", "Expo.plist");
+		if (yield* fs.exists(candidate).pipe(Effect.orElseSucceed(() => false))) return candidate;
+	}
+	return yield* new BuildFailedError({
+		step: "set ios update channel",
+		exitCode: 1,
+		message: `No Supporting/Expo.plist found under ${iosDir} after prebuild — is "expo-updates" installed?`
+	});
+});
+/**
+* Write the channel into the prebuilt `ios/` project: merge it into the
+* `EXUpdatesRequestHeaders` dict of the generated Expo.plist.
+*/
+const setIosUpdateChannel = (params) => Effect.gen(function* () {
+	const fs = yield* FileSystem.FileSystem;
+	const plistPath = yield* findExpoPlist(params.iosDir);
+	const failure = (cause) => new BuildFailedError({
+		step: "set ios update channel",
+		exitCode: 1,
+		message: `Failed to write the update channel into ${plistPath}: ${formatCause(cause)}`
+	});
+	const content = yield* fs.readFileString(plistPath).pipe(Effect.mapError(failure));
+	const parsed = yield* Effect.try({
+		try: () => plist.parse(content),
+		catch: failure
+	});
+	if (!isRecord$1(parsed)) return yield* failure("Expo.plist is not a plist dictionary.");
+	const next = {
+		...parsed,
+		[IOS_REQUEST_HEADERS_PLIST_KEY]: withChannelHeader(parsed[IOS_REQUEST_HEADERS_PLIST_KEY], params.channel)
+	};
+	const rendered = plist.build(next);
+	yield* fs.writeFileString(plistPath, `${rendered}\n`).pipe(Effect.mapError(failure));
+});
+
 //#endregion
 //#region src/lib/pty-runner.ts
 const ptyDimensions = () => {
@@ -19921,7 +20384,7 @@ const runAndroidCustom = (input, commandEnv) => Effect.gen(function* () {
 	if (custom.artifactPath === void 0) return yield* new BuildFailedError({
 		step: "custom android build",
 		exitCode: 1,
-		message: "Custom Android build requires \"artifactPath\" (e.g. \"**/*.aab\") in better-update.json."
+		message: "Custom Android build requires \"artifactPath\" (e.g. \"**/*.aab\") in eas.json."
 	});
 	const credentials = yield* resolveAndroidCredentials(input);
 	const credEnv = credentials === void 0 ? {} : {
@@ -19955,18 +20418,24 @@ const runAndroidCustom = (input, commandEnv) => Effect.gen(function* () {
 });
 const runAndroidBuild = (input) => Effect.gen(function* () {
 	const commandEnv = yield* (yield* CliRuntime).commandEnvironment(input.envVars);
-	if (input.strategy === "expo") yield* runStep({
-		command: "bunx",
-		args: [
-			"expo",
-			"prebuild",
-			"--platform",
-			"android",
-			"--clean"
-		],
-		cwd: input.projectRoot,
-		env: commandEnv
-	}, "expo prebuild android");
+	if (input.strategy === "expo") {
+		yield* runStep({
+			command: "bunx",
+			args: [
+				"expo",
+				"prebuild",
+				"--platform",
+				"android",
+				"--clean"
+			],
+			cwd: input.projectRoot,
+			env: commandEnv
+		}, "expo prebuild android");
+		if (input.updateChannel !== void 0) yield* setAndroidUpdateChannel({
+			projectRoot: input.projectRoot,
+			channel: input.updateChannel
+		});
+	}
 	return input.strategy === "custom" ? yield* runAndroidCustom(input, commandEnv) : yield* runGradleBuild(input, commandEnv);
 });
 
@@ -20846,12 +21315,12 @@ const acquireKeychain = ({ tempDir, p12Path, p12Password }) => {
 
 //#endregion
 //#region src/lib/plist.ts
-const plist = typeof plistMod.parse === "function" ? plistMod : plistMod.default;
+const plist$1 = typeof plist.parse === "function" ? plist : plist.default;
 /**
 * Parse an XML plist string into a typed object.
 * Throws on malformed XML — callers should wrap in Effect.try.
 */
-const parsePlistXml = (xml) => plist.parse(xml);
+const parsePlistXml = (xml) => plist$1.parse(xml);
 /**
 * Parse a binary plist buffer into a typed object.
 * Uses bplist-parser for Apple's binary plist format.
@@ -21149,7 +21618,7 @@ const resolveXcodeContainer = (projectRoot, iosDir, iosProfile) => Effect.gen(fu
 	return yield* new BuildFailedError({
 		step: "resolve Xcode container",
 		exitCode: 1,
-		message: `No .xcworkspace or .xcodeproj found under ${iosDir}. Set ios.workspace / ios.project in better-update.json.`
+		message: `No .xcworkspace or .xcodeproj found under ${iosDir}. Set ios.workspace / ios.project in eas.json.`
 	});
 });
 /**
@@ -21171,6 +21640,10 @@ const prepareIosNative = (params) => Effect.gen(function* () {
 			cwd: params.projectRoot,
 			env: params.commandEnv
 		}, "expo prebuild ios");
+		if (params.updateChannel !== void 0) yield* setIosUpdateChannel({
+			iosDir: params.iosDir,
+			channel: params.updateChannel
+		});
 		yield* runStep({
 			command: "pod",
 			args: ["install"],
@@ -21220,7 +21693,8 @@ const runIosSimulatorBuild = (input) => Effect.gen(function* () {
 		projectRoot,
 		iosDir,
 		iosProfile,
-		commandEnv
+		commandEnv,
+		updateChannel: input.updateChannel
 	});
 	const container = yield* resolveXcodeContainer(projectRoot, iosDir, iosProfile);
 	const scheme = iosProfile.scheme ?? container.schemeBase;
@@ -21323,7 +21797,8 @@ const runIosDeviceBuild = (input) => Effect.gen(function* () {
 		projectRoot,
 		iosDir,
 		iosProfile,
-		commandEnv
+		commandEnv,
+		updateChannel: input.updateChannel
 	});
 	const container = yield* resolveXcodeContainer(projectRoot, iosDir, iosProfile);
 	const scheme = iosProfile.scheme ?? container.schemeBase;
@@ -21455,7 +21930,7 @@ const runIosCustom = (input) => Effect.gen(function* () {
 	if (custom.artifactPath === void 0) return yield* new BuildFailedError({
 		step: "custom ios build",
 		exitCode: 1,
-		message: "Custom iOS build requires \"artifactPath\" (e.g. \"build/*.ipa\") in better-update.json."
+		message: "Custom iOS build requires \"artifactPath\" (e.g. \"build/*.ipa\") in eas.json."
 	});
 	const credentials = yield* fetchAllCredentials({
 		api: input.api,
@@ -21644,354 +22119,6 @@ const applyAutoIncrement = (input) => Effect.gen(function* () {
 	return bumps;
 });
 
-//#endregion
-//#region src/lib/eas-profile-extends.ts
-const asStringValue = (value) => typeof value === "string" ? value : void 0;
-const asBooleanValue = (value) => typeof value === "boolean" ? value : void 0;
-const asNumberValue = (raw) => typeof raw === "number" && Number.isFinite(raw) ? raw : void 0;
-const shallowMerge = (base, overlay) => {
-	if (!base) return overlay;
-	if (!overlay) return base;
-	return {
-		...base,
-		...overlay
-	};
-};
-const stripExtends = (profile) => {
-	if (profile.extends === void 0) return profile;
-	const { extends: _omit, ...rest } = profile;
-	return rest;
-};
-const resolveExtendsChain = (params) => Effect.gen(function* () {
-	const { profiles, profileName, label, maxDepth, makeError } = params;
-	const sourceLabel = params.sourceLabel ?? "eas.json";
-	const noun = label === "build" ? "Build" : "Submit";
-	const chain = [];
-	const visited = /* @__PURE__ */ new Set();
-	let current = profileName;
-	let depth = 0;
-	while (current !== void 0) {
-		if (visited.has(current)) return yield* Effect.fail(makeError(`Cycle detected in ${sourceLabel} ${label}.${profileName} extends chain at "${current}".`));
-		visited.add(current);
-		const profile = profiles[current];
-		if (!profile) return yield* Effect.fail(makeError(current === profileName ? `${noun} profile "${profileName}" not found in ${sourceLabel}.` : `${noun} profile "${profileName}" extends missing profile "${current}".`));
-		chain.unshift(profile);
-		current = profile.extends;
-		depth += 1;
-		if (depth > maxDepth) return yield* Effect.fail(makeError(`Too many "extends" levels (max ${String(maxDepth)}) in ${sourceLabel} ${label}.${profileName}.`));
-	}
-	return chain;
-});
-
-//#endregion
-//#region src/lib/eas-submit-config.ts
-const MAX_SUBMIT_EXTENDS_DEPTH = 10;
-const asStringArray = (raw) => {
-	if (!Array.isArray(raw)) return;
-	const items = raw.filter((item) => typeof item === "string");
-	return items.length === 0 ? void 0 : items;
-};
-const asAndroidReleaseStatus = (raw) => {
-	const value = asStringValue(raw);
-	return value === "completed" || value === "draft" || value === "halted" || value === "inProgress" ? value : void 0;
-};
-const parseIosSubmitProfile = (raw) => {
-	const record = asRecord(raw);
-	if (!record) return;
-	return compact({
-		appleId: asStringValue(record["appleId"]),
-		ascAppId: asStringValue(record["ascAppId"]),
-		appleTeamId: asStringValue(record["appleTeamId"]),
-		ascApiKeyPath: asStringValue(record["ascApiKeyPath"]),
-		ascApiKeyId: asStringValue(record["ascApiKeyId"]),
-		ascApiKeyIssuerId: asStringValue(record["ascApiKeyIssuerId"]),
-		sku: asStringValue(record["sku"]),
-		language: asStringValue(record["language"]),
-		companyName: asStringValue(record["companyName"]),
-		appName: asStringValue(record["appName"]),
-		bundleIdentifier: asStringValue(record["bundleIdentifier"]),
-		metadataPath: asStringValue(record["metadataPath"]),
-		groups: asStringArray(record["groups"])
-	});
-};
-const parseAndroidSubmitProfile = (raw) => {
-	const record = asRecord(raw);
-	if (!record) return;
-	return compact({
-		serviceAccountKeyPath: asStringValue(record["serviceAccountKeyPath"]),
-		serviceAccountKeyId: asStringValue(record["serviceAccountKeyId"]),
-		track: asStringValue(record["track"]),
-		releaseStatus: asAndroidReleaseStatus(record["releaseStatus"]),
-		changesNotSentForReview: asBooleanValue(record["changesNotSentForReview"]),
-		rollout: asNumberValue(record["rollout"]),
-		applicationId: asStringValue(record["applicationId"])
-	});
-};
-const parseSubmitProfile = (raw) => {
-	const record = asRecord(raw);
-	if (!record) return;
-	return compact({
-		extends: asStringValue(record["extends"]),
-		ios: parseIosSubmitProfile(record["ios"]),
-		android: parseAndroidSubmitProfile(record["android"])
-	});
-};
-const mergeSubmitProfile = (base, overlay) => {
-	const ios = shallowMerge(base.ios, overlay.ios);
-	const android = shallowMerge(base.android, overlay.android);
-	return compact({
-		extends: overlay.extends,
-		ios,
-		android
-	});
-};
-const resolveEasSubmitProfile = (profiles, profileName, sourceLabel = "eas.json") => Effect.gen(function* () {
-	if (!profiles) return yield* new BuildProfileError({ message: `${sourceLabel} has no "submit" section. Add at least one submit profile.` });
-	return stripExtends((yield* resolveExtendsChain({
-		profiles,
-		profileName,
-		label: "submit",
-		maxDepth: MAX_SUBMIT_EXTENDS_DEPTH,
-		sourceLabel,
-		makeError: (message) => new BuildProfileError({ message })
-	})).reduce((acc, next, index) => index === 0 ? next : mergeSubmitProfile(acc, next), {}));
-});
-
-//#endregion
-//#region src/lib/eas-config.ts
-const MAX_EXTENDS_DEPTH = 10;
-const asEnv = (value) => {
-	const record = asRecord(value);
-	if (!record) return;
-	const env = {};
-	for (const [key, raw] of Object.entries(record)) if (typeof raw === "string") env[key] = raw;
-	return Object.keys(env).length === 0 ? void 0 : env;
-};
-const asIosDistribution = (raw) => {
-	const value = asStringValue(raw);
-	if (value === "app-store" || value === "ad-hoc" || value === "development" || value === "enterprise") return value;
-};
-const asEnterpriseProvisioning = (raw) => {
-	const value = asStringValue(raw);
-	return value === "adhoc" || value === "universal" ? value : void 0;
-};
-const asAndroidBuildType = (raw) => {
-	const value = asStringValue(raw);
-	return value === "debug" || value === "release" ? value : void 0;
-};
-const asAndroidFormat = (raw) => {
-	const value = asStringValue(raw);
-	return value === "apk" || value === "aab" ? value : void 0;
-};
-const asAndroidDistribution = (raw) => {
-	const value = asStringValue(raw);
-	return value === "play-store" || value === "direct" ? value : void 0;
-};
-const asIosAutoIncrement = (raw) => {
-	if (typeof raw === "boolean") return raw;
-	const value = asStringValue(raw);
-	return value === "buildNumber" || value === "version" ? value : void 0;
-};
-const asAndroidAutoIncrement = (raw) => {
-	if (typeof raw === "boolean") return raw;
-	const value = asStringValue(raw);
-	return value === "versionCode" || value === "version" ? value : void 0;
-};
-const asAutoIncrement = (raw) => {
-	if (typeof raw === "boolean") return raw;
-	const value = asStringValue(raw);
-	return value === "buildNumber" || value === "versionCode" || value === "version" ? value : void 0;
-};
-const asEasDistribution = (raw) => {
-	const value = asStringValue(raw);
-	return value === "internal" || value === "store" ? value : void 0;
-};
-const asCredentialsSource = (raw) => {
-	const value = asStringValue(raw);
-	return value === "remote" || value === "local" ? value : void 0;
-};
-const parseIosProfile = (raw) => {
-	const record = asRecord(raw);
-	if (!record) return;
-	return compact({
-		distribution: asIosDistribution(record["distribution"]),
-		buildConfiguration: asStringValue(record["buildConfiguration"]),
-		scheme: asStringValue(record["scheme"]),
-		simulator: asBooleanValue(record["simulator"]),
-		enterpriseProvisioning: asEnterpriseProvisioning(record["enterpriseProvisioning"]),
-		autoIncrement: asIosAutoIncrement(record["autoIncrement"]),
-		workspace: asStringValue(record["workspace"]),
-		project: asStringValue(record["project"]),
-		podInstall: asBooleanValue(record["podInstall"]),
-		bundleIdentifier: asStringValue(record["bundleIdentifier"]),
-		version: asStringValue(record["version"]),
-		buildNumber: asStringValue(record["buildNumber"])
-	});
-};
-const parseAndroidProfile = (raw) => {
-	const record = asRecord(raw);
-	if (!record) return;
-	return compact({
-		buildType: asAndroidBuildType(record["buildType"]),
-		flavor: asStringValue(record["flavor"]),
-		gradleCommand: asStringValue(record["gradleCommand"]),
-		format: asAndroidFormat(record["format"]),
-		distribution: asAndroidDistribution(record["distribution"]),
-		autoIncrement: asAndroidAutoIncrement(record["autoIncrement"]),
-		module: asStringValue(record["module"]),
-		gradleTask: asStringValue(record["gradleTask"]),
-		applicationId: asStringValue(record["applicationId"]),
-		version: asStringValue(record["version"]),
-		versionCode: asStringValue(record["versionCode"])
-	});
-};
-const parseCustomCommandSpec = (raw) => {
-	const record = asRecord(raw);
-	if (!record) return;
-	const command = asStringValue(record["command"]);
-	if (command === void 0) return;
-	return compact({
-		command,
-		cwd: asStringValue(record["cwd"]),
-		env: asEnv(record["env"]),
-		artifactPath: asStringValue(record["artifactPath"])
-	});
-};
-const parseCustomCommandProfile = (raw) => {
-	const record = asRecord(raw);
-	if (!record) return;
-	const result = compact({
-		ios: parseCustomCommandSpec(record["ios"]),
-		android: parseCustomCommandSpec(record["android"])
-	});
-	return Object.keys(result).length === 0 ? void 0 : result;
-};
-const parseBuildProfile = (raw) => {
-	const record = asRecord(raw);
-	if (!record) return;
-	return compact({
-		extends: asStringValue(record["extends"]),
-		developmentClient: asBooleanValue(record["developmentClient"]),
-		distribution: asEasDistribution(record["distribution"]),
-		channel: asStringValue(record["channel"]),
-		environment: asStringValue(record["environment"]),
-		env: asEnv(record["env"]),
-		ios: parseIosProfile(record["ios"]),
-		android: parseAndroidProfile(record["android"]),
-		credentialsSource: asCredentialsSource(record["credentialsSource"]),
-		autoIncrement: asAutoIncrement(record["autoIncrement"]),
-		withoutCredentials: asBooleanValue(record["withoutCredentials"]),
-		custom: parseCustomCommandProfile(record["custom"])
-	});
-};
-/**
-* Parse an already-decoded JSON object into an {@link EasConfig}. Shared by the
-* `eas.json` reader and the `better-update.json` build-config reader — both hold
-* the same `build`/`submit`/`cli` shape, only the source file differs.
-*/
-const parseConfigFromRecord = (root) => {
-	const buildRecord = asRecord(root["build"]);
-	if (!buildRecord) return asRecord(root["cli"]) ? { cli: parseCli(root["cli"]) } : {};
-	const profiles = {};
-	for (const [name, value] of Object.entries(buildRecord)) {
-		const profile = parseBuildProfile(value);
-		if (profile) profiles[name] = profile;
-	}
-	const submitRecord = asRecord(root["submit"]);
-	const submit = {};
-	if (submitRecord) for (const [name, value] of Object.entries(submitRecord)) {
-		const profile = parseSubmitProfile(value);
-		if (profile !== void 0) submit[name] = profile;
-	}
-	return {
-		...asRecord(root["cli"]) ? { cli: parseCli(root["cli"]) } : {},
-		build: profiles,
-		...Object.keys(submit).length === 0 ? {} : { submit }
-	};
-};
-const parseEasConfig = (text) => Effect.gen(function* () {
-	const root = asRecord(yield* Effect.try({
-		try: () => JSON.parse(text),
-		catch: (cause) => new BuildProfileError({ message: `eas.json is not valid JSON: ${formatCause(cause)}` })
-	}));
-	if (!root) return yield* new BuildProfileError({ message: "eas.json must be a JSON object at the top level." });
-	return parseConfigFromRecord(root);
-});
-const parseCli = (raw) => {
-	const record = asRecord(raw);
-	if (!record) return {};
-	return compact({ version: asStringValue(record["version"]) });
-};
-const easJsonPath = (projectRoot) => Effect.gen(function* () {
-	return (yield* Path.Path).join(projectRoot, "eas.json");
-});
-const readEasJson = (projectRoot) => Effect.gen(function* () {
-	const fs = yield* FileSystem.FileSystem;
-	const filePath = yield* easJsonPath(projectRoot);
-	return yield* parseEasConfig(yield* fs.readFileString(filePath).pipe(Effect.mapError((cause) => new BuildProfileError({ message: cause._tag === "SystemError" && cause.reason === "NotFound" ? `No eas.json found at ${filePath}. Create one with a "build" section.` : `Failed to read eas.json: ${cause.message}` }))));
-});
-const mergeCustom = (base, overlay) => {
-	const merged = shallowMerge(base, overlay);
-	return merged === void 0 || Object.keys(merged).length === 0 ? void 0 : merged;
-};
-const mergeProfile = (base, overlay) => {
-	const ios = shallowMerge(base.ios, overlay.ios);
-	const android = shallowMerge(base.android, overlay.android);
-	const env = shallowMerge(base.env, overlay.env);
-	const custom = mergeCustom(base.custom, overlay.custom);
-	const developmentClient = overlay.developmentClient ?? base.developmentClient;
-	const distribution = overlay.distribution ?? base.distribution;
-	const channel = overlay.channel ?? base.channel;
-	const environment = overlay.environment ?? base.environment;
-	const credentialsSource = overlay.credentialsSource ?? base.credentialsSource;
-	const autoIncrement = overlay.autoIncrement ?? base.autoIncrement;
-	const withoutCredentials = overlay.withoutCredentials ?? base.withoutCredentials;
-	return compact({
-		extends: overlay.extends,
-		developmentClient,
-		distribution,
-		channel,
-		environment,
-		env,
-		ios,
-		android,
-		credentialsSource,
-		autoIncrement,
-		withoutCredentials,
-		custom
-	});
-};
-const resolveEasBuildProfile = (config, profileName, sourceLabel = "eas.json") => Effect.gen(function* () {
-	const profiles = config.build;
-	if (!profiles) return yield* new BuildProfileError({ message: `${sourceLabel} has no "build" section. Add at least one profile.` });
-	return stripExtends((yield* resolveExtendsChain({
-		profiles,
-		profileName,
-		label: "build",
-		maxDepth: MAX_EXTENDS_DEPTH,
-		sourceLabel,
-		makeError: (message) => new BuildProfileError({ message })
-	})).reduce((acc, next, index) => index === 0 ? next : mergeProfile(acc, next), {}));
-});
-
-//#endregion
-//#region src/lib/better-update-build-config.ts
-/** Label used in profile-resolution error copy when config comes from this file. */
-const BETTER_UPDATE_SOURCE_LABEL = "better-update.json";
-/**
-* Read the `build`/`submit`/`cli` config from `better-update.json`. Returns an
-* empty config (no `build` key) when the file is absent or carries no build
-* section. Shares the parser with {@link file://./eas-config.ts}; only the
-* source file and the error `sourceLabel` differ.
-*/
-const readBuildConfig = (projectRoot) => readBetterUpdateConfig(projectRoot).pipe(Effect.map((config) => config === void 0 ? {} : parseConfigFromRecord(config)));
-/** List available build-profile names declared in `better-update.json`. */
-const listBuildProfileNames = (projectRoot) => readBuildConfig(projectRoot).pipe(Effect.map((config) => Object.keys(config.build ?? {})));
-/** Resolve a submit profile from `better-update.json`'s `submit` section. */
-const readSubmitProfile = (projectRoot, profileName) => Effect.gen(function* () {
-	return yield* resolveEasSubmitProfile((yield* readBuildConfig(projectRoot)).submit, profileName, BETTER_UPDATE_SOURCE_LABEL);
-});
-
 //#endregion
 //#region src/lib/build-profile.ts
 const deriveIosDistribution = (eas) => {
@@ -22097,9 +22224,9 @@ const fromGenericProfile = (eas, profileName) => {
 		customCommand: eas.custom
 	});
 };
-/** Resolve a build profile from `better-update.json`'s `build` section. */
+/** Resolve a build profile from `eas.json`'s `build` section (all build systems). */
 const readBuildProfile = (projectRoot, profileName) => Effect.gen(function* () {
-	return fromGenericProfile(yield* resolveEasBuildProfile(yield* readBuildConfig(projectRoot), profileName, "better-update.json"), profileName);
+	return fromGenericProfile(yield* resolveEasBuildProfile(yield* readEasJson(projectRoot), profileName, "eas.json"), profileName);
 });
 const readRuntimeVersionMeta = (config, platform) => ({
 	platform,
@@ -22156,7 +22283,7 @@ const PROJECT_TYPES = [
 	"native",
 	"custom"
 ];
-/** Narrow an arbitrary `projectType` override (e.g. from better-update.json) to a valid value. */
+/** Narrow an arbitrary `projectType` override (e.g. from eas.json) to a valid value. */
 const asProjectType = (raw) => PROJECT_TYPES.find((type) => type === raw);
 const exists = (filePath) => Effect.gen(function* () {
 	return yield* (yield* FileSystem.FileSystem).exists(filePath).pipe(Effect.orElseSucceed(() => false));
@@ -22279,12 +22406,14 @@ const exportDecryptedEnvVars = (api, projectId, environment) => Effect.gen(funct
 });
 /**
 * Pull + decrypt environment variables flattened into a key/value map for
-* injection into a build/subprocess.
+* injection into a build/subprocess. Reports which variables were loaded (names
+* only — values stay secret) so users can see what the server contributed.
 */
 const pullEnvVars = (api, { projectId, environment }) => Effect.gen(function* () {
 	const validated = coerceEnvironment(environment);
 	if (!validated) return yield* new EnvExportError({ message: `Invalid environment "${environment}": must be lowercase letters, digits, and hyphens, starting with a letter.` });
 	const items = yield* exportDecryptedEnvVars(api, projectId, validated);
+	yield* printHuman(items.length === 0 ? `No environment variables found for the "${validated}" environment.` : `Environment variables loaded from the "${validated}" environment: ${items.map((item) => item.key).join(", ")}`);
 	return Object.fromEntries(items.map((item) => [item.key, item.value]));
 });
 /**
@@ -22552,13 +22681,14 @@ const inferPlatforms = (config) => {
 };
 /**
 * Resolve a build platform from an explicit flag, or fall back to the Expo
-* config (`expo.platforms` or the presence of `ios`/`android` sections). Prompts
-* when the config declares both platforms; fails when ambiguous and prompts are
-* disallowed.
+* config (`expo.platforms` or the presence of `ios`/`android` sections). The
+* config is loaded lazily so an explicit `--platform` skips evaluating
+* `app.config.js`/`.ts` entirely. Prompts when the config declares both
+* platforms; fails when ambiguous and prompts are disallowed.
 */
-const detectPlatform = (explicit, config) => Effect.gen(function* () {
+const detectPlatform = (explicit, loadConfig) => Effect.gen(function* () {
 	if (explicit !== void 0) return explicit;
-	const candidates = inferPlatforms(config);
+	const candidates = inferPlatforms(yield* loadConfig);
 	if (candidates.length === 0) return yield* new BuildProfileError({ message: "Cannot infer build platform. Add an `ios` or `android` section to your Expo config, or pass --platform." });
 	if (candidates.length === 1) {
 		const [only] = candidates;
@@ -22584,7 +22714,7 @@ const detectPlatformGeneric = (explicit, context) => Effect.gen(function* () {
 	const wantsAndroid = context.profile.android !== void 0 || context.profile.customCommand?.android !== void 0;
 	if (wantsIos && (context.hasIosDir || context.profile.customCommand?.ios !== void 0)) candidates.push("ios");
 	if (wantsAndroid && (context.hasAndroidDir || context.profile.customCommand?.android !== void 0)) candidates.push("android");
-	if (candidates.length === 0) return yield* new BuildProfileError({ message: "Cannot infer build platform. Add an `ios` or `android` section to the build profile in better-update.json, or pass --platform." });
+	if (candidates.length === 0) return yield* new BuildProfileError({ message: "Cannot infer build platform. Add an `ios` or `android` section to the build profile in eas.json, or pass --platform." });
 	const [only] = candidates;
 	if (candidates.length === 1 && only !== void 0) return only;
 	if (!(yield* InteractiveMode).allow) return yield* new BuildProfileError({ message: `Multiple platforms available (${candidates.join(", ")}). Pass --platform explicitly when running non-interactively.` });
@@ -23466,13 +23596,13 @@ const EMPTY = {
 	buildNumber: void 0,
 	rawRuntimeVersion: void 0
 };
-const warnIfMismatch = (label, override, native) => override !== void 0 && native !== void 0 && override !== native ? printWarn(`${label} override "${override}" differs from the native value "${native}". The better-update.json value will be used for build metadata.`) : Effect.void;
+const warnIfMismatch = (label, override, native) => override !== void 0 && native !== void 0 && override !== native ? printWarn(`${label} override "${override}" differs from the native value "${native}". The eas.json value will be used for build metadata.`) : Effect.void;
 const resolveAndroidMeta = (projectRoot, profile) => Effect.gen(function* () {
 	const gradle = yield* readGradleConfig(path.join(projectRoot, "android"));
 	const override = profile.android?.metaOverride;
 	yield* warnIfMismatch("android.applicationId", override?.applicationId, gradle?.applicationId);
 	const androidPackage = override?.applicationId ?? gradle?.applicationId;
-	if (androidPackage === void 0) return yield* new BuildProfileError({ message: "Could not determine the Android applicationId. Set android.applicationId under this build profile in better-update.json, or ensure android/app/build.gradle defines it." });
+	if (androidPackage === void 0) return yield* new BuildProfileError({ message: "Could not determine the Android applicationId. Set android.applicationId under this build profile in eas.json, or ensure android/app/build.gradle defines it." });
 	const versionCode = override?.versionCode ?? (gradle?.versionCode === void 0 ? void 0 : String(gradle.versionCode));
 	return {
 		...EMPTY,
@@ -23490,7 +23620,7 @@ const resolveIosMeta = (projectRoot, profile) => Effect.gen(function* () {
 	const override = profile.ios?.metaOverride;
 	yield* warnIfMismatch("ios.bundleIdentifier", override?.bundleIdentifier, native.bundleId);
 	const bundleId = override?.bundleIdentifier ?? native.bundleId;
-	if (bundleId === void 0) return yield* new BuildProfileError({ message: "Could not determine the iOS bundle identifier. Set ios.bundleIdentifier under this build profile in better-update.json, or ensure the Xcode project defines PRODUCT_BUNDLE_IDENTIFIER for the build configuration." });
+	if (bundleId === void 0) return yield* new BuildProfileError({ message: "Could not determine the iOS bundle identifier. Set ios.bundleIdentifier under this build profile in eas.json, or ensure the Xcode project defines PRODUCT_BUNDLE_IDENTIFIER for the build configuration." });
 	return {
 		...EMPTY,
 		bundleId,
@@ -23530,6 +23660,27 @@ const resolveAppMeta = (params) => {
 	return params.platform === "ios" ? resolveIosMeta(params.projectRoot, params.profile) : resolveAndroidMeta(params.projectRoot, params.profile);
 };
 
+//#endregion
+//#region src/application/resolve-update-channel.ts
+/**
+* EAS parity: bake the profile's channel into the native app as the
+* expo-channel-name request header during prebuild. Only the managed ("expo")
+* strategy prebuilds, and only apps shipping expo-updates read the header — a
+* binary built without it silently falls back to the server's default channel,
+* so a missing `channel` on an updates-enabled profile fails fast instead.
+* Returns the channel to inject, or `undefined` to skip injection.
+*/
+const resolveUpdateChannel = (params) => Effect.gen(function* () {
+	const { userCwd, platform, profile, projectType } = params;
+	if ((platform === "ios" ? resolveIosStrategy(profile, projectType) : resolveAndroidStrategy(profile, projectType)) !== "expo") return;
+	if (!(yield* isExpoUpdatesInstalled(userCwd))) {
+		yield* printHuman("expo-updates is not installed — skipping update-channel injection.");
+		return;
+	}
+	if (profile.channel === void 0) return yield* new BuildProfileError({ message: `Build profile "${profile.name}" has no "channel". The channel is baked into the binary as the expo-channel-name update request header; add e.g. "channel": "production" to the profile.` });
+	return profile.channel;
+});
+
 //#endregion
 //#region src/application/build-workflow.ts
 const runIosPlatformBuild = (input) => Effect.gen(function* () {
@@ -23559,6 +23710,7 @@ const runIosPlatformBuild = (input) => Effect.gen(function* () {
 			strategy,
 			rawOutput: options.rawOutput,
 			freezeCredentials: options.freezeCredentials ?? false,
+			updateChannel: input.updateChannel,
 			...compact({ customCommand: profile.customCommand?.ios })
 		}),
 		target: isSimulator ? {
@@ -23602,6 +23754,7 @@ const runAndroidPlatformBuild = (input) => Effect.gen(function* () {
 			profileName: profile.name,
 			skipCredentials,
 			strategy,
+			updateChannel: input.updateChannel,
 			...compact({ customCommand: profile.customCommand?.android })
 		}),
 		target: androidProfile.format === "aab" ? {
@@ -23658,7 +23811,7 @@ const resolveProfileName = (projectRoot, requested) => Effect.gen(function* () {
 	const available = yield* listBuildProfileNames(projectRoot);
 	if (available.includes(requested)) return requested;
 	if (!(yield* InteractiveMode).allow || available.length === 0) return requested;
-	yield* printHuman(`Build profile "${requested}" not found in better-update.json.`);
+	yield* printHuman(`Build profile "${requested}" not found in eas.json.`);
 	return yield* promptSelect("Pick a build profile:", available.map((name) => ({
 		value: name,
 		label: name
@@ -23674,17 +23827,12 @@ const runBuildWorkflow = (options) => Effect.scoped(Effect.gen(function* () {
 	});
 	const projectType = yield* detectProjectType({
 		projectRoot: userCwd,
-		override: asProjectType((yield* readBetterUpdateConfig(userCwd))?.["projectType"])
+		override: asProjectType(yield* readEasProjectType(userCwd))
 	});
 	const isExpo = projectType === "expo";
 	const projectId = yield* readProjectId;
 	const profile = yield* readBuildProfile(userCwd, yield* resolveProfileName(userCwd, options.profileName));
 	if (profile.developmentClient === true) yield* warnIfDevClientMissing(userCwd);
-	const platform = isExpo ? yield* detectPlatform(options.platform, yield* readExpoConfig(userCwd)) : yield* detectPlatformGeneric(options.platform, {
-		profile,
-		hasAndroidDir: yield* dirExists(userCwd, "android"),
-		hasIosDir: yield* dirExists(userCwd, "ios")
-	});
 	const envVars = {
 		...yield* pullEnvVars(api, {
 			projectId,
@@ -23692,6 +23840,17 @@ const runBuildWorkflow = (options) => Effect.scoped(Effect.gen(function* () {
 		}),
 		...profile.env
 	};
+	const platform = isExpo ? yield* detectPlatform(options.platform, readExpoConfig(userCwd, envVars)) : yield* detectPlatformGeneric(options.platform, {
+		profile,
+		hasAndroidDir: yield* dirExists(userCwd, "android"),
+		hasIosDir: yield* dirExists(userCwd, "ios")
+	});
+	const updateChannel = yield* resolveUpdateChannel({
+		userCwd,
+		platform,
+		profile,
+		projectType
+	});
 	const { appMeta, runtimeVersion } = isExpo ? yield* resolveExpoBuildMeta({
 		userCwd,
 		platform,
@@ -23714,7 +23873,8 @@ const runBuildWorkflow = (options) => Effect.scoped(Effect.gen(function* () {
 		envVars,
 		projectType
 	});
-	yield* printHuman(`Building ${platform} artifact for profile "${profile.name}"${runtimeVersion === void 0 ? "" : ` (runtimeVersion=${runtimeVersion})`}`);
+	const buildDetails = [...runtimeVersion === void 0 ? [] : [`runtimeVersion=${runtimeVersion}`], ...updateChannel === void 0 ? [] : [`channel=${updateChannel}`]];
+	yield* printHuman(`Building ${platform} artifact for profile "${profile.name}"${buildDetails.length === 0 ? "" : ` (${buildDetails.join(", ")})`}`);
 	const { build, target, bundleId } = yield* runPlatformBuild({
 		api,
 		options,
@@ -23725,7 +23885,8 @@ const runBuildWorkflow = (options) => Effect.scoped(Effect.gen(function* () {
 		envVars,
 		projectId,
 		projectRoot: staging.projectRoot,
-		tempDir
+		tempDir,
+		updateChannel
 	});
 	yield* printHuman(`Artifact produced: ${build.artifactPath}`);
 	let exportedArtifactPath = void 0;
@@ -24746,7 +24907,7 @@ const runUploadWorkflow = (options) => Effect.gen(function* () {
 	if (!(yield* (yield* FileSystem.FileSystem).exists(options.artifactPath).pipe(Effect.orElseSucceed(() => false)))) return yield* new ArtifactNotFoundError({ message: `Artifact not found at ${options.artifactPath}.` });
 	const projectType = yield* detectProjectType({
 		projectRoot,
-		override: asProjectType((yield* readBetterUpdateConfig(projectRoot))?.["projectType"])
+		override: asProjectType(yield* readEasProjectType(projectRoot))
 	});
 	const projectId = yield* readProjectId;
 	const profile = yield* readBuildProfile(projectRoot, options.profileName);
@@ -26842,9 +27003,14 @@ const listCommand$6 = defineCommand({
 	},
 	run: async () => runEffect(Effect.gen(function* () {
 		const api = yield* apiClient;
-		const [{ recipients, vaultVersion }, { items }] = yield* Effect.all([api.orgVault.listWraps(), api.userEncryptionKeys.list()]);
+		const [{ recipients, vaultVersion }, { items }, vault] = yield* Effect.all([
+			api.orgVault.listWraps(),
+			api.userEncryptionKeys.list(),
+			api.orgVault.get()
+		]);
 		const byId = new Map(items.map((key) => [key.id, key]));
 		yield* printHuman(`Vault version ${vaultVersion}`);
+		if (vault.rotationPending) yield* printHuman(`⚠ Rotation pending — a recipient was removed (${vault.rotationPendingReason ?? "vault access revoked"}). Credential downloads are blocked until you run \`credentials access rotate\`.`);
 		yield* printHumanList([
 			"Key ID",
 			"Kind",
@@ -26861,6 +27027,7 @@ const listCommand$6 = defineCommand({
 		}), "No recipients hold the vault key yet.");
 		return {
 			vaultVersion,
+			rotationPending: vault.rotationPending,
 			recipients: recipients.map((recipient) => toRecipientView(recipient.userEncryptionKeyId, byId.get(recipient.userEncryptionKeyId)))
 		};
 	}), { json: "value" })
@@ -28530,16 +28697,54 @@ const revokeCommand = defineCommand({
 	}
 });
 
+//#endregion
+//#region src/lib/duration.ts
+/**
+* Parse a human-readable duration flag ("90", "45m", "2h", "1h30m") into
+* milliseconds. A bare number means minutes. Returns `undefined` for anything
+* unparseable or non-positive — range policy stays with the caller.
+*/
+const parseDurationMs = (input) => {
+	const groups = /^(?:(?<hours>\d+)h)?(?:(?<minutes>\d+)m?)?$/u.exec(input.trim().toLowerCase())?.groups;
+	if (!groups || groups["hours"] === void 0 && groups["minutes"] === void 0) return;
+	const hours = Number(groups["hours"] ?? 0);
+	const minutes = Number(groups["minutes"] ?? 0);
+	const ms = (hours * 60 + minutes) * 6e4;
+	return ms > 0 ? ms : void 0;
+};
+/**
+* Approximate human form of a duration, rounded up to whole minutes so
+* "<1 min remaining" still reads as 1 — "45 min", "2 h", "1 h 30 min".
+*/
+const formatDurationApprox = (ms) => {
+	const totalMinutes = Math.max(1, Math.ceil(ms / 6e4));
+	const hours = Math.floor(totalMinutes / 60);
+	const minutes = totalMinutes % 60;
+	if (hours === 0) return `${minutes} min`;
+	return minutes === 0 ? `${hours} h` : `${hours} h ${minutes} min`;
+};
+
 //#endregion
 //#region src/commands/credentials/session.ts
-/** Whole minutes left, rounded up so "<1 min remaining" still reads as 1. */
-const remainingMinutes = (remainingMs) => Math.max(1, Math.ceil(remainingMs / 6e4));
+/** Parse + bound the `--duration` flag; `undefined` (flag absent) keeps the 15-minute default. */
+const resolveUnlockTtlMs = (flag) => Effect.gen(function* () {
+	if (flag === void 0) return;
+	const ms = parseDurationMs(flag);
+	if (ms === void 0) return yield* new InvalidArgumentError({ message: `Could not parse --duration "${flag}" — use minutes ("90") or h/m units ("45m", "2h", "1h30m").` });
+	if (ms < 6e4 || ms > 864e5) return yield* new InvalidArgumentError({ message: `--duration must be between ${formatDurationApprox(VAULT_CACHE_TTL_MIN_MS)} and ${formatDurationApprox(VAULT_CACHE_TTL_MAX_MS)}, got "${flag}".` });
+	return ms;
+});
 const unlockCommand = defineCommand({
 	meta: {
 		name: "unlock",
 		description: "Unlock the credential vault and cache the key in your OS keychain, so later commands don't re-prompt"
 	},
-	run: async () => runEffect(Effect.gen(function* () {
+	args: { duration: {
+		type: "string",
+		description: "How long to stay unlocked — minutes (\"90\") or h/m units (\"45m\", \"2h\", \"1h30m\"); default 15m, max 24h"
+	} },
+	run: async ({ args }) => runEffect(Effect.gen(function* () {
+		const cacheTtlMs = yield* resolveUnlockTtlMs(args.duration);
 		const recipient = yield* activeRecipient;
 		if (recipient.source !== "file") {
 			yield* printHuman("Active identity is the BETTER_UPDATE_IDENTITY (CI) key — it has no passphrase and isn't cached.");
@@ -28548,9 +28753,9 @@ const unlockCommand = defineCommand({
 		const api = yield* apiClient;
 		const cache = yield* VaultCache;
 		yield* cache.clear(recipient.publicKey);
-		yield* unlockVaultKeyInteractive(api);
+		yield* unlockVaultKeyInteractive(api, { cacheTtlMs });
 		const cached = yield* cache.get(recipient.publicKey);
-		yield* printHuman(`Vault unlocked${cached === void 0 ? " (no OS keychain available — commands will keep prompting)" : ` for ~${remainingMinutes(cached.remainingMs)} min; run \`better-update credentials lock\` to clear it`}.`);
+		yield* printHuman(`Vault unlocked${cached === void 0 ? " (no OS keychain available — commands will keep prompting)" : ` for ~${formatDurationApprox(cached.remainingMs)}; run \`better-update credentials lock\` to clear it`}.`);
 	}))
 });
 const lockCommand = defineCommand({
@@ -28576,7 +28781,7 @@ const statusCommand$1 = defineCommand({
 			return;
 		}
 		const cached = yield* (yield* VaultCache).get(recipient.publicKey);
-		yield* printHuman(cached === void 0 ? "Locked — the next credential command will prompt for your passphrase." : `Unlocked — cached vault key expires in ~${remainingMinutes(cached.remainingMs)} min.`);
+		yield* printHuman(cached === void 0 ? "Locked — the next credential command will prompt for your passphrase." : `Unlocked — cached vault key expires in ~${formatDurationApprox(cached.remainingMs)}.`);
 	}))
 });
 
@@ -30027,21 +30232,22 @@ const checkProjectLink = Effect.gen(function* () {
 	if (fromEnv !== void 0 && fromEnv.length > 0) return pass("project-linked", "Project linked", `projectId=${fromEnv} (via ${BETTER_UPDATE_PROJECT_ID_ENV})`);
 	const resolved = yield* readProjectId.pipe(Effect.either);
 	if (resolved._tag === "Left") return warn("project-linked", "Project linked", resolved.left.message);
-	const source = (yield* readLinkedProjectId(root)) === void 0 ? "Expo config" : "better-update.json";
+	const source = (yield* readEasLinkedProjectId(root)) === void 0 ? "Expo config" : "eas.json";
 	return pass("project-linked", "Project linked", `projectId=${resolved.right} (via ${source})`);
 });
 const checkProjectType = Effect.gen(function* () {
 	const root = yield* (yield* CliRuntime).cwd;
-	const override = asProjectType((yield* readBetterUpdateConfig(root))?.["projectType"]);
+	const override = asProjectType(yield* readEasProjectType(root));
 	return pass("project-type", "Project type", `${yield* detectProjectType({
 		projectRoot: root,
 		override
-	})} (${override === void 0 ? "auto-detected" : "better-update.json override"})`);
+	})} (${override === void 0 ? "auto-detected" : "eas.json override"})`);
 });
 const checkBuildConfig = Effect.gen(function* () {
-	const names = yield* listBuildProfileNames(yield* (yield* CliRuntime).cwd);
-	if (names.length === 0) return warn("build-config", "Build config", "No build profiles found. Add a \"build\" section to better-update.json.");
-	return pass("build-config", "Build config", `${names.length} profile(s) defined`);
+	const names = yield* listBuildProfileNames(yield* (yield* CliRuntime).cwd).pipe(Effect.either);
+	if (names._tag === "Left") return warn("build-config", "Build config", names.left.message);
+	if (names.right.length === 0) return warn("build-config", "Build config", "No build profiles found. Add a \"build\" section to eas.json.");
+	return pass("build-config", "Build config", `${names.right.length} profile(s) defined`);
 });
 const runChecks = Effect.gen(function* () {
 	const xcode = (yield* CliRuntime).platform === "darwin" ? [yield* checkCommand("xcode", "Xcode CLI tools", "xcode-select", ["-p"])] : [];
@@ -31556,7 +31762,8 @@ const resolveNameAndSlug = (args, projectRoot, expoConfig) => Effect.gen(functio
 });
 /**
 * Persist the resolved project id: into the Expo config (`extra.betterUpdate`)
-* when an Expo project is present, otherwise into `better-update.json`.
+* when an Expo project is present, otherwise as `eas.json`'s top-level
+* `projectId` extension key.
 */
 const persistLink = (projectRoot, projectId, hasExpoConfig) => Effect.gen(function* () {
 	if (hasExpoConfig) {
@@ -31568,7 +31775,7 @@ const persistLink = (projectRoot, projectId, hasExpoConfig) => Effect.gen(functi
 			...compact({ configPath: writeResult.configPath })
 		};
 	}
-	const filePath = yield* writeBetterUpdateConfig(projectRoot, { projectId });
+	const filePath = yield* writeEasJsonPatch(projectRoot, { projectId });
 	yield* printHuman(`Project linked successfully. ID saved to ${path.relative(projectRoot, filePath)}.`);
 	return {
 		projectId,
@@ -31677,45 +31884,6 @@ const logoutCommand = defineCommand({
 	}), { json: "value" })
 });
 
-//#endregion
-//#region src/commands/migrate-config.ts
-const migrateConfigCommand = defineCommand({
-	meta: {
-		name: "migrate-config",
-		description: "Migrate `build`/`submit` profiles from a legacy eas.json into better-update.json"
-	},
-	args: { yes: {
-		type: "boolean",
-		description: "Skip the confirmation prompt"
-	} },
-	run: async ({ args }) => runEffect(Effect.gen(function* () {
-		const runtime = yield* CliRuntime;
-		const fs = yield* FileSystem.FileSystem;
-		const root = yield* runtime.cwd;
-		const easPath = path.join(root, "eas.json");
-		if (!(yield* fs.exists(easPath).pipe(Effect.orElseSucceed(() => false)))) return yield* new InvalidArgumentError({ message: `No eas.json found at ${root}.` });
-		const config = yield* readEasJson(root);
-		const patch = compact({
-			build: config.build,
-			submit: config.submit,
-			cli: config.cli
-		});
-		if (Object.keys(patch).length === 0) {
-			yield* printHuman("eas.json has no build/submit/cli sections — nothing to migrate.");
-			return;
-		}
-		const existingBuild = (yield* readBetterUpdateConfig(root))?.["build"];
-		if (typeof existingBuild === "object" && existingBuild !== null && config.build !== void 0 && !args.yes) {
-			if (!(yield* promptConfirm("better-update.json already has a build section — overwrite it from eas.json?", { initialValue: false }))) {
-				yield* printHuman("Cancelled.");
-				return;
-			}
-		}
-		yield* writeBetterUpdateConfig(root, patch);
-		yield* printHuman("Merged eas.json build/submit into better-update.json. You can now delete eas.json.");
-	}))
-});
-
 //#endregion
 //#region src/commands/open.ts
 const RESOURCE_PATHS = {
@@ -35415,7 +35583,6 @@ const commandRegistry = {
 	devices: devicesCommand,
 	webhooks: webhooksCommand,
 	autocomplete: autocompleteCommand,
-	"migrate-config": migrateConfigCommand,
 	apple: appleCommand,
 	submit: submitCommand
 };