@better-update/cli 0.36.2 → 0.38.0

package/dist/index.mjs

@@ -35,7 +35,7 @@ var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 //#endregion
 //#region package.json
-var version = "0.36.2";
+var version = "0.38.0";
 
 //#endregion
 //#region src/lib/interactive-mode.ts
@@ -425,11 +425,11 @@ const Ciphertext = Schema.String.pipe(Schema.minLength(1)).annotations({ descrip
 const WrappedDek = Schema.String.pipe(Schema.minLength(1)).annotations({ description: "Base64 of the DEK wrapped under the org vault key" });
 /**
 * The secret kinds whose DEK is wrapped under the org vault key — the rows a
-* rotation must re-wrap. Five signing-credential tables plus `envVarValue` (one
+* rotation must re-wrap. Eight signing-credential tables plus `envVarValue` (one
 * row per environment variable value revision). Provisioning profiles are
 * plaintext and are deliberately absent.
 */
-const CredentialType = Schema.Literal("appleDistributionCertificate", "applePushKey", "ascApiKey", "googleServiceAccountKey", "androidUploadKeystore", "envVarValue").annotations({ description: "Which encrypted-secret table a vault-key DEK re-wrap targets" });
+const CredentialType = Schema.Literal("appleDistributionCertificate", "applePushKey", "applePushCertificate", "applePayCertificate", "applePassTypeCertificate", "ascApiKey", "googleServiceAccountKey", "androidUploadKeystore", "envVarValue").annotations({ description: "Which encrypted-secret table a vault-key DEK re-wrap targets" });
 /**
 * The client-encrypted envelope. Spread into each secret credential's upload
 * body and download result alongside that credential's public metadata. The
@@ -665,6 +665,128 @@ var AppleDistributionCertificatesGroup = class extends HttpApiGroup.make("appleD
 	description: "Manage .p12 distribution certificates"
 })) {};
 
+//#endregion
+//#region ../../packages/api/src/domain/apple-pass-type-certificate.ts
+/**
+* Pass Type ID certificate (Wallet passes), bound to a Pass Type ID
+* (`pass.*`). The library has no Pass Type ID API, so these are uploaded
+* manually: the CLI seals the `.p12` (cert + key) and the server stores only the
+* envelope + metadata.
+*/
+var ApplePassTypeCertificate = class extends Schema.Class("ApplePassTypeCertificate")({
+	id: Id,
+	organizationId: Id,
+	appleTeamId: Id,
+	passTypeIdentifier: Schema.String,
+	serialNumber: Schema.String,
+	validFrom: DateTimeString,
+	validUntil: DateTimeString,
+	createdAt: DateTimeString,
+	updatedAt: DateTimeString
+}) {};
+/** Client-encrypted upload: the `.p12` bytes + password are sealed into `ciphertext`. */
+const UploadApplePassTypeCertificateBody = Schema.Struct({
+	id: Id,
+	...encryptedEnvelopeFields,
+	passTypeIdentifier: Schema.String.pipe(Schema.minLength(1), Schema.maxLength(200)),
+	serialNumber: Schema.String.pipe(Schema.minLength(1), Schema.maxLength(200)),
+	appleTeamIdentifier: AppleTeamIdentifier,
+	...appleTeamMetadataFields,
+	validFrom: DateTimeString,
+	validUntil: DateTimeString
+});
+const DeleteApplePassTypeCertificateResult = DeletedResult;
+/** The encrypted envelope (relayed from R2) plus metadata; the CLI decrypts `ciphertext` to recover `{ p12Base64, p12Password }`. */
+const DownloadApplePassTypeCertificateResult = Schema.Struct({
+	id: Id,
+	...encryptedEnvelopeFields,
+	passTypeIdentifier: Schema.String,
+	serialNumber: Schema.String,
+	appleTeamIdentifier: AppleTeamIdentifier,
+	validFrom: DateTimeString,
+	validUntil: DateTimeString
+});
+
+//#endregion
+//#region ../../packages/api/src/groups/apple-pass-type-certificates.ts
+var ApplePassTypeCertificatesGroup = class extends HttpApiGroup.make("applePassTypeCertificates").add(HttpApiEndpoint.get("list", "/api/apple/pass-type-certificates").addSuccess(Schema.Struct({ items: Schema.Array(ApplePassTypeCertificate) })).annotateContext(OpenApi.annotations({
+	title: "List Apple Pass Type ID certificates",
+	description: "List Pass Type ID certificates for the organization"
+}))).add(HttpApiEndpoint.post("upload", "/api/apple/pass-type-certificates").setPayload(UploadApplePassTypeCertificateBody).addSuccess(ApplePassTypeCertificate, { status: 201 }).annotateContext(OpenApi.annotations({
+	title: "Upload Pass Type ID certificate",
+	description: "Upload a Wallet Pass Type ID .p12 certificate"
+}))).add(HttpApiEndpoint.del("delete")`/api/apple/pass-type-certificates/${idParam}`.addSuccess(DeleteApplePassTypeCertificateResult).annotateContext(OpenApi.annotations({
+	title: "Delete Pass Type ID certificate",
+	description: "Remove a stored Pass Type ID certificate"
+}))).add(HttpApiEndpoint.get("download")`/api/apple/pass-type-certificates/${idParam}/download`.addSuccess(DownloadApplePassTypeCertificateResult).annotateContext(OpenApi.annotations({
+	title: "Download Pass Type ID certificate",
+	description: "Fetch the decrypted .p12 Pass Type ID certificate for local use (audit-logged)"
+}))).addError(NotFound).addError(Conflict).addError(BadRequest).addError(Forbidden).annotateContext(OpenApi.annotations({
+	title: "Apple Pass Type ID Certificates",
+	description: "Manage Wallet Pass Type ID certificates"
+})) {};
+
+//#endregion
+//#region ../../packages/api/src/domain/apple-pay-certificate.ts
+/**
+* Apple Pay Payment Processing certificate, bound to a Merchant ID
+* (`merchant.*`). The library cannot create these (no portal cert type), so they
+* are uploaded manually: the CLI seals the `.p12` (cert + key) and the server
+* stores only the envelope + metadata.
+*/
+var ApplePayCertificate = class extends Schema.Class("ApplePayCertificate")({
+	id: Id,
+	organizationId: Id,
+	appleTeamId: Id,
+	merchantIdentifier: Schema.String,
+	serialNumber: Schema.String,
+	validFrom: DateTimeString,
+	validUntil: DateTimeString,
+	createdAt: DateTimeString,
+	updatedAt: DateTimeString
+}) {};
+/** Client-encrypted upload: the `.p12` bytes + password are sealed into `ciphertext`. */
+const UploadApplePayCertificateBody = Schema.Struct({
+	id: Id,
+	...encryptedEnvelopeFields,
+	merchantIdentifier: Schema.String.pipe(Schema.minLength(1), Schema.maxLength(200)),
+	serialNumber: Schema.String.pipe(Schema.minLength(1), Schema.maxLength(200)),
+	appleTeamIdentifier: AppleTeamIdentifier,
+	...appleTeamMetadataFields,
+	validFrom: DateTimeString,
+	validUntil: DateTimeString
+});
+const DeleteApplePayCertificateResult = DeletedResult;
+/** The encrypted envelope (relayed from R2) plus metadata; the CLI decrypts `ciphertext` to recover `{ p12Base64, p12Password }`. */
+const DownloadApplePayCertificateResult = Schema.Struct({
+	id: Id,
+	...encryptedEnvelopeFields,
+	merchantIdentifier: Schema.String,
+	serialNumber: Schema.String,
+	appleTeamIdentifier: AppleTeamIdentifier,
+	validFrom: DateTimeString,
+	validUntil: DateTimeString
+});
+
+//#endregion
+//#region ../../packages/api/src/groups/apple-pay-certificates.ts
+var ApplePayCertificatesGroup = class extends HttpApiGroup.make("applePayCertificates").add(HttpApiEndpoint.get("list", "/api/apple/pay-certificates").addSuccess(Schema.Struct({ items: Schema.Array(ApplePayCertificate) })).annotateContext(OpenApi.annotations({
+	title: "List Apple Pay certificates",
+	description: "List Apple Pay payment processing certificates for the organization"
+}))).add(HttpApiEndpoint.post("upload", "/api/apple/pay-certificates").setPayload(UploadApplePayCertificateBody).addSuccess(ApplePayCertificate, { status: 201 }).annotateContext(OpenApi.annotations({
+	title: "Upload Apple Pay certificate",
+	description: "Upload an Apple Pay payment processing .p12 certificate"
+}))).add(HttpApiEndpoint.del("delete")`/api/apple/pay-certificates/${idParam}`.addSuccess(DeleteApplePayCertificateResult).annotateContext(OpenApi.annotations({
+	title: "Delete Apple Pay certificate",
+	description: "Remove a stored Apple Pay payment processing certificate"
+}))).add(HttpApiEndpoint.get("download")`/api/apple/pay-certificates/${idParam}/download`.addSuccess(DownloadApplePayCertificateResult).annotateContext(OpenApi.annotations({
+	title: "Download Apple Pay certificate",
+	description: "Fetch the decrypted .p12 Apple Pay certificate for local use (audit-logged)"
+}))).addError(NotFound).addError(Conflict).addError(BadRequest).addError(Forbidden).annotateContext(OpenApi.annotations({
+	title: "Apple Pay Certificates",
+	description: "Manage Apple Pay payment processing certificates"
+})) {};
+
 //#endregion
 //#region ../../packages/api/src/domain/apple-provisioning-profile.ts
 const DistributionType = Schema.Literal("APP_STORE", "AD_HOC", "ENTERPRISE", "DEVELOPMENT");
@@ -722,6 +844,71 @@ var AppleProvisioningProfilesGroup = class extends HttpApiGroup.make("appleProvi
 	description: "Manage .mobileprovision profiles (upload or generate)"
 })) {};
 
+//#endregion
+//#region ../../packages/api/src/domain/apple-push-certificate.ts
+/**
+* Legacy APNs Push Services SSL certificate (the `.cer`/`.p12` push cert, distinct
+* from the modern `.p8` token key in `apple-push-key.ts`). Bound to a single App
+* ID (`bundleIdentifier`) rather than a whole team. The production cert serves
+* both the sandbox and production APNs environments.
+*/
+var ApplePushCertificate = class extends Schema.Class("ApplePushCertificate")({
+	id: Id,
+	organizationId: Id,
+	appleTeamId: Id,
+	bundleIdentifier: Schema.String,
+	serialNumber: Schema.String,
+	validFrom: DateTimeString,
+	validUntil: DateTimeString,
+	createdAt: DateTimeString,
+	updatedAt: DateTimeString
+}) {};
+/**
+* Client-encrypted upload: the `.p12` bytes + password are sealed into
+* `ciphertext` (the CLI parses the cert locally to fill the metadata below);
+* the server stores the envelope and metadata and never sees the plaintext.
+*/
+const UploadApplePushCertificateBody = Schema.Struct({
+	id: Id,
+	...encryptedEnvelopeFields,
+	bundleIdentifier: Schema.String.pipe(Schema.minLength(1), Schema.maxLength(200)),
+	serialNumber: Schema.String.pipe(Schema.minLength(1), Schema.maxLength(200)),
+	appleTeamIdentifier: AppleTeamIdentifier,
+	...appleTeamMetadataFields,
+	validFrom: DateTimeString,
+	validUntil: DateTimeString
+});
+const DeleteApplePushCertificateResult = DeletedResult;
+/** The encrypted envelope (relayed from R2) plus server-visible metadata; the CLI decrypts `ciphertext` to recover `{ p12Base64, p12Password }`. */
+const DownloadApplePushCertificateResult = Schema.Struct({
+	id: Id,
+	...encryptedEnvelopeFields,
+	bundleIdentifier: Schema.String,
+	serialNumber: Schema.String,
+	appleTeamIdentifier: AppleTeamIdentifier,
+	validFrom: DateTimeString,
+	validUntil: DateTimeString
+});
+
+//#endregion
+//#region ../../packages/api/src/groups/apple-push-certificates.ts
+var ApplePushCertificatesGroup = class extends HttpApiGroup.make("applePushCertificates").add(HttpApiEndpoint.get("list", "/api/apple/push-certificates").addSuccess(Schema.Struct({ items: Schema.Array(ApplePushCertificate) })).annotateContext(OpenApi.annotations({
+	title: "List Apple push certificates",
+	description: "List APNs push SSL certificates for the organization"
+}))).add(HttpApiEndpoint.post("upload", "/api/apple/push-certificates").setPayload(UploadApplePushCertificateBody).addSuccess(ApplePushCertificate, { status: 201 }).annotateContext(OpenApi.annotations({
+	title: "Upload push certificate",
+	description: "Upload an APNs Push Services .p12 SSL certificate"
+}))).add(HttpApiEndpoint.del("delete")`/api/apple/push-certificates/${idParam}`.addSuccess(DeleteApplePushCertificateResult).annotateContext(OpenApi.annotations({
+	title: "Delete push certificate",
+	description: "Remove a stored APNs push SSL certificate"
+}))).add(HttpApiEndpoint.get("download")`/api/apple/push-certificates/${idParam}/download`.addSuccess(DownloadApplePushCertificateResult).annotateContext(OpenApi.annotations({
+	title: "Download push certificate",
+	description: "Fetch the decrypted .p12 push certificate for local use (audit-logged)"
+}))).addError(NotFound).addError(Conflict).addError(BadRequest).addError(Forbidden).annotateContext(OpenApi.annotations({
+	title: "Apple Push Certificates",
+	description: "Manage APNs Push Services SSL certificates"
+})) {};
+
 //#endregion
 //#region ../../packages/api/src/domain/apple-push-key.ts
 const ApplePushKeyId = tenCharPortalId("Push Key ID");
@@ -2550,7 +2737,7 @@ var WebhooksGroup = class extends HttpApiGroup.make("webhooks").add(HttpApiEndpo
 
 //#endregion
 //#region ../../packages/api/src/api.ts
-var ManagementApi = class extends HttpApi.make("management-api").add(ProjectsGroup).add(BranchesGroup).add(ChannelsGroup).add(EnvironmentsGroup).add(UpdatesGroup).add(AssetsGroup).add(AnalyticsGroup).add(BuildsGroup).add(RuntimesGroup).add(EnvVarsGroup).add(FingerprintsGroup).add(AuditLogsGroup).add(DevicesGroup).add(AppleTeamsGroup).add(AppleDistributionCertificatesGroup).add(ApplePushKeysGroup).add(AscApiKeysGroup).add(AppleProvisioningProfilesGroup).add(GoogleServiceAccountKeysGroup).add(IosBundleConfigurationsGroup).add(IosAppMetadataGroup).add(SubmissionsGroup).add(AndroidApplicationIdentifiersGroup).add(AndroidUploadKeystoresGroup).add(AndroidBuildCredentialsGroup).add(BuildCredentialsGroup).add(UserEncryptionKeysGroup).add(OrgVaultGroup).add(MeGroup).add(WebhooksGroup).add(PoliciesGroup).add(GroupsGroup).add(PolicyAttachmentsGroup).add(ApiKeysGroup).add(InvitationsGroup).add(MembersGroup).add(OrganizationGroup).add(AdminGroup).middleware(Authentication).annotateContext(OpenApi.annotations({
+var ManagementApi = class extends HttpApi.make("management-api").add(ProjectsGroup).add(BranchesGroup).add(ChannelsGroup).add(EnvironmentsGroup).add(UpdatesGroup).add(AssetsGroup).add(AnalyticsGroup).add(BuildsGroup).add(RuntimesGroup).add(EnvVarsGroup).add(FingerprintsGroup).add(AuditLogsGroup).add(DevicesGroup).add(AppleTeamsGroup).add(AppleDistributionCertificatesGroup).add(ApplePushKeysGroup).add(ApplePushCertificatesGroup).add(ApplePayCertificatesGroup).add(ApplePassTypeCertificatesGroup).add(AscApiKeysGroup).add(AppleProvisioningProfilesGroup).add(GoogleServiceAccountKeysGroup).add(IosBundleConfigurationsGroup).add(IosAppMetadataGroup).add(SubmissionsGroup).add(AndroidApplicationIdentifiersGroup).add(AndroidUploadKeystoresGroup).add(AndroidBuildCredentialsGroup).add(BuildCredentialsGroup).add(UserEncryptionKeysGroup).add(OrgVaultGroup).add(MeGroup).add(WebhooksGroup).add(PoliciesGroup).add(GroupsGroup).add(PolicyAttachmentsGroup).add(ApiKeysGroup).add(InvitationsGroup).add(MembersGroup).add(OrganizationGroup).add(AdminGroup).middleware(Authentication).annotateContext(OpenApi.annotations({
 	title: "Better Update Management API",
 	version: "1.0.0",
 	description: "Management API for OTA update publishing, deployment, and analytics"
@@ -3567,8 +3754,9 @@ const VaultCacheLive = Layer.effect(VaultCache, Effect.gen(function* () {
 //#endregion
 //#region src/services/version-check.ts
 const NPM_REGISTRY_URL = "https://registry.npmjs.org/@better-update/cli/latest";
-const CACHE_TTL_MS = 1440 * 60 * 1e3;
+const CACHE_TTL_MS = 300 * 1e3;
 const REFRESH_TIMEOUT_MS = 3e3;
+const FOREGROUND_TIMEOUT_MS = 1500;
 var VersionCheck = class extends Context.Tag("cli/VersionCheck")() {};
 const VersionCheckLive = Layer.effect(VersionCheck, Effect.gen(function* () {
 	const fs = yield* FileSystem.FileSystem;
@@ -3588,6 +3776,20 @@ const VersionCheckLive = Layer.effect(VersionCheck, Effect.gen(function* () {
 			checkedAt: parsed["checkedAt"]
 		};
 	});
+	const fetchAndCache = (timeoutMs) => Effect.gen(function* () {
+		const request = HttpClientRequest.get(NPM_REGISTRY_URL).pipe(HttpClientRequest.setHeader("accept", "application/json"));
+		const response = yield* httpClient.execute(request);
+		if (response.status < 200 || response.status >= 300) return;
+		const body = yield* response.json;
+		if (!isRecord$1(body) || typeof body["version"] !== "string") return;
+		const latest = body["version"];
+		yield* fs.makeDirectory(cacheDir, { recursive: true });
+		yield* fs.writeFileString(cacheFile, `${JSON.stringify({
+			latest,
+			checkedAt: Date.now()
+		}, null, 2)}\n`);
+		return latest;
+	}).pipe(Effect.timeout(timeoutMs), Effect.catchAll(() => Effect.succeed(void 0)));
 	return {
 		cachedLatest: readCache.pipe(Effect.map((entry) => entry?.latest)),
 		cacheStale: readCache.pipe(Effect.map((entry) => {
@@ -3595,19 +3797,8 @@ const VersionCheckLive = Layer.effect(VersionCheck, Effect.gen(function* () {
 			const elapsed = Date.now() - entry.checkedAt;
 			return elapsed < 0 || elapsed > CACHE_TTL_MS;
 		})),
-		refreshCache: Effect.gen(function* () {
-			const request = HttpClientRequest.get(NPM_REGISTRY_URL).pipe(HttpClientRequest.setHeader("accept", "application/json"));
-			const response = yield* httpClient.execute(request);
-			if (response.status < 200 || response.status >= 300) return;
-			const body = yield* response.json;
-			if (!isRecord$1(body) || typeof body["version"] !== "string") return;
-			const latest = body["version"];
-			yield* fs.makeDirectory(cacheDir, { recursive: true });
-			yield* fs.writeFileString(cacheFile, `${JSON.stringify({
-				latest,
-				checkedAt: Date.now()
-			}, null, 2)}\n`);
-		}).pipe(Effect.timeout(REFRESH_TIMEOUT_MS), Effect.catchAll(() => Effect.void))
+		fetchLatest: fetchAndCache(FOREGROUND_TIMEOUT_MS),
+		refreshCache: fetchAndCache(REFRESH_TIMEOUT_MS).pipe(Effect.asVoid)
 	};
 }));
 
@@ -4535,6 +4726,79 @@ const writeEasJsonPatch = (projectRoot, patch) => Effect.gen(function* () {
 	return filePath;
 });
 /**
+* Default `build` profiles scaffolded by `init` / `build configure`. Mirrors the
+* EAS three-tier convention: `development` (dev-client, internal), `preview`
+* (internal QA) and `production` (store). Keep in sync with the build-profile
+* derivation in `build-profile.ts` (e.g. `distribution: "internal"` → ad-hoc).
+*/
+const DEFAULT_BUILD_PROFILES = {
+	development: {
+		developmentClient: true,
+		distribution: "internal",
+		channel: "development",
+		environment: "development",
+		android: { format: "apk" }
+	},
+	preview: {
+		distribution: "internal",
+		channel: "preview",
+		environment: "preview",
+		android: { format: "apk" }
+	},
+	production: {
+		channel: "production",
+		environment: "production",
+		android: { format: "aab" }
+	}
+};
+const DEFAULT_PROFILE_NAMES = [
+	"development",
+	"preview",
+	"production"
+];
+/** Full default `eas.json` body (cli pin + the three default build profiles). */
+const DEFAULT_EAS_JSON = {
+	cli: { version: ">= 7.0.0" },
+	build: DEFAULT_BUILD_PROFILES
+};
+/**
+* Ensure `eas.json` carries the default build profiles. Creates the file with
+* the full default template when absent; otherwise tops up only the missing
+* default profiles, preserving every existing profile and top-level key
+* (`projectId`, `projectType`, `submit`, …). Never overwrites a profile that is
+* already defined — call sites wanting a hard reset write `DEFAULT_EAS_JSON`.
+*/
+const ensureDefaultBuildProfiles = (projectRoot) => Effect.gen(function* () {
+	const existing = yield* readEasJsonRaw(projectRoot);
+	if (existing === void 0) return {
+		path: yield* writeEasJsonPatch(projectRoot, DEFAULT_EAS_JSON),
+		action: "created",
+		added: [...DEFAULT_PROFILE_NAMES]
+	};
+	const existingBuild = isRecord$1(existing["build"]) ? existing["build"] : {};
+	const missing = DEFAULT_PROFILE_NAMES.filter((name) => !(name in existingBuild));
+	if (missing.length === 0) return {
+		path: easJsonPath(projectRoot),
+		action: "noop",
+		added: []
+	};
+	const additions = Object.fromEntries(missing.map((name) => [name, DEFAULT_BUILD_PROFILES[name]]));
+	return {
+		path: yield* writeEasJsonPatch(projectRoot, existing["cli"] === void 0 ? {
+			cli: DEFAULT_EAS_JSON.cli,
+			build: {
+				...existingBuild,
+				...additions
+			}
+		} : { build: {
+			...existingBuild,
+			...additions
+		} }),
+		action: "topped-up",
+		added: missing
+	};
+});
+/**
 * Resolve the linked project id from `eas.json`'s top-level `projectId`, or
 * `undefined` when the file is absent / has no usable value.
 */
@@ -22076,6 +22340,51 @@ const runAndroidBuild = (input) => Effect.gen(function* () {
 	return input.strategy === "custom" ? yield* runAndroidCustom(input, commandEnv) : yield* runGradleBuild(input, commandEnv);
 });
 
+//#endregion
+//#region src/lib/credential-choices.ts
+/** ISO timestamp → `YYYY-MM-DD` for compact, scannable labels. */
+const isoDate = (value) => value.slice(0, 10);
+/**
+* Credentials store the internal team UUID, which is meaningless to read. Build a
+* resolver from `appleTeams.list()` that maps it to the team name (falling back to
+* the 10-char portal identifier, then the raw id if the team isn't in the list).
+*/
+const makeAppleTeamLabeler = (teams) => {
+	const byId = new Map(teams.map((team) => [team.id, team.name ?? team.appleTeamId]));
+	return (internalTeamId) => byId.get(internalTeamId) ?? internalTeamId;
+};
+/**
+* Keystore aliases are often cryptic, so surface the type + creation date in the
+* label and the SHA-1 fingerprint (which matches the Play Console upload key) on
+* the active-row hint.
+*/
+const keystoreChoice = (item) => {
+	const details = [item.keystoreType, `created ${isoDate(item.createdAt)}`].filter((part) => part !== null);
+	return {
+		value: item.id,
+		label: `${item.keyAlias} (${details.join(", ")})`,
+		hint: item.sha1Fingerprint ? `SHA-1 ${item.sha1Fingerprint}` : `id ${item.id.slice(0, 8)}…`
+	};
+};
+/**
+* Push keys share a team, so include the creation date to tell siblings apart.
+* Pass a `teamLabel` (see {@link makeAppleTeamLabeler}) to show the team name
+* instead of the internal UUID.
+*/
+const pushKeyChoice = (key, teamLabel = key.appleTeamId) => ({
+	value: key.id,
+	label: `${key.keyId} (team ${teamLabel}, added ${isoDate(key.createdAt)})`
+});
+/**
+* Surface the expiry so an expired certificate is obvious before it's picked.
+* Pass a `teamLabel` (see {@link makeAppleTeamLabeler}) to show the team name
+* instead of the internal UUID.
+*/
+const distributionCertChoice = (cert, teamLabel = cert.appleTeamId) => ({
+	value: cert.id,
+	label: `${cert.serialNumber.slice(0, 12)}… (team ${teamLabel}, exp ${isoDate(cert.validUntil)})`
+});
+
 //#endregion
 //#region src/lib/credentials-generator-apple-id.ts
 const DISTRIBUTION_TO_PROFILE_TYPE = {
@@ -22443,10 +22752,7 @@ const chooseDistributionCertViaAppleId = (api, ctx, appleTeamIdentifier) => Effe
 	const choice = yield* promptSelect("Select a distribution certificate (or 'generate' for a fresh one)", [{
 		value: GENERATE_NEW,
 		label: "Generate a new distribution certificate"
-	}, ...items.map((cert) => ({
-		value: cert.id,
-		label: `${cert.serialNumber.slice(0, 12)}… (team ${appleTeamIdentifier})`
-	}))]);
+	}, ...items.map((cert) => distributionCertChoice(cert, team?.name ?? appleTeamIdentifier))]);
 	if (choice === GENERATE_NEW) {
 		const created = yield* generateDistributionCertViaAppleIdInteractive(api, ctx);
 		return {
@@ -22557,13 +22863,11 @@ const chooseIosCertificateId = (api) => Effect.gen(function* () {
 		});
 		return (yield* generateDistributionCertInteractive(api)).id;
 	}
+	const teamLabel = makeAppleTeamLabeler((yield* api.appleTeams.list()).items);
 	const choice = yield* promptSelect("Select a distribution certificate (or 'generate' for a fresh one)", [{
 		value: "__generate__",
 		label: "Generate a new distribution certificate"
-	}, ...certs.items.map((cert) => ({
-		value: cert.id,
-		label: `${cert.serialNumber.slice(0, 12)}… (team ${cert.appleTeamId})`
-	}))]);
+	}, ...certs.items.map((cert) => distributionCertChoice(cert, teamLabel(cert.appleTeamId)))]);
 	if (choice === "__generate__") return (yield* generateDistributionCertInteractive(api)).id;
 	return choice;
 });
@@ -22665,10 +22969,7 @@ const pickExistingKeystore = (api) => Effect.gen(function* () {
 		message: "No existing keystores in this organization.",
 		hint: "Re-run and choose 'Generate new keystore'."
 	});
-	return yield* promptSelect("Select a keystore", keystores.items.map((item) => ({
-		value: item.id,
-		label: item.keyAlias
-	})));
+	return yield* promptSelect("Select a keystore", keystores.items.map(keystoreChoice));
 });
 const resolveAndroidAppId = (api, input) => Effect.gen(function* () {
 	const existing = (yield* api.androidApplicationIdentifiers.list({ path: { projectId: input.projectId } })).items.find((item) => item.packageName === input.applicationIdentifier);
@@ -24173,34 +24474,6 @@ const runBuildWorkflow = (options) => Effect.scoped(Effect.gen(function* () {
 
 //#endregion
 //#region src/commands/build/configure.ts
-const DEFAULT_EAS_JSON = {
-	cli: { version: ">= 7.0.0" },
-	build: {
-		development: {
-			developmentClient: true,
-			distribution: "internal",
-			channel: "development",
-			environment: "development",
-			android: { format: "apk" }
-		},
-		preview: {
-			distribution: "internal",
-			channel: "preview",
-			environment: "preview",
-			android: { format: "apk" }
-		},
-		production: {
-			channel: "production",
-			environment: "production",
-			android: { format: "aab" }
-		}
-	}
-};
-const DEFAULT_PROFILES = [
-	"development",
-	"preview",
-	"production"
-];
 const writeEasJson = (filePath, value) => Effect.gen(function* () {
 	yield* (yield* FileSystem.FileSystem).writeFileString(filePath, `${JSON.stringify(value, null, 2)}\n`).pipe(Effect.mapError((cause) => new BuildProfileError({ message: `Failed to write eas.json: ${cause.message}` })));
 });
@@ -24216,43 +24489,44 @@ const configureBuildCommand = defineCommand({
 	run: async ({ args }) => runEffect(Effect.gen(function* () {
 		const { allow: interactive } = yield* InteractiveMode;
 		const projectRoot = yield* (yield* CliRuntime).cwd;
-		const easJsonPath = path.join(projectRoot, "eas.json");
+		const filePath = easJsonPath(projectRoot);
 		const fs = yield* FileSystem.FileSystem;
-		if (!(yield* fs.exists(easJsonPath))) {
-			yield* writeEasJson(easJsonPath, DEFAULT_EAS_JSON);
-			yield* printHuman(`Wrote eas.json with default profiles to ${easJsonPath}.`);
-			yield* printHumanKeyValue([["Profiles", DEFAULT_PROFILES.join(", ")], ["Path", easJsonPath]]);
-			return {
-				action: "created",
-				path: easJsonPath,
-				profiles: [...DEFAULT_PROFILES]
-			};
-		}
+		const exists = yield* fs.exists(filePath);
 		if (args.force === true) {
-			if (!(interactive ? yield* promptConfirm(`Overwrite existing eas.json at ${easJsonPath} with defaults?`) : true)) {
+			if (!(exists && interactive ? yield* promptConfirm(`Overwrite existing eas.json at ${filePath} with defaults?`) : true)) {
 				yield* printHuman("Aborted. eas.json was not modified.");
 				return {
 					action: "aborted",
-					path: easJsonPath
+					path: filePath
 				};
 			}
-			yield* writeEasJson(easJsonPath, DEFAULT_EAS_JSON);
-			yield* printHuman(`Overwrote eas.json with default profiles.`);
+			yield* writeEasJson(filePath, DEFAULT_EAS_JSON);
+			yield* printHuman(exists ? "Overwrote eas.json with default profiles." : `Wrote eas.json with default profiles to ${filePath}.`);
 			return {
-				action: "overwritten",
-				path: easJsonPath,
-				profiles: [...DEFAULT_PROFILES]
+				action: exists ? "overwritten" : "created",
+				path: filePath,
+				profiles: [...DEFAULT_PROFILE_NAMES]
 			};
 		}
-		const config = yield* parseEasConfig(yield* fs.readFileString(easJsonPath).pipe(Effect.mapError((cause) => new BuildProfileError({ message: `Failed to read eas.json: ${cause.message}` }))));
+		if (!exists) {
+			const created = yield* ensureDefaultBuildProfiles(projectRoot);
+			yield* printHuman(`Wrote eas.json with default profiles to ${created.path}.`);
+			yield* printHumanKeyValue([["Profiles", created.added.join(", ")], ["Path", created.path]]);
+			return {
+				action: "created",
+				path: created.path,
+				profiles: created.added
+			};
+		}
+		const config = yield* parseEasConfig(yield* fs.readFileString(filePath).pipe(Effect.mapError((cause) => new BuildProfileError({ message: `Failed to read eas.json: ${cause.message}` }))));
 		const existingProfiles = Object.keys(config.build ?? {});
-		const missing = DEFAULT_PROFILES.filter((name) => !existingProfiles.includes(name));
+		const missing = DEFAULT_PROFILE_NAMES.filter((name) => !existingProfiles.includes(name));
 		if (missing.length === 0) {
 			yield* printHuman(`eas.json already defines all default profiles (${existingProfiles.join(", ")}). Nothing to add.`);
 			yield* printHuman("Pass --force to overwrite with the default template.");
 			return {
 				action: "noop",
-				path: easJsonPath,
+				path: filePath,
 				existing: existingProfiles
 			};
 		}
@@ -24260,28 +24534,21 @@ const configureBuildCommand = defineCommand({
 			yield* printHuman("Aborted. eas.json was not modified.");
 			return {
 				action: "aborted",
-				path: easJsonPath
+				path: filePath
 			};
 		}
-		const additions = Object.fromEntries(missing.map((name) => [name, DEFAULT_EAS_JSON.build[name]]));
-		yield* writeEasJson(easJsonPath, {
-			build: {
-				...config.build,
-				...additions
-			},
-			...compact({ cli: config.cli })
-		});
-		yield* printHuman(`Added profile(s) to eas.json: ${missing.join(", ")}.`);
+		const result = yield* ensureDefaultBuildProfiles(projectRoot);
+		yield* printHuman(`Added profile(s) to eas.json: ${result.added.join(", ")}.`);
 		yield* printHumanKeyValue([
 			["Existing", existingProfiles.join(", ") || "(none)"],
-			["Added", missing.join(", ")],
-			["Path", easJsonPath]
+			["Added", result.added.join(", ")],
+			["Path", result.path]
 		]);
 		return {
 			action: "topped-up",
-			path: easJsonPath,
+			path: result.path,
 			existing: existingProfiles,
-			added: [...missing]
+			added: result.added
 		};
 	}), { json: "value" })
 });
@@ -25821,13 +26088,160 @@ const inspectP12 = (params) => Effect.try({
 	catch: (error) => new CredentialValidationError({ message: `Failed to parse P12 certificate: ${error instanceof Error ? error.message : String(error)}` })
 });
 
+//#endregion
+//#region src/lib/credentials-pass-type-certificate.ts
+/**
+* Manual upload of a Wallet Pass Type ID `.p12` certificate. The Pass Type ID
+* (`pass.*`) is passed explicitly; serial/validity come from the parsed cert and
+* the team from its OU (or `--apple-team-identifier`). Only
+* `{ p12Base64, p12Password }` is sealed.
+*/
+const uploadIosPassTypeCertificate = (api, input, bytes) => Effect.gen(function* () {
+	if (input.password === void 0) return yield* new CredentialValidationError({ message: "Missing --password required for the selected credential type." });
+	if (!input.passTypeIdentifier) return yield* new CredentialValidationError({ message: "Missing --pass-type-identifier required for a Pass Type ID certificate." });
+	const info = yield* inspectP12({
+		data: Buffer.from(bytes),
+		password: input.password
+	});
+	const appleTeamIdentifier = info.teamId ?? input.appleTeamIdentifier;
+	if (!appleTeamIdentifier) return yield* new CredentialValidationError({ message: "Could not derive Apple Team ID from the certificate; pass --apple-team-identifier." });
+	if (!info.validFrom || !info.expiresAt) return yield* new CredentialValidationError({ message: "Certificate is missing notBefore/notAfter dates." });
+	const metadata = {
+		passTypeIdentifier: input.passTypeIdentifier,
+		serialNumber: info.serialNumber,
+		appleTeamIdentifier,
+		validFrom: info.validFrom.toISOString(),
+		validUntil: info.expiresAt.toISOString()
+	};
+	const envelope = yield* sealForUpload({
+		session: yield* openVaultSessionInteractive(api),
+		credentialType: "pass-type-certificate",
+		metadata,
+		secret: {
+			p12Base64: toBase64(bytes),
+			p12Password: input.password
+		}
+	});
+	return {
+		id: (yield* api.applePassTypeCertificates.upload({ payload: {
+			...toUploadEnvelope(envelope),
+			...metadata
+		} })).id,
+		name: input.name,
+		platform: "ios",
+		type: "pass-type-certificate"
+	};
+});
+
+//#endregion
+//#region src/lib/credentials-pay-certificate.ts
+/**
+* Manual upload of an Apple Pay payment-processing `.p12` certificate. The
+* Merchant ID (`merchant.*`) is not carried reliably in the cert, so it is passed
+* explicitly; serial/validity come from the parsed cert and the team from its OU
+* (or `--apple-team-identifier`). Only `{ p12Base64, p12Password }` is sealed.
+*/
+const uploadIosPayCertificate = (api, input, bytes) => Effect.gen(function* () {
+	if (input.password === void 0) return yield* new CredentialValidationError({ message: "Missing --password required for the selected credential type." });
+	if (!input.merchantIdentifier) return yield* new CredentialValidationError({ message: "Missing --merchant-identifier required for an Apple Pay certificate." });
+	const info = yield* inspectP12({
+		data: Buffer.from(bytes),
+		password: input.password
+	});
+	const appleTeamIdentifier = info.teamId ?? input.appleTeamIdentifier;
+	if (!appleTeamIdentifier) return yield* new CredentialValidationError({ message: "Could not derive Apple Team ID from the certificate; pass --apple-team-identifier." });
+	if (!info.validFrom || !info.expiresAt) return yield* new CredentialValidationError({ message: "Certificate is missing notBefore/notAfter dates." });
+	const metadata = {
+		merchantIdentifier: input.merchantIdentifier,
+		serialNumber: info.serialNumber,
+		appleTeamIdentifier,
+		validFrom: info.validFrom.toISOString(),
+		validUntil: info.expiresAt.toISOString()
+	};
+	const envelope = yield* sealForUpload({
+		session: yield* openVaultSessionInteractive(api),
+		credentialType: "apple-pay-certificate",
+		metadata,
+		secret: {
+			p12Base64: toBase64(bytes),
+			p12Password: input.password
+		}
+	});
+	return {
+		id: (yield* api.applePayCertificates.upload({ payload: {
+			...toUploadEnvelope(envelope),
+			...metadata
+		} })).id,
+		name: input.name,
+		platform: "ios",
+		type: "apple-pay-certificate"
+	};
+});
+
+//#endregion
+//#region src/lib/credentials-push-certificate.ts
+/**
+* Derive the App ID a push SSL cert is bound to from its Common Name, e.g.
+* "Apple Push Services: com.example.app" → "com.example.app". Returns undefined
+* when the CN does not carry a reverse-DNS identifier.
+*/
+const bundleIdFromPushCertCN = (commonName) => {
+	const bundle = /:\s*(?<bundle>[A-Za-z0-9](?:[A-Za-z0-9.-]*[A-Za-z0-9])?)\s*$/u.exec(commonName)?.groups?.["bundle"];
+	return bundle?.includes(".") ? bundle : void 0;
+};
+/**
+* Manual upload of a legacy APNs Push Services `.p12` SSL certificate. The CLI
+* parses the cert locally for its metadata (serial, validity, team, and the App
+* ID from the CN) and seals `{ p12Base64, p12Password }` into the vault; the
+* server only ever stores the ciphertext.
+*/
+const uploadIosPushCertificate = (api, input, bytes) => Effect.gen(function* () {
+	if (input.password === void 0) return yield* new CredentialValidationError({ message: "Missing --password required for the selected credential type." });
+	const info = yield* inspectP12({
+		data: Buffer.from(bytes),
+		password: input.password
+	});
+	if (!info.teamId) return yield* new CredentialValidationError({ message: "Could not derive Apple Team ID from certificate subject (expected OU=TEAMID or CN with (TEAMID))." });
+	if (!info.validFrom || !info.expiresAt) return yield* new CredentialValidationError({ message: "Certificate is missing notBefore/notAfter dates." });
+	const bundleIdentifier = input.bundleIdentifier ?? bundleIdFromPushCertCN(info.signingIdentity);
+	if (!bundleIdentifier) return yield* new CredentialValidationError({ message: "Could not derive the App ID from the push certificate (expected CN 'Apple Push Services: <bundle id>'). Pass --bundle-identifier." });
+	const metadata = {
+		bundleIdentifier,
+		serialNumber: info.serialNumber,
+		appleTeamIdentifier: info.teamId,
+		validFrom: info.validFrom.toISOString(),
+		validUntil: info.expiresAt.toISOString()
+	};
+	const envelope = yield* sealForUpload({
+		session: yield* openVaultSessionInteractive(api),
+		credentialType: "push-certificate",
+		metadata,
+		secret: {
+			p12Base64: toBase64(bytes),
+			p12Password: input.password
+		}
+	});
+	return {
+		id: (yield* api.applePushCertificates.upload({ payload: {
+			...toUploadEnvelope(envelope),
+			...metadata
+		} })).id,
+		name: input.name,
+		platform: "ios",
+		type: "push-certificate"
+	};
+});
+
 //#endregion
 //#region src/lib/credentials-manager.ts
 const formatDistribution = (value) => value.toLowerCase().replaceAll("_", "-");
 const listAllCredentials = (api) => Effect.gen(function* () {
-	const [certs, pushKeys, ascKeys, profiles, keystores, googleKeys] = yield* Effect.all([
+	const [certs, pushKeys, pushCerts, payCerts, passCerts, ascKeys, profiles, keystores, googleKeys] = yield* Effect.all([
 		api.appleDistributionCertificates.list(),
 		api.applePushKeys.list(),
+		api.applePushCertificates.list(),
+		api.applePayCertificates.list(),
+		api.applePassTypeCertificates.list(),
 		api.ascApiKeys.list(),
 		api.appleProvisioningProfiles.list({ urlParams: {} }),
 		api.androidUploadKeystores.list(),
@@ -25848,6 +26262,27 @@ const listAllCredentials = (api) => Effect.gen(function* () {
 			type: "push-key",
 			distribution: null
 		})),
+		...pushCerts.items.map((cert) => ({
+			id: cert.id,
+			name: cert.bundleIdentifier,
+			platform: "ios",
+			type: "push-certificate",
+			distribution: null
+		})),
+		...payCerts.items.map((cert) => ({
+			id: cert.id,
+			name: cert.merchantIdentifier,
+			platform: "ios",
+			type: "apple-pay-certificate",
+			distribution: null
+		})),
+		...passCerts.items.map((cert) => ({
+			id: cert.id,
+			name: cert.passTypeIdentifier,
+			platform: "ios",
+			type: "pass-type-certificate",
+			distribution: null
+		})),
 		...ascKeys.items.map((key) => ({
 			id: key.id,
 			name: key.name,
@@ -26045,6 +26480,9 @@ const uploadAndroidGoogleServiceAccountKey = (api, input, bytes) => Effect.gen(f
 const uploadHandlers = {
 	"ios:distribution-certificate": uploadIosDistributionCertificate,
 	"ios:push-key": uploadIosPushKey,
+	"ios:push-certificate": uploadIosPushCertificate,
+	"ios:apple-pay-certificate": uploadIosPayCertificate,
+	"ios:pass-type-certificate": uploadIosPassTypeCertificate,
 	"ios:asc-api-key": uploadIosAscApiKey,
 	"ios:provisioning-profile": uploadIosProvisioningProfile,
 	"android:keystore": uploadAndroidKeystore,
@@ -26070,6 +26508,15 @@ const deleteCredential = (api, input) => {
 		platform: "ios",
 		type: "push-key"
 	}, () => api.applePushKeys.delete({ path })), Match.when({
+		platform: "ios",
+		type: "push-certificate"
+	}, () => api.applePushCertificates.delete({ path })), Match.when({
+		platform: "ios",
+		type: "apple-pay-certificate"
+	}, () => api.applePayCertificates.delete({ path })), Match.when({
+		platform: "ios",
+		type: "pass-type-certificate"
+	}, () => api.applePassTypeCertificates.delete({ path })), Match.when({
 		platform: "ios",
 		type: "asc-api-key"
 	}, () => api.ascApiKeys.delete({ path })), Match.when({
@@ -26150,6 +26597,9 @@ const TYPE_LABELS = {
 	"distribution-certificate": "iOS distribution certificate",
 	"provisioning-profile": "iOS provisioning profile",
 	"push-key": "APNs push key",
+	"push-certificate": "APNs push SSL certificate",
+	"apple-pay-certificate": "Apple Pay certificate",
+	"pass-type-certificate": "Pass Type ID certificate",
 	"asc-api-key": "ASC API key",
 	keystore: "Android keystore",
 	"google-service-account-key": "Google service account key"
@@ -26365,10 +26815,7 @@ const changeDefaultKeystore = (ctx) => Effect.gen(function* () {
 const downloadAndroidKeystoreInteractive = (ctx) => Effect.gen(function* () {
 	const list = yield* ctx.api.androidUploadKeystores.list();
 	if (list.items.length === 0) return yield* Console.log("No keystores to download.");
-	const id = yield* promptSelect("Select a keystore to download", list.items.map((item) => ({
-		value: item.id,
-		label: `${item.keyAlias} (${item.id.slice(0, 8)}…)`
-	})));
+	const id = yield* promptSelect("Select a keystore to download", list.items.map(keystoreChoice));
 	const data = yield* ctx.api.androidUploadKeystores.download({ path: { id } });
 	const secret = yield* openFromDownload({
 		session: yield* openVaultSessionInteractive(ctx.api),
@@ -26692,10 +27139,8 @@ const revokeIosDistributionCert = (ctx) => Effect.gen(function* () {
 		message: "No ASC API key linked to an Apple team.",
 		hint: "Upload an ASC API key first so the CLI can call Apple to revoke."
 	});
-	const localId = yield* promptSelect("Select a distribution certificate to revoke", certs.items.map((cert) => ({
-		value: cert.id,
-		label: `${cert.serialNumber.slice(0, 12)}… (team ${cert.appleTeamId})`
-	})));
+	const teamLabel = makeAppleTeamLabeler((yield* ctx.api.appleTeams.list()).items);
+	const localId = yield* promptSelect("Select a distribution certificate to revoke", certs.items.map((cert) => distributionCertChoice(cert, teamLabel(cert.appleTeamId))));
 	const target = certs.items.find((entry) => entry.id === localId);
 	const ascApiKeyId = teamKeys.find((key) => key.appleTeamId === target?.appleTeamId)?.id ?? (yield* promptSelect("Select an ASC API key to call Apple with", teamKeys.map((key) => ({
 		value: key.id,
@@ -26722,10 +27167,8 @@ const revokeIosPushKey = (ctx) => Effect.gen(function* () {
 		message: "No APNs push keys in this account.",
 		hint: "Run 'Add a new push key' to create one first."
 	});
-	const localId = yield* promptSelect("Select a push key to revoke", items.map((key) => ({
-		value: key.id,
-		label: `${key.keyId} (team ${key.appleTeamId})`
-	})));
+	const teamLabel = makeAppleTeamLabeler((yield* ctx.api.appleTeams.list()).items);
+	const localId = yield* promptSelect("Select a push key to revoke", items.map((key) => pushKeyChoice(key, teamLabel(key.appleTeamId))));
 	const target = items.find((entry) => entry.id === localId);
 	if (target === void 0) return yield* new MissingCredentialsError({
 		message: `Selected push key ${localId} not found.`,
@@ -26863,10 +27306,8 @@ const bindIosPushKey = (ctx) => Effect.gen(function* () {
 		hint: "Run 'Add a new push key' first."
 	});
 	const config = yield* promptForBundleConfig(ctx);
-	const pushKeyId = yield* promptSelect("Select a push key to bind", keys.items.map((key) => ({
-		value: key.id,
-		label: `${key.keyId} (team ${key.appleTeamId})`
-	})));
+	const teamLabel = makeAppleTeamLabeler((yield* ctx.api.appleTeams.list()).items);
+	const pushKeyId = yield* promptSelect("Select a push key to bind", keys.items.map((key) => pushKeyChoice(key, teamLabel(key.appleTeamId))));
 	yield* ctx.api.iosBundleConfigurations.update({
 		path: { id: config.id },
 		payload: { applePushKeyId: pushKeyId }
@@ -26883,10 +27324,8 @@ const setupProjectPushNotifications = (ctx) => Effect.gen(function* () {
 		label: "Add a new push key"
 	}]);
 	const config = yield* promptForBundleConfig(ctx);
-	const pushKeyId = choice === "add" ? yield* createNewPushKeyForBundle(ctx, config.appleTeamId) : yield* promptSelect("Select a push key to bind", keys.items.map((key) => ({
-		value: key.id,
-		label: `${key.keyId} (team ${key.appleTeamId})`
-	})));
+	const teamLabel = makeAppleTeamLabeler(keys.items.length === 0 ? [] : (yield* ctx.api.appleTeams.list()).items);
+	const pushKeyId = choice === "add" ? yield* createNewPushKeyForBundle(ctx, config.appleTeamId) : yield* promptSelect("Select a push key to bind", keys.items.map((key) => pushKeyChoice(key, teamLabel(key.appleTeamId))));
 	yield* ctx.api.iosBundleConfigurations.update({
 		path: { id: config.id },
 		payload: { applePushKeyId: pushKeyId }
@@ -27648,6 +28087,9 @@ const CREDENTIAL_TYPES$3 = [
 	"distribution-certificate",
 	"provisioning-profile",
 	"push-key",
+	"push-certificate",
+	"apple-pay-certificate",
+	"pass-type-certificate",
 	"asc-api-key",
 	"keystore",
 	"google-service-account-key"
@@ -27764,6 +28206,9 @@ const DOWNLOAD_TYPES = [
 	"distribution-certificate",
 	"provisioning-profile",
 	"push-key",
+	"push-certificate",
+	"apple-pay-certificate",
+	"pass-type-certificate",
 	"asc-api-key",
 	"keystore",
 	"google-service-account-key"
@@ -27855,6 +28300,105 @@ const downloadPushKey = ({ api, id, cwd, output }) => Effect.gen(function* () {
 		}
 	};
 });
+const downloadPushCertificate = ({ api, id, cwd, output }) => Effect.gen(function* () {
+	const data = yield* api.applePushCertificates.download({ path: { id } });
+	const secret = yield* openFromDownload({
+		session: yield* openVaultSessionInteractive(api),
+		credentialType: "push-certificate",
+		downloaded: data
+	});
+	const p12Base64 = yield* secretString(secret, "p12Base64");
+	const p12Password = yield* secretString(secret, "p12Password");
+	const filePath = resolveOutputPath(cwd, output, `${data.id}.p12`);
+	yield* writeBinary(filePath, fromBase64(p12Base64));
+	return {
+		path: filePath,
+		pairs: [
+			["Path", filePath],
+			["Type", "Apple push SSL certificate (.p12)"],
+			["Bundle", data.bundleIdentifier],
+			["Serial", data.serialNumber],
+			["Apple team", data.appleTeamIdentifier],
+			["Valid from", data.validFrom],
+			["Valid until", data.validUntil],
+			["P12 password", p12Password]
+		],
+		metadata: {
+			bundleIdentifier: data.bundleIdentifier,
+			serialNumber: data.serialNumber,
+			appleTeamIdentifier: data.appleTeamIdentifier,
+			validFrom: data.validFrom,
+			validUntil: data.validUntil,
+			p12Password
+		}
+	};
+});
+const downloadPayCertificate = ({ api, id, cwd, output }) => Effect.gen(function* () {
+	const data = yield* api.applePayCertificates.download({ path: { id } });
+	const secret = yield* openFromDownload({
+		session: yield* openVaultSessionInteractive(api),
+		credentialType: "apple-pay-certificate",
+		downloaded: data
+	});
+	const p12Base64 = yield* secretString(secret, "p12Base64");
+	const p12Password = yield* secretString(secret, "p12Password");
+	const filePath = resolveOutputPath(cwd, output, `${data.id}.p12`);
+	yield* writeBinary(filePath, fromBase64(p12Base64));
+	return {
+		path: filePath,
+		pairs: [
+			["Path", filePath],
+			["Type", "Apple Pay payment processing certificate (.p12)"],
+			["Merchant", data.merchantIdentifier],
+			["Serial", data.serialNumber],
+			["Apple team", data.appleTeamIdentifier],
+			["Valid from", data.validFrom],
+			["Valid until", data.validUntil],
+			["P12 password", p12Password]
+		],
+		metadata: {
+			merchantIdentifier: data.merchantIdentifier,
+			serialNumber: data.serialNumber,
+			appleTeamIdentifier: data.appleTeamIdentifier,
+			validFrom: data.validFrom,
+			validUntil: data.validUntil,
+			p12Password
+		}
+	};
+});
+const downloadPassTypeCertificate = ({ api, id, cwd, output }) => Effect.gen(function* () {
+	const data = yield* api.applePassTypeCertificates.download({ path: { id } });
+	const secret = yield* openFromDownload({
+		session: yield* openVaultSessionInteractive(api),
+		credentialType: "pass-type-certificate",
+		downloaded: data
+	});
+	const p12Base64 = yield* secretString(secret, "p12Base64");
+	const p12Password = yield* secretString(secret, "p12Password");
+	const filePath = resolveOutputPath(cwd, output, `${data.id}.p12`);
+	yield* writeBinary(filePath, fromBase64(p12Base64));
+	return {
+		path: filePath,
+		pairs: [
+			["Path", filePath],
+			["Type", "Wallet Pass Type ID certificate (.p12)"],
+			["Pass Type ID", data.passTypeIdentifier],
+			["Serial", data.serialNumber],
+			["Apple team", data.appleTeamIdentifier],
+			["Valid from", data.validFrom],
+			["Valid until", data.validUntil],
+			["P12 password", p12Password]
+		],
+		metadata: {
+			passTypeIdentifier: data.passTypeIdentifier,
+			serialNumber: data.serialNumber,
+			appleTeamIdentifier: data.appleTeamIdentifier,
+			validFrom: data.validFrom,
+			validUntil: data.validUntil,
+			p12Password
+		}
+	};
+});
 const downloadAscApiKey$1 = ({ api, id, cwd, output }) => Effect.gen(function* () {
 	const data = yield* api.ascApiKeys.getCredentials({ path: { id } });
 	const p8Pem = yield* secretString(yield* openFromDownload({
@@ -27939,6 +28483,9 @@ const dispatchDownload = (ctx, type) => {
 		case "distribution-certificate": return downloadDistributionCertificate(ctx);
 		case "provisioning-profile": return downloadProvisioningProfile$1(ctx);
 		case "push-key": return downloadPushKey(ctx);
+		case "push-certificate": return downloadPushCertificate(ctx);
+		case "apple-pay-certificate": return downloadPayCertificate(ctx);
+		case "pass-type-certificate": return downloadPassTypeCertificate(ctx);
 		case "asc-api-key": return downloadAscApiKey$1(ctx);
 		case "keystore": return downloadKeystore(ctx);
 		case "google-service-account-key": return downloadGoogleServiceAccountKey(ctx);
@@ -27984,6 +28531,99 @@ const downloadCommand = defineCommand({
 	}), { json: "value" })
 });
 
+//#endregion
+//#region src/lib/credentials-generator-merchant.ts
+/**
+* Enable the Apple Pay capability on an App ID, registering the App ID first if
+* it does not exist yet. Returns once the capability is on.
+*/
+const enableApplePayCapability = (ctx, bundleIdentifier) => Effect.gen(function* () {
+	const bundle = (yield* wrap("apple-find-bundle-id", async () => AppleUtils.BundleId.findAsync(ctx, { identifier: bundleIdentifier }))) ?? (yield* wrap("apple-create-bundle-id", async () => AppleUtils.BundleId.createAsync(ctx, {
+		identifier: bundleIdentifier,
+		name: bundleIdentifier,
+		platform: AppleUtils.BundleIdPlatform.IOS
+	})));
+	yield* wrap("apple-enable-apple-pay", async () => bundle.updateBundleIdCapabilityAsync({
+		capabilityType: AppleUtils.CapabilityType.APPLE_PAY,
+		option: AppleUtils.CapabilityTypeOption.ON
+	}));
+});
+/**
+* Register an Apple Pay Merchant ID (`merchant.*`) on the Developer Portal via an
+* Apple ID session, optionally enabling the Apple Pay capability on an App ID.
+* This is the one piece of Apple Pay onboarding the portal API supports — the
+* payment-processing certificate itself is still created out-of-band (usually by
+* the PSP) and uploaded via `credentials upload --type apple-pay-certificate`.
+*/
+const registerMerchantIdViaAppleId = (input) => Effect.gen(function* () {
+	const merchant = yield* wrap("apple-create-merchant-id", async () => AppleUtils.MerchantId.createAsync(input.context, {
+		identifier: input.identifier,
+		name: input.name
+	}));
+	if (input.bundleIdentifier !== void 0 && input.bundleIdentifier.length > 0) yield* enableApplePayCapability(input.context, input.bundleIdentifier);
+	return {
+		developerPortalIdentifier: merchant.id,
+		identifier: input.identifier,
+		name: input.name,
+		capabilityEnabledForBundleId: input.bundleIdentifier
+	};
+});
+
+//#endregion
+//#region src/commands/credentials/generate-merchant-id.ts
+const MERCHANT_ID_PATTERN = /^merchant\.[A-Za-z0-9][A-Za-z0-9.-]*$/u;
+const MERCHANT_EXIT_EXTRAS = {
+	CredentialValidationError: 2,
+	AppleIdGenerateFailedError: 6,
+	AppleAuthError: 4,
+	InteractiveProhibitedError: 4
+};
+const merchantIdCommand = defineCommand({
+	meta: {
+		name: "merchant-id",
+		description: "Register an Apple Pay Merchant ID (merchant.*) on the Developer Portal via Apple ID login, optionally turning on Apple Pay for an App ID. The payment-processing certificate itself is uploaded separately with `credentials upload --type apple-pay-certificate`."
+	},
+	args: {
+		identifier: {
+			type: "string",
+			required: true,
+			description: "Merchant ID (merchant.*)"
+		},
+		name: {
+			type: "string",
+			description: "Display name (defaults to the identifier)"
+		},
+		"bundle-identifier": {
+			type: "string",
+			description: "App ID to enable the Apple Pay capability on"
+		}
+	},
+	run: async ({ args }) => runEffect(Effect.gen(function* () {
+		const identifier = args.identifier.trim();
+		if (!MERCHANT_ID_PATTERN.test(identifier)) return yield* new CredentialValidationError({ message: `Merchant ID "${identifier}" must look like merchant.com.example.` });
+		const auth = yield* AppleAuth;
+		const session = yield* auth.ensureLoggedIn();
+		yield* printHuman("Registering Apple Pay Merchant ID via your Apple ID...");
+		const created = yield* registerMerchantIdViaAppleId({
+			context: auth.buildRequestContext(session),
+			identifier,
+			name: args.name ?? identifier,
+			...compact({ bundleIdentifier: args["bundle-identifier"] })
+		});
+		yield* printHuman("Merchant ID registered.");
+		yield* printHumanKeyValue([
+			["Merchant ID", created.identifier],
+			["Name", created.name],
+			["Apple identifier", created.developerPortalIdentifier],
+			["Apple Pay enabled on", created.capabilityEnabledForBundleId ?? "-"]
+		]);
+		return created;
+	}), {
+		exits: MERCHANT_EXIT_EXTRAS,
+		json: "value"
+	})
+});
+
 //#endregion
 //#region src/commands/credentials/generate-push-key.ts
 const PUSH_KEY_EXIT_EXTRAS = {
@@ -28382,6 +29022,7 @@ const generateCommand$1 = defineCommand({
 		"distribution-certificate": distributionCertificateCommand$1,
 		"provisioning-profile": provisioningProfileCommand,
 		"push-key": pushKeyCommand$1,
+		"merchant-id": merchantIdCommand,
 		"gsa-key": gsaKeyCommand
 	}
 });
@@ -28682,6 +29323,9 @@ const CREDENTIAL_TYPES$2 = [
 	"distribution-certificate",
 	"provisioning-profile",
 	"push-key",
+	"push-certificate",
+	"apple-pay-certificate",
+	"pass-type-certificate",
 	"asc-api-key",
 	"keystore",
 	"google-service-account-key"
@@ -28856,10 +29500,8 @@ const resolvePushKeyTarget = (api, idArg) => Effect.gen(function* () {
 		const [only] = items;
 		if (only !== void 0) return only;
 	}
-	const chosen = yield* promptSelect("Select a push key to revoke", items.map((entry) => ({
-		value: entry.id,
-		label: `${entry.keyId} (team ${entry.appleTeamId})`
-	})));
+	const teamLabel = makeAppleTeamLabeler((yield* api.appleTeams.list()).items);
+	const chosen = yield* promptSelect("Select a push key to revoke", items.map((key) => pushKeyChoice(key, teamLabel(key.appleTeamId))));
 	const match = items.find((entry) => entry.id === chosen);
 	if (match === void 0) return yield* new CredentialValidationError({ message: `Selected push key ${chosen} not found after listing.` });
 	return match;
@@ -29548,6 +30190,9 @@ const CREDENTIAL_TYPES$1 = [
 	"distribution-certificate",
 	"provisioning-profile",
 	"push-key",
+	"push-certificate",
+	"apple-pay-certificate",
+	"pass-type-certificate",
 	"asc-api-key",
 	"keystore",
 	"google-service-account-key"
@@ -29601,6 +30246,18 @@ const uploadCommand = defineCommand({
 		"apple-team-identifier": {
 			type: "string",
 			description: "Apple Team ID"
+		},
+		"bundle-identifier": {
+			type: "string",
+			description: "App ID for a push certificate (else derived from the cert CN)"
+		},
+		"merchant-identifier": {
+			type: "string",
+			description: "Merchant ID (merchant.*) for an Apple Pay certificate"
+		},
+		"pass-type-identifier": {
+			type: "string",
+			description: "Pass Type ID (pass.*) for a Pass Type ID certificate"
 		}
 	},
 	run: async ({ args }) => runEffect(Effect.gen(function* () {
@@ -29615,7 +30272,10 @@ const uploadCommand = defineCommand({
 				keyPassword: args["key-password"],
 				keyId: args["key-id"],
 				issuerId: args["issuer-id"],
-				appleTeamIdentifier: args["apple-team-identifier"]
+				appleTeamIdentifier: args["apple-team-identifier"],
+				bundleIdentifier: args["bundle-identifier"],
+				merchantIdentifier: args["merchant-identifier"],
+				passTypeIdentifier: args["pass-type-identifier"]
 			})
 		});
 		yield* printHuman("Credential uploaded successfully.");
@@ -29689,6 +30349,9 @@ const CREDENTIAL_TYPES = [
 	"distribution-certificate",
 	"provisioning-profile",
 	"push-key",
+	"push-certificate",
+	"apple-pay-certificate",
+	"pass-type-certificate",
 	"asc-api-key",
 	"keystore",
 	"google-service-account-key"
@@ -29753,6 +30416,66 @@ const viewPushKey = (api, id) => Effect.gen(function* () {
 		raw: item
 	};
 });
+const viewPushCertificate = (api, id) => Effect.gen(function* () {
+	const { items } = yield* api.applePushCertificates.list();
+	const item = items.find((entry) => entry.id === id);
+	if (!item) return yield* notFound(id, "push-certificate");
+	return {
+		kind: "push-certificate",
+		pairs: [
+			["ID", item.id],
+			["Type", "Apple push SSL certificate"],
+			["Bundle identifier", item.bundleIdentifier],
+			["Serial number", item.serialNumber],
+			["Apple team ID", item.appleTeamId],
+			["Valid from", item.validFrom],
+			["Valid until", item.validUntil],
+			["Created", item.createdAt],
+			["Updated", item.updatedAt]
+		],
+		raw: item
+	};
+});
+const viewPayCertificate = (api, id) => Effect.gen(function* () {
+	const { items } = yield* api.applePayCertificates.list();
+	const item = items.find((entry) => entry.id === id);
+	if (!item) return yield* notFound(id, "apple-pay-certificate");
+	return {
+		kind: "apple-pay-certificate",
+		pairs: [
+			["ID", item.id],
+			["Type", "Apple Pay payment processing certificate"],
+			["Merchant identifier", item.merchantIdentifier],
+			["Serial number", item.serialNumber],
+			["Apple team ID", item.appleTeamId],
+			["Valid from", item.validFrom],
+			["Valid until", item.validUntil],
+			["Created", item.createdAt],
+			["Updated", item.updatedAt]
+		],
+		raw: item
+	};
+});
+const viewPassTypeCertificate = (api, id) => Effect.gen(function* () {
+	const { items } = yield* api.applePassTypeCertificates.list();
+	const item = items.find((entry) => entry.id === id);
+	if (!item) return yield* notFound(id, "pass-type-certificate");
+	return {
+		kind: "pass-type-certificate",
+		pairs: [
+			["ID", item.id],
+			["Type", "Wallet Pass Type ID certificate"],
+			["Pass Type ID", item.passTypeIdentifier],
+			["Serial number", item.serialNumber],
+			["Apple team ID", item.appleTeamId],
+			["Valid from", item.validFrom],
+			["Valid until", item.validUntil],
+			["Created", item.createdAt],
+			["Updated", item.updatedAt]
+		],
+		raw: item
+	};
+});
 const viewAscApiKey = (api, id) => Effect.gen(function* () {
 	const { items } = yield* api.ascApiKeys.list();
 	const item = items.find((entry) => entry.id === id);
@@ -29811,6 +30534,9 @@ const lookupByType = (api, id, type) => {
 		case "distribution-certificate": return viewDistributionCertificate(api, id);
 		case "provisioning-profile": return viewProvisioningProfile(api, id);
 		case "push-key": return viewPushKey(api, id);
+		case "push-certificate": return viewPushCertificate(api, id);
+		case "apple-pay-certificate": return viewPayCertificate(api, id);
+		case "pass-type-certificate": return viewPassTypeCertificate(api, id);
 		case "asc-api-key": return viewAscApiKey(api, id);
 		case "keystore": return viewKeystore(api, id);
 		case "google-service-account-key": return viewGoogleServiceAccountKey(api, id);
@@ -31999,6 +32725,20 @@ const persistLink = (projectRoot, projectId, hasExpoConfig) => Effect.gen(functi
 		configPath: filePath
 	};
 });
+/**
+* Scaffold the default `eas.json` build profiles after linking so a freshly
+* `init`ed project can `build` straight away. Only acts when no `build` section
+* exists yet — a project that already defines profiles is left untouched (run
+* `build configure` to top those up). Use `build configure` to re-scaffold.
+*/
+const scaffoldBuildProfiles = (projectRoot) => Effect.gen(function* () {
+	const existing = yield* readEasJsonRaw(projectRoot);
+	const existingBuild = isRecord$1(existing?.["build"]) ? existing["build"] : {};
+	if (Object.keys(existingBuild).length > 0) return [];
+	const result = yield* ensureDefaultBuildProfiles(projectRoot);
+	yield* printHuman(`Scaffolded eas.json with default build profiles: ${result.added.join(", ")}.`);
+	return result.added;
+});
 const initCommand = defineCommand({
 	meta: {
 		name: "init",
@@ -32026,9 +32766,12 @@ const initCommand = defineCommand({
 		if (args.id !== void 0 && args.id.length > 0) {
 			const project = yield* api.projects.get({ path: { id: args.id } });
 			yield* printHuman(`Linking project: ${project.name} (${project.id})`);
+			const linked = yield* persistLink(projectRoot, project.id, hasExpoConfig);
+			const buildProfiles = yield* scaffoldBuildProfiles(projectRoot);
 			return {
 				linked: true,
-				...yield* persistLink(projectRoot, project.id, hasExpoConfig)
+				...linked,
+				buildProfiles
 			};
 		}
 		const { name, slug } = yield* resolveNameAndSlug(args, projectRoot, expoConfig);
@@ -32042,21 +32785,24 @@ const initCommand = defineCommand({
 			limit: 100
 		} });
 		const existing = items.find((project) => project.slug === slug);
+		const linked = yield* persistLink(projectRoot, yield* Effect.gen(function* () {
+			if (existing) {
+				yield* printHuman(`Found existing project: ${existing.name} (${existing.id})`);
+				return existing.id;
+			}
+			yield* printHuman("No existing project found. Creating new project...");
+			const created = yield* api.projects.create({ payload: {
+				name,
+				slug
+			} });
+			yield* printHuman(`Created project: ${created.name} (${created.id})`);
+			return created.id;
+		}), hasExpoConfig);
+		const buildProfiles = yield* scaffoldBuildProfiles(projectRoot);
 		return {
 			linked: true,
-			...yield* persistLink(projectRoot, yield* Effect.gen(function* () {
-				if (existing) {
-					yield* printHuman(`Found existing project: ${existing.name} (${existing.id})`);
-					return existing.id;
-				}
-				yield* printHuman("No existing project found. Creating new project...");
-				const created = yield* api.projects.create({ payload: {
-					name,
-					slug
-				} });
-				yield* printHuman(`Created project: ${created.name} (${created.id})`);
-				return created.id;
-			}), hasExpoConfig)
+			...linked,
+			buildProfiles
 		};
 	}), { json: "value" })
 });
@@ -35873,10 +36619,11 @@ const bootstrapVersionCheck = (currentVersion, installerHint, spawnRefresh, opti
 	if (yield* isOptedOut) return;
 	const versionCheck = yield* VersionCheck;
 	if (options?.quiet !== true) {
-		const cached = yield* versionCheck.cachedLatest;
-		if (cached && isNewerVersion(cached, currentVersion)) {
+		let latest = yield* versionCheck.cachedLatest;
+		if (latest === void 0) latest = yield* versionCheck.fetchLatest;
+		if (latest && isNewerVersion(latest, currentVersion)) {
 			const installer = detectInstallerFromImportMetaUrl(installerHint);
-			yield* Console.error(formatNotice(currentVersion, cached, installCommand(installer)));
+			yield* Console.error(formatNotice(currentVersion, latest, installCommand(installer)));
 		}
 	}
 	if (yield* versionCheck.cacheStale) spawnRefresh();