@better-update/cli 0.37.0 → 0.39.0

package/dist/index.mjs

@@ -20,6 +20,7 @@ import chalk from "chalk";
 import { promisify } from "node:util";
 import ignore from "ignore";
 import os, { tmpdir } from "node:os";
+import { fileURLToPath } from "node:url";
 import { maxBy, uniqBy } from "es-toolkit";
 import forge from "node-forge";
 import { AndroidConfig } from "@expo/config-plugins";
@@ -28,14 +29,13 @@ import { ExpoRunFormatter } from "@expo/xcpretty";
 import { Buffer as Buffer$1 } from "node:buffer";
 import { getFormattedSerialNumber, getX509Certificate, parsePKCS12 } from "@expo/pkcs12";
 import qrcode from "qrcode-terminal";
-import { fileURLToPath } from "node:url";
 
 //#region \0rolldown/runtime.js
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 //#endregion
 //#region package.json
-var version = "0.37.0";
+var version = "0.39.0";
 
 //#endregion
 //#region src/lib/interactive-mode.ts
@@ -425,11 +425,11 @@ const Ciphertext = Schema.String.pipe(Schema.minLength(1)).annotations({ descrip
 const WrappedDek = Schema.String.pipe(Schema.minLength(1)).annotations({ description: "Base64 of the DEK wrapped under the org vault key" });
 /**
 * The secret kinds whose DEK is wrapped under the org vault key — the rows a
-* rotation must re-wrap. Five signing-credential tables plus `envVarValue` (one
+* rotation must re-wrap. Eight signing-credential tables plus `envVarValue` (one
 * row per environment variable value revision). Provisioning profiles are
 * plaintext and are deliberately absent.
 */
-const CredentialType = Schema.Literal("appleDistributionCertificate", "applePushKey", "ascApiKey", "googleServiceAccountKey", "androidUploadKeystore", "envVarValue").annotations({ description: "Which encrypted-secret table a vault-key DEK re-wrap targets" });
+const CredentialType = Schema.Literal("appleDistributionCertificate", "applePushKey", "applePushCertificate", "applePayCertificate", "applePassTypeCertificate", "ascApiKey", "googleServiceAccountKey", "androidUploadKeystore", "envVarValue").annotations({ description: "Which encrypted-secret table a vault-key DEK re-wrap targets" });
 /**
 * The client-encrypted envelope. Spread into each secret credential's upload
 * body and download result alongside that credential's public metadata. The
@@ -665,6 +665,128 @@ var AppleDistributionCertificatesGroup = class extends HttpApiGroup.make("appleD
 	description: "Manage .p12 distribution certificates"
 })) {};
 
+//#endregion
+//#region ../../packages/api/src/domain/apple-pass-type-certificate.ts
+/**
+* Pass Type ID certificate (Wallet passes), bound to a Pass Type ID
+* (`pass.*`). The library has no Pass Type ID API, so these are uploaded
+* manually: the CLI seals the `.p12` (cert + key) and the server stores only the
+* envelope + metadata.
+*/
+var ApplePassTypeCertificate = class extends Schema.Class("ApplePassTypeCertificate")({
+	id: Id,
+	organizationId: Id,
+	appleTeamId: Id,
+	passTypeIdentifier: Schema.String,
+	serialNumber: Schema.String,
+	validFrom: DateTimeString,
+	validUntil: DateTimeString,
+	createdAt: DateTimeString,
+	updatedAt: DateTimeString
+}) {};
+/** Client-encrypted upload: the `.p12` bytes + password are sealed into `ciphertext`. */
+const UploadApplePassTypeCertificateBody = Schema.Struct({
+	id: Id,
+	...encryptedEnvelopeFields,
+	passTypeIdentifier: Schema.String.pipe(Schema.minLength(1), Schema.maxLength(200)),
+	serialNumber: Schema.String.pipe(Schema.minLength(1), Schema.maxLength(200)),
+	appleTeamIdentifier: AppleTeamIdentifier,
+	...appleTeamMetadataFields,
+	validFrom: DateTimeString,
+	validUntil: DateTimeString
+});
+const DeleteApplePassTypeCertificateResult = DeletedResult;
+/** The encrypted envelope (relayed from R2) plus metadata; the CLI decrypts `ciphertext` to recover `{ p12Base64, p12Password }`. */
+const DownloadApplePassTypeCertificateResult = Schema.Struct({
+	id: Id,
+	...encryptedEnvelopeFields,
+	passTypeIdentifier: Schema.String,
+	serialNumber: Schema.String,
+	appleTeamIdentifier: AppleTeamIdentifier,
+	validFrom: DateTimeString,
+	validUntil: DateTimeString
+});
+
+//#endregion
+//#region ../../packages/api/src/groups/apple-pass-type-certificates.ts
+var ApplePassTypeCertificatesGroup = class extends HttpApiGroup.make("applePassTypeCertificates").add(HttpApiEndpoint.get("list", "/api/apple/pass-type-certificates").addSuccess(Schema.Struct({ items: Schema.Array(ApplePassTypeCertificate) })).annotateContext(OpenApi.annotations({
+	title: "List Apple Pass Type ID certificates",
+	description: "List Pass Type ID certificates for the organization"
+}))).add(HttpApiEndpoint.post("upload", "/api/apple/pass-type-certificates").setPayload(UploadApplePassTypeCertificateBody).addSuccess(ApplePassTypeCertificate, { status: 201 }).annotateContext(OpenApi.annotations({
+	title: "Upload Pass Type ID certificate",
+	description: "Upload a Wallet Pass Type ID .p12 certificate"
+}))).add(HttpApiEndpoint.del("delete")`/api/apple/pass-type-certificates/${idParam}`.addSuccess(DeleteApplePassTypeCertificateResult).annotateContext(OpenApi.annotations({
+	title: "Delete Pass Type ID certificate",
+	description: "Remove a stored Pass Type ID certificate"
+}))).add(HttpApiEndpoint.get("download")`/api/apple/pass-type-certificates/${idParam}/download`.addSuccess(DownloadApplePassTypeCertificateResult).annotateContext(OpenApi.annotations({
+	title: "Download Pass Type ID certificate",
+	description: "Fetch the decrypted .p12 Pass Type ID certificate for local use (audit-logged)"
+}))).addError(NotFound).addError(Conflict).addError(BadRequest).addError(Forbidden).annotateContext(OpenApi.annotations({
+	title: "Apple Pass Type ID Certificates",
+	description: "Manage Wallet Pass Type ID certificates"
+})) {};
+
+//#endregion
+//#region ../../packages/api/src/domain/apple-pay-certificate.ts
+/**
+* Apple Pay Payment Processing certificate, bound to a Merchant ID
+* (`merchant.*`). The library cannot create these (no portal cert type), so they
+* are uploaded manually: the CLI seals the `.p12` (cert + key) and the server
+* stores only the envelope + metadata.
+*/
+var ApplePayCertificate = class extends Schema.Class("ApplePayCertificate")({
+	id: Id,
+	organizationId: Id,
+	appleTeamId: Id,
+	merchantIdentifier: Schema.String,
+	serialNumber: Schema.String,
+	validFrom: DateTimeString,
+	validUntil: DateTimeString,
+	createdAt: DateTimeString,
+	updatedAt: DateTimeString
+}) {};
+/** Client-encrypted upload: the `.p12` bytes + password are sealed into `ciphertext`. */
+const UploadApplePayCertificateBody = Schema.Struct({
+	id: Id,
+	...encryptedEnvelopeFields,
+	merchantIdentifier: Schema.String.pipe(Schema.minLength(1), Schema.maxLength(200)),
+	serialNumber: Schema.String.pipe(Schema.minLength(1), Schema.maxLength(200)),
+	appleTeamIdentifier: AppleTeamIdentifier,
+	...appleTeamMetadataFields,
+	validFrom: DateTimeString,
+	validUntil: DateTimeString
+});
+const DeleteApplePayCertificateResult = DeletedResult;
+/** The encrypted envelope (relayed from R2) plus metadata; the CLI decrypts `ciphertext` to recover `{ p12Base64, p12Password }`. */
+const DownloadApplePayCertificateResult = Schema.Struct({
+	id: Id,
+	...encryptedEnvelopeFields,
+	merchantIdentifier: Schema.String,
+	serialNumber: Schema.String,
+	appleTeamIdentifier: AppleTeamIdentifier,
+	validFrom: DateTimeString,
+	validUntil: DateTimeString
+});
+
+//#endregion
+//#region ../../packages/api/src/groups/apple-pay-certificates.ts
+var ApplePayCertificatesGroup = class extends HttpApiGroup.make("applePayCertificates").add(HttpApiEndpoint.get("list", "/api/apple/pay-certificates").addSuccess(Schema.Struct({ items: Schema.Array(ApplePayCertificate) })).annotateContext(OpenApi.annotations({
+	title: "List Apple Pay certificates",
+	description: "List Apple Pay payment processing certificates for the organization"
+}))).add(HttpApiEndpoint.post("upload", "/api/apple/pay-certificates").setPayload(UploadApplePayCertificateBody).addSuccess(ApplePayCertificate, { status: 201 }).annotateContext(OpenApi.annotations({
+	title: "Upload Apple Pay certificate",
+	description: "Upload an Apple Pay payment processing .p12 certificate"
+}))).add(HttpApiEndpoint.del("delete")`/api/apple/pay-certificates/${idParam}`.addSuccess(DeleteApplePayCertificateResult).annotateContext(OpenApi.annotations({
+	title: "Delete Apple Pay certificate",
+	description: "Remove a stored Apple Pay payment processing certificate"
+}))).add(HttpApiEndpoint.get("download")`/api/apple/pay-certificates/${idParam}/download`.addSuccess(DownloadApplePayCertificateResult).annotateContext(OpenApi.annotations({
+	title: "Download Apple Pay certificate",
+	description: "Fetch the decrypted .p12 Apple Pay certificate for local use (audit-logged)"
+}))).addError(NotFound).addError(Conflict).addError(BadRequest).addError(Forbidden).annotateContext(OpenApi.annotations({
+	title: "Apple Pay Certificates",
+	description: "Manage Apple Pay payment processing certificates"
+})) {};
+
 //#endregion
 //#region ../../packages/api/src/domain/apple-provisioning-profile.ts
 const DistributionType = Schema.Literal("APP_STORE", "AD_HOC", "ENTERPRISE", "DEVELOPMENT");
@@ -722,6 +844,71 @@ var AppleProvisioningProfilesGroup = class extends HttpApiGroup.make("appleProvi
 	description: "Manage .mobileprovision profiles (upload or generate)"
 })) {};
 
+//#endregion
+//#region ../../packages/api/src/domain/apple-push-certificate.ts
+/**
+* Legacy APNs Push Services SSL certificate (the `.cer`/`.p12` push cert, distinct
+* from the modern `.p8` token key in `apple-push-key.ts`). Bound to a single App
+* ID (`bundleIdentifier`) rather than a whole team. The production cert serves
+* both the sandbox and production APNs environments.
+*/
+var ApplePushCertificate = class extends Schema.Class("ApplePushCertificate")({
+	id: Id,
+	organizationId: Id,
+	appleTeamId: Id,
+	bundleIdentifier: Schema.String,
+	serialNumber: Schema.String,
+	validFrom: DateTimeString,
+	validUntil: DateTimeString,
+	createdAt: DateTimeString,
+	updatedAt: DateTimeString
+}) {};
+/**
+* Client-encrypted upload: the `.p12` bytes + password are sealed into
+* `ciphertext` (the CLI parses the cert locally to fill the metadata below);
+* the server stores the envelope and metadata and never sees the plaintext.
+*/
+const UploadApplePushCertificateBody = Schema.Struct({
+	id: Id,
+	...encryptedEnvelopeFields,
+	bundleIdentifier: Schema.String.pipe(Schema.minLength(1), Schema.maxLength(200)),
+	serialNumber: Schema.String.pipe(Schema.minLength(1), Schema.maxLength(200)),
+	appleTeamIdentifier: AppleTeamIdentifier,
+	...appleTeamMetadataFields,
+	validFrom: DateTimeString,
+	validUntil: DateTimeString
+});
+const DeleteApplePushCertificateResult = DeletedResult;
+/** The encrypted envelope (relayed from R2) plus server-visible metadata; the CLI decrypts `ciphertext` to recover `{ p12Base64, p12Password }`. */
+const DownloadApplePushCertificateResult = Schema.Struct({
+	id: Id,
+	...encryptedEnvelopeFields,
+	bundleIdentifier: Schema.String,
+	serialNumber: Schema.String,
+	appleTeamIdentifier: AppleTeamIdentifier,
+	validFrom: DateTimeString,
+	validUntil: DateTimeString
+});
+
+//#endregion
+//#region ../../packages/api/src/groups/apple-push-certificates.ts
+var ApplePushCertificatesGroup = class extends HttpApiGroup.make("applePushCertificates").add(HttpApiEndpoint.get("list", "/api/apple/push-certificates").addSuccess(Schema.Struct({ items: Schema.Array(ApplePushCertificate) })).annotateContext(OpenApi.annotations({
+	title: "List Apple push certificates",
+	description: "List APNs push SSL certificates for the organization"
+}))).add(HttpApiEndpoint.post("upload", "/api/apple/push-certificates").setPayload(UploadApplePushCertificateBody).addSuccess(ApplePushCertificate, { status: 201 }).annotateContext(OpenApi.annotations({
+	title: "Upload push certificate",
+	description: "Upload an APNs Push Services .p12 SSL certificate"
+}))).add(HttpApiEndpoint.del("delete")`/api/apple/push-certificates/${idParam}`.addSuccess(DeleteApplePushCertificateResult).annotateContext(OpenApi.annotations({
+	title: "Delete push certificate",
+	description: "Remove a stored APNs push SSL certificate"
+}))).add(HttpApiEndpoint.get("download")`/api/apple/push-certificates/${idParam}/download`.addSuccess(DownloadApplePushCertificateResult).annotateContext(OpenApi.annotations({
+	title: "Download push certificate",
+	description: "Fetch the decrypted .p12 push certificate for local use (audit-logged)"
+}))).addError(NotFound).addError(Conflict).addError(BadRequest).addError(Forbidden).annotateContext(OpenApi.annotations({
+	title: "Apple Push Certificates",
+	description: "Manage APNs Push Services SSL certificates"
+})) {};
+
 //#endregion
 //#region ../../packages/api/src/domain/apple-push-key.ts
 const ApplePushKeyId = tenCharPortalId("Push Key ID");
@@ -2550,7 +2737,7 @@ var WebhooksGroup = class extends HttpApiGroup.make("webhooks").add(HttpApiEndpo
 
 //#endregion
 //#region ../../packages/api/src/api.ts
-var ManagementApi = class extends HttpApi.make("management-api").add(ProjectsGroup).add(BranchesGroup).add(ChannelsGroup).add(EnvironmentsGroup).add(UpdatesGroup).add(AssetsGroup).add(AnalyticsGroup).add(BuildsGroup).add(RuntimesGroup).add(EnvVarsGroup).add(FingerprintsGroup).add(AuditLogsGroup).add(DevicesGroup).add(AppleTeamsGroup).add(AppleDistributionCertificatesGroup).add(ApplePushKeysGroup).add(AscApiKeysGroup).add(AppleProvisioningProfilesGroup).add(GoogleServiceAccountKeysGroup).add(IosBundleConfigurationsGroup).add(IosAppMetadataGroup).add(SubmissionsGroup).add(AndroidApplicationIdentifiersGroup).add(AndroidUploadKeystoresGroup).add(AndroidBuildCredentialsGroup).add(BuildCredentialsGroup).add(UserEncryptionKeysGroup).add(OrgVaultGroup).add(MeGroup).add(WebhooksGroup).add(PoliciesGroup).add(GroupsGroup).add(PolicyAttachmentsGroup).add(ApiKeysGroup).add(InvitationsGroup).add(MembersGroup).add(OrganizationGroup).add(AdminGroup).middleware(Authentication).annotateContext(OpenApi.annotations({
+var ManagementApi = class extends HttpApi.make("management-api").add(ProjectsGroup).add(BranchesGroup).add(ChannelsGroup).add(EnvironmentsGroup).add(UpdatesGroup).add(AssetsGroup).add(AnalyticsGroup).add(BuildsGroup).add(RuntimesGroup).add(EnvVarsGroup).add(FingerprintsGroup).add(AuditLogsGroup).add(DevicesGroup).add(AppleTeamsGroup).add(AppleDistributionCertificatesGroup).add(ApplePushKeysGroup).add(ApplePushCertificatesGroup).add(ApplePayCertificatesGroup).add(ApplePassTypeCertificatesGroup).add(AscApiKeysGroup).add(AppleProvisioningProfilesGroup).add(GoogleServiceAccountKeysGroup).add(IosBundleConfigurationsGroup).add(IosAppMetadataGroup).add(SubmissionsGroup).add(AndroidApplicationIdentifiersGroup).add(AndroidUploadKeystoresGroup).add(AndroidBuildCredentialsGroup).add(BuildCredentialsGroup).add(UserEncryptionKeysGroup).add(OrgVaultGroup).add(MeGroup).add(WebhooksGroup).add(PoliciesGroup).add(GroupsGroup).add(PolicyAttachmentsGroup).add(ApiKeysGroup).add(InvitationsGroup).add(MembersGroup).add(OrganizationGroup).add(AdminGroup).middleware(Authentication).annotateContext(OpenApi.annotations({
 	title: "Better Update Management API",
 	version: "1.0.0",
 	description: "Management API for OTA update publishing, deployment, and analytics"
@@ -3567,8 +3754,9 @@ const VaultCacheLive = Layer.effect(VaultCache, Effect.gen(function* () {
 //#endregion
 //#region src/services/version-check.ts
 const NPM_REGISTRY_URL = "https://registry.npmjs.org/@better-update/cli/latest";
-const CACHE_TTL_MS = 1440 * 60 * 1e3;
+const CACHE_TTL_MS = 300 * 1e3;
 const REFRESH_TIMEOUT_MS = 3e3;
+const FOREGROUND_TIMEOUT_MS = 1500;
 var VersionCheck = class extends Context.Tag("cli/VersionCheck")() {};
 const VersionCheckLive = Layer.effect(VersionCheck, Effect.gen(function* () {
 	const fs = yield* FileSystem.FileSystem;
@@ -3588,6 +3776,20 @@ const VersionCheckLive = Layer.effect(VersionCheck, Effect.gen(function* () {
 			checkedAt: parsed["checkedAt"]
 		};
 	});
+	const fetchAndCache = (timeoutMs) => Effect.gen(function* () {
+		const request = HttpClientRequest.get(NPM_REGISTRY_URL).pipe(HttpClientRequest.setHeader("accept", "application/json"));
+		const response = yield* httpClient.execute(request);
+		if (response.status < 200 || response.status >= 300) return;
+		const body = yield* response.json;
+		if (!isRecord$1(body) || typeof body["version"] !== "string") return;
+		const latest = body["version"];
+		yield* fs.makeDirectory(cacheDir, { recursive: true });
+		yield* fs.writeFileString(cacheFile, `${JSON.stringify({
+			latest,
+			checkedAt: Date.now()
+		}, null, 2)}\n`);
+		return latest;
+	}).pipe(Effect.timeout(timeoutMs), Effect.catchAll(() => Effect.succeed(void 0)));
 	return {
 		cachedLatest: readCache.pipe(Effect.map((entry) => entry?.latest)),
 		cacheStale: readCache.pipe(Effect.map((entry) => {
@@ -3595,19 +3797,8 @@ const VersionCheckLive = Layer.effect(VersionCheck, Effect.gen(function* () {
 			const elapsed = Date.now() - entry.checkedAt;
 			return elapsed < 0 || elapsed > CACHE_TTL_MS;
 		})),
-		refreshCache: Effect.gen(function* () {
-			const request = HttpClientRequest.get(NPM_REGISTRY_URL).pipe(HttpClientRequest.setHeader("accept", "application/json"));
-			const response = yield* httpClient.execute(request);
-			if (response.status < 200 || response.status >= 300) return;
-			const body = yield* response.json;
-			if (!isRecord$1(body) || typeof body["version"] !== "string") return;
-			const latest = body["version"];
-			yield* fs.makeDirectory(cacheDir, { recursive: true });
-			yield* fs.writeFileString(cacheFile, `${JSON.stringify({
-				latest,
-				checkedAt: Date.now()
-			}, null, 2)}\n`);
-		}).pipe(Effect.timeout(REFRESH_TIMEOUT_MS), Effect.catchAll(() => Effect.void))
+		fetchLatest: fetchAndCache(FOREGROUND_TIMEOUT_MS),
+		refreshCache: fetchAndCache(REFRESH_TIMEOUT_MS).pipe(Effect.asVoid)
 	};
 }));
 
@@ -4535,6 +4726,79 @@ const writeEasJsonPatch = (projectRoot, patch) => Effect.gen(function* () {
 	return filePath;
 });
 /**
+* Default `build` profiles scaffolded by `init` / `build configure`. Mirrors the
+* EAS three-tier convention: `development` (dev-client, internal), `preview`
+* (internal QA) and `production` (store). Keep in sync with the build-profile
+* derivation in `build-profile.ts` (e.g. `distribution: "internal"` → ad-hoc).
+*/
+const DEFAULT_BUILD_PROFILES = {
+	development: {
+		developmentClient: true,
+		distribution: "internal",
+		channel: "development",
+		environment: "development",
+		android: { format: "apk" }
+	},
+	preview: {
+		distribution: "internal",
+		channel: "preview",
+		environment: "preview",
+		android: { format: "apk" }
+	},
+	production: {
+		channel: "production",
+		environment: "production",
+		android: { format: "aab" }
+	}
+};
+const DEFAULT_PROFILE_NAMES = [
+	"development",
+	"preview",
+	"production"
+];
+/** Full default `eas.json` body (cli pin + the three default build profiles). */
+const DEFAULT_EAS_JSON = {
+	cli: { version: ">= 7.0.0" },
+	build: DEFAULT_BUILD_PROFILES
+};
+/**
+* Ensure `eas.json` carries the default build profiles. Creates the file with
+* the full default template when absent; otherwise tops up only the missing
+* default profiles, preserving every existing profile and top-level key
+* (`projectId`, `projectType`, `submit`, …). Never overwrites a profile that is
+* already defined — call sites wanting a hard reset write `DEFAULT_EAS_JSON`.
+*/
+const ensureDefaultBuildProfiles = (projectRoot) => Effect.gen(function* () {
+	const existing = yield* readEasJsonRaw(projectRoot);
+	if (existing === void 0) return {
+		path: yield* writeEasJsonPatch(projectRoot, DEFAULT_EAS_JSON),
+		action: "created",
+		added: [...DEFAULT_PROFILE_NAMES]
+	};
+	const existingBuild = isRecord$1(existing["build"]) ? existing["build"] : {};
+	const missing = DEFAULT_PROFILE_NAMES.filter((name) => !(name in existingBuild));
+	if (missing.length === 0) return {
+		path: easJsonPath(projectRoot),
+		action: "noop",
+		added: []
+	};
+	const additions = Object.fromEntries(missing.map((name) => [name, DEFAULT_BUILD_PROFILES[name]]));
+	return {
+		path: yield* writeEasJsonPatch(projectRoot, existing["cli"] === void 0 ? {
+			cli: DEFAULT_EAS_JSON.cli,
+			build: {
+				...existingBuild,
+				...additions
+			}
+		} : { build: {
+			...existingBuild,
+			...additions
+		} }),
+		action: "topped-up",
+		added: missing
+	};
+});
+/**
 * Resolve the linked project id from `eas.json`'s top-level `projectId`, or
 * `undefined` when the file is absent / has no usable value.
 */
@@ -19871,38 +20135,6 @@ const acquireBuildTempDir = Effect.gen(function* () {
 	return dir;
 });
 
-//#endregion
-//#region src/lib/asc-credentials.ts
-/**
-* Fetch an ASC API key and decrypt its `.p8` PEM locally. The server is
-* zero-knowledge: `getCredentials` returns the encrypted envelope, so the CLI
-* unwraps it here before talking to Apple. The unlock passphrase is resolved
-* lazily — prompted for a file identity, none for the CI env key.
-*/
-const fetchAscCredentials = (api, ascApiKeyId) => Effect.gen(function* () {
-	const data = yield* api.ascApiKeys.getCredentials({ path: { id: ascApiKeyId } });
-	const { p8Pem } = yield* openFromDownload({
-		session: yield* openVaultSessionInteractive(api),
-		credentialType: "asc-api-key",
-		downloaded: {
-			id: data.ascApiKeyId,
-			ciphertext: data.ciphertext,
-			wrappedDek: data.wrappedDek,
-			vaultVersion: data.vaultVersion,
-			keyId: data.keyId,
-			issuerId: data.issuerId
-		}
-	});
-	if (typeof p8Pem !== "string") return yield* new IdentityError({ message: `Decrypted ASC API key ${ascApiKeyId} is missing its .p8 PEM.` });
-	return {
-		ascApiKeyId: data.ascApiKeyId,
-		keyId: data.keyId,
-		issuerId: data.issuerId,
-		appleTeamIdentifier: data.appleTeamIdentifier,
-		p8Pem
-	};
-});
-
 //#endregion
 //#region src/lib/google-play.ts
 var GooglePlayAuthError = class extends Schema.TaggedError()("GooglePlayAuthError", {
@@ -20135,18 +20367,29 @@ const uploadBundle = (params) => Effect.gen(function* () {
 		cause
 	})));
 });
+/**
+* Build the track release object. Google Play accepts `userFraction` only for a
+* staged (`inProgress`) rollout and rejects it for `completed`/`draft`/`halted`,
+* so the fraction is gated on the status rather than passed through blindly.
+*/
+const buildTrackRelease = (params) => ({
+	status: params.releaseStatus,
+	versionCodes: [String(params.versionCode)],
+	...compact({
+		userFraction: params.releaseStatus === "inProgress" ? toOptional(params.rollout) : void 0,
+		releaseNotes: params.releaseNotes ? [{
+			language: "en-US",
+			text: params.releaseNotes
+		}] : void 0
+	})
+});
 const updateTrack = (params) => {
-	const release = {
-		status: params.releaseStatus,
-		versionCodes: [String(params.versionCode)],
-		...compact({
-			userFraction: toOptional(params.rollout),
-			releaseNotes: params.releaseNotes ? [{
-				language: "en-US",
-				text: params.releaseNotes
-			}] : void 0
-		})
-	};
+	const release = buildTrackRelease({
+		releaseStatus: params.releaseStatus,
+		versionCode: params.versionCode,
+		rollout: params.rollout,
+		releaseNotes: params.releaseNotes
+	});
 	return callJsonRaw({
 		url: `${ANDROID_PUBLISHER_BASE}/androidpublisher/v3/applications/${encodeURIComponent(params.packageName)}/edits/${encodeURIComponent(params.editId)}/tracks/${encodeURIComponent(params.track)}`,
 		method: "PUT",
@@ -20165,6 +20408,624 @@ const commitEdit = (params) => callJsonRaw({
 	label: "edits.commit"
 });
 
+//#endregion
+//#region src/lib/asc-credentials.ts
+/**
+* Fetch an ASC API key and decrypt its `.p8` PEM locally. The server is
+* zero-knowledge: `getCredentials` returns the encrypted envelope, so the CLI
+* unwraps it here before talking to Apple. The unlock passphrase is resolved
+* lazily — prompted for a file identity, none for the CI env key.
+*/
+const fetchAscCredentials = (api, ascApiKeyId) => Effect.gen(function* () {
+	const data = yield* api.ascApiKeys.getCredentials({ path: { id: ascApiKeyId } });
+	const { p8Pem } = yield* openFromDownload({
+		session: yield* openVaultSessionInteractive(api),
+		credentialType: "asc-api-key",
+		downloaded: {
+			id: data.ascApiKeyId,
+			ciphertext: data.ciphertext,
+			wrappedDek: data.wrappedDek,
+			vaultVersion: data.vaultVersion,
+			keyId: data.keyId,
+			issuerId: data.issuerId
+		}
+	});
+	if (typeof p8Pem !== "string") return yield* new IdentityError({ message: `Decrypted ASC API key ${ascApiKeyId} is missing its .p8 PEM.` });
+	return {
+		ascApiKeyId: data.ascApiKeyId,
+		keyId: data.keyId,
+		issuerId: data.issuerId,
+		appleTeamIdentifier: data.appleTeamIdentifier,
+		p8Pem
+	};
+});
+
+//#endregion
+//#region src/lib/apple-pem.ts
+const PEM_HEADER = "-----BEGIN PRIVATE KEY-----";
+const PEM_FOOTER = "-----END PRIVATE KEY-----";
+const pemToPkcs8Der = (pem) => {
+	const normalized = pem.replaceAll("\r\n", "\n").trim();
+	const start = normalized.indexOf(PEM_HEADER);
+	const end = normalized.indexOf(PEM_FOOTER);
+	if (start === -1 || end === -1 || end <= start) return null;
+	const body = normalized.slice(start + 27, end).replaceAll(/\s+/gu, "").trim();
+	if (body.length === 0) return null;
+	try {
+		return fromBase64(body);
+	} catch {
+		return null;
+	}
+};
+
+//#endregion
+//#region src/lib/apple-asc-jwt.ts
+var AppleAuthError = class extends Data.TaggedError("AppleAuthError") {};
+const MAX_JWT_LIFETIME_SECONDS = 1200;
+const asArrayBuffer = (bytes) => {
+	const buffer = new ArrayBuffer(bytes.byteLength);
+	new Uint8Array(buffer).set(bytes);
+	return buffer;
+};
+const signAscJwt = (credentials) => Effect.gen(function* () {
+	const der = pemToPkcs8Der(credentials.p8Pem);
+	if (der === null) return yield* new AppleAuthError({ cause: /* @__PURE__ */ new Error("Invalid .p8 PEM") });
+	const header = {
+		alg: "ES256",
+		kid: credentials.keyId,
+		typ: "JWT"
+	};
+	const now = Math.floor(Date.now() / 1e3);
+	const payload = {
+		iss: credentials.issuerId,
+		iat: now,
+		exp: now + MAX_JWT_LIFETIME_SECONDS,
+		aud: "appstoreconnect-v1"
+	};
+	const signingInput = `${toBase64Url(new TextEncoder().encode(JSON.stringify(header)))}.${toBase64Url(new TextEncoder().encode(JSON.stringify(payload)))}`;
+	const key = yield* Effect.tryPromise({
+		try: async () => crypto.subtle.importKey("pkcs8", asArrayBuffer(der), {
+			name: "ECDSA",
+			namedCurve: "P-256"
+		}, false, ["sign"]),
+		catch: (cause) => new AppleAuthError({ cause })
+	});
+	const signature = yield* Effect.tryPromise({
+		try: async () => crypto.subtle.sign({
+			name: "ECDSA",
+			hash: "SHA-256"
+		}, key, new TextEncoder().encode(signingInput)),
+		catch: (cause) => new AppleAuthError({ cause })
+	});
+	return `${signingInput}.${toBase64Url(new Uint8Array(signature))}`;
+});
+
+//#endregion
+//#region src/lib/apple-asc-client.ts
+/**
+* App Store Connect REST client authenticated with an ASC **API key** — a JWT
+* signed from a `.p8` private key (see `apple-asc-jwt.ts`). Credentials are
+* resolved non-interactively from the server (`fetchAscCredentials`), so this
+* powers headless flows: build-credential resolution, provisioning-profile
+* generation, and device sync.
+*
+* Intentionally NOT built on `@expo/apple-utils`: that library authenticates
+* via an interactive Apple-ID **cookie session** (username/password + 2FA, see
+* `services/apple-auth.ts`) and exposes a cookie-based `RequestContext`. That is
+* a different auth model that would force an interactive login here. The two
+* coexist by design — apple-utils backs `apple login`; this client backs
+* non-interactive ASC API-key access.
+*/
+var AscApiError = class extends Data.TaggedError("AscApiError") {};
+var AscNetworkError = class extends Data.TaggedError("AscNetworkError") {};
+const API_BASE = "https://api.appstoreconnect.apple.com";
+const extractErrors = (body) => {
+	if (!isRecord$1(body) || !Array.isArray(body["errors"])) return [];
+	return body["errors"].filter((value) => isRecord$1(value));
+};
+const parseApiError = (response, body, raw) => {
+	const [first] = extractErrors(body);
+	return new AscApiError({
+		status: response.status,
+		message: first?.detail ?? first?.title ?? response.statusText,
+		code: first?.code,
+		raw
+	});
+};
+const fetchRaw = (jwt, path, init) => Effect.gen(function* () {
+	const response = yield* Effect.tryPromise({
+		try: async () => fetch(`${API_BASE}${path}`, compact({
+			method: init?.method ?? "GET",
+			body: init?.body,
+			headers: {
+				authorization: `Bearer ${jwt}`,
+				"content-type": "application/json",
+				accept: "application/json"
+			}
+		})),
+		catch: (cause) => new AscNetworkError({ cause })
+	});
+	const text = yield* Effect.tryPromise({
+		try: async () => response.text(),
+		catch: (cause) => new AscNetworkError({ cause })
+	});
+	const body = yield* Effect.try({
+		try: () => text.length === 0 ? {} : JSON.parse(text),
+		catch: (cause) => new AscNetworkError({ cause })
+	});
+	if (!response.ok) return yield* parseApiError(response, body, text);
+	return body;
+});
+const toAscCertificate = (value) => {
+	if (!isRecord$1(value)) return null;
+	const { id, attributes } = value;
+	if (typeof id !== "string" || !isRecord$1(attributes)) return null;
+	const { serialNumber, certificateType, expirationDate, certificateContent, displayName } = attributes;
+	if (typeof serialNumber !== "string" || typeof certificateType !== "string" || typeof expirationDate !== "string") return null;
+	return {
+		id,
+		serialNumber,
+		certificateType,
+		expirationDate,
+		certificateContent: typeof certificateContent === "string" ? certificateContent : null,
+		displayName: typeof displayName === "string" ? displayName : null
+	};
+};
+const toAscBundleId = (value) => {
+	if (!isRecord$1(value)) return null;
+	const { id, attributes } = value;
+	if (typeof id !== "string" || !isRecord$1(attributes)) return null;
+	const { identifier, name } = attributes;
+	if (typeof identifier !== "string" || typeof name !== "string") return null;
+	return {
+		id,
+		identifier,
+		name
+	};
+};
+const PROFILE_TYPES = [
+	"IOS_APP_ADHOC",
+	"IOS_APP_DEVELOPMENT",
+	"IOS_APP_STORE",
+	"IOS_APP_INHOUSE"
+];
+const asProfileType = (value) => {
+	const match = PROFILE_TYPES.find((entry) => entry === value);
+	return match === void 0 ? null : match;
+};
+const toAscProfile = (value) => {
+	if (!isRecord$1(value)) return null;
+	const { id, attributes } = value;
+	if (typeof id !== "string" || !isRecord$1(attributes)) return null;
+	const { name, uuid, expirationDate, profileContent } = attributes;
+	const profileType = asProfileType(attributes["profileType"]);
+	if (typeof name !== "string" || typeof uuid !== "string" || typeof expirationDate !== "string" || typeof profileContent !== "string" || profileType === null) return null;
+	return {
+		id,
+		name,
+		uuid,
+		expirationDate,
+		profileContent,
+		profileType
+	};
+};
+const toAscDevice = (value) => {
+	if (!isRecord$1(value)) return null;
+	const { id, attributes } = value;
+	if (typeof id !== "string" || !isRecord$1(attributes)) return null;
+	const { udid, name, deviceClass } = attributes;
+	if (typeof udid !== "string" || typeof name !== "string") return null;
+	return {
+		id,
+		udid,
+		name,
+		deviceClass: typeof deviceClass === "string" ? deviceClass : null
+	};
+};
+const extractList = (body, map) => {
+	if (!isRecord$1(body) || !Array.isArray(body["data"])) return [];
+	return body["data"].map(map).filter((value) => value !== null);
+};
+const extractSingle = (body, map) => {
+	if (!isRecord$1(body)) return null;
+	return map(body["data"]);
+};
+/**
+* App Store Connect paginates list responses (default 200/page) and returns the
+* absolute URL of the next page under `links.next`. Strip the base so it can be
+* fed back into `fetchRaw`; return null when there is no further page.
+*/
+const nextPagePath = (body) => {
+	if (!isRecord$1(body)) return null;
+	const { links } = body;
+	if (!isRecord$1(links) || typeof links["next"] !== "string") return null;
+	const { next } = links;
+	return next.startsWith(API_BASE) ? next.slice(37) : next;
+};
+const malformed = (resource) => new AscApiError({
+	status: 500,
+	message: `Malformed ${resource} response`,
+	code: void 0,
+	raw: ""
+});
+const withJwt = (credentials, fn) => Effect.gen(function* () {
+	return yield* fn(yield* signAscJwt(credentials));
+});
+const listCertificates = (credentials, params) => withJwt(credentials, (jwt) => Effect.gen(function* () {
+	return extractList(yield* fetchRaw(jwt, `/v1/certificates${params?.certificateType ? `?filter[certificateType]=${params.certificateType}&limit=200` : "?limit=200"}`), toAscCertificate);
+}));
+const createCertificate = (credentials, params) => withJwt(credentials, (jwt) => Effect.gen(function* () {
+	const csrContent = params.csrPem.replaceAll("-----BEGIN CERTIFICATE REQUEST-----", "").replaceAll("-----END CERTIFICATE REQUEST-----", "").replaceAll(/\s+/gu, "");
+	const resource = extractSingle(yield* fetchRaw(jwt, "/v1/certificates", {
+		method: "POST",
+		body: JSON.stringify({ data: {
+			type: "certificates",
+			attributes: {
+				csrContent,
+				certificateType: params.certificateType
+			}
+		} })
+	}), toAscCertificate);
+	if (resource === null) return yield* malformed("certificate");
+	return resource;
+}));
+const deleteCertificate = (credentials, id) => withJwt(credentials, (jwt) => Effect.asVoid(fetchRaw(jwt, `/v1/certificates/${encodeURIComponent(id)}`, { method: "DELETE" })));
+const listBundleIds = (credentials) => withJwt(credentials, (jwt) => Effect.gen(function* () {
+	return extractList(yield* fetchRaw(jwt, "/v1/bundleIds?limit=200"), toAscBundleId);
+}));
+const createBundleId = (credentials, params) => withJwt(credentials, (jwt) => Effect.gen(function* () {
+	const resource = extractSingle(yield* fetchRaw(jwt, "/v1/bundleIds", {
+		method: "POST",
+		body: JSON.stringify({ data: {
+			type: "bundleIds",
+			attributes: {
+				identifier: params.identifier,
+				name: params.name,
+				platform: "IOS"
+			}
+		} })
+	}), toAscBundleId);
+	if (resource === null) return yield* malformed("bundleId");
+	return resource;
+}));
+const listDevices = (credentials) => withJwt(credentials, (jwt) => Effect.gen(function* () {
+	const devices = [];
+	let path = "/v1/devices?limit=200";
+	while (path !== null) {
+		const body = yield* fetchRaw(jwt, path);
+		devices.push(...extractList(body, toAscDevice));
+		path = nextPagePath(body);
+	}
+	return devices;
+}));
+const createDevice = (credentials, params) => withJwt(credentials, (jwt) => Effect.gen(function* () {
+	const resource = extractSingle(yield* fetchRaw(jwt, "/v1/devices", {
+		method: "POST",
+		body: JSON.stringify({ data: {
+			type: "devices",
+			attributes: {
+				name: params.name,
+				udid: params.udid,
+				platform: "IOS"
+			}
+		} })
+	}), toAscDevice);
+	if (resource === null) return yield* malformed("device");
+	return resource;
+}));
+const createProvisioningProfile = (credentials, params) => withJwt(credentials, (jwt) => Effect.gen(function* () {
+	const relationships = {
+		bundleId: { data: {
+			type: "bundleIds",
+			id: params.bundleIdAscId
+		} },
+		certificates: { data: params.certificateAscIds.map((id) => ({
+			type: "certificates",
+			id
+		})) },
+		...params.deviceAscIds.length > 0 ? { devices: { data: params.deviceAscIds.map((id) => ({
+			type: "devices",
+			id
+		})) } } : {}
+	};
+	const resource = extractSingle(yield* fetchRaw(jwt, "/v1/profiles", {
+		method: "POST",
+		body: JSON.stringify({ data: {
+			type: "profiles",
+			attributes: {
+				name: params.profileName,
+				profileType: params.profileType
+			},
+			relationships
+		} })
+	}), toAscProfile);
+	if (resource === null) return yield* malformed("profile");
+	return resource;
+}));
+const isCertificateLimitError = (error) => {
+	if (error._tag !== "AscApiError") return false;
+	return /already have a current.*certificate|pending certificate request/iu.test(error.message);
+};
+
+//#endregion
+//#region src/lib/apple-asc-testflight.ts
+/**
+* App Store Connect TestFlight operations layered on the ASC API-key client
+* ({@link ./apple-asc-client}). Used by the iOS submit flow to configure a build
+* *after* `altool` uploads it: set the "What to Test" text and assign the build
+* to internal beta groups — matching `eas submit`'s post-upload behaviour.
+*/
+const toAscApp = (value) => {
+	if (!isRecord$1(value)) return null;
+	const { id, attributes } = value;
+	if (typeof id !== "string") return null;
+	const attrs = isRecord$1(attributes) ? attributes : {};
+	return {
+		id,
+		bundleId: typeof attrs["bundleId"] === "string" ? attrs["bundleId"] : null,
+		name: typeof attrs["name"] === "string" ? attrs["name"] : null
+	};
+};
+const toAscBuild = (value) => {
+	if (!isRecord$1(value)) return null;
+	const { id, attributes } = value;
+	if (typeof id !== "string") return null;
+	const attrs = isRecord$1(attributes) ? attributes : {};
+	return {
+		id,
+		version: typeof attrs["version"] === "string" ? attrs["version"] : null,
+		uploadedDate: typeof attrs["uploadedDate"] === "string" ? attrs["uploadedDate"] : null,
+		processingState: typeof attrs["processingState"] === "string" ? attrs["processingState"] : null
+	};
+};
+const toAscBetaGroup = (value) => {
+	if (!isRecord$1(value)) return null;
+	const { id, attributes } = value;
+	if (typeof id !== "string" || !isRecord$1(attributes)) return null;
+	const { name, isInternalGroup } = attributes;
+	if (typeof name !== "string") return null;
+	return {
+		id,
+		name,
+		isInternal: isInternalGroup === true
+	};
+};
+const toAscBetaBuildLocalization = (value) => {
+	if (!isRecord$1(value)) return null;
+	const { id, attributes } = value;
+	if (typeof id !== "string" || !isRecord$1(attributes)) return null;
+	const { locale, whatsNew } = attributes;
+	if (typeof locale !== "string") return null;
+	return {
+		id,
+		locale,
+		whatsNew: typeof whatsNew === "string" ? whatsNew : null
+	};
+};
+/** Classify a raw `processingState`. Unknown/absent states stay `processing`
+* so the poller keeps waiting rather than failing early. */
+const classifyProcessingState = (state) => {
+	if (state === "VALID") return "valid";
+	if (state === "FAILED" || state === "INVALID") return "failed";
+	return "processing";
+};
+/**
+* Identify the build produced by *our* upload. `listRecentBuilds` returns builds
+* newest-first; the freshly-uploaded build is the newest one whose id differs
+* from the baseline captured before upload. Comparing ids (not timestamps) avoids
+* both clock-skew misses and accidentally matching a pre-existing build.
+*/
+const pickNewBuild = (builds, baselineLatestBuildId) => {
+	const [newest] = builds;
+	if (newest === void 0 || newest.id === baselineLatestBuildId) return null;
+	return newest;
+};
+const matchBetaGroupsByName = (groups, names) => {
+	const byName = new Map(groups.map((group) => [group.name, group]));
+	const matched = [];
+	const missing = [];
+	for (const name of names) {
+		const group = byName.get(name);
+		if (group === void 0) missing.push(name);
+		else matched.push(group);
+	}
+	return {
+		matched,
+		missing
+	};
+};
+/** Resolve the ASC app record for a bundle identifier, or null when none exists. */
+const getAppByBundleId = (credentials, bundleId) => withJwt(credentials, (jwt) => Effect.gen(function* () {
+	const [first] = extractList(yield* fetchRaw(jwt, `/v1/apps?filter[bundleId]=${encodeURIComponent(bundleId)}&limit=1`), toAscApp);
+	return first === void 0 ? null : first;
+}));
+/** Builds for an app, newest upload first. */
+const listRecentBuilds = (credentials, appId, limit = 20) => withJwt(credentials, (jwt) => Effect.gen(function* () {
+	return extractList(yield* fetchRaw(jwt, `/v1/builds?filter[app]=${encodeURIComponent(appId)}&sort=-uploadedDate&limit=${String(limit)}`), toAscBuild);
+}));
+const listBetaGroups = (credentials, appId) => withJwt(credentials, (jwt) => Effect.gen(function* () {
+	const groups = [];
+	let path = `/v1/betaGroups?filter[app]=${encodeURIComponent(appId)}&limit=200`;
+	while (path !== null) {
+		const body = yield* fetchRaw(jwt, path);
+		groups.push(...extractList(body, toAscBetaGroup));
+		path = nextPagePath(body);
+	}
+	return groups;
+}));
+const listBuildBetaLocalizations = (credentials, buildId) => withJwt(credentials, (jwt) => Effect.gen(function* () {
+	return extractList(yield* fetchRaw(jwt, `/v1/builds/${encodeURIComponent(buildId)}/betaBuildLocalizations?limit=200`), toAscBetaBuildLocalization);
+}));
+const createBetaBuildLocalization = (credentials, params) => withJwt(credentials, (jwt) => Effect.asVoid(fetchRaw(jwt, "/v1/betaBuildLocalizations", {
+	method: "POST",
+	body: JSON.stringify({ data: {
+		type: "betaBuildLocalizations",
+		attributes: {
+			locale: params.locale,
+			whatsNew: params.whatsNew
+		},
+		relationships: { build: { data: {
+			type: "builds",
+			id: params.buildId
+		} } }
+	} })
+})));
+const updateBetaBuildLocalization = (credentials, params) => withJwt(credentials, (jwt) => Effect.asVoid(fetchRaw(jwt, `/v1/betaBuildLocalizations/${encodeURIComponent(params.id)}`, {
+	method: "PATCH",
+	body: JSON.stringify({ data: {
+		type: "betaBuildLocalizations",
+		id: params.id,
+		attributes: { whatsNew: params.whatsNew }
+	} })
+})));
+const addBuildToBetaGroups = (credentials, buildId, groupIds) => withJwt(credentials, (jwt) => Effect.asVoid(fetchRaw(jwt, `/v1/builds/${encodeURIComponent(buildId)}/relationships/betaGroups`, {
+	method: "POST",
+	body: JSON.stringify({ data: groupIds.map((id) => ({
+		type: "betaGroups",
+		id
+	})) })
+})));
+
+//#endregion
+//#region src/application/ios-testflight-config.ts
+/**
+* Post-upload TestFlight configuration for iOS submissions. After `altool`
+* uploads the `.ipa`, App Store Connect spends several minutes *processing* the
+* binary before it can be configured. This module waits for that processing to
+* finish, then sets the build's "What to Test" text and assigns it to internal
+* TestFlight groups — the same follow-up `eas submit` performs server-side.
+*
+* Auth reuses the ASC **API key** already decrypted for the upload (no second
+* credential prompt). Failures surface as {@link TestFlightConfigError} so the
+* caller can mark the submission ERRORED with a precise reason.
+*/
+var TestFlightConfigError = class extends Data.TaggedError("TestFlightConfigError") {};
+const DEFAULT_POLL_TIMEOUT_MS = 15 * 6e4;
+const DEFAULT_POLL_INTERVAL_MS = 3e4;
+const DEFAULT_LOCALE = "en-US";
+const ascErrorMessage$1 = (error) => {
+	if (error._tag === "AscApiError") return `App Store Connect API error ${String(error.status)}: ${error.message}`;
+	if (error._tag === "AscNetworkError") return `App Store Connect network error: ${String(error.cause)}`;
+	return `App Store Connect auth error: ${String(error.cause)}`;
+};
+const wrapAsc = (code) => (error) => new TestFlightConfigError({
+	code,
+	message: ascErrorMessage$1(error)
+});
+/**
+* Resolve the ASC app id (preferring the explicit `ascAppId`) and snapshot the
+* latest existing build. Run this *before* `altool` so the freshly-uploaded
+* build can be distinguished from prior ones.
+*/
+const captureTestFlightContext = (params) => Effect.gen(function* () {
+	const appId = params.ascAppId ?? (yield* Effect.gen(function* () {
+		const app = yield* getAppByBundleId(params.credentials, params.bundleIdentifier).pipe(Effect.mapError(wrapAsc("TESTFLIGHT_APP_LOOKUP_FAILED")));
+		if (app === null) return yield* new TestFlightConfigError({
+			code: "TESTFLIGHT_APP_NOT_FOUND",
+			message: `No App Store Connect app found for bundle id ${params.bundleIdentifier}. Set ascAppId in the eas.json submit profile.`
+		});
+		return app.id;
+	}));
+	return {
+		appId,
+		baselineLatestBuildId: toDbNull((yield* listRecentBuilds(params.credentials, appId, 1).pipe(Effect.mapError(wrapAsc("TESTFLIGHT_LIST_BUILDS_FAILED"))))[0]?.id)
+	};
+});
+const pollForProcessedBuild = (params) => Effect.gen(function* () {
+	const deadline = Date.now() + params.pollTimeoutMs;
+	const final = yield* Effect.iterate({
+		build: null,
+		attempt: 0
+	}, {
+		while: (state) => state.build === null,
+		body: (state) => Effect.gen(function* () {
+			if (state.attempt > 0) yield* Effect.sleep(Duration.millis(params.pollIntervalMs));
+			const candidate = pickNewBuild(yield* listRecentBuilds(params.credentials, params.context.appId, 20).pipe(Effect.mapError(wrapAsc("TESTFLIGHT_LIST_BUILDS_FAILED"))), params.context.baselineLatestBuildId);
+			if (candidate !== null) {
+				const processing = classifyProcessingState(candidate.processingState);
+				if (processing === "failed") return yield* new TestFlightConfigError({
+					code: "TESTFLIGHT_BUILD_PROCESSING_FAILED",
+					message: `App Store Connect rejected build ${candidate.version ?? candidate.id} during processing (state ${candidate.processingState ?? "unknown"}).`
+				});
+				if (processing === "valid") return {
+					build: candidate,
+					attempt: state.attempt + 1
+				};
+			}
+			if (Date.now() > deadline) return yield* new TestFlightConfigError({
+				code: "TESTFLIGHT_BUILD_PROCESSING_TIMEOUT",
+				message: `Timed out after ${String(Math.round(params.pollTimeoutMs / 6e4))} min waiting for the uploaded build to finish processing on App Store Connect. The binary uploaded successfully — re-run the TestFlight configuration later.`
+			});
+			yield* printHuman(candidate === null ? "Waiting for the uploaded build to appear on App Store Connect..." : "Build is processing on App Store Connect...");
+			return {
+				build: null,
+				attempt: state.attempt + 1
+			};
+		})
+	});
+	if (final.build === null) return yield* new TestFlightConfigError({
+		code: "TESTFLIGHT_BUILD_NOT_FOUND",
+		message: "Could not locate the uploaded build on App Store Connect."
+	});
+	return final.build;
+});
+const applyWhatToTest = (params) => Effect.gen(function* () {
+	const existing = (yield* listBuildBetaLocalizations(params.credentials, params.buildId).pipe(Effect.mapError(wrapAsc("TESTFLIGHT_LIST_LOCALIZATIONS_FAILED")))).find((loc) => loc.locale === params.locale);
+	yield* (existing === void 0 ? createBetaBuildLocalization(params.credentials, {
+		buildId: params.buildId,
+		locale: params.locale,
+		whatsNew: params.whatToTest
+	}) : updateBetaBuildLocalization(params.credentials, {
+		id: existing.id,
+		whatsNew: params.whatToTest
+	})).pipe(Effect.mapError(wrapAsc("TESTFLIGHT_SET_WHAT_TO_TEST_FAILED")));
+});
+const applyGroups = (params) => Effect.gen(function* () {
+	const allGroups = yield* listBetaGroups(params.credentials, params.appId).pipe(Effect.mapError(wrapAsc("TESTFLIGHT_LIST_GROUPS_FAILED")));
+	const { matched, missing } = matchBetaGroupsByName(allGroups, params.groups);
+	if (missing.length > 0) {
+		const available = allGroups.map((group) => group.name).join(", ") || "(none)";
+		return yield* new TestFlightConfigError({
+			code: "TESTFLIGHT_GROUP_NOT_FOUND",
+			message: `TestFlight group(s) not found: ${missing.join(", ")}. Available groups: ${available}.`
+		});
+	}
+	yield* addBuildToBetaGroups(params.credentials, params.buildId, matched.map((group) => group.id)).pipe(Effect.mapError(wrapAsc("TESTFLIGHT_ADD_TO_GROUPS_FAILED")));
+});
+/** Whether a profile has any TestFlight config that warrants the processing wait. */
+const needsTestFlightConfig = (params) => params.whatToTest !== void 0 || params.groups.length > 0;
+const applyTestFlightConfig = (inputs) => Effect.gen(function* () {
+	yield* printHuman("Configuring TestFlight (waiting for build processing)...");
+	const build = yield* pollForProcessedBuild({
+		credentials: inputs.credentials,
+		context: inputs.context,
+		pollTimeoutMs: inputs.pollTimeoutMs ?? DEFAULT_POLL_TIMEOUT_MS,
+		pollIntervalMs: inputs.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS
+	});
+	if (inputs.whatToTest !== void 0) {
+		yield* applyWhatToTest({
+			credentials: inputs.credentials,
+			buildId: build.id,
+			locale: inputs.language ?? DEFAULT_LOCALE,
+			whatToTest: inputs.whatToTest
+		});
+		yield* printHuman(`Set "What to Test" on build ${build.version ?? build.id}.`);
+	}
+	if (inputs.groups.length > 0) {
+		yield* applyGroups({
+			credentials: inputs.credentials,
+			appId: inputs.context.appId,
+			buildId: build.id,
+			groups: inputs.groups
+		});
+		yield* printHuman(`Assigned build to TestFlight group(s): ${inputs.groups.join(", ")}.`);
+	}
+	return {
+		buildId: build.id,
+		buildVersion: build.version
+	};
+});
+
 //#endregion
 //#region src/application/submit-flow.ts
 const execFileAsync = promisify(execFile);
@@ -20231,65 +21092,15 @@ const pollSubmissionUntilTerminal = (api, submissionId, pollIntervalMs = 5e3) =>
 	code: "SUBMISSION_POLL_NO_RESULT",
 	message: "Polling completed without producing a submission"
 })) : Effect.succeed(final)));
-const writeAscApiKeyP8 = (api, ascApiKeyId) => Effect.gen(function* () {
-	const creds = yield* fetchAscCredentials(api, ascApiKeyId).pipe(Effect.mapError(() => new CliSubmitError({
-		code: "SUBMISSION_ASC_KEY_FETCH_FAILED",
-		message: `Failed to fetch or decrypt ASC API key ${ascApiKeyId}`
-	})));
-	const target = path.join(tmpdir(), `better-update-submit-AuthKey_${creds.keyId}.p8`);
-	yield* Effect.promise(async () => writeFile(target, creds.p8Pem, "utf8"));
-	return {
-		p8Path: target,
-		keyId: creds.keyId,
-		issuerId: creds.issuerId
-	};
-});
-const runIosAltoolUpload = (inputs) => Effect.gen(function* () {
-	const creds = yield* writeAscApiKeyP8(inputs.api, inputs.ascApiKeyId);
-	const apiKeyDir = path.dirname(creds.p8Path);
-	yield* inputs.api.submissions.updateStatus({
-		path: { id: inputs.submissionId },
-		payload: { status: "IN_PROGRESS" }
-	}).pipe(Effect.mapError(() => new CliSubmitError({
-		code: "SUBMISSION_PATCH_FAILED",
-		message: "Failed to PATCH submission status to IN_PROGRESS"
-	})));
-	const result = yield* runAltool([
-		"--upload-app",
-		"--type",
-		"ios",
-		"--apiKey",
-		creds.keyId,
-		"--apiIssuer",
-		creds.issuerId,
-		"--apiKeyDir",
-		apiKeyDir,
-		"--file",
-		inputs.ipaPath,
-		"--output-format",
-		"xml"
-	]);
-	const terminalStatus = result.exitCode === 0 ? "FINISHED" : "ERRORED";
-	const errorMessage = result.exitCode === 0 ? null : `xcrun altool exited ${String(result.exitCode)}: ${result.stderr}`;
-	yield* inputs.api.submissions.updateStatus({
-		path: { id: inputs.submissionId },
-		payload: {
-			status: terminalStatus,
-			...errorMessage ? {
-				errorCode: "SUBMISSION_SERVICE_IOS_ALTOOL_FAILED",
-				errorMessage
-			} : {}
-		}
-	}).pipe(Effect.mapError(() => new CliSubmitError({
-		code: "SUBMISSION_PATCH_FAILED",
-		message: "Failed to PATCH submission terminal status"
-	})));
-	return {
-		status: terminalStatus,
-		stdout: result.stdout,
-		stderr: result.stderr
-	};
-});
+const patchSubmissionStatus = (api, submissionId, payload) => api.submissions.updateStatus({
+	path: { id: submissionId },
+	payload
+}).pipe(Effect.mapError(() => new CliSubmitError({
+	code: "SUBMISSION_PATCH_FAILED",
+	message: `Failed to PATCH submission status to ${payload.status}`
+})));
+/** A local `path` archive may be given as a plain path or a `file://` URL. */
+const localPathFromArchiveValue = (value) => value.startsWith("file://") ? fileURLToPath(value) : value;
 const readLocalFile = (filePath, errorCode, errorMessageFmt) => Effect.tryPromise({
 	try: async () => readFile(filePath),
 	catch: (cause) => new CliSubmitError({
@@ -20310,7 +21121,7 @@ const fetchArchiveOverHttp = (url) => Effect.gen(function* () {
 		},
 		catch: (cause) => new CliSubmitError({
 			code: "SUBMISSION_ARCHIVE_DOWNLOAD_FAILED",
-			message: `Failed to download AAB from ${url}: ${cause instanceof Error ? cause.message : String(cause)}`
+			message: `Failed to download archive from ${url}: ${cause instanceof Error ? cause.message : String(cause)}`
 		})
 	});
 	if (!result.ok || result.bytes === null) return yield* new CliSubmitError({
@@ -20319,7 +21130,153 @@ const fetchArchiveOverHttp = (url) => Effect.gen(function* () {
 	});
 	return result.bytes;
 });
-const readArchiveBytes = (archive) => archive.source === "path" ? Effect.map(readLocalFile(archive.value, "SUBMISSION_ARCHIVE_READ_FAILED", (cause) => `Failed to read AAB at ${archive.value}: ${cause instanceof Error ? cause.message : String(cause)}`), (buf) => new Uint8Array(buf)) : fetchArchiveOverHttp(archive.value);
+const readArchiveBytes = (archive) => archive.source === "path" ? Effect.map(readLocalFile(localPathFromArchiveValue(archive.value), "SUBMISSION_ARCHIVE_READ_FAILED", (cause) => `Failed to read archive at ${archive.value}: ${cause instanceof Error ? cause.message : String(cause)}`), (buf) => new Uint8Array(buf)) : fetchArchiveOverHttp(archive.value);
+const downloadArchiveToTempFile = (url, extension) => Effect.gen(function* () {
+	const bytes = yield* fetchArchiveOverHttp(url);
+	const target = path.join(tmpdir(), `better-update-submit-${crypto.randomUUID()}${extension}`);
+	yield* Effect.tryPromise({
+		try: async () => writeFile(target, bytes),
+		catch: (cause) => new CliSubmitError({
+			code: "SUBMISSION_ARCHIVE_WRITE_FAILED",
+			message: `Failed to stage archive to ${target}: ${cause instanceof Error ? cause.message : String(cause)}`
+		})
+	});
+	return target;
+});
+/**
+* Resolve an archive to a **local file path** on disk, downloading remote
+* (`build`/`url`) sources first. Store upload tools (`altool`) require a path
+* they can open — handing them an https URL fails.
+*/
+const resolveLocalArchivePath = (archive, extension) => archive.source === "path" ? Effect.succeed(localPathFromArchiveValue(archive.value)) : downloadArchiveToTempFile(archive.value, extension);
+/** EAS-compatible env var carrying the Apple ID app-specific password. */
+const APPLE_APP_SPECIFIC_PASSWORD_ENV = "EXPO_APPLE_APP_SPECIFIC_PASSWORD";
+const hasAppleAppSpecificPassword = () => {
+	const value = process.env[APPLE_APP_SPECIFIC_PASSWORD_ENV];
+	return value !== void 0 && value !== "";
+};
+/**
+* Resolve the upload auth, matching `eas submit` precedence: an app-specific
+* password (env var + `appleId`) wins when usable; otherwise fall back to the
+* ASC API key. Returns null when neither is configured.
+*/
+const resolveIosUploadAuth = (params) => {
+	if (params.hasAppSpecificPassword && params.appleId !== void 0) return {
+		kind: "app-specific-password",
+		appleId: params.appleId
+	};
+	if (params.ascApiKeyId !== void 0) return {
+		kind: "asc-api-key",
+		ascApiKeyId: params.ascApiKeyId
+	};
+	return null;
+};
+const resolveAscCredentials = (api, ascApiKeyId) => fetchAscCredentials(api, ascApiKeyId).pipe(Effect.mapError(() => new CliSubmitError({
+	code: "SUBMISSION_ASC_KEY_FETCH_FAILED",
+	message: `Failed to fetch or decrypt ASC API key ${ascApiKeyId}`
+})));
+/** `altool` reads the API key from `--apiKeyDir`; write the decrypted `.p8` there. */
+const writeP8ForAltool = (credentials) => Effect.gen(function* () {
+	const target = path.join(tmpdir(), `better-update-submit-AuthKey_${credentials.keyId}.p8`);
+	yield* Effect.promise(async () => writeFile(target, credentials.p8Pem, "utf8"));
+	return target;
+});
+const baseAltoolArgs = (ipaPath) => [
+	"--upload-app",
+	"--type",
+	"ios",
+	"--file",
+	ipaPath,
+	"--output-format",
+	"xml"
+];
+/** Build `altool` args for the chosen auth. The app-specific password is passed
+* as `@env:` so it never enters argv; `altool` reads it from the inherited env. */
+const buildAltoolArgs = (params) => Effect.gen(function* () {
+	if (params.auth.kind === "app-specific-password") return [
+		...baseAltoolArgs(params.ipaPath),
+		"--username",
+		params.auth.appleId,
+		"--password",
+		`@env:${APPLE_APP_SPECIFIC_PASSWORD_ENV}`
+	];
+	if (params.ascCredentials === null) return yield* new CliSubmitError({
+		code: "SUBMISSION_ASC_KEY_FETCH_FAILED",
+		message: "ASC API key is required for an asc-api-key upload but was not resolved."
+	});
+	const p8Path = yield* writeP8ForAltool(params.ascCredentials);
+	return [
+		...baseAltoolArgs(params.ipaPath),
+		"--apiKey",
+		params.ascCredentials.keyId,
+		"--apiIssuer",
+		params.ascCredentials.issuerId,
+		"--apiKeyDir",
+		path.dirname(p8Path)
+	];
+});
+const runIosSubmit = (inputs) => Effect.gen(function* () {
+	const wantsConfig = needsTestFlightConfig({
+		whatToTest: inputs.config.whatToTest,
+		groups: inputs.config.groups
+	});
+	const credsKeyId = inputs.auth.kind === "asc-api-key" ? inputs.auth.ascApiKeyId : inputs.ascApiKeyId;
+	const ascCredentials = (inputs.auth.kind === "asc-api-key" || wantsConfig) && credsKeyId !== void 0 ? yield* resolveAscCredentials(inputs.api, credsKeyId) : null;
+	const ipaPath = yield* resolveLocalArchivePath(inputs.archive, ".ipa");
+	let tfContext = null;
+	if (wantsConfig && ascCredentials !== null) tfContext = yield* captureTestFlightContext({
+		credentials: ascCredentials,
+		ascAppId: inputs.config.ascAppId,
+		bundleIdentifier: inputs.config.bundleIdentifier
+	}).pipe(Effect.mapError((error) => new CliSubmitError({
+		code: error.code,
+		message: error.message
+	})));
+	else if (wantsConfig) yield* printHuman("Note: \"What to Test\" and TestFlight groups require an ASC API key (ascApiKeyId) — skipping that step for the app-specific-password upload.");
+	const altoolArgs = yield* buildAltoolArgs({
+		auth: inputs.auth,
+		ascCredentials,
+		ipaPath
+	});
+	yield* patchSubmissionStatus(inputs.api, inputs.submissionId, { status: "IN_PROGRESS" });
+	const result = yield* runAltool(altoolArgs);
+	if (result.exitCode !== 0) {
+		yield* patchSubmissionStatus(inputs.api, inputs.submissionId, {
+			status: "ERRORED",
+			errorCode: "SUBMISSION_SERVICE_IOS_ALTOOL_FAILED",
+			errorMessage: `xcrun altool exited ${String(result.exitCode)}: ${result.stderr}`
+		});
+		return { status: "ERRORED" };
+	}
+	yield* printHuman("altool upload complete.");
+	if (tfContext !== null && ascCredentials !== null) yield* applyTestFlightConfig({
+		credentials: ascCredentials,
+		context: tfContext,
+		language: inputs.config.language,
+		whatToTest: inputs.config.whatToTest,
+		groups: inputs.config.groups
+	}).pipe(Effect.catchTag("TestFlightConfigError", (configError) => Effect.gen(function* () {
+		yield* patchSubmissionStatus(inputs.api, inputs.submissionId, {
+			status: "ERRORED",
+			errorCode: configError.code,
+			errorMessage: configError.message
+		});
+		return yield* new CliSubmitError({
+			code: configError.code,
+			message: configError.message
+		});
+	})));
+	yield* patchSubmissionStatus(inputs.api, inputs.submissionId, { status: "FINISHED" });
+	return { status: "FINISHED" };
+});
+
+//#endregion
+//#region src/application/android-play-submit.ts
+/**
+* Client-side Google Play submission: decrypt the service account key, then run
+* the Play Developer API edit pipeline (insert → upload bundle → assign track →
+* commit) — the same steps `eas submit` performs server-side.
+*/
 const fetchServiceAccountKeyById = (api, id) => Effect.gen(function* () {
 	const data = yield* api.googleServiceAccountKeys.download({ path: { id } }).pipe(Effect.mapError(() => new CliSubmitError({
 		code: "SUBMISSION_ANDROID_SA_KEY_FETCH_FAILED",
@@ -20342,25 +21299,35 @@ const fetchServiceAccountKeyById = (api, id) => Effect.gen(function* () {
 	});
 	return json;
 });
+const readServiceAccountFile = (filePath) => Effect.tryPromise({
+	try: async () => new TextDecoder().decode(await readFile(filePath)),
+	catch: (cause) => new CliSubmitError({
+		code: "SUBMISSION_ANDROID_SA_KEY_LOCAL_READ_FAILED",
+		message: `Failed to read service account JSON at ${filePath}: ${cause instanceof Error ? cause.message : String(cause)}`
+	})
+});
 const resolveServiceAccountJson = (params) => {
 	if (params.serviceAccountKeyId !== void 0) return fetchServiceAccountKeyById(params.api, params.serviceAccountKeyId);
-	if (params.serviceAccountKeyPath !== void 0) return Effect.map(readLocalFile(params.serviceAccountKeyPath, "SUBMISSION_ANDROID_SA_KEY_LOCAL_READ_FAILED", (cause) => `Failed to read service account JSON at ${String(params.serviceAccountKeyPath)}: ${cause instanceof Error ? cause.message : String(cause)}`), (buf) => new TextDecoder().decode(buf));
+	if (params.serviceAccountKeyPath !== void 0) return readServiceAccountFile(params.serviceAccountKeyPath);
 	return Effect.fail(new CliSubmitError({
 		code: "SUBMISSION_ANDROID_SA_KEY_MISSING",
 		message: "Android submission requires a service account key. Pass --service-account-key-id <id>, set serviceAccountKeyId in eas.json submit profile, or set serviceAccountKeyPath to a local JSON file."
 	}));
 };
-const patchSubmissionStatus = (api, submissionId, payload) => api.submissions.updateStatus({
-	path: { id: submissionId },
-	payload
-}).pipe(Effect.mapError(() => new CliSubmitError({
-	code: "SUBMISSION_PATCH_FAILED",
-	message: `Failed to PATCH submission status to ${payload.status}`
-})));
 const wrapGooglePlayError = (label) => (cause) => new CliSubmitError({
 	code: `SUBMISSION_ANDROID_${label}`,
 	message: cause.message
 });
+/**
+* EAS/Google Play rule: a staged rollout fraction is required for — and only
+* valid with — releaseStatus `inProgress`. Returns an error message, or null
+* when the combination is valid.
+*/
+const androidRolloutError = (releaseStatus, rollout) => {
+	if (releaseStatus === "inProgress" && rollout === null) return "rollout is required when releaseStatus is 'inProgress' — set submit.<profile>.android.rollout to a 0–1 fraction.";
+	if (releaseStatus !== "inProgress" && rollout !== null) return `rollout is only allowed when releaseStatus is 'inProgress', not '${releaseStatus}'.`;
+	return null;
+};
 const runGooglePlayPipeline = (params) => Effect.gen(function* () {
 	const edit = yield* insertEdit({
 		accessToken: params.accessToken,
@@ -20395,6 +21362,20 @@ const runAndroidGooglePlayUpload = (inputs) => Effect.gen(function* () {
 		code: "SUBMISSION_ANDROID_APP_ID_MISSING",
 		message: "Android submit profile requires applicationId — set submit.<profile>.android.applicationId in eas.json"
 	});
+	const releaseStatus = inputs.androidProfile.releaseStatus ?? "completed";
+	const rollout = toDbNull(inputs.androidProfile.rollout);
+	const rolloutError = androidRolloutError(releaseStatus, rollout);
+	if (rolloutError !== null) {
+		yield* patchSubmissionStatus(inputs.api, inputs.submissionId, {
+			status: "ERRORED",
+			errorCode: "SUBMISSION_ANDROID_ROLLOUT_INVALID",
+			errorMessage: rolloutError
+		});
+		return yield* new CliSubmitError({
+			code: "SUBMISSION_ANDROID_ROLLOUT_INVALID",
+			message: rolloutError
+		});
+	}
 	const serviceAccountJson = yield* resolveServiceAccountJson({
 		api: inputs.api,
 		serviceAccountKeyId: inputs.serviceAccountKeyId,
@@ -20409,9 +21390,9 @@ const runAndroidGooglePlayUpload = (inputs) => Effect.gen(function* () {
 			applicationId,
 			aab,
 			track: inputs.androidProfile.track ?? "internal",
-			releaseStatus: inputs.androidProfile.releaseStatus ?? "completed",
+			releaseStatus,
 			changesNotSentForReview: inputs.androidProfile.changesNotSentForReview ?? false,
-			rollout: toDbNull(inputs.androidProfile.rollout)
+			rollout
 		});
 	}).pipe(Effect.catchTag("CliSubmitError", (engineError) => Effect.gen(function* () {
 		yield* patchSubmissionStatus(inputs.api, inputs.submissionId, {
@@ -20473,13 +21454,45 @@ const runAutoSubmit = (input) => Effect.gen(function* () {
 		})
 	});
 	yield* printHuman(`Submission created: ${submission.id} (${submission.status})`);
-	if (input.platform === "ios" && easProfile.ios?.ascApiKeyId !== void 0) {
-		yield* printHuman("Running xcrun altool upload...");
-		yield* runIosAltoolUpload({
+	if (input.platform === "ios" && iosConfig !== void 0) {
+		const auth = resolveIosUploadAuth({
+			appleId: easProfile.ios?.appleId,
+			ascApiKeyId: easProfile.ios?.ascApiKeyId,
+			hasAppSpecificPassword: hasAppleAppSpecificPassword()
+		});
+		if (auth === null) yield* printHuman("Skipping iOS upload: configure ascApiKeyId or set EXPO_APPLE_APP_SPECIFIC_PASSWORD (+ appleId).");
+		else {
+			yield* printHuman(auth.kind === "app-specific-password" ? "Running xcrun altool upload (Apple ID app-specific password)..." : "Running xcrun altool upload (ASC API key)...");
+			yield* runIosSubmit({
+				api: input.api,
+				submissionId: submission.id,
+				archive: {
+					source: "build",
+					value: archiveUrl
+				},
+				auth,
+				ascApiKeyId: easProfile.ios?.ascApiKeyId,
+				config: {
+					bundleIdentifier: iosConfig.bundleIdentifier,
+					ascAppId: easProfile.ios?.ascAppId,
+					language: easProfile.ios?.language,
+					whatToTest: input.whatToTest,
+					groups: easProfile.ios?.groups ?? []
+				}
+			});
+		}
+	}
+	if (input.platform === "android" && androidConfig !== void 0 && easProfile.android !== void 0) {
+		yield* printHuman("Uploading bundle to Google Play...");
+		yield* runAndroidGooglePlayUpload({
 			api: input.api,
 			submissionId: submission.id,
-			ipaPath: archiveUrl,
-			ascApiKeyId: easProfile.ios.ascApiKeyId
+			archive: {
+				source: "build",
+				value: archiveUrl
+			},
+			androidProfile: easProfile.android,
+			serviceAccountKeyId: easProfile.android.serviceAccountKeyId
 		});
 	}
 	yield* printHuman(`Submission final status: ${(yield* pollSubmissionUntilTerminal(input.api, submission.id)).status}`);
@@ -20650,313 +21663,6 @@ const generateAndroidKeystore = (input) => Command.exitCode(Command.make("keytoo
 	message: `generate android keystore exited with code ${code}`
 }))));
 
-//#endregion
-//#region src/lib/apple-pem.ts
-const PEM_HEADER = "-----BEGIN PRIVATE KEY-----";
-const PEM_FOOTER = "-----END PRIVATE KEY-----";
-const pemToPkcs8Der = (pem) => {
-	const normalized = pem.replaceAll("\r\n", "\n").trim();
-	const start = normalized.indexOf(PEM_HEADER);
-	const end = normalized.indexOf(PEM_FOOTER);
-	if (start === -1 || end === -1 || end <= start) return null;
-	const body = normalized.slice(start + 27, end).replaceAll(/\s+/gu, "").trim();
-	if (body.length === 0) return null;
-	try {
-		return fromBase64(body);
-	} catch {
-		return null;
-	}
-};
-
-//#endregion
-//#region src/lib/apple-asc-jwt.ts
-var AppleAuthError = class extends Data.TaggedError("AppleAuthError") {};
-const MAX_JWT_LIFETIME_SECONDS = 1200;
-const asArrayBuffer = (bytes) => {
-	const buffer = new ArrayBuffer(bytes.byteLength);
-	new Uint8Array(buffer).set(bytes);
-	return buffer;
-};
-const signAscJwt = (credentials) => Effect.gen(function* () {
-	const der = pemToPkcs8Der(credentials.p8Pem);
-	if (der === null) return yield* new AppleAuthError({ cause: /* @__PURE__ */ new Error("Invalid .p8 PEM") });
-	const header = {
-		alg: "ES256",
-		kid: credentials.keyId,
-		typ: "JWT"
-	};
-	const now = Math.floor(Date.now() / 1e3);
-	const payload = {
-		iss: credentials.issuerId,
-		iat: now,
-		exp: now + MAX_JWT_LIFETIME_SECONDS,
-		aud: "appstoreconnect-v1"
-	};
-	const signingInput = `${toBase64Url(new TextEncoder().encode(JSON.stringify(header)))}.${toBase64Url(new TextEncoder().encode(JSON.stringify(payload)))}`;
-	const key = yield* Effect.tryPromise({
-		try: async () => crypto.subtle.importKey("pkcs8", asArrayBuffer(der), {
-			name: "ECDSA",
-			namedCurve: "P-256"
-		}, false, ["sign"]),
-		catch: (cause) => new AppleAuthError({ cause })
-	});
-	const signature = yield* Effect.tryPromise({
-		try: async () => crypto.subtle.sign({
-			name: "ECDSA",
-			hash: "SHA-256"
-		}, key, new TextEncoder().encode(signingInput)),
-		catch: (cause) => new AppleAuthError({ cause })
-	});
-	return `${signingInput}.${toBase64Url(new Uint8Array(signature))}`;
-});
-
-//#endregion
-//#region src/lib/apple-asc-client.ts
-/**
-* App Store Connect REST client authenticated with an ASC **API key** — a JWT
-* signed from a `.p8` private key (see `apple-asc-jwt.ts`). Credentials are
-* resolved non-interactively from the server (`fetchAscCredentials`), so this
-* powers headless flows: build-credential resolution, provisioning-profile
-* generation, and device sync.
-*
-* Intentionally NOT built on `@expo/apple-utils`: that library authenticates
-* via an interactive Apple-ID **cookie session** (username/password + 2FA, see
-* `services/apple-auth.ts`) and exposes a cookie-based `RequestContext`. That is
-* a different auth model that would force an interactive login here. The two
-* coexist by design — apple-utils backs `apple login`; this client backs
-* non-interactive ASC API-key access.
-*/
-var AscApiError = class extends Data.TaggedError("AscApiError") {};
-var AscNetworkError = class extends Data.TaggedError("AscNetworkError") {};
-const API_BASE = "https://api.appstoreconnect.apple.com";
-const extractErrors = (body) => {
-	if (!isRecord$1(body) || !Array.isArray(body["errors"])) return [];
-	return body["errors"].filter((value) => isRecord$1(value));
-};
-const parseApiError = (response, body, raw) => {
-	const [first] = extractErrors(body);
-	return new AscApiError({
-		status: response.status,
-		message: first?.detail ?? first?.title ?? response.statusText,
-		code: first?.code,
-		raw
-	});
-};
-const fetchRaw = (jwt, path, init) => Effect.gen(function* () {
-	const response = yield* Effect.tryPromise({
-		try: async () => fetch(`${API_BASE}${path}`, compact({
-			method: init?.method ?? "GET",
-			body: init?.body,
-			headers: {
-				authorization: `Bearer ${jwt}`,
-				"content-type": "application/json",
-				accept: "application/json"
-			}
-		})),
-		catch: (cause) => new AscNetworkError({ cause })
-	});
-	const text = yield* Effect.tryPromise({
-		try: async () => response.text(),
-		catch: (cause) => new AscNetworkError({ cause })
-	});
-	const body = yield* Effect.try({
-		try: () => text.length === 0 ? {} : JSON.parse(text),
-		catch: (cause) => new AscNetworkError({ cause })
-	});
-	if (!response.ok) return yield* parseApiError(response, body, text);
-	return body;
-});
-const toAscCertificate = (value) => {
-	if (!isRecord$1(value)) return null;
-	const { id, attributes } = value;
-	if (typeof id !== "string" || !isRecord$1(attributes)) return null;
-	const { serialNumber, certificateType, expirationDate, certificateContent, displayName } = attributes;
-	if (typeof serialNumber !== "string" || typeof certificateType !== "string" || typeof expirationDate !== "string") return null;
-	return {
-		id,
-		serialNumber,
-		certificateType,
-		expirationDate,
-		certificateContent: typeof certificateContent === "string" ? certificateContent : null,
-		displayName: typeof displayName === "string" ? displayName : null
-	};
-};
-const toAscBundleId = (value) => {
-	if (!isRecord$1(value)) return null;
-	const { id, attributes } = value;
-	if (typeof id !== "string" || !isRecord$1(attributes)) return null;
-	const { identifier, name } = attributes;
-	if (typeof identifier !== "string" || typeof name !== "string") return null;
-	return {
-		id,
-		identifier,
-		name
-	};
-};
-const PROFILE_TYPES = [
-	"IOS_APP_ADHOC",
-	"IOS_APP_DEVELOPMENT",
-	"IOS_APP_STORE",
-	"IOS_APP_INHOUSE"
-];
-const asProfileType = (value) => {
-	const match = PROFILE_TYPES.find((entry) => entry === value);
-	return match === void 0 ? null : match;
-};
-const toAscProfile = (value) => {
-	if (!isRecord$1(value)) return null;
-	const { id, attributes } = value;
-	if (typeof id !== "string" || !isRecord$1(attributes)) return null;
-	const { name, uuid, expirationDate, profileContent } = attributes;
-	const profileType = asProfileType(attributes["profileType"]);
-	if (typeof name !== "string" || typeof uuid !== "string" || typeof expirationDate !== "string" || typeof profileContent !== "string" || profileType === null) return null;
-	return {
-		id,
-		name,
-		uuid,
-		expirationDate,
-		profileContent,
-		profileType
-	};
-};
-const toAscDevice = (value) => {
-	if (!isRecord$1(value)) return null;
-	const { id, attributes } = value;
-	if (typeof id !== "string" || !isRecord$1(attributes)) return null;
-	const { udid, name, deviceClass } = attributes;
-	if (typeof udid !== "string" || typeof name !== "string") return null;
-	return {
-		id,
-		udid,
-		name,
-		deviceClass: typeof deviceClass === "string" ? deviceClass : null
-	};
-};
-const extractList = (body, map) => {
-	if (!isRecord$1(body) || !Array.isArray(body["data"])) return [];
-	return body["data"].map(map).filter((value) => value !== null);
-};
-const extractSingle = (body, map) => {
-	if (!isRecord$1(body)) return null;
-	return map(body["data"]);
-};
-/**
-* App Store Connect paginates list responses (default 200/page) and returns the
-* absolute URL of the next page under `links.next`. Strip the base so it can be
-* fed back into `fetchRaw`; return null when there is no further page.
-*/
-const nextPagePath = (body) => {
-	if (!isRecord$1(body)) return null;
-	const { links } = body;
-	if (!isRecord$1(links) || typeof links["next"] !== "string") return null;
-	const { next } = links;
-	return next.startsWith(API_BASE) ? next.slice(37) : next;
-};
-const malformed = (resource) => new AscApiError({
-	status: 500,
-	message: `Malformed ${resource} response`,
-	code: void 0,
-	raw: ""
-});
-const withJwt = (credentials, fn) => Effect.gen(function* () {
-	return yield* fn(yield* signAscJwt(credentials));
-});
-const listCertificates = (credentials, params) => withJwt(credentials, (jwt) => Effect.gen(function* () {
-	return extractList(yield* fetchRaw(jwt, `/v1/certificates${params?.certificateType ? `?filter[certificateType]=${params.certificateType}&limit=200` : "?limit=200"}`), toAscCertificate);
-}));
-const createCertificate = (credentials, params) => withJwt(credentials, (jwt) => Effect.gen(function* () {
-	const csrContent = params.csrPem.replaceAll("-----BEGIN CERTIFICATE REQUEST-----", "").replaceAll("-----END CERTIFICATE REQUEST-----", "").replaceAll(/\s+/gu, "");
-	const resource = extractSingle(yield* fetchRaw(jwt, "/v1/certificates", {
-		method: "POST",
-		body: JSON.stringify({ data: {
-			type: "certificates",
-			attributes: {
-				csrContent,
-				certificateType: params.certificateType
-			}
-		} })
-	}), toAscCertificate);
-	if (resource === null) return yield* malformed("certificate");
-	return resource;
-}));
-const deleteCertificate = (credentials, id) => withJwt(credentials, (jwt) => Effect.asVoid(fetchRaw(jwt, `/v1/certificates/${encodeURIComponent(id)}`, { method: "DELETE" })));
-const listBundleIds = (credentials) => withJwt(credentials, (jwt) => Effect.gen(function* () {
-	return extractList(yield* fetchRaw(jwt, "/v1/bundleIds?limit=200"), toAscBundleId);
-}));
-const createBundleId = (credentials, params) => withJwt(credentials, (jwt) => Effect.gen(function* () {
-	const resource = extractSingle(yield* fetchRaw(jwt, "/v1/bundleIds", {
-		method: "POST",
-		body: JSON.stringify({ data: {
-			type: "bundleIds",
-			attributes: {
-				identifier: params.identifier,
-				name: params.name,
-				platform: "IOS"
-			}
-		} })
-	}), toAscBundleId);
-	if (resource === null) return yield* malformed("bundleId");
-	return resource;
-}));
-const listDevices = (credentials) => withJwt(credentials, (jwt) => Effect.gen(function* () {
-	const devices = [];
-	let path = "/v1/devices?limit=200";
-	while (path !== null) {
-		const body = yield* fetchRaw(jwt, path);
-		devices.push(...extractList(body, toAscDevice));
-		path = nextPagePath(body);
-	}
-	return devices;
-}));
-const createDevice = (credentials, params) => withJwt(credentials, (jwt) => Effect.gen(function* () {
-	const resource = extractSingle(yield* fetchRaw(jwt, "/v1/devices", {
-		method: "POST",
-		body: JSON.stringify({ data: {
-			type: "devices",
-			attributes: {
-				name: params.name,
-				udid: params.udid,
-				platform: "IOS"
-			}
-		} })
-	}), toAscDevice);
-	if (resource === null) return yield* malformed("device");
-	return resource;
-}));
-const createProvisioningProfile = (credentials, params) => withJwt(credentials, (jwt) => Effect.gen(function* () {
-	const relationships = {
-		bundleId: { data: {
-			type: "bundleIds",
-			id: params.bundleIdAscId
-		} },
-		certificates: { data: params.certificateAscIds.map((id) => ({
-			type: "certificates",
-			id
-		})) },
-		...params.deviceAscIds.length > 0 ? { devices: { data: params.deviceAscIds.map((id) => ({
-			type: "devices",
-			id
-		})) } } : {}
-	};
-	const resource = extractSingle(yield* fetchRaw(jwt, "/v1/profiles", {
-		method: "POST",
-		body: JSON.stringify({ data: {
-			type: "profiles",
-			attributes: {
-				name: params.profileName,
-				profileType: params.profileType
-			},
-			relationships
-		} })
-	}), toAscProfile);
-	if (resource === null) return yield* malformed("profile");
-	return resource;
-}));
-const isCertificateLimitError = (error) => {
-	if (error._tag !== "AscApiError") return false;
-	return /already have a current.*certificate|pending certificate request/iu.test(error.message);
-};
-
 //#endregion
 //#region src/lib/apple-cert-to-p12.ts
 var CertParseError = class extends Data.TaggedError("CertParseError") {};
@@ -24210,34 +24916,6 @@ const runBuildWorkflow = (options) => Effect.scoped(Effect.gen(function* () {
 
 //#endregion
 //#region src/commands/build/configure.ts
-const DEFAULT_EAS_JSON = {
-	cli: { version: ">= 7.0.0" },
-	build: {
-		development: {
-			developmentClient: true,
-			distribution: "internal",
-			channel: "development",
-			environment: "development",
-			android: { format: "apk" }
-		},
-		preview: {
-			distribution: "internal",
-			channel: "preview",
-			environment: "preview",
-			android: { format: "apk" }
-		},
-		production: {
-			channel: "production",
-			environment: "production",
-			android: { format: "aab" }
-		}
-	}
-};
-const DEFAULT_PROFILES = [
-	"development",
-	"preview",
-	"production"
-];
 const writeEasJson = (filePath, value) => Effect.gen(function* () {
 	yield* (yield* FileSystem.FileSystem).writeFileString(filePath, `${JSON.stringify(value, null, 2)}\n`).pipe(Effect.mapError((cause) => new BuildProfileError({ message: `Failed to write eas.json: ${cause.message}` })));
 });
@@ -24253,43 +24931,44 @@ const configureBuildCommand = defineCommand({
 	run: async ({ args }) => runEffect(Effect.gen(function* () {
 		const { allow: interactive } = yield* InteractiveMode;
 		const projectRoot = yield* (yield* CliRuntime).cwd;
-		const easJsonPath = path.join(projectRoot, "eas.json");
+		const filePath = easJsonPath(projectRoot);
 		const fs = yield* FileSystem.FileSystem;
-		if (!(yield* fs.exists(easJsonPath))) {
-			yield* writeEasJson(easJsonPath, DEFAULT_EAS_JSON);
-			yield* printHuman(`Wrote eas.json with default profiles to ${easJsonPath}.`);
-			yield* printHumanKeyValue([["Profiles", DEFAULT_PROFILES.join(", ")], ["Path", easJsonPath]]);
-			return {
-				action: "created",
-				path: easJsonPath,
-				profiles: [...DEFAULT_PROFILES]
-			};
-		}
+		const exists = yield* fs.exists(filePath);
 		if (args.force === true) {
-			if (!(interactive ? yield* promptConfirm(`Overwrite existing eas.json at ${easJsonPath} with defaults?`) : true)) {
+			if (!(exists && interactive ? yield* promptConfirm(`Overwrite existing eas.json at ${filePath} with defaults?`) : true)) {
 				yield* printHuman("Aborted. eas.json was not modified.");
 				return {
 					action: "aborted",
-					path: easJsonPath
+					path: filePath
 				};
 			}
-			yield* writeEasJson(easJsonPath, DEFAULT_EAS_JSON);
-			yield* printHuman(`Overwrote eas.json with default profiles.`);
+			yield* writeEasJson(filePath, DEFAULT_EAS_JSON);
+			yield* printHuman(exists ? "Overwrote eas.json with default profiles." : `Wrote eas.json with default profiles to ${filePath}.`);
 			return {
-				action: "overwritten",
-				path: easJsonPath,
-				profiles: [...DEFAULT_PROFILES]
+				action: exists ? "overwritten" : "created",
+				path: filePath,
+				profiles: [...DEFAULT_PROFILE_NAMES]
+			};
+		}
+		if (!exists) {
+			const created = yield* ensureDefaultBuildProfiles(projectRoot);
+			yield* printHuman(`Wrote eas.json with default profiles to ${created.path}.`);
+			yield* printHumanKeyValue([["Profiles", created.added.join(", ")], ["Path", created.path]]);
+			return {
+				action: "created",
+				path: created.path,
+				profiles: created.added
 			};
 		}
-		const config = yield* parseEasConfig(yield* fs.readFileString(easJsonPath).pipe(Effect.mapError((cause) => new BuildProfileError({ message: `Failed to read eas.json: ${cause.message}` }))));
+		const config = yield* parseEasConfig(yield* fs.readFileString(filePath).pipe(Effect.mapError((cause) => new BuildProfileError({ message: `Failed to read eas.json: ${cause.message}` }))));
 		const existingProfiles = Object.keys(config.build ?? {});
-		const missing = DEFAULT_PROFILES.filter((name) => !existingProfiles.includes(name));
+		const missing = DEFAULT_PROFILE_NAMES.filter((name) => !existingProfiles.includes(name));
 		if (missing.length === 0) {
 			yield* printHuman(`eas.json already defines all default profiles (${existingProfiles.join(", ")}). Nothing to add.`);
 			yield* printHuman("Pass --force to overwrite with the default template.");
 			return {
 				action: "noop",
-				path: easJsonPath,
+				path: filePath,
 				existing: existingProfiles
 			};
 		}
@@ -24297,28 +24976,21 @@ const configureBuildCommand = defineCommand({
 			yield* printHuman("Aborted. eas.json was not modified.");
 			return {
 				action: "aborted",
-				path: easJsonPath
+				path: filePath
 			};
 		}
-		const additions = Object.fromEntries(missing.map((name) => [name, DEFAULT_EAS_JSON.build[name]]));
-		yield* writeEasJson(easJsonPath, {
-			build: {
-				...config.build,
-				...additions
-			},
-			...compact({ cli: config.cli })
-		});
-		yield* printHuman(`Added profile(s) to eas.json: ${missing.join(", ")}.`);
+		const result = yield* ensureDefaultBuildProfiles(projectRoot);
+		yield* printHuman(`Added profile(s) to eas.json: ${result.added.join(", ")}.`);
 		yield* printHumanKeyValue([
 			["Existing", existingProfiles.join(", ") || "(none)"],
-			["Added", missing.join(", ")],
-			["Path", easJsonPath]
+			["Added", result.added.join(", ")],
+			["Path", result.path]
 		]);
 		return {
 			action: "topped-up",
-			path: easJsonPath,
+			path: result.path,
 			existing: existingProfiles,
-			added: [...missing]
+			added: result.added
 		};
 	}), { json: "value" })
 });
@@ -25858,13 +26530,160 @@ const inspectP12 = (params) => Effect.try({
 	catch: (error) => new CredentialValidationError({ message: `Failed to parse P12 certificate: ${error instanceof Error ? error.message : String(error)}` })
 });
 
+//#endregion
+//#region src/lib/credentials-pass-type-certificate.ts
+/**
+* Manual upload of a Wallet Pass Type ID `.p12` certificate. The Pass Type ID
+* (`pass.*`) is passed explicitly; serial/validity come from the parsed cert and
+* the team from its OU (or `--apple-team-identifier`). Only
+* `{ p12Base64, p12Password }` is sealed.
+*/
+const uploadIosPassTypeCertificate = (api, input, bytes) => Effect.gen(function* () {
+	if (input.password === void 0) return yield* new CredentialValidationError({ message: "Missing --password required for the selected credential type." });
+	if (!input.passTypeIdentifier) return yield* new CredentialValidationError({ message: "Missing --pass-type-identifier required for a Pass Type ID certificate." });
+	const info = yield* inspectP12({
+		data: Buffer.from(bytes),
+		password: input.password
+	});
+	const appleTeamIdentifier = info.teamId ?? input.appleTeamIdentifier;
+	if (!appleTeamIdentifier) return yield* new CredentialValidationError({ message: "Could not derive Apple Team ID from the certificate; pass --apple-team-identifier." });
+	if (!info.validFrom || !info.expiresAt) return yield* new CredentialValidationError({ message: "Certificate is missing notBefore/notAfter dates." });
+	const metadata = {
+		passTypeIdentifier: input.passTypeIdentifier,
+		serialNumber: info.serialNumber,
+		appleTeamIdentifier,
+		validFrom: info.validFrom.toISOString(),
+		validUntil: info.expiresAt.toISOString()
+	};
+	const envelope = yield* sealForUpload({
+		session: yield* openVaultSessionInteractive(api),
+		credentialType: "pass-type-certificate",
+		metadata,
+		secret: {
+			p12Base64: toBase64(bytes),
+			p12Password: input.password
+		}
+	});
+	return {
+		id: (yield* api.applePassTypeCertificates.upload({ payload: {
+			...toUploadEnvelope(envelope),
+			...metadata
+		} })).id,
+		name: input.name,
+		platform: "ios",
+		type: "pass-type-certificate"
+	};
+});
+
+//#endregion
+//#region src/lib/credentials-pay-certificate.ts
+/**
+* Manual upload of an Apple Pay payment-processing `.p12` certificate. The
+* Merchant ID (`merchant.*`) is not carried reliably in the cert, so it is passed
+* explicitly; serial/validity come from the parsed cert and the team from its OU
+* (or `--apple-team-identifier`). Only `{ p12Base64, p12Password }` is sealed.
+*/
+const uploadIosPayCertificate = (api, input, bytes) => Effect.gen(function* () {
+	if (input.password === void 0) return yield* new CredentialValidationError({ message: "Missing --password required for the selected credential type." });
+	if (!input.merchantIdentifier) return yield* new CredentialValidationError({ message: "Missing --merchant-identifier required for an Apple Pay certificate." });
+	const info = yield* inspectP12({
+		data: Buffer.from(bytes),
+		password: input.password
+	});
+	const appleTeamIdentifier = info.teamId ?? input.appleTeamIdentifier;
+	if (!appleTeamIdentifier) return yield* new CredentialValidationError({ message: "Could not derive Apple Team ID from the certificate; pass --apple-team-identifier." });
+	if (!info.validFrom || !info.expiresAt) return yield* new CredentialValidationError({ message: "Certificate is missing notBefore/notAfter dates." });
+	const metadata = {
+		merchantIdentifier: input.merchantIdentifier,
+		serialNumber: info.serialNumber,
+		appleTeamIdentifier,
+		validFrom: info.validFrom.toISOString(),
+		validUntil: info.expiresAt.toISOString()
+	};
+	const envelope = yield* sealForUpload({
+		session: yield* openVaultSessionInteractive(api),
+		credentialType: "apple-pay-certificate",
+		metadata,
+		secret: {
+			p12Base64: toBase64(bytes),
+			p12Password: input.password
+		}
+	});
+	return {
+		id: (yield* api.applePayCertificates.upload({ payload: {
+			...toUploadEnvelope(envelope),
+			...metadata
+		} })).id,
+		name: input.name,
+		platform: "ios",
+		type: "apple-pay-certificate"
+	};
+});
+
+//#endregion
+//#region src/lib/credentials-push-certificate.ts
+/**
+* Derive the App ID a push SSL cert is bound to from its Common Name, e.g.
+* "Apple Push Services: com.example.app" → "com.example.app". Returns undefined
+* when the CN does not carry a reverse-DNS identifier.
+*/
+const bundleIdFromPushCertCN = (commonName) => {
+	const bundle = /:\s*(?<bundle>[A-Za-z0-9](?:[A-Za-z0-9.-]*[A-Za-z0-9])?)\s*$/u.exec(commonName)?.groups?.["bundle"];
+	return bundle?.includes(".") ? bundle : void 0;
+};
+/**
+* Manual upload of a legacy APNs Push Services `.p12` SSL certificate. The CLI
+* parses the cert locally for its metadata (serial, validity, team, and the App
+* ID from the CN) and seals `{ p12Base64, p12Password }` into the vault; the
+* server only ever stores the ciphertext.
+*/
+const uploadIosPushCertificate = (api, input, bytes) => Effect.gen(function* () {
+	if (input.password === void 0) return yield* new CredentialValidationError({ message: "Missing --password required for the selected credential type." });
+	const info = yield* inspectP12({
+		data: Buffer.from(bytes),
+		password: input.password
+	});
+	if (!info.teamId) return yield* new CredentialValidationError({ message: "Could not derive Apple Team ID from certificate subject (expected OU=TEAMID or CN with (TEAMID))." });
+	if (!info.validFrom || !info.expiresAt) return yield* new CredentialValidationError({ message: "Certificate is missing notBefore/notAfter dates." });
+	const bundleIdentifier = input.bundleIdentifier ?? bundleIdFromPushCertCN(info.signingIdentity);
+	if (!bundleIdentifier) return yield* new CredentialValidationError({ message: "Could not derive the App ID from the push certificate (expected CN 'Apple Push Services: <bundle id>'). Pass --bundle-identifier." });
+	const metadata = {
+		bundleIdentifier,
+		serialNumber: info.serialNumber,
+		appleTeamIdentifier: info.teamId,
+		validFrom: info.validFrom.toISOString(),
+		validUntil: info.expiresAt.toISOString()
+	};
+	const envelope = yield* sealForUpload({
+		session: yield* openVaultSessionInteractive(api),
+		credentialType: "push-certificate",
+		metadata,
+		secret: {
+			p12Base64: toBase64(bytes),
+			p12Password: input.password
+		}
+	});
+	return {
+		id: (yield* api.applePushCertificates.upload({ payload: {
+			...toUploadEnvelope(envelope),
+			...metadata
+		} })).id,
+		name: input.name,
+		platform: "ios",
+		type: "push-certificate"
+	};
+});
+
 //#endregion
 //#region src/lib/credentials-manager.ts
 const formatDistribution = (value) => value.toLowerCase().replaceAll("_", "-");
 const listAllCredentials = (api) => Effect.gen(function* () {
-	const [certs, pushKeys, ascKeys, profiles, keystores, googleKeys] = yield* Effect.all([
+	const [certs, pushKeys, pushCerts, payCerts, passCerts, ascKeys, profiles, keystores, googleKeys] = yield* Effect.all([
 		api.appleDistributionCertificates.list(),
 		api.applePushKeys.list(),
+		api.applePushCertificates.list(),
+		api.applePayCertificates.list(),
+		api.applePassTypeCertificates.list(),
 		api.ascApiKeys.list(),
 		api.appleProvisioningProfiles.list({ urlParams: {} }),
 		api.androidUploadKeystores.list(),
@@ -25885,6 +26704,27 @@ const listAllCredentials = (api) => Effect.gen(function* () {
 			type: "push-key",
 			distribution: null
 		})),
+		...pushCerts.items.map((cert) => ({
+			id: cert.id,
+			name: cert.bundleIdentifier,
+			platform: "ios",
+			type: "push-certificate",
+			distribution: null
+		})),
+		...payCerts.items.map((cert) => ({
+			id: cert.id,
+			name: cert.merchantIdentifier,
+			platform: "ios",
+			type: "apple-pay-certificate",
+			distribution: null
+		})),
+		...passCerts.items.map((cert) => ({
+			id: cert.id,
+			name: cert.passTypeIdentifier,
+			platform: "ios",
+			type: "pass-type-certificate",
+			distribution: null
+		})),
 		...ascKeys.items.map((key) => ({
 			id: key.id,
 			name: key.name,
@@ -26082,6 +26922,9 @@ const uploadAndroidGoogleServiceAccountKey = (api, input, bytes) => Effect.gen(f
 const uploadHandlers = {
 	"ios:distribution-certificate": uploadIosDistributionCertificate,
 	"ios:push-key": uploadIosPushKey,
+	"ios:push-certificate": uploadIosPushCertificate,
+	"ios:apple-pay-certificate": uploadIosPayCertificate,
+	"ios:pass-type-certificate": uploadIosPassTypeCertificate,
 	"ios:asc-api-key": uploadIosAscApiKey,
 	"ios:provisioning-profile": uploadIosProvisioningProfile,
 	"android:keystore": uploadAndroidKeystore,
@@ -26107,6 +26950,15 @@ const deleteCredential = (api, input) => {
 		platform: "ios",
 		type: "push-key"
 	}, () => api.applePushKeys.delete({ path })), Match.when({
+		platform: "ios",
+		type: "push-certificate"
+	}, () => api.applePushCertificates.delete({ path })), Match.when({
+		platform: "ios",
+		type: "apple-pay-certificate"
+	}, () => api.applePayCertificates.delete({ path })), Match.when({
+		platform: "ios",
+		type: "pass-type-certificate"
+	}, () => api.applePassTypeCertificates.delete({ path })), Match.when({
 		platform: "ios",
 		type: "asc-api-key"
 	}, () => api.ascApiKeys.delete({ path })), Match.when({
@@ -26187,6 +27039,9 @@ const TYPE_LABELS = {
 	"distribution-certificate": "iOS distribution certificate",
 	"provisioning-profile": "iOS provisioning profile",
 	"push-key": "APNs push key",
+	"push-certificate": "APNs push SSL certificate",
+	"apple-pay-certificate": "Apple Pay certificate",
+	"pass-type-certificate": "Pass Type ID certificate",
 	"asc-api-key": "ASC API key",
 	keystore: "Android keystore",
 	"google-service-account-key": "Google service account key"
@@ -27674,6 +28529,9 @@ const CREDENTIAL_TYPES$3 = [
 	"distribution-certificate",
 	"provisioning-profile",
 	"push-key",
+	"push-certificate",
+	"apple-pay-certificate",
+	"pass-type-certificate",
 	"asc-api-key",
 	"keystore",
 	"google-service-account-key"
@@ -27790,6 +28648,9 @@ const DOWNLOAD_TYPES = [
 	"distribution-certificate",
 	"provisioning-profile",
 	"push-key",
+	"push-certificate",
+	"apple-pay-certificate",
+	"pass-type-certificate",
 	"asc-api-key",
 	"keystore",
 	"google-service-account-key"
@@ -27881,6 +28742,105 @@ const downloadPushKey = ({ api, id, cwd, output }) => Effect.gen(function* () {
 		}
 	};
 });
+const downloadPushCertificate = ({ api, id, cwd, output }) => Effect.gen(function* () {
+	const data = yield* api.applePushCertificates.download({ path: { id } });
+	const secret = yield* openFromDownload({
+		session: yield* openVaultSessionInteractive(api),
+		credentialType: "push-certificate",
+		downloaded: data
+	});
+	const p12Base64 = yield* secretString(secret, "p12Base64");
+	const p12Password = yield* secretString(secret, "p12Password");
+	const filePath = resolveOutputPath(cwd, output, `${data.id}.p12`);
+	yield* writeBinary(filePath, fromBase64(p12Base64));
+	return {
+		path: filePath,
+		pairs: [
+			["Path", filePath],
+			["Type", "Apple push SSL certificate (.p12)"],
+			["Bundle", data.bundleIdentifier],
+			["Serial", data.serialNumber],
+			["Apple team", data.appleTeamIdentifier],
+			["Valid from", data.validFrom],
+			["Valid until", data.validUntil],
+			["P12 password", p12Password]
+		],
+		metadata: {
+			bundleIdentifier: data.bundleIdentifier,
+			serialNumber: data.serialNumber,
+			appleTeamIdentifier: data.appleTeamIdentifier,
+			validFrom: data.validFrom,
+			validUntil: data.validUntil,
+			p12Password
+		}
+	};
+});
+const downloadPayCertificate = ({ api, id, cwd, output }) => Effect.gen(function* () {
+	const data = yield* api.applePayCertificates.download({ path: { id } });
+	const secret = yield* openFromDownload({
+		session: yield* openVaultSessionInteractive(api),
+		credentialType: "apple-pay-certificate",
+		downloaded: data
+	});
+	const p12Base64 = yield* secretString(secret, "p12Base64");
+	const p12Password = yield* secretString(secret, "p12Password");
+	const filePath = resolveOutputPath(cwd, output, `${data.id}.p12`);
+	yield* writeBinary(filePath, fromBase64(p12Base64));
+	return {
+		path: filePath,
+		pairs: [
+			["Path", filePath],
+			["Type", "Apple Pay payment processing certificate (.p12)"],
+			["Merchant", data.merchantIdentifier],
+			["Serial", data.serialNumber],
+			["Apple team", data.appleTeamIdentifier],
+			["Valid from", data.validFrom],
+			["Valid until", data.validUntil],
+			["P12 password", p12Password]
+		],
+		metadata: {
+			merchantIdentifier: data.merchantIdentifier,
+			serialNumber: data.serialNumber,
+			appleTeamIdentifier: data.appleTeamIdentifier,
+			validFrom: data.validFrom,
+			validUntil: data.validUntil,
+			p12Password
+		}
+	};
+});
+const downloadPassTypeCertificate = ({ api, id, cwd, output }) => Effect.gen(function* () {
+	const data = yield* api.applePassTypeCertificates.download({ path: { id } });
+	const secret = yield* openFromDownload({
+		session: yield* openVaultSessionInteractive(api),
+		credentialType: "pass-type-certificate",
+		downloaded: data
+	});
+	const p12Base64 = yield* secretString(secret, "p12Base64");
+	const p12Password = yield* secretString(secret, "p12Password");
+	const filePath = resolveOutputPath(cwd, output, `${data.id}.p12`);
+	yield* writeBinary(filePath, fromBase64(p12Base64));
+	return {
+		path: filePath,
+		pairs: [
+			["Path", filePath],
+			["Type", "Wallet Pass Type ID certificate (.p12)"],
+			["Pass Type ID", data.passTypeIdentifier],
+			["Serial", data.serialNumber],
+			["Apple team", data.appleTeamIdentifier],
+			["Valid from", data.validFrom],
+			["Valid until", data.validUntil],
+			["P12 password", p12Password]
+		],
+		metadata: {
+			passTypeIdentifier: data.passTypeIdentifier,
+			serialNumber: data.serialNumber,
+			appleTeamIdentifier: data.appleTeamIdentifier,
+			validFrom: data.validFrom,
+			validUntil: data.validUntil,
+			p12Password
+		}
+	};
+});
 const downloadAscApiKey$1 = ({ api, id, cwd, output }) => Effect.gen(function* () {
 	const data = yield* api.ascApiKeys.getCredentials({ path: { id } });
 	const p8Pem = yield* secretString(yield* openFromDownload({
@@ -27965,6 +28925,9 @@ const dispatchDownload = (ctx, type) => {
 		case "distribution-certificate": return downloadDistributionCertificate(ctx);
 		case "provisioning-profile": return downloadProvisioningProfile$1(ctx);
 		case "push-key": return downloadPushKey(ctx);
+		case "push-certificate": return downloadPushCertificate(ctx);
+		case "apple-pay-certificate": return downloadPayCertificate(ctx);
+		case "pass-type-certificate": return downloadPassTypeCertificate(ctx);
 		case "asc-api-key": return downloadAscApiKey$1(ctx);
 		case "keystore": return downloadKeystore(ctx);
 		case "google-service-account-key": return downloadGoogleServiceAccountKey(ctx);
@@ -28010,6 +28973,99 @@ const downloadCommand = defineCommand({
 	}), { json: "value" })
 });
 
+//#endregion
+//#region src/lib/credentials-generator-merchant.ts
+/**
+* Enable the Apple Pay capability on an App ID, registering the App ID first if
+* it does not exist yet. Returns once the capability is on.
+*/
+const enableApplePayCapability = (ctx, bundleIdentifier) => Effect.gen(function* () {
+	const bundle = (yield* wrap("apple-find-bundle-id", async () => AppleUtils.BundleId.findAsync(ctx, { identifier: bundleIdentifier }))) ?? (yield* wrap("apple-create-bundle-id", async () => AppleUtils.BundleId.createAsync(ctx, {
+		identifier: bundleIdentifier,
+		name: bundleIdentifier,
+		platform: AppleUtils.BundleIdPlatform.IOS
+	})));
+	yield* wrap("apple-enable-apple-pay", async () => bundle.updateBundleIdCapabilityAsync({
+		capabilityType: AppleUtils.CapabilityType.APPLE_PAY,
+		option: AppleUtils.CapabilityTypeOption.ON
+	}));
+});
+/**
+* Register an Apple Pay Merchant ID (`merchant.*`) on the Developer Portal via an
+* Apple ID session, optionally enabling the Apple Pay capability on an App ID.
+* This is the one piece of Apple Pay onboarding the portal API supports — the
+* payment-processing certificate itself is still created out-of-band (usually by
+* the PSP) and uploaded via `credentials upload --type apple-pay-certificate`.
+*/
+const registerMerchantIdViaAppleId = (input) => Effect.gen(function* () {
+	const merchant = yield* wrap("apple-create-merchant-id", async () => AppleUtils.MerchantId.createAsync(input.context, {
+		identifier: input.identifier,
+		name: input.name
+	}));
+	if (input.bundleIdentifier !== void 0 && input.bundleIdentifier.length > 0) yield* enableApplePayCapability(input.context, input.bundleIdentifier);
+	return {
+		developerPortalIdentifier: merchant.id,
+		identifier: input.identifier,
+		name: input.name,
+		capabilityEnabledForBundleId: input.bundleIdentifier
+	};
+});
+
+//#endregion
+//#region src/commands/credentials/generate-merchant-id.ts
+const MERCHANT_ID_PATTERN = /^merchant\.[A-Za-z0-9][A-Za-z0-9.-]*$/u;
+const MERCHANT_EXIT_EXTRAS = {
+	CredentialValidationError: 2,
+	AppleIdGenerateFailedError: 6,
+	AppleAuthError: 4,
+	InteractiveProhibitedError: 4
+};
+const merchantIdCommand = defineCommand({
+	meta: {
+		name: "merchant-id",
+		description: "Register an Apple Pay Merchant ID (merchant.*) on the Developer Portal via Apple ID login, optionally turning on Apple Pay for an App ID. The payment-processing certificate itself is uploaded separately with `credentials upload --type apple-pay-certificate`."
+	},
+	args: {
+		identifier: {
+			type: "string",
+			required: true,
+			description: "Merchant ID (merchant.*)"
+		},
+		name: {
+			type: "string",
+			description: "Display name (defaults to the identifier)"
+		},
+		"bundle-identifier": {
+			type: "string",
+			description: "App ID to enable the Apple Pay capability on"
+		}
+	},
+	run: async ({ args }) => runEffect(Effect.gen(function* () {
+		const identifier = args.identifier.trim();
+		if (!MERCHANT_ID_PATTERN.test(identifier)) return yield* new CredentialValidationError({ message: `Merchant ID "${identifier}" must look like merchant.com.example.` });
+		const auth = yield* AppleAuth;
+		const session = yield* auth.ensureLoggedIn();
+		yield* printHuman("Registering Apple Pay Merchant ID via your Apple ID...");
+		const created = yield* registerMerchantIdViaAppleId({
+			context: auth.buildRequestContext(session),
+			identifier,
+			name: args.name ?? identifier,
+			...compact({ bundleIdentifier: args["bundle-identifier"] })
+		});
+		yield* printHuman("Merchant ID registered.");
+		yield* printHumanKeyValue([
+			["Merchant ID", created.identifier],
+			["Name", created.name],
+			["Apple identifier", created.developerPortalIdentifier],
+			["Apple Pay enabled on", created.capabilityEnabledForBundleId ?? "-"]
+		]);
+		return created;
+	}), {
+		exits: MERCHANT_EXIT_EXTRAS,
+		json: "value"
+	})
+});
+
 //#endregion
 //#region src/commands/credentials/generate-push-key.ts
 const PUSH_KEY_EXIT_EXTRAS = {
@@ -28408,6 +29464,7 @@ const generateCommand$1 = defineCommand({
 		"distribution-certificate": distributionCertificateCommand$1,
 		"provisioning-profile": provisioningProfileCommand,
 		"push-key": pushKeyCommand$1,
+		"merchant-id": merchantIdCommand,
 		"gsa-key": gsaKeyCommand
 	}
 });
@@ -28708,6 +29765,9 @@ const CREDENTIAL_TYPES$2 = [
 	"distribution-certificate",
 	"provisioning-profile",
 	"push-key",
+	"push-certificate",
+	"apple-pay-certificate",
+	"pass-type-certificate",
 	"asc-api-key",
 	"keystore",
 	"google-service-account-key"
@@ -29572,6 +30632,9 @@ const CREDENTIAL_TYPES$1 = [
 	"distribution-certificate",
 	"provisioning-profile",
 	"push-key",
+	"push-certificate",
+	"apple-pay-certificate",
+	"pass-type-certificate",
 	"asc-api-key",
 	"keystore",
 	"google-service-account-key"
@@ -29625,6 +30688,18 @@ const uploadCommand = defineCommand({
 		"apple-team-identifier": {
 			type: "string",
 			description: "Apple Team ID"
+		},
+		"bundle-identifier": {
+			type: "string",
+			description: "App ID for a push certificate (else derived from the cert CN)"
+		},
+		"merchant-identifier": {
+			type: "string",
+			description: "Merchant ID (merchant.*) for an Apple Pay certificate"
+		},
+		"pass-type-identifier": {
+			type: "string",
+			description: "Pass Type ID (pass.*) for a Pass Type ID certificate"
 		}
 	},
 	run: async ({ args }) => runEffect(Effect.gen(function* () {
@@ -29639,7 +30714,10 @@ const uploadCommand = defineCommand({
 				keyPassword: args["key-password"],
 				keyId: args["key-id"],
 				issuerId: args["issuer-id"],
-				appleTeamIdentifier: args["apple-team-identifier"]
+				appleTeamIdentifier: args["apple-team-identifier"],
+				bundleIdentifier: args["bundle-identifier"],
+				merchantIdentifier: args["merchant-identifier"],
+				passTypeIdentifier: args["pass-type-identifier"]
 			})
 		});
 		yield* printHuman("Credential uploaded successfully.");
@@ -29713,6 +30791,9 @@ const CREDENTIAL_TYPES = [
 	"distribution-certificate",
 	"provisioning-profile",
 	"push-key",
+	"push-certificate",
+	"apple-pay-certificate",
+	"pass-type-certificate",
 	"asc-api-key",
 	"keystore",
 	"google-service-account-key"
@@ -29777,6 +30858,66 @@ const viewPushKey = (api, id) => Effect.gen(function* () {
 		raw: item
 	};
 });
+const viewPushCertificate = (api, id) => Effect.gen(function* () {
+	const { items } = yield* api.applePushCertificates.list();
+	const item = items.find((entry) => entry.id === id);
+	if (!item) return yield* notFound(id, "push-certificate");
+	return {
+		kind: "push-certificate",
+		pairs: [
+			["ID", item.id],
+			["Type", "Apple push SSL certificate"],
+			["Bundle identifier", item.bundleIdentifier],
+			["Serial number", item.serialNumber],
+			["Apple team ID", item.appleTeamId],
+			["Valid from", item.validFrom],
+			["Valid until", item.validUntil],
+			["Created", item.createdAt],
+			["Updated", item.updatedAt]
+		],
+		raw: item
+	};
+});
+const viewPayCertificate = (api, id) => Effect.gen(function* () {
+	const { items } = yield* api.applePayCertificates.list();
+	const item = items.find((entry) => entry.id === id);
+	if (!item) return yield* notFound(id, "apple-pay-certificate");
+	return {
+		kind: "apple-pay-certificate",
+		pairs: [
+			["ID", item.id],
+			["Type", "Apple Pay payment processing certificate"],
+			["Merchant identifier", item.merchantIdentifier],
+			["Serial number", item.serialNumber],
+			["Apple team ID", item.appleTeamId],
+			["Valid from", item.validFrom],
+			["Valid until", item.validUntil],
+			["Created", item.createdAt],
+			["Updated", item.updatedAt]
+		],
+		raw: item
+	};
+});
+const viewPassTypeCertificate = (api, id) => Effect.gen(function* () {
+	const { items } = yield* api.applePassTypeCertificates.list();
+	const item = items.find((entry) => entry.id === id);
+	if (!item) return yield* notFound(id, "pass-type-certificate");
+	return {
+		kind: "pass-type-certificate",
+		pairs: [
+			["ID", item.id],
+			["Type", "Wallet Pass Type ID certificate"],
+			["Pass Type ID", item.passTypeIdentifier],
+			["Serial number", item.serialNumber],
+			["Apple team ID", item.appleTeamId],
+			["Valid from", item.validFrom],
+			["Valid until", item.validUntil],
+			["Created", item.createdAt],
+			["Updated", item.updatedAt]
+		],
+		raw: item
+	};
+});
 const viewAscApiKey = (api, id) => Effect.gen(function* () {
 	const { items } = yield* api.ascApiKeys.list();
 	const item = items.find((entry) => entry.id === id);
@@ -29835,6 +30976,9 @@ const lookupByType = (api, id, type) => {
 		case "distribution-certificate": return viewDistributionCertificate(api, id);
 		case "provisioning-profile": return viewProvisioningProfile(api, id);
 		case "push-key": return viewPushKey(api, id);
+		case "push-certificate": return viewPushCertificate(api, id);
+		case "apple-pay-certificate": return viewPayCertificate(api, id);
+		case "pass-type-certificate": return viewPassTypeCertificate(api, id);
 		case "asc-api-key": return viewAscApiKey(api, id);
 		case "keystore": return viewKeystore(api, id);
 		case "google-service-account-key": return viewGoogleServiceAccountKey(api, id);
@@ -32023,6 +33167,20 @@ const persistLink = (projectRoot, projectId, hasExpoConfig) => Effect.gen(functi
 		configPath: filePath
 	};
 });
+/**
+* Scaffold the default `eas.json` build profiles after linking so a freshly
+* `init`ed project can `build` straight away. Only acts when no `build` section
+* exists yet — a project that already defines profiles is left untouched (run
+* `build configure` to top those up). Use `build configure` to re-scaffold.
+*/
+const scaffoldBuildProfiles = (projectRoot) => Effect.gen(function* () {
+	const existing = yield* readEasJsonRaw(projectRoot);
+	const existingBuild = isRecord$1(existing?.["build"]) ? existing["build"] : {};
+	if (Object.keys(existingBuild).length > 0) return [];
+	const result = yield* ensureDefaultBuildProfiles(projectRoot);
+	yield* printHuman(`Scaffolded eas.json with default build profiles: ${result.added.join(", ")}.`);
+	return result.added;
+});
 const initCommand = defineCommand({
 	meta: {
 		name: "init",
@@ -32050,9 +33208,12 @@ const initCommand = defineCommand({
 		if (args.id !== void 0 && args.id.length > 0) {
 			const project = yield* api.projects.get({ path: { id: args.id } });
 			yield* printHuman(`Linking project: ${project.name} (${project.id})`);
+			const linked = yield* persistLink(projectRoot, project.id, hasExpoConfig);
+			const buildProfiles = yield* scaffoldBuildProfiles(projectRoot);
 			return {
 				linked: true,
-				...yield* persistLink(projectRoot, project.id, hasExpoConfig)
+				...linked,
+				buildProfiles
 			};
 		}
 		const { name, slug } = yield* resolveNameAndSlug(args, projectRoot, expoConfig);
@@ -32066,21 +33227,24 @@ const initCommand = defineCommand({
 			limit: 100
 		} });
 		const existing = items.find((project) => project.slug === slug);
+		const linked = yield* persistLink(projectRoot, yield* Effect.gen(function* () {
+			if (existing) {
+				yield* printHuman(`Found existing project: ${existing.name} (${existing.id})`);
+				return existing.id;
+			}
+			yield* printHuman("No existing project found. Creating new project...");
+			const created = yield* api.projects.create({ payload: {
+				name,
+				slug
+			} });
+			yield* printHuman(`Created project: ${created.name} (${created.id})`);
+			return created.id;
+		}), hasExpoConfig);
+		const buildProfiles = yield* scaffoldBuildProfiles(projectRoot);
 		return {
 			linked: true,
-			...yield* persistLink(projectRoot, yield* Effect.gen(function* () {
-				if (existing) {
-					yield* printHuman(`Found existing project: ${existing.name} (${existing.id})`);
-					return existing.id;
-				}
-				yield* printHuman("No existing project found. Creating new project...");
-				const created = yield* api.projects.create({ payload: {
-					name,
-					slug
-				} });
-				yield* printHuman(`Created project: ${created.name} (${created.id})`);
-				return created.id;
-			}), hasExpoConfig)
+			...linked,
+			buildProfiles
 		};
 	}), { json: "value" })
 });
@@ -32709,17 +33873,33 @@ const runFlow = (api, projectId, args) => Effect.gen(function* () {
 	});
 	yield* printHuman(`Submission created: ${submission.id} (${submission.status})`);
 	if (args.platform === "ios" && iosConfig !== void 0) {
-		const ascApiKeyId = args.easProfile.ios?.ascApiKeyId;
-		if (ascApiKeyId === void 0) {
-			yield* printHuman("iOS submission queued. Resolve ascApiKeyId in eas.json submit profile to enable client-side altool upload.");
+		const iosProfile = args.easProfile.ios;
+		const auth = resolveIosUploadAuth({
+			appleId: iosProfile?.appleId,
+			ascApiKeyId: iosProfile?.ascApiKeyId,
+			hasAppSpecificPassword: hasAppleAppSpecificPassword()
+		});
+		if (auth === null) {
+			yield* printHuman("iOS submission queued. Add ascApiKeyId to the eas.json submit profile, or set appleId + the EXPO_APPLE_APP_SPECIFIC_PASSWORD env var, to enable client-side altool upload.");
 			return submission;
 		}
-		yield* printHuman("Running xcrun altool upload locally...");
-		yield* runIosAltoolUpload({
+		yield* printHuman(auth.kind === "app-specific-password" ? "Running xcrun altool upload (Apple ID app-specific password)..." : "Running xcrun altool upload (ASC API key)...");
+		yield* runIosSubmit({
 			api,
 			submissionId: submission.id,
-			ipaPath: args.archive.archiveUrl,
-			ascApiKeyId
+			archive: {
+				source: args.archive.archiveSource,
+				value: args.archive.archiveUrl
+			},
+			auth,
+			ascApiKeyId: iosProfile?.ascApiKeyId,
+			config: {
+				bundleIdentifier: iosConfig.bundleIdentifier,
+				ascAppId: iosProfile?.ascAppId,
+				language: iosProfile?.language,
+				whatToTest: args.whatToTest,
+				groups: iosProfile?.groups ?? []
+			}
 		});
 	}
 	if (args.platform === "android" && args.easProfile.android !== void 0) {
@@ -35897,10 +37077,11 @@ const bootstrapVersionCheck = (currentVersion, installerHint, spawnRefresh, opti
 	if (yield* isOptedOut) return;
 	const versionCheck = yield* VersionCheck;
 	if (options?.quiet !== true) {
-		const cached = yield* versionCheck.cachedLatest;
-		if (cached && isNewerVersion(cached, currentVersion)) {
+		let latest = yield* versionCheck.cachedLatest;
+		if (latest === void 0) latest = yield* versionCheck.fetchLatest;
+		if (latest && isNewerVersion(latest, currentVersion)) {
 			const installer = detectInstallerFromImportMetaUrl(installerHint);
-			yield* Console.error(formatNotice(currentVersion, cached, installCommand(installer)));
+			yield* Console.error(formatNotice(currentVersion, latest, installCommand(installer)));
 		}
 	}
 	if (yield* versionCheck.cacheStale) spawnRefresh();