@lynxship/cli 0.1.20 → 0.1.21

package/dist/secure-store/backends.js

@@ -0,0 +1,248 @@
+import { unlink } from "node:fs/promises";
+import { spawn } from "node:child_process";
+import { join, resolve } from "node:path";
+import { assert } from "@lynxship/contracts";
+import { globalLynxShipDirectory } from "../paths.js";
+import { commandExists } from "../process-runner.js";
+const fileName = ".credentials.dpapi.json";
+const keychainService = "com.lynxship.cli.credentials";
+export function credentialFile(root, global = false) {
+    return join(global ? globalLynxShipDirectory() : join(root, ".lynxship"), fileName);
+}
+function runPowerShell(command, input) {
+    return new Promise((resolve, reject) => {
+        const child = spawn(`${process.env.SystemRoot ?? "C:\\Windows"}\\System32\\WindowsPowerShell\\v1.0\\powershell.exe`, ["-NoProfile", "-NonInteractive", "-Command", command], {
+            windowsHide: true,
+            stdio: ["pipe", "pipe", "pipe"],
+            env: {
+                ...process.env,
+                PSModulePath: [
+                    `${process.env.SystemRoot ?? "C:\\Windows"}\\System32\\WindowsPowerShell\\v1.0\\Modules`,
+                    `${process.env.ProgramFiles ?? "C:\\Program Files"}\\WindowsPowerShell\\Modules`,
+                ].join(";"),
+            },
+        });
+        let output = "";
+        let error = "";
+        child.stdout.on("data", (chunk) => (output += chunk.toString()));
+        child.stderr.on("data", (chunk) => (error += chunk.toString()));
+        child.once("error", reject);
+        child.once("close", (code) => {
+            if (code !== 0)
+                reject(new Error(error.trim() || "Windows secure storage failed"));
+            else
+                resolve(output.trim());
+        });
+        child.stdin.end(input);
+    });
+}
+export async function protect(value) {
+    if (process.platform !== "win32")
+        return value;
+    return runPowerShell("Import-Module Microsoft.PowerShell.Security; $input | ConvertTo-SecureString -AsPlainText -Force | ConvertFrom-SecureString", value);
+}
+export async function unprotect(value) {
+    if (process.platform !== "win32")
+        return value;
+    return runPowerShell("Import-Module Microsoft.PowerShell.Security; $cipher = [Console]::In.ReadToEnd(); $secure = ConvertTo-SecureString $cipher; $ptr = [Runtime.InteropServices.Marshal]::SecureStringToBSTR($secure); try { [Runtime.InteropServices.Marshal]::PtrToStringBSTR($ptr) } finally { [Runtime.InteropServices.Marshal]::ZeroFreeBSTR($ptr) }", value);
+}
+export function runSecurity(args) {
+    return new Promise((resolveOutput, reject) => {
+        const child = spawn("security", args, {
+            stdio: ["pipe", "pipe", "pipe"],
+        });
+        let output = "";
+        let error = "";
+        child.stdout.on("data", (chunk) => (output += chunk.toString()));
+        child.stderr.on("data", (chunk) => (error += chunk.toString()));
+        child.once("error", reject);
+        child.once("close", (code) => {
+            if (code !== 0)
+                reject(new Error(error.trim() || "macOS Keychain operation failed"));
+            else
+                resolveOutput(output.trim());
+        });
+        child.stdin.end();
+    });
+}
+export function runSecretTool(args, input = "") {
+    return new Promise((resolveOutput, reject) => {
+        const child = spawn("secret-tool", args, {
+            stdio: ["pipe", "pipe", "pipe"],
+        });
+        let output = "";
+        let error = "";
+        child.stdout.on("data", (chunk) => (output += chunk.toString()));
+        child.stderr.on("data", (chunk) => (error += chunk.toString()));
+        child.once("error", reject);
+        child.once("close", (code) => {
+            if (code !== 0)
+                reject(new Error(error.trim() || "Linux Secret Service operation failed"));
+            else
+                resolveOutput(output.trim());
+        });
+        child.stdin.end(input);
+    });
+}
+export function keychainAccount(root, global) {
+    return global ? "global" : `project:${resolve(root)}`;
+}
+export function secretServiceAccount(root, global) {
+    return keychainAccount(root, global);
+}
+export function credentialValues(credentials) {
+    const values = {};
+    if (credentials.r2) {
+        values.r2AccessKeyId = credentials.r2.accessKeyId;
+        values.r2SecretAccessKey = credentials.r2.secretAccessKey;
+    }
+    if (credentials.android) {
+        values.androidKeystorePath = credentials.android.keystorePath;
+        values.androidKeyAlias = credentials.android.keyAlias;
+        values.androidKeystorePassword = credentials.android.keystorePassword;
+        values.androidKeyPassword = credentials.android.keyPassword;
+    }
+    if (credentials.googlePlay) {
+        values.googlePlayServiceAccountJson =
+            credentials.googlePlay.serviceAccountJson;
+        values.googlePlayApplicationId = credentials.googlePlay.applicationId;
+        values.googlePlayTrack = credentials.googlePlay.track;
+        values.googlePlayReleaseStatus = credentials.googlePlay.releaseStatus;
+    }
+    if (credentials.appStoreConnect) {
+        values.ascApiKeyId = credentials.appStoreConnect.apiKeyId;
+        values.ascIssuerId = credentials.appStoreConnect.issuerId;
+        values.ascPrivateKey = credentials.appStoreConnect.privateKey;
+        values.ascBundleIdentifier = credentials.appStoreConnect.bundleIdentifier;
+        values.ascAppId = credentials.appStoreConnect.ascAppId ?? "";
+        values.ascTransporterPath =
+            credentials.appStoreConnect.transporterPath ?? "";
+    }
+    return values;
+}
+export function credentialsFromValues(values) {
+    return {
+        r2: values.r2AccessKeyId && values.r2SecretAccessKey
+            ? {
+                accessKeyId: values.r2AccessKeyId,
+                secretAccessKey: values.r2SecretAccessKey,
+            }
+            : undefined,
+        android: values.androidKeystorePath &&
+            values.androidKeyAlias &&
+            values.androidKeystorePassword &&
+            values.androidKeyPassword
+            ? {
+                keystorePath: values.androidKeystorePath,
+                keyAlias: values.androidKeyAlias,
+                keystorePassword: values.androidKeystorePassword,
+                keyPassword: values.androidKeyPassword,
+            }
+            : undefined,
+        googlePlay: values.googlePlayServiceAccountJson &&
+            values.googlePlayApplicationId &&
+            values.googlePlayTrack &&
+            values.googlePlayReleaseStatus
+            ? {
+                serviceAccountJson: values.googlePlayServiceAccountJson,
+                applicationId: values.googlePlayApplicationId,
+                track: values.googlePlayTrack,
+                releaseStatus: values.googlePlayReleaseStatus,
+            }
+            : undefined,
+        appStoreConnect: values.ascApiKeyId &&
+            values.ascIssuerId &&
+            values.ascPrivateKey &&
+            values.ascBundleIdentifier
+            ? {
+                apiKeyId: values.ascApiKeyId,
+                issuerId: values.ascIssuerId,
+                privateKey: values.ascPrivateKey,
+                bundleIdentifier: values.ascBundleIdentifier,
+                ascAppId: values.ascAppId || undefined,
+                transporterPath: values.ascTransporterPath || undefined,
+            }
+            : undefined,
+    };
+}
+export async function readKeychain(root, global) {
+    try {
+        const value = await runSecurity([
+            "find-generic-password",
+            "-a",
+            keychainAccount(root, global),
+            "-s",
+            keychainService,
+            "-w",
+        ]);
+        const stored = JSON.parse(value);
+        assert(stored.version === 1 && stored.platform === "macos-keychain", "CLI_CREDENTIALS_INVALID", "Unsupported LynxShip Keychain record");
+        return credentialsFromValues(stored.values);
+    }
+    catch {
+        return undefined;
+    }
+}
+export async function saveKeychain(root, credentials, global) {
+    const record = {
+        version: 1,
+        platform: "macos-keychain",
+        values: credentialValues(credentials),
+    };
+    await runSecurity([
+        "add-generic-password",
+        "-U",
+        "-a",
+        keychainAccount(root, global),
+        "-s",
+        keychainService,
+        "-w",
+        JSON.stringify(record),
+    ]);
+    await unlink(credentialFile(root, global)).catch(() => undefined);
+}
+export async function readSecretService(root, global) {
+    if (process.platform !== "linux" || !commandExists("secret-tool"))
+        return undefined;
+    try {
+        const value = await runSecretTool([
+            "lookup",
+            "application",
+            keychainService,
+            "account",
+            secretServiceAccount(root, global),
+        ]);
+        if (!value)
+            return undefined;
+        const stored = JSON.parse(value);
+        assert(stored.version === 1 && stored.platform === "linux-secret-service", "CLI_CREDENTIALS_INVALID", "Unsupported LynxShip Linux Secret Service record");
+        return credentialsFromValues(stored.values);
+    }
+    catch {
+        return undefined;
+    }
+}
+export async function saveSecretService(root, credentials, global) {
+    if (process.platform !== "linux" || !commandExists("secret-tool"))
+        return false;
+    const record = {
+        version: 1,
+        platform: "linux-secret-service",
+        values: credentialValues(credentials),
+    };
+    try {
+        await runSecretTool([
+            "store",
+            "--label",
+            "LynxShip CLI credentials",
+            "application",
+            keychainService,
+            "account",
+            secretServiceAccount(root, global),
+        ], JSON.stringify(record));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/secure-store/types.d.ts

@@ -0,0 +1,27 @@
+export interface StoredCredentials {
+    r2?: {
+        accessKeyId: string;
+        secretAccessKey: string;
+    };
+    android?: {
+        keystorePath: string;
+        keyAlias: string;
+        keystorePassword: string;
+        keyPassword: string;
+    };
+    googlePlay?: {
+        serviceAccountJson: string;
+        applicationId: string;
+        track: string;
+        releaseStatus: "draft" | "completed" | "inProgress" | "halted";
+    };
+    appStoreConnect?: {
+        apiKeyId: string;
+        issuerId: string;
+        privateKey: string;
+        bundleIdentifier: string;
+        ascAppId?: string;
+        transporterPath?: string;
+    };
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/secure-store/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/secure-store/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,iBAAiB;IAChC,EAAE,CAAC,EAAE;QACH,WAAW,EAAE,MAAM,CAAC;QACpB,eAAe,EAAE,MAAM,CAAC;KACzB,CAAC;IACF,OAAO,CAAC,EAAE;QACR,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,EAAE,MAAM,CAAC;QACjB,gBAAgB,EAAE,MAAM,CAAC;QACzB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,UAAU,CAAC,EAAE;QACX,kBAAkB,EAAE,MAAM,CAAC;QAC3B,aAAa,EAAE,MAAM,CAAC;QACtB,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,EAAE,OAAO,GAAG,WAAW,GAAG,YAAY,GAAG,QAAQ,CAAC;KAChE,CAAC;IACF,eAAe,CAAC,EAAE;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,MAAM,CAAC;QACnB,gBAAgB,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;CACH"}

package/dist/secure-store/types.js

@@ -0,0 +1 @@
+export {};

package/dist/secure-store.d.ts

@@ -1,29 +1,5 @@
-export interface StoredCredentials {
-    r2?: {
-        accessKeyId: string;
-        secretAccessKey: string;
-    };
-    android?: {
-        keystorePath: string;
-        keyAlias: string;
-        keystorePassword: string;
-        keyPassword: string;
-    };
-    googlePlay?: {
-        serviceAccountJson: string;
-        applicationId: string;
-        track: string;
-        releaseStatus: "draft" | "completed" | "inProgress" | "halted";
-    };
-    appStoreConnect?: {
-        apiKeyId: string;
-        issuerId: string;
-        privateKey: string;
-        bundleIdentifier: string;
-        ascAppId?: string;
-        transporterPath?: string;
-    };
-}
+import type { StoredCredentials } from "./secure-store/types.js";
+export type { StoredCredentials } from "./secure-store/types.js";
 export declare function credentialStorageDescription(): string;
 export declare function loadCredentials(root: string): Promise<StoredCredentials>;
 export declare function saveCredentials(root: string, credentials: StoredCredentials, options?: {

package/dist/secure-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secure-store.d.ts","sourceRoot":"","sources":["../src/secure-store.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,iBAAiB;IAChC,EAAE,CAAC,EAAE;QACH,WAAW,EAAE,MAAM,CAAC;QACpB,eAAe,EAAE,MAAM,CAAC;KACzB,CAAC;IACF,OAAO,CAAC,EAAE;QACR,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,EAAE,MAAM,CAAC;QACjB,gBAAgB,EAAE,MAAM,CAAC;QACzB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,UAAU,CAAC,EAAE;QACX,kBAAkB,EAAE,MAAM,CAAC;QAC3B,aAAa,EAAE,MAAM,CAAC;QACtB,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,EAAE,OAAO,GAAG,WAAW,GAAG,YAAY,GAAG,QAAQ,CAAC;KAChE,CAAC;IACF,eAAe,CAAC,EAAE;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,MAAM,CAAC;QACnB,gBAAgB,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;CACH;AAED,wBAAgB,4BAA4B,IAAI,MAAM,CAKrD;AAmYD,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,iBAAiB,CAAC,CAM5B;AAED,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,iBAAiB,EAC9B,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GACjC,OAAO,CAAC,IAAI,CAAC,CAmCf"}
+{"version":3,"file":"secure-store.d.ts","sourceRoot":"","sources":["../src/secure-store.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAcjE,YAAY,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAEjE,wBAAgB,4BAA4B,IAAI,MAAM,CAKrD;AA6ED,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,iBAAiB,CAAC,CAM5B;AAED,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,iBAAiB,EAC9B,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GACjC,OAAO,CAAC,IAAI,CAAC,CAmCf"}

package/dist/secure-store.js

@@ -1,9 +1,9 @@
 import { chmod, mkdir, readFile, unlink, writeFile } from "node:fs/promises";
-import { spawn } from "node:child_process";
-import { join, resolve } from "node:path";
+import { join } from "node:path";
+import { commandExists } from "./process-runner.js";
 import { assert } from "@lynxship/contracts";
 import { globalLynxShipDirectory } from "./paths.js";
-import { commandExists } from "./process-runner.js";
+import { credentialFile, credentialValues, credentialsFromValues, protect, readKeychain, readSecretService, saveKeychain, saveSecretService, unprotect, } from "./secure-store/backends.js";
 export function credentialStorageDescription() {
     if (process.platform === "win32")
         return "Windows DPAPI encrypted";
@@ -13,248 +13,6 @@ export function credentialStorageDescription() {
         return "Linux Secret Service";
     return "owner-only credential file";
 }
-const fileName = ".credentials.dpapi.json";
-const keychainService = "com.lynxship.cli.credentials";
-function credentialFile(root, global = false) {
-    return join(global ? globalLynxShipDirectory() : join(root, ".lynxship"), fileName);
-}
-function runPowerShell(command, input) {
-    return new Promise((resolve, reject) => {
-        const child = spawn(`${process.env.SystemRoot ?? "C:\\Windows"}\\System32\\WindowsPowerShell\\v1.0\\powershell.exe`, ["-NoProfile", "-NonInteractive", "-Command", command], {
-            windowsHide: true,
-            stdio: ["pipe", "pipe", "pipe"],
-            env: {
-                ...process.env,
-                PSModulePath: [
-                    `${process.env.SystemRoot ?? "C:\\Windows"}\\System32\\WindowsPowerShell\\v1.0\\Modules`,
-                    `${process.env.ProgramFiles ?? "C:\\Program Files"}\\WindowsPowerShell\\Modules`,
-                ].join(";"),
-            },
-        });
-        let output = "";
-        let error = "";
-        child.stdout.on("data", (chunk) => (output += chunk.toString()));
-        child.stderr.on("data", (chunk) => (error += chunk.toString()));
-        child.once("error", reject);
-        child.once("close", (code) => {
-            if (code !== 0)
-                reject(new Error(error.trim() || "Windows secure storage failed"));
-            else
-                resolve(output.trim());
-        });
-        child.stdin.end(input);
-    });
-}
-async function protect(value) {
-    if (process.platform !== "win32")
-        return value;
-    return runPowerShell("Import-Module Microsoft.PowerShell.Security; $input | ConvertTo-SecureString -AsPlainText -Force | ConvertFrom-SecureString", value);
-}
-async function unprotect(value) {
-    if (process.platform !== "win32")
-        return value;
-    return runPowerShell("Import-Module Microsoft.PowerShell.Security; $cipher = [Console]::In.ReadToEnd(); $secure = ConvertTo-SecureString $cipher; $ptr = [Runtime.InteropServices.Marshal]::SecureStringToBSTR($secure); try { [Runtime.InteropServices.Marshal]::PtrToStringBSTR($ptr) } finally { [Runtime.InteropServices.Marshal]::ZeroFreeBSTR($ptr) }", value);
-}
-function runSecurity(args) {
-    return new Promise((resolveOutput, reject) => {
-        const child = spawn("security", args, {
-            stdio: ["pipe", "pipe", "pipe"],
-        });
-        let output = "";
-        let error = "";
-        child.stdout.on("data", (chunk) => (output += chunk.toString()));
-        child.stderr.on("data", (chunk) => (error += chunk.toString()));
-        child.once("error", reject);
-        child.once("close", (code) => {
-            if (code !== 0)
-                reject(new Error(error.trim() || "macOS Keychain operation failed"));
-            else
-                resolveOutput(output.trim());
-        });
-        child.stdin.end();
-    });
-}
-function runSecretTool(args, input = "") {
-    return new Promise((resolveOutput, reject) => {
-        const child = spawn("secret-tool", args, {
-            stdio: ["pipe", "pipe", "pipe"],
-        });
-        let output = "";
-        let error = "";
-        child.stdout.on("data", (chunk) => (output += chunk.toString()));
-        child.stderr.on("data", (chunk) => (error += chunk.toString()));
-        child.once("error", reject);
-        child.once("close", (code) => {
-            if (code !== 0)
-                reject(new Error(error.trim() || "Linux Secret Service operation failed"));
-            else
-                resolveOutput(output.trim());
-        });
-        child.stdin.end(input);
-    });
-}
-function keychainAccount(root, global) {
-    return global ? "global" : `project:${resolve(root)}`;
-}
-function secretServiceAccount(root, global) {
-    return keychainAccount(root, global);
-}
-function credentialValues(credentials) {
-    const values = {};
-    if (credentials.r2) {
-        values.r2AccessKeyId = credentials.r2.accessKeyId;
-        values.r2SecretAccessKey = credentials.r2.secretAccessKey;
-    }
-    if (credentials.android) {
-        values.androidKeystorePath = credentials.android.keystorePath;
-        values.androidKeyAlias = credentials.android.keyAlias;
-        values.androidKeystorePassword = credentials.android.keystorePassword;
-        values.androidKeyPassword = credentials.android.keyPassword;
-    }
-    if (credentials.googlePlay) {
-        values.googlePlayServiceAccountJson =
-            credentials.googlePlay.serviceAccountJson;
-        values.googlePlayApplicationId = credentials.googlePlay.applicationId;
-        values.googlePlayTrack = credentials.googlePlay.track;
-        values.googlePlayReleaseStatus = credentials.googlePlay.releaseStatus;
-    }
-    if (credentials.appStoreConnect) {
-        values.ascApiKeyId = credentials.appStoreConnect.apiKeyId;
-        values.ascIssuerId = credentials.appStoreConnect.issuerId;
-        values.ascPrivateKey = credentials.appStoreConnect.privateKey;
-        values.ascBundleIdentifier = credentials.appStoreConnect.bundleIdentifier;
-        values.ascAppId = credentials.appStoreConnect.ascAppId ?? "";
-        values.ascTransporterPath =
-            credentials.appStoreConnect.transporterPath ?? "";
-    }
-    return values;
-}
-function credentialsFromValues(values) {
-    return {
-        r2: values.r2AccessKeyId && values.r2SecretAccessKey
-            ? {
-                accessKeyId: values.r2AccessKeyId,
-                secretAccessKey: values.r2SecretAccessKey,
-            }
-            : undefined,
-        android: values.androidKeystorePath &&
-            values.androidKeyAlias &&
-            values.androidKeystorePassword &&
-            values.androidKeyPassword
-            ? {
-                keystorePath: values.androidKeystorePath,
-                keyAlias: values.androidKeyAlias,
-                keystorePassword: values.androidKeystorePassword,
-                keyPassword: values.androidKeyPassword,
-            }
-            : undefined,
-        googlePlay: values.googlePlayServiceAccountJson &&
-            values.googlePlayApplicationId &&
-            values.googlePlayTrack &&
-            values.googlePlayReleaseStatus
-            ? {
-                serviceAccountJson: values.googlePlayServiceAccountJson,
-                applicationId: values.googlePlayApplicationId,
-                track: values.googlePlayTrack,
-                releaseStatus: values.googlePlayReleaseStatus,
-            }
-            : undefined,
-        appStoreConnect: values.ascApiKeyId &&
-            values.ascIssuerId &&
-            values.ascPrivateKey &&
-            values.ascBundleIdentifier
-            ? {
-                apiKeyId: values.ascApiKeyId,
-                issuerId: values.ascIssuerId,
-                privateKey: values.ascPrivateKey,
-                bundleIdentifier: values.ascBundleIdentifier,
-                ascAppId: values.ascAppId || undefined,
-                transporterPath: values.ascTransporterPath || undefined,
-            }
-            : undefined,
-    };
-}
-async function readKeychain(root, global) {
-    try {
-        const value = await runSecurity([
-            "find-generic-password",
-            "-a",
-            keychainAccount(root, global),
-            "-s",
-            keychainService,
-            "-w",
-        ]);
-        const stored = JSON.parse(value);
-        assert(stored.version === 1 && stored.platform === "macos-keychain", "CLI_CREDENTIALS_INVALID", "Unsupported LynxShip Keychain record");
-        return credentialsFromValues(stored.values);
-    }
-    catch {
-        return undefined;
-    }
-}
-async function saveKeychain(root, credentials, global) {
-    const record = {
-        version: 1,
-        platform: "macos-keychain",
-        values: credentialValues(credentials),
-    };
-    await runSecurity([
-        "add-generic-password",
-        "-U",
-        "-a",
-        keychainAccount(root, global),
-        "-s",
-        keychainService,
-        "-w",
-        JSON.stringify(record),
-    ]);
-    await unlink(credentialFile(root, global)).catch(() => undefined);
-}
-async function readSecretService(root, global) {
-    if (process.platform !== "linux" || !commandExists("secret-tool"))
-        return undefined;
-    try {
-        const value = await runSecretTool([
-            "lookup",
-            "application",
-            keychainService,
-            "account",
-            secretServiceAccount(root, global),
-        ]);
-        if (!value)
-            return undefined;
-        const stored = JSON.parse(value);
-        assert(stored.version === 1 && stored.platform === "linux-secret-service", "CLI_CREDENTIALS_INVALID", "Unsupported LynxShip Linux Secret Service record");
-        return credentialsFromValues(stored.values);
-    }
-    catch {
-        return undefined;
-    }
-}
-async function saveSecretService(root, credentials, global) {
-    if (process.platform !== "linux" || !commandExists("secret-tool"))
-        return false;
-    const record = {
-        version: 1,
-        platform: "linux-secret-service",
-        values: credentialValues(credentials),
-    };
-    try {
-        await runSecretTool([
-            "store",
-            "--label",
-            "LynxShip CLI credentials",
-            "application",
-            keychainService,
-            "account",
-            secretServiceAccount(root, global),
-        ], JSON.stringify(record));
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
 function mergeCredentials(global, project) {
     return {
         r2: project.r2 ?? global.r2,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lynxship/cli",
-  "version": "0.1.20",
+  "version": "0.1.21",
   "description": "Build, sign, store, submit and update LynxJS applications from the terminal.",
   "type": "module",
   "license": "MIT",
@@ -76,17 +76,20 @@
     "chalk": "5.4.1",
     "cli-progress": "3.12.0",
     "jsdom": "29.1.1",
+    "jiti": "2.7.0",
     "ora": "8.2.0",
     "pngjs": "7.0.0",
     "qr-code-styling": "1.9.2",
     "qrcode-terminal": "0.12.0",
     "@lynxship/build-orchestrator": "0.1.0",
+    "@lynxship/db": "0.1.0",
+    "@lynxship/microhs": "0.1.0",
+    "@lynxship/i18n": "0.1.0",
     "@lynxship/contracts": "0.1.0",
     "@lynxship/plugin-api": "0.1.0",
-    "@lynxship/db": "0.1.0",
-    "@lynxship/submit": "0.1.0",
+    "@lynxship/framework": "0.1.0",
     "@lynxship/signing": "0.1.0",
-    "@lynxship/microhs": "0.1.0"
+    "@lynxship/submit": "0.1.0"
   },
   "devDependencies": {
     "@types/cli-progress": "3.11.6",

package/templates/android-host/app/build.gradle

@@ -30,6 +30,7 @@ android {
 
 dependencies {
     implementation "org.lynxsdk.lynx:lynx:4.0.0"
+    implementation "androidx.annotation:annotation:1.10.0"
     implementation "org.lynxsdk.lynx:lynx-jssdk:4.0.0"
     implementation "org.lynxsdk.lynx:lynx-trace:4.0.0"
     implementation "org.lynxsdk.lynx:primjs:4.0.0"