@radhya/mach 1.4.11 → 1.4.13

package/README.md

@@ -1,8 +1,8 @@
 # Mach CLI
 
-**Cloud Build Orchestrator for React Native & Expo**
+**Cloud Build & Delivery for React Native & Expo**
 
-Mach is a powerful CLI that lets you build, sign, and submit React Native & Expo apps to the App Store and Google Play — all from the cloud. No more local build headaches.
+Mach is a CLI that lets you build, sign, and submit React Native & Expo apps — all from the cloud. No local build setup required.
 
 ## Installation
 
@@ -16,10 +16,7 @@ npm install -g @radhya/mach
 # Login to Mach Dashboard
 mach login
 
-# Initialize a new project
-mach init
-
-# Link an existing project
+# Link your project
 mach link
 
 # Run a cloud build
@@ -31,118 +28,58 @@ mach build --platform android
 
 | Command | Description |
 |---------|-------------|
-| `mach login` | Login to Mach Dashboard |
+| `mach login` | Authenticate with Mach Dashboard |
 | `mach init` | Create a new Mach project |
-| `mach link` | Link local directory to a Mach project |
-| `mach me` | Display current user details |
-| `mach build` | Run a cloud build (iOS / Android) |
-| `mach submit` | Automated store submission (App Store / Google Play) |
-| `mach credentials` | Interactive credential management (iOS / Android) |
-| `mach env` | Manage environment variables |
-| `mach config` | Show resolved configuration for a profile |
-| `mach start` | Start the development server (Metro) |
-| `mach host` | Setup AWS S3 static hosting with CloudFront |
-| `mach sitemap` | Generate sitemap.xml from Expo Router |
-| `mach audit` | Run automated security audit on the project |
-| `mach agent` | Start local device discovery agent for Install Hub (port 7070) |
-
-### Legacy Commands
-
-| Command | Description |
-|---------|-------------|
-| `mach credentials:setup` | Automated credential provisioning |
-| `mach credentials:service` | Upload service credentials (ASC API Key / Google Service JSON) |
+| `mach link` | Link local directory to an existing project |
+| `mach me` | Show current logged-in user |
+| `mach build` | Start a cloud build (iOS / Android) |
+| `mach submit` | Submit to App Store or Google Play |
+| `mach credentials` | Manage iOS certificates, provisioning profiles & Android keystores |
+| `mach env` | Manage environment variables and secrets |
+| `mach config` | Show resolved configuration for a build profile |
+| `mach start` | Start the Metro development server |
+| `mach device` | Register test devices for ad-hoc distribution |
+| `mach audit` | Run automated security checks on your project |
+| `mach agent` | Start the local device discovery agent for Install Hub |
 
 ## Cloud Builds
 
-iOS builds run on a self-hosted Mac Mini via a GitLab CI runner. Android builds run on AWS EC2 Spot Instances.
-
-### How iOS Cloud Builds Work
-
-1. **CLI zips & uploads** your source code to S3 (node_modules and build artifacts are excluded)
-2. **Dashboard API** triggers a GitLab pipeline via trigger token
-3. **GitLab runner** on the Mac Mini picks up the job — it skips git fetch (`GIT_STRATEGY: none`) since source comes from S3
-4. **Runner downloads** source from S3, extracts it, and runs `mach build --local`
-5. **Build artifacts** (IPA/APK) are uploaded back to S3
-6. **Dashboard** shows live logs and download links
-
-> **Important:** The `ios-build` GitLab repo must have `GIT_STRATEGY: none` set in `.gitlab-ci.yml` — otherwise the runner will try to git fetch from GitLab on every build, which can cause hangs if the Mac Mini has slow connectivity to GitLab.
+Trigger a build in the cloud — Mach handles zipping, uploading, compiling, and returning your IPA or APK.
 
 ```bash
-# iOS build
+# iOS build (production)
 mach build --platform ios --profile production
 
 # Android build
 mach build --platform android --profile production
 
-# Local build
+# Build locally
 mach build --platform ios --local
-
-# Dry run (generate build script without launching)
-mach build --platform android --dry-run
 ```
 
 ### Build Options
 
-- `--platform <os>` — Target platform: `ios` or `android` (required)
-- `--profile <name>` — Build profile from `mach.config.json` (e.g., `production`, `staging`, `development`)
-- `--auto-version` — **(Android)** Automatically resolve and increment versionCode via Google Play API
-- `--local` — Run build on local machine
-- `--dry-run` — Generate script without launching
-- `--verbose` — Enable verbose logging
-- `--simulator` — Build for iOS Simulator (no signing required)
-
-## Automated Versioning (Android)
-
-Mach can automatically resolve your next `versionCode` by querying the Google Play Store. This prevents "Duplicate Version Code" rejection errors.
-
-### Setup
-Ensure you have uploaded a **Google Service Account JSON** to the Mach Dashboard under Service Credentials.
-
-### usage
-Set the version code to `"auto"` in your config:
-```json
-"android": {
-  "versionCode": "auto"
-}
-```
-Or pass the flag via CLI:
-```bash
-mach build --platform android --auto-version
-```
-
-> [!TIP]
-> Mach queries all tracks (Internal, Alpha, Beta, Production), finds the highest existing version, and increments it by 1 for your new build.
-
-
-## Store Submission
-
-Automate your App Store and Google Play submissions directly from the CLI.
-
-```bash
-# Submit to App Store
-mach submit --platform ios
-
-# Submit to Google Play (internal track)
-mach submit --platform android --track internal
-```
+| Flag | Description |
+|------|-------------|
+| `--platform` | `ios` or `android` (required) |
+| `--profile` | Build profile from `mach.config.json` (default: `production`) |
+| `--local` | Run build on local machine |
+| `--dry-run` | Generate build script without running it |
+| `--simulator` | iOS Simulator build (no signing needed) |
+| `--auto-version` | Auto-increment Android versionCode via Google Play API |
+| `--verbose` | Enable detailed build logging |
 
 ## Credential Management
 
-Manage iOS certificates, provisioning profiles, Android keystores, and service credentials — all in one place.
+Manage iOS certificates, provisioning profiles, Android keystores, and App Store Connect API keys — all stored securely in the Dashboard.
 
 ```bash
 # Interactive credential manager
 mach credentials
-
-# Legacy: Automated provisioning
-mach credentials:setup --platform ios
-mach credentials:setup --platform android
-
-# Upload service credentials (ASC API Key / Google Service JSON)
-mach credentials:service --platform ios --file key.p8 --key-id XXXXX --issuer-id XXXXX
 ```
 
+Mach walks you through each step: choosing a bundle ID, picking a distribution type (development / ad-hoc / App Store), and syncing certificates. Everything is encrypted at rest and injected at build time.
+
 ## Configuration
 
 Create a `mach.config.json` in your project root:
@@ -152,43 +89,22 @@ Create a `mach.config.json` in your project root:
   "projectId": "your-project-id",
   "name": "MyApp",
   "slug": "my-app",
-  "scheme": "myapp",
   "ios": {
-    "bundleIdentifier": "com.example.myapp",
-    "teamId": "XXXXXXXXXX"
+    "bundleIdentifier": "com.example.myapp"
   },
   "android": {
     "package": "com.example.myapp",
     "versionCode": "auto"
-  }
-}
-```
-
-### Build Profiles
-
-Define multiple build profiles under the `build` key. Profiles support deep inheritance via `extends`.
-
-```json
-{
-  "projectId": "your-project-id",
-  "name": "MyApp",
-  "slug": "my-app",
-  "scheme": "myapp",
-  "android": { "package": "com.example.myapp" },
-  "ios": { "bundleIdentifier": "com.example.myapp" },
+  },
   "build": {
-    "base": {},
     "development": {
-      "extends": "base",
       "developmentClient": true,
       "environment": "development"
     },
     "staging": {
-      "extends": "base",
       "distribution": "internal"
     },
     "production": {
-      "extends": "base",
       "distribution": "store"
     }
   },
@@ -208,35 +124,16 @@ Define multiple build profiles under the `build` key. Profiles support deep inhe
 
 | Property | Description |
 |----------|-------------|
-| `extends` | Inherit settings from another profile (recursive) |
-| `environment` | Map to a Dashboard Secret Environment (`development`, `staging`, `production`). Defaults to profile name. |
+| `extends` | Inherit settings from another profile |
+| `environment` | Dashboard Secret Environment to use (`development`, `staging`, `production`) |
 | `developmentClient` | `true` to build with `expo-dev-client` |
-| `distribution` | `internal` (TestFlight/Play Console) or `store` (Production) |
-| `preBuild` / `postBuild` | Reference a script or run a raw command |
+| `distribution` | `internal` (TestFlight / Play Console) or `store` (Production) |
+| `preBuild` / `postBuild` | Shell command or script reference to run around the build |
 | `envGroups` | Array of environment group names to merge into this profile |
 
-### Platform Overrides
-
-Any property can be overridden per platform using `ios` or `android` blocks:
-
-```json
-{
-  "build": {
-    "development": {
-      "extends": "base",
-      "developmentClient": true,
-      "ios": {
-        "simulator": true,
-        "iosDeploymentTarget": "15.0"
-      }
-    }
-  }
-}
-```
-
 ### Environment Groups
 
-Define reusable sets of environment variables shared across profiles:
+Reusable sets of environment variables shared across profiles:
 
 ```json
 {
@@ -253,78 +150,77 @@ Define reusable sets of environment variables shared across profiles:
 }
 ```
 
-### Scripts
-
-Define custom build hooks:
-
-```json
-{
-  "scripts": {
-    "clean": "rm -rf ios/build android/app/build"
-  },
-  "build": {
-    "production": {
-      "preBuild": "scripts.clean"
-    }
-  }
-}
-```
-
-## Environment Variables
+## Secrets & Environment Variables
 
-Mach allows you to securely inject secrets directly into your cloud builds without exposing them in your codebase. All secrets are fully encrypted using AES-256-GCM.
+Secrets are encrypted at rest and injected at build time, scoped per environment.
 
 ```bash
-# Set environment variables for the project (Defaults to Secret mode)
+# Add a secret
 mach env set API_URL=https://api.example.com SECRET_KEY=xxx
 
-# List all variables
+# List all secrets
 mach env list
 ```
 
 ### Android Keystore Passwords
-For maximum security, your Android Keystore (`.jks`) file is stored in a separate encrypted S3 bucket away from its passwords. 
 
-To provide your passwords to the Cloud Builder, you **must** define them as Mach Environment variables (Secrets). Mach will automatically securely decrypt and inject them during the Gradle build process.
+The keystore file is stored encrypted in the Dashboard. Provide its passwords as secrets so Mach can inject them during the Gradle build:
 
 ```bash
-# Set the master password for the keystore (used for both the Keystore and the Key Alias)
 mach env set KEYSTORE_PASSWORD_PRODUCTION=my_super_secret_password
+```
 
-# If your Keystore password and Key Alias password differ, you can set both independently:
+If your keystore password and key alias password differ:
+
+```bash
 mach env set KEYSTORE_PASSWORD_PRODUCTION=my_key_pass KEYSTORE_STORE_PASSWORD_PRODUCTION=my_store_pass
 ```
 
-*(Note: Replace `PRODUCTION` with `STAGING` or `DEVELOPMENT` depending on your targeted build profile).*
+Replace `PRODUCTION` with `STAGING` or `DEVELOPMENT` to match your build profile.
+
+## Automated Versioning (Android)
+
+Mach can automatically determine the next `versionCode` by querying Google Play across all tracks (Internal → Production), and increment it by 1 — preventing duplicate version rejections.
+
+**Setup:** Upload a Google Service Account JSON via `mach credentials` → Service Credentials.
 
+**Usage:**
+```bash
+mach build --platform android --auto-version
+```
+
+Or in config:
+```json
+"android": { "versionCode": "auto" }
+```
+
+## Store Submission
+
+```bash
+mach submit --platform ios
+mach submit --platform android --track internal
+```
 
 ## Development Server
 
 ```bash
-# Start Metro with profile
 mach start --build-profile development
-
-# Start with tunnel
 mach start --tunnel
-
-# Clear cache
 mach start --clear
 ```
 
 ## Security Audit
 
-Run automated security checks on your project:
-
 ```bash
 mach audit
 mach audit --severity high
 mach audit --fix
-mach audit --json  # CI/CD friendly output
+mach audit --json   # CI/CD-friendly JSON output
 ```
 
 ## Authentication
 
-### Interactive Login
+### Interactive
 
 ```bash
 mach login
@@ -334,30 +230,26 @@ Credentials are stored in `~/.mach/credentials.json`.
 
 ### CI/CD (Token-based)
 
-Set the `MACH_TOKEN` environment variable for non-interactive authentication:
-
 ```bash
 export MACH_TOKEN=your-personal-access-token
 mach build --platform ios --profile production
 ```
 
-Generate tokens from the Mach Dashboard under Settings > Personal Access Tokens.
+Generate tokens from the Mach Dashboard under **Settings → Access Tokens**.
 
 ## Environment Variables Reference
 
 | Variable | Description |
 |----------|-------------|
 | `MACH_TOKEN` | Personal access token for CI/CD (skips login) |
-| `MACH_API_URL` | Override the API endpoint (default: `https://mach-api.securejs.in`) |
 | `MACH_DEBUG` | Enable debug logging |
 | `MACH_P12_PASSWORD` | iOS certificate password (avoids interactive prompt) |
 
 ## Requirements
 
 - Node.js 18+
-- npm or yarn
-- For iOS builds: Xcode (local) or cloud instance with macOS
-- For Android builds: Android SDK (local) or cloud instance
+- For iOS builds: Xcode (local builds) or cloud build subscription
+- For Android builds: Android SDK (local builds) or cloud build subscription
 
 ## License
 

package/dist/chunk-YXFDQM4S.js

@@ -0,0 +1,53 @@
+import{a as p,g as R}from"./chunk-YZYFEHP5.js";import{log as t,spinner as z,text as J,password as de,select as T,confirm as Re,isCancel as v,cancel as G,intro as Ze,outro as Ve,note as Ie}from"@clack/prompts";import{log as Z,spinner as ee,text as P,select as te,isCancel as _,cancel as U,note as ie,confirm as he}from"@clack/prompts";import N from"chalk";import{spawnSync as q}from"child_process";import E from"fs";import X from"path";import re from"os";var Se="cmVxdWlyZSAnc3BhY2VzaGlwJwpyZXF1aXJlICdqc29uJwoKZGVmIGxpc3Rfa2V5cwogIGJlZ2luCiAgICBTcGFjZXNoaXA6OlBvcnRhbC5sb2dpbihFTlZbJ0ZBU1RMQU5FX1VTRVInXSkKICAgIFNwYWNlc2hpcDo6UG9ydGFsLnNlbGVjdF90ZWFtKHRlYW1faWQ6IEVOVlsnRkFTVExBTkVfVEVBTV9JRCddKQogICAgCiAgICAjIExvZ2luIHRvIFR1bmVzIChBcHAgU3RvcmUgQ29ubmVjdCkgYW5kIHNlbGVjdCB0aGUgc2FtZSB0ZWFtCiAgICBTcGFjZXNoaXA6OlR1bmVzLmxvZ2luKEVOVlsnRkFTVExBTkVfVVNFUiddKQogICAgU3BhY2VzaGlwOjpUdW5lcy5zZWxlY3RfdGVhbSh0ZWFtX2lkOiBFTlZbJ0ZBU1RMQU5FX1RFQU1fSUQnXSkKICAgIAogICAgIyBVc2UgVHVuZXMgY2xpZW50IHdoaWNoIHBvaW50cyB0byBhcHBzdG9yZWNvbm5lY3QuYXBwbGUuY29tCiAgICBjbGllbnQgPSBTcGFjZXNoaXA6OlR1bmVzLmNsaWVudAogICAgIyBVc2Ugcm9vdC1yZWxhdGl2ZSBVUkwgdG8gcmVwbGFjZSB0aGUgZGVmYXVsdCBUdW5lcyBwYXRoICgvV2ViT2JqZWN0cy8uLi4pCiAgICByZXNwb25zZSA9IGNsaWVudC5yZXF1ZXN0KDpnZXQsICcvaXJpcy92MS9hcGlLZXlzJykKICAgIAogICAgaWYgcmVzcG9uc2UuYm9keS5uaWw/IHx8ICFyZXNwb25zZS5ib2R5LmlzX2E/KEhhc2gpCiAgICAgIHJhaXNlICJBUEkgcmV0dXJuZWQgZW1wdHkgb3IgaW52YWxpZCByZXNwb25zZSBib2R5IGZvciBsaXN0aW5nIGtleXMiCiAgICBlbmQKICAgIAogICAgJHN0ZGVyci5wdXRzICJERUJVRzogRnVsbCBMaXN0IFJlc3BvbnNlOiAje3Jlc3BvbnNlLmJvZHkudG9fanNvbn0iCiAgICAKICAgIGtleXMgPSByZXNwb25zZS5ib2R5WydkYXRhJ10gfHwgW10KICAgIAogICAgb3V0cHV0ID0ga2V5cy5tYXAgZG8gfGt8CiAgICAgIGF0dHIgPSBrWydhdHRyaWJ1dGVzJ10gfHwge30KICAgICAgewogICAgICAgIGlkOiBrWydpZCddLAogICAgICAgIG5hbWU6IGF0dHJbJ25hbWUnXSwKICAgICAgICBpc3N1ZXJJZDogYXR0clsnaXNzdWVySWQnXSwKICAgICAgICByb2xlOiBhdHRyWydyb2xlcyddJi5maXJzdCwKICAgICAgICByZXZvY2FibGU6IGF0dHJbJ3Jldm9jYWJsZSddCiAgICAgIH0KICAgIGVuZAogICAgCiAgICBwdXRzICJfX19NQUNIX0pTT05fU1RBUlRfX18iICsgb3V0cHV0LnRvX2pzb24gKyAiX19fTUFDSF9KU09OX0VORF9fXyIKICByZXNjdWUgPT4gZQogICAgJHN0ZGVyci5wdXRzICJFUlJPUjogI3tlLm1lc3NhZ2V9IgogICAgaWYgZGVmaW5lZD8ocmVzcG9uc2UpICYmIHJlc3BvbnNlICYmIHJlc3BvbnNlLmJvZHkKICAgICAgJHN0ZGVyci5wdXRzICJSZXNwb25zZSBCb2R5OiAje3Jlc3BvbnNlLmJvZHkudG9fanNvbn0iCiAgICBlbmQKICAgIGV4aXQgMQogIGVuZAplbmQKCmRlZiBjcmVhdGVfa2V5KG5hbWUsIHJvbGUgPSAnQURNSU4nKQogIGJlZ2luCiAgICBTcGFjZXNoaXA6OlBvcnRhbC5sb2dpbihFTlZbJ0ZBU1RMQU5FX1VTRVInXSkKICAgIFNwYWNlc2hpcDo6UG9ydGFsLnNlbGVjdF90ZWFtKHRlYW1faWQ6IEVOVlsnRkFTVExBTkVfVEVBTV9JRCddKQogICAgCiAgICBTcGFjZXNoaXA6OlR1bmVzLmxvZ2luKEVOVlsnRkFTVExBTkVfVVNFUiddKQogICAgU3BhY2VzaGlwOjpUdW5lcy5zZWxlY3RfdGVhbSh0ZWFtX2lkOiBFTlZbJ0ZBU1RMQU5FX1RFQU1fSUQnXSkKICAgIAogICAgY2xpZW50ID0gU3BhY2VzaGlwOjpUdW5lcy5jbGllbnQKICAgIAogICAgIyBUcnVuY2F0ZSBuaWNrbmFtZSB0byAzMCBjaGFycyBhcyBwZXIgQXBwbGUncyBsaW1pdAogICAgIyBXZSBrZWVwIHRoZSBvcmlnaW5hbCAnbmFtZScgZm9yIGxvZ2dpbmcgYnV0IHNlbmQgdHJ1bmNhdGVkICduaWNrbmFtZScgdG8gQVBJCiAgICBzYWZlX25pY2tuYW1lID0gbmFtZVswLCAzMF0KICAgIAogICAgcGF5bG9hZCA9IHsKICAgICAgZGF0YTogewogICAgICAgIHR5cGU6ICJhcGlLZXlzIiwKICAgICAgICBhdHRyaWJ1dGVzOiB7CiAgICAgICAgICBuaWNrbmFtZTogc2FmZV9uaWNrbmFtZSwKICAgICAgICAgIGtleVR5cGU6ICJQVUJMSUNfQVBJIiwKICAgICAgICAgIHJvbGVzOiBbcm9sZV0sCiAgICAgICAgICBhbGxBcHBzVmlzaWJsZTogdHJ1ZQogICAgICAgIH0KICAgICAgfQogICAgfQogICAgCiAgICByZXNwb25zZSA9IGNsaWVudC5yZXF1ZXN0KDpwb3N0KSBkbyB8cmVxfAogICAgICByZXEudXJsICIvaXJpcy92MS9hcGlLZXlzIgogICAgICByZXEuYm9keSA9IHBheWxvYWQudG9fanNvbgogICAgICByZXEuaGVhZGVyc1snQ29udGVudC1UeXBlJ10gPSAnYXBwbGljYXRpb24vanNvbicKICAgICAgcmVxLmhlYWRlcnNbJ0FjY2VwdCddID0gJ2FwcGxpY2F0aW9uL3ZuZC5hcGkranNvbiwgYXBwbGljYXRpb24vanNvbiwgdGV4dC9qYXZhc2NyaXB0LCAqLyo7IHE9MC4wMScKICAgICAgcmVxLmhlYWRlcnNbJ1gtUmVxdWVzdGVkLVdpdGgnXSA9ICdYTUxIdHRwUmVxdWVzdCcKICAgICAgcmVxLmhlYWRlcnNbJ1JlZmVyZXInXSA9ICdodHRwczovL2FwcHN0b3JlY29ubmVjdC5hcHBsZS5jb20vYWNjZXNzL2FwaScKICAgICAgcmVxLmhlYWRlcnNbJ1gtQXBwbGUtV2lkZ2V0LUtleSddID0gY2xpZW50LndpZGdldF9rZXkgaWYgY2xpZW50LnJlc3BvbmRfdG8/KDp3aWRnZXRfa2V5KQogICAgZW5kCiAgICAKICAgICMgREVCVUc6IEluc3BlY3QgdGhlIHJhdyByZXNwb25zZSBvYmplY3QKICAgICRzdGRlcnIucHV0cyAiREVCVUc6IFJlc3BvbnNlIENsYXNzOiAje3Jlc3BvbnNlLmNsYXNzfSIKICAgICRzdGRlcnIucHV0cyAiREVCVUc6IFJlc3BvbnNlIEhlYWRlcnM6ICN7cmVzcG9uc2UuaGVhZGVyc30iCiAgICAkc3RkZXJyLnB1dHMgIkRFQlVHOiBSZXNwb25zZSBCb2R5OiAje3Jlc3BvbnNlLmJvZHkudG9fanNvbn0iCiAgICAKICAgIGlmIHJlc3BvbnNlLmJvZHkubmlsPyB8fCAhcmVzcG9uc2UuYm9keS5pc19hPyhIYXNoKSB8fCByZXNwb25zZS5ib2R5WydkYXRhJ10ubmlsPwogICAgICBlcnJvcl9tc2cgPSAiQVBJIGZhaWxlZCB0byBjcmVhdGUga2V5LiIKICAgICAgaWYgcmVzcG9uc2UuYm9keSAmJiByZXNwb25zZS5ib2R5WydlcnJvcnMnXQogICAgICAgIGVycm9yX21zZyArPSAiIEVycm9yczogIiArIHJlc3BvbnNlLmJvZHlbJ2Vycm9ycyddLm1hcHt8ZXwgZVsnZGV0YWlsJ119LmpvaW4oJywgJykKICAgICAgZW5kCiAgICAgIHJhaXNlIGVycm9yX21zZwogICAgZW5kCiAgICAKICAgIGtleV9kYXRhID0gcmVzcG9uc2UuYm9keVsnZGF0YSddCiAgICBhdHRyID0ga2V5X2RhdGFbJ2F0dHJpYnV0ZXMnXSB8fCB7fQoKICAgICMgVGhlIC5wOCBjb250ZW50IGlzIHVzdWFsbHkgaW4gJ3ByaXZhdGVLZXknIG9yICdrZXlDb250ZW50JyBvbiB0aGUgSU5JVElBTCBDUkVBVEUgcmVzcG9uc2UKICAgIHA4X2NvbnRlbnQgPSBhdHRyWydwcml2YXRlS2V5J10gfHwgYXR0clsna2V5Q29udGVudCddCiAgICAKICAgIGlmIHA4X2NvbnRlbnQubmlsPwogICAgICAkc3RkZXJyLnB1dHMgIkRFQlVHOiBLZXkgY29udGVudCBtaXNzaW5nIGluIHJlc3BvbnNlLiBBdHRlbXB0aW5nIHJldHJpZXZhbCB2aWEgZG93bmxvYWQvZXhwb3J0IGVuZHBvaW50cy4uLiIgCiAgICAgIAogICAgICBwYXRoc190b190cnkgPSBbCiAgICAgICAgImh0dHBzOi8vYXBwc3RvcmVjb25uZWN0LmFwcGxlLmNvbS9pcmlzL3YxL2FwaUtleXMvI3trZXlfZGF0YVsnaWQnXX0vZG93bmxvYWQiLAogICAgICAgICJodHRwczovL2FwcHN0b3JlY29ubmVjdC5hcHBsZS5jb20vaXJpcy92MS9hcGlLZXlzLyN7a2V5X2RhdGFbJ2lkJ119L2V4cG9ydCIKICAgICAgXQogICAgICAKICAgICAgcGF0aHNfdG9fdHJ5LmVhY2ggZG8gfHBhdGh8CiAgICAgICAgYmVnaW4KICAgICAgICAgICRzdGRlcnIucHV0cyAiREVCVUc6IFRyeWluZyAje3BhdGh9Li4uIgogICAgICAgICAgZG93bmxvYWRfcmVzcCA9IGNsaWVudC5yZXF1ZXN0KDpnZXQpIGRvIHxyZXF8CiAgICAgICAgICAgIHJlcS51cmwgcGF0aAogICAgICAgICAgICByZXEuaGVhZGVyc1snQWNjZXB0J10gPSAnYXBwbGljYXRpb24vdm5kLmFwaStqc29uLCBhcHBsaWNhdGlvbi9qc29uLCB0ZXh0L2phdmFzY3JpcHQsICovKjsgcT0wLjAxJwogICAgICAgICAgICByZXEuaGVhZGVyc1snWC1SZXF1ZXN0ZWQtV2l0aCddID0gJ1hNTEh0dHBSZXF1ZXN0JwogICAgICAgICAgICByZXEuaGVhZGVyc1snUmVmZXJlciddID0gJ2h0dHBzOi8vYXBwc3RvcmVjb25uZWN0LmFwcGxlLmNvbS9hY2Nlc3MvYXBpJwogICAgICAgICAgZW5kCiAgICAgICAgICAkc3RkZXJyLnB1dHMgIkRFQlVHOiBSZXNwb25zZSBDbGFzczogI3tkb3dubG9hZF9yZXNwLmJvZHkuY2xhc3N9IgogICAgICAgICAgJHN0ZGVyci5wdXRzICJERUJVRzogUmVzcG9uc2UgU3RhdHVzOiAje2Rvd25sb2FkX3Jlc3Auc3RhdHVzfSIgaWYgZG93bmxvYWRfcmVzcC5yZXNwb25kX3RvPyg6c3RhdHVzKQogICAgICAgICAgCiAgICAgICAgICBpZiBkb3dubG9hZF9yZXNwLmJvZHkgJiYgIWRvd25sb2FkX3Jlc3AuYm9keS50b19zLmluY2x1ZGU/KCciZXJyb3JzIj0+JykKICAgICAgICAgICAgIGlmIGRvd25sb2FkX3Jlc3AuYm9keS5pc19hPyhIYXNoKQogICAgICAgICAgICAgICBwOF9jb250ZW50ID0gZG93bmxvYWRfcmVzcC5ib2R5WydrZXlDb250ZW50J10gfHwgZG93bmxvYWRfcmVzcC5ib2R5Wydjb250ZW50J10gfHwgZG93bmxvYWRfcmVzcC5ib2R5LmRpZygnZGF0YScsICdhdHRyaWJ1dGVzJywgJ3ByaXZhdGVLZXknKQogICAgICAgICAgICAgZWxzZQogICAgICAgICAgICAgICBwOF9jb250ZW50ID0gZG93bmxvYWRfcmVzcC5ib2R5CiAgICAgICAgICAgICBlbmQKICAgICAgICAgICAgIAogICAgICAgICAgICAgaWYgcDhfY29udGVudCAmJiBwOF9jb250ZW50LnRvX3Muc3RhcnRfd2l0aD8oJy0tLS0tQkVHSU4nKQogICAgICAgICAgICAgICAkc3RkZXJyLnB1dHMgIkRFQlVHOiBSZXRyaWV2YWwgdmlhICN7cGF0aH0gc3VjY2Vzc2Z1bCEgQ29udGVudCBsZW5ndGg6ICN7cDhfY29udGVudC50b19zLmxlbmd0aH0iCiAgICAgICAgICAgICAgIGJyZWFrCiAgICAgICAgICAgICBlbHNlCiAgICAgICAgICAgICAgICRzdGRlcnIucHV0cyAiREVCVUc6IFJlc3BvbnNlIGZyb20gI3twYXRofSBkaWQgbm90IGNvbnRhaW4gYSB2YWxpZCBwcml2YXRlIGtleS4iCiAgICAgICAgICAgICAgIHA4X2NvbnRlbnQgPSBuaWwKICAgICAgICAgICAgIGVuZAogICAgICAgICAgZWxzZQogICAgICAgICAgICAgJHN0ZGVyci5wdXRzICJERUJVRzogUmVzcG9uc2UgZnJvbSAje3BhdGh9IGVtcHR5IG9yIGNvbnRhaW5zIGVycm9ycy4iCiAgICAgICAgICBlbmQKICAgICAgICByZXNjdWUgPT4gZQogICAgICAgICAgJHN0ZGVyci5wdXRzICJERUJVRzogQXR0ZW1wdCBmb3IgI3twYXRofSBmYWlsZWQ6ICN7ZS5tZXNzYWdlfSIKICAgICAgICBlbmQKICAgICAgZW5kCiAgICBlbmQKCiAgICAjIEZJTkFMIFZBTElEQVRJT046IEVuc3VyZSBpdCdzIG5vdCBhIFJ1YnkgaGFzaCBzdHJpbmcgcmVwcmVzZW50YXRpb24gb3IgZXJyb3IKICAgIGlmIHA4X2NvbnRlbnQuaXNfYT8oSGFzaCkgfHwgcDhfY29udGVudC50b19zLmluY2x1ZGU/KCciZXJyb3JzIj0+JykgfHwgIXA4X2NvbnRlbnQudG9fcy5zdGFydF93aXRoPygnLS0tLS1CRUdJTicpCiAgICAgICRzdGRlcnIucHV0cyAiREVCVUc6IEludmFsaWQga2V5IGNvbnRlbnQgZGV0ZWN0ZWQuIgogICAgICBwOF9jb250ZW50ID0gbmlsCiAgICBlbmQKCiAgICBpZiBwOF9jb250ZW50Lm5pbD8KICAgICAgJHN0ZGVyci5wdXRzICJERUJVRzogRmFpbGVkIHRvIHJldHJpZXZlIGtleSBjb250ZW50LiIKICAgIGVuZAogICAgCiAgICByZXN1bHQgPSB7CiAgICAgIGlkOiBrZXlfZGF0YVsnaWQnXSwKICAgICAgbmFtZTogYXR0clsnbmlja25hbWUnXSB8fCBhdHRyWyduYW1lJ10sCiAgICAgIGlzc3VlcklkOiBhdHRyWydpc3N1ZXJJZCddLAogICAgICBrZXlDb250ZW50OiBwOF9jb250ZW50LAogICAgICByYXdfcmVzcG9uc2U6IHJlc3BvbnNlLmJvZHkgIyBJbmNsdWRlIHRoaXMgZm9yIGRlYnVnZ2luZyB3aGVuIGtleUNvbnRlbnQgaXMgbmlsCiAgICB9CiAgICAKICAgIHB1dHMgIl9fX01BQ0hfSlNPTl9TVEFSVF9fXyIgKyByZXN1bHQudG9fanNvbiArICJfX19NQUNIX0pTT05fRU5EX19fIgogIHJlc2N1ZSA9PiBlCiAgICAkc3RkZXJyLnB1dHMgIkVSUk9SOiAje2UubWVzc2FnZX0iCiAgICBpZiBkZWZpbmVkPyhyZXNwb25zZSkgJiYgcmVzcG9uc2UgJiYgcmVzcG9uc2UuYm9keQogICAgICAgJHN0ZGVyci5wdXRzICJSZXNwb25zZSBCb2R5OiAje3Jlc3BvbnNlLmJvZHkudG9fanNvbn0iCiAgICBlbmQKICAgIGV4aXQgMQogIGVuZAplbmQKCmRlZiBkZWxldGVfa2V5KGlkKQogIGJlZ2luCiAgICBTcGFjZXNoaXA6OlBvcnRhbC5sb2dpbihFTlZbJ0ZBU1RMQU5FX1VTRVInXSkKICAgIFNwYWNlc2hpcDo6UG9ydGFsLnNlbGVjdF90ZWFtKHRlYW1faWQ6IEVOVlsnRkFTVExBTkVfVEVBTV9JRCddKQogICAgCiAgICBTcGFjZXNoaXA6OlR1bmVzLmxvZ2luKEVOVlsnRkFTVExBTkVfVVNFUiddKQogICAgU3BhY2VzaGlwOjpUdW5lcy5zZWxlY3RfdGVhbSh0ZWFtX2lkOiBFTlZbJ0ZBU1RMQU5FX1RFQU1fSUQnXSkKICAgIAogICAgY2xpZW50ID0gU3BhY2VzaGlwOjpUdW5lcy5jbGllbnQKICAgIGNsaWVudC5yZXF1ZXN0KDpkZWxldGUsICIvaXJpcy92MS9hcGlLZXlzLyN7aWR9IikKICAgIHB1dHMgIlNVQ0NFU1MiCiAgcmVzY3VlID0+IGUKICAgICRzdGRlcnIucHV0cyAiRVJST1I6ICN7ZS5tZXNzYWdlfSIKICAgIGV4aXQgMQogIGVuZAplbmQKCmNvbW1hbmQgPSBBUkdWWzBdCmlmIGNvbW1hbmQgPT0gJ2xpc3QnCiAgbGlzdF9rZXlzCmVsc2lmIGNvbW1hbmQgPT0gJ2NyZWF0ZScKICBjcmVhdGVfa2V5KEFSR1ZbMV0gfHwgIk1hY2ggQVBJIEtleSAje1RpbWUubm93LnRvX2l9IikKZWxzaWYgY29tbWFuZCA9PSAnZGVsZXRlJwogIGRlbGV0ZV9rZXkoQVJHVlsxXSkKZW5kCg==";function ne(){let a=X.join(re.tmpdir(),p.nameLower);E.existsSync(a)||E.mkdirSync(a,{recursive:!0});let e=X.join(a,"manage_asc_keys.rb");return E.writeFileSync(e,Buffer.from(Se,"base64").toString("utf-8"),{mode:493}),e}function se(){return{...process.env,PATH:`/usr/local/opt/ruby/bin:/usr/local/Cellar/fastlane/2.227.0/libexec/bin:${process.env.HOME}/.local/share/fastlane/3.4.0/bin:${process.env.PATH}`,GEM_HOME:process.env.FASTLANE_GEM_HOME||`${process.env.HOME}/.local/share/fastlane/3.4.0`,GEM_PATH:(process.env.FASTLANE_GEM_HOME||`${process.env.HOME}/.local/share/fastlane/3.4.0`)+":/usr/local/Cellar/fastlane/2.227.0/libexec",FASTLANE_INSTALLED_VIA_HOMEBREW:"true",CI:"1"}}var pe=async a=>{let e=ee(),r=a.platform,c=`./${p.configFileName}`;if(!E.existsSync(c)){Z.error(`No ${p.configFileName} found. Run \`${p.nameLower} init\` or \`${p.nameLower} link\` first.`);return}let s=JSON.parse(E.readFileSync(c,"utf-8")),{projectId:o}=s;if(!o){Z.error(`${p.configFileName} is missing projectId.`);return}let i=a.file;if(r==="ios"&&!i){let g=await te({message:"Manage App Store Connect API Key:",options:[{value:"magic",label:"\u2728 Create new automatically (EAS-Style)",hint:"Requires Apple ID + 2FA"},{value:"manual",label:"\u{1F50D} Configure manually",hint:"Provide existing .p8 file"},{value:"delete",label:"\u{1F5D1}\uFE0F  Delete an existing Key"}]});if(_(g)){U("Operation cancelled");return}if(g==="magic"){await be(o,s);return}if(g==="delete"){await we(o,s);return}}if(!i){let g=r==="ios"?"https://appstoreconnect.apple.com/access/api":"https://console.cloud.google.com/apis/credentials";ie(`To submit to the ${r==="ios"?"App Store":"Google Play Store"}, you need a Service Key:
+
+1. Open: ${N.cyan(g)}
+`+(r==="ios"?`2. Generate an "App Store Connect API Key" with ${N.bold("Admin")} role.
+3. Download the ${N.bold(".p8")} file.`:`2. Create a "Service Account", generate a ${N.bold("JSON")} key.
+3. Download the ${N.bold(".json")} file.`),"Guided Setup"),e.start("Scanning for downloaded keys...");let d=ve(r);if(e.stop(d.length>0?`Detected ${d.length} potential key(s)`:"No keys detected automatically"),d.length>0){let m=await te({message:"Found these potential keys. Use one of them?",options:[...d.map(l=>({value:l.path,label:`${X.basename(l.path)} (${l.location})`})),{value:"manual",label:"Enter path manually..."}]});if(_(m)){U("Operation cancelled");return}m!=="manual"&&(i=m)}if(!i){let m=await P({message:`Paste the path to your ${r==="ios"?".p8":".json"} file:`,validate:l=>E.existsSync(l)?void 0:"File not found"});if(_(m)){U("Operation cancelled");return}i=m}}let u=a.issuerId,C=a.keyId;if(r==="ios"){if(!C&&i){let g=X.basename(i).match(/AuthKey_(.*)\.p8/);g&&(C=g[1],Z.info(`Auto-detected Key ID from filename: ${N.green(C)}`))}if(!u){let g=await P({message:"Enter App Store Connect Issuer ID (Found on the Keys page):",validate:d=>d.length>0?void 0:"Issuer ID is required"});if(_(g)){U("Operation cancelled");return}u=g}if(!C){let g=await P({message:"Enter App Store Connect Key ID:",validate:d=>d.length>0?void 0:"Key ID is required"});if(_(g)){U("Operation cancelled");return}C=g}}await ae(o,i,r,u,C)};async function be(a,e){let r=ee(),c=e.submit?.production?.ios?.appleId,s=e.submit?.production?.ios?.appleTeamId;if(!c){let u=await P({message:"Apple ID:",placeholder:"your-email@example.com"});if(_(u))return;c=u,e.submit||(e.submit={production:{ios:{}}}),e.submit.production||(e.submit.production={ios:{}}),e.submit.production.ios||(e.submit.production.ios={}),e.submit.production.ios.appleId=c,E.writeFileSync(`./${p.configFileName}`,JSON.stringify(e,null,2))}if(!s){let u=await P({message:"Apple Team ID:",placeholder:"e.g. 4523G95823"});if(_(u))return;s=u,e.submit||(e.submit={production:{ios:{}}}),e.submit.production||(e.submit.production={ios:{}}),e.submit.production.ios||(e.submit.production.ios={}),e.submit.production.ios.appleTeamId=s,E.writeFileSync(`./${p.configFileName}`,JSON.stringify(e,null,2))}let o=await P({message:"Enter a name for the new API Key:",initialValue:`[${p.name}] Project ${a}`});if(_(o))return;r.start("Authenticating with Apple and creating API Key...");let i=ne();if(!E.existsSync(i)){Z.error(`Magic Error: Helper script not found at ${i}`);return}try{let u=q("ruby",[i,"create",o],{env:{...se(),FASTLANE_USER:c,FASTLANE_TEAM_ID:s},stdio:["inherit","pipe","pipe"],encoding:"utf-8"}),C=u.stdout||"",g=u.stderr||"";if(g&&(g.includes("DEBUG:")||g.includes("ERROR:"))&&g.split(`
+`).forEach(S=>{S.trim()&&Z.info(N.dim(`[Ruby] ${S.trim()}`))}),u.status!==0){r.stop("Failed"),Z.error(`Magic creation failed: ${g}`);return}let d=C.match(new RegExp(`${p.jsonStartMarker}(.*)${p.jsonEndMarker}`));if(!d){r.stop("Parse Error"),Z.error("Could not parse response from Apple Portal.");return}let m=JSON.parse(d[1]),{id:l,issuerId:I,keyContent:f}=m;if(r.stop("Key Created Successfully"),Z.success(`\u2713 Created Key ID: ${N.green(l)}`),!I){ie(`Your Issuer ID is shown at the top of:
+  ${N.cyan("https://appstoreconnect.apple.com/access/integrations/api")}
+
+It looks like: ${N.dim("xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx")}`,"One More Thing");let S=await P({message:"Enter your App Store Connect Issuer ID:",validate:b=>b.trim().length>0?void 0:"Issuer ID is required"});if(_(S)){U("Operation cancelled.");return}I=S.trim()}if(f){let S=X.join(re.tmpdir(),`AuthKey_${l}.p8`);E.writeFileSync(S,f),await ae(a,S,"ios",I,l),E.unlinkSync(S)}else{Z.warn(N.yellow("\u26A0\uFE0F  Apple did not return the private key in the response.")),ie(`Download the .p8 file manually:
+
+  1. Open: ${N.cyan("https://appstoreconnect.apple.com/access/integrations/api")}
+  2. Find Key ID: ${N.green(l)}
+  3. Click ${N.bold("Download API Key")} (only available once)
+  4. Drag & drop the downloaded .p8 file below`,"Manual Step Required");let S=await P({message:"Path to the downloaded .p8 file (drag & drop here):",validate:b=>E.existsSync(b)?void 0:"File not found"});if(_(S)){U("Operation cancelled. Credential ID was registered but key content is missing.");return}await ae(a,S,"ios",I,l)}}catch(u){r.stop("Error"),Z.error(`Error: ${u.message}`)}}async function we(a,e){let r=ee(),c=e.submit?.production?.ios?.appleId,s=e.submit?.production?.ios?.appleTeamId;if(!c){let i=await P({message:"Apple ID:"});if(_(i))return;c=i,e.submit||(e.submit={production:{ios:{}}}),e.submit.production||(e.submit.production={ios:{}}),e.submit.production.ios||(e.submit.production.ios={}),e.submit.production.ios.appleId=c,E.writeFileSync(`./${p.configFileName}`,JSON.stringify(e,null,2))}if(!s){let i=await P({message:"Apple Team ID:"});if(_(i))return;s=i,e.submit||(e.submit={production:{ios:{}}}),e.submit.production||(e.submit.production={ios:{}}),e.submit.production.ios||(e.submit.production.ios={}),e.submit.production.ios.appleTeamId=s,E.writeFileSync(`./${p.configFileName}`,JSON.stringify(e,null,2))}r.start("Fetching existing API Keys...");let o=ne();if(!E.existsSync(o)){Z.error(`Magic Error: Helper script not found at ${o}`);return}try{let i=q("ruby",[o,"list"],{env:{...se(),FASTLANE_USER:c,FASTLANE_TEAM_ID:s},stdio:["inherit","pipe","pipe"],encoding:"utf-8"});if(i.status!==0){r.stop("Failed"),Z.error(`Listing failed: ${i.stderr}`);return}let u=i.stdout.match(new RegExp(`${p.jsonStartMarker}(.*)${p.jsonEndMarker}`));if(!u){r.stop("Parse Error");return}let C=JSON.parse(u[1]);if(r.stop(`Found ${C.length} keys`),C.length===0){Z.info("No API Keys found on this team.");return}let g=await te({message:"Select a key to delete from Apple Developer Portal:",options:[...C.map(l=>({value:l.id,label:`ID: ${l.id} - ${l.name} (${l.role})`})),{value:"cancel",label:"Cancel"}]});if(_(g)||g==="cancel")return;let d=await he({message:`Are you sure you want to delete Key ${g}? This cannot be undone.`});if(!d||_(d))return;r.start(`Deleting Key ${g}...`);let m=q("ruby",[ne(),"delete",g],{env:{...se(),FASTLANE_USER:c,FASTLANE_TEAM_ID:s},stdio:"pipe",encoding:"utf-8"});m.status===0?(r.stop("Deleted"),Z.success(`\u2713 Key ${g} has been removed from Apple Portal.`)):(r.stop("Deletion Failed"),Z.error(`Error: ${m.stderr}`))}catch(i){r.stop("Error"),Z.error(`Error: ${i.message}`)}}async function ae(a,e,r,c,s){let o=ee();o.start(`Uploading Service Credentials for ${r}...`);try{let i=r==="ios"?"asc_api_key":"google_service_account",u=new URL(import.meta.url),C=X.dirname(u.pathname),g=[X.join(C,"isolated-upload.js"),X.join(C,"commands","isolated-upload.js"),X.resolve(C,"../commands/isolated-upload.js"),X.resolve(process.cwd(),`node_modules/.bin/${p.nameLower}-upload`)],d="";for(let l of g)if(E.existsSync(l)){d=l;break}if(!d)throw new Error("Could not locate isolated-upload.js. Ensure the CLI is properly installed.");let m=q("node",[d,a,e,i,"*","service","undefined","undefined",c||"undefined",s||"undefined"],{stdio:"pipe",encoding:"utf-8",env:{...process.env,AT_CLI_ISOLATED:"1"}});if(m.status!==0){let l=m.stderr||m.stdout||"Unknown upload failure";o.stop("Upload Failed"),Z.error(N.red(`Upload Failed: ${l}`));return}m.stdout.includes("SUCCESS")?(o.stop("Upload Success"),Z.success(N.green(`\u2713 Service Credentials for ${r} uploaded successfully.`))):(o.stop("Upload Summary"),Z.warn(N.yellow(`Upload finished but success not confirmed: ${m.stdout}`)))}catch(i){o.stop("Upload Error"),Z.error(N.red(`Error: ${i.message}`))}}function ve(a){let e=a==="ios"?".p8":".json",r=[],c=[{path:"./",label:"Project Root"},{path:X.join(re.homedir(),"Downloads"),label:"Downloads"}];for(let s of c)if(E.existsSync(s.path))try{let o=E.readdirSync(s.path);for(let i of o)if(i.endsWith(e)){if(a==="android"&&!E.readFileSync(X.join(s.path,i),"utf8").includes("service_account")||a==="ios"&&!i.startsWith("AuthKey"))continue;r.push({path:X.join(s.path,i),location:s.label})}}catch{}return r}import Ce from"axios";import n from"chalk";import{execSync as W,spawnSync as L}from"child_process";import oe from"crypto";import A from"fs";import V from"path";import ge from"os";Ce.defaults.proxy=!1;function ce(a,e){if(!A.existsSync(a))return;let r=A.readdirSync(a);for(let c of r){let s=V.join(a,c);if(A.statSync(s).isDirectory()){let i=ce(s,e);if(i)return i}else if(e.test(c))return s}}function Ee(a,e,r){let c=A.readFileSync(r,"utf8"),s=Math.floor(Date.now()/1e3),o=Buffer.from(JSON.stringify({alg:"ES256",kid:a,typ:"JWT"})).toString("base64url"),i=Buffer.from(JSON.stringify({iss:e,iat:s,exp:s+1200,aud:"appstoreconnect-v1"})).toString("base64url"),u=`${o}.${i}`,C=oe.createSign("SHA256");C.update(u);let g=C.sign({key:c,dsaEncoding:"ieee-p1363"}).toString("base64url");return`${u}.${g}`}async function Ne(a,e,r,c){let s=Ee(e,r,c),o=(await import("axios")).default;for(let i of a)try{await o.post("https://api.appstoreconnect.apple.com/v1/devices",{data:{type:"devices",attributes:{name:i.name,udid:i.udid,platform:"IOS"}}},{headers:{Authorization:`Bearer ${s}`,"Content-Type":"application/json"}}),t.info(n.dim(`  \u2713 Registered: ${i.name}`))}catch(u){let C=u.response?.data?.errors;C?.some(d=>d.code==="ENTITY_ERROR.ATTRIBUTE.INVALID.DUPLICATE"||d.detail?.toLowerCase().includes("already registered")||d.detail?.toLowerCase().includes("already exists"))?t.info(n.dim(`  Already on Portal: ${i.name}`)):t.warn(n.yellow(`  Could not register ${i.name}: ${C?.[0]?.detail||u.message}`))}}var ue=async a=>{Ze(n.bgCyan.black(p.cliTag("Credentials")));let e=await T({message:"Select platform:",options:[{value:"ios",label:"iOS"},{value:"android",label:"Android"}]});v(e)&&(G("Operation cancelled"),process.exit(0));let r=await T({message:"What do you want to do?",options:[{value:"setup",label:"Build Credentials (Certs/Profiles)",hint:"Manage everything needed to build your project"},{value:"download",label:"Download credentials (credentials.json)",hint:"Sync credentials from Dashboard to local project"},{value:"service",label:"App Store Connect API Key (Magic)",hint:"Manage your API Key for automated submission"},{value:"push",label:"Push Notifications (Placeholder)",hint:"Manage your Apple Push Notifications Key"},{value:"back",label:"Go back"},{value:"exit",label:"Exit"}].filter(c=>!(e==="android"&&(c.value==="service"&&(c.label="Google Service Account (JSON)"),c.value==="push")))});if((v(r)||r==="exit")&&(G("Operation cancelled"),process.exit(0)),r==="back")return ue(a);if(r==="setup")await ke({...a,platform:e});else if(r==="download")await Xe({...a,platform:e});else if(r==="service")await pe({platform:e});else if(r==="push")return Ie("Push Notifications management is coming soon!","Coming Soon"),ue(a);Ve(n.green("Done!"))},ke=async a=>{let e=z(),r=a.platform,c=a.profile;if(!c){let u=await T({message:"Select credential type:",options:[{value:"development",label:"Development",hint:"Local testing & simulators"},{value:"staging",label:"Ad Hoc / Staging",hint:"Internal distribution & device testing"},{value:"production",label:"Production / App Store",hint:"App Store & Play Store submission"}]});v(u)&&(G("Operation cancelled"),process.exit(0)),c=u}let s=`./${p.configFileName}`;if(!A.existsSync(s)){t.error(`No ${p.configFileName} found. Run \`${p.nameLower} init\` or \`${p.nameLower} link\` first.`);return}let o=JSON.parse(A.readFileSync(s,"utf-8")),{projectId:i}=o;if(!i){t.error(`${p.configFileName} is missing projectId.`);return}a.awsProfile&&t.warn(n.yellow(`Ignoring --aws-profile. Authenticating with ${p.name} Cloud...`)),t.info(n.dim(`Setting up credentials for: ${c}`)),r==="ios"?await Ge(i,c,a,o):await _e(i,c,c==="production"?"store":"internal",a)};async function Ge(a,e,r,c){let s=r.bundleId;if(!s){let C=c.submit?.production?.ios?.bundleId||c.ios?.bundleId,g=[];try{let m=(await R.get(`/credentials/${a}`)).data.credentials||[];g=[...new Set(m.filter(l=>l.platform==="ios"&&l.bundleId&&l.bundleId!=="*").map(l=>l.bundleId))]}catch{}if(C&&!g.includes(C)&&g.unshift(C),g.length>0){let d=[...g.map(l=>({value:l,label:l,hint:l===C?"from config":void 0})),{value:"__new__",label:"+ Enter a new Bundle ID"}],m=await T({message:"Which Bundle ID are you setting up credentials for?",options:d});if(v(m)&&(G("Operation cancelled"),process.exit(0)),m==="__new__"){let l=await J({message:"iOS Bundle ID (e.g. com.example.app):",placeholder:"com.example.app",validate:I=>I.includes(".")?void 0:"Please enter a valid Bundle ID"});v(l)&&(G("Operation cancelled"),process.exit(0)),s=l}else s=m}else{let d=await J({message:"iOS Bundle ID (e.g. com.example.app):",placeholder:"com.example.app",validate:m=>m.includes(".")?void 0:"Please enter a valid Bundle ID"});v(d)&&(G("Operation cancelled"),process.exit(0)),s=d}}t.info(n.dim(`Bundle ID: ${s}`));let o=e==="production"?"store":e==="staging"?"adhoc":"development",i=c.submit?.production?.ios?.appleId;i&&t.info(n.dim(`Using Apple ID from config: ${i}`)),await Fe(a,s,e,o,o==="store"?"appstore":o==="adhoc"?"adhoc":"development",r,c,i)}async function Be(a){let e="MATCH_ENCRYPTION_PASSPHRASE";try{let i=((await R.get(`/projects/${a}/secrets/export?env=development`)).data.secrets||{})[e];if(i&&!i.includes("[Decryption Failed]"))return t.info(n.dim("Using existing encryption passphrase from Dashboard")),t.info(n.cyan(`MATCH_PASSWORD: ${i}`)),i;if(i&&i.includes("[Decryption Failed]")){t.warn(n.yellow("\u26A0\uFE0F  Existing MATCH_PASSWORD could not be decrypted (encryption key changed).")),t.info(n.dim("Generating a fresh passphrase and cleaning old certificates..."));let u=oe.randomBytes(32).toString("base64");try{await R.post(`/projects/${a}/secrets`,{key:e,value:u,type:"managed",description:"Encryption passphrase for iOS certificates (fastlane match)",visibility:"secret"}),t.success(n.green("\u2713 New encryption passphrase generated and saved"))}catch{}try{await R.post("/credentials/clean-match-storage",{projectId:a}),t.success(n.green("\u2713 Cleaned old certificates from storage"))}catch{}return u}}catch(s){t.info(n.dim(`Could not fetch existing passphrase from Dashboard: ${s.message}`))}let r=await T({message:"No active encryption passphrase found on Dashboard. What would you like to do?",options:[{value:"generate",label:"Generate a new secure passphrase",hint:"Safe for first-time setup"},{value:"enter",label:"Enter existing passphrase manually",hint:"Required if you already have certs in S3"},{value:"cancel",label:"Cancel",hint:"Quit"}]});if((v(r)||r==="cancel")&&(G("Operation cancelled"),process.exit(0)),r==="enter"){let s=await de({message:"Enter your MATCH_PASSWORD (encryption passphrase):",validate:i=>i.length>0?void 0:"Passphrase is required"});v(s)&&(G("Operation cancelled"),process.exit(0));let o=s;try{await R.post(`/projects/${a}/secrets`,{key:e,value:o,type:"managed",description:"Encryption passphrase for iOS certificates (fastlane match)"}),t.success(n.green("\u2713 Saved passphrase to Dashboard"))}catch{}return o}let c=oe.randomBytes(32).toString("base64");try{await R.post(`/projects/${a}/secrets`,{key:e,value:c,type:"managed",description:"Encryption passphrase for iOS certificates (fastlane match)",visibility:"secret"}),t.success(n.green("\u2713 Generated and saved encryption passphrase to Dashboard")),t.info(n.cyan(`MATCH_PASSWORD: ${c}`))}catch(s){t.warn(n.yellow(`Could not save passphrase to Dashboard: ${s.message}`))}return c}async function Fe(a,e,r,c,s,o,i,u){let C=z();t.info(n.blue("Configuring iOS certificate management..."));let g;if(!u){let d=await J({message:"Apple ID (for Apple Developer Portal):",placeholder:"your-email@example.com",validate:m=>m.includes("@")?void 0:"Please enter a valid email"});v(d)&&(G("Operation cancelled"),process.exit(0)),u=d,i.submit||(i.submit={production:{ios:{}}}),i.submit.production||(i.submit.production={ios:{}}),i.submit.production.ios||(i.submit.production.ios={}),i.submit.production.ios.appleId=u,A.writeFileSync(`./${p.configFileName}`,JSON.stringify(i,null,2)),t.success(n.green("\u2713 Apple ID saved to config"))}C.start(`Fetching ${s} certificates...`);try{let d=await Be(a),m="",l="";try{let b=await R.post("/credentials/build-server-token",{projectId:a});b.data.status==="success"&&b.data.credentials&&(process.env.AWS_ACCESS_KEY_ID=b.data.credentials.accessKeyId,process.env.AWS_SECRET_ACCESS_KEY=b.data.credentials.secretAccessKey,b.data.credentials.sessionToken&&(process.env.AWS_SESSION_TOKEN=b.data.credentials.sessionToken),l=b.data.credentials.region||"ap-south-1",m=b.data.credentials.bucket||p.bucketPrefix,process.env.AWS_REGION=l,delete process.env.AWS_PROFILE)}catch(b){throw t.error(`Failed to authenticate with ${p.name} Cloud.`),b}if(!m||!l){t.error(`Failed to resolve S3 configuration from ${p.name} Cloud.`);return}let I=o.teamId||i.submit?.production?.ios?.appleTeamId;if(!I)try{let D=(await R.get(`/projects/${a}/secrets`)).data.secrets?.find($=>$.key==="APPLE_TEAM_ID");D&&(I=D.value,t.info(n.dim(`Using Team ID from Dashboard: ${I}`)))}catch{}if(I&&I===i.submit?.production?.ios?.appleTeamId&&t.info(n.dim(`Using Apple Team ID from config: ${I}`)),!I){t.warn(n.yellow(`
+Apple Team ID is required to fetch certificates.`)),t.info(n.dim("You can find this at: https://developer.apple.com/account \u2192 Membership Details"));let b=await J({message:"Enter your 10-character Apple Team ID:",placeholder:"e.g. SA56KTS33U",validate:D=>D.length===10?void 0:"Team ID must be exactly 10 characters"});v(b)&&(G("Operation cancelled"),process.exit(0)),I=b,await fe(a,I)}C.stop("Starting certificate sync...");let f=p.credentialsKeychain,S=p.keychainPassword;try{let D=`${process.env.HOME||"/Users/"+(process.env.USER||p.nameLower)}/Library/Keychains/${f}`;t.info(n.dim(`Ensuring keychain exists: ${f}`));try{W(`security create-keychain -p ${S} ${f} 2>/dev/null || true`),W(`security unlock-keychain -p ${S} ${f}`),W(`security set-keychain-settings ${f}`);let h=W("security list-keychains -d user").toString();if(!h.includes(f)){t.info(n.dim(`Adding ${f} to search list`));let y=[...h.replace(/"/g,"").split(`
+`).map(x=>x.trim()).filter(x=>x.length>0),D].join(" ");W(`security list-keychains -d user -s ${y}`)}}catch(h){t.warn(n.dim("Keychain setup warning (non-critical): "+h.message))}let $,O;try{let w=((await R.get(`/credentials/${a}`)).data.credentials||[]).find(y=>y.type==="asc_api_key"&&y.issuerId);if(w){let y=await R.get(`/credentials/${w.credentialId}/download`,{params:{projectId:a}});if(y.data.downloadUrl){let k=await(await import("axios")).default.get(y.data.downloadUrl,{responseType:"arraybuffer"}),H=V.join(ge.tmpdir(),`mach-asc-${Date.now()}`);A.mkdirSync(H,{recursive:!0}),g=V.join(H,`AuthKey_${w.keyId}.p8`),A.writeFileSync(g,Buffer.from(k.data)),$=w.keyId,O=w.issuerId,t.success(n.green("\u2713 ASC API key loaded \u2014 no 2FA required for Portal operations"))}}}catch(h){t.warn(n.dim(`Could not load ASC API key: ${h.message}. Will fall back to Apple ID auth.`))}t.info(n.dim("Generating secure P12 export password..."));let M=Ae();t.success(n.green("\u2713 Secure P12 password generated."));let B={...process.env,AWS_REGION:process.env.AWS_REGION||"ap-south-1",AWS_ACCESS_KEY_ID:process.env.AWS_ACCESS_KEY_ID,AWS_SECRET_ACCESS_KEY:process.env.AWS_SECRET_ACCESS_KEY,SSL_CERT_FILE:"/etc/ssl/cert.pem",AWS_CA_BUNDLE:"/etc/ssl/cert.pem",FASTLANE_SSL_CA_CERT:"/etc/ssl/cert.pem",MATCH_PASSWORD:d,FASTLANE_USER:u,FASTLANE_SKIP_UPDATE_CHECK:"1",FASTLANE_TEAM_ID:I,MATCH_KEYCHAIN_NAME:f,MATCH_KEYCHAIN_PASSWORD:S,TERM:process.env.TERM||"xterm-256color",SHELL:process.env.SHELL||"/bin/zsh",MATCH_OUTPUT_PATH:V.join(process.cwd(),"temp_match"),MATCH_STORAGE_MODE:"s3",MATCH_S3_REGION:l,MATCH_S3_BUCKET:m,MATCH_S3_OBJECT_PREFIX:"ios-certificates/",MATCH_USERNAME:u,MATCH_APP_IDENTIFIER:e,MATCH_TYPE:s,[`${p.envPrefix}P12_PASSWORD`]:M,...g&&$&&O?{APP_STORE_CONNECT_API_KEY_KEY_ID:$,APP_STORE_CONNECT_API_KEY_ISSUER_ID:O,APP_STORE_CONNECT_API_KEY_KEY_FILEPATH:g,FASTLANE_SKIP_2FA:"1"}:{}};if(o.force){t.warn(n.yellow(`
+\u26A0\uFE0F  Force flag detected: Hard resetting ${s} certificates...`)),t.info(n.dim("Detected decryption failure loop. Clearing remote storage directly to allow fresh generation.")),t.info(n.cyan(`Current MATCH_PASSWORD: ${d}`)),t.info(n.dim(`Cleaning match storage for Team ID: ${I}...`));try{(await R.post("/credentials/clean-match-storage",{projectId:a,teamId:I})).data.status==="success"&&t.success(n.green(`\u2713 Cleared S3 storage for Team ID: ${I}`))}catch(h){t.warn(n.yellow(`S3 cleanup via API failed: ${h.message}`)),t.info(n.dim("Continuing to attempt standard nuke..."))}try{W(`fastlane match nuke ${s} --skip_confirmation`,{stdio:"inherit",cwd:process.cwd(),env:B}),t.success(n.green(`\u2713 Nuked existing ${s} credentials`))}catch{t.warn(n.yellow("Standard nuke failed (likely due to password mismatch).")),t.info(n.dim("Since S3 was cleared manually, proceeding to generation..."))}}if(s==="adhoc"||s==="development")try{t.info(n.blue("Fetching registered devices..."));let w=(await R.get("/devices")).data.devices||[];if(w.length===0)t.warn(n.yellow("No registered devices found. Profile will only include devices already on the Apple Developer Portal.")),t.info(n.dim(`Register devices with: ${p.nameLower} device register`));else{let{multiselect:y}=await import("@clack/prompts"),x=await y({message:`Select devices to include in the ${s} profile:`,options:w.map(k=>({value:k.udid,label:`${k.name} (${k.udid.substring(0,12)}...)`,hint:k.model||k.platform})),initialValues:w.map(k=>k.udid)});if(!v(x)&&x.length>0){let k=w.filter(H=>x.includes(H.udid));if(t.info(n.blue(`Registering ${k.length} device(s) on Apple Developer Portal...`)),g&&$&&O)await Ne(k,$,O,g);else{t.info(n.dim("You will be prompted for a 2FA code once \u2014 type it and press Enter."));for(let H of k){let ye=H.name.replace(/"/g,'\\"');L(`fastlane run register_device name:"${ye}" udid:"${H.udid}"`,{shell:!0,env:B,stdio:"inherit",cwd:process.cwd()})}}t.info(n.green("\u2713 Device registration complete."))}}}catch(h){t.warn(n.yellow(`Could not fetch registered devices: ${h.message}`)),t.info(n.dim("Continuing without explicit device registration."))}try{let h=L(`fastlane match ${s} --app_identifier "${e}" --profile_name "${p.nameLower} ${s} ${e}"`,{shell:!0,cwd:process.cwd(),env:B,stdio:"inherit",encoding:"utf-8"});if(h.status!==0){t.warn(n.yellow(`
+Certificate sync failed. Attempting to create App ID and retry...`));try{W(`fastlane produce --app_identifier "${e}" --app_name "${e}" --skip_itc`,{stdio:"inherit",env:B}),t.success(n.green("\u2713 App ID created successfully")),t.info(n.blue("Retrying certificate sync...")),h=L(`fastlane match ${s} --app_identifier "${e}" --profile_name "${p.nameLower} ${s} ${e}"`,{shell:!0,cwd:process.cwd(),env:B,stdio:"inherit",encoding:"utf-8"})}catch{}if(h.status!==0)throw new Error("fastlane match failed")}}catch(h){t.warn(n.yellow(`
+Sync failed. This often happens if the encryption passphrase (MATCH_PASSWORD) is incorrect or session expired.`)),t.info(n.cyan(`Failed MATCH_PASSWORD was: ${d}`));let w=await T({message:"What would you like to do?",options:[{value:"retry_password",label:"Retry with a different MATCH_PASSWORD",hint:"Manually enter the decryption passphrase"},{value:"check_portal",label:"Check Apple Portal (Resolve certificate limits)",hint:"See if you have too many certificates"},{value:"manual",label:"Fallback to manual upload",hint:"Provide .p12 and .mobileprovision files"},{value:"cancel",label:"Cancel",hint:"Go back"}]});if(v(w)||w==="cancel")throw h;if(w==="retry_password"){t.info(n.dim(`
+You are overriding the dashboard passphrase for this session.`));let y=await de({message:"Enter the correct MATCH_PASSWORD for this project:"});if(y&&!v(y)){d=y,t.info(n.blue("Retrying with provided passphrase...")),t.info(n.cyan(`New MATCH_PASSWORD: ${d}`));let x={...B,MATCH_PASSWORD:d};if(L(`fastlane match ${s}`,{shell:!0,stdio:"inherit",cwd:process.cwd(),env:x}).status===0)await R.post(`/projects/${a}/secrets`,{key:"MATCH_ENCRYPTION_PASSPHRASE",value:d,description:"Encryption passphrase for iOS certificates (fastlane match)",visibility:"secret"}),t.success(n.green("\u2713 Dashboard passphrase updated.")),t.info(n.cyan(`MATCH_PASSWORD: ${d}`));else throw new Error("Sync failed again with provided passphrase.")}else throw h}else if(w==="check_portal")try{let y=await le(B,s);if(y.length>0){if(t.info(n.dim(`Found ${y.length} existing ${s} certificates on the portal.`)),await xe(s,B,a,y)&&(t.info(n.blue("Retrying certificate sync...")),L(`fastlane match ${s}`,{shell:!0,stdio:"inherit",cwd:process.cwd(),env:B}).status!==0))throw new Error("Retry failed")}else throw t.error(n.red("No existing certificates found on portal to resolve.")),h}catch(y){throw t.warn(n.dim(`Portal check warning: ${y.message}`)),h}else throw h}t.success(n.green("\u2713 Certificates fetched and synced"));let F=V.join(process.cwd(),"temp_match"),K=V.join(F,`${p.fastlanePrefix}_export.p12`),j=ce(F,/\.mobileprovision$/);try{let w=`${process.env.HOME||"/Users/"+(process.env.USER||p.nameLower)}/Library/Keychains/${f}`;A.existsSync(F)||A.mkdirSync(F,{recursive:!0}),t.info(n.dim("Exporting certificate from keychain for dashboard upload...")),W(`security export -k ${w} -t identities -f pkcs12 -o ${K} -P ""`,{stdio:"ignore"})}catch{t.warn(n.dim("Could not export certificate from keychain."))}o.teamId&&!I&&await fe(a,o.teamId);let Q=A.existsSync(K)?K:ce(F,/\.p12$/);if(Q&&j){let h,w;try{let y=await le(B,s);y.length>0&&(h=y[0].expires,w=y[0].id)}catch{t.warn(n.dim("Could not fetch expiration date or ID for dashboard record."))}await Y(a,Q,"ios_cert",e,c,void 0,h,o.teamId||I,w,M),await Y(a,j,"ios_profile",e,c,void 0,h,o.teamId||I),t.success(n.green("\u2713 Both iOS certificate and provisioning profile uploaded successfully"));try{A.existsSync("./temp_match")&&A.rmSync("./temp_match",{recursive:!0,force:!0})}catch{}}else t.warn(n.yellow("Certificates generated but not found in expected location.")),t.info(n.dim("Falling back to manual upload...")),await me(a,e,c)}catch(b){C.stop("Certificate fetch failed"),t.error(n.red(`Error: ${b.message}`)),t.info(n.dim("Falling back to manual upload...")),await me(a,e,c)}}catch(d){C.stop("iOS setup failed"),t.error(n.red(`Error: ${d.message}`))}finally{if(g)try{A.rmSync(V.dirname(g),{recursive:!0,force:!0})}catch{}}}async function fe(a,e){try{await R.post(`/projects/${a}/secrets`,{key:"APPLE_TEAM_ID",value:e,description:"Apple Developer Team ID (used for iOS signing)"}),t.success(n.green(`\u2713 Saved Team ID ${e} to Dashboard`))}catch(r){t.warn(n.yellow(`Could not save Team ID to Dashboard: ${r.message}`))}}async function me(a,e,r){t.info(n.yellow(`
+Manual Upload Mode`)),t.info("Please provide your certificate and provisioning profile:");let c=await J({message:"Path to .p12 certificate file:",validate:i=>A.existsSync(i)?void 0:"File not found"});v(c)&&(G("Operation cancelled"),process.exit(0));let s=await J({message:"Path to .mobileprovision file:",validate:i=>A.existsSync(i)?void 0:"File not found"});v(s)&&(G("Operation cancelled"),process.exit(0));let o=z();o.start(`Uploading to ${p.name} Dashboard...`);try{await Y(a,c,"ios_cert",e,r),await Y(a,s,"ios_profile",e,r),o.stop("Upload complete"),t.success(n.green("\u2713 iOS credentials uploaded successfully"))}catch(i){throw o.stop("Upload failed"),i}}async function _e(a,e,r,c){let s=z();t.step(n.blue("Android Credential Setup"));let o=c.bundleId;if(!o){let d=[];try{let l=(await R.get(`/credentials/${a}`)).data.credentials||[];d=[...new Set(l.filter(I=>I.platform==="android"&&I.bundleId&&I.bundleId!=="*").map(I=>I.bundleId))]}catch{}if(d.length>0){let m=[...d.map(I=>({value:I,label:I})),{value:"__new__",label:"+ Enter a new Package Name"}],l=await T({message:"Which Package Name are you setting up credentials for?",options:m});if(v(l)&&(G("Operation cancelled"),process.exit(0)),l==="__new__"){let I=await J({message:"Android Package Name (e.g. com.example.app):",placeholder:"com.example.app",validate:f=>f.includes(".")?void 0:"Please enter a valid package name"});v(I)&&(G("Operation cancelled"),process.exit(0)),o=I}else o=l}else{let m=await J({message:"Android Package Name (e.g. com.example.app):",placeholder:"com.example.app",validate:l=>l.includes(".")?void 0:"Please enter a valid package name"});v(m)&&(G("Operation cancelled"),process.exit(0)),o=m}}try{let l=((await R.get(`/credentials/${a}`)).data.credentials||[]).find(I=>I.platform==="android"&&I.distributionType===r&&I.bundleId===o);if(l){t.warn(n.yellow(`\u26A0\uFE0F  Existing Android credentials found for ${r}`));let I=await J({message:"What would you like to do? (use/new/cancel)",validate:f=>{let S=f.toLowerCase();if(!(S==="use"||S==="new"||S==="cancel"))return"Please type: use, new, or cancel"}});if(v(I)||I.toLowerCase()==="cancel")return;if(I.toLowerCase()==="use"){t.success(n.green("\u2713 Using existing credentials."));return}await R.delete(`/credentials/${l.credentialId}?projectId=${a}`)}}catch{}let i="./android/app/my-release-key.jks";if(A.existsSync(i)){let d=await Re({message:"Upload existing keystore?"});if(d&&!v(d)){let m=await J({message:"Key alias:",initialValue:"my-key-alias"});if(v(m))return;let l=await de({message:"Keystore password:"});if(v(l))return;await Y(a,i,"android_keystore",o,r,m,void 0,void 0,void 0,l),t.success(n.green("\u2713 Keystore uploaded"));return}}t.info(n.blue("Generating new Android keystore..."));let u=c.keyAlias||`${p.nameLower}-${We()}`,C=Ae(),g=`./${p.nameLower}-${e}.jks`;A.existsSync(g)&&A.unlinkSync(g),s.start("Generating keystore...");try{let d=C.replace(/'/g,"'\\''");W(`keytool -genkeypair -v -keystore "${g}" -alias "${u}" -keyalg RSA -keysize 2048 -validity 10000 -storepass '${d}' -keypass '${d}' -dname "CN=${p.name} Build, OU=Mobile, O=Company, L=City, S=State, C=US"`,{stdio:"inherit"}),s.stop("Keystore generated"),await Y(a,g,"android_keystore",o,r,u,void 0,void 0,void 0,C),t.success(n.green("\u2713 Android credentials uploaded successfully")),t.info(n.cyan(`Key Alias: ${u}`))}catch(d){throw s.stop("Generation failed"),new Error(`Keystore generation failed: ${d.message}`)}}async function Y(a,e,r,c,s,o,i,u,C,g){let d=V.basename(e);t.info(n.dim(`Uploading ${d} (Isolated process)...`));let m=new URL(import.meta.url),l=V.dirname(m.pathname),I=V.join(l,"commands","isolated-upload.js"),f=L("node",[I,a,e,r,c,s,o||"undefined",i||"undefined",u||"undefined",C||"undefined",g||"undefined"],{stdio:"pipe",encoding:"utf-8",env:{...process.env,AT_CLI_ISOLATED:"1"}});if(f.status!==0){let S=f.stderr||f.stdout||"Unknown isolated upload failure";throw t.error(n.red(`Isolated Upload Failed: ${S}`)),new Error(S)}f.stdout.includes("SUCCESS")?t.info(n.dim(`\u2713 ${d} uploaded and registered.`)):t.warn(n.yellow(`Isolated upload finished but success not confirmed: ${f.stdout}`))}async function Xe(a){let e=z(),r=a.platform,c=`./${p.configFileName}`;if(!A.existsSync(c)){t.error(`No ${p.configFileName} found. Run \`${p.nameLower} init\` or \`${p.nameLower} link\` first.`);return}let s=JSON.parse(A.readFileSync(c,"utf-8")),{projectId:o}=s;if(!o){t.error(`${p.configFileName} is missing projectId.`);return}try{e.start("Fetching project secrets...");let u=(await R.get(`/projects/${o}/secrets/export?env=all`)).data.secrets||{};e.stop("Secrets fetched and merged."),e.start("Fetching credentials...");let g=(await R.get(`/credentials/${o}`)).data.credentials||[];e.stop(`Found ${g.length} metadata records.`);let d=g.filter(f=>f.platform===r);if(d.length===0){t.info(`No ${r} credentials found on Dashboard.`);return}let m="./credentials.json",l={};if(A.existsSync(m))try{l=JSON.parse(A.readFileSync(m,"utf-8"))}catch{t.warn("Could not parse existing credentials.json, creating a new one.")}l[r]||(l[r]={});let I=V.join(process.cwd(),"credentials",r);A.existsSync(I)||A.mkdirSync(I,{recursive:!0});for(let f of d){e.start(`Downloading ${f.type} (${f.distributionType})...`);try{let S=await R.get(`/credentials/${f.credentialId}/download?projectId=${o}`);if(S.data.status==="success"&&S.data.downloadUrl){let b=V.join(process.cwd(),"credentials",r,f.distributionType);A.existsSync(b)||A.mkdirSync(b,{recursive:!0});let D=f.s3Key?.split(".").pop()||(f.type.includes("keystore")?"jks":f.type.includes("cert")?"p12":"mobileprovision"),$=`${f.type}.${D}`,O=V.join(b,$),M=await Ce.get(S.data.downloadUrl,{responseType:"arraybuffer"});A.writeFileSync(O,Buffer.from(M.data));let B=V.join("credentials",r,f.distributionType,$);if(r==="android"){if(f.type==="android_keystore"){let F=f.distributionType==="store"?"PRODUCTION":f.distributionType==="internal"?"STAGING":"DEVELOPMENT",K=["PRODUCTION","STORE","INTERNAL","STAGING","DEVELOPMENT","RELEASE","DEBUG"],j=[`KEYSTORE_PASSWORD_${F}`,`KEYSTORE_PASSWORD_${f.distributionType.toUpperCase()}`,...K.map(y=>`KEYSTORE_PASSWORD_${y}`),"ANDROID_KEYSTONE_PASSWORD","KEYSTORE_PASSWORD"],Q=[`KEYSTORE_ALIAS_${F}`,`KEYSTORE_ALIAS_${f.distributionType.toUpperCase()}`,...K.map(y=>`KEYSTORE_ALIAS_${y}`),"KEYSTORE_ALIAS"],h=j.map(y=>u[y]).find(y=>!!y)||"",w=Q.map(y=>u[y]).find(y=>!!y)||f.meta?.alias||"";l.android.keystore={keystorePath:B,keystorePassword:h,keyAlias:w,keyPassword:h}}}else if(r==="ios"){let F=f.distributionType==="store"?"production":f.distributionType==="adhoc"?"staging":"development";l.ios[F]||(l.ios[F]={}),f.type==="ios_cert"?(l.ios[F].certificatePath=B,l.ios[F].certificatePassword=u.IOS_P12_PASSWORD||""):f.type==="ios_profile"&&(l.ios[F].provisioningProfilePath=B)}e.stop(`\u2713 ${f.type} (${f.distributionType}) saved.`)}}catch(S){let b=S.response?.data?.message||S.message;e.stop(n.dim(`- Skipped ${f.type} (${f.distributionType}): ${b}`))}}A.writeFileSync(m,JSON.stringify(l,null,2)),t.success(n.green("\u2713 Local credentials.json updated.")),Ie("Credentials have been synced to your local machine. Ensure credentials.json and credentials/ is added to your .gitignore.","Sync Complete")}catch(i){e.stop(n.red("Sync failed.")),t.error(`Error: ${i.message}`)}}function Ae(){let a="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_+=",e="";for(let r=0;r<24;r++)e+=a.charAt(Math.floor(Math.random()*a.length));return e}function We(a=8){let e="abcdefghijklmnopqrstuvwxyz0123456789",r="";for(let c=0;c<a;c++)r+=e.charAt(Math.floor(Math.random()*e.length));return r}async function xe(a,e,r,c){let s=c||await le(e,a);if(!s||s.length===0)return!1;let o=await T({message:"Select a certificate to revoke:",options:[...s.map(i=>({value:`revoke:${i.id}`,label:`Revoke: ${i.name} (${i.expires})`})),{value:"nuke",label:"Revoke All"},{value:"cancel",label:"Cancel"}]});return v(o)||o==="cancel"?!1:o==="nuke"?(W(`fastlane match nuke ${a}`,{stdio:"inherit",cwd:process.cwd(),env:e}),!0):typeof o=="string"&&o.startsWith("revoke:")?(await $e(e,o.split(":")[1]),!0):!1}async function le(a,e){let r=e==="development"?"development":"distribution",c=`
+lane :${p.fastlanePrefix}_list_certs do
+  require 'spaceship'
+  require 'json'
+  begin
+    Spaceship::Portal.login(ENV['FASTLANE_USER'])
+    Spaceship::Portal.select_team(team_id: ENV['FASTLANE_TEAM_ID'])
+    output = Spaceship::Portal.certificate.all.select { |c|
+      if "${r}" == "development"
+        c.type_display_id.downcase.include?("development")
+      else
+        c.type_display_id.downcase.include?("distribution") || c.type_display_id.downcase.include?("production")
+      end
+    }.map { |c| { id: c.id, name: c.name, expires: c.expires.strftime('%Y-%m-%d'), type: c.type_display_id } }
+    puts "${p.jsonStartMarker}" + output.to_json + "${p.jsonEndMarker}"
+  rescue => e
+    $stderr.puts "ERROR: #{e.message}"
+    exit 1
+  end
+end`,s=V.join(ge.tmpdir(),`/tmp/${p.nameLower}-list-certs-${Date.now()}`),o=V.join(s,"fastlane"),i=V.join(o,"Fastfile");try{A.existsSync(o)||A.mkdirSync(o,{recursive:!0}),A.writeFileSync(i,c);let C=W(`fastlane ${p.fastlanePrefix}_list_certs`,{env:{...a,CI:"1",FASTLANE_FASTFILE:i},cwd:s,stdio:["inherit","pipe","inherit"]}).toString().match(new RegExp(`${p.jsonStartMarker}(.*)${p.jsonEndMarker}`));return C?JSON.parse(C[1]):[]}finally{A.existsSync(s)&&A.rmSync(s,{recursive:!0,force:!0})}}async function $e(a,e){let r=`
+lane :${p.fastlanePrefix}_revoke_cert do
+  require 'spaceship'
+  begin
+    Spaceship::Portal.login(ENV['FASTLANE_USER'])
+    Spaceship::Portal.select_team(team_id: ENV['FASTLANE_TEAM_ID'])
+    cert = Spaceship::Portal.certificate.all.find { |c| c.id == "${e}" }
+    cert.revoke! if cert
+  rescue => e
+    $stderr.puts "ERROR: #{e.message}"
+    exit 1
+  end
+end`,c=V.join(ge.tmpdir(),`/tmp/${p.nameLower}-revoke-cert-${Date.now()}`),s=V.join(c,"fastlane"),o=V.join(s,"Fastfile");try{A.existsSync(s)||A.mkdirSync(s,{recursive:!0}),A.writeFileSync(o,r),W(`fastlane ${p.fastlanePrefix}_revoke_cert`,{env:{...a,CI:"1",FASTLANE_FASTFILE:o},cwd:c,stdio:["inherit","pipe","inherit"]})}finally{A.existsSync(c)&&A.rmSync(c,{recursive:!0,force:!0})}}export{pe as a,ue as b,ke as c,Xe as d};

package/dist/{credentials-SIMFHBM3.js → credentials-WL7JKLF4.js}

@@ -1 +1 @@
-import{b as a,c as b,d as c}from"./chunk-OQOE4CWV.js";import"./chunk-YZYFEHP5.js";export{a as credentialsMainCommand,b as credentialsSetupCommand,c as downloadCredentialsCommand};
+import{b as a,c as b,d as c}from"./chunk-YXFDQM4S.js";import"./chunk-YZYFEHP5.js";export{a as credentialsMainCommand,b as credentialsSetupCommand,c as downloadCredentialsCommand};

package/dist/index.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import{a as ci,c as qe}from"./chunk-OQOE4CWV.js";import{a as p,b as ri,c as ue,d as si,e as gt,f as ai,g as _}from"./chunk-YZYFEHP5.js";import{Command as Jr,Option as On}from"commander";import{configDotenv as qr}from"dotenv";import{intro as de,outro as Tn}from"@clack/prompts";import oe from"chalk";import{text as li,confirm as kn,spinner as Nn,isCancel as Ut,cancel as Xe,note as xn,outro as Ln}from"@clack/prompts";import Ze from"chalk";async function di(){try{let e=await li({message:"Enter Bucket Name:",placeholder:"e.g. my-app-dev",validate(o){if(o.length===0)return"Bucket name is required"}});Ut(e)&&(Xe("Operation cancelled."),process.exit(0));let n=await li({message:"Enter Region:",initialValue:"ap-south-1"});Ut(n)&&(Xe("Operation cancelled."),process.exit(0));let t=await kn({message:"Do you want to create a CloudFront Distribution for this bucket?",initialValue:!0});Ut(t)&&(Xe("Operation cancelled."),process.exit(0));let i=Nn();i.start("Setting up hosting infrastructure...");try{let o=await _.post("/hosting/setup",{bucketName:e,region:n,createCloudFront:t});if(o.data.status!=="success")throw new Error(o.data.message||"Hosting setup failed");i.stop("Hosting setup complete!");let r=o.data,a=`Bucket Name:      ${Ze.cyan(r.bucketName)}
+import{a as ci,c as qe}from"./chunk-YXFDQM4S.js";import{a as p,b as ri,c as ue,d as si,e as gt,f as ai,g as _}from"./chunk-YZYFEHP5.js";import{Command as Jr,Option as On}from"commander";import{configDotenv as qr}from"dotenv";import{intro as de,outro as Tn}from"@clack/prompts";import oe from"chalk";import{text as li,confirm as kn,spinner as Nn,isCancel as Ut,cancel as Xe,note as xn,outro as Ln}from"@clack/prompts";import Ze from"chalk";async function di(){try{let e=await li({message:"Enter Bucket Name:",placeholder:"e.g. my-app-dev",validate(o){if(o.length===0)return"Bucket name is required"}});Ut(e)&&(Xe("Operation cancelled."),process.exit(0));let n=await li({message:"Enter Region:",initialValue:"ap-south-1"});Ut(n)&&(Xe("Operation cancelled."),process.exit(0));let t=await kn({message:"Do you want to create a CloudFront Distribution for this bucket?",initialValue:!0});Ut(t)&&(Xe("Operation cancelled."),process.exit(0));let i=Nn();i.start("Setting up hosting infrastructure...");try{let o=await _.post("/hosting/setup",{bucketName:e,region:n,createCloudFront:t});if(o.data.status!=="success")throw new Error(o.data.message||"Hosting setup failed");i.stop("Hosting setup complete!");let r=o.data,a=`Bucket Name:      ${Ze.cyan(r.bucketName)}
 `;a+=`Region:           ${Ze.cyan(r.region)}
 `,a+=`S3 Website URL:   ${Ze.blue(r.s3WebsiteUrl)}`,r.cloudFrontId&&(a+=`
 
@@ -805,5 +805,5 @@ Environment Variables:`)),Object.entries(i.env).forEach(([o,r])=>{pe.info(`  ${o
 Running expo prebuild for deeper analysis...`));try{Nr("npx expo prebuild --no-install",{cwd:e,stdio:"pipe"})}catch{return ft.warn(fe.yellow("Prebuild failed \u2014 skipping manifest/plist checks.")),r}}else if(!s)return n.json||ft.info(fe.dim(`
 Skipping manifest/plist checks \u2014 no android/ios dirs. Use --prebuild to generate them.`)),r;for(let l of o){let d=Sn();d.start(fe.dim(`Running ${l.label}...`));try{let u=Date.now(),f=await l.fn(e,n);f.durationMs=Date.now()-u,r.push(f);let y=f.findings.length;d.stop(y>0?fe.yellow(`${l.label} \u2014 ${y} finding(s)`):fe.green(`${l.label} \u2014 clean`))}catch(u){d.stop(fe.red(`${l.label} \u2014 error`)),r.push({category:l.category,label:l.label,findings:[],durationMs:0,error:u.message})}}}return r}import ee from"chalk";import{log as q}from"@clack/prompts";var Ve={critical:ee.bgRed.white.bold,high:ee.red.bold,medium:ee.yellow.bold,low:ee.blue,info:ee.dim},Nt={critical:0,high:1,medium:2,low:3,info:4};function Lr(e,n){if(!n)return!0;let t=Nt[n];return t===void 0?!0:Nt[e]<=t}function bn(e,n){let t=0,i={critical:0,high:0,medium:0,low:0,info:0};for(let a of e){let c=a.findings.filter(l=>Lr(l.severity,n));if(c.length===0&&!a.error)continue;if(q.info(""),q.info(ee.bold(`  ${a.label}`)+ee.dim(`  ${c.length} finding(s)`)),q.info(ee.dim("  "+"\u2500".repeat(60))),a.error){q.error(ee.red(`  Error: ${a.error}`));continue}let s=[...c].sort((l,d)=>Nt[l.severity]-Nt[d.severity]);for(let l of s){let d=Ve[l.severity](` ${l.severity.toUpperCase()} `);q.info(`  ${d}  ${ee.bold(l.id)}  ${l.title}`),q.info(ee.dim(`          ${l.description}`)),l.file&&q.info(ee.dim(`          File: ${l.file}${l.line?`:${l.line}`:""}`)),q.info(ee.cyan(`          Fix: ${l.recommendation}`)),q.info(""),i[l.severity]++,t++}}q.info(""),q.info(ee.bold("  Summary")),q.info(ee.dim("  "+"\u2500".repeat(60))),q.info(`  Total: ${ee.bold(String(t))} finding(s)`),q.info(`  ${Ve.critical(` ${i.critical} Critical `)}  ${Ve.high(` ${i.high} High `)}  ${Ve.medium(` ${i.medium} Medium `)}  ${Ve.low(` ${i.low} Low `)}  ${Ve.info(` ${i.info} Info `)}`);let o=i.critical>0,r=i.high>0;o||r?(q.info(""),q.error(ee.red.bold(`  FAIL \u2014 ${i.critical} critical, ${i.high} high issue(s) found`))):t>0?(q.info(""),q.warn(ee.yellow("  PASS (with warnings) \u2014 no critical or high issues"))):(q.info(""),q.success(ee.green.bold("  PASS \u2014 no issues found")))}function Pn(e,n){let t=e.flatMap(o=>o.findings),i={};for(let o of Object.values(he))i[o]=t.filter(r=>r.severity===o).length;return{version:"1.0.0",timestamp:new Date().toISOString(),project:n.name||"unknown",projectVersion:n.version||"0.0.0",summary:{total:t.length,...i},passed:i.critical===0&&i.high===0,checks:e.map(o=>({category:o.category,label:o.label,findingCount:o.findings.length,durationMs:o.durationMs,error:o.error||null})),findings:t}}import{log as X,spinner as Ur}from"@clack/prompts";import Y from"chalk";import Oe from"fs";import Mr from"os";import Ye from"path";import{execSync as Fr}from"child_process";var $n=16384,Hr=1,Gr=Buffer.from([127,69,76,70]);async function _n(e){X.info(Y.bold.underline("16KB Page Alignment Check")),console.log("");let n=Ye.resolve(e);if(!Oe.existsSync(n))return X.error(Y.red(`APK file not found: ${n}`)),!1;if(!n.endsWith(".apk"))return X.error(Y.red("The provided file is not an APK file.")),!1;let t=Ur();t.start("Extracting and analyzing native libraries...");let i=Oe.mkdtempSync(Ye.join(Mr.tmpdir(),"mach-16kb-"));try{try{Fr(`unzip -o -q "${n}" "lib/arm64-v8a/*.so" "lib/x86_64/*.so" -d "${i}" 2>/dev/null`,{encoding:"utf-8",maxBuffer:50*1024*1024})}catch{}let o=Dn(Ye.join(i,"lib"));if(o.length===0)return t.stop("Analysis complete."),X.info(Y.yellow("No arm64-v8a or x86_64 native libraries found in the APK.")),X.info(Y.dim("16KB alignment check only applies to arm64-v8a and x86_64 architectures.")),!0;let r=[];for(let s of o){let l=Ye.relative(i,s),d=jr(l),u=Ye.basename(s),f=Br(s);f!==null&&r.push({name:u,filePath:l,arch:d,align:f,compatible:f>=$n})}if(t.stop("Analysis complete."),r.length===0)return X.info(Y.yellow("No valid ELF shared libraries found.")),!0;let a=r.filter(s=>!s.compatible),c=r.filter(s=>s.compatible);if(X.info(Y.dim(`Checked ${r.length} native librar${r.length===1?"y":"ies"}
 `)),a.length>0){X.info(Y.red.bold(`Incompatible libraries:
-`));for(let s of a)X.error(Y.red(`${Y.bold(s.name)} ${Y.dim(`(${s.arch})`)}`)),X.info(Y.dim(`  PT_LOAD alignment: 2**${Math.log2(s.align)} (${s.align} bytes, needs 2**14 = ${$n})`))}return c.length>0&&(console.log(""),X.success(Y.green(`${c.length} librar${c.length===1?"y":"ies"} correctly aligned (2**14 or higher).`))),console.log(""),a.length===0?(X.success(Y.green.bold("ELF Verification Successful. APK is 16KB compatible.")),!0):(X.error(Y.red.bold(`Found ${a.length} unaligned lib${a.length===1?"":"s"} (arm64-v8a/x86_64 libs need to be aligned).`)),console.log(""),X.info(Y.yellow("To fix this:")),X.info(Y.dim("  1. Rebuild with NDK r28+ which defaults to 16KB page alignment")),X.info(Y.dim("  2. Or set -DANDROID_SUPPORT_FLEXIBLE_PAGE_SIZES=ON in CMake")),X.info(Y.dim("  3. Update third-party libraries that ship prebuilt .so files")),X.info(Y.dim("  4. After rebuilding: zipalign -p -f -v 16 input.apk output.apk")),console.log(""),X.info(Y.dim("Reference: https://developer.android.com/guide/practices/page-sizes")),!1)}catch(o){return t.stop("Analysis failed."),X.error(Y.red(`Failed to analyze APK: ${o.message}`)),!1}finally{try{Oe.rmSync(i,{recursive:!0,force:!0})}catch{}}}function Br(e){let n=Oe.openSync(e,"r");try{let t=Buffer.alloc(64);if(Oe.readSync(n,t,0,64,0),!t.subarray(0,4).equals(Gr))return null;let i=t[4]===2,o=t[5]===1,r=(f,y)=>o?f.readUInt16LE(y):f.readUInt16BE(y),a=(f,y)=>o?f.readUInt32LE(y):f.readUInt32BE(y),c=(f,y)=>Number(o?f.readBigUInt64LE(y):f.readBigUInt64BE(y)),s,l,d;i?(s=c(t,32),l=r(t,54),d=r(t,56)):(s=a(t,28),l=r(t,42),d=r(t,44));let u=null;for(let f=0;f<d;f++){let y=Buffer.alloc(l);if(Oe.readSync(n,y,0,l,s+f*l),a(y,0)!==Hr)continue;let g;i?g=c(y,48):g=a(y,28),g>0&&(u===null||g<u)&&(u=g)}return u??0}catch{return null}finally{Oe.closeSync(n)}}function Dn(e){let n=[];if(!Oe.existsSync(e))return n;let t=Oe.readdirSync(e,{withFileTypes:!0});for(let i of t){let o=Ye.join(e,i.name);i.isDirectory()?n.push(...Dn(o)):i.name.endsWith(".so")&&n.push(o)}return n}function jr(e){return e.includes("arm64-v8a")?"arm64-v8a":e.includes("x86_64")?"x86_64":"unknown"}var Rn=async e=>{if(ue()||(ye.error($e.red(`You are not logged in. Run \`${p.nameLower} login\` first.`)),process.exit(1)),e.apk){await Wr(e);return}let t=process.cwd(),i=xt.join(t,"package.json");mt.existsSync(i)||(ye.error($e.red("No package.json found. Run this command from a project root.")),process.exit(1));let o=JSON.parse(mt.readFileSync(i,"utf-8")),r=!!(o.dependencies?.expo||o.devDependencies?.expo);e.json||(ye.info($e.dim(`Project: ${o.name||"unknown"} v${o.version||"0.0.0"}`)),ye.info($e.dim(`Type: ${r?"Expo":"Bare React Native"}`)),ye.info(""));let a={json:e.json,fix:e.fix,category:e.category,severity:e.severity,prebuild:e.prebuild},c=await In(t,a);e.json?console.log(JSON.stringify(Pn(c,o),null,2)):bn(c,e.severity);let s=c.some(d=>d.findings.some(u=>u.severity==="critical")),l=c.some(d=>d.findings.some(u=>u.severity==="high"));(s||l)&&process.exit(1)},wn=["16kb"];async function Wr(e){let n=e.category?.toLowerCase();n&&!wn.includes(n)&&(ye.error($e.red(`Unknown APK check category: "${n}"`)),ye.info($e.dim(`Available APK checks: ${wn.join(", ")}`)),process.exit(1));let t=await Vr(e.apk);t||process.exit(1);let i=!n,o=!1;(i||n==="16kb")&&(await _n(t)||(o=!0)),o&&process.exit(1)}async function Vr(e){if(e.startsWith("build:")){let t=e.slice(6);return await Yr(t)}if(e.startsWith("http://")||e.startsWith("https://"))return await Cn(e);let n=xt.resolve(e);return mt.existsSync(n)?n:(ye.error($e.red(`APK file not found: ${n}`)),null)}async function Yr(e){let n=vn();n.start(`Fetching APK from build ${e}...`);try{let t=await _.get(`/build/${e}`);if(t.data.status!=="success")throw new Error(t.data.message);let i=t.data.build;if(!i)throw new Error("Build not found");let o=i.artifacts?.find(r=>r.type?r.type==="apk":r.name?.endsWith(".apk")||r.url?.includes(".apk"));return!o||!o.url?(n.stop("No APK artifact found"),ye.error($e.red("This build does not have an APK artifact.")),ye.info($e.dim("Make sure the build produced an APK (not just an AAB).")),null):(n.stop(`Found build: ${i.buildId||e}`),await Cn(o.url))}catch(t){return n.stop("Failed to fetch build"),ye.error($e.red(t.message)),null}}async function Cn(e){let n=vn();n.start("Downloading APK...");try{let t=mt.mkdtempSync(xt.join(Kr.tmpdir(),`${p.nameLower}-audit-`)),i=xt.join(t,"app.apk"),o=await zr.get(e,{responseType:"arraybuffer"});mt.writeFileSync(i,o.data);let r=(o.data.length/(1024*1024)).toFixed(1);return n.stop(`Downloaded APK (${r} MB)`),i}catch(t){return n.stop("Download failed"),ye.error($e.red(`Failed to download APK: ${t.message}`)),null}}var Xr=console.log;console.log=()=>{};qr();console.log=Xr;de(oe.bgCyan.black(p.cliTag("Production Build Orchestrator")));var Qr=Zr(import.meta.url),es=Qr("../package.json"),W=new Jr;W.name(p.nameLower).description(`${p.name} CLI: Powerful Cloud Infrastructure Tools`).version(es.version).option("-y, --yes","Automatically answer yes to all prompts",!1).option("--quiet","Suppress non-essential output",!1);W.command("agent").description("Start local device discovery agent for the Install Hub (port 7070)").action(async()=>{await Ri()});W.command("host").description("Setup AWS S3 static hosting and CloudFront").action(async()=>{de(oe.bgCyan.black(p.cliTag("Hosting"))),await di()});W.command("sitemap").description("Generate sitemap.xml from Expo Router app structure").option("-o, --output <path>","Output path for sitemap.xml","./public/sitemap.xml").action(async e=>{de(oe.bgCyan.black(p.cliTag("Sitemap Generator"))),await mi(e)});W.command("build").description("Run a build on a cloud provider (AWS Spot Instances)").argument("[platform]","Target platform (android, ios)").option("--platform <os>","Target platform alias (android, ios) [Optional]").option("--repo <url>","Git Repository URL").option("--branch <name>","Git Branch").option("--ami <id>","AMI ID").option("--bucket <name>","S3 Bucket for artifacts").option("--region <region>","AWS Region").option("--aws-profile <name>","AWS Credentials Profile").option("-p, --build-profile <name>","Build Profile (e.g. production, staging)","production").option("--profile <name>","Build Profile (alias for --build-profile)").option("--dry-run","Generate User Data script without launching").option("--keep-instance","Do not terminate the instance after build").option("--subnet <id>","VPC Subnet ID to launch the instance in").option("--security-group <id>","VPC Security Group ID to use").option("--ssh-host <host>","Remote host for iOS build (SSH)").option("--ssh-user <user>","SSH username for remote host").option("--ssh-key <path>","Path to private SSH key for remote host").option("--ios-scheme <scheme>","iOS Scheme to build").option("--ios-team-id <id>","Apple Development Team ID").option("--ios-configuration <config>","Xcode configuration (Release/Debug)").option("--ios-export-method <method>","Export method (ad-hoc, app-store, development, enterprise)").option("--ios-api-key-id <id>","App Store Connect API Key ID").option("--ios-api-key-issuer <id>","App Store Connect API Key Issuer ID").option("--ios-api-key-path <path>","Path to App Store Connect API Key (.p8) file").option("--simulator","Build for iOS Simulator (no signing required)").addOption(new On("--build-id <id>","Internal build ID").hideHelp()).addOption(new On("--project-id <id>","Internal project ID").hideHelp()).option("--local","Run build on local machine").option("--auto-version","Automatically fetch and increment versionCode from Google Play").option("--verbose","Enable verbose logging").option("-y, --yes","Automatically answer yes to all prompts",!1).option("--quiet","Suppress non-essential output",!1).action(async(e,n)=>{let t=W.opts();n.yes=n.yes||t.yes,n.quiet=n.quiet||t.quiet,n.platform=e||n.platform,n.buildProfile=n.profile||n.buildProfile,n.quiet||de(oe.bgCyan.black(p.cliTag("Cloud Build"))),await At(n)});W.command("update").description("Deploy an Over-The-Air (OTA) update to your live channel").option("--branch <name>","Channel or Branch to deploy to (e.g., production)","production").action(async e=>{de(oe.bgCyan.black(p.cliTag("OTA Update"))),await ji(e)});W.command("submit").description("Automated Store Submission (App Store / Google Play)").option("--platform <os>","Target platform (ios/android)").option("--track <track>","Google Play Track (internal, alpha, beta, production)","internal").option("--latest","Use the latest successful build for submission").option("--build-id <id>","Use a specific build ID for submission").action(async e=>{de(oe.bgCyan.black(p.cliTag("Store Submission"))),await Gi(e)});W.command("login").description(`Login to ${p.name} Dashboard`).action(async()=>{de(oe.bgCyan.black(p.cliTag("Login"))),await ki()});W.command("link").description(`Link local directory to a ${p.name} Project`).action(async()=>{de(oe.bgCyan.black(p.cliTag("Link Project"))),await Ni()});W.command("me").description("Display currently logged in user details").action(async()=>{await zi()});W.command("init").description(`Create a new ${p.name} Project`).action(async()=>{de(oe.bgCyan.black(p.cliTag("Init Project"))),await xi()});W.command("env").description("Manage Environment Variables").argument("<action>","Action to perform: set or list").argument("[args...]","Key=Value pairs for set action").action(async(e,n)=>{de(oe.bgCyan.black(p.cliTag("Env Manager"))),await Mi(e,n)});W.command("start").description("Start the development server (Metro)").option("-p, --build-profile <name>","Build profile (e.g. development, staging)","development").option("--tunnel","Use ngrok tunnel").option("--lan","Use LAN IP").option("--localhost","Use localhost").option("-c, --clear","Clear Metro cache").option("--port <number>","Port to listen on").option("--ios","Start on iOS").option("--android","Start on Android").option("--web","Start on Web").action(async e=>{de(oe.bgCyan.black(p.cliTag("Dev Server"))),await Ji(e)});W.command("config").description("Show resolved configuration for a profile").option("-p, --profile <name>","Build profile to resolve","development").option("--json","Output as JSON").action(async e=>{await qi(e)});W.command("credentials").description("Unified, interactive credential management (iOS/Android)").option("-p, --profile <name>","Build profile (production, staging, development)").option("--force","Force recreate certificates (nuke existing on Apple Portal)",!1).action(async e=>{let{credentialsMainCommand:n}=await import("./credentials-SIMFHBM3.js");await n(e)});W.command("credentials:setup").description("Automated credential provisioning (iOS/Android) [Legacy]").requiredOption("--platform <os>","Platform: ios or android").option("--profile <name>","Build profile (production, staging, development)").option("--bundle-id <id>","Bundle ID / Package Name (optional, auto-detected)").option("--team-id <id>","Apple Team ID (iOS only)").option("--key-alias <alias>","Android keystore alias (optional, auto-generated)").option("--aws-profile <name>","AWS Credentials Profile (for S3 storage)").option("--force","Force recreate certificates (nuke existing on Apple Portal)",!1).action(async e=>{de(oe.bgCyan.black(p.cliTag("Credentials Setup"))),await qe(e),Tn(oe.green("Done!"))});W.command("credentials:service").description("Upload Service Credentials (ASC API Key / Google Service JSON) [Legacy]").requiredOption("--platform <os>","Platform: ios or android").option("--file <path>","Path to credential file (.p8 or .json)").option("--issuer-id <id>","ASC API Key Issuer ID (iOS only)").option("--key-id <id>","ASC API Key ID (iOS only)").action(async e=>{de(oe.bgCyan.black(p.cliTag("Service Credentials"))),await ci(e),Tn(oe.green("Done!"))});var oi=W.command("device").description("Manage registered iOS test devices");oi.command("register").description("Register a connected iOS device or enter UDID manually").option("--udid <udid>","Device UDID (skip auto-detection)").option("--name <name>","Device name").action(async e=>{await _t("register",e)});oi.command("list").description("List all registered devices").action(async()=>{await _t("list",{})});oi.command("remove").description("Remove a registered device").option("--udid <udid>","Device UDID to remove").action(async e=>{await _t("remove",e)});W.command("audit").description("Run automated security audit on the project or APK").option("--apk <path>","Path to APK file (runs APK diagnostics like 16KB alignment)").option("--json","Output results as JSON (for CI/CD)").option("--fix","Auto-apply fixes where possible").option("--category <name>","Run only a specific check category (e.g. 16kb, permissions, secrets)").option("--severity <level>","Minimum severity to display (critical, high, medium, low, info)").option("--prebuild","Run expo prebuild for deeper manifest/plist analysis").action(async e=>{de(oe.bgCyan.black(p.cliTag(e.apk?"APK Audit":"Security Audit"))),await Rn(e)});var ts=new Set(["login"]);W.hook("preAction",(e,n)=>{let t=n.name();ts.has(t)||si()});W.on("command:*",()=>{console.error(`Invalid command: %s
+`));for(let s of a)X.error(Y.red(`${Y.bold(s.name)} ${Y.dim(`(${s.arch})`)}`)),X.info(Y.dim(`  PT_LOAD alignment: 2**${Math.log2(s.align)} (${s.align} bytes, needs 2**14 = ${$n})`))}return c.length>0&&(console.log(""),X.success(Y.green(`${c.length} librar${c.length===1?"y":"ies"} correctly aligned (2**14 or higher).`))),console.log(""),a.length===0?(X.success(Y.green.bold("ELF Verification Successful. APK is 16KB compatible.")),!0):(X.error(Y.red.bold(`Found ${a.length} unaligned lib${a.length===1?"":"s"} (arm64-v8a/x86_64 libs need to be aligned).`)),console.log(""),X.info(Y.yellow("To fix this:")),X.info(Y.dim("  1. Rebuild with NDK r28+ which defaults to 16KB page alignment")),X.info(Y.dim("  2. Or set -DANDROID_SUPPORT_FLEXIBLE_PAGE_SIZES=ON in CMake")),X.info(Y.dim("  3. Update third-party libraries that ship prebuilt .so files")),X.info(Y.dim("  4. After rebuilding: zipalign -p -f -v 16 input.apk output.apk")),console.log(""),X.info(Y.dim("Reference: https://developer.android.com/guide/practices/page-sizes")),!1)}catch(o){return t.stop("Analysis failed."),X.error(Y.red(`Failed to analyze APK: ${o.message}`)),!1}finally{try{Oe.rmSync(i,{recursive:!0,force:!0})}catch{}}}function Br(e){let n=Oe.openSync(e,"r");try{let t=Buffer.alloc(64);if(Oe.readSync(n,t,0,64,0),!t.subarray(0,4).equals(Gr))return null;let i=t[4]===2,o=t[5]===1,r=(f,y)=>o?f.readUInt16LE(y):f.readUInt16BE(y),a=(f,y)=>o?f.readUInt32LE(y):f.readUInt32BE(y),c=(f,y)=>Number(o?f.readBigUInt64LE(y):f.readBigUInt64BE(y)),s,l,d;i?(s=c(t,32),l=r(t,54),d=r(t,56)):(s=a(t,28),l=r(t,42),d=r(t,44));let u=null;for(let f=0;f<d;f++){let y=Buffer.alloc(l);if(Oe.readSync(n,y,0,l,s+f*l),a(y,0)!==Hr)continue;let g;i?g=c(y,48):g=a(y,28),g>0&&(u===null||g<u)&&(u=g)}return u??0}catch{return null}finally{Oe.closeSync(n)}}function Dn(e){let n=[];if(!Oe.existsSync(e))return n;let t=Oe.readdirSync(e,{withFileTypes:!0});for(let i of t){let o=Ye.join(e,i.name);i.isDirectory()?n.push(...Dn(o)):i.name.endsWith(".so")&&n.push(o)}return n}function jr(e){return e.includes("arm64-v8a")?"arm64-v8a":e.includes("x86_64")?"x86_64":"unknown"}var Rn=async e=>{if(ue()||(ye.error($e.red(`You are not logged in. Run \`${p.nameLower} login\` first.`)),process.exit(1)),e.apk){await Wr(e);return}let t=process.cwd(),i=xt.join(t,"package.json");mt.existsSync(i)||(ye.error($e.red("No package.json found. Run this command from a project root.")),process.exit(1));let o=JSON.parse(mt.readFileSync(i,"utf-8")),r=!!(o.dependencies?.expo||o.devDependencies?.expo);e.json||(ye.info($e.dim(`Project: ${o.name||"unknown"} v${o.version||"0.0.0"}`)),ye.info($e.dim(`Type: ${r?"Expo":"Bare React Native"}`)),ye.info(""));let a={json:e.json,fix:e.fix,category:e.category,severity:e.severity,prebuild:e.prebuild},c=await In(t,a);e.json?console.log(JSON.stringify(Pn(c,o),null,2)):bn(c,e.severity);let s=c.some(d=>d.findings.some(u=>u.severity==="critical")),l=c.some(d=>d.findings.some(u=>u.severity==="high"));(s||l)&&process.exit(1)},wn=["16kb"];async function Wr(e){let n=e.category?.toLowerCase();n&&!wn.includes(n)&&(ye.error($e.red(`Unknown APK check category: "${n}"`)),ye.info($e.dim(`Available APK checks: ${wn.join(", ")}`)),process.exit(1));let t=await Vr(e.apk);t||process.exit(1);let i=!n,o=!1;(i||n==="16kb")&&(await _n(t)||(o=!0)),o&&process.exit(1)}async function Vr(e){if(e.startsWith("build:")){let t=e.slice(6);return await Yr(t)}if(e.startsWith("http://")||e.startsWith("https://"))return await Cn(e);let n=xt.resolve(e);return mt.existsSync(n)?n:(ye.error($e.red(`APK file not found: ${n}`)),null)}async function Yr(e){let n=vn();n.start(`Fetching APK from build ${e}...`);try{let t=await _.get(`/build/${e}`);if(t.data.status!=="success")throw new Error(t.data.message);let i=t.data.build;if(!i)throw new Error("Build not found");let o=i.artifacts?.find(r=>r.type?r.type==="apk":r.name?.endsWith(".apk")||r.url?.includes(".apk"));return!o||!o.url?(n.stop("No APK artifact found"),ye.error($e.red("This build does not have an APK artifact.")),ye.info($e.dim("Make sure the build produced an APK (not just an AAB).")),null):(n.stop(`Found build: ${i.buildId||e}`),await Cn(o.url))}catch(t){return n.stop("Failed to fetch build"),ye.error($e.red(t.message)),null}}async function Cn(e){let n=vn();n.start("Downloading APK...");try{let t=mt.mkdtempSync(xt.join(Kr.tmpdir(),`${p.nameLower}-audit-`)),i=xt.join(t,"app.apk"),o=await zr.get(e,{responseType:"arraybuffer"});mt.writeFileSync(i,o.data);let r=(o.data.length/(1024*1024)).toFixed(1);return n.stop(`Downloaded APK (${r} MB)`),i}catch(t){return n.stop("Download failed"),ye.error($e.red(`Failed to download APK: ${t.message}`)),null}}var Xr=console.log;console.log=()=>{};qr();console.log=Xr;de(oe.bgCyan.black(p.cliTag("Production Build Orchestrator")));var Qr=Zr(import.meta.url),es=Qr("../package.json"),W=new Jr;W.name(p.nameLower).description(`${p.name} CLI: Powerful Cloud Infrastructure Tools`).version(es.version).option("-y, --yes","Automatically answer yes to all prompts",!1).option("--quiet","Suppress non-essential output",!1);W.command("agent").description("Start local device discovery agent for the Install Hub (port 7070)").action(async()=>{await Ri()});W.command("host").description("Setup AWS S3 static hosting and CloudFront").action(async()=>{de(oe.bgCyan.black(p.cliTag("Hosting"))),await di()});W.command("sitemap").description("Generate sitemap.xml from Expo Router app structure").option("-o, --output <path>","Output path for sitemap.xml","./public/sitemap.xml").action(async e=>{de(oe.bgCyan.black(p.cliTag("Sitemap Generator"))),await mi(e)});W.command("build").description("Run a build on a cloud provider (AWS Spot Instances)").argument("[platform]","Target platform (android, ios)").option("--platform <os>","Target platform alias (android, ios) [Optional]").option("--repo <url>","Git Repository URL").option("--branch <name>","Git Branch").option("--ami <id>","AMI ID").option("--bucket <name>","S3 Bucket for artifacts").option("--region <region>","AWS Region").option("--aws-profile <name>","AWS Credentials Profile").option("-p, --build-profile <name>","Build Profile (e.g. production, staging)","production").option("--profile <name>","Build Profile (alias for --build-profile)").option("--dry-run","Generate User Data script without launching").option("--keep-instance","Do not terminate the instance after build").option("--subnet <id>","VPC Subnet ID to launch the instance in").option("--security-group <id>","VPC Security Group ID to use").option("--ssh-host <host>","Remote host for iOS build (SSH)").option("--ssh-user <user>","SSH username for remote host").option("--ssh-key <path>","Path to private SSH key for remote host").option("--ios-scheme <scheme>","iOS Scheme to build").option("--ios-team-id <id>","Apple Development Team ID").option("--ios-configuration <config>","Xcode configuration (Release/Debug)").option("--ios-export-method <method>","Export method (ad-hoc, app-store, development, enterprise)").option("--ios-api-key-id <id>","App Store Connect API Key ID").option("--ios-api-key-issuer <id>","App Store Connect API Key Issuer ID").option("--ios-api-key-path <path>","Path to App Store Connect API Key (.p8) file").option("--simulator","Build for iOS Simulator (no signing required)").addOption(new On("--build-id <id>","Internal build ID").hideHelp()).addOption(new On("--project-id <id>","Internal project ID").hideHelp()).option("--local","Run build on local machine").option("--auto-version","Automatically fetch and increment versionCode from Google Play").option("--verbose","Enable verbose logging").option("-y, --yes","Automatically answer yes to all prompts",!1).option("--quiet","Suppress non-essential output",!1).action(async(e,n)=>{let t=W.opts();n.yes=n.yes||t.yes,n.quiet=n.quiet||t.quiet,n.platform=e||n.platform,n.buildProfile=n.profile||n.buildProfile,n.quiet||de(oe.bgCyan.black(p.cliTag("Cloud Build"))),await At(n)});W.command("update").description("Deploy an Over-The-Air (OTA) update to your live channel").option("--branch <name>","Channel or Branch to deploy to (e.g., production)","production").action(async e=>{de(oe.bgCyan.black(p.cliTag("OTA Update"))),await ji(e)});W.command("submit").description("Automated Store Submission (App Store / Google Play)").option("--platform <os>","Target platform (ios/android)").option("--track <track>","Google Play Track (internal, alpha, beta, production)","internal").option("--latest","Use the latest successful build for submission").option("--build-id <id>","Use a specific build ID for submission").action(async e=>{de(oe.bgCyan.black(p.cliTag("Store Submission"))),await Gi(e)});W.command("login").description(`Login to ${p.name} Dashboard`).action(async()=>{de(oe.bgCyan.black(p.cliTag("Login"))),await ki()});W.command("link").description(`Link local directory to a ${p.name} Project`).action(async()=>{de(oe.bgCyan.black(p.cliTag("Link Project"))),await Ni()});W.command("me").description("Display currently logged in user details").action(async()=>{await zi()});W.command("init").description(`Create a new ${p.name} Project`).action(async()=>{de(oe.bgCyan.black(p.cliTag("Init Project"))),await xi()});W.command("env").description("Manage Environment Variables").argument("<action>","Action to perform: set or list").argument("[args...]","Key=Value pairs for set action").action(async(e,n)=>{de(oe.bgCyan.black(p.cliTag("Env Manager"))),await Mi(e,n)});W.command("start").description("Start the development server (Metro)").option("-p, --build-profile <name>","Build profile (e.g. development, staging)","development").option("--tunnel","Use ngrok tunnel").option("--lan","Use LAN IP").option("--localhost","Use localhost").option("-c, --clear","Clear Metro cache").option("--port <number>","Port to listen on").option("--ios","Start on iOS").option("--android","Start on Android").option("--web","Start on Web").action(async e=>{de(oe.bgCyan.black(p.cliTag("Dev Server"))),await Ji(e)});W.command("config").description("Show resolved configuration for a profile").option("-p, --profile <name>","Build profile to resolve","development").option("--json","Output as JSON").action(async e=>{await qi(e)});W.command("credentials").description("Unified, interactive credential management (iOS/Android)").option("-p, --profile <name>","Build profile (production, staging, development)").option("--force","Force recreate certificates (nuke existing on Apple Portal)",!1).action(async e=>{let{credentialsMainCommand:n}=await import("./credentials-WL7JKLF4.js");await n(e)});W.command("credentials:setup").description("Automated credential provisioning (iOS/Android) [Legacy]").requiredOption("--platform <os>","Platform: ios or android").option("--profile <name>","Build profile (production, staging, development)").option("--bundle-id <id>","Bundle ID / Package Name (optional, auto-detected)").option("--team-id <id>","Apple Team ID (iOS only)").option("--key-alias <alias>","Android keystore alias (optional, auto-generated)").option("--aws-profile <name>","AWS Credentials Profile (for S3 storage)").option("--force","Force recreate certificates (nuke existing on Apple Portal)",!1).action(async e=>{de(oe.bgCyan.black(p.cliTag("Credentials Setup"))),await qe(e),Tn(oe.green("Done!"))});W.command("credentials:service").description("Upload Service Credentials (ASC API Key / Google Service JSON) [Legacy]").requiredOption("--platform <os>","Platform: ios or android").option("--file <path>","Path to credential file (.p8 or .json)").option("--issuer-id <id>","ASC API Key Issuer ID (iOS only)").option("--key-id <id>","ASC API Key ID (iOS only)").action(async e=>{de(oe.bgCyan.black(p.cliTag("Service Credentials"))),await ci(e),Tn(oe.green("Done!"))});var oi=W.command("device").description("Manage registered iOS test devices");oi.command("register").description("Register a connected iOS device or enter UDID manually").option("--udid <udid>","Device UDID (skip auto-detection)").option("--name <name>","Device name").action(async e=>{await _t("register",e)});oi.command("list").description("List all registered devices").action(async()=>{await _t("list",{})});oi.command("remove").description("Remove a registered device").option("--udid <udid>","Device UDID to remove").action(async e=>{await _t("remove",e)});W.command("audit").description("Run automated security audit on the project or APK").option("--apk <path>","Path to APK file (runs APK diagnostics like 16KB alignment)").option("--json","Output results as JSON (for CI/CD)").option("--fix","Auto-apply fixes where possible").option("--category <name>","Run only a specific check category (e.g. 16kb, permissions, secrets)").option("--severity <level>","Minimum severity to display (critical, high, medium, low, info)").option("--prebuild","Run expo prebuild for deeper manifest/plist analysis").action(async e=>{de(oe.bgCyan.black(p.cliTag(e.apk?"APK Audit":"Security Audit"))),await Rn(e)});var ts=new Set(["login"]);W.hook("preAction",(e,n)=>{let t=n.name();ts.has(t)||si()});W.on("command:*",()=>{console.error(`Invalid command: %s
 See --help for a list of available commands.`,W.args.join(" ")),process.exit(1)});process.argv.slice(2).length||W.help();W.parse(process.argv);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@radhya/mach",
-  "version": "1.4.11",
+  "version": "1.4.13",
   "description": "Mach CLI: Cloud Build Orchestrator for React Native & Expo",
   "main": "dist/index.js",
   "type": "module",

package/dist/chunk-OQOE4CWV.js

@@ -1,55 +0,0 @@
-import{a as g,g as v}from"./chunk-YZYFEHP5.js";import{log as t,spinner as z,text as J,password as pe,select as O,confirm as Ze,isCancel as w,cancel as G,intro as Ve,outro as Ee,note as Ce}from"@clack/prompts";import{log as Z,spinner as ee,text as P,select as ne,isCancel as _,cancel as K,note as se,confirm as Se}from"@clack/prompts";import E from"chalk";import{spawnSync as q}from"child_process";import V from"fs";import X from"path";import ce from"os";var be="cmVxdWlyZSAnc3BhY2VzaGlwJwpyZXF1aXJlICdqc29uJwoKZGVmIGxpc3Rfa2V5cwogIGJlZ2luCiAgICBTcGFjZXNoaXA6OlBvcnRhbC5sb2dpbihFTlZbJ0ZBU1RMQU5FX1VTRVInXSkKICAgIFNwYWNlc2hpcDo6UG9ydGFsLnNlbGVjdF90ZWFtKHRlYW1faWQ6IEVOVlsnRkFTVExBTkVfVEVBTV9JRCddKQogICAgCiAgICAjIExvZ2luIHRvIFR1bmVzIChBcHAgU3RvcmUgQ29ubmVjdCkgYW5kIHNlbGVjdCB0aGUgc2FtZSB0ZWFtCiAgICBTcGFjZXNoaXA6OlR1bmVzLmxvZ2luKEVOVlsnRkFTVExBTkVfVVNFUiddKQogICAgU3BhY2VzaGlwOjpUdW5lcy5zZWxlY3RfdGVhbSh0ZWFtX2lkOiBFTlZbJ0ZBU1RMQU5FX1RFQU1fSUQnXSkKICAgIAogICAgIyBVc2UgVHVuZXMgY2xpZW50IHdoaWNoIHBvaW50cyB0byBhcHBzdG9yZWNvbm5lY3QuYXBwbGUuY29tCiAgICBjbGllbnQgPSBTcGFjZXNoaXA6OlR1bmVzLmNsaWVudAogICAgIyBVc2Ugcm9vdC1yZWxhdGl2ZSBVUkwgdG8gcmVwbGFjZSB0aGUgZGVmYXVsdCBUdW5lcyBwYXRoICgvV2ViT2JqZWN0cy8uLi4pCiAgICByZXNwb25zZSA9IGNsaWVudC5yZXF1ZXN0KDpnZXQsICcvaXJpcy92MS9hcGlLZXlzJykKICAgIAogICAgaWYgcmVzcG9uc2UuYm9keS5uaWw/IHx8ICFyZXNwb25zZS5ib2R5LmlzX2E/KEhhc2gpCiAgICAgIHJhaXNlICJBUEkgcmV0dXJuZWQgZW1wdHkgb3IgaW52YWxpZCByZXNwb25zZSBib2R5IGZvciBsaXN0aW5nIGtleXMiCiAgICBlbmQKICAgIAogICAgJHN0ZGVyci5wdXRzICJERUJVRzogRnVsbCBMaXN0IFJlc3BvbnNlOiAje3Jlc3BvbnNlLmJvZHkudG9fanNvbn0iCiAgICAKICAgIGtleXMgPSByZXNwb25zZS5ib2R5WydkYXRhJ10gfHwgW10KICAgIAogICAgb3V0cHV0ID0ga2V5cy5tYXAgZG8gfGt8CiAgICAgIGF0dHIgPSBrWydhdHRyaWJ1dGVzJ10gfHwge30KICAgICAgewogICAgICAgIGlkOiBrWydpZCddLAogICAgICAgIG5hbWU6IGF0dHJbJ25hbWUnXSwKICAgICAgICBpc3N1ZXJJZDogYXR0clsnaXNzdWVySWQnXSwKICAgICAgICByb2xlOiBhdHRyWydyb2xlcyddJi5maXJzdCwKICAgICAgICByZXZvY2FibGU6IGF0dHJbJ3Jldm9jYWJsZSddCiAgICAgIH0KICAgIGVuZAogICAgCiAgICBwdXRzICJfX19NQUNIX0pTT05fU1RBUlRfX18iICsgb3V0cHV0LnRvX2pzb24gKyAiX19fTUFDSF9KU09OX0VORF9fXyIKICByZXNjdWUgPT4gZQogICAgJHN0ZGVyci5wdXRzICJFUlJPUjogI3tlLm1lc3NhZ2V9IgogICAgaWYgZGVmaW5lZD8ocmVzcG9uc2UpICYmIHJlc3BvbnNlICYmIHJlc3BvbnNlLmJvZHkKICAgICAgJHN0ZGVyci5wdXRzICJSZXNwb25zZSBCb2R5OiAje3Jlc3BvbnNlLmJvZHkudG9fanNvbn0iCiAgICBlbmQKICAgIGV4aXQgMQogIGVuZAplbmQKCmRlZiBjcmVhdGVfa2V5KG5hbWUsIHJvbGUgPSAnQURNSU4nKQogIGJlZ2luCiAgICBTcGFjZXNoaXA6OlBvcnRhbC5sb2dpbihFTlZbJ0ZBU1RMQU5FX1VTRVInXSkKICAgIFNwYWNlc2hpcDo6UG9ydGFsLnNlbGVjdF90ZWFtKHRlYW1faWQ6IEVOVlsnRkFTVExBTkVfVEVBTV9JRCddKQogICAgCiAgICBTcGFjZXNoaXA6OlR1bmVzLmxvZ2luKEVOVlsnRkFTVExBTkVfVVNFUiddKQogICAgU3BhY2VzaGlwOjpUdW5lcy5zZWxlY3RfdGVhbSh0ZWFtX2lkOiBFTlZbJ0ZBU1RMQU5FX1RFQU1fSUQnXSkKICAgIAogICAgY2xpZW50ID0gU3BhY2VzaGlwOjpUdW5lcy5jbGllbnQKICAgIAogICAgIyBUcnVuY2F0ZSBuaWNrbmFtZSB0byAzMCBjaGFycyBhcyBwZXIgQXBwbGUncyBsaW1pdAogICAgIyBXZSBrZWVwIHRoZSBvcmlnaW5hbCAnbmFtZScgZm9yIGxvZ2dpbmcgYnV0IHNlbmQgdHJ1bmNhdGVkICduaWNrbmFtZScgdG8gQVBJCiAgICBzYWZlX25pY2tuYW1lID0gbmFtZVswLCAzMF0KICAgIAogICAgcGF5bG9hZCA9IHsKICAgICAgZGF0YTogewogICAgICAgIHR5cGU6ICJhcGlLZXlzIiwKICAgICAgICBhdHRyaWJ1dGVzOiB7CiAgICAgICAgICBuaWNrbmFtZTogc2FmZV9uaWNrbmFtZSwKICAgICAgICAgIGtleVR5cGU6ICJQVUJMSUNfQVBJIiwKICAgICAgICAgIHJvbGVzOiBbcm9sZV0sCiAgICAgICAgICBhbGxBcHBzVmlzaWJsZTogdHJ1ZQogICAgICAgIH0KICAgICAgfQogICAgfQogICAgCiAgICByZXNwb25zZSA9IGNsaWVudC5yZXF1ZXN0KDpwb3N0KSBkbyB8cmVxfAogICAgICByZXEudXJsICIvaXJpcy92MS9hcGlLZXlzIgogICAgICByZXEuYm9keSA9IHBheWxvYWQudG9fanNvbgogICAgICByZXEuaGVhZGVyc1snQ29udGVudC1UeXBlJ10gPSAnYXBwbGljYXRpb24vanNvbicKICAgICAgcmVxLmhlYWRlcnNbJ0FjY2VwdCddID0gJ2FwcGxpY2F0aW9uL3ZuZC5hcGkranNvbiwgYXBwbGljYXRpb24vanNvbiwgdGV4dC9qYXZhc2NyaXB0LCAqLyo7IHE9MC4wMScKICAgICAgcmVxLmhlYWRlcnNbJ1gtUmVxdWVzdGVkLVdpdGgnXSA9ICdYTUxIdHRwUmVxdWVzdCcKICAgICAgcmVxLmhlYWRlcnNbJ1JlZmVyZXInXSA9ICdodHRwczovL2FwcHN0b3JlY29ubmVjdC5hcHBsZS5jb20vYWNjZXNzL2FwaScKICAgICAgcmVxLmhlYWRlcnNbJ1gtQXBwbGUtV2lkZ2V0LUtleSddID0gY2xpZW50LndpZGdldF9rZXkgaWYgY2xpZW50LnJlc3BvbmRfdG8/KDp3aWRnZXRfa2V5KQogICAgZW5kCiAgICAKICAgICMgREVCVUc6IEluc3BlY3QgdGhlIHJhdyByZXNwb25zZSBvYmplY3QKICAgICRzdGRlcnIucHV0cyAiREVCVUc6IFJlc3BvbnNlIENsYXNzOiAje3Jlc3BvbnNlLmNsYXNzfSIKICAgICRzdGRlcnIucHV0cyAiREVCVUc6IFJlc3BvbnNlIEhlYWRlcnM6ICN7cmVzcG9uc2UuaGVhZGVyc30iCiAgICAkc3RkZXJyLnB1dHMgIkRFQlVHOiBSZXNwb25zZSBCb2R5OiAje3Jlc3BvbnNlLmJvZHkudG9fanNvbn0iCiAgICAKICAgIGlmIHJlc3BvbnNlLmJvZHkubmlsPyB8fCAhcmVzcG9uc2UuYm9keS5pc19hPyhIYXNoKSB8fCByZXNwb25zZS5ib2R5WydkYXRhJ10ubmlsPwogICAgICBlcnJvcl9tc2cgPSAiQVBJIGZhaWxlZCB0byBjcmVhdGUga2V5LiIKICAgICAgaWYgcmVzcG9uc2UuYm9keSAmJiByZXNwb25zZS5ib2R5WydlcnJvcnMnXQogICAgICAgIGVycm9yX21zZyArPSAiIEVycm9yczogIiArIHJlc3BvbnNlLmJvZHlbJ2Vycm9ycyddLm1hcHt8ZXwgZVsnZGV0YWlsJ119LmpvaW4oJywgJykKICAgICAgZW5kCiAgICAgIHJhaXNlIGVycm9yX21zZwogICAgZW5kCiAgICAKICAgIGtleV9kYXRhID0gcmVzcG9uc2UuYm9keVsnZGF0YSddCiAgICBhdHRyID0ga2V5X2RhdGFbJ2F0dHJpYnV0ZXMnXSB8fCB7fQoKICAgICMgVGhlIC5wOCBjb250ZW50IGlzIHVzdWFsbHkgaW4gJ3ByaXZhdGVLZXknIG9yICdrZXlDb250ZW50JyBvbiB0aGUgSU5JVElBTCBDUkVBVEUgcmVzcG9uc2UKICAgIHA4X2NvbnRlbnQgPSBhdHRyWydwcml2YXRlS2V5J10gfHwgYXR0clsna2V5Q29udGVudCddCiAgICAKICAgIGlmIHA4X2NvbnRlbnQubmlsPwogICAgICAkc3RkZXJyLnB1dHMgIkRFQlVHOiBLZXkgY29udGVudCBtaXNzaW5nIGluIHJlc3BvbnNlLiBBdHRlbXB0aW5nIHJldHJpZXZhbCB2aWEgZG93bmxvYWQvZXhwb3J0IGVuZHBvaW50cy4uLiIgCiAgICAgIAogICAgICBwYXRoc190b190cnkgPSBbCiAgICAgICAgImh0dHBzOi8vYXBwc3RvcmVjb25uZWN0LmFwcGxlLmNvbS9pcmlzL3YxL2FwaUtleXMvI3trZXlfZGF0YVsnaWQnXX0vZG93bmxvYWQiLAogICAgICAgICJodHRwczovL2FwcHN0b3JlY29ubmVjdC5hcHBsZS5jb20vaXJpcy92MS9hcGlLZXlzLyN7a2V5X2RhdGFbJ2lkJ119L2V4cG9ydCIKICAgICAgXQogICAgICAKICAgICAgcGF0aHNfdG9fdHJ5LmVhY2ggZG8gfHBhdGh8CiAgICAgICAgYmVnaW4KICAgICAgICAgICRzdGRlcnIucHV0cyAiREVCVUc6IFRyeWluZyAje3BhdGh9Li4uIgogICAgICAgICAgZG93bmxvYWRfcmVzcCA9IGNsaWVudC5yZXF1ZXN0KDpnZXQpIGRvIHxyZXF8CiAgICAgICAgICAgIHJlcS51cmwgcGF0aAogICAgICAgICAgICByZXEuaGVhZGVyc1snQWNjZXB0J10gPSAnYXBwbGljYXRpb24vdm5kLmFwaStqc29uLCBhcHBsaWNhdGlvbi9qc29uLCB0ZXh0L2phdmFzY3JpcHQsICovKjsgcT0wLjAxJwogICAgICAgICAgICByZXEuaGVhZGVyc1snWC1SZXF1ZXN0ZWQtV2l0aCddID0gJ1hNTEh0dHBSZXF1ZXN0JwogICAgICAgICAgICByZXEuaGVhZGVyc1snUmVmZXJlciddID0gJ2h0dHBzOi8vYXBwc3RvcmVjb25uZWN0LmFwcGxlLmNvbS9hY2Nlc3MvYXBpJwogICAgICAgICAgZW5kCiAgICAgICAgICAkc3RkZXJyLnB1dHMgIkRFQlVHOiBSZXNwb25zZSBDbGFzczogI3tkb3dubG9hZF9yZXNwLmJvZHkuY2xhc3N9IgogICAgICAgICAgJHN0ZGVyci5wdXRzICJERUJVRzogUmVzcG9uc2UgU3RhdHVzOiAje2Rvd25sb2FkX3Jlc3Auc3RhdHVzfSIgaWYgZG93bmxvYWRfcmVzcC5yZXNwb25kX3RvPyg6c3RhdHVzKQogICAgICAgICAgCiAgICAgICAgICBpZiBkb3dubG9hZF9yZXNwLmJvZHkgJiYgIWRvd25sb2FkX3Jlc3AuYm9keS50b19zLmluY2x1ZGU/KCciZXJyb3JzIj0+JykKICAgICAgICAgICAgIGlmIGRvd25sb2FkX3Jlc3AuYm9keS5pc19hPyhIYXNoKQogICAgICAgICAgICAgICBwOF9jb250ZW50ID0gZG93bmxvYWRfcmVzcC5ib2R5WydrZXlDb250ZW50J10gfHwgZG93bmxvYWRfcmVzcC5ib2R5Wydjb250ZW50J10gfHwgZG93bmxvYWRfcmVzcC5ib2R5LmRpZygnZGF0YScsICdhdHRyaWJ1dGVzJywgJ3ByaXZhdGVLZXknKQogICAgICAgICAgICAgZWxzZQogICAgICAgICAgICAgICBwOF9jb250ZW50ID0gZG93bmxvYWRfcmVzcC5ib2R5CiAgICAgICAgICAgICBlbmQKICAgICAgICAgICAgIAogICAgICAgICAgICAgaWYgcDhfY29udGVudCAmJiBwOF9jb250ZW50LnRvX3Muc3RhcnRfd2l0aD8oJy0tLS0tQkVHSU4nKQogICAgICAgICAgICAgICAkc3RkZXJyLnB1dHMgIkRFQlVHOiBSZXRyaWV2YWwgdmlhICN7cGF0aH0gc3VjY2Vzc2Z1bCEgQ29udGVudCBsZW5ndGg6ICN7cDhfY29udGVudC50b19zLmxlbmd0aH0iCiAgICAgICAgICAgICAgIGJyZWFrCiAgICAgICAgICAgICBlbHNlCiAgICAgICAgICAgICAgICRzdGRlcnIucHV0cyAiREVCVUc6IFJlc3BvbnNlIGZyb20gI3twYXRofSBkaWQgbm90IGNvbnRhaW4gYSB2YWxpZCBwcml2YXRlIGtleS4iCiAgICAgICAgICAgICAgIHA4X2NvbnRlbnQgPSBuaWwKICAgICAgICAgICAgIGVuZAogICAgICAgICAgZWxzZQogICAgICAgICAgICAgJHN0ZGVyci5wdXRzICJERUJVRzogUmVzcG9uc2UgZnJvbSAje3BhdGh9IGVtcHR5IG9yIGNvbnRhaW5zIGVycm9ycy4iCiAgICAgICAgICBlbmQKICAgICAgICByZXNjdWUgPT4gZQogICAgICAgICAgJHN0ZGVyci5wdXRzICJERUJVRzogQXR0ZW1wdCBmb3IgI3twYXRofSBmYWlsZWQ6ICN7ZS5tZXNzYWdlfSIKICAgICAgICBlbmQKICAgICAgZW5kCiAgICBlbmQKCiAgICAjIEZJTkFMIFZBTElEQVRJT046IEVuc3VyZSBpdCdzIG5vdCBhIFJ1YnkgaGFzaCBzdHJpbmcgcmVwcmVzZW50YXRpb24gb3IgZXJyb3IKICAgIGlmIHA4X2NvbnRlbnQuaXNfYT8oSGFzaCkgfHwgcDhfY29udGVudC50b19zLmluY2x1ZGU/KCciZXJyb3JzIj0+JykgfHwgIXA4X2NvbnRlbnQudG9fcy5zdGFydF93aXRoPygnLS0tLS1CRUdJTicpCiAgICAgICRzdGRlcnIucHV0cyAiREVCVUc6IEludmFsaWQga2V5IGNvbnRlbnQgZGV0ZWN0ZWQuIgogICAgICBwOF9jb250ZW50ID0gbmlsCiAgICBlbmQKCiAgICBpZiBwOF9jb250ZW50Lm5pbD8KICAgICAgJHN0ZGVyci5wdXRzICJERUJVRzogRmFpbGVkIHRvIHJldHJpZXZlIGtleSBjb250ZW50LiIKICAgIGVuZAogICAgCiAgICByZXN1bHQgPSB7CiAgICAgIGlkOiBrZXlfZGF0YVsnaWQnXSwKICAgICAgbmFtZTogYXR0clsnbmlja25hbWUnXSB8fCBhdHRyWyduYW1lJ10sCiAgICAgIGlzc3VlcklkOiBhdHRyWydpc3N1ZXJJZCddLAogICAgICBrZXlDb250ZW50OiBwOF9jb250ZW50LAogICAgICByYXdfcmVzcG9uc2U6IHJlc3BvbnNlLmJvZHkgIyBJbmNsdWRlIHRoaXMgZm9yIGRlYnVnZ2luZyB3aGVuIGtleUNvbnRlbnQgaXMgbmlsCiAgICB9CiAgICAKICAgIHB1dHMgIl9fX01BQ0hfSlNPTl9TVEFSVF9fXyIgKyByZXN1bHQudG9fanNvbiArICJfX19NQUNIX0pTT05fRU5EX19fIgogIHJlc2N1ZSA9PiBlCiAgICAkc3RkZXJyLnB1dHMgIkVSUk9SOiAje2UubWVzc2FnZX0iCiAgICBpZiBkZWZpbmVkPyhyZXNwb25zZSkgJiYgcmVzcG9uc2UgJiYgcmVzcG9uc2UuYm9keQogICAgICAgJHN0ZGVyci5wdXRzICJSZXNwb25zZSBCb2R5OiAje3Jlc3BvbnNlLmJvZHkudG9fanNvbn0iCiAgICBlbmQKICAgIGV4aXQgMQogIGVuZAplbmQKCmRlZiBkZWxldGVfa2V5KGlkKQogIGJlZ2luCiAgICBTcGFjZXNoaXA6OlBvcnRhbC5sb2dpbihFTlZbJ0ZBU1RMQU5FX1VTRVInXSkKICAgIFNwYWNlc2hpcDo6UG9ydGFsLnNlbGVjdF90ZWFtKHRlYW1faWQ6IEVOVlsnRkFTVExBTkVfVEVBTV9JRCddKQogICAgCiAgICBTcGFjZXNoaXA6OlR1bmVzLmxvZ2luKEVOVlsnRkFTVExBTkVfVVNFUiddKQogICAgU3BhY2VzaGlwOjpUdW5lcy5zZWxlY3RfdGVhbSh0ZWFtX2lkOiBFTlZbJ0ZBU1RMQU5FX1RFQU1fSUQnXSkKICAgIAogICAgY2xpZW50ID0gU3BhY2VzaGlwOjpUdW5lcy5jbGllbnQKICAgIGNsaWVudC5yZXF1ZXN0KDpkZWxldGUsICIvaXJpcy92MS9hcGlLZXlzLyN7aWR9IikKICAgIHB1dHMgIlNVQ0NFU1MiCiAgcmVzY3VlID0+IGUKICAgICRzdGRlcnIucHV0cyAiRVJST1I6ICN7ZS5tZXNzYWdlfSIKICAgIGV4aXQgMQogIGVuZAplbmQKCmNvbW1hbmQgPSBBUkdWWzBdCmlmIGNvbW1hbmQgPT0gJ2xpc3QnCiAgbGlzdF9rZXlzCmVsc2lmIGNvbW1hbmQgPT0gJ2NyZWF0ZScKICBjcmVhdGVfa2V5KEFSR1ZbMV0gfHwgIk1hY2ggQVBJIEtleSAje1RpbWUubm93LnRvX2l9IikKZWxzaWYgY29tbWFuZCA9PSAnZGVsZXRlJwogIGRlbGV0ZV9rZXkoQVJHVlsxXSkKZW5kCg==";function ae(){let a=X.join(ce.tmpdir(),g.nameLower);V.existsSync(a)||V.mkdirSync(a,{recursive:!0});let e=X.join(a,"manage_asc_keys.rb");return V.writeFileSync(e,Buffer.from(be,"base64").toString("utf-8"),{mode:493}),e}function re(){return{...process.env,PATH:`/usr/local/opt/ruby/bin:/usr/local/Cellar/fastlane/2.227.0/libexec/bin:${process.env.HOME}/.local/share/fastlane/3.4.0/bin:${process.env.PATH}`,GEM_HOME:process.env.FASTLANE_GEM_HOME||`${process.env.HOME}/.local/share/fastlane/3.4.0`,GEM_PATH:(process.env.FASTLANE_GEM_HOME||`${process.env.HOME}/.local/share/fastlane/3.4.0`)+":/usr/local/Cellar/fastlane/2.227.0/libexec",FASTLANE_INSTALLED_VIA_HOMEBREW:"true",CI:"1"}}var ue=async a=>{let e=ee(),r=a.platform,l=`./${g.configFileName}`;if(!V.existsSync(l)){Z.error(`No ${g.configFileName} found. Run \`${g.nameLower} init\` or \`${g.nameLower} link\` first.`);return}let s=JSON.parse(V.readFileSync(l,"utf-8")),{projectId:c}=s;if(!c){Z.error(`${g.configFileName} is missing projectId.`);return}let i=a.file;if(r==="ios"&&!i){let d=await ne({message:"Manage App Store Connect API Key:",options:[{value:"magic",label:"\u2728 Create new automatically (EAS-Style)",hint:"Requires Apple ID + 2FA"},{value:"manual",label:"\u{1F50D} Configure manually",hint:"Provide existing .p8 file"},{value:"delete",label:"\u{1F5D1}\uFE0F  Delete an existing Key"}]});if(_(d)){K("Operation cancelled");return}if(d==="magic"){await we(c,s);return}if(d==="delete"){await ve(c,s);return}}if(!i){let d=r==="ios"?"https://appstoreconnect.apple.com/access/api":"https://console.cloud.google.com/apis/credentials";se(`To submit to the ${r==="ios"?"App Store":"Google Play Store"}, you need a Service Key:
-
-1. Open: ${E.cyan(d)}
-`+(r==="ios"?`2. Generate an "App Store Connect API Key" with ${E.bold("Admin")} role.
-3. Download the ${E.bold(".p8")} file.`:`2. Create a "Service Account", generate a ${E.bold("JSON")} key.
-3. Download the ${E.bold(".json")} file.`),"Guided Setup"),e.start("Scanning for downloaded keys...");let p=Re(r);if(e.stop(p.length>0?`Detected ${p.length} potential key(s)`:"No keys detected automatically"),p.length>0){let f=await ne({message:"Found these potential keys. Use one of them?",options:[...p.map(o=>({value:o.path,label:`${X.basename(o.path)} (${o.location})`})),{value:"manual",label:"Enter path manually..."}]});if(_(f)){K("Operation cancelled");return}f!=="manual"&&(i=f)}if(!i){let f=await P({message:`Paste the path to your ${r==="ios"?".p8":".json"} file:`,validate:o=>V.existsSync(o)?void 0:"File not found"});if(_(f)){K("Operation cancelled");return}i=f}}let u=a.issuerId,I=a.keyId;if(r==="ios"){if(!I&&i){let d=X.basename(i).match(/AuthKey_(.*)\.p8/);d&&(I=d[1],Z.info(`Auto-detected Key ID from filename: ${E.green(I)}`))}if(!u){let d=await P({message:"Enter App Store Connect Issuer ID (Found on the Keys page):",validate:p=>p.length>0?void 0:"Issuer ID is required"});if(_(d)){K("Operation cancelled");return}u=d}if(!I){let d=await P({message:"Enter App Store Connect Key ID:",validate:p=>p.length>0?void 0:"Key ID is required"});if(_(d)){K("Operation cancelled");return}I=d}}await oe(c,i,r,u,I)};async function we(a,e){let r=ee(),l=e.submit?.production?.ios?.appleId,s=e.submit?.production?.ios?.appleTeamId;if(!l){let u=await P({message:"Apple ID:",placeholder:"your-email@example.com"});if(_(u))return;l=u,e.submit||(e.submit={production:{ios:{}}}),e.submit.production||(e.submit.production={ios:{}}),e.submit.production.ios||(e.submit.production.ios={}),e.submit.production.ios.appleId=l,V.writeFileSync(`./${g.configFileName}`,JSON.stringify(e,null,2))}if(!s){let u=await P({message:"Apple Team ID:",placeholder:"e.g. 4523G95823"});if(_(u))return;s=u,e.submit||(e.submit={production:{ios:{}}}),e.submit.production||(e.submit.production={ios:{}}),e.submit.production.ios||(e.submit.production.ios={}),e.submit.production.ios.appleTeamId=s,V.writeFileSync(`./${g.configFileName}`,JSON.stringify(e,null,2))}let c=await P({message:"Enter a name for the new API Key:",initialValue:`[${g.name}] Project ${a}`});if(_(c))return;r.start("Authenticating with Apple and creating API Key...");let i=ae();if(!V.existsSync(i)){Z.error(`Magic Error: Helper script not found at ${i}`);return}try{let u=q("ruby",[i,"create",c],{env:{...re(),FASTLANE_USER:l,FASTLANE_TEAM_ID:s},stdio:["inherit","pipe","pipe"],encoding:"utf-8"}),I=u.stdout||"",d=u.stderr||"";if(d&&(d.includes("DEBUG:")||d.includes("ERROR:"))&&d.split(`
-`).forEach(m=>{m.trim()&&Z.info(E.dim(`[Ruby] ${m.trim()}`))}),u.status!==0){r.stop("Failed"),Z.error(`Magic creation failed: ${d}`);return}let p=I.match(new RegExp(`${g.jsonStartMarker}(.*)${g.jsonEndMarker}`));if(!p){r.stop("Parse Error"),Z.error("Could not parse response from Apple Portal.");return}let f=JSON.parse(p[1]),{id:o,issuerId:y,keyContent:C}=f;if(r.stop("Key Created Successfully"),Z.success(`\u2713 Created Key ID: ${E.green(o)}`),!y){se(`Your Issuer ID is shown at the top of:
-  ${E.cyan("https://appstoreconnect.apple.com/access/integrations/api")}
-
-It looks like: ${E.dim("xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx")}`,"One More Thing");let m=await P({message:"Enter your App Store Connect Issuer ID:",validate:N=>N.trim().length>0?void 0:"Issuer ID is required"});if(_(m)){K("Operation cancelled.");return}y=m.trim()}if(C){let m=X.join(ce.tmpdir(),`AuthKey_${o}.p8`);V.writeFileSync(m,C),await oe(a,m,"ios",y,o),V.unlinkSync(m)}else{Z.warn(E.yellow("\u26A0\uFE0F  Apple did not return the private key in the response.")),se(`Download the .p8 file manually:
-
-  1. Open: ${E.cyan("https://appstoreconnect.apple.com/access/integrations/api")}
-  2. Find Key ID: ${E.green(o)}
-  3. Click ${E.bold("Download API Key")} (only available once)
-  4. Drag & drop the downloaded .p8 file below`,"Manual Step Required");let m=await P({message:"Path to the downloaded .p8 file (drag & drop here):",validate:N=>V.existsSync(N)?void 0:"File not found"});if(_(m)){K("Operation cancelled. Credential ID was registered but key content is missing.");return}await oe(a,m,"ios",y,o)}}catch(u){r.stop("Error"),Z.error(`Error: ${u.message}`)}}async function ve(a,e){let r=ee(),l=e.submit?.production?.ios?.appleId,s=e.submit?.production?.ios?.appleTeamId;if(!l){let i=await P({message:"Apple ID:"});if(_(i))return;l=i,e.submit||(e.submit={production:{ios:{}}}),e.submit.production||(e.submit.production={ios:{}}),e.submit.production.ios||(e.submit.production.ios={}),e.submit.production.ios.appleId=l,V.writeFileSync(`./${g.configFileName}`,JSON.stringify(e,null,2))}if(!s){let i=await P({message:"Apple Team ID:"});if(_(i))return;s=i,e.submit||(e.submit={production:{ios:{}}}),e.submit.production||(e.submit.production={ios:{}}),e.submit.production.ios||(e.submit.production.ios={}),e.submit.production.ios.appleTeamId=s,V.writeFileSync(`./${g.configFileName}`,JSON.stringify(e,null,2))}r.start("Fetching existing API Keys...");let c=ae();if(!V.existsSync(c)){Z.error(`Magic Error: Helper script not found at ${c}`);return}try{let i=q("ruby",[c,"list"],{env:{...re(),FASTLANE_USER:l,FASTLANE_TEAM_ID:s},stdio:["inherit","pipe","pipe"],encoding:"utf-8"});if(i.status!==0){r.stop("Failed"),Z.error(`Listing failed: ${i.stderr}`);return}let u=i.stdout.match(new RegExp(`${g.jsonStartMarker}(.*)${g.jsonEndMarker}`));if(!u){r.stop("Parse Error");return}let I=JSON.parse(u[1]);if(r.stop(`Found ${I.length} keys`),I.length===0){Z.info("No API Keys found on this team.");return}let d=await ne({message:"Select a key to delete from Apple Developer Portal:",options:[...I.map(o=>({value:o.id,label:`ID: ${o.id} - ${o.name} (${o.role})`})),{value:"cancel",label:"Cancel"}]});if(_(d)||d==="cancel")return;let p=await Se({message:`Are you sure you want to delete Key ${d}? This cannot be undone.`});if(!p||_(p))return;r.start(`Deleting Key ${d}...`);let f=q("ruby",[ae(),"delete",d],{env:{...re(),FASTLANE_USER:l,FASTLANE_TEAM_ID:s},stdio:"pipe",encoding:"utf-8"});f.status===0?(r.stop("Deleted"),Z.success(`\u2713 Key ${d} has been removed from Apple Portal.`)):(r.stop("Deletion Failed"),Z.error(`Error: ${f.stderr}`))}catch(i){r.stop("Error"),Z.error(`Error: ${i.message}`)}}async function oe(a,e,r,l,s){let c=ee();c.start(`Uploading Service Credentials for ${r}...`);try{let i=r==="ios"?"asc_api_key":"google_service_account",u=new URL(import.meta.url),I=X.dirname(u.pathname),d=[X.join(I,"isolated-upload.js"),X.join(I,"commands","isolated-upload.js"),X.resolve(I,"../commands/isolated-upload.js"),X.resolve(process.cwd(),`node_modules/.bin/${g.nameLower}-upload`)],p="";for(let o of d)if(V.existsSync(o)){p=o;break}if(!p)throw new Error("Could not locate isolated-upload.js. Ensure the CLI is properly installed.");let f=q("node",[p,a,e,i,"*","service","undefined","undefined",l||"undefined",s||"undefined"],{stdio:"pipe",encoding:"utf-8",env:{...process.env,AT_CLI_ISOLATED:"1"}});if(f.status!==0){let o=f.stderr||f.stdout||"Unknown upload failure";c.stop("Upload Failed"),Z.error(E.red(`Upload Failed: ${o}`));return}f.stdout.includes("SUCCESS")?(c.stop("Upload Success"),Z.success(E.green(`\u2713 Service Credentials for ${r} uploaded successfully.`))):(c.stop("Upload Summary"),Z.warn(E.yellow(`Upload finished but success not confirmed: ${f.stdout}`)))}catch(i){c.stop("Upload Error"),Z.error(E.red(`Error: ${i.message}`))}}function Re(a){let e=a==="ios"?".p8":".json",r=[],l=[{path:"./",label:"Project Root"},{path:X.join(ce.homedir(),"Downloads"),label:"Downloads"}];for(let s of l)if(V.existsSync(s.path))try{let c=V.readdirSync(s.path);for(let i of c)if(i.endsWith(e)){if(a==="android"&&!V.readFileSync(X.join(s.path,i),"utf8").includes("service_account")||a==="ios"&&!i.startsWith("AuthKey"))continue;r.push({path:X.join(s.path,i),location:s.label})}}catch{}return r}import Ae from"axios";import n from"chalk";import{execSync as W,spawnSync as L}from"child_process";import le from"crypto";import A from"fs";import R from"path";import te from"os";Ae.defaults.proxy=!1;function de(a,e){if(!A.existsSync(a))return;let r=A.readdirSync(a);for(let l of r){let s=R.join(a,l);if(A.statSync(s).isDirectory()){let i=de(s,e);if(i)return i}else if(e.test(l))return s}}function Ne(a,e,r){let l=A.readFileSync(r,"utf8"),s=Math.floor(Date.now()/1e3),c=Buffer.from(JSON.stringify({alg:"ES256",kid:a,typ:"JWT"})).toString("base64url"),i=Buffer.from(JSON.stringify({iss:e,iat:s,exp:s+1200,aud:"appstoreconnect-v1"})).toString("base64url"),u=`${c}.${i}`,I=le.createSign("SHA256");I.update(u);let d=I.sign({key:l,dsaEncoding:"ieee-p1363"}).toString("base64url");return`${u}.${d}`}async function ke(a,e,r,l){let s=Ne(e,r,l),c=(await import("axios")).default;for(let i of a)try{await c.post("https://api.appstoreconnect.apple.com/v1/devices",{data:{type:"devices",attributes:{name:i.name,udid:i.udid,platform:"IOS"}}},{headers:{Authorization:`Bearer ${s}`,"Content-Type":"application/json"}}),t.info(n.dim(`  \u2713 Registered: ${i.name}`))}catch(u){let I=u.response?.data?.errors;I?.some(p=>p.code==="ENTITY_ERROR.ATTRIBUTE.INVALID.DUPLICATE"||p.detail?.toLowerCase().includes("already registered")||p.detail?.toLowerCase().includes("already exists"))?t.info(n.dim(`  Already on Portal: ${i.name}`)):t.warn(n.yellow(`  Could not register ${i.name}: ${I?.[0]?.detail||u.message}`))}}var fe=async a=>{Ve(n.bgCyan.black(g.cliTag("Credentials")));let e=await O({message:"Select platform:",options:[{value:"ios",label:"iOS"},{value:"android",label:"Android"}]});w(e)&&(G("Operation cancelled"),process.exit(0));let r=await O({message:"What do you want to do?",options:[{value:"setup",label:"Build Credentials (Certs/Profiles)",hint:"Manage everything needed to build your project"},{value:"download",label:"Download credentials (credentials.json)",hint:"Sync credentials from Dashboard to local project"},{value:"service",label:"App Store Connect API Key (Magic)",hint:"Manage your API Key for automated submission"},{value:"push",label:"Push Notifications (Placeholder)",hint:"Manage your Apple Push Notifications Key"},{value:"back",label:"Go back"},{value:"exit",label:"Exit"}].filter(l=>!(e==="android"&&(l.value==="service"&&(l.label="Google Service Account (JSON)"),l.value==="push")))});if((w(r)||r==="exit")&&(G("Operation cancelled"),process.exit(0)),r==="back")return fe(a);if(r==="setup")await Ge({...a,platform:e});else if(r==="download")await We({...a,platform:e});else if(r==="service")await ue({platform:e});else if(r==="push")return Ce("Push Notifications management is coming soon!","Coming Soon"),fe(a);Ee(n.green("Done!"))},Ge=async a=>{let e=z(),r=a.platform,l=a.profile;if(!l){let u=await O({message:"Select credential type:",options:[{value:"development",label:"Development",hint:"Local testing & simulators"},{value:"staging",label:"Ad Hoc / Staging",hint:"Internal distribution & device testing"},{value:"production",label:"Production / App Store",hint:"App Store & Play Store submission"}]});w(u)&&(G("Operation cancelled"),process.exit(0)),l=u}let s=`./${g.configFileName}`;if(!A.existsSync(s)){t.error(`No ${g.configFileName} found. Run \`${g.nameLower} init\` or \`${g.nameLower} link\` first.`);return}let c=JSON.parse(A.readFileSync(s,"utf-8")),{projectId:i}=c;if(!i){t.error(`${g.configFileName} is missing projectId.`);return}a.awsProfile&&t.warn(n.yellow(`Ignoring --aws-profile. Authenticating with ${g.name} Cloud...`)),t.info(n.dim(`Setting up credentials for: ${l}`)),r==="ios"?await Be(i,l,a,c):await Xe(i,l,l==="production"?"store":"internal",a)};async function Be(a,e,r,l){let s=r.bundleId;if(!s){let I=l.submit?.production?.ios?.bundleId||l.ios?.bundleId,d=[];try{let f=(await v.get(`/credentials/${a}`)).data.credentials||[];d=[...new Set(f.filter(o=>o.platform==="ios"&&o.bundleId&&o.bundleId!=="*").map(o=>o.bundleId))]}catch{}if(I&&!d.includes(I)&&d.unshift(I),d.length>0){let p=[...d.map(o=>({value:o,label:o,hint:o===I?"from config":void 0})),{value:"__new__",label:"+ Enter a new Bundle ID"}],f=await O({message:"Which Bundle ID are you setting up credentials for?",options:p});if(w(f)&&(G("Operation cancelled"),process.exit(0)),f==="__new__"){let o=await J({message:"iOS Bundle ID (e.g. com.example.app):",placeholder:"com.example.app",validate:y=>y.includes(".")?void 0:"Please enter a valid Bundle ID"});w(o)&&(G("Operation cancelled"),process.exit(0)),s=o}else s=f}else{let p=await J({message:"iOS Bundle ID (e.g. com.example.app):",placeholder:"com.example.app",validate:f=>f.includes(".")?void 0:"Please enter a valid Bundle ID"});w(p)&&(G("Operation cancelled"),process.exit(0)),s=p}}t.info(n.dim(`Bundle ID: ${s}`));let c=e==="production"?"store":e==="staging"?"adhoc":"development",i=l.submit?.production?.ios?.appleId;i&&t.info(n.dim(`Using Apple ID from config: ${i}`)),await _e(a,s,e,c,c==="store"?"appstore":c==="adhoc"?"adhoc":"development",r,l,i)}async function Fe(a){let e="MATCH_ENCRYPTION_PASSPHRASE";try{let i=((await v.get(`/projects/${a}/secrets/export?env=development`)).data.secrets||{})[e];if(i&&!i.includes("[Decryption Failed]"))return t.info(n.dim("Using existing encryption passphrase from Dashboard")),t.info(n.cyan(`MATCH_PASSWORD: ${i}`)),i;if(i&&i.includes("[Decryption Failed]")){t.warn(n.yellow("\u26A0\uFE0F  Existing MATCH_PASSWORD could not be decrypted (encryption key changed).")),t.info(n.dim("Generating a fresh passphrase and cleaning old certificates..."));let u=le.randomBytes(32).toString("base64");try{await v.post(`/projects/${a}/secrets`,{key:e,value:u,type:"managed",description:"Encryption passphrase for iOS certificates (fastlane match)",visibility:"secret"}),t.success(n.green("\u2713 New encryption passphrase generated and saved"))}catch{}try{await v.post("/credentials/clean-match-storage",{projectId:a}),t.success(n.green("\u2713 Cleaned old certificates from storage"))}catch{}return u}}catch(s){t.info(n.dim(`Could not fetch existing passphrase from Dashboard: ${s.message}`))}let r=await O({message:"No active encryption passphrase found on Dashboard. What would you like to do?",options:[{value:"generate",label:"Generate a new secure passphrase",hint:"Safe for first-time setup"},{value:"enter",label:"Enter existing passphrase manually",hint:"Required if you already have certs in S3"},{value:"cancel",label:"Cancel",hint:"Quit"}]});if((w(r)||r==="cancel")&&(G("Operation cancelled"),process.exit(0)),r==="enter"){let s=await pe({message:"Enter your MATCH_PASSWORD (encryption passphrase):",validate:i=>i.length>0?void 0:"Passphrase is required"});w(s)&&(G("Operation cancelled"),process.exit(0));let c=s;try{await v.post(`/projects/${a}/secrets`,{key:e,value:c,type:"managed",description:"Encryption passphrase for iOS certificates (fastlane match)"}),t.success(n.green("\u2713 Saved passphrase to Dashboard"))}catch{}return c}let l=le.randomBytes(32).toString("base64");try{await v.post(`/projects/${a}/secrets`,{key:e,value:l,type:"managed",description:"Encryption passphrase for iOS certificates (fastlane match)",visibility:"secret"}),t.success(n.green("\u2713 Generated and saved encryption passphrase to Dashboard")),t.info(n.cyan(`MATCH_PASSWORD: ${l}`))}catch(s){t.warn(n.yellow(`Could not save passphrase to Dashboard: ${s.message}`))}return l}async function _e(a,e,r,l,s,c,i,u){let I=z();if(t.info(n.blue("Configuring iOS certificate management...")),!u){let d=await J({message:"Apple ID (for Apple Developer Portal):",placeholder:"your-email@example.com",validate:p=>p.includes("@")?void 0:"Please enter a valid email"});w(d)&&(G("Operation cancelled"),process.exit(0)),u=d,i.submit||(i.submit={production:{ios:{}}}),i.submit.production||(i.submit.production={ios:{}}),i.submit.production.ios||(i.submit.production.ios={}),i.submit.production.ios.appleId=u,A.writeFileSync(`./${g.configFileName}`,JSON.stringify(i,null,2)),t.success(n.green("\u2713 Apple ID saved to config"))}I.start(`Fetching ${s} certificates...`);try{let d=await Fe(a),p="",f="";try{let m=await v.post("/credentials/build-server-token",{projectId:a});m.data.status==="success"&&m.data.credentials&&(process.env.AWS_ACCESS_KEY_ID=m.data.credentials.accessKeyId,process.env.AWS_SECRET_ACCESS_KEY=m.data.credentials.secretAccessKey,m.data.credentials.sessionToken&&(process.env.AWS_SESSION_TOKEN=m.data.credentials.sessionToken),f=m.data.credentials.region||"ap-south-1",p=m.data.credentials.bucket||g.bucketPrefix,process.env.AWS_REGION=f,delete process.env.AWS_PROFILE)}catch(m){throw t.error(`Failed to authenticate with ${g.name} Cloud.`),m}if(!p||!f){t.error(`Failed to resolve S3 configuration from ${g.name} Cloud.`);return}let o=c.teamId||i.submit?.production?.ios?.appleTeamId;if(!o)try{let N=(await v.get(`/projects/${a}/secrets`)).data.secrets?.find($=>$.key==="APPLE_TEAM_ID");N&&(o=N.value,t.info(n.dim(`Using Team ID from Dashboard: ${o}`)))}catch{}if(o&&o===i.submit?.production?.ios?.appleTeamId&&t.info(n.dim(`Using Apple Team ID from config: ${o}`)),!o){t.warn(n.yellow(`
-Apple Team ID is required to fetch certificates.`)),t.info(n.dim("You can find this at: https://developer.apple.com/account -> Membership Details"));let m=await J({message:"Enter your 10-character Apple Team ID:",placeholder:"e.g. 4523G95823",validate:N=>N.length===10?void 0:"Team ID must be exactly 10 characters"});w(m)&&(G("Operation cancelled"),process.exit(0)),o=m,await me(a,o)}I.stop("Starting certificate sync...");let y=g.credentialsKeychain,C=g.keychainPassword;try{let N=`${process.env.HOME||"/Users/"+(process.env.USER||g.nameLower)}/Library/Keychains/${y}`;t.info(n.dim(`Ensuring keychain exists: ${y}`));try{W(`security create-keychain -p ${C} ${y} 2>/dev/null || true`),W(`security unlock-keychain -p ${C} ${y}`),W(`security set-keychain-settings ${y}`);let S=W("security list-keychains -d user").toString();if(!S.includes(y)){t.info(n.dim(`Adding ${y} to search list`));let h=[...S.replace(/"/g,"").split(`
-`).map(x=>x.trim()).filter(x=>x.length>0),N].join(" ");W(`security list-keychains -d user -s ${h}`)}}catch(S){t.warn(n.dim("Keychain setup warning (non-critical): "+S.message))}let $,D,H;try{let b=((await v.get(`/credentials/${a}`)).data.credentials||[]).find(h=>h.type==="asc_api_key"&&h.issuerId);if(b){let h=await v.get(`/credentials/${b.credentialId}/download`,{params:{projectId:a}});if(h.data.downloadUrl){let k=await(await import("axios")).default.get(h.data.downloadUrl,{responseType:"arraybuffer"}),T=R.join(te.tmpdir(),`mach-asc-${Date.now()}`);A.mkdirSync(T,{recursive:!0}),$=R.join(T,`AuthKey_${b.keyId}.p8`),A.writeFileSync($,Buffer.from(k.data)),D=b.keyId,H=b.issuerId,t.success(n.green("\u2713 ASC API key loaded \u2014 no 2FA required for Portal operations"))}}}catch(S){t.warn(n.dim(`Could not load ASC API key: ${S.message}. Will fall back to Apple ID auth.`))}t.info(n.dim("Generating secure P12 export password..."));let M=ye();t.success(n.green("\u2713 Secure P12 password generated."));let B={...process.env,AWS_REGION:process.env.AWS_REGION||"ap-south-1",AWS_ACCESS_KEY_ID:process.env.AWS_ACCESS_KEY_ID,AWS_SECRET_ACCESS_KEY:process.env.AWS_SECRET_ACCESS_KEY,SSL_CERT_FILE:"/etc/ssl/cert.pem",AWS_CA_BUNDLE:"/etc/ssl/cert.pem",FASTLANE_SSL_CA_CERT:"/etc/ssl/cert.pem",MATCH_PASSWORD:d,FASTLANE_USER:u,FASTLANE_SKIP_UPDATE_CHECK:"1",FASTLANE_TEAM_ID:o,MATCH_KEYCHAIN_NAME:y,MATCH_KEYCHAIN_PASSWORD:C,TERM:process.env.TERM||"xterm-256color",SHELL:process.env.SHELL||"/bin/zsh",MATCH_OUTPUT_PATH:R.join(process.cwd(),"temp_match"),MATCH_STORAGE_MODE:"s3",MATCH_S3_REGION:f,MATCH_S3_BUCKET:p,MATCH_S3_OBJECT_PREFIX:"ios-certificates/",MATCH_USERNAME:u,MATCH_APP_IDENTIFIER:e,MATCH_TYPE:s,[`${g.envPrefix}P12_PASSWORD`]:M,...$&&D&&H?{APP_STORE_CONNECT_API_KEY_KEY_ID:D,APP_STORE_CONNECT_API_KEY_ISSUER_ID:H,APP_STORE_CONNECT_API_KEY_KEY_FILEPATH:$,FASTLANE_SKIP_2FA:"1"}:{}};if(c.force){t.warn(n.yellow(`
-\u26A0\uFE0F  Force flag detected: Hard resetting ${s} certificates...`)),t.info(n.dim("Detected decryption failure loop. Clearing remote storage directly to allow fresh generation.")),t.info(n.cyan(`Current MATCH_PASSWORD: ${d}`)),t.info(n.dim(`Cleaning match storage for Team ID: ${o}...`));try{(await v.post("/credentials/clean-match-storage",{projectId:a,teamId:o})).data.status==="success"&&t.success(n.green(`\u2713 Cleared S3 storage for Team ID: ${o}`))}catch(S){t.warn(n.yellow(`S3 cleanup via API failed: ${S.message}`)),t.info(n.dim("Continuing to attempt standard nuke..."))}try{W(`fastlane match nuke ${s} --skip_confirmation`,{stdio:"inherit",cwd:process.cwd(),env:B}),t.success(n.green(`\u2713 Nuked existing ${s} credentials`))}catch{t.warn(n.yellow("Standard nuke failed (likely due to password mismatch).")),t.info(n.dim("Since S3 was cleared manually, proceeding to generation..."))}}if(s==="adhoc"||s==="development")try{t.info(n.blue("Fetching registered devices..."));let b=(await v.get("/devices")).data.devices||[];if(b.length===0)t.warn(n.yellow("No registered devices found. Profile will only include devices already on the Apple Developer Portal.")),t.info(n.dim(`Register devices with: ${g.nameLower} device register`));else{let{multiselect:h}=await import("@clack/prompts"),x=await h({message:`Select devices to include in the ${s} profile:`,options:b.map(k=>({value:k.udid,label:`${k.name} (${k.udid.substring(0,12)}...)`,hint:k.model||k.platform})),initialValues:b.map(k=>k.udid)});if(!w(x)&&x.length>0){let k=b.filter(T=>x.includes(T.udid));if(t.info(n.blue(`Registering ${k.length} device(s) on Apple Developer Portal...`)),$&&D&&H)await ke(k,D,H,$);else{t.info(n.dim("You will be prompted for a 2FA code once \u2014 type it and press Enter."));let T=R.join(te.tmpdir(),`mach-devices-${Date.now()}.tsv`),he=`Device ID	Device Name
-`+k.map(ie=>`${ie.udid}	${ie.name}`).join(`
-`);A.writeFileSync(T,he);try{L(`fastlane run register_devices devices_file:"${T}"`,{shell:!0,env:B,stdio:"inherit",cwd:process.cwd()})}finally{try{A.unlinkSync(T)}catch{}}}t.info(n.green("\u2713 Device registration complete."))}}}catch(S){t.warn(n.yellow(`Could not fetch registered devices: ${S.message}`)),t.info(n.dim("Continuing without explicit device registration."))}try{let S=L(`fastlane match ${s} --app_identifier "${e}" --profile_name "${g.nameLower} ${s} ${e}"`,{shell:!0,cwd:process.cwd(),env:B,stdio:"inherit",encoding:"utf-8"});if(S.status!==0){t.warn(n.yellow(`
-Certificate sync failed. Attempting to create App ID and retry...`));try{W(`fastlane produce --app_identifier "${e}" --app_name "${e}" --skip_itc`,{stdio:"inherit",env:B}),t.success(n.green("\u2713 App ID created successfully")),t.info(n.blue("Retrying certificate sync...")),S=L(`fastlane match ${s} --app_identifier "${e}" --profile_name "${g.nameLower} ${s} ${e}"`,{shell:!0,cwd:process.cwd(),env:B,stdio:"inherit",encoding:"utf-8"})}catch{}if(S.status!==0)throw new Error("fastlane match failed")}}catch(S){t.warn(n.yellow(`
-Sync failed. This often happens if the encryption passphrase (MATCH_PASSWORD) is incorrect or session expired.`)),t.info(n.cyan(`Failed MATCH_PASSWORD was: ${d}`));let b=await O({message:"What would you like to do?",options:[{value:"retry_password",label:"Retry with a different MATCH_PASSWORD",hint:"Manually enter the decryption passphrase"},{value:"check_portal",label:"Check Apple Portal (Resolve certificate limits)",hint:"See if you have too many certificates"},{value:"manual",label:"Fallback to manual upload",hint:"Provide .p12 and .mobileprovision files"},{value:"cancel",label:"Cancel",hint:"Go back"}]});if(w(b)||b==="cancel")throw S;if(b==="retry_password"){t.info(n.dim(`
-You are overriding the dashboard passphrase for this session.`));let h=await pe({message:"Enter the correct MATCH_PASSWORD for this project:"});if(h&&!w(h)){d=h,t.info(n.blue("Retrying with provided passphrase...")),t.info(n.cyan(`New MATCH_PASSWORD: ${d}`));let x={...B,MATCH_PASSWORD:d};if(L(`fastlane match ${s}`,{shell:!0,stdio:"inherit",cwd:process.cwd(),env:x}).status===0)await v.post(`/projects/${a}/secrets`,{key:"MATCH_ENCRYPTION_PASSPHRASE",value:d,description:"Encryption passphrase for iOS certificates (fastlane match)",visibility:"secret"}),t.success(n.green("\u2713 Dashboard passphrase updated.")),t.info(n.cyan(`MATCH_PASSWORD: ${d}`));else throw new Error("Sync failed again with provided passphrase.")}else throw S}else if(b==="check_portal")try{let h=await ge(B,s);if(h.length>0){if(t.info(n.dim(`Found ${h.length} existing ${s} certificates on the portal.`)),await $e(s,B,a,h)&&(t.info(n.blue("Retrying certificate sync...")),L(`fastlane match ${s}`,{shell:!0,stdio:"inherit",cwd:process.cwd(),env:B}).status!==0))throw new Error("Retry failed")}else throw t.error(n.red("No existing certificates found on portal to resolve.")),S}catch(h){throw t.warn(n.dim(`Portal check warning: ${h.message}`)),S}else throw S}t.success(n.green("\u2713 Certificates fetched and synced"));let F=R.join(process.cwd(),"temp_match"),U=R.join(F,`${g.fastlanePrefix}_export.p12`),j=de(F,/\.mobileprovision$/);try{let b=`${process.env.HOME||"/Users/"+(process.env.USER||g.nameLower)}/Library/Keychains/${y}`;A.existsSync(F)||A.mkdirSync(F,{recursive:!0}),t.info(n.dim("Exporting certificate from keychain for dashboard upload...")),W(`security export -k ${b} -t identities -f pkcs12 -o ${U} -P ""`,{stdio:"ignore"})}catch{t.warn(n.dim("Could not export certificate from keychain."))}c.teamId&&!o&&await me(a,c.teamId);let Q=A.existsSync(U)?U:de(F,/\.p12$/);if(Q&&j){let S,b;try{let h=await ge(B,s);h.length>0&&(S=h[0].expires,b=h[0].id)}catch{t.warn(n.dim("Could not fetch expiration date or ID for dashboard record."))}await Y(a,Q,"ios_cert",e,l,void 0,S,c.teamId||o,b,M),await Y(a,j,"ios_profile",e,l,void 0,S,c.teamId||o),t.success(n.green("\u2713 Both iOS certificate and provisioning profile uploaded successfully"));try{A.existsSync("./temp_match")&&A.rmSync("./temp_match",{recursive:!0,force:!0})}catch{}}else t.warn(n.yellow("Certificates generated but not found in expected location.")),t.info(n.dim("Falling back to manual upload...")),await Ie(a,e,l)}catch(m){I.stop("Certificate fetch failed"),t.error(n.red(`Error: ${m.message}`)),t.info(n.dim("Falling back to manual upload...")),await Ie(a,e,l)}}catch(d){I.stop("iOS setup failed"),t.error(n.red(`Error: ${d.message}`))}finally{if(ascKeyPath)try{A.rmSync(R.dirname(ascKeyPath),{recursive:!0,force:!0})}catch{}}}async function me(a,e){try{await v.post(`/projects/${a}/secrets`,{key:"APPLE_TEAM_ID",value:e,description:"Apple Developer Team ID (used for iOS signing)"}),t.success(n.green(`\u2713 Saved Team ID ${e} to Dashboard`))}catch(r){t.warn(n.yellow(`Could not save Team ID to Dashboard: ${r.message}`))}}async function Ie(a,e,r){t.info(n.yellow(`
-Manual Upload Mode`)),t.info("Please provide your certificate and provisioning profile:");let l=await J({message:"Path to .p12 certificate file:",validate:i=>A.existsSync(i)?void 0:"File not found"});w(l)&&(G("Operation cancelled"),process.exit(0));let s=await J({message:"Path to .mobileprovision file:",validate:i=>A.existsSync(i)?void 0:"File not found"});w(s)&&(G("Operation cancelled"),process.exit(0));let c=z();c.start(`Uploading to ${g.name} Dashboard...`);try{await Y(a,l,"ios_cert",e,r),await Y(a,s,"ios_profile",e,r),c.stop("Upload complete"),t.success(n.green("\u2713 iOS credentials uploaded successfully"))}catch(i){throw c.stop("Upload failed"),i}}async function Xe(a,e,r,l){let s=z();t.step(n.blue("Android Credential Setup"));let c=l.bundleId;if(!c){let p=[];try{let o=(await v.get(`/credentials/${a}`)).data.credentials||[];p=[...new Set(o.filter(y=>y.platform==="android"&&y.bundleId&&y.bundleId!=="*").map(y=>y.bundleId))]}catch{}if(p.length>0){let f=[...p.map(y=>({value:y,label:y})),{value:"__new__",label:"+ Enter a new Package Name"}],o=await O({message:"Which Package Name are you setting up credentials for?",options:f});if(w(o)&&(G("Operation cancelled"),process.exit(0)),o==="__new__"){let y=await J({message:"Android Package Name (e.g. com.example.app):",placeholder:"com.example.app",validate:C=>C.includes(".")?void 0:"Please enter a valid package name"});w(y)&&(G("Operation cancelled"),process.exit(0)),c=y}else c=o}else{let f=await J({message:"Android Package Name (e.g. com.example.app):",placeholder:"com.example.app",validate:o=>o.includes(".")?void 0:"Please enter a valid package name"});w(f)&&(G("Operation cancelled"),process.exit(0)),c=f}}try{let o=((await v.get(`/credentials/${a}`)).data.credentials||[]).find(y=>y.platform==="android"&&y.distributionType===r&&y.bundleId===c);if(o){t.warn(n.yellow(`\u26A0\uFE0F  Existing Android credentials found for ${r}`));let y=await J({message:"What would you like to do? (use/new/cancel)",validate:C=>{let m=C.toLowerCase();if(!(m==="use"||m==="new"||m==="cancel"))return"Please type: use, new, or cancel"}});if(w(y)||y.toLowerCase()==="cancel")return;if(y.toLowerCase()==="use"){t.success(n.green("\u2713 Using existing credentials."));return}await v.delete(`/credentials/${o.credentialId}?projectId=${a}`)}}catch{}let i="./android/app/my-release-key.jks";if(A.existsSync(i)){let p=await Ze({message:"Upload existing keystore?"});if(p&&!w(p)){let f=await J({message:"Key alias:",initialValue:"my-key-alias"});if(w(f))return;let o=await pe({message:"Keystore password:"});if(w(o))return;await Y(a,i,"android_keystore",c,r,f,void 0,void 0,void 0,o),t.success(n.green("\u2713 Keystore uploaded"));return}}t.info(n.blue("Generating new Android keystore..."));let u=l.keyAlias||`${g.nameLower}-${xe()}`,I=ye(),d=`./${g.nameLower}-${e}.jks`;A.existsSync(d)&&A.unlinkSync(d),s.start("Generating keystore...");try{let p=I.replace(/'/g,"'\\''");W(`keytool -genkeypair -v -keystore "${d}" -alias "${u}" -keyalg RSA -keysize 2048 -validity 10000 -storepass '${p}' -keypass '${p}' -dname "CN=${g.name} Build, OU=Mobile, O=Company, L=City, S=State, C=US"`,{stdio:"inherit"}),s.stop("Keystore generated"),await Y(a,d,"android_keystore",c,r,u,void 0,void 0,void 0,I),t.success(n.green("\u2713 Android credentials uploaded successfully")),t.info(n.cyan(`Key Alias: ${u}`))}catch(p){throw s.stop("Generation failed"),new Error(`Keystore generation failed: ${p.message}`)}}async function Y(a,e,r,l,s,c,i,u,I,d){let p=R.basename(e);t.info(n.dim(`Uploading ${p} (Isolated process)...`));let f=new URL(import.meta.url),o=R.dirname(f.pathname),y=R.join(o,"commands","isolated-upload.js"),C=L("node",[y,a,e,r,l,s,c||"undefined",i||"undefined",u||"undefined",I||"undefined",d||"undefined"],{stdio:"pipe",encoding:"utf-8",env:{...process.env,AT_CLI_ISOLATED:"1"}});if(C.status!==0){let m=C.stderr||C.stdout||"Unknown isolated upload failure";throw t.error(n.red(`Isolated Upload Failed: ${m}`)),new Error(m)}C.stdout.includes("SUCCESS")?t.info(n.dim(`\u2713 ${p} uploaded and registered.`)):t.warn(n.yellow(`Isolated upload finished but success not confirmed: ${C.stdout}`))}async function We(a){let e=z(),r=a.platform,l=`./${g.configFileName}`;if(!A.existsSync(l)){t.error(`No ${g.configFileName} found. Run \`${g.nameLower} init\` or \`${g.nameLower} link\` first.`);return}let s=JSON.parse(A.readFileSync(l,"utf-8")),{projectId:c}=s;if(!c){t.error(`${g.configFileName} is missing projectId.`);return}try{e.start("Fetching project secrets...");let u=(await v.get(`/projects/${c}/secrets/export?env=all`)).data.secrets||{};e.stop("Secrets fetched and merged."),e.start("Fetching credentials...");let d=(await v.get(`/credentials/${c}`)).data.credentials||[];e.stop(`Found ${d.length} metadata records.`);let p=d.filter(C=>C.platform===r);if(p.length===0){t.info(`No ${r} credentials found on Dashboard.`);return}let f="./credentials.json",o={};if(A.existsSync(f))try{o=JSON.parse(A.readFileSync(f,"utf-8"))}catch{t.warn("Could not parse existing credentials.json, creating a new one.")}o[r]||(o[r]={});let y=R.join(process.cwd(),"credentials",r);A.existsSync(y)||A.mkdirSync(y,{recursive:!0});for(let C of p){e.start(`Downloading ${C.type} (${C.distributionType})...`);try{let m=await v.get(`/credentials/${C.credentialId}/download?projectId=${c}`);if(m.data.status==="success"&&m.data.downloadUrl){let N=R.join(process.cwd(),"credentials",r,C.distributionType);A.existsSync(N)||A.mkdirSync(N,{recursive:!0});let $=C.s3Key?.split(".").pop()||(C.type.includes("keystore")?"jks":C.type.includes("cert")?"p12":"mobileprovision"),D=`${C.type}.${$}`,H=R.join(N,D),M=await Ae.get(m.data.downloadUrl,{responseType:"arraybuffer"});A.writeFileSync(H,Buffer.from(M.data));let B=R.join("credentials",r,C.distributionType,D);if(r==="android"){if(C.type==="android_keystore"){let F=C.distributionType==="store"?"PRODUCTION":C.distributionType==="internal"?"STAGING":"DEVELOPMENT",U=["PRODUCTION","STORE","INTERNAL","STAGING","DEVELOPMENT","RELEASE","DEBUG"],j=[`KEYSTORE_PASSWORD_${F}`,`KEYSTORE_PASSWORD_${C.distributionType.toUpperCase()}`,...U.map(h=>`KEYSTORE_PASSWORD_${h}`),"ANDROID_KEYSTONE_PASSWORD","KEYSTORE_PASSWORD"],Q=[`KEYSTORE_ALIAS_${F}`,`KEYSTORE_ALIAS_${C.distributionType.toUpperCase()}`,...U.map(h=>`KEYSTORE_ALIAS_${h}`),"KEYSTORE_ALIAS"],S=j.map(h=>u[h]).find(h=>!!h)||"",b=Q.map(h=>u[h]).find(h=>!!h)||C.meta?.alias||"";o.android.keystore={keystorePath:B,keystorePassword:S,keyAlias:b,keyPassword:S}}}else if(r==="ios"){let F=C.distributionType==="store"?"production":C.distributionType==="adhoc"?"staging":"development";o.ios[F]||(o.ios[F]={}),C.type==="ios_cert"?(o.ios[F].certificatePath=B,o.ios[F].certificatePassword=u.IOS_P12_PASSWORD||""):C.type==="ios_profile"&&(o.ios[F].provisioningProfilePath=B)}e.stop(`\u2713 ${C.type} (${C.distributionType}) saved.`)}}catch(m){let N=m.response?.data?.message||m.message;e.stop(n.dim(`- Skipped ${C.type} (${C.distributionType}): ${N}`))}}A.writeFileSync(f,JSON.stringify(o,null,2)),t.success(n.green("\u2713 Local credentials.json updated.")),Ce("Credentials have been synced to your local machine. Ensure credentials.json and credentials/ is added to your .gitignore.","Sync Complete")}catch(i){e.stop(n.red("Sync failed.")),t.error(`Error: ${i.message}`)}}function ye(){let a="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_+=",e="";for(let r=0;r<24;r++)e+=a.charAt(Math.floor(Math.random()*a.length));return e}function xe(a=8){let e="abcdefghijklmnopqrstuvwxyz0123456789",r="";for(let l=0;l<a;l++)r+=e.charAt(Math.floor(Math.random()*e.length));return r}async function $e(a,e,r,l){let s=l||await ge(e,a);if(!s||s.length===0)return!1;let c=await O({message:"Select a certificate to revoke:",options:[...s.map(i=>({value:`revoke:${i.id}`,label:`Revoke: ${i.name} (${i.expires})`})),{value:"nuke",label:"Revoke All"},{value:"cancel",label:"Cancel"}]});return w(c)||c==="cancel"?!1:c==="nuke"?(W(`fastlane match nuke ${a}`,{stdio:"inherit",cwd:process.cwd(),env:e}),!0):typeof c=="string"&&c.startsWith("revoke:")?(await Pe(e,c.split(":")[1]),!0):!1}async function ge(a,e){let r=e==="development"?"development":"distribution",l=`
-lane :${g.fastlanePrefix}_list_certs do
-  require 'spaceship'
-  require 'json'
-  begin
-    Spaceship::Portal.login(ENV['FASTLANE_USER'])
-    Spaceship::Portal.select_team(team_id: ENV['FASTLANE_TEAM_ID'])
-    output = Spaceship::Portal.certificate.all.select { |c|
-      if "${r}" == "development"
-        c.type_display_id.downcase.include?("development")
-      else
-        c.type_display_id.downcase.include?("distribution") || c.type_display_id.downcase.include?("production")
-      end
-    }.map { |c| { id: c.id, name: c.name, expires: c.expires.strftime('%Y-%m-%d'), type: c.type_display_id } }
-    puts "${g.jsonStartMarker}" + output.to_json + "${g.jsonEndMarker}"
-  rescue => e
-    $stderr.puts "ERROR: #{e.message}"
-    exit 1
-  end
-end`,s=R.join(te.tmpdir(),`/tmp/${g.nameLower}-list-certs-${Date.now()}`),c=R.join(s,"fastlane"),i=R.join(c,"Fastfile");try{A.existsSync(c)||A.mkdirSync(c,{recursive:!0}),A.writeFileSync(i,l);let I=W(`fastlane ${g.fastlanePrefix}_list_certs`,{env:{...a,CI:"1",FASTLANE_FASTFILE:i},cwd:s,stdio:["inherit","pipe","inherit"]}).toString().match(new RegExp(`${g.jsonStartMarker}(.*)${g.jsonEndMarker}`));return I?JSON.parse(I[1]):[]}finally{A.existsSync(s)&&A.rmSync(s,{recursive:!0,force:!0})}}async function Pe(a,e){let r=`
-lane :${g.fastlanePrefix}_revoke_cert do
-  require 'spaceship'
-  begin
-    Spaceship::Portal.login(ENV['FASTLANE_USER'])
-    Spaceship::Portal.select_team(team_id: ENV['FASTLANE_TEAM_ID'])
-    cert = Spaceship::Portal.certificate.all.find { |c| c.id == "${e}" }
-    cert.revoke! if cert
-  rescue => e
-    $stderr.puts "ERROR: #{e.message}"
-    exit 1
-  end
-end`,l=R.join(te.tmpdir(),`/tmp/${g.nameLower}-revoke-cert-${Date.now()}`),s=R.join(l,"fastlane"),c=R.join(s,"Fastfile");try{A.existsSync(s)||A.mkdirSync(s,{recursive:!0}),A.writeFileSync(c,r),W(`fastlane ${g.fastlanePrefix}_revoke_cert`,{env:{...a,CI:"1",FASTLANE_FASTFILE:c},cwd:l,stdio:["inherit","pipe","inherit"]})}finally{A.existsSync(l)&&A.rmSync(l,{recursive:!0,force:!0})}}export{ue as a,fe as b,Ge as c,We as d};