@radhya/mach 1.4.27 → 1.5.0

package/README.md

@@ -35,6 +35,7 @@ mach build --platform android
 | `mach build` | Start a cloud build (iOS / Android) |
 | `mach submit` | Submit to App Store or Google Play |
 | `mach credentials` | Manage iOS certificates, provisioning profiles & Android keystores |
+| `mach credentials:service` | Upload App Store Connect or Google Play service credentials |
 | `mach env` | Manage environment variables and secrets |
 | `mach config` | Show resolved configuration for a build profile |
 | `mach start` | Start the Metro development server |
@@ -68,6 +69,76 @@ mach build --platform ios --local
 | `--simulator` | iOS Simulator build (no signing needed) |
 | `--auto-version` | Auto-increment Android versionCode via Google Play API |
 | `--verbose` | Enable detailed build logging |
+| `--json-output` | Write build metadata (`buildId`, Dashboard URL, status) to a JSON file for CI/CD |
+
+### CI Build URLs
+
+Use `--json-output` when a pipeline needs the Dashboard URL for Slack, deployment notes, or downstream steps:
+
+```bash
+mach build --platform android --profile production --json-output mach-android-build.json
+ANDROID_URL=$(node -pe "require('./mach-android-build.json').url")
+```
+
+The JSON file includes:
+
+```json
+{
+  "status": "success",
+  "buildId": "00000000-0000-0000-0000-000000000000",
+  "platform": "android",
+  "profile": "production",
+  "url": "https://dashboard.example/build/00000000-0000-0000-0000-000000000000"
+}
+```
+
+### Bitbucket Pipelines
+
+Mach works in Bitbucket through a Dashboard access token. Create a token in **Dashboard → Settings → Access Tokens**, save it as `MACH_TOKEN`, and use `--json-output` to pass build URLs to Slack.
+
+```yaml
+image: node:24.13.1
+
+definitions:
+  steps:
+    - step: &build-android
+        name: Build Android
+        size: 2x
+        caches:
+          - node
+        script:
+          - npm ci
+          - npm install -g @radhya/mach@latest
+          - mach build --platform android --profile $MACH_BUILD_PROFILE --auto-version --json-output mach-android-build.json
+          - ANDROID_URL=$(node -pe "require('./mach-android-build.json').url")
+          - pipe: atlassian/slack-notify:2.0.0
+            variables:
+              WEBHOOK_URL: $SLACK_WEBHOOK_URL
+              MESSAGE: "$SLACK_MESSAGE_PREFIX (Android): $ANDROID_URL"
+
+    - step: &submit-android
+        name: Submit Android
+        size: 2x
+        caches:
+          - node
+        script:
+          - npm ci
+          - npm install -g @radhya/mach@latest
+          - mach submit --latest --platform android --profile $MACH_SUBMIT_PROFILE --track ${MACH_ANDROID_TRACK:-internal}
+```
+
+Required Bitbucket variables:
+
+| Variable | Required | Description |
+|----------|----------|-------------|
+| `MACH_TOKEN` | Yes | Dashboard access token for CI/CD auth |
+| `MACH_BUILD_PROFILE` | Yes | Build profile from `mach.config.json`, e.g. `production` |
+| `MACH_SUBMIT_PROFILE` | Yes | Profile used by `mach submit --latest`, e.g. `production` |
+| `MACH_ANDROID_TRACK` | Android submit | Google Play track, e.g. `internal`, `alpha`, `beta`, `production` |
+| `SLACK_WEBHOOK_URL` | Slack | Incoming webhook for build notifications |
+| `SLACK_MESSAGE_PREFIX` | Slack | Message prefix such as project/environment name |
+
+Before enabling CI, make sure `mach.config.json` is committed, credentials are uploaded in the Dashboard, and Android service credentials are attached to the exact package id.
 
 ## Credential Management
 
@@ -90,6 +161,29 @@ mach credentials --bundle-id com.example.app.staging
 
 The Dashboard shows each bundle ID as a row. Clicking it reveals its Distribution certificate, Provisioning profile, and Service credentials — matching the same layout as Expo's credentials screen. A **Password stored** badge confirms the P12 export password is saved and will be injected at build time automatically.
 
+### Service Credentials
+
+Service credentials are used for store automation:
+
+- iOS: App Store Connect API key (`.p8`)
+- Android: Google Play service account JSON
+
+Android service credentials are scoped to a package name. This matters when one Mach project contains multiple Android application identifiers.
+
+```bash
+# Android: upload a Google Play service account JSON
+mach credentials:service --platform android --package-name com.example.app --file ~/Downloads/play-service-account.json
+
+# If --package-name is omitted, Mach fetches saved Android package ids
+# from the Dashboard and asks you to select one.
+mach credentials:service --platform android --file ~/Downloads/play-service-account.json
+
+# iOS: upload or create an App Store Connect API key
+mach credentials:service --platform ios
+```
+
+The Dashboard also supports this under **Credentials → Android → package id → Service credentials**. Uploading a Google Play service key under `*` is legacy behavior; store submission now expects the service credential to match the Android package being submitted.
+
 ## Configuration
 
 Create a `mach.config.json` in your project root:
@@ -216,10 +310,25 @@ Or in config:
 ## Store Submission
 
 ```bash
-mach submit --platform ios
-mach submit --platform android --track internal
+# Submit the latest successful build for a profile
+mach submit --latest --platform android --profile production
+mach submit --latest --platform ios --profile production
+
+# Android track can be supplied on the command or in mach.config.json
+mach submit --latest --platform android --profile production --track internal
+
+# Submit a specific build id
+mach submit --platform android --build-id <build-id>
 ```
 
+For Android, Mach resolves the package from `mach.config.json` / Expo config and looks for a matching `google_service_account` credential. If none exists, upload it with:
+
+```bash
+mach credentials:service --platform android --package-name com.example.app --file ~/Downloads/play-service-account.json
+```
+
+If `--profile` is provided with `--latest`, Mach chooses the latest successful build from that profile only. This avoids accidentally submitting a staging or preprod build to production.
+
 ## Development Server
 
 ```bash
@@ -256,6 +365,14 @@ mach build --platform ios --profile production
 
 Generate tokens from the Mach Dashboard under **Settings → Access Tokens**.
 
+Example CI flow:
+
+```bash
+export MACH_TOKEN=your-personal-access-token
+mach build --platform android --profile production
+mach submit --latest --platform android --profile production
+```
+
 ## Environment Variables Reference
 
 | Variable | Description |

package/dist/chunk-K4B4LODJ.js

@@ -0,0 +1,54 @@
+import{a as u,g as R}from"./chunk-YZYFEHP5.js";import{log as n,spinner as z,text as D,password as ie,select as H,confirm as Ve,isCancel as v,cancel as x,intro as Ne,outro as Ge,note as Ae}from"@clack/prompts";import{log as k,spinner as te,text as W,select as q,isCancel as N,cancel as O,note as ne,confirm as pe}from"@clack/prompts";import V from"chalk";import{spawnSync as ee}from"child_process";import Z from"fs";import F from"path";import oe from"os";var be="cmVxdWlyZSAnc3BhY2VzaGlwJwpyZXF1aXJlICdqc29uJwoKZGVmIGxpc3Rfa2V5cwogIGJlZ2luCiAgICBTcGFjZXNoaXA6OlBvcnRhbC5sb2dpbihFTlZbJ0ZBU1RMQU5FX1VTRVInXSkKICAgIFNwYWNlc2hpcDo6UG9ydGFsLnNlbGVjdF90ZWFtKHRlYW1faWQ6IEVOVlsnRkFTVExBTkVfVEVBTV9JRCddKQogICAgCiAgICAjIExvZ2luIHRvIFR1bmVzIChBcHAgU3RvcmUgQ29ubmVjdCkgYW5kIHNlbGVjdCB0aGUgc2FtZSB0ZWFtCiAgICBTcGFjZXNoaXA6OlR1bmVzLmxvZ2luKEVOVlsnRkFTVExBTkVfVVNFUiddKQogICAgU3BhY2VzaGlwOjpUdW5lcy5zZWxlY3RfdGVhbSh0ZWFtX2lkOiBFTlZbJ0ZBU1RMQU5FX1RFQU1fSUQnXSkKICAgIAogICAgIyBVc2UgVHVuZXMgY2xpZW50IHdoaWNoIHBvaW50cyB0byBhcHBzdG9yZWNvbm5lY3QuYXBwbGUuY29tCiAgICBjbGllbnQgPSBTcGFjZXNoaXA6OlR1bmVzLmNsaWVudAogICAgIyBVc2Ugcm9vdC1yZWxhdGl2ZSBVUkwgdG8gcmVwbGFjZSB0aGUgZGVmYXVsdCBUdW5lcyBwYXRoICgvV2ViT2JqZWN0cy8uLi4pCiAgICByZXNwb25zZSA9IGNsaWVudC5yZXF1ZXN0KDpnZXQsICcvaXJpcy92MS9hcGlLZXlzJykKICAgIAogICAgaWYgcmVzcG9uc2UuYm9keS5uaWw/IHx8ICFyZXNwb25zZS5ib2R5LmlzX2E/KEhhc2gpCiAgICAgIHJhaXNlICJBUEkgcmV0dXJuZWQgZW1wdHkgb3IgaW52YWxpZCByZXNwb25zZSBib2R5IGZvciBsaXN0aW5nIGtleXMiCiAgICBlbmQKICAgIAogICAgJHN0ZGVyci5wdXRzICJERUJVRzogRnVsbCBMaXN0IFJlc3BvbnNlOiAje3Jlc3BvbnNlLmJvZHkudG9fanNvbn0iCiAgICAKICAgIGtleXMgPSByZXNwb25zZS5ib2R5WydkYXRhJ10gfHwgW10KICAgIAogICAgb3V0cHV0ID0ga2V5cy5tYXAgZG8gfGt8CiAgICAgIGF0dHIgPSBrWydhdHRyaWJ1dGVzJ10gfHwge30KICAgICAgewogICAgICAgIGlkOiBrWydpZCddLAogICAgICAgIG5hbWU6IGF0dHJbJ25hbWUnXSwKICAgICAgICBpc3N1ZXJJZDogYXR0clsnaXNzdWVySWQnXSwKICAgICAgICByb2xlOiBhdHRyWydyb2xlcyddJi5maXJzdCwKICAgICAgICByZXZvY2FibGU6IGF0dHJbJ3Jldm9jYWJsZSddCiAgICAgIH0KICAgIGVuZAogICAgCiAgICBwdXRzICJfX19NQUNIX0pTT05fU1RBUlRfX18iICsgb3V0cHV0LnRvX2pzb24gKyAiX19fTUFDSF9KU09OX0VORF9fXyIKICByZXNjdWUgPT4gZQogICAgJHN0ZGVyci5wdXRzICJFUlJPUjogI3tlLm1lc3NhZ2V9IgogICAgaWYgZGVmaW5lZD8ocmVzcG9uc2UpICYmIHJlc3BvbnNlICYmIHJlc3BvbnNlLmJvZHkKICAgICAgJHN0ZGVyci5wdXRzICJSZXNwb25zZSBCb2R5OiAje3Jlc3BvbnNlLmJvZHkudG9fanNvbn0iCiAgICBlbmQKICAgIGV4aXQgMQogIGVuZAplbmQKCmRlZiBjcmVhdGVfa2V5KG5hbWUsIHJvbGUgPSAnQURNSU4nKQogIGJlZ2luCiAgICBTcGFjZXNoaXA6OlBvcnRhbC5sb2dpbihFTlZbJ0ZBU1RMQU5FX1VTRVInXSkKICAgIFNwYWNlc2hpcDo6UG9ydGFsLnNlbGVjdF90ZWFtKHRlYW1faWQ6IEVOVlsnRkFTVExBTkVfVEVBTV9JRCddKQogICAgCiAgICBTcGFjZXNoaXA6OlR1bmVzLmxvZ2luKEVOVlsnRkFTVExBTkVfVVNFUiddKQogICAgU3BhY2VzaGlwOjpUdW5lcy5zZWxlY3RfdGVhbSh0ZWFtX2lkOiBFTlZbJ0ZBU1RMQU5FX1RFQU1fSUQnXSkKICAgIAogICAgY2xpZW50ID0gU3BhY2VzaGlwOjpUdW5lcy5jbGllbnQKICAgIAogICAgIyBUcnVuY2F0ZSBuaWNrbmFtZSB0byAzMCBjaGFycyBhcyBwZXIgQXBwbGUncyBsaW1pdAogICAgIyBXZSBrZWVwIHRoZSBvcmlnaW5hbCAnbmFtZScgZm9yIGxvZ2dpbmcgYnV0IHNlbmQgdHJ1bmNhdGVkICduaWNrbmFtZScgdG8gQVBJCiAgICBzYWZlX25pY2tuYW1lID0gbmFtZVswLCAzMF0KICAgIAogICAgcGF5bG9hZCA9IHsKICAgICAgZGF0YTogewogICAgICAgIHR5cGU6ICJhcGlLZXlzIiwKICAgICAgICBhdHRyaWJ1dGVzOiB7CiAgICAgICAgICBuaWNrbmFtZTogc2FmZV9uaWNrbmFtZSwKICAgICAgICAgIGtleVR5cGU6ICJQVUJMSUNfQVBJIiwKICAgICAgICAgIHJvbGVzOiBbcm9sZV0sCiAgICAgICAgICBhbGxBcHBzVmlzaWJsZTogdHJ1ZQogICAgICAgIH0KICAgICAgfQogICAgfQogICAgCiAgICByZXNwb25zZSA9IGNsaWVudC5yZXF1ZXN0KDpwb3N0KSBkbyB8cmVxfAogICAgICByZXEudXJsICIvaXJpcy92MS9hcGlLZXlzIgogICAgICByZXEuYm9keSA9IHBheWxvYWQudG9fanNvbgogICAgICByZXEuaGVhZGVyc1snQ29udGVudC1UeXBlJ10gPSAnYXBwbGljYXRpb24vanNvbicKICAgICAgcmVxLmhlYWRlcnNbJ0FjY2VwdCddID0gJ2FwcGxpY2F0aW9uL3ZuZC5hcGkranNvbiwgYXBwbGljYXRpb24vanNvbiwgdGV4dC9qYXZhc2NyaXB0LCAqLyo7IHE9MC4wMScKICAgICAgcmVxLmhlYWRlcnNbJ1gtUmVxdWVzdGVkLVdpdGgnXSA9ICdYTUxIdHRwUmVxdWVzdCcKICAgICAgcmVxLmhlYWRlcnNbJ1JlZmVyZXInXSA9ICdodHRwczovL2FwcHN0b3JlY29ubmVjdC5hcHBsZS5jb20vYWNjZXNzL2FwaScKICAgICAgcmVxLmhlYWRlcnNbJ1gtQXBwbGUtV2lkZ2V0LUtleSddID0gY2xpZW50LndpZGdldF9rZXkgaWYgY2xpZW50LnJlc3BvbmRfdG8/KDp3aWRnZXRfa2V5KQogICAgZW5kCiAgICAKICAgICMgREVCVUc6IEluc3BlY3QgdGhlIHJhdyByZXNwb25zZSBvYmplY3QKICAgICRzdGRlcnIucHV0cyAiREVCVUc6IFJlc3BvbnNlIENsYXNzOiAje3Jlc3BvbnNlLmNsYXNzfSIKICAgICRzdGRlcnIucHV0cyAiREVCVUc6IFJlc3BvbnNlIEhlYWRlcnM6ICN7cmVzcG9uc2UuaGVhZGVyc30iCiAgICAkc3RkZXJyLnB1dHMgIkRFQlVHOiBSZXNwb25zZSBCb2R5OiAje3Jlc3BvbnNlLmJvZHkudG9fanNvbn0iCiAgICAKICAgIGlmIHJlc3BvbnNlLmJvZHkubmlsPyB8fCAhcmVzcG9uc2UuYm9keS5pc19hPyhIYXNoKSB8fCByZXNwb25zZS5ib2R5WydkYXRhJ10ubmlsPwogICAgICBlcnJvcl9tc2cgPSAiQVBJIGZhaWxlZCB0byBjcmVhdGUga2V5LiIKICAgICAgaWYgcmVzcG9uc2UuYm9keSAmJiByZXNwb25zZS5ib2R5WydlcnJvcnMnXQogICAgICAgIGVycm9yX21zZyArPSAiIEVycm9yczogIiArIHJlc3BvbnNlLmJvZHlbJ2Vycm9ycyddLm1hcHt8ZXwgZVsnZGV0YWlsJ119LmpvaW4oJywgJykKICAgICAgZW5kCiAgICAgIHJhaXNlIGVycm9yX21zZwogICAgZW5kCiAgICAKICAgIGtleV9kYXRhID0gcmVzcG9uc2UuYm9keVsnZGF0YSddCiAgICBhdHRyID0ga2V5X2RhdGFbJ2F0dHJpYnV0ZXMnXSB8fCB7fQoKICAgICMgVGhlIC5wOCBjb250ZW50IGlzIHVzdWFsbHkgaW4gJ3ByaXZhdGVLZXknIG9yICdrZXlDb250ZW50JyBvbiB0aGUgSU5JVElBTCBDUkVBVEUgcmVzcG9uc2UKICAgIHA4X2NvbnRlbnQgPSBhdHRyWydwcml2YXRlS2V5J10gfHwgYXR0clsna2V5Q29udGVudCddCiAgICAKICAgIGlmIHA4X2NvbnRlbnQubmlsPwogICAgICAkc3RkZXJyLnB1dHMgIkRFQlVHOiBLZXkgY29udGVudCBtaXNzaW5nIGluIHJlc3BvbnNlLiBBdHRlbXB0aW5nIHJldHJpZXZhbCB2aWEgZG93bmxvYWQvZXhwb3J0IGVuZHBvaW50cy4uLiIgCiAgICAgIAogICAgICBwYXRoc190b190cnkgPSBbCiAgICAgICAgImh0dHBzOi8vYXBwc3RvcmVjb25uZWN0LmFwcGxlLmNvbS9pcmlzL3YxL2FwaUtleXMvI3trZXlfZGF0YVsnaWQnXX0vZG93bmxvYWQiLAogICAgICAgICJodHRwczovL2FwcHN0b3JlY29ubmVjdC5hcHBsZS5jb20vaXJpcy92MS9hcGlLZXlzLyN7a2V5X2RhdGFbJ2lkJ119L2V4cG9ydCIKICAgICAgXQogICAgICAKICAgICAgcGF0aHNfdG9fdHJ5LmVhY2ggZG8gfHBhdGh8CiAgICAgICAgYmVnaW4KICAgICAgICAgICRzdGRlcnIucHV0cyAiREVCVUc6IFRyeWluZyAje3BhdGh9Li4uIgogICAgICAgICAgZG93bmxvYWRfcmVzcCA9IGNsaWVudC5yZXF1ZXN0KDpnZXQpIGRvIHxyZXF8CiAgICAgICAgICAgIHJlcS51cmwgcGF0aAogICAgICAgICAgICByZXEuaGVhZGVyc1snQWNjZXB0J10gPSAnYXBwbGljYXRpb24vdm5kLmFwaStqc29uLCBhcHBsaWNhdGlvbi9qc29uLCB0ZXh0L2phdmFzY3JpcHQsICovKjsgcT0wLjAxJwogICAgICAgICAgICByZXEuaGVhZGVyc1snWC1SZXF1ZXN0ZWQtV2l0aCddID0gJ1hNTEh0dHBSZXF1ZXN0JwogICAgICAgICAgICByZXEuaGVhZGVyc1snUmVmZXJlciddID0gJ2h0dHBzOi8vYXBwc3RvcmVjb25uZWN0LmFwcGxlLmNvbS9hY2Nlc3MvYXBpJwogICAgICAgICAgZW5kCiAgICAgICAgICAkc3RkZXJyLnB1dHMgIkRFQlVHOiBSZXNwb25zZSBDbGFzczogI3tkb3dubG9hZF9yZXNwLmJvZHkuY2xhc3N9IgogICAgICAgICAgJHN0ZGVyci5wdXRzICJERUJVRzogUmVzcG9uc2UgU3RhdHVzOiAje2Rvd25sb2FkX3Jlc3Auc3RhdHVzfSIgaWYgZG93bmxvYWRfcmVzcC5yZXNwb25kX3RvPyg6c3RhdHVzKQogICAgICAgICAgCiAgICAgICAgICBpZiBkb3dubG9hZF9yZXNwLmJvZHkgJiYgIWRvd25sb2FkX3Jlc3AuYm9keS50b19zLmluY2x1ZGU/KCciZXJyb3JzIj0+JykKICAgICAgICAgICAgIGlmIGRvd25sb2FkX3Jlc3AuYm9keS5pc19hPyhIYXNoKQogICAgICAgICAgICAgICBwOF9jb250ZW50ID0gZG93bmxvYWRfcmVzcC5ib2R5WydrZXlDb250ZW50J10gfHwgZG93bmxvYWRfcmVzcC5ib2R5Wydjb250ZW50J10gfHwgZG93bmxvYWRfcmVzcC5ib2R5LmRpZygnZGF0YScsICdhdHRyaWJ1dGVzJywgJ3ByaXZhdGVLZXknKQogICAgICAgICAgICAgZWxzZQogICAgICAgICAgICAgICBwOF9jb250ZW50ID0gZG93bmxvYWRfcmVzcC5ib2R5CiAgICAgICAgICAgICBlbmQKICAgICAgICAgICAgIAogICAgICAgICAgICAgaWYgcDhfY29udGVudCAmJiBwOF9jb250ZW50LnRvX3Muc3RhcnRfd2l0aD8oJy0tLS0tQkVHSU4nKQogICAgICAgICAgICAgICAkc3RkZXJyLnB1dHMgIkRFQlVHOiBSZXRyaWV2YWwgdmlhICN7cGF0aH0gc3VjY2Vzc2Z1bCEgQ29udGVudCBsZW5ndGg6ICN7cDhfY29udGVudC50b19zLmxlbmd0aH0iCiAgICAgICAgICAgICAgIGJyZWFrCiAgICAgICAgICAgICBlbHNlCiAgICAgICAgICAgICAgICRzdGRlcnIucHV0cyAiREVCVUc6IFJlc3BvbnNlIGZyb20gI3twYXRofSBkaWQgbm90IGNvbnRhaW4gYSB2YWxpZCBwcml2YXRlIGtleS4iCiAgICAgICAgICAgICAgIHA4X2NvbnRlbnQgPSBuaWwKICAgICAgICAgICAgIGVuZAogICAgICAgICAgZWxzZQogICAgICAgICAgICAgJHN0ZGVyci5wdXRzICJERUJVRzogUmVzcG9uc2UgZnJvbSAje3BhdGh9IGVtcHR5IG9yIGNvbnRhaW5zIGVycm9ycy4iCiAgICAgICAgICBlbmQKICAgICAgICByZXNjdWUgPT4gZQogICAgICAgICAgJHN0ZGVyci5wdXRzICJERUJVRzogQXR0ZW1wdCBmb3IgI3twYXRofSBmYWlsZWQ6ICN7ZS5tZXNzYWdlfSIKICAgICAgICBlbmQKICAgICAgZW5kCiAgICBlbmQKCiAgICAjIEZJTkFMIFZBTElEQVRJT046IEVuc3VyZSBpdCdzIG5vdCBhIFJ1YnkgaGFzaCBzdHJpbmcgcmVwcmVzZW50YXRpb24gb3IgZXJyb3IKICAgIGlmIHA4X2NvbnRlbnQuaXNfYT8oSGFzaCkgfHwgcDhfY29udGVudC50b19zLmluY2x1ZGU/KCciZXJyb3JzIj0+JykgfHwgIXA4X2NvbnRlbnQudG9fcy5zdGFydF93aXRoPygnLS0tLS1CRUdJTicpCiAgICAgICRzdGRlcnIucHV0cyAiREVCVUc6IEludmFsaWQga2V5IGNvbnRlbnQgZGV0ZWN0ZWQuIgogICAgICBwOF9jb250ZW50ID0gbmlsCiAgICBlbmQKCiAgICBpZiBwOF9jb250ZW50Lm5pbD8KICAgICAgJHN0ZGVyci5wdXRzICJERUJVRzogRmFpbGVkIHRvIHJldHJpZXZlIGtleSBjb250ZW50LiIKICAgIGVuZAogICAgCiAgICByZXN1bHQgPSB7CiAgICAgIGlkOiBrZXlfZGF0YVsnaWQnXSwKICAgICAgbmFtZTogYXR0clsnbmlja25hbWUnXSB8fCBhdHRyWyduYW1lJ10sCiAgICAgIGlzc3VlcklkOiBhdHRyWydpc3N1ZXJJZCddLAogICAgICBrZXlDb250ZW50OiBwOF9jb250ZW50LAogICAgICByYXdfcmVzcG9uc2U6IHJlc3BvbnNlLmJvZHkgIyBJbmNsdWRlIHRoaXMgZm9yIGRlYnVnZ2luZyB3aGVuIGtleUNvbnRlbnQgaXMgbmlsCiAgICB9CiAgICAKICAgIHB1dHMgIl9fX01BQ0hfSlNPTl9TVEFSVF9fXyIgKyByZXN1bHQudG9fanNvbiArICJfX19NQUNIX0pTT05fRU5EX19fIgogIHJlc2N1ZSA9PiBlCiAgICAkc3RkZXJyLnB1dHMgIkVSUk9SOiAje2UubWVzc2FnZX0iCiAgICBpZiBkZWZpbmVkPyhyZXNwb25zZSkgJiYgcmVzcG9uc2UgJiYgcmVzcG9uc2UuYm9keQogICAgICAgJHN0ZGVyci5wdXRzICJSZXNwb25zZSBCb2R5OiAje3Jlc3BvbnNlLmJvZHkudG9fanNvbn0iCiAgICBlbmQKICAgIGV4aXQgMQogIGVuZAplbmQKCmRlZiBkZWxldGVfa2V5KGlkKQogIGJlZ2luCiAgICBTcGFjZXNoaXA6OlBvcnRhbC5sb2dpbihFTlZbJ0ZBU1RMQU5FX1VTRVInXSkKICAgIFNwYWNlc2hpcDo6UG9ydGFsLnNlbGVjdF90ZWFtKHRlYW1faWQ6IEVOVlsnRkFTVExBTkVfVEVBTV9JRCddKQogICAgCiAgICBTcGFjZXNoaXA6OlR1bmVzLmxvZ2luKEVOVlsnRkFTVExBTkVfVVNFUiddKQogICAgU3BhY2VzaGlwOjpUdW5lcy5zZWxlY3RfdGVhbSh0ZWFtX2lkOiBFTlZbJ0ZBU1RMQU5FX1RFQU1fSUQnXSkKICAgIAogICAgY2xpZW50ID0gU3BhY2VzaGlwOjpUdW5lcy5jbGllbnQKICAgIGNsaWVudC5yZXF1ZXN0KDpkZWxldGUsICIvaXJpcy92MS9hcGlLZXlzLyN7aWR9IikKICAgIHB1dHMgIlNVQ0NFU1MiCiAgcmVzY3VlID0+IGUKICAgICRzdGRlcnIucHV0cyAiRVJST1I6ICN7ZS5tZXNzYWdlfSIKICAgIGV4aXQgMQogIGVuZAplbmQKCmNvbW1hbmQgPSBBUkdWWzBdCmlmIGNvbW1hbmQgPT0gJ2xpc3QnCiAgbGlzdF9rZXlzCmVsc2lmIGNvbW1hbmQgPT0gJ2NyZWF0ZScKICBjcmVhdGVfa2V5KEFSR1ZbMV0gfHwgIk1hY2ggQVBJIEtleSAje1RpbWUubm93LnRvX2l9IikKZWxzaWYgY29tbWFuZCA9PSAnZGVsZXRlJwogIGRlbGV0ZV9rZXkoQVJHVlsxXSkKZW5kCg==";function ae(){let i=F.join(oe.tmpdir(),u.nameLower);Z.existsSync(i)||Z.mkdirSync(i,{recursive:!0});let e=F.join(i,"manage_asc_keys.rb");return Z.writeFileSync(e,Buffer.from(be,"base64").toString("utf-8"),{mode:493}),e}function se(){return{...process.env,PATH:`/usr/local/opt/ruby/bin:/usr/local/Cellar/fastlane/2.227.0/libexec/bin:${process.env.HOME}/.local/share/fastlane/3.4.0/bin:${process.env.PATH}`,GEM_HOME:process.env.FASTLANE_GEM_HOME||`${process.env.HOME}/.local/share/fastlane/3.4.0`,GEM_PATH:(process.env.FASTLANE_GEM_HOME||`${process.env.HOME}/.local/share/fastlane/3.4.0`)+":/usr/local/Cellar/fastlane/2.227.0/libexec",FASTLANE_INSTALLED_VIA_HOMEBREW:"true",CI:"1"}}var ue=async i=>{let e=te(),a=i.platform,o=`./${u.configFileName}`;if(!Z.existsSync(o)){k.error(`No ${u.configFileName} found. Run \`${u.nameLower} init\` or \`${u.nameLower} link\` first.`);return}let t=JSON.parse(Z.readFileSync(o,"utf-8")),{projectId:c}=t;if(!c){k.error(`${u.configFileName} is missing projectId.`);return}let s=i.file,p=a==="android"?i.packageName||i.bundleId:i.bundleId||t.ios?.bundleIdentifier||"*";if(a==="android"&&!p&&(p=await we(c,t),p===null))return;if(a==="ios"&&!s){let l=await q({message:"Manage App Store Connect API Key:",options:[{value:"magic",label:"\u2728 Create new automatically (EAS-Style)",hint:"Requires Apple ID + 2FA"},{value:"manual",label:"\u{1F50D} Configure manually",hint:"Provide existing .p8 file"},{value:"delete",label:"\u{1F5D1}\uFE0F  Delete an existing Key"}]});if(N(l)){O("Operation cancelled");return}if(l==="magic"){await Ze(c,t);return}if(l==="delete"){await ke(c,t);return}}if(!s){let l=a==="ios"?"https://appstoreconnect.apple.com/access/api":"https://console.cloud.google.com/apis/credentials";ne(`To submit to the ${a==="ios"?"App Store":"Google Play Store"}, you need a Service Key:
+
+1. Open: ${V.cyan(l)}
+`+(a==="ios"?`2. Generate an "App Store Connect API Key" with ${V.bold("Admin")} role.
+3. Download the ${V.bold(".p8")} file.`:`2. Create a "Service Account", generate a ${V.bold("JSON")} key.
+3. Download the ${V.bold(".json")} file.`),"Guided Setup"),e.start("Scanning for downloaded keys...");let m=Ee(a);if(e.stop(m.length>0?`Detected ${m.length} potential key(s)`:"No keys detected automatically"),m.length>0){let d=await q({message:"Found these potential keys. Use one of them?",options:[...m.map(g=>({value:g.path,label:`${F.basename(g.path)} (${g.location})`})),{value:"manual",label:"Enter path manually..."}]});if(N(d)){O("Operation cancelled");return}d!=="manual"&&(s=d)}if(!s){let d=await W({message:`Paste the path to your ${a==="ios"?".p8":".json"} file:`,validate:g=>Z.existsSync(g)?void 0:"File not found"});if(N(d)){O("Operation cancelled");return}s=d}}let A=i.issuerId,f=i.keyId;if(a==="ios"){if(!f&&s){let l=F.basename(s).match(/AuthKey_(.*)\.p8/);l&&(f=l[1],k.info(`Auto-detected Key ID from filename: ${V.green(f)}`))}if(!A){let l=await W({message:"Enter App Store Connect Issuer ID (Found on the Keys page):",validate:m=>m.length>0?void 0:"Issuer ID is required"});if(N(l)){O("Operation cancelled");return}A=l}if(!f){let l=await W({message:"Enter App Store Connect Key ID:",validate:m=>m.length>0?void 0:"Key ID is required"});if(N(l)){O("Operation cancelled");return}f=l}}if(a==="android"&&(!p||p==="*")){let l=await fe();if(l===null)return;p=l}await re(c,s,a,A,f,p)};async function we(i,e){let a=await ve(i);if(a.length>0){let t=await q({message:"Select Android package for this Google Play service key:",options:[...a.map(c=>({value:c,label:c})),{value:"manual",label:"Enter another package name..."}]});if(N(t))return O("Operation cancelled"),null;if(t==="manual")return fe();if(t!=="manual")return t}let o=Re(e);if(o){let t=await pe({message:`Use Android package from local config (${o})?`,initialValue:!0});if(N(t))return O("Operation cancelled"),null;if(t)return o}}async function fe(){let i=await W({message:"Android package name for this Google Play service key:",placeholder:"com.example.app",validate:e=>e.includes(".")?void 0:"Enter a valid package name"});return N(i)?(O("Operation cancelled"),null):i}async function ve(i){try{let a=(await R.get(`/credentials/${i}`)).data.credentials||[],o=new Set;for(let t of a)(t.platform==="android"||t.type==="android_keystore"||t.type==="google_service_account")&&t.bundleId&&t.bundleId!=="*"&&o.add(t.bundleId);return Array.from(o).sort()}catch(e){return k.warn(V.yellow(`Could not fetch saved Android package identifiers: ${e.message}`)),[]}}function Re(i){if(i.android?.package)return i.android.package;if(i.expo?.android?.package)return i.expo.android.package;let e=F.join(process.cwd(),"app.json");if(Z.existsSync(e))try{return JSON.parse(Z.readFileSync(e,"utf-8")).expo?.android?.package}catch{}let a=F.join(process.cwd(),"app.config.json");if(Z.existsSync(a))try{let o=JSON.parse(Z.readFileSync(a,"utf-8"));return o.expo?.android?.package||o.android?.package}catch{}}async function Ze(i,e){let a=te(),o=e.submit?.production?.ios?.appleId,t=e.submit?.production?.ios?.appleTeamId;if(!o){let p=await W({message:"Apple ID:",placeholder:"your-email@example.com"});if(N(p))return;o=p,e.submit||(e.submit={production:{ios:{}}}),e.submit.production||(e.submit.production={ios:{}}),e.submit.production.ios||(e.submit.production.ios={}),e.submit.production.ios.appleId=o,Z.writeFileSync(`./${u.configFileName}`,JSON.stringify(e,null,2))}if(!t){let p=await W({message:"Apple Team ID:",placeholder:"e.g. 4523G95823"});if(N(p))return;t=p,e.submit||(e.submit={production:{ios:{}}}),e.submit.production||(e.submit.production={ios:{}}),e.submit.production.ios||(e.submit.production.ios={}),e.submit.production.ios.appleTeamId=t,Z.writeFileSync(`./${u.configFileName}`,JSON.stringify(e,null,2))}let c=await W({message:"Enter a name for the new API Key:",initialValue:`[${u.name}] Project ${i}`});if(N(c))return;a.start("Authenticating with Apple and creating API Key...");let s=ae();if(!Z.existsSync(s)){k.error(`Magic Error: Helper script not found at ${s}`);return}try{let p=ee("ruby",[s,"create",c],{env:{...se(),FASTLANE_USER:o,FASTLANE_TEAM_ID:t},stdio:["inherit","pipe","pipe"],encoding:"utf-8"}),A=p.stdout||"",f=p.stderr||"";if(f&&(f.includes("DEBUG:")||f.includes("ERROR:"))&&f.split(`
+`).forEach(b=>{b.trim()&&k.info(V.dim(`[Ruby] ${b.trim()}`))}),p.status!==0){a.stop("Failed"),k.error(`Magic creation failed: ${f}`);return}let l=A.match(new RegExp(`${u.jsonStartMarker}(.*)${u.jsonEndMarker}`));if(!l){a.stop("Parse Error"),k.error("Could not parse response from Apple Portal.");return}let m=JSON.parse(l[1]),{id:d,issuerId:g,keyContent:I}=m;if(a.stop("Key Created Successfully"),k.success(`\u2713 Created Key ID: ${V.green(d)}`),!g){ne(`Your Issuer ID is shown at the top of:
+  ${V.cyan("https://appstoreconnect.apple.com/access/integrations/api")}
+
+It looks like: ${V.dim("xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx")}`,"One More Thing");let b=await W({message:"Enter your App Store Connect Issuer ID:",validate:h=>h.trim().length>0?void 0:"Issuer ID is required"});if(N(b)){O("Operation cancelled.");return}g=b.trim()}if(I){let b=F.join(oe.tmpdir(),`AuthKey_${d}.p8`);Z.writeFileSync(b,I),await re(i,b,"ios",g,d,e.ios?.bundleIdentifier||"*"),Z.unlinkSync(b)}else{k.warn(V.yellow("\u26A0\uFE0F  Apple did not return the private key in the response.")),ne(`Download the .p8 file manually:
+
+  1. Open: ${V.cyan("https://appstoreconnect.apple.com/access/integrations/api")}
+  2. Find Key ID: ${V.green(d)}
+  3. Click ${V.bold("Download API Key")} (only available once)
+  4. Drag & drop the downloaded .p8 file below`,"Manual Step Required");let b=await W({message:"Path to the downloaded .p8 file (drag & drop here):",validate:h=>Z.existsSync(h)?void 0:"File not found"});if(N(b)){O("Operation cancelled. Credential ID was registered but key content is missing.");return}await re(i,b,"ios",g,d,e.ios?.bundleIdentifier||"*")}}catch(p){a.stop("Error"),k.error(`Error: ${p.message}`)}}async function ke(i,e){let a=te(),o=e.submit?.production?.ios?.appleId,t=e.submit?.production?.ios?.appleTeamId;if(!o){let s=await W({message:"Apple ID:"});if(N(s))return;o=s,e.submit||(e.submit={production:{ios:{}}}),e.submit.production||(e.submit.production={ios:{}}),e.submit.production.ios||(e.submit.production.ios={}),e.submit.production.ios.appleId=o,Z.writeFileSync(`./${u.configFileName}`,JSON.stringify(e,null,2))}if(!t){let s=await W({message:"Apple Team ID:"});if(N(s))return;t=s,e.submit||(e.submit={production:{ios:{}}}),e.submit.production||(e.submit.production={ios:{}}),e.submit.production.ios||(e.submit.production.ios={}),e.submit.production.ios.appleTeamId=t,Z.writeFileSync(`./${u.configFileName}`,JSON.stringify(e,null,2))}a.start("Fetching existing API Keys...");let c=ae();if(!Z.existsSync(c)){k.error(`Magic Error: Helper script not found at ${c}`);return}try{let s=ee("ruby",[c,"list"],{env:{...se(),FASTLANE_USER:o,FASTLANE_TEAM_ID:t},stdio:["inherit","pipe","pipe"],encoding:"utf-8"});if(s.status!==0){a.stop("Failed"),k.error(`Listing failed: ${s.stderr}`);return}let p=s.stdout.match(new RegExp(`${u.jsonStartMarker}(.*)${u.jsonEndMarker}`));if(!p){a.stop("Parse Error");return}let A=JSON.parse(p[1]);if(a.stop(`Found ${A.length} keys`),A.length===0){k.info("No API Keys found on this team.");return}let f=await q({message:"Select a key to delete from Apple Developer Portal:",options:[...A.map(d=>({value:d.id,label:`ID: ${d.id} - ${d.name} (${d.role})`})),{value:"cancel",label:"Cancel"}]});if(N(f)||f==="cancel")return;let l=await pe({message:`Are you sure you want to delete Key ${f}? This cannot be undone.`});if(!l||N(l))return;a.start(`Deleting Key ${f}...`);let m=ee("ruby",[ae(),"delete",f],{env:{...se(),FASTLANE_USER:o,FASTLANE_TEAM_ID:t},stdio:"pipe",encoding:"utf-8"});m.status===0?(a.stop("Deleted"),k.success(`\u2713 Key ${f} has been removed from Apple Portal.`)):(a.stop("Deletion Failed"),k.error(`Error: ${m.stderr}`))}catch(s){a.stop("Error"),k.error(`Error: ${s.message}`)}}async function re(i,e,a,o,t,c="*"){let s=te();s.start(`Uploading Service Credentials for ${a}...`);try{let p=a==="ios"?"asc_api_key":"google_service_account",A=new URL(import.meta.url),f=F.dirname(A.pathname),l=[F.join(f,"isolated-upload.js"),F.join(f,"commands","isolated-upload.js"),F.resolve(f,"../commands/isolated-upload.js"),F.resolve(process.cwd(),`node_modules/.bin/${u.nameLower}-upload`)],m="";for(let g of l)if(Z.existsSync(g)){m=g;break}if(!m)throw new Error("Could not locate isolated-upload.js. Ensure the CLI is properly installed.");let d=ee("node",[m,i,e,p,c,"service","undefined","undefined",o||"undefined",t||"undefined"],{stdio:"pipe",encoding:"utf-8",env:{...process.env,AT_CLI_ISOLATED:"1"}});if(d.status!==0){let g=d.stderr||d.stdout||"Unknown upload failure";s.stop("Upload Failed"),k.error(V.red(`Upload Failed: ${g}`));return}d.stdout.includes("SUCCESS")?(s.stop("Upload Success"),k.success(V.green(`\u2713 Service Credentials for ${a} uploaded successfully.`))):(s.stop("Upload Summary"),k.warn(V.yellow(`Upload finished but success not confirmed: ${d.stdout}`)))}catch(p){s.stop("Upload Error"),k.error(V.red(`Error: ${p.message}`))}}function Ee(i){let e=i==="ios"?".p8":".json",a=[],o=[{path:"./",label:"Project Root"},{path:F.join(oe.homedir(),"Downloads"),label:"Downloads"}];for(let t of o)if(Z.existsSync(t.path))try{let c=Z.readdirSync(t.path);for(let s of c)if(s.endsWith(e)){if(i==="android"&&!Z.readFileSync(F.join(t.path,s),"utf8").includes("service_account")||i==="ios"&&!s.startsWith("AuthKey"))continue;a.push({path:F.join(t.path,s),location:t.label})}}catch{}return a}import Ce from"axios";import r from"chalk";import{execSync as P,spawnSync as L}from"child_process";import ce from"crypto";import y from"fs";import E from"path";import ge from"os";Ce.defaults.proxy=!1;function le(i,e){if(!y.existsSync(i))return;let a=y.readdirSync(i);for(let o of a){let t=E.join(i,o);if(y.statSync(t).isDirectory()){let s=le(t,e);if(s)return s}else if(e.test(o))return t}}function Be(i,e,a){let o=y.readFileSync(a,"utf8"),t=Math.floor(Date.now()/1e3),c=Buffer.from(JSON.stringify({alg:"ES256",kid:i,typ:"JWT"})).toString("base64url"),s=Buffer.from(JSON.stringify({iss:e,iat:t,exp:t+1200,aud:"appstoreconnect-v1"})).toString("base64url"),p=`${c}.${s}`,A=ce.createSign("SHA256");A.update(p);let f=A.sign({key:o,dsaEncoding:"ieee-p1363"}).toString("base64url");return`${p}.${f}`}async function Fe(i,e,a,o){let t=Be(e,a,o),c=(await import("axios")).default;for(let s of i)try{await c.post("https://api.appstoreconnect.apple.com/v1/devices",{data:{type:"devices",attributes:{name:s.name,udid:s.udid,platform:"IOS"}}},{headers:{Authorization:`Bearer ${t}`,"Content-Type":"application/json"}}),n.info(r.dim(`  \u2713 Registered: ${s.name}`))}catch(p){let A=p.response?.data?.errors;A?.some(l=>l.code==="ENTITY_ERROR.ATTRIBUTE.INVALID.DUPLICATE"||l.detail?.toLowerCase().includes("already registered")||l.detail?.toLowerCase().includes("already exists"))?n.info(r.dim(`  Already on Portal: ${s.name}`)):n.warn(r.yellow(`  Could not register ${s.name}: ${A?.[0]?.detail||p.message}`))}}var me=async i=>{Ne(r.bgCyan.black(u.cliTag("Credentials")));let e=await H({message:"Select platform:",options:[{value:"ios",label:"iOS"},{value:"android",label:"Android"}]});v(e)&&(x("Operation cancelled"),process.exit(0));let a=await H({message:"What do you want to do?",options:[{value:"setup",label:"Build Credentials (Certs/Profiles)",hint:"Manage everything needed to build your project"},{value:"download",label:"Download credentials (credentials.json)",hint:"Sync credentials from Dashboard to local project"},{value:"service",label:"App Store Connect API Key (Magic)",hint:"Manage your API Key for automated submission"},{value:"push",label:"Push Notifications (Placeholder)",hint:"Manage your Apple Push Notifications Key"},{value:"back",label:"Go back"},{value:"exit",label:"Exit"}].filter(o=>!(e==="android"&&(o.value==="service"&&(o.label="Google Service Account (JSON)"),o.value==="push")))});if((v(a)||a==="exit")&&(x("Operation cancelled"),process.exit(0)),a==="back")return me(i);if(a==="setup")await xe({...i,platform:e});else if(a==="download")await We({...i,platform:e});else if(a==="service")await ue({platform:e});else if(a==="push")return Ae("Push Notifications management is coming soon!","Coming Soon"),me(i);Ge(r.green("Done!"))},xe=async i=>{let e=z(),a=i.platform,o=i.profile;if(!o){let p=await H({message:"Select credential type:",options:[{value:"development",label:"Development",hint:"Local testing & simulators"},{value:"staging",label:"Ad Hoc / Staging",hint:"Internal distribution & device testing"},{value:"production",label:"Production / App Store",hint:"App Store & Play Store submission"}]});v(p)&&(x("Operation cancelled"),process.exit(0)),o=p}let t=`./${u.configFileName}`;if(!y.existsSync(t)){n.error(`No ${u.configFileName} found. Run \`${u.nameLower} init\` or \`${u.nameLower} link\` first.`);return}let c=JSON.parse(y.readFileSync(t,"utf-8")),{projectId:s}=c;if(!s){n.error(`${u.configFileName} is missing projectId.`);return}i.awsProfile&&n.warn(r.yellow(`Ignoring --aws-profile. Authenticating with ${u.name} Cloud...`)),n.info(r.dim(`Setting up credentials for: ${o}`)),a==="ios"?await _e(s,o,i,c):await Xe(s,o,o==="production"?"store":"internal",i)};async function _e(i,e,a,o){let t=a.bundleId;if(!t){let A=o.submit?.production?.ios?.bundleId||o.ios?.bundleId,f=[];try{let m=(await R.get(`/credentials/${i}`)).data.credentials||[];f=[...new Set(m.filter(d=>d.platform==="ios"&&d.bundleId&&d.bundleId!=="*").map(d=>d.bundleId))]}catch{}if(A&&!f.includes(A)&&f.unshift(A),f.length>0){let l=[...f.map(d=>({value:d,label:d,hint:d===A?"from config":void 0})),{value:"__new__",label:"+ Enter a new Bundle ID"}],m=await H({message:"Which Bundle ID are you setting up credentials for?",options:l});if(v(m)&&(x("Operation cancelled"),process.exit(0)),m==="__new__"){let d=await D({message:"iOS Bundle ID (e.g. com.example.app):",placeholder:"com.example.app",validate:g=>g.includes(".")?void 0:"Please enter a valid Bundle ID"});v(d)&&(x("Operation cancelled"),process.exit(0)),t=d}else t=m}else{let l=await D({message:"iOS Bundle ID (e.g. com.example.app):",placeholder:"com.example.app",validate:m=>m.includes(".")?void 0:"Please enter a valid Bundle ID"});v(l)&&(x("Operation cancelled"),process.exit(0)),t=l}}n.info(r.dim(`Bundle ID: ${t}`));let c=e==="production"?"store":e==="staging"?"adhoc":"development",s=o.submit?.production?.ios?.appleId;s&&n.info(r.dim(`Using Apple ID from config: ${s}`)),await Pe(i,t,e,c,c==="store"?"appstore":c==="adhoc"?"adhoc":"development",a,o,s)}async function $e(i){let e="MATCH_ENCRYPTION_PASSPHRASE";try{let s=((await R.get(`/projects/${i}/secrets/export?env=development`)).data.secrets||{})[e];if(s&&!s.includes("[Decryption Failed]"))return n.info(r.dim("Using existing encryption passphrase from Dashboard")),n.info(r.cyan(`MATCH_PASSWORD: ${s}`)),s;if(s&&s.includes("[Decryption Failed]")){n.warn(r.yellow("\u26A0\uFE0F  Existing MATCH_PASSWORD could not be decrypted (encryption key changed).")),n.info(r.dim("Generating a fresh passphrase and cleaning old certificates..."));let p=ce.randomBytes(32).toString("base64");try{await R.post(`/projects/${i}/secrets`,{key:e,value:p,type:"managed",description:"Encryption passphrase for iOS certificates (fastlane match)",visibility:"secret"}),n.success(r.green("\u2713 New encryption passphrase generated and saved"))}catch{}try{await R.post("/credentials/clean-match-storage",{projectId:i}),n.success(r.green("\u2713 Cleaned old certificates from storage"))}catch{}return p}}catch(t){n.info(r.dim(`Could not fetch existing passphrase from Dashboard: ${t.message}`))}let a=await H({message:"No active encryption passphrase found on Dashboard. What would you like to do?",options:[{value:"generate",label:"Generate a new secure passphrase",hint:"Safe for first-time setup"},{value:"enter",label:"Enter existing passphrase manually",hint:"Required if you already have certs in S3"},{value:"cancel",label:"Cancel",hint:"Quit"}]});if((v(a)||a==="cancel")&&(x("Operation cancelled"),process.exit(0)),a==="enter"){let t=await ie({message:"Enter your MATCH_PASSWORD (encryption passphrase):",validate:s=>s.length>0?void 0:"Passphrase is required"});v(t)&&(x("Operation cancelled"),process.exit(0));let c=t;try{await R.post(`/projects/${i}/secrets`,{key:e,value:c,type:"managed",description:"Encryption passphrase for iOS certificates (fastlane match)"}),n.success(r.green("\u2713 Saved passphrase to Dashboard"))}catch{}return c}let o=ce.randomBytes(32).toString("base64");try{await R.post(`/projects/${i}/secrets`,{key:e,value:o,type:"managed",description:"Encryption passphrase for iOS certificates (fastlane match)",visibility:"secret"}),n.success(r.green("\u2713 Generated and saved encryption passphrase to Dashboard")),n.info(r.cyan(`MATCH_PASSWORD: ${o}`))}catch(t){n.warn(r.yellow(`Could not save passphrase to Dashboard: ${t.message}`))}return o}async function Pe(i,e,a,o,t,c,s,p){let A=z();n.info(r.blue("Configuring iOS certificate management..."));let f;if(!p){let l=await D({message:"Apple ID (for Apple Developer Portal):",placeholder:"your-email@example.com",validate:m=>m.includes("@")?void 0:"Please enter a valid email"});v(l)&&(x("Operation cancelled"),process.exit(0)),p=l,s.submit||(s.submit={production:{ios:{}}}),s.submit.production||(s.submit.production={ios:{}}),s.submit.production.ios||(s.submit.production.ios={}),s.submit.production.ios.appleId=p,y.writeFileSync(`./${u.configFileName}`,JSON.stringify(s,null,2)),n.success(r.green("\u2713 Apple ID saved to config"))}A.start(`Fetching ${t} certificates...`);try{let l=await $e(i),m="",d="";try{let h=await R.post("/credentials/build-server-token",{projectId:i});h.data.status==="success"&&h.data.credentials&&(process.env.AWS_ACCESS_KEY_ID=h.data.credentials.accessKeyId,process.env.AWS_SECRET_ACCESS_KEY=h.data.credentials.secretAccessKey,h.data.credentials.sessionToken&&(process.env.AWS_SESSION_TOKEN=h.data.credentials.sessionToken),d=h.data.credentials.region||"ap-south-1",m=h.data.credentials.bucket||u.bucketPrefix,process.env.AWS_REGION=d,delete process.env.AWS_PROFILE)}catch(h){throw n.error(`Failed to authenticate with ${u.name} Cloud.`),h}if(!m||!d){n.error(`Failed to resolve S3 configuration from ${u.name} Cloud.`);return}let g=c.teamId||s.submit?.production?.ios?.appleTeamId;if(!g)try{let X=(await R.get(`/projects/${i}/secrets`)).data.secrets?.find(J=>J.key==="APPLE_TEAM_ID");X&&(g=X.value,n.info(r.dim(`Using Team ID from Dashboard: ${g}`)))}catch{}if(g&&g===s.submit?.production?.ios?.appleTeamId&&n.info(r.dim(`Using Apple Team ID from config: ${g}`)),!g){n.warn(r.yellow(`
+Apple Team ID is required to fetch certificates.`)),n.info(r.dim("You can find this at: https://developer.apple.com/account \u2192 Membership Details"));let h=await D({message:"Enter your 10-character Apple Team ID:",placeholder:"e.g. SA56KTS33U",validate:X=>X.length===10?void 0:"Team ID must be exactly 10 characters"});v(h)&&(x("Operation cancelled"),process.exit(0)),g=h,await Ie(i,g)}A.stop("Starting certificate sync...");let I=`${u.buildPrefix}-${g}.keychain-db`,b=u.keychainPassword;try{let X=`${process.env.HOME||"/Users/"+(process.env.USER||u.nameLower)}/Library/Keychains/${I}`;n.info(r.dim(`Ensuring keychain exists: ${I}`));try{P(`security create-keychain -p ${b} ${I} 2>/dev/null || true`),P(`security unlock-keychain -p ${b} ${I}`),P(`security set-keychain-settings ${I}`);let S=P("security list-keychains -d user").toString();if(!S.includes(I)){n.info(r.dim(`Adding ${I} to search list`));let C=[...S.replace(/"/g,"").split(`
+`).map(G=>G.trim()).filter(G=>G.length>0),X].join(" ");P(`security list-keychains -d user -s ${C}`)}}catch(S){n.warn(r.dim("Keychain setup warning (non-critical): "+S.message))}let J,K;try{let w=((await R.get(`/credentials/${i}`)).data.credentials||[]).find(C=>C.type==="asc_api_key"&&C.issuerId);if(w){let C=await R.get(`/credentials/${w.credentialId}/download`,{params:{projectId:i}});if(C.data.downloadUrl){let B=await(await import("axios")).default.get(C.data.downloadUrl,{responseType:"arraybuffer"}),U=E.join(ge.tmpdir(),`mach-asc-${Date.now()}`);y.mkdirSync(U,{recursive:!0}),f=E.join(U,`AuthKey_${w.keyId}.p8`),y.writeFileSync(f,Buffer.from(B.data)),J=w.keyId,K=w.issuerId,n.success(r.green("\u2713 ASC API key loaded \u2014 no 2FA required for Portal operations"))}}}catch(S){n.warn(r.dim(`Could not load ASC API key: ${S.message}. Will fall back to Apple ID auth.`))}n.info(r.dim("Generating secure P12 export password..."));let M=he();n.success(r.green("\u2713 Secure P12 password generated."));let _={...process.env,AWS_REGION:process.env.AWS_REGION||"ap-south-1",AWS_ACCESS_KEY_ID:process.env.AWS_ACCESS_KEY_ID,AWS_SECRET_ACCESS_KEY:process.env.AWS_SECRET_ACCESS_KEY,SSL_CERT_FILE:"/etc/ssl/cert.pem",AWS_CA_BUNDLE:"/etc/ssl/cert.pem",FASTLANE_SSL_CA_CERT:"/etc/ssl/cert.pem",MATCH_PASSWORD:l,FASTLANE_USER:p,FASTLANE_SKIP_UPDATE_CHECK:"1",FASTLANE_TEAM_ID:g,MATCH_KEYCHAIN_NAME:X,MATCH_KEYCHAIN_PASSWORD:b,TERM:process.env.TERM||"xterm-256color",SHELL:process.env.SHELL||"/bin/zsh",MATCH_OUTPUT_PATH:E.join(process.cwd(),"temp_match"),MATCH_STORAGE_MODE:"s3",MATCH_S3_REGION:d,MATCH_S3_BUCKET:m,MATCH_S3_OBJECT_PREFIX:"ios-certificates/",MATCH_USERNAME:p,MATCH_APP_IDENTIFIER:e,MATCH_TYPE:t,[`${u.envPrefix}P12_PASSWORD`]:M,...f&&J&&K?{APP_STORE_CONNECT_API_KEY_KEY_ID:J,APP_STORE_CONNECT_API_KEY_ISSUER_ID:K,APP_STORE_CONNECT_API_KEY_KEY_FILEPATH:f,FASTLANE_SKIP_2FA:"1"}:{}};if(c.force){n.warn(r.yellow(`
+\u26A0\uFE0F  Force flag detected: Hard resetting ${t} certificates...`)),n.info(r.dim("Detected decryption failure loop. Clearing remote storage directly to allow fresh generation.")),n.info(r.cyan(`Current MATCH_PASSWORD: ${l}`)),n.info(r.dim(`Cleaning match storage for Team ID: ${g}...`));try{(await R.post("/credentials/clean-match-storage",{projectId:i,teamId:g})).data.status==="success"&&n.success(r.green(`\u2713 Cleared S3 storage for Team ID: ${g}`))}catch(S){n.warn(r.yellow(`S3 cleanup via API failed: ${S.message}`)),n.info(r.dim("Continuing to attempt standard nuke..."))}try{P(`fastlane match nuke ${t} --skip_confirmation`,{stdio:"inherit",cwd:process.cwd(),env:_}),n.success(r.green(`\u2713 Nuked existing ${t} credentials`))}catch{n.warn(r.yellow("Standard nuke failed (likely due to password mismatch).")),n.info(r.dim("Since S3 was cleared manually, proceeding to generation..."))}}if(t==="adhoc"||t==="development")try{n.info(r.blue("Fetching registered devices..."));let w=(await R.get("/devices")).data.devices||[];if(w.length===0)n.warn(r.yellow("No registered devices found. Profile will only include devices already on the Apple Developer Portal.")),n.info(r.dim(`Register devices with: ${u.nameLower} device register`));else{let{multiselect:C}=await import("@clack/prompts"),G=await C({message:`Select devices to include in the ${t} profile:`,options:w.map(B=>({value:B.udid,label:`${B.name} (${B.udid.substring(0,12)}...)`,hint:B.model||B.platform})),initialValues:w.map(B=>B.udid)});if(!v(G)&&G.length>0){let B=w.filter(U=>G.includes(U.udid));if(n.info(r.blue(`Registering ${B.length} device(s) on Apple Developer Portal...`)),f&&J&&K)await Fe(B,J,K,f);else{n.info(r.dim("You will be prompted for a 2FA code once \u2014 type it and press Enter."));for(let U of B){let Se=U.name.replace(/"/g,'\\"');L(`fastlane run register_device name:"${Se}" udid:"${U.udid}"`,{shell:!0,env:_,stdio:"inherit",cwd:process.cwd()})}}n.info(r.green("\u2713 Device registration complete."))}}}catch(S){n.warn(r.yellow(`Could not fetch registered devices: ${S.message}`)),n.info(r.dim("Continuing without explicit device registration."))}try{let S=L(`fastlane match ${t} --app_identifier "${e}" --profile_name "${u.nameLower} ${t} ${e}"`,{shell:!0,cwd:process.cwd(),env:_,stdio:"inherit",encoding:"utf-8"});if(S.status!==0){n.warn(r.yellow(`
+Certificate sync failed. Attempting to create App ID and retry...`));try{P(`fastlane produce --app_identifier "${e}" --app_name "${e}" --skip_itc`,{stdio:"inherit",env:_}),n.success(r.green("\u2713 App ID created successfully")),n.info(r.blue("Retrying certificate sync...")),S=L(`fastlane match ${t} --app_identifier "${e}" --profile_name "${u.nameLower} ${t} ${e}"`,{shell:!0,cwd:process.cwd(),env:_,stdio:"inherit",encoding:"utf-8"})}catch{}if(S.status!==0)throw new Error("fastlane match failed")}}catch(S){n.warn(r.yellow(`
+Sync failed. This often happens if the encryption passphrase (MATCH_PASSWORD) is incorrect or session expired.`)),n.info(r.cyan(`Failed MATCH_PASSWORD was: ${l}`));let w=await H({message:"What would you like to do?",options:[{value:"retry_password",label:"Retry with a different MATCH_PASSWORD",hint:"Manually enter the decryption passphrase"},{value:"check_portal",label:"Check Apple Portal (Resolve certificate limits)",hint:"See if you have too many certificates"},{value:"manual",label:"Fallback to manual upload",hint:"Provide .p12 and .mobileprovision files"},{value:"cancel",label:"Cancel",hint:"Go back"}]});if(v(w)||w==="cancel")throw S;if(w==="retry_password"){n.info(r.dim(`
+You are overriding the dashboard passphrase for this session.`));let C=await ie({message:"Enter the correct MATCH_PASSWORD for this project:"});if(C&&!v(C)){l=C,n.info(r.blue("Retrying with provided passphrase...")),n.info(r.cyan(`New MATCH_PASSWORD: ${l}`));let G={..._,MATCH_PASSWORD:l};if(L(`fastlane match ${t}`,{shell:!0,stdio:"inherit",cwd:process.cwd(),env:G}).status===0)await R.post(`/projects/${i}/secrets`,{key:"MATCH_ENCRYPTION_PASSPHRASE",value:l,description:"Encryption passphrase for iOS certificates (fastlane match)",visibility:"secret"}),n.success(r.green("\u2713 Dashboard passphrase updated.")),n.info(r.cyan(`MATCH_PASSWORD: ${l}`));else throw new Error("Sync failed again with provided passphrase.")}else throw S}else if(w==="check_portal")try{let C=await de(_,t);if(C.length>0){if(n.info(r.dim(`Found ${C.length} existing ${t} certificates on the portal.`)),await Oe(t,_,i,C)&&(n.info(r.blue("Retrying certificate sync...")),L(`fastlane match ${t}`,{shell:!0,stdio:"inherit",cwd:process.cwd(),env:_}).status!==0))throw new Error("Retry failed")}else throw n.error(r.red("No existing certificates found on portal to resolve.")),S}catch(C){throw n.warn(r.dim(`Portal check warning: ${C.message}`)),S}else throw S}n.success(r.green("\u2713 Certificates fetched and synced"));let $=E.join(process.cwd(),"temp_match"),T=E.join($,`${u.fastlanePrefix}_export.p12`),j=le($,/\.mobileprovision$/);try{let w=`${process.env.HOME||"/Users/"+(process.env.USER||u.nameLower)}/Library/Keychains/${I}`;y.existsSync($)||y.mkdirSync($,{recursive:!0}),n.info(r.dim("Exporting certificate from keychain for dashboard upload..."));let C=P(`security find-identity -v -p codesigning "${w}"`,{encoding:"utf-8"});n.info(r.dim(`Identities in keychain:
+${C.trim()}`)),P(`security export -k "${w}" -t identities -f pkcs12 -o "${T}" -P ""`,{stdio:"ignore"});try{let G=P(`openssl pkcs12 -in "${T}" -nokeys -passin pass: -legacy 2>/dev/null || openssl pkcs12 -in "${T}" -nokeys -passin pass: 2>/dev/null`,{encoding:"utf-8"});if(!G.includes(g))throw new Error(`Exported P12 does not contain identity for team ${g}. Found: ${G.substring(0,200)}`);n.success(r.green(`\u2713 P12 verified \u2014 contains correct team identity (${g})`))}catch(G){throw new Error(`P12 verification failed: ${G.message}`)}}catch{n.warn(r.dim("Could not export certificate from keychain."))}c.teamId&&!g&&await Ie(i,c.teamId);let Q=y.existsSync(T)?T:le($,/\.p12$/);if(Q&&j){let S,w;try{let C=await de(_,t);C.length>0&&(S=C[0].expires,w=C[0].id)}catch{n.warn(r.dim("Could not fetch expiration date or ID for dashboard record."))}await Y(i,Q,"ios_cert",e,o,void 0,S,c.teamId||g,w,M),await Y(i,j,"ios_profile",e,o,void 0,S,c.teamId||g),n.success(r.green("\u2713 Both iOS certificate and provisioning profile uploaded successfully"));try{y.existsSync("./temp_match")&&y.rmSync("./temp_match",{recursive:!0,force:!0})}catch{}}else n.warn(r.yellow("Certificates generated but not found in expected location.")),n.info(r.dim("Falling back to manual upload...")),await ye(i,e,o)}catch(h){A.stop("Certificate fetch failed"),n.error(r.red(`Error: ${h.message}`)),n.info(r.dim("Falling back to manual upload...")),await ye(i,e,o)}}catch(l){A.stop("iOS setup failed"),n.error(r.red(`Error: ${l.message}`))}finally{if(f)try{y.rmSync(E.dirname(f),{recursive:!0,force:!0})}catch{}}}async function Ie(i,e){try{await R.post(`/projects/${i}/secrets`,{key:"APPLE_TEAM_ID",value:e,description:"Apple Developer Team ID (used for iOS signing)"}),n.success(r.green(`\u2713 Saved Team ID ${e} to Dashboard`))}catch(a){n.warn(r.yellow(`Could not save Team ID to Dashboard: ${a.message}`))}}async function ye(i,e,a){n.info(r.yellow(`
+Manual Upload Mode`)),n.info("Please provide your certificate and provisioning profile:");let o=await D({message:"Path to .p12 certificate file:",validate:s=>y.existsSync(s)?void 0:"File not found"});v(o)&&(x("Operation cancelled"),process.exit(0));let t=await D({message:"Path to .mobileprovision file:",validate:s=>y.existsSync(s)?void 0:"File not found"});v(t)&&(x("Operation cancelled"),process.exit(0));let c=z();c.start(`Uploading to ${u.name} Dashboard...`);try{await Y(i,o,"ios_cert",e,a),await Y(i,t,"ios_profile",e,a),c.stop("Upload complete"),n.success(r.green("\u2713 iOS credentials uploaded successfully"))}catch(s){throw c.stop("Upload failed"),s}}async function Xe(i,e,a,o){let t=z();n.step(r.blue("Android Credential Setup"));let c=o.bundleId;if(!c){let l=[];try{let d=(await R.get(`/credentials/${i}`)).data.credentials||[];l=[...new Set(d.filter(g=>g.platform==="android"&&g.bundleId&&g.bundleId!=="*").map(g=>g.bundleId))]}catch{}if(l.length>0){let m=[...l.map(g=>({value:g,label:g})),{value:"__new__",label:"+ Enter a new Package Name"}],d=await H({message:"Which Package Name are you setting up credentials for?",options:m});if(v(d)&&(x("Operation cancelled"),process.exit(0)),d==="__new__"){let g=await D({message:"Android Package Name (e.g. com.example.app):",placeholder:"com.example.app",validate:I=>I.includes(".")?void 0:"Please enter a valid package name"});v(g)&&(x("Operation cancelled"),process.exit(0)),c=g}else c=d}else{let m=await D({message:"Android Package Name (e.g. com.example.app):",placeholder:"com.example.app",validate:d=>d.includes(".")?void 0:"Please enter a valid package name"});v(m)&&(x("Operation cancelled"),process.exit(0)),c=m}}try{let d=((await R.get(`/credentials/${i}`)).data.credentials||[]).find(g=>g.platform==="android"&&g.distributionType===a&&g.bundleId===c);if(d){n.warn(r.yellow(`\u26A0\uFE0F  Existing Android credentials found for ${a}`));let g=await D({message:"What would you like to do? (use/new/cancel)",validate:I=>{let b=I.toLowerCase();if(!(b==="use"||b==="new"||b==="cancel"))return"Please type: use, new, or cancel"}});if(v(g)||g.toLowerCase()==="cancel")return;if(g.toLowerCase()==="use"){n.success(r.green("\u2713 Using existing credentials."));return}await R.delete(`/credentials/${d.credentialId}?projectId=${i}`)}}catch{}let s="./android/app/my-release-key.jks";if(y.existsSync(s)){let l=await Ve({message:"Upload existing keystore?"});if(l&&!v(l)){let m=await D({message:"Key alias:",initialValue:"my-key-alias"});if(v(m))return;let d=await ie({message:"Keystore password:"});if(v(d))return;let g=await ie({message:"Key password (leave blank if same as keystore password):"});if(v(g))return;let I=g.trim()||d;await Y(i,s,"android_keystore",c,a,m,void 0,void 0,void 0,void 0,d,I),n.success(r.green("\u2713 Keystore uploaded"));return}}n.info(r.blue("Generating new Android keystore..."));let p=o.keyAlias||`${u.nameLower}-${Je()}`,A=he(),f=`./${u.nameLower}-${e}.jks`;y.existsSync(f)&&y.unlinkSync(f),t.start("Generating keystore...");try{let l=A.replace(/'/g,"'\\''");P(`keytool -genkeypair -v -keystore "${f}" -alias "${p}" -keyalg RSA -keysize 2048 -validity 10000 -storepass '${l}' -keypass '${l}' -dname "CN=${u.name} Build, OU=Mobile, O=Company, L=City, S=State, C=US"`,{stdio:"inherit"}),t.stop("Keystore generated"),await Y(i,f,"android_keystore",c,a,p,void 0,void 0,void 0,void 0,A,A),n.success(r.green("\u2713 Android credentials uploaded successfully")),n.info(r.cyan(`Key Alias: ${p}`))}catch(l){throw t.stop("Generation failed"),new Error(`Keystore generation failed: ${l.message}`)}}async function Y(i,e,a,o,t,c,s,p,A,f,l,m){let d=E.basename(e);n.info(r.dim(`Uploading ${d} (Isolated process)...`));let g=new URL(import.meta.url),I=E.dirname(g.pathname),b=E.join(I,"commands","isolated-upload.js"),h=L("node",[b,i,e,a,o,t,c||"undefined",s||"undefined",p||"undefined",A||"undefined",f||"undefined",l||"undefined",m||"undefined"],{stdio:"pipe",encoding:"utf-8",env:{...process.env,AT_CLI_ISOLATED:"1"}});if(h.status!==0){let X=h.stderr||h.stdout||"Unknown isolated upload failure";throw n.error(r.red(`Isolated Upload Failed: ${X}`)),new Error(X)}h.stdout.includes("SUCCESS")?n.info(r.dim(`\u2713 ${d} uploaded and registered.`)):n.warn(r.yellow(`Isolated upload finished but success not confirmed: ${h.stdout}`))}async function We(i){let e=z(),a=i.platform,o=`./${u.configFileName}`;if(!y.existsSync(o)){n.error(`No ${u.configFileName} found. Run \`${u.nameLower} init\` or \`${u.nameLower} link\` first.`);return}let t=JSON.parse(y.readFileSync(o,"utf-8")),{projectId:c}=t;if(!c){n.error(`${u.configFileName} is missing projectId.`);return}try{e.start("Fetching project secrets...");let p=(await R.get(`/projects/${c}/secrets/export?env=all`)).data.secrets||{};e.stop("Secrets fetched and merged."),e.start("Fetching credentials...");let f=(await R.get(`/credentials/${c}`)).data.credentials||[];e.stop(`Found ${f.length} metadata records.`);let l=f.filter(I=>I.platform===a);if(l.length===0){n.info(`No ${a} credentials found on Dashboard.`);return}let m="./credentials.json",d={};if(y.existsSync(m))try{d=JSON.parse(y.readFileSync(m,"utf-8"))}catch{n.warn("Could not parse existing credentials.json, creating a new one.")}d[a]||(d[a]={});let g=E.join(process.cwd(),"credentials",a);y.existsSync(g)||y.mkdirSync(g,{recursive:!0});for(let I of l){e.start(`Downloading ${I.type} (${I.distributionType})...`);try{let b=await R.get(`/credentials/${I.credentialId}/download?projectId=${c}`);if(b.data.status==="success"&&b.data.downloadUrl){let h=E.join(process.cwd(),"credentials",a,I.distributionType);y.existsSync(h)||y.mkdirSync(h,{recursive:!0});let X=I.s3Key?.split(".").pop()||(I.type.includes("keystore")?"jks":I.type.includes("cert")?"p12":"mobileprovision"),J=`${I.type}.${X}`,K=E.join(h,J),M=await Ce.get(b.data.downloadUrl,{responseType:"arraybuffer"});y.writeFileSync(K,Buffer.from(M.data));let _=E.join("credentials",a,I.distributionType,J);if(a==="android"){if(I.type==="android_keystore"){let $=I.distributionType==="store"?"PRODUCTION":I.distributionType==="internal"?"STAGING":"DEVELOPMENT",T=["PRODUCTION","STORE","INTERNAL","STAGING","DEVELOPMENT","RELEASE","DEBUG"],j=[`KEYSTORE_PASSWORD_${$}`,`KEYSTORE_PASSWORD_${I.distributionType.toUpperCase()}`,...T.map(C=>`KEYSTORE_PASSWORD_${C}`),"ANDROID_KEYSTONE_PASSWORD","KEYSTORE_PASSWORD"],Q=[`KEYSTORE_ALIAS_${$}`,`KEYSTORE_ALIAS_${I.distributionType.toUpperCase()}`,...T.map(C=>`KEYSTORE_ALIAS_${C}`),"KEYSTORE_ALIAS"],S=j.map(C=>p[C]).find(C=>!!C)||"",w=Q.map(C=>p[C]).find(C=>!!C)||I.meta?.alias||"";d.android.keystore={keystorePath:_,keystorePassword:S,keyAlias:w,keyPassword:S}}}else if(a==="ios"){let $=I.distributionType==="store"?"production":I.distributionType==="adhoc"?"staging":"development";d.ios[$]||(d.ios[$]={}),I.type==="ios_cert"?(d.ios[$].certificatePath=_,d.ios[$].certificatePassword=p.IOS_P12_PASSWORD||""):I.type==="ios_profile"&&(d.ios[$].provisioningProfilePath=_)}e.stop(`\u2713 ${I.type} (${I.distributionType}) saved.`)}}catch(b){let h=b.response?.data?.message||b.message;e.stop(r.dim(`- Skipped ${I.type} (${I.distributionType}): ${h}`))}}y.writeFileSync(m,JSON.stringify(d,null,2)),n.success(r.green("\u2713 Local credentials.json updated.")),Ae("Credentials have been synced to your local machine. Ensure credentials.json and credentials/ is added to your .gitignore.","Sync Complete")}catch(s){e.stop(r.red("Sync failed.")),n.error(`Error: ${s.message}`)}}function he(){let i="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_+=",e="";for(let a=0;a<24;a++)e+=i.charAt(Math.floor(Math.random()*i.length));return e}function Je(i=8){let e="abcdefghijklmnopqrstuvwxyz0123456789",a="";for(let o=0;o<i;o++)a+=e.charAt(Math.floor(Math.random()*e.length));return a}async function Oe(i,e,a,o){let t=o||await de(e,i);if(!t||t.length===0)return!1;let c=await H({message:"Select a certificate to revoke:",options:[...t.map(s=>({value:`revoke:${s.id}`,label:`Revoke: ${s.name} (${s.expires})`})),{value:"nuke",label:"Revoke All"},{value:"cancel",label:"Cancel"}]});return v(c)||c==="cancel"?!1:c==="nuke"?(P(`fastlane match nuke ${i}`,{stdio:"inherit",cwd:process.cwd(),env:e}),!0):typeof c=="string"&&c.startsWith("revoke:")?(await De(e,c.split(":")[1]),!0):!1}async function de(i,e){let a=e==="development"?"development":"distribution",o=`
+lane :${u.fastlanePrefix}_list_certs do
+  require 'spaceship'
+  require 'json'
+  begin
+    Spaceship::Portal.login(ENV['FASTLANE_USER'])
+    Spaceship::Portal.select_team(team_id: ENV['FASTLANE_TEAM_ID'])
+    output = Spaceship::Portal.certificate.all.select { |c|
+      if "${a}" == "development"
+        c.type_display_id.downcase.include?("development")
+      else
+        c.type_display_id.downcase.include?("distribution") || c.type_display_id.downcase.include?("production")
+      end
+    }.map { |c| { id: c.id, name: c.name, expires: c.expires.strftime('%Y-%m-%d'), type: c.type_display_id } }
+    puts "${u.jsonStartMarker}" + output.to_json + "${u.jsonEndMarker}"
+  rescue => e
+    $stderr.puts "ERROR: #{e.message}"
+    exit 1
+  end
+end`,t=E.join(ge.tmpdir(),`/tmp/${u.nameLower}-list-certs-${Date.now()}`),c=E.join(t,"fastlane"),s=E.join(c,"Fastfile");try{y.existsSync(c)||y.mkdirSync(c,{recursive:!0}),y.writeFileSync(s,o);let A=P(`fastlane ${u.fastlanePrefix}_list_certs`,{env:{...i,CI:"1",FASTLANE_FASTFILE:s},cwd:t,stdio:["inherit","pipe","inherit"]}).toString().match(new RegExp(`${u.jsonStartMarker}(.*)${u.jsonEndMarker}`));return A?JSON.parse(A[1]):[]}finally{y.existsSync(t)&&y.rmSync(t,{recursive:!0,force:!0})}}async function De(i,e){let a=`
+lane :${u.fastlanePrefix}_revoke_cert do
+  require 'spaceship'
+  begin
+    Spaceship::Portal.login(ENV['FASTLANE_USER'])
+    Spaceship::Portal.select_team(team_id: ENV['FASTLANE_TEAM_ID'])
+    cert = Spaceship::Portal.certificate.all.find { |c| c.id == "${e}" }
+    cert.revoke! if cert
+  rescue => e
+    $stderr.puts "ERROR: #{e.message}"
+    exit 1
+  end
+end`,o=E.join(ge.tmpdir(),`/tmp/${u.nameLower}-revoke-cert-${Date.now()}`),t=E.join(o,"fastlane"),c=E.join(t,"Fastfile");try{y.existsSync(t)||y.mkdirSync(t,{recursive:!0}),y.writeFileSync(c,a),P(`fastlane ${u.fastlanePrefix}_revoke_cert`,{env:{...i,CI:"1",FASTLANE_FASTFILE:c},cwd:o,stdio:["inherit","pipe","inherit"]})}finally{y.existsSync(o)&&y.rmSync(o,{recursive:!0,force:!0})}}export{ue as a,me as b,xe as c,We as d};

package/dist/commands/isolated-upload.js

@@ -1 +1 @@
-import{g as s}from"../chunk-YZYFEHP5.js";import E from"fs";import S from"path";async function T(){let[o,r,n,y,a,d,l,p,f,u]=process.argv.slice(2);try{let e=S.basename(r),w=E.readFileSync(r),I=await s.post("/credentials/upload-url",{projectId:o,fileName:e,fileType:"application/octet-stream",type:n,distributionType:a}),{uploadUrl:h,key:R,fileId:x}=I.data,g=(await import("axios")).default,c=!1,m=null;for(let t=1;t<=3;t++)try{t>1&&await new Promise(i=>setTimeout(i,2e3*t)),await g.put(h,w,{headers:{"Content-Type":"application/octet-stream"},maxContentLength:1/0,maxBodyLength:1/0,timeout:6e4}),c=!0;break}catch(i){m=i}if(!c)throw m;await s.post("/credentials",{projectId:o,id:x,name:`${n} - ${a}`,type:n,bundleId:y,distributionType:a,s3Key:R,alias:d==="undefined"?void 0:d,expiresAt:l==="undefined"?void 0:l,issuerId:p==="undefined"?void 0:p,keyId:f==="undefined"?void 0:f,password:u==="undefined"?void 0:u}),console.log("SUCCESS"),process.exit(0)}catch(e){e.response?console.error(`API_ERROR: ${e.response.status} - ${JSON.stringify(e.response.data)}`):console.error(`NETWORK_ERROR: ${e.message}`),process.exit(1)}}T();
+import{g as i}from"../chunk-YZYFEHP5.js";import E from"fs";import S from"path";async function T(){let[o,d,n,I,s,r,f,l,p,u,c,y]=process.argv.slice(2);try{let e=S.basename(d),h=E.readFileSync(d),R=await i.post("/credentials/upload-url",{projectId:o,fileName:e,fileType:"application/octet-stream",type:n,distributionType:s}),{uploadUrl:k,key:x,fileId:P}=R.data,g=(await import("axios")).default,m=!1,w=null;for(let t=1;t<=3;t++)try{t>1&&await new Promise(a=>setTimeout(a,2e3*t)),await g.put(k,h,{headers:{"Content-Type":"application/octet-stream"},maxContentLength:1/0,maxBodyLength:1/0,timeout:6e4}),m=!0;break}catch(a){w=a}if(!m)throw w;await i.post("/credentials",{projectId:o,id:P,name:`${n} - ${s}`,type:n,bundleId:I,distributionType:s,s3Key:x,alias:r==="undefined"?void 0:r,expiresAt:f==="undefined"?void 0:f,issuerId:l==="undefined"?void 0:l,keyId:p==="undefined"?void 0:p,password:u==="undefined"?void 0:u,keystorePassword:c==="undefined"?void 0:c,keyPassword:y==="undefined"?void 0:y}),console.log("SUCCESS"),process.exit(0)}catch(e){e.response?console.error(`API_ERROR: ${e.response.status} - ${JSON.stringify(e.response.data)}`):console.error(`NETWORK_ERROR: ${e.message}`),process.exit(1)}}T();

package/dist/{credentials-ADMJHL4K.js → credentials-XU7FSPK4.js}

@@ -1 +1 @@
-import{b as a,c as b,d as c}from"./chunk-QUHQZ26P.js";import"./chunk-YZYFEHP5.js";export{a as credentialsMainCommand,b as credentialsSetupCommand,c as downloadCredentialsCommand};
+import{b as a,c as b,d as c}from"./chunk-K4B4LODJ.js";import"./chunk-YZYFEHP5.js";export{a as credentialsMainCommand,b as credentialsSetupCommand,c as downloadCredentialsCommand};