@radhya/mach 1.8.12 → 1.9.1

package/README.md

@@ -71,6 +71,8 @@ mach build --platform android --profile production
 mach build --platform ios --local
 ```
 
+Installable artifacts are downloaded through Mach public file routes, not raw S3 URLs. Public build pages and QR install links use the configured files domain (for example `https://files.getmach.dev`) so users do not see bucket names or presigned S3 URLs.
+
 ### Build Options
 
 | Flag             | Description                                                                      |
@@ -80,7 +82,7 @@ mach build --platform ios --local
 | `--local`        | Run build on local machine                                                       |
 | `--dry-run`      | Generate build script without running it                                         |
 | `--simulator`    | iOS Simulator build (no signing needed)                                          |
-| `--auto-version` | Force Android versionCode lookup via Google Play API                             |
+| `--auto-version` | Force Android versionCode or iOS buildNumber lookup from the store               |
 | `--verbose`      | Enable detailed build logging                                                    |
 | `--json-output`  | Write build metadata (`buildId`, Dashboard URL, status) to a JSON file for CI/CD |
 
@@ -124,7 +126,7 @@ definitions:
         script:
           - npm ci
           - npm install -g @radhya/mach@latest
-          # Keep --auto-version for store builds. Omit it for internal/dev-client builds unless that package exists in Google Play.
+          # Keep --auto-version for store builds. Omit it for internal/dev-client builds unless that package exists in the store.
           - mach build --platform android --profile $MACH_BUILD_PROFILE --auto-version --json-output mach-android-build.json
           - ANDROID_URL=$(node -pe "require('./mach-android-build.json').url")
           - pipe: atlassian/slack-notify:2.0.0
@@ -143,7 +145,7 @@ definitions:
           - mach submit --latest --platform android --profile $MACH_SUBMIT_PROFILE --track ${MACH_ANDROID_TRACK:-internal} --release-status ${MACH_ANDROID_RELEASE_STATUS:-completed} ${MACH_ANDROID_ROLLOUT:+--rollout $MACH_ANDROID_ROLLOUT} ${MACH_ANDROID_CHANGES_NOT_SENT_FOR_REVIEW:+--changes-not-sent-for-review}
 ```
 
-Android submission uses the Google Play Developer API directly, so Bitbucket/Linux runners do not need Ruby or Fastlane for `.aab` uploads. Mach still writes Android submission status to the submissions table, which gives the Dashboard the same history view without starting the macOS runner. iOS submission is queued through Mach and executed on the configured macOS GitLab runner, so the public command is the same from macOS, Linux, Windows, or CI.
+Android submission uses the Google Play Developer API directly, so Bitbucket/Linux runners do not need Ruby or Fastlane for `.aab` uploads. Mach retries transient Play API failures before failing, records Android submissions in the Dashboard, and does not start the macOS runner for Android. iOS submission is queued through Mach and executed on the configured macOS GitLab runner, so the public command is the same from macOS, Linux, Windows, or CI. GitLab pipeline details are kept internal; users see the Mach submission URL and status.
 
 Required Bitbucket variables:
 
@@ -167,9 +169,77 @@ For iOS submit, the user-facing command is universal:
 mach submit --latest --platform ios --profile $MACH_SUBMIT_PROFILE
 ```
 
-The macOS runner executes the internal runner command after the Mach API triggers GitLab:
+The macOS runner executes the internal runner command after the Mach API triggers GitLab. A robust combined build/submit `.gitlab-ci.yml` looks like this:
 
 ```yaml
+# --- GLOBAL CONFIG ---
+stages:
+  - build
+  - submit
+
+variables:
+  GIT_STRATEGY: none
+
+# --- iOS BUILD JOB ---
+skye_m4_build:
+  stage: build
+  tags:
+    - m4-mini
+    - ios-build
+  rules:
+    - if: '$MACH_ACTION == "submit_ios"'
+      when: never
+    - when: on_success
+  script: |
+    set -euo pipefail
+    source ~/.zshrc || source ~/.bashrc || true
+
+    echo "Starting MACH Cloud Build on M4 Mac Mini..."
+    echo "Build ID: $BUILD_ID"
+    echo "Project ID: $PROJECT_ID"
+    echo "Platform: $PLATFORM"
+
+    export AWS_DEFAULT_REGION="ap-south-1"
+
+    echo "Fetching build token from SSM..."
+    export MACH_TOKEN=$(aws ssm get-parameter \
+      --name "/skye/builds/$BUILD_ID/token" \
+      --with-decryption \
+      --query 'Parameter.Value' \
+      --region ap-south-1 \
+      --output text)
+
+    if [ -z "${MACH_TOKEN:-}" ] || [ "$MACH_TOKEN" = "None" ]; then
+      echo "Failed to fetch MACH_TOKEN from SSM"
+      exit 1
+    fi
+
+    aws ssm delete-parameter --name "/skye/builds/$BUILD_ID/token" --region ap-south-1 || true
+
+    echo "Fetching source from S3..."
+    aws s3 cp s3://$S3_BUCKET/builds/$BUILD_ID/source.zip source.zip --quiet --region ap-south-1
+
+    echo "Extracting source..."
+    unzip -o -q source.zip
+
+    echo "Running Mach local build..."
+    mach build --local \
+      --build-id "$BUILD_ID" \
+      --project-id "$PROJECT_ID" \
+      --platform "$PLATFORM" \
+      $BUILD_ARGS
+  after_script:
+    - |
+      if [ "${CI_JOB_STATUS:-}" != "success" ] && [ -n "${BUILD_ID:-}" ] && [ -n "${PROJECT_ID:-}" ] && [ -n "${MACH_TOKEN:-}" ]; then
+        mach build --fail-only \
+          --build-id "$BUILD_ID" \
+          --project-id "$PROJECT_ID" \
+          --platform "${PLATFORM:-ios}" \
+          --error "GitLab iOS runner failed before the build could report a final status."
+      fi
+    - if [ -n "${BUILD_ID:-}" ]; then aws ssm delete-parameter --name "/skye/builds/$BUILD_ID/token" --region ap-south-1 2>/dev/null || true; fi
+
+# --- iOS SUBMIT JOB ---
 skye_m4_ios_submit:
   stage: submit
   tags:
@@ -180,9 +250,18 @@ skye_m4_ios_submit:
       when: on_success
     - when: never
   script: |
+    set -euo pipefail
     source ~/.zshrc || source ~/.bashrc || true
+
+    echo "Starting MACH iOS Submit on M4 Mac Mini..."
+    echo "Submit ID: $SUBMIT_ID"
+    echo "Project ID: $PROJECT_ID"
+    echo "Profile: ${MACH_SUBMIT_PROFILE:-production}"
+    echo "Build ID: ${BUILD_ID:-latest}"
+
     export AWS_DEFAULT_REGION="ap-south-1"
 
+    echo "Fetching submit token from SSM..."
     export MACH_TOKEN=$(aws ssm get-parameter \
       --name "/skye/submissions/$SUBMIT_ID/token" \
       --with-decryption \
@@ -190,15 +269,21 @@ skye_m4_ios_submit:
       --region ap-south-1 \
       --output text)
 
+    if [ -z "${MACH_TOKEN:-}" ] || [ "$MACH_TOKEN" = "None" ]; then
+      echo "Failed to fetch MACH_TOKEN from SSM"
+      exit 1
+    fi
+
     aws ssm delete-parameter --name "/skye/submissions/$SUBMIT_ID/token" --region ap-south-1 || true
 
+    echo "Running Mach local iOS submit..."
     if [ -n "${BUILD_ID:-}" ]; then
       mach submit --local --submit-id "$SUBMIT_ID" --project-id "$PROJECT_ID" --platform ios --profile "${MACH_SUBMIT_PROFILE:-production}" --build-id "$BUILD_ID"
     else
       mach submit --local --submit-id "$SUBMIT_ID" --project-id "$PROJECT_ID" --platform ios --profile "${MACH_SUBMIT_PROFILE:-production}" --latest
     fi
   after_script:
-    - aws ssm delete-parameter --name "/skye/submissions/$SUBMIT_ID/token" --region ap-south-1 2>/dev/null || true
+    - if [ -n "${SUBMIT_ID:-}" ]; then aws ssm delete-parameter --name "/skye/submissions/$SUBMIT_ID/token" --region ap-south-1 2>/dev/null || true; fi
 ```
 
 ## Credential Management
@@ -245,6 +330,8 @@ mach credentials:service --platform ios
 
 The Dashboard also supports this under **Credentials → Android → package id → Service credentials**. Uploading a Google Play service key under `*` is legacy behavior; store submission now expects the service credential to match the Android package being submitted.
 
+App Store Connect keys are used for iOS TestFlight submission and iOS buildNumber auto-increment. Mach stores the key id, issuer id, Apple Developer Team ID, and App Store Connect provider/team metadata so build and submit commands can run without Apple ID prompts.
+
 Google Play service keys are only needed for store automation: Android submission and Play-backed versionCode resolution. They are not signing credentials. A dev package such as `com.example.app.dev` needs its own Google Play service key only if that exact package exists in Google Play and you explicitly ask Mach to query Play for it.
 
 ## Configuration
@@ -258,7 +345,10 @@ Create a `mach.config.json` in your project root:
   "slug": "my-app",
   "nodeVersion": "24",
   "ios": {
-    "bundleIdentifier": "com.example.myapp"
+    "bundleIdentifier": "com.example.myapp",
+    "appleTeamId": "ABCDE12345",
+    "ascAppId": "1234567890",
+    "buildNumber": "auto"
   },
   "android": {
     "package": "com.example.myapp",
@@ -267,6 +357,7 @@ Create a `mach.config.json` in your project root:
   "build": {
     "development": {
       "developmentClient": true,
+      "distribution": "development",
       "environment": "development"
     },
     "staging": {
@@ -296,6 +387,17 @@ Create a `mach.config.json` in your project root:
 | `name`        | App display name                                                                                                |
 | `nodeVersion` | Node.js version to use on the build machine (e.g. `"24"`, `"20.11.0"`). Switches via nvm before installing deps |
 
+### Platform Properties
+
+| Property               | Description                                                                                                                    |
+| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------ |
+| `ios.bundleIdentifier` | iOS bundle ID used for signing, App Store Connect lookup, and submit                                                           |
+| `ios.appleTeamId`      | Apple Developer Team ID used for iOS signing                                                                                   |
+| `ios.ascAppId`         | App Store Connect app id. Optional when Mach can find the app by bundle ID; recommended for reliable iOS buildNumber lookup    |
+| `ios.buildNumber`      | Set to `"auto"` to let Mach resolve the next iOS CFBundleVersion from App Store Connect and seed the server-side build counter |
+| `android.package`      | Android package name used for signing, Google Play lookup, and submit                                                          |
+| `android.versionCode`  | Set to `"auto"` to let store builds resolve the next versionCode via Google Play                                                |
+
 ### Profile Properties
 
 | Property                 | Description                                                                                    |
@@ -303,7 +405,7 @@ Create a `mach.config.json` in your project root:
 | `extends`                | Inherit settings from another profile                                                          |
 | `environment`            | Dashboard Secret Environment to use (`development`, `staging`, `production`)                   |
 | `developmentClient`      | `true` to build with `expo-dev-client`                                                         |
-| `distribution`           | `internal` for installable/testing builds or `store` for App Store / Play Store release builds |
+| `distribution`           | `development` for iOS development signing, `internal` for ad-hoc/internal testing builds, or `store` for App Store / Play Store release builds |
 | `preBuild` / `postBuild` | Shell command or script reference to run around the build                                      |
 | `envGroups`              | Array of environment group names to merge into this profile                                    |
 
@@ -338,6 +440,8 @@ mach env set API_URL=https://api.example.com SECRET_KEY=xxx
 mach env list
 ```
 
+Mach includes the resolved environment in the build fingerprint, so development, staging, and production builds do not reuse a native build cache when their injected variables differ. If a stored secret cannot be decrypted, Mach surfaces that as a configuration problem instead of silently injecting `[Decryption Failed]` into a production binary.
+
 ### Android Keystore Passwords
 
 The keystore file is stored encrypted in the Dashboard. Provide its passwords as secrets so Mach can inject them during the Gradle build:
@@ -354,27 +458,33 @@ mach env set KEYSTORE_PASSWORD_PRODUCTION=my_key_pass KEYSTORE_STORE_PASSWORD_PR
 
 Replace `PRODUCTION` with `STAGING` or `DEVELOPMENT` to match your build profile.
 
-## Automated Versioning (Android)
+## Automated Versioning
+
+Mach can automatically determine the next Android `versionCode` and iOS `buildNumber` from the store, then increment safely to prevent duplicate upload rejections.
 
-Mach can automatically determine the next `versionCode` by querying Google Play across all tracks (Internal → Production), and increment it by 1 — preventing duplicate version rejections.
+**Android setup:** Upload a Google Service Account JSON via `mach credentials` → Service Credentials for the exact Android package being queried.
 
-**Setup:** Upload a Google Service Account JSON via `mach credentials` → Service Credentials for the exact Android package being queried.
+**iOS setup:** Upload or create an App Store Connect API key with `mach credentials:service --platform ios`. Set `ios.ascAppId` in `mach.config.json` when possible so Mach can query the exact App Store Connect app.
 
 **Usage:**
 
 ```bash
 mach build --platform android --auto-version
+mach build --platform ios --profile production --auto-version
 ```
 
 Or in config:
 
 ```json
-"android": { "versionCode": "auto" }
+"android": { "versionCode": "auto" },
+"ios": { "buildNumber": "auto" }
 ```
 
 When `android.versionCode` is set to `"auto"`, Mach performs the Google Play lookup automatically for Android `store` builds. For `internal` builds, Mach skips the Play lookup by default so development packages do not need Google Play service keys. Pass `--auto-version` on an internal build only when that package is registered in Google Play and should be queried.
 
-Dev-client builds should keep `distribution: "internal"` and set `developmentClient: true`. Mach will use development signing credentials for those builds while still producing an internal installable artifact.
+When `ios.buildNumber` is set to `"auto"`, Mach queries App Store Connect for the latest uploaded build number and seeds Mach's server-side counter from that value. If App Store Connect has build `81` and Mach's internal counter is still `1`, the next iOS build becomes at least `82`. Concurrent builds are still safe because the Dashboard API increments the counter atomically.
+
+Regular iOS development builds should set `distribution: "development"` and resolve Apple Development certificates/profiles. For custom profile names, Mach follows the profile fields, not the profile name: `environment` chooses Dashboard secrets, and `distribution` / `iosExportMethod` chooses signing. Dev-client builds can keep `distribution: "internal"` and set `developmentClient: true`; Mach will still use development signing credentials while producing an internal installable artifact.
 
 For Android dev-client builds, Mach defaults to Gradle `assembleDebug` so the output opens the Metro/debug server instead of behaving like a standalone release APK. For iOS dev-client builds, Mach uses the Debug Xcode configuration.
 
@@ -406,7 +516,9 @@ mach credentials:service --platform android --package-name com.example.app --fil
 
 Android submit reads `submit.<profile>.android.track`, `submit.<profile>.android.releaseStatus`, and optional `submit.<profile>.android.rollout`, falling back to `submit.production.android.*`, then `internal` / `completed`. Valid Google Play release status values are `completed`, `draft`, `halted`, and `inProgress`. Use `rollout` only with `inProgress` or `halted`; it must be greater than `0` and less than `1`.
 
-Android submit does not require Fastlane. Mach uploads the `.aab`, assigns the returned `versionCode` to the requested track, commits the edit through the Google Play Developer API, and records the submission in the Dashboard. Transient Google Play failures are retried up to four times before the command fails. iOS submit queues a managed submission through Mach and runs Fastlane `pilot` on the macOS GitLab runner. Runner jobs call `mach submit --local ...`; users and CI call the normal `mach submit --platform ios ...` command. If `--ssh-host` or `submit.<profile>.ios.sshHost` is set, Mach can also upload the `.ipa` and App Store Connect API key to that macOS runner, run `pilot` remotely, then remove the remote temp files.
+Android submit does not require Fastlane. Mach uploads the `.aab`, assigns the returned `versionCode` to the requested track, commits the edit through the Google Play Developer API, and records the submission in the Dashboard. Transient Google Play failures are retried up to four times before the command fails.
+
+iOS submit queues a managed submission through Mach and runs Fastlane `pilot` on the macOS GitLab runner. Runner jobs call `mach submit --local ...`; users and CI call the normal `mach submit --platform ios ...` command. The Dashboard submission row is connected to the build, records who created it, and is marked failed if the runner or upload fails. If `--ssh-host` or `submit.<profile>.ios.sshHost` is set, Mach can also upload the `.ipa` and App Store Connect API key to that macOS runner, run `pilot` remotely, then remove the remote temp files.
 
 If `--profile` is provided with `--latest`, Mach chooses the latest successful build from that profile only. This avoids accidentally submitting a staging or preprod build to production.
 
@@ -451,6 +563,7 @@ mach build --platform ios --profile production
 ```
 
 Generate tokens from the Mach Dashboard under **Settings → Access Tokens**.
+Access tokens can be named like CI robots (for example `BitbucketPipeline`). Builds and submissions store the token identity so the Dashboard can show who or what created the run without storing a user's email/name on the build row.
 
 Example CI flow:
 

package/dist/chunk-SQL26D7I.js

@@ -0,0 +1,58 @@
+import{a as m,g as V}from"./chunk-YBL2LBMW.js";import{log as r,spinner as q,text as _,password as re,select as D,confirm as xe,isCancel as W,cancel as U,intro as Ue,outro as He,note as We}from"@clack/prompts";import{log as R,spinner as j,text as $,select as L,isCancel as F,cancel as T,note as ae,confirm as ye}from"@clack/prompts";import v from"chalk";import{spawnSync as Q}from"child_process";import G from"fs";import x from"path";import pe from"os";import ne from"fs";function nt(n){if(n){if(!ne.existsSync(n))return null;try{return JSON.parse(ne.readFileSync(n,"utf-8"))}catch{return null}}if(!ne.existsSync(`./${m.configFileName}`))return null;try{return JSON.parse(ne.readFileSync(`./${m.configFileName}`,"utf-8"))}catch{return null}}function oe(n,e,i=new Set){if(i.has(e))throw new Error(`Circular inheritance detected in profile: ${e}`);i.add(e);let a=n.build?.[e];if(!a)return null;let t={...a};if(a.extends){let s=oe(n,a.extends,i);s&&(t={...s,...a,env:{...s.env,...a.env},ios:{...s.ios,...a.ios},android:{...s.android,...a.android}})}if(t.envGroups&&Array.isArray(t.envGroups)){let s={};for(let c of t.envGroups){let d=n.envGroups?.[c];d?Object.assign(s,d):log.warn(`Environment group not found: ${c}`)}t.env={...s,...t.env}}return t}function ie(n,e){let i=e?oe(n,e)||{}:{};if(i.android?.package)return i.android.package;if(i.androidPackage)return i.androidPackage;if(n.android?.package)return n.android.package;if(n.expo?.android?.package)return n.expo.android.package}function se(n,e){let i=e?oe(n,e)||{}:{};if(i.ios?.bundleIdentifier)return i.ios.bundleIdentifier;if(i.iosBundleIdentifier)return i.iosBundleIdentifier;if(n.ios?.bundleIdentifier)return n.ios.bundleIdentifier;if(n.ios?.bundleId)return n.ios.bundleId;if(n.expo?.ios?.bundleIdentifier)return n.expo.ios.bundleIdentifier}var it=(n,e=`${m.envPrefix}`)=>{let i={},a=(t,s)=>{if(t)for(let c in t){let d=t[c],g=`${s}${c.toUpperCase().replace(/[^A-Z0-9]/g,"_")}`;d!==null&&typeof d=="object"&&!Array.isArray(d)?a(d,`${g}_`):i[g]=String(d)}};return a(n,e),i};var ke="cmVxdWlyZSAnc3BhY2VzaGlwJwpyZXF1aXJlICdqc29uJwoKZGVmIHJlYWRfdGVhbV9maWVsZCh0ZWFtLCAqa2V5cykKICBrZXlzLmVhY2ggZG8gfGtleXwKICAgIGJlZ2luCiAgICAgIHZhbHVlID0gdGVhbVtrZXldIGlmIHRlYW0ucmVzcG9uZF90bz8oOltdKQogICAgICByZXR1cm4gdmFsdWUgaWYgdmFsdWUgJiYgdmFsdWUudG9fcy5sZW5ndGggPiAwCiAgICByZXNjdWUKICAgIGVuZAoKICAgIG1ldGhvZF9uYW1lID0ga2V5LnRvX3MKICAgIGlmIHRlYW0ucmVzcG9uZF90bz8obWV0aG9kX25hbWUpCiAgICAgIHZhbHVlID0gdGVhbS5wdWJsaWNfc2VuZChtZXRob2RfbmFtZSkKICAgICAgcmV0dXJuIHZhbHVlIGlmIHZhbHVlICYmIHZhbHVlLnRvX3MubGVuZ3RoID4gMAogICAgZW5kCiAgZW5kCgogIG5pbAplbmQKCmRlZiBub3JtYWxpemVfdGVhbV9uYW1lKG5hbWUpCiAgbmFtZS50b19zLmRvd25jYXNlLmdzdWIoL1teYS16MC05XSsvLCAnICcpLnN0cmlwCmVuZAoKZGVmIHBvcnRhbF90ZWFtX25hbWUKICB0ZWFtX2lkID0gRU5WWydGQVNUTEFORV9URUFNX0lEJ10udG9fcwogIHRlYW1zID0gU3BhY2VzaGlwOjpQb3J0YWwuY2xpZW50LnRlYW1zCiAgdGVhbXMgPSB0ZWFtcy52YWx1ZXMgaWYgdGVhbXMuaXNfYT8oSGFzaCkKCiAgdGVhbSA9IEFycmF5KHRlYW1zKS5maW5kIGRvIHx0fAogICAgWwogICAgICByZWFkX3RlYW1fZmllbGQodCwgJ3RlYW1JZCcsIDp0ZWFtSWQpLAogICAgICByZWFkX3RlYW1fZmllbGQodCwgJ3RlYW1faWQnLCA6dGVhbV9pZCksCiAgICAgIHJlYWRfdGVhbV9maWVsZCh0LCAnaWQnLCA6aWQpCiAgICBdLmNvbXBhY3QubWFwKCY6dG9fcykuaW5jbHVkZT8odGVhbV9pZCkKICBlbmQKCiAgcmVhZF90ZWFtX2ZpZWxkKHRlYW0sICduYW1lJywgOm5hbWUsICd0ZWFtTmFtZScsIDp0ZWFtTmFtZSwgJ2Rpc3BsYXlOYW1lJywgOmRpc3BsYXlOYW1lKQpyZXNjdWUgPT4gZQogICRzdGRlcnIucHV0cyAiREVCVUc6IENvdWxkIG5vdCByZXNvbHZlIERldmVsb3BlciBQb3J0YWwgdGVhbSBuYW1lOiAje2UubWVzc2FnZX0iCiAgbmlsCmVuZAoKZGVmIHR1bmVzX3RlYW1faWQodGVhbSkKICByZWFkX3RlYW1fZmllbGQoCiAgICB0ZWFtLAogICAgJ3Byb3ZpZGVySWQnLCA6cHJvdmlkZXJJZCwKICAgICdwcm92aWRlcl9pZCcsIDpwcm92aWRlcl9pZCwKICAgICdjb250ZW50UHJvdmlkZXJJZCcsIDpjb250ZW50UHJvdmlkZXJJZCwKICAgICdjb250ZW50X3Byb3ZpZGVyX2lkJywgOmNvbnRlbnRfcHJvdmlkZXJfaWQsCiAgICAndGVhbUlkJywgOnRlYW1JZCwKICAgICd0ZWFtX2lkJywgOnRlYW1faWQsCiAgICAnaWQnLCA6aWQKICApLnRvX3MKZW5kCgpkZWYgdHVuZXNfdGVhbV9uYW1lKHRlYW0pCiAgcmVhZF90ZWFtX2ZpZWxkKAogICAgdGVhbSwKICAgICduYW1lJywgOm5hbWUsCiAgICAnY29udGVudFByb3ZpZGVyTmFtZScsIDpjb250ZW50UHJvdmlkZXJOYW1lLAogICAgJ2NvbnRlbnRfcHJvdmlkZXJfbmFtZScsIDpjb250ZW50X3Byb3ZpZGVyX25hbWUsCiAgICAndGVhbU5hbWUnLCA6dGVhbU5hbWUsCiAgICAnZGlzcGxheU5hbWUnLCA6ZGlzcGxheU5hbWUKICApLnRvX3MKZW5kCgpkZWYgYXZhaWxhYmxlX3R1bmVzX3RlYW1zCiAgdGVhbXMgPSBTcGFjZXNoaXA6OlR1bmVzLmNsaWVudC50ZWFtcwogIHRlYW1zID0gdGVhbXMudmFsdWVzIGlmIHRlYW1zLmlzX2E/KEhhc2gpCiAgQXJyYXkodGVhbXMpCnJlc2N1ZSA9PiBlCiAgJHN0ZGVyci5wdXRzICJERUJVRzogQ291bGQgbm90IGluc3BlY3QgQXBwIFN0b3JlIENvbm5lY3QgdGVhbXM6ICN7ZS5tZXNzYWdlfSIKICBbXQplbmQKCmRlZiBzZWxlY3RfYXBwX3N0b3JlX2Nvbm5lY3RfdGVhbQogIGV4cGxpY2l0X3RlYW1faWQgPSBFTlZbJ0ZBU1RMQU5FX0lUQ19URUFNX0lEJ10gfHwgRU5WWydGQVNUTEFORV9BU0NfVEVBTV9JRCddCiAgaWYgZXhwbGljaXRfdGVhbV9pZCAmJiBleHBsaWNpdF90ZWFtX2lkLnRvX3MubGVuZ3RoID4gMAogICAgU3BhY2VzaGlwOjpUdW5lcy5zZWxlY3RfdGVhbSh0ZWFtX2lkOiBleHBsaWNpdF90ZWFtX2lkKQogICAgcmV0dXJuIGV4cGxpY2l0X3RlYW1faWQKICBlbmQKCiAgZGV2ZWxvcGVyX3RlYW1faWQgPSBFTlZbJ0ZBU1RMQU5FX1RFQU1fSUQnXS50b19zCiAgZGV2ZWxvcGVyX3RlYW1fbmFtZSA9IHBvcnRhbF90ZWFtX25hbWUKICB0ZWFtcyA9IGF2YWlsYWJsZV90dW5lc190ZWFtcwoKICBpZiBkZXZlbG9wZXJfdGVhbV9uYW1lICYmIGRldmVsb3Blcl90ZWFtX25hbWUubGVuZ3RoID4gMAogICAgbm9ybWFsaXplZF9kZXZlbG9wZXJfbmFtZSA9IG5vcm1hbGl6ZV90ZWFtX25hbWUoZGV2ZWxvcGVyX3RlYW1fbmFtZSkKICAgIG1hdGNoZWRfdGVhbSA9IHRlYW1zLmZpbmQgeyB8dGVhbXwgbm9ybWFsaXplX3RlYW1fbmFtZSh0dW5lc190ZWFtX25hbWUodGVhbSkpID09IG5vcm1hbGl6ZWRfZGV2ZWxvcGVyX25hbWUgfQoKICAgIGlmIG1hdGNoZWRfdGVhbQogICAgICBtYXRjaGVkX2lkID0gdHVuZXNfdGVhbV9pZChtYXRjaGVkX3RlYW0pCiAgICAgIG1hdGNoZWRfbmFtZSA9IHR1bmVzX3RlYW1fbmFtZShtYXRjaGVkX3RlYW0pCiAgICAgIFNwYWNlc2hpcDo6VHVuZXMuc2VsZWN0X3RlYW0odGVhbV9pZDogbWF0Y2hlZF9pZCkKICAgICAgJHN0ZGVyci5wdXRzICJERUJVRzogQXV0by1zZWxlY3RlZCBBcHAgU3RvcmUgQ29ubmVjdCB0ZWFtICN7bWF0Y2hlZF9pZH0gKCN7bWF0Y2hlZF9uYW1lfSkgZm9yIERldmVsb3BlciBUZWFtICN7ZGV2ZWxvcGVyX3RlYW1faWR9IgogICAgICByZXR1cm4gbWF0Y2hlZF9pZAogICAgZW5kCiAgZW5kCgogIGlmIHRlYW1zLmxlbmd0aCA9PSAxCiAgICBvbmx5X3RlYW0gPSB0ZWFtcy5maXJzdAogICAgb25seV90ZWFtX2lkID0gdHVuZXNfdGVhbV9pZChvbmx5X3RlYW0pCiAgICBTcGFjZXNoaXA6OlR1bmVzLnNlbGVjdF90ZWFtKHRlYW1faWQ6IG9ubHlfdGVhbV9pZCkKICAgICRzdGRlcnIucHV0cyAiREVCVUc6IEF1dG8tc2VsZWN0ZWQgb25seSBBcHAgU3RvcmUgQ29ubmVjdCB0ZWFtICN7b25seV90ZWFtX2lkfSAoI3t0dW5lc190ZWFtX25hbWUob25seV90ZWFtKX0pIgogICAgcmV0dXJuIG9ubHlfdGVhbV9pZAogIGVuZAoKICAkc3RkZXJyLnB1dHMgIkVSUk9SOiBDb3VsZCBub3QgbWFwIEFwcGxlIERldmVsb3BlciBUZWFtIElEICcje2RldmVsb3Blcl90ZWFtX2lkfScje2RldmVsb3Blcl90ZWFtX25hbWUgPyAiICgje2RldmVsb3Blcl90ZWFtX25hbWV9KSIgOiAnJ30gdG8gQXBwIFN0b3JlIENvbm5lY3QuIgogICRzdGRlcnIucHV0cyAiQXZhaWxhYmxlIEFwcCBTdG9yZSBDb25uZWN0IHRlYW1zOiIKICB0ZWFtcy5lYWNoIGRvIHx0ZWFtfAogICAgJHN0ZGVyci5wdXRzICItICN7dHVuZXNfdGVhbV9pZCh0ZWFtKX0gKCN7dHVuZXNfdGVhbV9uYW1lKHRlYW0pfSkiCiAgZW5kCiAgZXhpdCAxCmVuZAoKZGVmIGxpc3RfdGVhbXMKICBiZWdpbgogICAgU3BhY2VzaGlwOjpQb3J0YWwubG9naW4oRU5WWydGQVNUTEFORV9VU0VSJ10pCiAgICBTcGFjZXNoaXA6OlBvcnRhbC5zZWxlY3RfdGVhbSh0ZWFtX2lkOiBFTlZbJ0ZBU1RMQU5FX1RFQU1fSUQnXSkKCiAgICBkZXZlbG9wZXJfdGVhbV9uYW1lID0gcG9ydGFsX3RlYW1fbmFtZQoKICAgIFNwYWNlc2hpcDo6VHVuZXMubG9naW4oRU5WWydGQVNUTEFORV9VU0VSJ10pCiAgICBub3JtYWxpemVkX2RldmVsb3Blcl9uYW1lID0gbm9ybWFsaXplX3RlYW1fbmFtZShkZXZlbG9wZXJfdGVhbV9uYW1lKQogICAgdGVhbXMgPSBhdmFpbGFibGVfdHVuZXNfdGVhbXMubWFwIGRvIHx0ZWFtfAogICAgICB0ZWFtX25hbWUgPSB0dW5lc190ZWFtX25hbWUodGVhbSkKICAgICAgewogICAgICAgIGlkOiB0dW5lc190ZWFtX2lkKHRlYW0pLAogICAgICAgIG5hbWU6IHRlYW1fbmFtZSwKICAgICAgICByZWNvbW1lbmRlZDogbm9ybWFsaXplZF9kZXZlbG9wZXJfbmFtZS5sZW5ndGggPiAwICYmIG5vcm1hbGl6ZV90ZWFtX25hbWUodGVhbV9uYW1lKSA9PSBub3JtYWxpemVkX2RldmVsb3Blcl9uYW1lCiAgICAgIH0KICAgIGVuZAoKICAgIHB1dHMgIl9fX01BQ0hfSlNPTl9TVEFSVF9fXyIgKyB7CiAgICAgIGRldmVsb3BlclRlYW1JZDogRU5WWydGQVNUTEFORV9URUFNX0lEJ10sCiAgICAgIGRldmVsb3BlclRlYW1OYW1lOiBkZXZlbG9wZXJfdGVhbV9uYW1lLAogICAgICB0ZWFtczogdGVhbXMKICAgIH0udG9fanNvbiArICJfX19NQUNIX0pTT05fRU5EX19fIgogIHJlc2N1ZSA9PiBlCiAgICAkc3RkZXJyLnB1dHMgIkVSUk9SOiAje2UubWVzc2FnZX0iCiAgICBleGl0IDEKICBlbmQKZW5kCgpkZWYgbGlzdF9rZXlzCiAgYmVnaW4KICAgIFNwYWNlc2hpcDo6UG9ydGFsLmxvZ2luKEVOVlsnRkFTVExBTkVfVVNFUiddKQogICAgU3BhY2VzaGlwOjpQb3J0YWwuc2VsZWN0X3RlYW0odGVhbV9pZDogRU5WWydGQVNUTEFORV9URUFNX0lEJ10pCiAgICAKICAgIFNwYWNlc2hpcDo6VHVuZXMubG9naW4oRU5WWydGQVNUTEFORV9VU0VSJ10pCiAgICBzZWxlY3RfYXBwX3N0b3JlX2Nvbm5lY3RfdGVhbQogICAgCiAgICAjIFVzZSBUdW5lcyBjbGllbnQgd2hpY2ggcG9pbnRzIHRvIGFwcHN0b3JlY29ubmVjdC5hcHBsZS5jb20KICAgIGNsaWVudCA9IFNwYWNlc2hpcDo6VHVuZXMuY2xpZW50CiAgICAjIFVzZSByb290LXJlbGF0aXZlIFVSTCB0byByZXBsYWNlIHRoZSBkZWZhdWx0IFR1bmVzIHBhdGggKC9XZWJPYmplY3RzLy4uLikKICAgIHJlc3BvbnNlID0gY2xpZW50LnJlcXVlc3QoOmdldCwgJy9pcmlzL3YxL2FwaUtleXMnKQogICAgCiAgICBpZiByZXNwb25zZS5ib2R5Lm5pbD8gfHwgIXJlc3BvbnNlLmJvZHkuaXNfYT8oSGFzaCkKICAgICAgcmFpc2UgIkFQSSByZXR1cm5lZCBlbXB0eSBvciBpbnZhbGlkIHJlc3BvbnNlIGJvZHkgZm9yIGxpc3Rpbmcga2V5cyIKICAgIGVuZAogICAgCiAgICAkc3RkZXJyLnB1dHMgIkRFQlVHOiBGdWxsIExpc3QgUmVzcG9uc2U6ICN7cmVzcG9uc2UuYm9keS50b19qc29ufSIKICAgIAogICAga2V5cyA9IHJlc3BvbnNlLmJvZHlbJ2RhdGEnXSB8fCBbXQogICAgCiAgICBvdXRwdXQgPSBrZXlzLm1hcCBkbyB8a3wKICAgICAgYXR0ciA9IGtbJ2F0dHJpYnV0ZXMnXSB8fCB7fQogICAgICB7CiAgICAgICAgaWQ6IGtbJ2lkJ10sCiAgICAgICAgbmFtZTogYXR0clsnbmFtZSddLAogICAgICAgIGlzc3VlcklkOiBhdHRyWydpc3N1ZXJJZCddLAogICAgICAgIHJvbGU6IGF0dHJbJ3JvbGVzJ10mLmZpcnN0LAogICAgICAgIHJldm9jYWJsZTogYXR0clsncmV2b2NhYmxlJ10KICAgICAgfQogICAgZW5kCiAgICAKICAgIHB1dHMgIl9fX01BQ0hfSlNPTl9TVEFSVF9fXyIgKyBvdXRwdXQudG9fanNvbiArICJfX19NQUNIX0pTT05fRU5EX19fIgogIHJlc2N1ZSA9PiBlCiAgICAkc3RkZXJyLnB1dHMgIkVSUk9SOiAje2UubWVzc2FnZX0iCiAgICBpZiBkZWZpbmVkPyhyZXNwb25zZSkgJiYgcmVzcG9uc2UgJiYgcmVzcG9uc2UuYm9keQogICAgICAkc3RkZXJyLnB1dHMgIlJlc3BvbnNlIEJvZHk6ICN7cmVzcG9uc2UuYm9keS50b19qc29ufSIKICAgIGVuZAogICAgZXhpdCAxCiAgZW5kCmVuZAoKZGVmIGNyZWF0ZV9rZXkobmFtZSwgcm9sZSA9ICdBRE1JTicpCiAgYmVnaW4KICAgIFNwYWNlc2hpcDo6UG9ydGFsLmxvZ2luKEVOVlsnRkFTVExBTkVfVVNFUiddKQogICAgU3BhY2VzaGlwOjpQb3J0YWwuc2VsZWN0X3RlYW0odGVhbV9pZDogRU5WWydGQVNUTEFORV9URUFNX0lEJ10pCiAgICAKICAgIFNwYWNlc2hpcDo6VHVuZXMubG9naW4oRU5WWydGQVNUTEFORV9VU0VSJ10pCiAgICBzZWxlY3RfYXBwX3N0b3JlX2Nvbm5lY3RfdGVhbQogICAgCiAgICBjbGllbnQgPSBTcGFjZXNoaXA6OlR1bmVzLmNsaWVudAogICAgCiAgICAjIFRydW5jYXRlIG5pY2tuYW1lIHRvIDMwIGNoYXJzIGFzIHBlciBBcHBsZSdzIGxpbWl0CiAgICAjIFdlIGtlZXAgdGhlIG9yaWdpbmFsICduYW1lJyBmb3IgbG9nZ2luZyBidXQgc2VuZCB0cnVuY2F0ZWQgJ25pY2tuYW1lJyB0byBBUEkKICAgIHNhZmVfbmlja25hbWUgPSBuYW1lWzAsIDMwXQogICAgCiAgICBwYXlsb2FkID0gewogICAgICBkYXRhOiB7CiAgICAgICAgdHlwZTogImFwaUtleXMiLAogICAgICAgIGF0dHJpYnV0ZXM6IHsKICAgICAgICAgIG5pY2tuYW1lOiBzYWZlX25pY2tuYW1lLAogICAgICAgICAga2V5VHlwZTogIlBVQkxJQ19BUEkiLAogICAgICAgICAgcm9sZXM6IFtyb2xlXSwKICAgICAgICAgIGFsbEFwcHNWaXNpYmxlOiB0cnVlCiAgICAgICAgfQogICAgICB9CiAgICB9CiAgICAKICAgIHJlc3BvbnNlID0gY2xpZW50LnJlcXVlc3QoOnBvc3QpIGRvIHxyZXF8CiAgICAgIHJlcS51cmwgIi9pcmlzL3YxL2FwaUtleXMiCiAgICAgIHJlcS5ib2R5ID0gcGF5bG9hZC50b19qc29uCiAgICAgIHJlcS5oZWFkZXJzWydDb250ZW50LVR5cGUnXSA9ICdhcHBsaWNhdGlvbi9qc29uJwogICAgICByZXEuaGVhZGVyc1snQWNjZXB0J10gPSAnYXBwbGljYXRpb24vdm5kLmFwaStqc29uLCBhcHBsaWNhdGlvbi9qc29uLCB0ZXh0L2phdmFzY3JpcHQsICovKjsgcT0wLjAxJwogICAgICByZXEuaGVhZGVyc1snWC1SZXF1ZXN0ZWQtV2l0aCddID0gJ1hNTEh0dHBSZXF1ZXN0JwogICAgICByZXEuaGVhZGVyc1snUmVmZXJlciddID0gJ2h0dHBzOi8vYXBwc3RvcmVjb25uZWN0LmFwcGxlLmNvbS9hY2Nlc3MvYXBpJwogICAgICByZXEuaGVhZGVyc1snWC1BcHBsZS1XaWRnZXQtS2V5J10gPSBjbGllbnQud2lkZ2V0X2tleSBpZiBjbGllbnQucmVzcG9uZF90bz8oOndpZGdldF9rZXkpCiAgICBlbmQKICAgIAogICAgIyBERUJVRzogSW5zcGVjdCB0aGUgcmF3IHJlc3BvbnNlIG9iamVjdAogICAgJHN0ZGVyci5wdXRzICJERUJVRzogUmVzcG9uc2UgQ2xhc3M6ICN7cmVzcG9uc2UuY2xhc3N9IgogICAgJHN0ZGVyci5wdXRzICJERUJVRzogUmVzcG9uc2UgSGVhZGVyczogI3tyZXNwb25zZS5oZWFkZXJzfSIKICAgICRzdGRlcnIucHV0cyAiREVCVUc6IFJlc3BvbnNlIEJvZHk6ICN7cmVzcG9uc2UuYm9keS50b19qc29ufSIKICAgIAogICAgaWYgcmVzcG9uc2UuYm9keS5uaWw/IHx8ICFyZXNwb25zZS5ib2R5LmlzX2E/KEhhc2gpIHx8IHJlc3BvbnNlLmJvZHlbJ2RhdGEnXS5uaWw/CiAgICAgIGVycm9yX21zZyA9ICJBUEkgZmFpbGVkIHRvIGNyZWF0ZSBrZXkuIgogICAgICBpZiByZXNwb25zZS5ib2R5ICYmIHJlc3BvbnNlLmJvZHlbJ2Vycm9ycyddCiAgICAgICAgZXJyb3JfbXNnICs9ICIgRXJyb3JzOiAiICsgcmVzcG9uc2UuYm9keVsnZXJyb3JzJ10ubWFwe3xlfCBlWydkZXRhaWwnXX0uam9pbignLCAnKQogICAgICBlbmQKICAgICAgcmFpc2UgZXJyb3JfbXNnCiAgICBlbmQKICAgIAogICAga2V5X2RhdGEgPSByZXNwb25zZS5ib2R5WydkYXRhJ10KICAgIGF0dHIgPSBrZXlfZGF0YVsnYXR0cmlidXRlcyddIHx8IHt9CgogICAgIyBUaGUgLnA4IGNvbnRlbnQgaXMgdXN1YWxseSBpbiAncHJpdmF0ZUtleScgb3IgJ2tleUNvbnRlbnQnIG9uIHRoZSBJTklUSUFMIENSRUFURSByZXNwb25zZQogICAgcDhfY29udGVudCA9IGF0dHJbJ3ByaXZhdGVLZXknXSB8fCBhdHRyWydrZXlDb250ZW50J10KICAgIAogICAgaWYgcDhfY29udGVudC5uaWw/CiAgICAgICRzdGRlcnIucHV0cyAiREVCVUc6IEtleSBjb250ZW50IG1pc3NpbmcgaW4gcmVzcG9uc2UuIEF0dGVtcHRpbmcgcmV0cmlldmFsIHZpYSBkb3dubG9hZC9leHBvcnQgZW5kcG9pbnRzLi4uIiAKICAgICAgCiAgICAgIHBhdGhzX3RvX3RyeSA9IFsKICAgICAgICAiaHR0cHM6Ly9hcHBzdG9yZWNvbm5lY3QuYXBwbGUuY29tL2lyaXMvdjEvYXBpS2V5cy8je2tleV9kYXRhWydpZCddfS9kb3dubG9hZCIsCiAgICAgICAgImh0dHBzOi8vYXBwc3RvcmVjb25uZWN0LmFwcGxlLmNvbS9pcmlzL3YxL2FwaUtleXMvI3trZXlfZGF0YVsnaWQnXX0vZXhwb3J0IgogICAgICBdCiAgICAgIAogICAgICBwYXRoc190b190cnkuZWFjaCBkbyB8cGF0aHwKICAgICAgICBiZWdpbgogICAgICAgICAgJHN0ZGVyci5wdXRzICJERUJVRzogVHJ5aW5nICN7cGF0aH0uLi4iCiAgICAgICAgICBkb3dubG9hZF9yZXNwID0gY2xpZW50LnJlcXVlc3QoOmdldCkgZG8gfHJlcXwKICAgICAgICAgICAgcmVxLnVybCBwYXRoCiAgICAgICAgICAgIHJlcS5oZWFkZXJzWydBY2NlcHQnXSA9ICdhcHBsaWNhdGlvbi92bmQuYXBpK2pzb24sIGFwcGxpY2F0aW9uL2pzb24sIHRleHQvamF2YXNjcmlwdCwgKi8qOyBxPTAuMDEnCiAgICAgICAgICAgIHJlcS5oZWFkZXJzWydYLVJlcXVlc3RlZC1XaXRoJ10gPSAnWE1MSHR0cFJlcXVlc3QnCiAgICAgICAgICAgIHJlcS5oZWFkZXJzWydSZWZlcmVyJ10gPSAnaHR0cHM6Ly9hcHBzdG9yZWNvbm5lY3QuYXBwbGUuY29tL2FjY2Vzcy9hcGknCiAgICAgICAgICBlbmQKICAgICAgICAgICRzdGRlcnIucHV0cyAiREVCVUc6IFJlc3BvbnNlIENsYXNzOiAje2Rvd25sb2FkX3Jlc3AuYm9keS5jbGFzc30iCiAgICAgICAgICAkc3RkZXJyLnB1dHMgIkRFQlVHOiBSZXNwb25zZSBTdGF0dXM6ICN7ZG93bmxvYWRfcmVzcC5zdGF0dXN9IiBpZiBkb3dubG9hZF9yZXNwLnJlc3BvbmRfdG8/KDpzdGF0dXMpCiAgICAgICAgICAKICAgICAgICAgIGlmIGRvd25sb2FkX3Jlc3AuYm9keSAmJiAhZG93bmxvYWRfcmVzcC5ib2R5LnRvX3MuaW5jbHVkZT8oJyJlcnJvcnMiPT4nKQogICAgICAgICAgICAgaWYgZG93bmxvYWRfcmVzcC5ib2R5LmlzX2E/KEhhc2gpCiAgICAgICAgICAgICAgIHA4X2NvbnRlbnQgPSBkb3dubG9hZF9yZXNwLmJvZHlbJ2tleUNvbnRlbnQnXSB8fCBkb3dubG9hZF9yZXNwLmJvZHlbJ2NvbnRlbnQnXSB8fCBkb3dubG9hZF9yZXNwLmJvZHkuZGlnKCdkYXRhJywgJ2F0dHJpYnV0ZXMnLCAncHJpdmF0ZUtleScpCiAgICAgICAgICAgICBlbHNlCiAgICAgICAgICAgICAgIHA4X2NvbnRlbnQgPSBkb3dubG9hZF9yZXNwLmJvZHkKICAgICAgICAgICAgIGVuZAogICAgICAgICAgICAgCiAgICAgICAgICAgICBpZiBwOF9jb250ZW50ICYmIHA4X2NvbnRlbnQudG9fcy5zdGFydF93aXRoPygnLS0tLS1CRUdJTicpCiAgICAgICAgICAgICAgICRzdGRlcnIucHV0cyAiREVCVUc6IFJldHJpZXZhbCB2aWEgI3twYXRofSBzdWNjZXNzZnVsISBDb250ZW50IGxlbmd0aDogI3twOF9jb250ZW50LnRvX3MubGVuZ3RofSIKICAgICAgICAgICAgICAgYnJlYWsKICAgICAgICAgICAgIGVsc2UKICAgICAgICAgICAgICAgJHN0ZGVyci5wdXRzICJERUJVRzogUmVzcG9uc2UgZnJvbSAje3BhdGh9IGRpZCBub3QgY29udGFpbiBhIHZhbGlkIHByaXZhdGUga2V5LiIKICAgICAgICAgICAgICAgcDhfY29udGVudCA9IG5pbAogICAgICAgICAgICAgZW5kCiAgICAgICAgICBlbHNlCiAgICAgICAgICAgICAkc3RkZXJyLnB1dHMgIkRFQlVHOiBSZXNwb25zZSBmcm9tICN7cGF0aH0gZW1wdHkgb3IgY29udGFpbnMgZXJyb3JzLiIKICAgICAgICAgIGVuZAogICAgICAgIHJlc2N1ZSA9PiBlCiAgICAgICAgICAkc3RkZXJyLnB1dHMgIkRFQlVHOiBBdHRlbXB0IGZvciAje3BhdGh9IGZhaWxlZDogI3tlLm1lc3NhZ2V9IgogICAgICAgIGVuZAogICAgICBlbmQKICAgIGVuZAoKICAgICMgRklOQUwgVkFMSURBVElPTjogRW5zdXJlIGl0J3Mgbm90IGEgUnVieSBoYXNoIHN0cmluZyByZXByZXNlbnRhdGlvbiBvciBlcnJvcgogICAgaWYgcDhfY29udGVudC5pc19hPyhIYXNoKSB8fCBwOF9jb250ZW50LnRvX3MuaW5jbHVkZT8oJyJlcnJvcnMiPT4nKSB8fCAhcDhfY29udGVudC50b19zLnN0YXJ0X3dpdGg/KCctLS0tLUJFR0lOJykKICAgICAgJHN0ZGVyci5wdXRzICJERUJVRzogSW52YWxpZCBrZXkgY29udGVudCBkZXRlY3RlZC4iCiAgICAgIHA4X2NvbnRlbnQgPSBuaWwKICAgIGVuZAoKICAgIGlmIHA4X2NvbnRlbnQubmlsPwogICAgICAkc3RkZXJyLnB1dHMgIkRFQlVHOiBGYWlsZWQgdG8gcmV0cmlldmUga2V5IGNvbnRlbnQuIgogICAgZW5kCiAgICAKICAgIHJlc3VsdCA9IHsKICAgICAgaWQ6IGtleV9kYXRhWydpZCddLAogICAgICBuYW1lOiBhdHRyWyduaWNrbmFtZSddIHx8IGF0dHJbJ25hbWUnXSwKICAgICAgaXNzdWVySWQ6IGF0dHJbJ2lzc3VlcklkJ10sCiAgICAgIGtleUNvbnRlbnQ6IHA4X2NvbnRlbnQsCiAgICAgIHJhd19yZXNwb25zZTogcmVzcG9uc2UuYm9keSAjIEluY2x1ZGUgdGhpcyBmb3IgZGVidWdnaW5nIHdoZW4ga2V5Q29udGVudCBpcyBuaWwKICAgIH0KICAgIAogICAgcHV0cyAiX19fTUFDSF9KU09OX1NUQVJUX19fIiArIHJlc3VsdC50b19qc29uICsgIl9fX01BQ0hfSlNPTl9FTkRfX18iCiAgcmVzY3VlID0+IGUKICAgICRzdGRlcnIucHV0cyAiRVJST1I6ICN7ZS5tZXNzYWdlfSIKICAgIGlmIGRlZmluZWQ/KHJlc3BvbnNlKSAmJiByZXNwb25zZSAmJiByZXNwb25zZS5ib2R5CiAgICAgICAkc3RkZXJyLnB1dHMgIlJlc3BvbnNlIEJvZHk6ICN7cmVzcG9uc2UuYm9keS50b19qc29ufSIKICAgIGVuZAogICAgZXhpdCAxCiAgZW5kCmVuZAoKZGVmIGRlbGV0ZV9rZXkoaWQpCiAgYmVnaW4KICAgIFNwYWNlc2hpcDo6UG9ydGFsLmxvZ2luKEVOVlsnRkFTVExBTkVfVVNFUiddKQogICAgU3BhY2VzaGlwOjpQb3J0YWwuc2VsZWN0X3RlYW0odGVhbV9pZDogRU5WWydGQVNUTEFORV9URUFNX0lEJ10pCiAgICAKICAgIFNwYWNlc2hpcDo6VHVuZXMubG9naW4oRU5WWydGQVNUTEFORV9VU0VSJ10pCiAgICBzZWxlY3RfYXBwX3N0b3JlX2Nvbm5lY3RfdGVhbQogICAgCiAgICBjbGllbnQgPSBTcGFjZXNoaXA6OlR1bmVzLmNsaWVudAogICAgY2xpZW50LnJlcXVlc3QoOmRlbGV0ZSwgIi9pcmlzL3YxL2FwaUtleXMvI3tpZH0iKQogICAgcHV0cyAiU1VDQ0VTUyIKICByZXNjdWUgPT4gZQogICAgJHN0ZGVyci5wdXRzICJFUlJPUjogI3tlLm1lc3NhZ2V9IgogICAgZXhpdCAxCiAgZW5kCmVuZAoKY29tbWFuZCA9IEFSR1ZbMF0KaWYgY29tbWFuZCA9PSAnbGlzdCcKICBsaXN0X2tleXMKZWxzaWYgY29tbWFuZCA9PSAndGVhbXMnCiAgbGlzdF90ZWFtcwplbHNpZiBjb21tYW5kID09ICdjcmVhdGUnCiAgY3JlYXRlX2tleShBUkdWWzFdIHx8ICJNYWNoIEFQSSBLZXkgI3tUaW1lLm5vdy50b19pfSIpCmVsc2lmIGNvbW1hbmQgPT0gJ2RlbGV0ZScKICBkZWxldGVfa2V5KEFSR1ZbMV0pCmVuZAo=";function ce(){let n=x.join(pe.tmpdir(),m.nameLower);G.existsSync(n)||G.mkdirSync(n,{recursive:!0});let e=x.join(n,"manage_asc_keys.rb");return G.writeFileSync(e,Buffer.from(ke,"base64").toString("utf-8"),{mode:493}),e}function le(){return{...process.env,PATH:`/usr/local/opt/ruby/bin:/usr/local/Cellar/fastlane/2.227.0/libexec/bin:${process.env.HOME}/.local/share/fastlane/3.4.0/bin:${process.env.PATH}`,GEM_HOME:process.env.FASTLANE_GEM_HOME||`${process.env.HOME}/.local/share/fastlane/3.4.0`,GEM_PATH:(process.env.FASTLANE_GEM_HOME||`${process.env.HOME}/.local/share/fastlane/3.4.0`)+":/usr/local/Cellar/fastlane/2.227.0/libexec",FASTLANE_INSTALLED_VIA_HOMEBREW:"true",CI:"1"}}function ue(n){let e=new Map,i=/-\s+(\d+)\s+\(([^)]+)\)/g,a=/\d+\)\s+"([^"]+)"\s+\((\d+)\)/g,t;for(;(t=i.exec(n))!==null;)e.set(t[1],{id:t[1],name:t[2]});for(;(t=a.exec(n))!==null;)e.set(t[2],{id:t[2],name:t[1]});return Array.from(e.values())}function Ie(n){return n.submit?.production?.ios?.appStoreConnectTeamId||n.submit?.production?.ios?.itcTeamId||n.submit?.production?.ios?.appleConnectTeamId}function he(n,e,i){return{...le(),FASTLANE_USER:n,FASTLANE_TEAM_ID:e,...i?{FASTLANE_ITC_TEAM_ID:i,FASTLANE_ASC_TEAM_ID:i}:{}}}async function Xe(n,e,i,a){let t=j();t.start("Fetching App Store Connect providers...");let s=Q("ruby",[n,"teams"],{env:he(i,a),stdio:["inherit","pipe","pipe"],encoding:"utf-8"});if(s.status!==0){t.stop("Could not fetch providers");let I=ue(`${s.stdout||""}
+${s.stderr||""}`);if(I.length>0)return de(e,I,"Select the App Store Connect provider for this API key:");R.warn(v.yellow(`Could not list App Store Connect providers: ${s.stderr||"Unknown error"}`));return}let c=(s.stdout||"").match(new RegExp(`${m.jsonStartMarker}(.*)${m.jsonEndMarker}`));if(!c){t.stop("Could not parse providers");return}let d=JSON.parse(c[1]),g=(d.teams||[]).filter(I=>I.id&&I.name);if(t.stop(g.length===1?"Found 1 provider":`Found ${g.length} providers`),g.length===0)return;if(g.length===1)return R.success(v.green(`\u2713 Using App Store Connect provider ${g[0].name} (${g[0].id})`)),g[0].id;let y=g.filter(I=>I.recommended),u=g.filter(I=>!I.recommended);return de(e,[...y,...u],`Select the App Store Connect provider for Developer Team ${d.developerTeamName||a}:`)}async function de(n,e,i){let a=await L({message:i,options:e.map(s=>({value:s.id,label:s.name,hint:`${s.id}${s.recommended?" \xB7 recommended":""}`}))});if(F(a))return T("Operation cancelled"),null;let t=a;return R.success(v.green(`\u2713 Using App Store Connect Provider ID ${t}`)),t}var be=async n=>{let e=j(),i=n.platform,a=`./${m.configFileName}`;if(!G.existsSync(a)){R.error(`No ${m.configFileName} found. Run \`${m.nameLower} init\` or \`${m.nameLower} link\` first.`);return}let t=JSON.parse(G.readFileSync(a,"utf-8")),{projectId:s}=t,c=n.profile||"production";if(!s){R.error(`${m.configFileName} is missing projectId.`);return}let d=n.file,g=i==="android"?n.packageName||n.bundleId:n.bundleId||se(t,c)||"*";if(i==="android"&&!g&&(g=await Fe(s,t,c),g===null))return;if(i==="ios"&&!d){let p=await L({message:"Manage App Store Connect API Key:",options:[{value:"magic",label:"\u2728 Create new automatically",hint:"Requires Apple ID + 2FA"},{value:"manual",label:"\u{1F50D} Configure manually",hint:"Provide existing .p8 file"},{value:"delete",label:"\u{1F5D1}\uFE0F  Delete an existing Key"}]});if(F(p)){T("Operation cancelled");return}if(p==="magic"){await Be(s,t);return}if(p==="delete"){await Ye(s,t);return}}if(!d){let p=i==="ios"?"https://appstoreconnect.apple.com/access/api":"https://console.cloud.google.com/apis/credentials";ae(`To submit to the ${i==="ios"?"App Store":"Google Play Store"}, you need a Service Key:
+
+1. Open: ${v.cyan(p)}
+`+(i==="ios"?`2. Generate an "App Store Connect API Key" with ${v.bold("Admin")} role.
+3. Download the ${v.bold(".p8")} file.`:`2. Create a "Service Account", generate a ${v.bold("JSON")} key.
+3. Download the ${v.bold(".json")} file.`),"Guided Setup"),e.start("Scanning for downloaded keys...");let l=Je(i);if(e.stop(l.length>0?`Detected ${l.length} potential key(s)`:"No keys detected automatically"),l.length>0){let C=await L({message:"Found these potential keys. Use one of them?",options:[...l.map(A=>({value:A.path,label:`${x.basename(A.path)} (${A.location})`})),{value:"manual",label:"Enter path manually..."}]});if(F(C)){T("Operation cancelled");return}C!=="manual"&&(d=C)}if(!d){let C=await $({message:`Paste the path to your ${i==="ios"?".p8":".json"} file:`,validate:A=>G.existsSync(A)?void 0:"File not found"});if(F(C)){T("Operation cancelled");return}d=C}}let y=n.issuerId,u=n.keyId;if(i==="ios"){if(!u&&d){let p=x.basename(d).match(/AuthKey_(.*)\.p8/);p&&(u=p[1],R.info(`Auto-detected Key ID from filename: ${v.green(u)}`))}if(!y){let p=await $({message:"Enter App Store Connect Issuer ID (Found on the Keys page):",validate:l=>l.length>0?void 0:"Issuer ID is required"});if(F(p)){T("Operation cancelled");return}y=p}if(!u){let p=await $({message:"Enter App Store Connect Key ID:",validate:l=>l.length>0?void 0:"Key ID is required"});if(F(p)){T("Operation cancelled");return}u=p}}if(i==="android"&&(!g||g==="*")){let p=await Se();if(p===null)return;g=p}let I=t.submit?.production?.ios?.appleTeamId,f=Ie(t);await ge(s,d,i,y,u,g,{teamId:i==="ios"?I:void 0,developerTeamId:i==="ios"?I:void 0,appStoreConnectTeamId:i==="ios"?f:void 0,providerId:i==="ios"?f:void 0})};async function Fe(n,e,i){let a=await Ne(n),t=Ee(e,i);if(t&&!a.includes(t)&&a.unshift(t),a.length>0){let s=await L({message:"Select Android package for this Google Play service key:",options:[...a.map(c=>({value:c,label:c,hint:c===t?"from config":void 0})),{value:"manual",label:"Enter another package name..."}]});if(F(s))return T("Operation cancelled"),null;if(s==="manual")return Se();if(s!=="manual")return s}if(t){let s=await ye({message:`Use Android package from local config (${t})?`,initialValue:!0});if(F(s))return T("Operation cancelled"),null;if(s)return t}}async function Se(){let n=await $({message:"Android package name for this Google Play service key:",placeholder:"com.example.app",validate:e=>e.includes(".")?void 0:"Enter a valid package name"});return F(n)?(T("Operation cancelled"),null):n}async function Ne(n){try{let i=(await V.get(`/credentials/${n}`)).data.credentials||[],a=new Set;for(let t of i)(t.platform==="android"||t.type==="android_keystore"||t.type==="google_service_account")&&t.bundleId&&t.bundleId!=="*"&&a.add(t.bundleId);return Array.from(a).sort()}catch(e){return R.warn(v.yellow(`Could not fetch saved Android package identifiers: ${e.message}`)),[]}}function Ee(n,e){let i=ie(n,e);if(i)return i;let a=x.join(process.cwd(),"app.json");if(G.existsSync(a))try{return JSON.parse(G.readFileSync(a,"utf-8")).expo?.android?.package}catch{}let t=x.join(process.cwd(),"app.config.json");if(G.existsSync(t))try{let s=JSON.parse(G.readFileSync(t,"utf-8"));return s.expo?.android?.package||s.android?.package}catch{}}async function Be(n,e){let i=j(),a=e.submit?.production?.ios?.appleId,t=e.submit?.production?.ios?.appleTeamId,s=Ie(e);if(!a){let g=await $({message:"Apple ID:",placeholder:"your-email@example.com"});if(F(g))return;a=g}if(!t){let g=await $({message:"Apple Team ID:",placeholder:"e.g. 4523G95823"});if(F(g))return;t=g,e.submit||(e.submit={production:{ios:{}}}),e.submit.production||(e.submit.production={ios:{}}),e.submit.production.ios||(e.submit.production.ios={}),e.submit.production.ios.appleTeamId=t,G.writeFileSync(`./${m.configFileName}`,JSON.stringify(e,null,2))}let c=await $({message:"Enter a name for the new API Key:",initialValue:`[${m.name}] Project ${n}`});if(F(c))return;let d=ce();if(!G.existsSync(d)){R.error(`Magic Error: Helper script not found at ${d}`);return}try{let g=await Xe(d,e,a,t);if(g===null)return;if(g)s=g;else if(!s)return;i.start("Creating App Store Connect API Key...");let y=Z=>Q("ruby",[d,"create",c],{env:he(a,t,Z),stdio:["inherit","pipe","pipe"],encoding:"utf-8"}),u=y(s),I=u.stdout||"",f=u.stderr||"";if(u.status!==0){let Z=ue(`${I}
+${f}`);if(Z.length>0){i.stop("Select App Store Connect team"),ae(`Apple Developer Team IDs look like ${v.bold(t)}.
+App Store Connect API keys use a numeric provider/team ID instead.`,"Team ID mismatch");let k=await de(e,Z,"Select the App Store Connect provider for this API key:");if(!k)return;s=k,i.start("Creating API Key with selected App Store Connect team..."),u=y(s),I=u.stdout||"",f=u.stderr||""}}if(f&&(f.includes("DEBUG:")||f.includes("ERROR:"))&&f.split(`
+`).forEach(Z=>{Z.trim()&&R.info(v.dim(`[Ruby] ${Z.trim()}`))}),u.status!==0){i.stop("Failed"),R.error(`Magic creation failed: ${f}`);return}let p=I.match(new RegExp(`${m.jsonStartMarker}(.*)${m.jsonEndMarker}`));if(!p){i.stop("Parse Error"),R.error("Could not parse response from Apple Portal.");return}let l=JSON.parse(p[1]),{id:C,issuerId:A,keyContent:N}=l;if(i.stop("Key Created Successfully"),R.success(`\u2713 Created Key ID: ${v.green(C)}`),!A){ae(`Your Issuer ID is shown at the top of:
+  ${v.cyan("https://appstoreconnect.apple.com/access/integrations/api")}
+
+It looks like: ${v.dim("xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx")}`,"One More Thing");let Z=await $({message:"Enter your App Store Connect Issuer ID:",validate:k=>k.trim().length>0?void 0:"Issuer ID is required"});if(F(Z)){T("Operation cancelled.");return}A=Z.trim()}if(N){let Z=x.join(pe.tmpdir(),`AuthKey_${C}.p8`);G.writeFileSync(Z,N),await ge(n,Z,"ios",A,C,e.ios?.bundleIdentifier||"*",{teamId:t,developerTeamId:t,appStoreConnectTeamId:s,providerId:s}),G.unlinkSync(Z)}else{R.warn(v.yellow("\u26A0\uFE0F  Apple did not return the private key in the response.")),ae(`Download the .p8 file manually:
+
+  1. Open: ${v.cyan("https://appstoreconnect.apple.com/access/integrations/api")}
+  2. Find Key ID: ${v.green(C)}
+  3. Click ${v.bold("Download API Key")} (only available once)
+  4. Drag & drop the downloaded .p8 file below`,"Manual Step Required");let Z=await $({message:"Path to the downloaded .p8 file (drag & drop here):",validate:k=>G.existsSync(k)?void 0:"File not found"});if(F(Z)){T("Operation cancelled. Credential ID was registered but key content is missing.");return}await ge(n,Z,"ios",A,C,e.ios?.bundleIdentifier||"*",{teamId:t,developerTeamId:t,appStoreConnectTeamId:s,providerId:s})}}catch(g){i.stop("Error"),R.error(`Error: ${g.message}`)}}async function Ye(n,e){let i=j(),a=e.submit?.production?.ios?.appleId,t=e.submit?.production?.ios?.appleTeamId,s=Ie(e);if(!a){let d=await $({message:"Apple ID:"});if(F(d))return;a=d}if(!t){let d=await $({message:"Apple Team ID:"});if(F(d))return;t=d,e.submit||(e.submit={production:{ios:{}}}),e.submit.production||(e.submit.production={ios:{}}),e.submit.production.ios||(e.submit.production.ios={}),e.submit.production.ios.appleTeamId=t,G.writeFileSync(`./${m.configFileName}`,JSON.stringify(e,null,2))}i.start("Fetching existing API Keys...");let c=ce();if(!G.existsSync(c)){R.error(`Magic Error: Helper script not found at ${c}`);return}try{let d=l=>Q("ruby",[c,"list"],{env:{...le(),FASTLANE_USER:a,FASTLANE_TEAM_ID:t,...l?{FASTLANE_ITC_TEAM_ID:l,FASTLANE_ASC_TEAM_ID:l}:{}},stdio:["inherit","pipe","pipe"],encoding:"utf-8"}),g=d(s);if(g.status!==0){let l=ue(`${g.stdout||""}
+${g.stderr||""}`);if(l.length>0){i.stop("Select App Store Connect team");let C=await L({message:"Select the App Store Connect team to list API keys:",options:l.map(A=>({value:A.id,label:A.name,hint:A.id}))});if(F(C)){T("Operation cancelled");return}s=C,i.start("Fetching existing API Keys..."),g=d(s)}}if(g.status!==0){i.stop("Failed"),R.error(`Listing failed: ${g.stderr}`);return}let y=g.stdout.match(new RegExp(`${m.jsonStartMarker}(.*)${m.jsonEndMarker}`));if(!y){i.stop("Parse Error");return}let u=JSON.parse(y[1]);if(i.stop(`Found ${u.length} keys`),u.length===0){R.info("No API Keys found on this team.");return}let I=await L({message:"Select a key to delete from Apple Developer Portal:",options:[...u.map(l=>({value:l.id,label:`ID: ${l.id} - ${l.name} (${l.role})`})),{value:"cancel",label:"Cancel"}]});if(F(I)||I==="cancel")return;let f=await ye({message:`Are you sure you want to delete Key ${I}? This cannot be undone.`});if(!f||F(f))return;i.start(`Deleting Key ${I}...`);let p=Q("ruby",[ce(),"delete",I],{env:{...le(),FASTLANE_USER:a,FASTLANE_TEAM_ID:t,...s?{FASTLANE_ITC_TEAM_ID:s,FASTLANE_ASC_TEAM_ID:s}:{}},stdio:"pipe",encoding:"utf-8"});p.status===0?(i.stop("Deleted"),R.success(`\u2713 Key ${I} has been removed from Apple Portal.`)):(i.stop("Deletion Failed"),R.error(`Error: ${p.stderr}`))}catch(d){i.stop("Error"),R.error(`Error: ${d.message}`)}}async function ge(n,e,i,a,t,s="*",c={}){let d=j();d.start(`Uploading Service Credentials for ${i}...`);try{let g=i==="ios"?"asc_api_key":"google_service_account",y=new URL(import.meta.url),u=x.dirname(y.pathname),I=[x.join(u,"isolated-upload.js"),x.join(u,"commands","isolated-upload.js"),x.resolve(u,"../commands/isolated-upload.js"),x.resolve(process.cwd(),`node_modules/.bin/${m.nameLower}-upload`)],f="";for(let l of I)if(G.existsSync(l)){f=l;break}if(!f)throw new Error("Could not locate isolated-upload.js. Ensure the CLI is properly installed.");let p=Q("node",[f,n,e,g,s,"service","undefined","undefined",a||"undefined",t||"undefined","undefined","undefined","undefined",c.teamId||"undefined",c.teamName||"undefined",c.developerTeamId||"undefined",c.appStoreConnectTeamId||"undefined",c.providerId||"undefined",c.providerName||"undefined"],{stdio:"pipe",encoding:"utf-8",env:{...process.env,AT_CLI_ISOLATED:"1"}});if(p.status!==0){let l=p.stderr||p.stdout||"Unknown upload failure";d.stop("Upload Failed"),R.error(v.red(`Upload Failed: ${l}`));return}p.stdout.includes("SUCCESS")?(d.stop("Upload Success"),R.success(v.green(`\u2713 Service Credentials for ${i} uploaded successfully.`))):(d.stop("Upload Summary"),R.warn(v.yellow(`Upload finished but success not confirmed: ${p.stdout}`)))}catch(g){d.stop("Upload Error"),R.error(v.red(`Error: ${g.message}`))}}function Je(n){let e=n==="ios"?".p8":".json",i=[],a=[{path:"./",label:"Project Root"},{path:x.join(pe.homedir(),"Downloads"),label:"Downloads"}];for(let t of a)if(G.existsSync(t.path))try{let s=G.readdirSync(t.path);for(let c of s)if(c.endsWith(e)){if(n==="android"&&!G.readFileSync(x.join(t.path,c),"utf8").includes("service_account")||n==="ios"&&!c.startsWith("AuthKey"))continue;i.push({path:x.join(t.path,c),location:t.label})}}catch{}return i}import Ve from"axios";import o from"chalk";import{execSync as H,spawnSync as M}from"child_process";import fe from"crypto";import b from"fs";import X from"path";import Ce from"os";Ve.defaults.proxy=!1;function me(n,e){if(!b.existsSync(n))return;let i=b.readdirSync(n);for(let a of i){let t=X.join(n,a);if(b.statSync(t).isDirectory()){let c=me(t,e);if(c)return c}else if(e.test(a))return t}}function Pe(n,e,i){let a=b.readFileSync(i,"utf8"),t=Math.floor(Date.now()/1e3),s=Buffer.from(JSON.stringify({alg:"ES256",kid:n,typ:"JWT"})).toString("base64url"),c=Buffer.from(JSON.stringify({iss:e,iat:t,exp:t+1200,aud:"appstoreconnect-v1"})).toString("base64url"),d=`${s}.${c}`,g=fe.createSign("SHA256");g.update(d);let y=g.sign({key:a,dsaEncoding:"ieee-p1363"}).toString("base64url");return`${d}.${y}`}async function Te(n,e,i,a){let t=Pe(e,i,a),s=(await import("axios")).default;for(let c of n)try{await s.post("https://api.appstoreconnect.apple.com/v1/devices",{data:{type:"devices",attributes:{name:c.name,udid:c.udid,platform:"IOS"}}},{headers:{Authorization:`Bearer ${t}`,"Content-Type":"application/json"}}),r.info(o.dim(`  \u2713 Registered: ${c.name}`))}catch(d){let g=d.response?.data?.errors;g?.some(u=>u.code==="ENTITY_ERROR.ATTRIBUTE.INVALID.DUPLICATE"||u.detail?.toLowerCase().includes("already registered")||u.detail?.toLowerCase().includes("already exists"))?r.info(o.dim(`  Already on Portal: ${c.name}`)):r.warn(o.yellow(`  Could not register ${c.name}: ${g?.[0]?.detail||d.message}`))}}var Ze=async n=>{Ue(o.bgCyan.black(m.cliTag("Credentials")));let e=await D({message:"Select platform:",options:[{value:"ios",label:"iOS"},{value:"android",label:"Android"}]});W(e)&&(U("Operation cancelled"),process.exit(0));let i=await D({message:"What do you want to do?",options:[{value:"setup",label:"Build Credentials (Certs/Profiles)",hint:"Manage everything needed to build your project"},{value:"download",label:"Download credentials (credentials.json)",hint:"Sync credentials from Dashboard to local project"},{value:"service",label:"App Store Connect API Key (Magic)",hint:"Manage your API Key for automated submission"},{value:"push",label:"Push Notifications (Placeholder)",hint:"Manage your Apple Push Notifications Key"},{value:"back",label:"Go back"},{value:"exit",label:"Exit"}].filter(a=>!(e==="android"&&(a.value==="service"&&(a.label="Google Service Account (JSON)"),a.value==="push")))});if((W(i)||i==="exit")&&(U("Operation cancelled"),process.exit(0)),i==="back")return Ze(n);if(i==="setup")await $e({...n,platform:e});else if(i==="download")await ze({...n,platform:e});else if(i==="service")await be({...n,platform:e});else if(i==="push")return We("Push Notifications management is coming soon!","Coming Soon"),Ze(n);He(o.green("Done!"))},$e=async n=>{let e=q(),i=n.platform,a=n.profile;if(!a){let d=await D({message:"Select credential type:",options:[{value:"development",label:"Development",hint:"Local testing & simulators"},{value:"staging",label:"Ad Hoc / Staging",hint:"Internal distribution & device testing"},{value:"production",label:"Production / App Store",hint:"App Store & Play Store submission"}]});W(d)&&(U("Operation cancelled"),process.exit(0)),a=d}let t=`./${m.configFileName}`;if(!b.existsSync(t)){r.error(`No ${m.configFileName} found. Run \`${m.nameLower} init\` or \`${m.nameLower} link\` first.`);return}let s=JSON.parse(b.readFileSync(t,"utf-8")),{projectId:c}=s;if(!c){r.error(`${m.configFileName} is missing projectId.`);return}n.awsProfile&&r.warn(o.yellow(`Ignoring --aws-profile. Authenticating with ${m.name} Cloud...`)),r.info(o.dim(`Setting up credentials for: ${a}`)),i==="ios"?await _e(c,a,n,s):await Oe(c,a,a==="production"?"store":"internal",n,s)};async function _e(n,e,i,a){let t=i.bundleId;if(!t){let g=a.submit?.[e]?.ios?.bundleIdentifier||a.submit?.[e]?.ios?.bundleId||se(a,e),y=[];try{let I=(await V.get(`/credentials/${n}`)).data.credentials||[];y=[...new Set(I.filter(f=>f.platform==="ios"&&f.bundleId&&f.bundleId!=="*").map(f=>f.bundleId))]}catch{}if(g&&!y.includes(g)&&y.unshift(g),y.length>0){let u=[...y.map(f=>({value:f,label:f,hint:f===g?"from config":void 0})),{value:"__new__",label:"+ Enter a new Bundle ID"}],I=await D({message:"Which Bundle ID are you setting up credentials for?",options:u});if(W(I)&&(U("Operation cancelled"),process.exit(0)),I==="__new__"){let f=await _({message:"iOS Bundle ID (e.g. com.example.app):",placeholder:"com.example.app",validate:p=>p.includes(".")?void 0:"Please enter a valid Bundle ID"});W(f)&&(U("Operation cancelled"),process.exit(0)),t=f}else t=I}else{let u=await _({message:"iOS Bundle ID (e.g. com.example.app):",placeholder:"com.example.app",validate:I=>I.includes(".")?void 0:"Please enter a valid Bundle ID"});W(u)&&(U("Operation cancelled"),process.exit(0)),t=u}}r.info(o.dim(`Bundle ID: ${t}`));let s=e==="production"?"store":e==="staging"?"adhoc":"development",c=a.submit?.production?.ios?.appleId;c&&r.info(o.dim(`Using Apple ID from config: ${c}`)),await De(n,t,e,s,s==="store"?"appstore":s==="adhoc"?"adhoc":"development",i,a,c)}async function Ke(n){let e="MATCH_ENCRYPTION_PASSPHRASE";try{let c=((await V.get(`/projects/${n}/secrets/export?env=development`)).data.secrets||{})[e];if(c&&!c.includes("[Decryption Failed]"))return r.info(o.dim("Using existing encryption passphrase from Dashboard")),r.info(o.cyan(`MATCH_PASSWORD: ${c}`)),c;if(c&&c.includes("[Decryption Failed]")){r.warn(o.yellow("\u26A0\uFE0F  Existing MATCH_PASSWORD could not be decrypted (encryption key changed).")),r.info(o.dim("Generating a fresh passphrase and cleaning old certificates..."));let d=fe.randomBytes(32).toString("base64");try{await V.post(`/projects/${n}/secrets`,{key:e,value:d,type:"managed",description:"Encryption passphrase for iOS certificates (fastlane match)",visibility:"secret"}),r.success(o.green("\u2713 New encryption passphrase generated and saved"))}catch{}try{await V.post("/credentials/clean-match-storage",{projectId:n}),r.success(o.green("\u2713 Cleaned old certificates from storage"))}catch{}return d}}catch(t){r.info(o.dim(`Could not fetch existing passphrase from Dashboard: ${t.message}`))}let i=await D({message:"No active encryption passphrase found on Dashboard. What would you like to do?",options:[{value:"generate",label:"Generate a new secure passphrase",hint:"Safe for first-time setup"},{value:"enter",label:"Enter existing passphrase manually",hint:"Required if you already have certs in S3"},{value:"cancel",label:"Cancel",hint:"Quit"}]});if((W(i)||i==="cancel")&&(U("Operation cancelled"),process.exit(0)),i==="enter"){let t=await re({message:"Enter your MATCH_PASSWORD (encryption passphrase):",validate:c=>c.length>0?void 0:"Passphrase is required"});W(t)&&(U("Operation cancelled"),process.exit(0));let s=t;try{await V.post(`/projects/${n}/secrets`,{key:e,value:s,type:"managed",description:"Encryption passphrase for iOS certificates (fastlane match)"}),r.success(o.green("\u2713 Saved passphrase to Dashboard"))}catch{}return s}let a=fe.randomBytes(32).toString("base64");try{await V.post(`/projects/${n}/secrets`,{key:e,value:a,type:"managed",description:"Encryption passphrase for iOS certificates (fastlane match)",visibility:"secret"}),r.success(o.green("\u2713 Generated and saved encryption passphrase to Dashboard")),r.info(o.cyan(`MATCH_PASSWORD: ${a}`))}catch(t){r.warn(o.yellow(`Could not save passphrase to Dashboard: ${t.message}`))}return a}async function De(n,e,i,a,t,s,c,d){let g=q();r.info(o.blue("Configuring iOS certificate management..."));let y;if(!d){let u=await _({message:"Apple ID (for Apple Developer Portal):",placeholder:"your-email@example.com",validate:I=>I.includes("@")?void 0:"Please enter a valid email"});W(u)&&(U("Operation cancelled"),process.exit(0)),d=u}g.start(`Fetching ${t} certificates...`);try{let u=await Ke(n),I="",f="";try{let A=await V.post("/credentials/build-server-token",{projectId:n});A.data.status==="success"&&A.data.credentials&&(process.env.AWS_ACCESS_KEY_ID=A.data.credentials.accessKeyId,process.env.AWS_SECRET_ACCESS_KEY=A.data.credentials.secretAccessKey,A.data.credentials.sessionToken&&(process.env.AWS_SESSION_TOKEN=A.data.credentials.sessionToken),f=A.data.credentials.region||"ap-south-1",I=A.data.credentials.bucket||m.bucketPrefix,process.env.AWS_REGION=f,delete process.env.AWS_PROFILE)}catch(A){throw r.error(`Failed to authenticate with ${m.name} Cloud.`),A}if(!I||!f){r.error(`Failed to resolve S3 configuration from ${m.name} Cloud.`);return}let p=s.teamId||c.submit?.production?.ios?.appleTeamId;if(!p)try{let N=(await V.get(`/projects/${n}/secrets`)).data.secrets?.find(Z=>Z.key==="APPLE_TEAM_ID");N&&(p=N.value,r.info(o.dim(`Using Team ID from Dashboard: ${p}`)))}catch{}if(p&&p===c.submit?.production?.ios?.appleTeamId&&r.info(o.dim(`Using Apple Team ID from config: ${p}`)),!p){r.warn(o.yellow(`
+Apple Team ID is required to fetch certificates.`)),r.info(o.dim("You can find this at: https://developer.apple.com/account \u2192 Membership Details"));let A=await _({message:"Enter your 10-character Apple Team ID:",placeholder:"e.g. SA56KTS33U",validate:N=>N.length===10?void 0:"Team ID must be exactly 10 characters"});W(A)&&(U("Operation cancelled"),process.exit(0)),p=A,await we(n,p)}g.stop("Starting certificate sync...");let l=`${m.buildPrefix}-${p}.keychain-db`,C=m.keychainPassword;try{let N=`${process.env.HOME||"/Users/"+(process.env.USER||m.nameLower)}/Library/Keychains/${l}`;r.info(o.dim(`Ensuring keychain exists: ${l}`));try{H(`security create-keychain -p ${C} ${l} 2>/dev/null || true`),H(`security unlock-keychain -p ${C} ${l}`),H(`security set-keychain-settings ${l}`);let S=H("security list-keychains -d user").toString();if(!S.includes(l)){r.info(o.dim(`Adding ${l} to search list`));let h=[...S.replace(/"/g,"").split(`
+`).map(B=>B.trim()).filter(B=>B.length>0),N].join(" ");H(`security list-keychains -d user -s ${h}`)}}catch(S){r.warn(o.dim("Keychain setup warning (non-critical): "+S.message))}let Z,k;try{let w=((await V.get(`/credentials/${n}`)).data.credentials||[]).find(h=>h.type==="asc_api_key"&&h.issuerId);if(w){let h=await V.get(`/credentials/${w.credentialId}/download`,{params:{projectId:n}});if(h.data.downloadUrl){let J=await(await import("axios")).default.get(h.data.downloadUrl,{responseType:"arraybuffer"}),O=X.join(Ce.tmpdir(),`mach-asc-${Date.now()}`);b.mkdirSync(O,{recursive:!0}),y=X.join(O,`AuthKey_${w.keyId}.p8`),b.writeFileSync(y,Buffer.from(J.data)),Z=w.keyId,k=w.issuerId,r.success(o.green("\u2713 ASC API key loaded \u2014 no 2FA required for Portal operations"))}}}catch(S){r.warn(o.dim(`Could not load ASC API key: ${S.message}. Will fall back to Apple ID auth.`))}r.info(o.dim("Generating secure P12 export password..."));let P=ve();r.success(o.green("\u2713 Secure P12 password generated."));let Y={...process.env,AWS_REGION:process.env.AWS_REGION||"ap-south-1",AWS_ACCESS_KEY_ID:process.env.AWS_ACCESS_KEY_ID,AWS_SECRET_ACCESS_KEY:process.env.AWS_SECRET_ACCESS_KEY,SSL_CERT_FILE:"/etc/ssl/cert.pem",AWS_CA_BUNDLE:"/etc/ssl/cert.pem",FASTLANE_SSL_CA_CERT:"/etc/ssl/cert.pem",MATCH_PASSWORD:u,FASTLANE_USER:d,FASTLANE_SKIP_UPDATE_CHECK:"1",FASTLANE_TEAM_ID:p,MATCH_KEYCHAIN_NAME:N,MATCH_KEYCHAIN_PASSWORD:C,TERM:process.env.TERM||"xterm-256color",SHELL:process.env.SHELL||"/bin/zsh",MATCH_OUTPUT_PATH:X.join(process.cwd(),"temp_match"),MATCH_STORAGE_MODE:"s3",MATCH_S3_REGION:f,MATCH_S3_BUCKET:I,MATCH_S3_OBJECT_PREFIX:"ios-certificates/",MATCH_USERNAME:d,MATCH_APP_IDENTIFIER:e,MATCH_TYPE:t,[`${m.envPrefix}P12_PASSWORD`]:P,...y&&Z&&k?{APP_STORE_CONNECT_API_KEY_KEY_ID:Z,APP_STORE_CONNECT_API_KEY_ISSUER_ID:k,APP_STORE_CONNECT_API_KEY_KEY_FILEPATH:y,FASTLANE_SKIP_2FA:"1"}:{}};if(s.force){r.warn(o.yellow(`
+\u26A0\uFE0F  Force flag detected: Hard resetting ${t} certificates...`)),r.info(o.dim("Detected decryption failure loop. Clearing remote storage directly to allow fresh generation.")),r.info(o.cyan(`Current MATCH_PASSWORD: ${u}`)),r.info(o.dim(`Cleaning match storage for Team ID: ${p}...`));try{(await V.post("/credentials/clean-match-storage",{projectId:n,teamId:p})).data.status==="success"&&r.success(o.green(`\u2713 Cleared S3 storage for Team ID: ${p}`))}catch(S){r.warn(o.yellow(`S3 cleanup via API failed: ${S.message}`)),r.info(o.dim("Continuing to attempt standard nuke..."))}try{H(`fastlane match nuke ${t} --skip_confirmation`,{stdio:"inherit",cwd:process.cwd(),env:Y}),r.success(o.green(`\u2713 Nuked existing ${t} credentials`))}catch{r.warn(o.yellow("Standard nuke failed (likely due to password mismatch).")),r.info(o.dim("Since S3 was cleared manually, proceeding to generation..."))}}if(t==="adhoc"||t==="development")try{r.info(o.blue("Fetching registered devices..."));let w=(await V.get("/devices")).data.devices||[];if(w.length===0)r.warn(o.yellow("No registered devices found. Profile will only include devices already on the Apple Developer Portal.")),r.info(o.dim(`Register devices with: ${m.nameLower} device register`));else{let{multiselect:h}=await import("@clack/prompts"),B=await h({message:`Select devices to include in the ${t} profile:`,options:w.map(J=>({value:J.udid,label:`${J.name} (${J.udid.substring(0,12)}...)`,hint:J.model||J.platform})),initialValues:w.map(J=>J.udid)});if(!W(B)&&B.length>0){let J=w.filter(O=>B.includes(O.udid));if(r.info(o.blue(`Registering ${J.length} device(s) on Apple Developer Portal...`)),y&&Z&&k)await Te(J,Z,k,y);else{r.info(o.dim("You will be prompted for a 2FA code once \u2014 type it and press Enter."));for(let O of J){let Ge=O.name.replace(/"/g,'\\"');M(`fastlane run register_device name:"${Ge}" udid:"${O.udid}"`,{shell:!0,env:Y,stdio:"inherit",cwd:process.cwd()})}}r.info(o.green("\u2713 Device registration complete."))}}}catch(S){r.warn(o.yellow(`Could not fetch registered devices: ${S.message}`)),r.info(o.dim("Continuing without explicit device registration."))}try{let S=M(`fastlane match ${t} --app_identifier "${e}" --profile_name "${m.nameLower} ${t} ${e}"`,{shell:!0,cwd:process.cwd(),env:Y,stdio:"inherit",encoding:"utf-8"});if(S.status!==0){r.warn(o.yellow(`
+Certificate sync failed. Attempting to create App ID and retry...`));try{H(`fastlane produce --app_identifier "${e}" --app_name "${e}" --skip_itc`,{stdio:"inherit",env:Y}),r.success(o.green("\u2713 App ID created successfully")),r.info(o.blue("Retrying certificate sync...")),S=M(`fastlane match ${t} --app_identifier "${e}" --profile_name "${m.nameLower} ${t} ${e}"`,{shell:!0,cwd:process.cwd(),env:Y,stdio:"inherit",encoding:"utf-8"})}catch{}if(S.status!==0)throw new Error("fastlane match failed")}}catch(S){r.warn(o.yellow(`
+Sync failed. This often happens if the encryption passphrase (MATCH_PASSWORD) is incorrect or session expired.`)),r.info(o.cyan(`Failed MATCH_PASSWORD was: ${u}`));let w=await D({message:"What would you like to do?",options:[{value:"retry_password",label:"Retry with a different MATCH_PASSWORD",hint:"Manually enter the decryption passphrase"},{value:"check_portal",label:"Check Apple Portal (Resolve certificate limits)",hint:"See if you have too many certificates"},{value:"manual",label:"Fallback to manual upload",hint:"Provide .p12 and .mobileprovision files"},{value:"cancel",label:"Cancel",hint:"Go back"}]});if(W(w)||w==="cancel")throw S;if(w==="retry_password"){r.info(o.dim(`
+You are overriding the dashboard passphrase for this session.`));let h=await re({message:"Enter the correct MATCH_PASSWORD for this project:"});if(h&&!W(h)){u=h,r.info(o.blue("Retrying with provided passphrase...")),r.info(o.cyan(`New MATCH_PASSWORD: ${u}`));let B={...Y,MATCH_PASSWORD:u};if(M(`fastlane match ${t}`,{shell:!0,stdio:"inherit",cwd:process.cwd(),env:B}).status===0)await V.post(`/projects/${n}/secrets`,{key:"MATCH_ENCRYPTION_PASSPHRASE",value:u,description:"Encryption passphrase for iOS certificates (fastlane match)",visibility:"secret"}),r.success(o.green("\u2713 Dashboard passphrase updated.")),r.info(o.cyan(`MATCH_PASSWORD: ${u}`));else throw new Error("Sync failed again with provided passphrase.")}else throw S}else if(w==="check_portal")try{let h=await Ae(Y,t);if(h.length>0){if(r.info(o.dim(`Found ${h.length} existing ${t} certificates on the portal.`)),await je(t,Y,n,h)&&(r.info(o.blue("Retrying certificate sync...")),M(`fastlane match ${t}`,{shell:!0,stdio:"inherit",cwd:process.cwd(),env:Y}).status!==0))throw new Error("Retry failed")}else throw r.error(o.red("No existing certificates found on portal to resolve.")),S}catch(h){throw r.warn(o.dim(`Portal check warning: ${h.message}`)),S}else throw S}r.success(o.green("\u2713 Certificates fetched and synced"));let E=X.join(process.cwd(),"temp_match"),K=X.join(E,`${m.fastlanePrefix}_export.p12`),ee=me(E,/\.mobileprovision$/);try{let w=`${process.env.HOME||"/Users/"+(process.env.USER||m.nameLower)}/Library/Keychains/${l}`;b.existsSync(E)||b.mkdirSync(E,{recursive:!0}),r.info(o.dim("Exporting certificate from keychain for dashboard upload..."));let h=H(`security find-identity -v -p codesigning "${w}"`,{encoding:"utf-8"});r.info(o.dim(`Identities in keychain:
+${h.trim()}`)),H(`security export -k "${w}" -t identities -f pkcs12 -o "${K}" -P ""`,{stdio:"ignore"});try{let B=H(`openssl pkcs12 -in "${K}" -nokeys -passin pass: -legacy 2>/dev/null || openssl pkcs12 -in "${K}" -nokeys -passin pass: 2>/dev/null`,{encoding:"utf-8"});if(!B.includes(p))throw new Error(`Exported P12 does not contain identity for team ${p}. Found: ${B.substring(0,200)}`);r.success(o.green(`\u2713 P12 verified \u2014 contains correct team identity (${p})`))}catch(B){throw new Error(`P12 verification failed: ${B.message}`)}}catch{r.warn(o.dim("Could not export certificate from keychain."))}s.teamId&&!p&&await we(n,s.teamId);let te=b.existsSync(K)?K:me(E,/\.p12$/);if(te&&ee){let S,w;try{let h=await Ae(Y,t);h.length>0&&(S=h[0].expires,w=h[0].id)}catch{r.warn(o.dim("Could not fetch expiration date or ID for dashboard record."))}await z(n,te,"ios_cert",e,a,void 0,S,s.teamId||p,w,P),await z(n,ee,"ios_profile",e,a,void 0,S,s.teamId||p),r.success(o.green("\u2713 Both iOS certificate and provisioning profile uploaded successfully"));try{b.existsSync("./temp_match")&&b.rmSync("./temp_match",{recursive:!0,force:!0})}catch{}}else r.warn(o.yellow("Certificates generated but not found in expected location.")),r.info(o.dim("Falling back to manual upload...")),await Re(n,e,a)}catch(A){g.stop("Certificate fetch failed"),r.error(o.red(`Error: ${A.message}`)),r.info(o.dim("Falling back to manual upload...")),await Re(n,e,a)}}catch(u){g.stop("iOS setup failed"),r.error(o.red(`Error: ${u.message}`))}finally{if(y)try{b.rmSync(X.dirname(y),{recursive:!0,force:!0})}catch{}}}async function we(n,e){try{await V.post(`/projects/${n}/secrets`,{key:"APPLE_TEAM_ID",value:e,description:"Apple Developer Team ID (used for iOS signing)"}),r.success(o.green(`\u2713 Saved Team ID ${e} to Dashboard`))}catch(i){r.warn(o.yellow(`Could not save Team ID to Dashboard: ${i.message}`))}}async function Re(n,e,i){r.info(o.yellow(`
+Manual Upload Mode`)),r.info("Please provide your certificate and provisioning profile:");let a=await _({message:"Path to .p12 certificate file:",validate:c=>b.existsSync(c)?void 0:"File not found"});W(a)&&(U("Operation cancelled"),process.exit(0));let t=await _({message:"Path to .mobileprovision file:",validate:c=>b.existsSync(c)?void 0:"File not found"});W(t)&&(U("Operation cancelled"),process.exit(0));let s=q();s.start(`Uploading to ${m.name} Dashboard...`);try{await z(n,a,"ios_cert",e,i),await z(n,t,"ios_profile",e,i),s.stop("Upload complete"),r.success(o.green("\u2713 iOS credentials uploaded successfully"))}catch(c){throw s.stop("Upload failed"),c}}async function Oe(n,e,i,a,t){let s=q();r.step(o.blue("Android Credential Setup"));let c=a.bundleId;if(!c){let I=ie(t,e),f=[];try{let l=(await V.get(`/credentials/${n}`)).data.credentials||[];f=[...new Set(l.filter(C=>C.platform==="android"&&C.bundleId&&C.bundleId!=="*").map(C=>C.bundleId))]}catch{}if(I&&!f.includes(I)&&f.unshift(I),f.length>0){let p=[...f.map(C=>({value:C,label:C,hint:C===I?"from config":void 0})),{value:"__new__",label:"+ Enter a new Package Name"}],l=await D({message:"Which Package Name are you setting up credentials for?",options:p});if(W(l)&&(U("Operation cancelled"),process.exit(0)),l==="__new__"){let C=await _({message:"Android Package Name (e.g. com.example.app):",placeholder:"com.example.app",validate:A=>A.includes(".")?void 0:"Please enter a valid package name"});W(C)&&(U("Operation cancelled"),process.exit(0)),c=C}else c=l}else{let p=await _({message:"Android Package Name (e.g. com.example.app):",placeholder:"com.example.app",validate:l=>l.includes(".")?void 0:"Please enter a valid package name"});W(p)&&(U("Operation cancelled"),process.exit(0)),c=p}}try{let p=((await V.get(`/credentials/${n}`)).data.credentials||[]).find(l=>l.platform==="android"&&l.distributionType===i&&l.bundleId===c);if(p){r.warn(o.yellow(`\u26A0\uFE0F  Existing Android credentials found for ${i}`));let l=await _({message:"What would you like to do? (use/new/cancel)",validate:C=>{let A=C.toLowerCase();if(!(A==="use"||A==="new"||A==="cancel"))return"Please type: use, new, or cancel"}});if(W(l)||l.toLowerCase()==="cancel")return;if(l.toLowerCase()==="use"){r.success(o.green("\u2713 Using existing credentials."));return}await V.delete(`/credentials/${p.credentialId}?projectId=${n}`)}}catch{}let d="./android/app/my-release-key.jks";if(b.existsSync(d)){let I=await xe({message:"Upload existing keystore?"});if(I&&!W(I)){let f=await _({message:"Key alias:",initialValue:"my-key-alias"});if(W(f))return;let p=await re({message:"Keystore password:"});if(W(p))return;let l=await re({message:"Key password (leave blank if same as keystore password):"});if(W(l))return;let C=l.trim()||p;await z(n,d,"android_keystore",c,i,f,void 0,void 0,void 0,void 0,p,C),r.success(o.green("\u2713 Keystore uploaded"));return}}r.info(o.blue("Generating new Android keystore..."));let g=a.keyAlias||`${m.nameLower}-${Qe()}`,y=ve(),u=`./${m.nameLower}-${e}.jks`;b.existsSync(u)&&b.unlinkSync(u),s.start("Generating keystore...");try{let I=y.replace(/'/g,"'\\''");H(`keytool -genkeypair -v -keystore "${u}" -alias "${g}" -keyalg RSA -keysize 2048 -validity 10000 -storepass '${I}' -keypass '${I}' -dname "CN=${m.name} Build, OU=Mobile, O=Company, L=City, S=State, C=US"`,{stdio:"inherit"}),s.stop("Keystore generated"),await z(n,u,"android_keystore",c,i,g,void 0,void 0,void 0,void 0,y,y),r.success(o.green("\u2713 Android credentials uploaded successfully")),r.info(o.cyan(`Key Alias: ${g}`))}catch(I){throw s.stop("Generation failed"),new Error(`Keystore generation failed: ${I.message}`)}}var Le=n=>new Promise(e=>setTimeout(e,n));function Me(n){return/ECONNRESET|ETIMEDOUT|EAI_AGAIN|ENOTFOUND|ECONNABORTED|socket hang up|network|timeout|temporar/i.test(n)||/API_ERROR:\s*(408|409|425|429|5\d\d)/i.test(n)}async function z(n,e,i,a,t,s,c,d,g,y,u,I){let f=X.basename(e);r.info(o.dim(`Uploading ${f} (Isolated process)...`));let p=new URL(import.meta.url),l=X.dirname(p.pathname),A=[X.join(l,"commands","isolated-upload.js"),n,e,i,a,t,s||"undefined",c||"undefined",d||"undefined",g||"undefined",y||"undefined",u||"undefined",I||"undefined"],N="",Z=5;for(let k=1;k<=Z;k++){let P=M("node",A,{stdio:"pipe",encoding:"utf-8",env:{...process.env,AT_CLI_ISOLATED:"1"}});if(P.status===0&&P.stdout.includes("SUCCESS")){r.info(o.dim(`\u2713 ${f} uploaded and registered.`));return}if(P.status===0){r.warn(o.yellow(`Isolated upload finished but success not confirmed: ${P.stdout}`));return}if(N=(P.stderr||P.stdout||P.error?.message||"Unknown isolated upload failure").trim(),!Me(N)||k>=Z)throw r.error(o.red(`Isolated Upload Failed: ${N}`)),new Error(N);let E=Math.min(3e4,1500*Math.pow(2,k-1));r.warn(o.yellow(`Upload failed with a transient error. Retrying ${f} in ${Math.round(E/1e3)}s... (${k}/${Z})`)),await Le(E)}throw new Error(N||"Unknown isolated upload failure")}async function ze(n){let e=q(),i=n.platform,a=`./${m.configFileName}`;if(!b.existsSync(a)){r.error(`No ${m.configFileName} found. Run \`${m.nameLower} init\` or \`${m.nameLower} link\` first.`);return}let t=JSON.parse(b.readFileSync(a,"utf-8")),{projectId:s}=t;if(!s){r.error(`${m.configFileName} is missing projectId.`);return}try{e.start("Fetching project secrets...");let d=(await V.get(`/projects/${s}/secrets/export?env=all`)).data.secrets||{};e.stop("Secrets fetched and merged."),e.start("Fetching credentials...");let y=(await V.get(`/credentials/${s}`)).data.credentials||[];e.stop(`Found ${y.length} metadata records.`);let u=y.filter(l=>l.platform===i);if(u.length===0){r.info(`No ${i} credentials found on Dashboard.`);return}let I="./credentials.json",f={};if(b.existsSync(I))try{f=JSON.parse(b.readFileSync(I,"utf-8"))}catch{r.warn("Could not parse existing credentials.json, creating a new one.")}f[i]||(f[i]={});let p=X.join(process.cwd(),"credentials",i);b.existsSync(p)||b.mkdirSync(p,{recursive:!0});for(let l of u){e.start(`Downloading ${l.type} (${l.distributionType})...`);try{let C=await V.get(`/credentials/${l.credentialId}/download?projectId=${s}`);if(C.data.status==="success"&&C.data.downloadUrl){let A=X.join(process.cwd(),"credentials",i,l.distributionType);b.existsSync(A)||b.mkdirSync(A,{recursive:!0});let N=l.s3Key?.split(".").pop()||(l.type.includes("keystore")?"jks":l.type.includes("cert")?"p12":"mobileprovision"),Z=`${l.type}.${N}`,k=X.join(A,Z),P=await Ve.get(C.data.downloadUrl,{responseType:"arraybuffer"});b.writeFileSync(k,Buffer.from(P.data));let Y=X.join("credentials",i,l.distributionType,Z);if(i==="android"){if(l.type==="android_keystore"){let E=l.distributionType==="store"?"PRODUCTION":l.distributionType==="internal"?"STAGING":"DEVELOPMENT",K=["PRODUCTION","STORE","INTERNAL","STAGING","DEVELOPMENT","RELEASE","DEBUG"],ee=[`KEYSTORE_PASSWORD_${E}`,`KEYSTORE_PASSWORD_${l.distributionType.toUpperCase()}`,...K.map(h=>`KEYSTORE_PASSWORD_${h}`),"ANDROID_KEYSTONE_PASSWORD","KEYSTORE_PASSWORD"],te=[`KEYSTORE_ALIAS_${E}`,`KEYSTORE_ALIAS_${l.distributionType.toUpperCase()}`,...K.map(h=>`KEYSTORE_ALIAS_${h}`),"KEYSTORE_ALIAS"],S=ee.map(h=>d[h]).find(h=>!!h)||"",w=te.map(h=>d[h]).find(h=>!!h)||l.meta?.alias||"";f.android.keystore={keystorePath:Y,keystorePassword:S,keyAlias:w,keyPassword:S}}}else if(i==="ios"){let E=l.distributionType==="store"?"production":l.distributionType==="adhoc"?"staging":"development";f.ios[E]||(f.ios[E]={}),l.type==="ios_cert"?(f.ios[E].certificatePath=Y,f.ios[E].certificatePassword=d.IOS_P12_PASSWORD||""):l.type==="ios_profile"&&(f.ios[E].provisioningProfilePath=Y)}e.stop(`\u2713 ${l.type} (${l.distributionType}) saved.`)}}catch(C){let A=C.response?.data?.message||C.message;e.stop(o.dim(`- Skipped ${l.type} (${l.distributionType}): ${A}`))}}b.writeFileSync(I,JSON.stringify(f,null,2)),r.success(o.green("\u2713 Local credentials.json updated.")),We("Credentials have been synced to your local machine. Ensure credentials.json and credentials/ is added to your .gitignore.","Sync Complete")}catch(c){e.stop(o.red("Sync failed.")),r.error(`Error: ${c.message}`)}}function ve(){let n="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_+=",e="";for(let i=0;i<24;i++)e+=n.charAt(Math.floor(Math.random()*n.length));return e}function Qe(n=8){let e="abcdefghijklmnopqrstuvwxyz0123456789",i="";for(let a=0;a<n;a++)i+=e.charAt(Math.floor(Math.random()*e.length));return i}async function je(n,e,i,a){let t=a||await Ae(e,n);if(!t||t.length===0)return!1;let s=await D({message:"Select a certificate to revoke:",options:[...t.map(c=>({value:`revoke:${c.id}`,label:`Revoke: ${c.name} (${c.expires})`})),{value:"nuke",label:"Revoke All"},{value:"cancel",label:"Cancel"}]});return W(s)||s==="cancel"?!1:s==="nuke"?(H(`fastlane match nuke ${n}`,{stdio:"inherit",cwd:process.cwd(),env:e}),!0):typeof s=="string"&&s.startsWith("revoke:")?(await qe(e,s.split(":")[1]),!0):!1}async function Ae(n,e){let i=e==="development"?"development":"distribution",a=`
+lane :${m.fastlanePrefix}_list_certs do
+  require 'spaceship'
+  require 'json'
+  begin
+    Spaceship::Portal.login(ENV['FASTLANE_USER'])
+    Spaceship::Portal.select_team(team_id: ENV['FASTLANE_TEAM_ID'])
+    output = Spaceship::Portal.certificate.all.select { |c|
+      if "${i}" == "development"
+        c.type_display_id.downcase.include?("development")
+      else
+        c.type_display_id.downcase.include?("distribution") || c.type_display_id.downcase.include?("production")
+      end
+    }.map { |c| { id: c.id, name: c.name, expires: c.expires.strftime('%Y-%m-%d'), type: c.type_display_id } }
+    puts "${m.jsonStartMarker}" + output.to_json + "${m.jsonEndMarker}"
+  rescue => e
+    $stderr.puts "ERROR: #{e.message}"
+    exit 1
+  end
+end`,t=X.join(Ce.tmpdir(),`/tmp/${m.nameLower}-list-certs-${Date.now()}`),s=X.join(t,"fastlane"),c=X.join(s,"Fastfile");try{b.existsSync(s)||b.mkdirSync(s,{recursive:!0}),b.writeFileSync(c,a);let g=H(`fastlane ${m.fastlanePrefix}_list_certs`,{env:{...n,CI:"1",FASTLANE_FASTFILE:c},cwd:t,stdio:["inherit","pipe","inherit"]}).toString().match(new RegExp(`${m.jsonStartMarker}(.*)${m.jsonEndMarker}`));return g?JSON.parse(g[1]):[]}finally{b.existsSync(t)&&b.rmSync(t,{recursive:!0,force:!0})}}async function qe(n,e){let i=`
+lane :${m.fastlanePrefix}_revoke_cert do
+  require 'spaceship'
+  begin
+    Spaceship::Portal.login(ENV['FASTLANE_USER'])
+    Spaceship::Portal.select_team(team_id: ENV['FASTLANE_TEAM_ID'])
+    cert = Spaceship::Portal.certificate.all.find { |c| c.id == "${e}" }
+    cert.revoke! if cert
+  rescue => e
+    $stderr.puts "ERROR: #{e.message}"
+    exit 1
+  end
+end`,a=X.join(Ce.tmpdir(),`/tmp/${m.nameLower}-revoke-cert-${Date.now()}`),t=X.join(a,"fastlane"),s=X.join(t,"Fastfile");try{b.existsSync(t)||b.mkdirSync(t,{recursive:!0}),b.writeFileSync(s,i),H(`fastlane ${m.fastlanePrefix}_revoke_cert`,{env:{...n,CI:"1",FASTLANE_FASTFILE:s},cwd:a,stdio:["inherit","pipe","inherit"]})}finally{b.existsSync(a)&&b.rmSync(a,{recursive:!0,force:!0})}}export{nt as a,oe as b,ie as c,se as d,it as e,be as f,Ze as g,$e as h,ze as i};

package/dist/commands/isolated-upload.js

@@ -1 +1 @@
-import{g as i}from"../chunk-YBL2LBMW.js";import E from"fs";import S from"path";async function T(){let[o,d,n,I,s,r,f,l,p,u,c,y]=process.argv.slice(2);try{let e=S.basename(d),h=E.readFileSync(d),R=await i.post("/credentials/upload-url",{projectId:o,fileName:e,fileType:"application/octet-stream",type:n,distributionType:s}),{uploadUrl:k,key:x,fileId:P}=R.data,g=(await import("axios")).default,m=!1,w=null;for(let t=1;t<=3;t++)try{t>1&&await new Promise(a=>setTimeout(a,2e3*t)),await g.put(k,h,{headers:{"Content-Type":"application/octet-stream"},maxContentLength:1/0,maxBodyLength:1/0,timeout:6e4}),m=!0;break}catch(a){w=a}if(!m)throw w;await i.post("/credentials",{projectId:o,id:P,name:`${n} - ${s}`,type:n,bundleId:I,distributionType:s,s3Key:x,alias:r==="undefined"?void 0:r,expiresAt:f==="undefined"?void 0:f,issuerId:l==="undefined"?void 0:l,keyId:p==="undefined"?void 0:p,password:u==="undefined"?void 0:u,keystorePassword:c==="undefined"?void 0:c,keyPassword:y==="undefined"?void 0:y}),console.log("SUCCESS"),process.exit(0)}catch(e){e.response?console.error(`API_ERROR: ${e.response.status} - ${JSON.stringify(e.response.data)}`):console.error(`NETWORK_ERROR: ${e.message}`),process.exit(1)}}T();
+import{g as r}from"../chunk-YBL2LBMW.js";import P from"fs";import A from"path";var C=n=>new Promise(e=>setTimeout(e,n));function S(n){let e=n?.response?.status,t=n?.code||"",a=n?.message||"";return!e||e===408||e===409||e===425||e===429||e>=500||/ECONNRESET|ETIMEDOUT|EAI_AGAIN|ENOTFOUND|ECONNABORTED|socket hang up|network|timeout/i.test(`${t} ${a}`)}async function u(n,e,t=5){let a;for(let d=1;d<=t;d++)try{return await e()}catch(s){if(a=s,!S(s)||d>=t)break;let o=Math.min(3e4,1500*Math.pow(2,d-1));console.warn(`[UPLOAD_RETRY] ${n} failed transiently. Retrying in ${Math.round(o/1e3)}s... (${d}/${t})`),await C(o)}throw a}async function b(){let[n,e,t,a,d,s,o,f,p,c,l,m,y,I,w,T,R,E]=process.argv.slice(2);try{let i=A.basename(e),h=P.readFileSync(e),N=await u("create upload URL",()=>r.post("/credentials/upload-url",{projectId:n,fileName:i,fileType:"application/octet-stream",type:t,distributionType:d})),{uploadUrl:g,key:O,fileId:$}=N.data,k=(await import("axios")).default;await u("upload file to storage",()=>k.put(g,h,{headers:{"Content-Type":"application/octet-stream"},maxContentLength:1/0,maxBodyLength:1/0,timeout:18e4})),await u("register credential",()=>r.post("/credentials",{projectId:n,id:$,name:`${t} - ${d}`,type:t,bundleId:a,distributionType:d,s3Key:O,alias:s==="undefined"?void 0:s,expiresAt:o==="undefined"?void 0:o,issuerId:f==="undefined"?void 0:f,keyId:p==="undefined"?void 0:p,password:c==="undefined"?void 0:c,keystorePassword:l==="undefined"?void 0:l,keyPassword:m==="undefined"?void 0:m,teamId:y==="undefined"?void 0:y,teamName:I==="undefined"?void 0:I,developerTeamId:w==="undefined"?void 0:w,appStoreConnectTeamId:T==="undefined"?void 0:T,providerId:R==="undefined"?void 0:R,providerName:E==="undefined"?void 0:E})),console.log("SUCCESS"),process.exit(0)}catch(i){i.response?console.error(`API_ERROR: ${i.response.status} - ${JSON.stringify(i.response.data)}`):console.error(`NETWORK_ERROR: ${i.message}`),process.exit(1)}}b();

package/dist/{credentials-UTJERDGT.js → credentials-TQV5IUCS.js}

@@ -1 +1 @@
-import{g as a,h as b,i as c}from"./chunk-NIGYNUTS.js";import"./chunk-YBL2LBMW.js";export{a as credentialsMainCommand,b as credentialsSetupCommand,c as downloadCredentialsCommand};
+import{g as a,h as b,i as c}from"./chunk-SQL26D7I.js";import"./chunk-YBL2LBMW.js";export{a as credentialsMainCommand,b as credentialsSetupCommand,c as downloadCredentialsCommand};