@radhya/mach 1.8.5 → 1.9.0

package/dist/index.js

@@ -1,21 +1,21 @@
 #!/usr/bin/env node
-import{a as Te,b as We,c as wi,d as Oi,e as et,f as Ci,h as pt}from"./chunk-NIGYNUTS.js";import{a as m,b as Ri,c as ge,d as vi,e as Nt,f as ut,g as v}from"./chunk-YBL2LBMW.js";import{Command as ga,Option as yo}from"commander";import{configDotenv as ha}from"dotenv";import{intro as ue,outro as So}from"@clack/prompts";import se from"chalk";import{text as Ni,confirm as Eo,spinner as Ao,isCancel as ei,cancel as ft,note as bo,outro as _o}from"@clack/prompts";import mt from"chalk";async function Ti(){try{let e=await Ni({message:"Enter Bucket Name:",placeholder:"e.g. my-app-dev",validate(o){if(o.length===0)return"Bucket name is required"}});ei(e)&&(ft("Operation cancelled."),process.exit(0));let t=await Ni({message:"Enter Region:",initialValue:"ap-south-1"});ei(t)&&(ft("Operation cancelled."),process.exit(0));let i=await Eo({message:"Do you want to create a CloudFront Distribution for this bucket?",initialValue:!0});ei(i)&&(ft("Operation cancelled."),process.exit(0));let n=Ao();n.start("Setting up hosting infrastructure...");try{let o=await v.post("/hosting/setup",{bucketName:e,region:t,createCloudFront:i});if(o.data.status!=="success")throw new Error(o.data.message||"Hosting setup failed");n.stop("Hosting setup complete!");let r=o.data,a=`Bucket Name:      ${mt.cyan(r.bucketName)}
-`;a+=`Region:           ${mt.cyan(r.region)}
-`,a+=`S3 Website URL:   ${mt.blue(r.s3WebsiteUrl)}`,r.cloudFrontId&&(a+=`
-
-CloudFront ID:    ${mt.cyan(r.cloudFrontId)}`,a+=`
-CloudFront URL:   ${mt.blue(r.cloudFrontUrl)}`),bo(a,"Setup Complete!"),_o("You are all set!")}catch(o){n.stop("Setup failed"),ft(`Error: ${o.response?.data?.message||o.message}`)}}catch(e){ft(`An unexpected error occurred: ${e.message}`)}}import{readdir as Io,writeFile as Po,access as $o,mkdir as Do}from"fs/promises";import{join as ki}from"path";import{spinner as Ro,text as xi,isCancel as Li,cancel as ti,note as vo,outro as wo}from"@clack/prompts";import Oo from"chalk";async function Co(){let e=["./app","./src/app"];for(let t of e)try{return await $o(t),t}catch{}return null}async function Mi(e){try{let i=await Co()||"./app",n=await xi({message:"Enter path to your app directory:",placeholder:i,initialValue:i,validate(d){if(d.length===0)return"Path is required"}});Li(n)&&(ti("Operation cancelled."),process.exit(0));let o=await xi({message:"Enter your website base URL:",placeholder:"https://example.com",validate(d){if(d.length===0)return"Base URL is required";if(!d.startsWith("http"))return"URL must start with http:// or https://"}});Li(o)&&(ti("Operation cancelled."),process.exit(0));let r=Ro();r.start("Scanning app directory for routes...");let a=await Ui(n);r.stop(`Found ${a.length} routes`);let l=No(a,o),s=e.output||"./public/sitemap.xml";r.start(`Writing sitemap to ${s}...`);let c=s.substring(0,s.lastIndexOf("/"));if(c)try{await Do(c,{recursive:!0})}catch{}await Po(s,l,"utf-8"),r.stop("Sitemap generated successfully!"),vo(`Routes included:
-${a.map(d=>`  \u2022 ${d.path}`).join(`
-`)}`,"Sitemap Summary"),wo(`Sitemap saved to ${Oo.cyan(s)}`)}catch(t){ti(`An error occurred: ${t.message}`)}}async function Ui(e,t=""){let i=[];try{let n=await Io(e,{withFileTypes:!0});for(let o of n){let r=ki(e,o.name);if(!(o.name.startsWith("_")||o.name.startsWith("."))){if(o.isDirectory()){let a=await Ui(r,ki(t,o.name));i.push(...a)}else if(o.isFile()){if(o.name==="index.tsx"||o.name==="index.ts"||o.name==="index.jsx"||o.name==="index.js"){let a=t===""?"/":`/${t}`;i.push({path:a,file:r})}else if(o.name.match(/\.(tsx|ts|jsx|js)$/)&&!o.name.includes("_layout")&&!o.name.includes("+")){let a=o.name.replace(/\.(tsx|ts|jsx|js)$/,""),l=`/${t}/${a}`.replace(/\/+/g,"/");i.push({path:l,file:r})}}}}}catch(n){throw new Error(`Failed to scan directory ${e}: ${n.message}`)}return i}function No(e,t){let i=new Date().toISOString().split("T")[0];return`<?xml version="1.0" encoding="UTF-8"?>
+import{a as Te,b as Ge,c as zi,d as Wi,e as nt,f as Yi,h as mt}from"./chunk-SQL26D7I.js";import{a as f,b as Ki,c as ye,d as Vi,e as xt,f as je,g as v}from"./chunk-YBL2LBMW.js";import{Command as Cl,Option as pt}from"commander";import{configDotenv as Nl}from"dotenv";import{intro as ge,outro as Jr}from"@clack/prompts";import me from"chalk";import{text as Ji,confirm as Xr,spinner as qr,isCancel as ci,cancel as gt,note as Zr,outro as Qr}from"@clack/prompts";import ht from"chalk";async function Xi(){try{let e=await Ji({message:"Enter Bucket Name:",placeholder:"e.g. my-app-dev",validate(r){if(r.length===0)return"Bucket name is required"}});ci(e)&&(gt("Operation cancelled."),process.exit(0));let t=await Ji({message:"Enter Region:",initialValue:"ap-south-1"});ci(t)&&(gt("Operation cancelled."),process.exit(0));let i=await Xr({message:"Do you want to create a CloudFront Distribution for this bucket?",initialValue:!0});ci(i)&&(gt("Operation cancelled."),process.exit(0));let n=qr();n.start("Setting up hosting infrastructure...");try{let r=await v.post("/hosting/setup",{bucketName:e,region:t,createCloudFront:i});if(r.data.status!=="success")throw new Error(r.data.message||"Hosting setup failed");n.stop("Hosting setup complete!");let o=r.data,s=`Bucket Name:      ${ht.cyan(o.bucketName)}
+`;s+=`Region:           ${ht.cyan(o.region)}
+`,s+=`S3 Website URL:   ${ht.blue(o.s3WebsiteUrl)}`,o.cloudFrontId&&(s+=`
+
+CloudFront ID:    ${ht.cyan(o.cloudFrontId)}`,s+=`
+CloudFront URL:   ${ht.blue(o.cloudFrontUrl)}`),Zr(s,"Setup Complete!"),Qr("You are all set!")}catch(r){n.stop("Setup failed"),gt(`Error: ${r.response?.data?.message||r.message}`)}}catch(e){gt(`An unexpected error occurred: ${e.message}`)}}import{readdir as eo,writeFile as to,access as io,mkdir as no}from"fs/promises";import{join as qi}from"path";import{spinner as ro,text as Zi,isCancel as Qi,cancel as ui,note as oo,outro as so}from"@clack/prompts";import ao from"chalk";async function lo(){let e=["./app","./src/app"];for(let t of e)try{return await io(t),t}catch{}return null}async function en(e){try{let i=await lo()||"./app",n=await Zi({message:"Enter path to your app directory:",placeholder:i,initialValue:i,validate(d){if(d.length===0)return"Path is required"}});Qi(n)&&(ui("Operation cancelled."),process.exit(0));let r=await Zi({message:"Enter your website base URL:",placeholder:"https://example.com",validate(d){if(d.length===0)return"Base URL is required";if(!d.startsWith("http"))return"URL must start with http:// or https://"}});Qi(r)&&(ui("Operation cancelled."),process.exit(0));let o=ro();o.start("Scanning app directory for routes...");let s=await tn(n);o.stop(`Found ${s.length} routes`);let l=co(s,r),a=e.output||"./public/sitemap.xml";o.start(`Writing sitemap to ${a}...`);let c=a.substring(0,a.lastIndexOf("/"));if(c)try{await no(c,{recursive:!0})}catch{}await to(a,l,"utf-8"),o.stop("Sitemap generated successfully!"),oo(`Routes included:
+${s.map(d=>`  \u2022 ${d.path}`).join(`
+`)}`,"Sitemap Summary"),so(`Sitemap saved to ${ao.cyan(a)}`)}catch(t){ui(`An error occurred: ${t.message}`)}}async function tn(e,t=""){let i=[];try{let n=await eo(e,{withFileTypes:!0});for(let r of n){let o=qi(e,r.name);if(!(r.name.startsWith("_")||r.name.startsWith("."))){if(r.isDirectory()){let s=await tn(o,qi(t,r.name));i.push(...s)}else if(r.isFile()){if(r.name==="index.tsx"||r.name==="index.ts"||r.name==="index.jsx"||r.name==="index.js"){let s=t===""?"/":`/${t}`;i.push({path:s,file:o})}else if(r.name.match(/\.(tsx|ts|jsx|js)$/)&&!r.name.includes("_layout")&&!r.name.includes("+")){let s=r.name.replace(/\.(tsx|ts|jsx|js)$/,""),l=`/${t}/${s}`.replace(/\/+/g,"/");i.push({path:l,file:o})}}}}}catch(n){throw new Error(`Failed to scan directory ${e}: ${n.message}`)}return i}function co(e,t){let i=new Date().toISOString().split("T")[0];return`<?xml version="1.0" encoding="UTF-8"?>
 <urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
-${e.map(o=>{let r=o.path;return r=r.replace(/\/\([^)]+\)/g,""),r=r.replace(/\/\[.*?\]/g,"/:id"),r=r.replace(/\/+/g,"/"),r===""&&(r="/"),`  <url>
-    <loc>${t}${r}</loc>
+${e.map(r=>{let o=r.path;return o=o.replace(/\/\([^)]+\)/g,""),o=o.replace(/\/\[.*?\]/g,"/:id"),o=o.replace(/\/+/g,"/"),o===""&&(o="/"),`  <url>
+    <loc>${t}${o}</loc>
     <lastmod>${i}</lastmod>
     <changefreq>weekly</changefreq>
     <priority>0.8</priority>
   </url>`}).join(`
 `)}
-</urlset>`}import{randomUUID as dr}from"crypto";import Se from"path";import ht from"axios";import ur from"os";import{spinner as ai,confirm as rn,isCancel as sn,log as w}from"@clack/prompts";import N from"chalk";import re from"fs";import{execSync as an}from"child_process";import ln from"adm-zip";import{spinner as Mo,log as Tt}from"@clack/prompts";import Hi from"chalk";import Bi from"fs";import Gi from"path";var Fi=`#!/bin/bash
+</urlset>`}import{randomUUID as rs}from"crypto";import we from"path";import St from"axios";import os from"os";import{spinner as bi,confirm as kn,isCancel as xn,log as O}from"@clack/prompts";import N from"chalk";import pe from"fs";import{execSync as Ln}from"child_process";import Un from"adm-zip";import{spinner as ho,log as Lt}from"@clack/prompts";import rn from"chalk";import on from"fs";import sn from"path";var nn=`#!/bin/bash
 # --- Mach Cloud Build Script (Android) ---
 # All S3 operations use presigned URLs via curl \u2014 zero AWS credentials on instance.
 BUILD_ID="{{BUILD_ID}}"
@@ -28,6 +28,8 @@ echo "Starting build setup..."
 
 # Forward environment variables (includes PRESIGNED_* URLs + project secrets)
 {{ENV_VARS}}
+export EXPO_NO_DOTENV=1
+echo "[ENV] EXPO_NO_DOTENV=$EXPO_NO_DOTENV"
 export HUSKY=0
 export CI=true
 export npm_config_engine_strict=false
@@ -203,6 +205,14 @@ if [ -d "/home/ubuntu/build/android" ]; then
   find /home/ubuntu/build/android -type d \\( -name build -o -name .cxx \\) -prune -exec rm -rf {} + 2>/dev/null || true
 fi
 
+clear_js_transform_caches() {
+  # Metro/Hermes can cache transformed modules with inlined EXPO_PUBLIC_* values.
+  # Clear after dependency restore/install so restored node_modules cannot reintroduce stale transforms.
+  echo "[CACHE] Clearing Metro/Hermes JS transform caches..."
+  rm -rf /tmp/metro-* /tmp/haste-map-* /tmp/react-native-packager-cache-* 2>/dev/null || true
+  rm -rf /root/.cache/metro /root/.cache/react-native-packager /home/ubuntu/.cache/metro .expo node_modules/.cache/metro 2>/dev/null || true
+}
+
 echo "Cache restore complete."
 
 # CodeArtifact Logic \u2014 use env var if already set (pass as project secret)
@@ -244,6 +254,7 @@ if [ -f "yarn.lock" ]; then
 else
   npm install --no-audit --no-fund --prefer-offline
 fi
+clear_js_transform_caches
 
 # --- Injected Version Code (Auto-versioning) ---
 # Apply before Expo prebuild so generated Gradle files receive the new versionCode.
@@ -291,6 +302,7 @@ fi
 
 # Build
 step_marker build
+clear_js_transform_caches
 if [ -f "android/gradlew" ]; then
   cd android
   GRADLEW="./gradlew"
@@ -502,13 +514,14 @@ for pid in "\${cache_pids[@]}"; do wait "$pid" || true; done
 echo "Build orchestrator finished. Auto-terminating instance in 5 seconds..."
 sleep 5
 sudo shutdown -h now
-`;import To from"crypto";var ko=new Set(["BUILD_ID","BUILD_NUMBER","ANDROID_VERSION_CODE","MACH_TOKEN","MACH_DEBUG","MACH_ENV_FINGERPRINT","CODEARTIFACT_AUTH_TOKEN","EXPO_ZQRN_BB_REPO_TOKEN","SENTRY_AUTH_TOKEN","IOS_DIST_P12","IOS_PROVISIONING_PROFILE","IOS_P12_PASSWORD","MATCH_ENCRYPTION_PASSPHRASE","MATCH_PASSWORD","MATCH_KEYCHAIN_NAME","MATCH_KEYCHAIN_PASSWORD","APPLE_TEAM_ID","FASTLANE_TEAM_ID","ANDROID_KEYSTORE","ANDROID_KEYSTORE_BASE64","ANDROID_STORE_PASSWORD","ANDROID_KEY_PASSWORD","ANDROID_KEY_ALIAS","KEYSTORE_PASSWORD","KEYSTORE_ALIAS","AWS_ACCESS_KEY_ID","AWS_SECRET_ACCESS_KEY","AWS_SESSION_TOKEN","AWS_SECURITY_TOKEN","GITHUB_TOKEN","NPM_TOKEN"]),xo=["PRESIGNED_","KEYSTORE_PASSWORD_"],Lo=e=>!e||ko.has(e)?!1:!xo.some(t=>e.startsWith(t)),Ye=(e,t,i)=>({...e,MACH_BUILD_PROFILE:t,MACH_APP_NAME:i.appName||i.name||"App"}),tt=e=>{let t=Object.entries(e).filter(([i])=>Lo(i)).sort(([i],[n])=>i.localeCompare(n));return To.createHash("sha256").update(JSON.stringify(t)).digest("hex")};var ji=e=>e.replace(/\\/g,"\\\\").replace(/"/g,'\\"').replace(/\$/g,"\\$").replace(/`/g,"\\`"),Ki=async(e,t,i={},n,o)=>{let r=Mo(),a=e.buildProfile||"production",l=a==="production",s=e.apk===!0,c=e.developmentClient?"assembleDebug":l?"bundleRelease":"assembleRelease",d=e.buildCommand||(s?"assembleRelease":c),u=e.nodeVersion?[`echo "[NODE] Switching to Node ${e.nodeVersion}..."`,`CURRENT_MAJOR=$(node -e "process.stdout.write(process.version.split('.')[0].replace('v',''))" 2>/dev/null || echo "0")`,`if [ "$CURRENT_MAJOR" != "${e.nodeVersion}" ]; then`,`  curl -fsSL https://deb.nodesource.com/setup_${e.nodeVersion}.x | bash - 2>&1`,"  apt-get install -y nodejs 2>&1",'  echo "[NODE] Installed Node $(node -v)"',"else",'  echo "[NODE] Already on Node $(node -v) \u2014 no switch needed"',"fi"].join(`
-`):"",p;if(o){let $=Gi.isAbsolute(o)?o:Gi.resolve(process.cwd(),o);Bi.existsSync($)?(p=Bi.readFileSync($,"utf-8"),Tt.info(Hi.magenta(`\u2713 Loaded preBuild hook: ${o}`))):Tt.warn(`preBuild script not found at ${$} \u2014 skipping`)}let f=Ye(i,a,e),y=tt(f),D=Fi.replace(/\{\{BUILD_ID\}\}/g,t).replace(/\{\{BUILD_COMMAND\}\}/g,d).replace("{{NODE_VERSION_SETUP}}",u).replace("{{ENV_VARS}}",`
-export MACH_APP_NAME="${ji(f.MACH_APP_NAME)}"
-export MACH_BUILD_PROFILE="${ji(a)}"
-export MACH_ENV_FINGERPRINT="${y}"
+`;import uo from"crypto";var po="mach-env-v2-js-bundle-cache",fo=new Set(["BUILD_ID","BUILD_NUMBER","ANDROID_VERSION_CODE","MACH_TOKEN","MACH_DEBUG","MACH_ENV_FINGERPRINT","CODEARTIFACT_AUTH_TOKEN","EXPO_ZQRN_BB_REPO_TOKEN","SENTRY_AUTH_TOKEN","IOS_DIST_P12","IOS_PROVISIONING_PROFILE","IOS_P12_PASSWORD","MATCH_ENCRYPTION_PASSPHRASE","MATCH_PASSWORD","MATCH_KEYCHAIN_NAME","MATCH_KEYCHAIN_PASSWORD","APPLE_TEAM_ID","FASTLANE_TEAM_ID","ANDROID_KEYSTORE","ANDROID_KEYSTORE_BASE64","ANDROID_STORE_PASSWORD","ANDROID_KEY_PASSWORD","ANDROID_KEY_ALIAS","KEYSTORE_PASSWORD","KEYSTORE_ALIAS","AWS_ACCESS_KEY_ID","AWS_SECRET_ACCESS_KEY","AWS_SESSION_TOKEN","AWS_SECURITY_TOKEN","GITHUB_TOKEN","NPM_TOKEN"]),mo=["PRESIGNED_","KEYSTORE_PASSWORD_"],go=e=>!e||fo.has(e)?!1:!mo.some(t=>e.startsWith(t)),Xe=(e,t,i)=>({...e,EXPO_NO_DOTENV:"1",MACH_BUILD_PROFILE:t,MACH_APP_NAME:i.appName||i.name||"App"}),rt=e=>{let t=Object.entries(e).filter(([i])=>go(i)).sort(([i],[n])=>i.localeCompare(n));return uo.createHash("sha256").update(JSON.stringify({version:po,entries:t})).digest("hex")};var an=e=>e.replace(/\\/g,"\\\\").replace(/"/g,'\\"').replace(/\$/g,"\\$").replace(/`/g,"\\`"),ln=async(e,t,i={},n,r)=>{let o=ho(),s=e.buildProfile||"production",l=s==="production",a=e.apk===!0,c=e.developmentClient?"assembleDebug":l?"bundleRelease":"assembleRelease",d=e.buildCommand||(a?"assembleRelease":c),u=e.nodeVersion?[`echo "[NODE] Switching to Node ${e.nodeVersion}..."`,`CURRENT_MAJOR=$(node -e "process.stdout.write(process.version.split('.')[0].replace('v',''))" 2>/dev/null || echo "0")`,`if [ "$CURRENT_MAJOR" != "${e.nodeVersion}" ]; then`,`  curl -fsSL https://deb.nodesource.com/setup_${e.nodeVersion}.x | bash - 2>&1`,"  apt-get install -y nodejs 2>&1",'  echo "[NODE] Installed Node $(node -v)"',"else",'  echo "[NODE] Already on Node $(node -v) \u2014 no switch needed"',"fi"].join(`
+`):"",p;if(r){let R=sn.isAbsolute(r)?r:sn.resolve(process.cwd(),r);on.existsSync(R)?(p=on.readFileSync(R,"utf-8"),Lt.info(rn.magenta(`\u2713 Loaded preBuild hook: ${r}`))):Lt.warn(`preBuild script not found at ${R} \u2014 skipping`)}let m=Xe(i,s,e),E=rt(m),U=nn.replace(/\{\{BUILD_ID\}\}/g,t).replace(/\{\{BUILD_COMMAND\}\}/g,d).replace("{{NODE_VERSION_SETUP}}",u).replace("{{ENV_VARS}}",`
+export MACH_APP_NAME="${an(m.MACH_APP_NAME)}"
+export MACH_BUILD_PROFILE="${an(s)}"
+export MACH_ENV_FINGERPRINT="${E}"
+export EXPO_NO_DOTENV=1
 {{ENV_VARS}}
-    `);if(e.dryRun){Tt.info("User Data Script (dry run):"),console.log(D);return}r.start("Requesting cloud build instance...");try{let $=await v.post("/builds/launch-android",{projectId:n,buildId:t,platform:e.platform,buildProfile:e.buildProfile,buildCommand:d,instanceType:e.instanceType,ami:e.ami,keepInstance:e.keepInstance,region:e.region,subnet:e.subnet,securityGroup:e.securityGroup,projectSecrets:i,dryRun:e.dryRun,userDataScript:D,preBuildScriptContent:p});if($.data.status!=="success")throw new Error($.data.message||"Failed to launch build instance");let L=$.data.instanceId;return r.stop("Build Started"),Tt.success(Hi.green(`Build initiated on cloud instance (${L}).`)),{instanceId:L}}catch($){r.stop("Android Build Failed");let L=$.response?.data?.message||$.message;throw new Error(`Failed to launch Android build: ${L}`)}};import{spinner as Uo,log as it}from"@clack/prompts";import Ge from"chalk";import Fo from"fs";import{execSync as gt}from"child_process";var Vi=`#!/bin/bash
+    `);if(e.dryRun){Lt.info("User Data Script (dry run):"),console.log(U);return}o.start("Requesting cloud build instance...");try{let R=await v.post("/builds/launch-android",{projectId:n,buildId:t,platform:e.platform,buildProfile:e.buildProfile,buildCommand:d,instanceType:e.instanceType,ami:e.ami,keepInstance:e.keepInstance,region:e.region,subnet:e.subnet,securityGroup:e.securityGroup,projectSecrets:i,dryRun:e.dryRun,userDataScript:U,preBuildScriptContent:p});if(R.data.status!=="success")throw new Error(R.data.message||"Failed to launch build instance");let F=R.data.instanceId;return o.stop("Build Started"),Lt.success(rn.green(`Build initiated on cloud instance (${F}).`)),{instanceId:F}}catch(R){o.stop("Android Build Failed");let F=R.response?.data?.message||R.message;throw new Error(`Failed to launch Android build: ${F}`)}};import{spinner as yo,log as ot}from"@clack/prompts";import Ke from"chalk";import So from"fs";import{execSync as yt}from"child_process";var dn=`#!/bin/bash
 # --- Mach Cloud Build Script (iOS) ---
 # All S3 operations use presigned URLs via curl \u2014 zero AWS credentials on Mac.
 
@@ -535,6 +548,8 @@ set -e
 
 # 4. Forward environment variables (includes PRESIGNED_* URLs + project secrets)
 {{ENV_VARS}}
+export EXPO_NO_DOTENV=1
+echo "[ENV] EXPO_NO_DOTENV=$EXPO_NO_DOTENV"
 
 BUILD_ID="{{BUILD_ID}}"
 BUILD_ENV_HASH="\${MACH_ENV_FINGERPRINT:-missing-env-fingerprint}"
@@ -604,17 +619,24 @@ if [ -f "$DD_ENV_HASH_FILE" ]; then
 fi
 if [ -d "$DERIVED_DATA_PATH/Build" ]; then
   if [ -z "$DD_PREVIOUS_ENV_HASH" ]; then
-    echo "[CACHE] DerivedData has no env stamp. Pruning stale iOS build products..."
-    rm -rf "$DERIVED_DATA_PATH/Build"
+    echo "[CACHE] DerivedData has no env stamp. Pruning iOS build products..."
   elif [ "$DD_PREVIOUS_ENV_HASH" != "$BUILD_ENV_HASH" ]; then
     echo "[CACHE] Build env changed. Pruning iOS build products..."
-    rm -rf "$DERIVED_DATA_PATH/Build"
   else
-    echo "[CACHE] DerivedData env stamp matches. Reusing Xcode build products."
+    echo "[CACHE] Pruning iOS build products to force a fresh JS bundle."
   fi
+  rm -rf "$DERIVED_DATA_PATH/Build"
 fi
 echo "$BUILD_ENV_HASH" > "$DD_ENV_HASH_FILE"
 
+clear_js_transform_caches() {
+  # Metro/Hermes can cache transformed modules with inlined EXPO_PUBLIC_* values.
+  # Clear after dependency restore/install so restored node_modules cannot reintroduce stale transforms.
+  echo "[CACHE] Clearing Metro/Hermes JS transform caches..."
+  rm -rf "\${TMPDIR:-/tmp}"/metro-* "\${TMPDIR:-/tmp}"/haste-map-* "\${TMPDIR:-/tmp}"/react-native-packager-cache-* 2>/dev/null || true
+  rm -rf "$HOME/Library/Caches/metro" "$HOME/Library/Caches/react-native-packager" "$HOME/.cache/metro" .expo node_modules/.cache/metro 2>/dev/null || true
+}
+
 # 1. Node Modules Cache \u2014 download via presigned URL
 if [ ! -d "node_modules" ] || [ -z "$(ls -A node_modules 2>/dev/null)" ]; then
   echo "Checking node_modules cache..."
@@ -642,6 +664,8 @@ else
   yarn install || npm install || exit 1
 fi
 
+clear_js_transform_caches
+
 # Save node_modules cache via presigned URL
 if [ ! -z "$PRESIGNED_CACHE_NODE_UPLOAD" ]; then
   echo "Uploading node_modules cache..."
@@ -726,7 +750,8 @@ if [ -f "ios/Podfile" ]; then
 fi
 
 # Remove stale artifacts from persistent workspaces before archiving.
-rm -rf build.xcarchive build.ipa build.app.zip export ios/build
+# Keep ios/build because React Native Codegen writes generated podspecs there.
+rm -rf build.xcarchive build.ipa build.app.zip export
 
 # 6. EAS-Style Automatic Signing (Temporary Keychain)
 echo "[STEP_START:signing] $(date +%s)"
@@ -804,6 +829,7 @@ security unlock-keychain -p "\${TEMP_KEYCHAIN_PASSWORD}" "\${TEMP_KEYCHAIN_PATH}
 
 # Build IPA
 echo "[STEP_START:build] $(date +%s)"
+clear_js_transform_caches
 if [ -f "Fastfile" ] || [ -d "fastlane" ]; then
   bundle exec fastlane ios build
 elif [ -d "ios" ]; then
@@ -845,8 +871,11 @@ elif [ -d "ios" ]; then
     if [ "$IS_SIMULATOR" == "true" ]; then
       xcodebuild build -workspace "$WORKSPACE" -scheme "$SCHEME" -configuration "$USER_CONFIG" -sdk "$SDK" -derivedDataPath "$DERIVED_DATA_PATH" $EXTRA_ARGS -parallelizeTargets || exit 1
     else
-      ARCHIVE_SIGN_ARGS="CODE_SIGN_STYLE=Manual \${TEAM_ID:+DEVELOPMENT_TEAM=$TEAM_ID} \${PROFILE_UUID:+PROVISIONING_PROFILE=$PROFILE_UUID} \${PROFILE_NAME:+PROVISIONING_PROFILE_SPECIFIER=$PROFILE_NAME}"
-      xcodebuild archive -workspace "$WORKSPACE" -scheme "$SCHEME" -archivePath "../build.xcarchive" -configuration "$USER_CONFIG" -sdk "$SDK" -derivedDataPath "$DERIVED_DATA_PATH" \${AUTH_PARAMS:+-allowProvisioningUpdates $AUTH_PARAMS} $ARCHIVE_SIGN_ARGS -parallelizeTargets -allowConcurrentBuilds || exit 1
+      ARCHIVE_SIGN_ARGS=("CODE_SIGN_STYLE=Manual")
+      [ -n "$TEAM_ID" ] && ARCHIVE_SIGN_ARGS+=("DEVELOPMENT_TEAM=$TEAM_ID")
+      [ -n "$PROFILE_UUID" ] && ARCHIVE_SIGN_ARGS+=("PROVISIONING_PROFILE=$PROFILE_UUID")
+      [ -n "$PROFILE_NAME" ] && ARCHIVE_SIGN_ARGS+=("PROVISIONING_PROFILE_SPECIFIER=$PROFILE_NAME")
+      xcodebuild archive -workspace "$WORKSPACE" -scheme "$SCHEME" -archivePath "../build.xcarchive" -configuration "$USER_CONFIG" -sdk "$SDK" -derivedDataPath "$DERIVED_DATA_PATH" \${AUTH_PARAMS:+-allowProvisioningUpdates $AUTH_PARAMS} "\${ARCHIVE_SIGN_ARGS[@]}" -parallelizeTargets -allowConcurrentBuilds || exit 1
     fi
   elif [ ! -z "$PROJECT" ]; then
     if [ -z "$USER_SCHEME" ]; then
@@ -864,8 +893,11 @@ elif [ -d "ios" ]; then
     if [ "$IS_SIMULATOR" == "true" ]; then
       xcodebuild build -project "$PROJECT" -scheme "$SCHEME" -configuration "$USER_CONFIG" -sdk "$SDK" -derivedDataPath "$DERIVED_DATA_PATH" $EXTRA_ARGS -parallelizeTargets || exit 1
     else
-      ARCHIVE_SIGN_ARGS="CODE_SIGN_STYLE=Manual \${TEAM_ID:+DEVELOPMENT_TEAM=$TEAM_ID} \${PROFILE_UUID:+PROVISIONING_PROFILE=$PROFILE_UUID} \${PROFILE_NAME:+PROVISIONING_PROFILE_SPECIFIER=$PROFILE_NAME}"
-      xcodebuild archive -project "$PROJECT" -scheme "$SCHEME" -archivePath "../build.xcarchive" -configuration "$USER_CONFIG" -sdk "$SDK" -derivedDataPath "$DERIVED_DATA_PATH" \${AUTH_PARAMS:+-allowProvisioningUpdates $AUTH_PARAMS} $ARCHIVE_SIGN_ARGS -parallelizeTargets -allowConcurrentBuilds || exit 1
+      ARCHIVE_SIGN_ARGS=("CODE_SIGN_STYLE=Manual")
+      [ -n "$TEAM_ID" ] && ARCHIVE_SIGN_ARGS+=("DEVELOPMENT_TEAM=$TEAM_ID")
+      [ -n "$PROFILE_UUID" ] && ARCHIVE_SIGN_ARGS+=("PROVISIONING_PROFILE=$PROFILE_UUID")
+      [ -n "$PROFILE_NAME" ] && ARCHIVE_SIGN_ARGS+=("PROVISIONING_PROFILE_SPECIFIER=$PROFILE_NAME")
+      xcodebuild archive -project "$PROJECT" -scheme "$SCHEME" -archivePath "../build.xcarchive" -configuration "$USER_CONFIG" -sdk "$SDK" -derivedDataPath "$DERIVED_DATA_PATH" \${AUTH_PARAMS:+-allowProvisioningUpdates $AUTH_PARAMS} "\${ARCHIVE_SIGN_ARGS[@]}" -parallelizeTargets -allowConcurrentBuilds || exit 1
     fi
   else
     echo "Error: Neither workspace nor project found for building."
@@ -973,100 +1005,112 @@ touch done
 if [ ! -z "$PRESIGNED_DONE_MARKER" ]; then
   curl -X PUT -T done "$PRESIGNED_DONE_MARKER" --silent
 fi
-`;var zi=e=>e.replace(/\\/g,"\\\\").replace(/"/g,'\\"').replace(/\$/g,"\\$").replace(/`/g,"\\`"),Wi=async(e,t,i={},n)=>{let o=Uo();e.sshHost||(e.sshHost="localhost",it.message(Ge.yellow("No SSH host provided, defaulting to localhost."))),o.start(`Connecting to remote Mac at ${Ge.cyan(e.sshHost)}...`);let r=e.sshUser||process.env.USER||"ubuntu",a=e.sshKey,l=`${r}@${e.sshHost}`,s=`ssh ${a?`-i ${a}`:""} -o StrictHostKeyChecking=no ${l}`,c=`scp ${a?`-i ${a}`:""} -o StrictHostKeyChecking=no`;try{let d=r==="ubuntu"?"/home/ubuntu":`/Users/${r}`,u=(i.PROJECT_ID||"default_project").replace(/[^a-zA-Z0-9-_]/g,"_"),p=`${d}/${m.remoteWorkspacesDir}/${u}`;o.message(`Preparing stable workspace: ${p}...`),gt(`${s} "mkdir -p ${p}"`,{stdio:"inherit"}),o.message("Transferring source code...");let f=`/tmp/${m.nameLower}-source-${t}.zip`;gt(`${c} ${f} ${l}:${p}/source.zip`,{stdio:"inherit"});let y=e.iosApiKeyPath?`${p}/api_key.p8`:"",D="";e.iosApiKeyPath&&(o.message("Uploading App Store Connect API key..."),gt(`${c} ${e.iosApiKeyPath} ${l}:${y}`),e.iosApiKeyId&&e.iosApiKeyIssuer&&(D=`-authenticationKeyID ${e.iosApiKeyId} -authenticationKeyIssuerID ${e.iosApiKeyIssuer} -authenticationKeyPath ${y}`));let $={};if(n)try{let U=await v.post(`/builds/${n}/${t}/build-urls`,{platform:"ios"});U.data.status==="success"&&($=U.data.urls)}catch(U){it.warn(Ge.yellow(`Could not fetch build URLs: ${U.message}`))}let L="";if($.credentials&&$.credentials.length>0)for(let U of $.credentials)U.type==="p12"?L+=`curl -sf -o "$CERT_DIR/${U.name}" "${U.downloadUrl}" || true
-`:U.type==="mobileprovision"&&(L+=`curl -sf -o "$PROV_TEMP/${U.name}" "${U.downloadUrl}" || true
-`);o.message("Generating macOS build script...");let B=process.env.CODEARTIFACT_AUTH_TOKEN?`export CODEARTIFACT_AUTH_TOKEN="${process.env.CODEARTIFACT_AUTH_TOKEN}"
-`:"";if(i)for(let[U,F]of Object.entries(i)){let R=F.replace(/"/g,'\\"').replace(/\$/g,"\\$").replace(/`/g,"\\`");B+=`export ${U}="${R}"
-`}let te=e.buildProfile||"production",E=Ye(i,te,e),H=tt(E),_=[B,$.logUpload?`export PRESIGNED_LOG_UPLOAD="${$.logUpload}"`:"",$.doneMarker?`export PRESIGNED_DONE_MARKER="${$.doneMarker}"`:"",$.cacheDerivedDataDownload?`export PRESIGNED_CACHE_DD_DOWNLOAD="${$.cacheDerivedDataDownload}"`:"",$.cacheDerivedDataUpload?`export PRESIGNED_CACHE_DD_UPLOAD="${$.cacheDerivedDataUpload}"`:"",$.cacheNodeModulesDownload?`export PRESIGNED_CACHE_NODE_DOWNLOAD="${$.cacheNodeModulesDownload}"`:"",$.cacheNodeModulesUpload?`export PRESIGNED_CACHE_NODE_UPLOAD="${$.cacheNodeModulesUpload}"`:"",$.cachePodsDownload?`export PRESIGNED_CACHE_PODS_DOWNLOAD="${$.cachePodsDownload}"`:"",$.cachePodsUpload?`export PRESIGNED_CACHE_PODS_UPLOAD="${$.cachePodsUpload}"`:"",$.artifactIpaUpload?`export PRESIGNED_ARTIFACT_IPA_UPLOAD="${$.artifactIpaUpload}"`:"",$.artifactAppZipUpload?`export PRESIGNED_ARTIFACT_APP_ZIP_UPLOAD="${$.artifactAppZipUpload}"`:"",`export BUILD_ID="${t}"`,`export MACH_BUILD_PROFILE="${zi(te)}"`,`export MACH_APP_NAME="${zi(E.MACH_APP_NAME)}"`,`export MACH_ENV_FINGERPRINT="${H}"`,`export ${m.envPrefix}PROJECT_ID="${u}"`,i.MATCH_ENCRYPTION_PASSPHRASE?`export MATCH_PASSWORD="${i.MATCH_ENCRYPTION_PASSPHRASE}"`:"",i.APPLE_TEAM_ID?`export FASTLANE_TEAM_ID="${i.APPLE_TEAM_ID}"`:"",`export MATCH_KEYCHAIN_NAME="${m.credentialsKeychain}"`,`export MATCH_KEYCHAIN_PASSWORD="${m.keychainPassword}"`].filter(Boolean).join(`
-`),g=e.nodeVersion?[`echo "[NODE] Switching to Node ${e.nodeVersion}..."`,'export NVM_DIR="$HOME/.nvm"','[ -s "$NVM_DIR/nvm.sh" ] && . "$NVM_DIR/nvm.sh" --no-use',`nvm install ${e.nodeVersion} 2>/dev/null || true`,`nvm use ${e.nodeVersion} --silent`,`export PATH="$NVM_DIR/versions/node/$(nvm version ${e.nodeVersion})/bin:$PATH"`,'echo "[NODE] Now using: $(node -v) at $(which node)"'].join(`
-`):"",A=Vi,I={"{{REMOTE_DIR}}":p,"{{ENV_VARS}}":_,"{{CREDENTIAL_DOWNLOADS}}":L,"{{IOS_SCHEME}}":e.iosScheme||"","{{IOS_CONFIG}}":e.iosConfiguration||"Release","{{TEAM_ID}}":e.iosTeamId||"","{{AUTH_PARAMS}}":D,"{{IS_SIMULATOR}}":e.simulator?"true":"false","{{BUILD_ID}}":t,"{{EXPORT_METHOD}}":e.iosExportMethod||"ad-hoc","{{NODE_VERSION_SETUP}}":g};Object.entries(I).forEach(([U,F])=>{A=A.split(U).join(F)});let M=`/tmp/${m.nameLower}-mac-build-${t}.sh`;if(Fo.writeFileSync(M,A),gt(`${c} ${M} ${l}:${p}/build.sh`),o.stop("Remote script uploaded."),it.info(Ge.cyan("Executing remote build. This might take a while...")),gt(`${s} "bash ${p}/build.sh"`,{stdio:"inherit"}),o.stop("Remote build finished!"),n){o.start("Fetching artifact links...");try{let F=(await v.get(`/builds/${n}/${t}/artifacts`)).data.artifacts||[],R=e.simulator===!0;if(F.length===0&&!R)throw o.stop("Build Failed!"),new Error("Build completed but no artifacts were generated. Check build logs for errors.");if(o.stop("Build Successful!"),F.length>0){it.success("Build Artifacts Ready:");for(let k of F)console.log(`
-${Ge.yellow(k.name)}:
-${Ge.cyan(k.downloadUrl)}`);console.log(`
-${Ge.dim("Note: Links are valid for 7 days.")}`)}else R&&it.warn("Simulator build completed. No artifacts uploaded.")}catch(U){o.stop("Could not fetch artifacts"),it.warn(Ge.yellow(`Artifact listing failed: ${U.message}`))}}}catch(d){throw o.stop("iOS Build Failed"),d}};import Ho from"crypto";import Ie from"axios";import Yi from"fs";var ke=6e4,Bo=12e4,ii=4,Ue=e=>encodeURIComponent(e),Go=e=>new Promise(t=>setTimeout(t,e));async function Pe(e,t){let i;for(let n=1;n<=ii;n++)try{return await t()}catch(o){if(i=o,n>=ii||!jo(o))throw o;let r=Number(o.response?.headers?.["retry-after"]),a=Number.isFinite(r)&&r>0?r*1e3:Math.min(2e3*n*n,15e3);console.log(`[Google Play] ${e} failed (attempt ${n}/${ii}); retrying in ${Math.round(a/1e3)}s...`),await Go(a)}throw i}function jo(e){let t=e.response?.status;return t?t===408||t===409||t===425||t===429||t>=500:!0}async function Ji(e,t){let i;try{let n=await kt(t),o=Ue(e);if(i=(await Pe("create edit",()=>Ie.post(`https://androidpublisher.googleapis.com/androidpublisher/v3/applications/${o}/edits`,{},{headers:{Authorization:`Bearer ${n}`,Connection:"close"},timeout:ke}))).data.id,!i)throw new Error("Google Play edit insert succeeded but did not return an edit id.");let a=Ue(i),l=0,c=(await Pe("list tracks",()=>Ie.get(`https://androidpublisher.googleapis.com/androidpublisher/v3/applications/${o}/edits/${a}/tracks`,{headers:{Authorization:`Bearer ${n}`,Connection:"close"},timeout:ke}))).data.tracks||[];for(let d of c)if(d.releases){for(let u of d.releases)if(u.versionCodes)for(let p of u.versionCodes){let f=parseInt(p,10);f>l&&(l=f)}}try{let u=(await Pe("list bundles",()=>Ie.get(`https://androidpublisher.googleapis.com/androidpublisher/v3/applications/${o}/edits/${a}/bundles`,{headers:{Authorization:`Bearer ${n}`,Connection:"close"},timeout:ke}))).data.bundles||[];for(let p of u)p.versionCode&&p.versionCode>l&&(l=p.versionCode)}catch{}try{let u=(await Pe("list APKs",()=>Ie.get(`https://androidpublisher.googleapis.com/androidpublisher/v3/applications/${o}/edits/${a}/apks`,{headers:{Authorization:`Bearer ${n}`,Connection:"close"},timeout:ke}))).data.apks||[];for(let p of u)p.versionCode&&p.versionCode>l&&(l=p.versionCode)}catch{}return l}catch(n){let o=n.response?.data?.error?.message||n.message;throw new Error(`Google Play API Error: ${o}`)}finally{if(i)try{let n=await kt(t);await Pe("delete edit",()=>Ie.delete(`https://androidpublisher.googleapis.com/androidpublisher/v3/applications/${Ue(e)}/edits/${Ue(i)}`,{headers:{Authorization:`Bearer ${n}`,Connection:"close"},timeout:ke}))}catch{}}}async function Xi(e){let{packageName:t,serviceAccount:i,aabPath:n,track:o,releaseStatus:r,userFraction:a,changesNotSentForReview:l}=e,s;try{let d={Authorization:`Bearer ${await kt(i)}`,Connection:"close"},u=Ue(t);if(s=(await Pe("create edit",()=>Ie.post(`https://androidpublisher.googleapis.com/androidpublisher/v3/applications/${u}/edits`,{},{headers:d,timeout:ke}))).data.id,!s)throw new Error("Google Play edit insert succeeded but did not return an edit id.");let f=Ue(s),y=Yi.statSync(n),D=await Pe("upload AAB",()=>Ie.post(`https://androidpublisher.googleapis.com/upload/androidpublisher/v3/applications/${u}/edits/${f}/bundles`,Yi.createReadStream(n),{headers:{...d,"Content-Type":"application/octet-stream","Content-Length":y.size},maxBodyLength:1/0,maxContentLength:1/0,params:{uploadType:"media"},timeout:Bo})),$=Number(D.data.versionCode);if(!$)throw new Error("Google Play upload succeeded but did not return a versionCode.");let L={versionCodes:[String($)],status:r};return(r==="inProgress"||r==="halted")&&typeof a=="number"&&(L.userFraction=a),await Pe("update track",()=>Ie.put(`https://androidpublisher.googleapis.com/androidpublisher/v3/applications/${u}/edits/${f}/tracks/${Ue(o)}`,{releases:[L]},{headers:d,timeout:ke})),await Pe("commit edit",()=>Ie.post(`https://androidpublisher.googleapis.com/androidpublisher/v3/applications/${u}/edits/${f}:commit`,{},{headers:d,params:l?{changesNotSentForReview:!0}:void 0,timeout:ke})),{editId:s,versionCode:$,track:o,releaseStatus:r,userFraction:a}}catch(c){if(s)try{let u=await kt(i);await Pe("delete edit",()=>Ie.delete(`https://androidpublisher.googleapis.com/androidpublisher/v3/applications/${Ue(t)}/edits/${Ue(s)}`,{headers:{Authorization:`Bearer ${u}`,Connection:"close"},timeout:ke}))}catch{}let d=c.response?.data?.error?.message||c.message;throw new Error(`Google Play API Error: ${d}`)}}async function kt(e){let t=Math.floor(Date.now()/1e3),i=t+3600,n={alg:"RS256",typ:"JWT"},o={iss:e.client_email,sub:e.client_email,aud:"https://oauth2.googleapis.com/token",iat:t,exp:i,scope:"https://www.googleapis.com/auth/androidpublisher"},r=Buffer.from(JSON.stringify(n)).toString("base64url"),a=Buffer.from(JSON.stringify(o)).toString("base64url"),l=`${r}.${a}`,s=Ho.createSign("RSA-SHA256");s.update(l);let c=s.sign(e.private_key,"base64url"),d=`${l}.${c}`;return(await Pe("OAuth token exchange",()=>Ie.post("https://oauth2.googleapis.com/token",{grant_type:"urn:ietf:params:oauth:grant-type:jwt-bearer",assertion:d},{headers:{Connection:"close"},timeout:ke}))).data.access_token}import{spinner as xt,log as b,isCancel as Lt,confirm as Ko,select as ni}from"@clack/prompts";import S from"chalk";import h from"fs";import P from"path";import{execSync as j,spawn as Zi}from"child_process";import $e from"os";import Vo from"crypto";var Qi=(e,t)=>t.filter(i=>h.existsSync(P.join(e,i))).reduce((i,n)=>i.update(h.readFileSync(P.join(e,n))),Vo.createHash("sha256")).digest("hex").slice(0,16),zo=e=>Qi(e,["package.json","yarn.lock","package-lock.json","bun.lockb"]),Wo=e=>Qi(e,["Podfile","Podfile.lock"]),Yo=e=>{let t=P.join(e,"fingerprint.json");try{return JSON.parse(h.readFileSync(t,"utf-8"))}catch{return{}}},qi=(e,t)=>{h.mkdirSync(e,{recursive:!0}),h.writeFileSync(P.join(e,"fingerprint.json"),JSON.stringify(t,null,2))},Jo=7200*1e3,Xo=(e,t)=>{h.mkdirSync(e,{recursive:!0});let i=P.join(e,"build.lock");if(h.existsSync(i))try{let n=JSON.parse(h.readFileSync(i,"utf-8")),o=Date.now()-(n.timestamp||0);if(o<Jo)throw new Error(`Another build is already running for this project (build ${n.buildId}, started ${Math.round(o/6e4)}m ago). Cancel it from the dashboard first, or wait for it to complete.`)}catch(n){if(n.message.includes("Another build"))throw n}h.writeFileSync(i,JSON.stringify({buildId:t,pid:process.pid,timestamp:Date.now()}))},qo=(e,t)=>{let i=P.join(e,"build.lock");try{h.existsSync(i)&&JSON.parse(h.readFileSync(i,"utf-8")).buildId===t&&h.unlinkSync(i)}catch{}},xe=(e,t,i=process.cwd(),n={},o,r)=>new Promise((a,l)=>{let s=["/opt/homebrew/bin","/usr/local/bin","/usr/bin","/bin","/usr/sbin","/sbin",P.join($e.homedir(),".npm-global/bin")],d=[...(process.env.PATH||"").split(":"),...s].filter((y,D,$)=>y&&$.indexOf(y)===D).join(":");process.env[`${m.envPrefix}DEBUG`]&&console.log(S.magenta(`[${m.nameUpper}_DEBUG] Execution PATH: ${d}`));let u={...process.env,...n,PATH:d,LANG:"en_US.UTF-8",LC_ALL:"en_US.UTF-8"};o&&process.env[`${m.envPrefix}DEBUG`]&&(o(S.magenta(`[ENVIRONMENT] node: ${process.execPath}
-`)),o(S.magenta(`[ENVIRONMENT] PATH: ${d}
-`)),o(S.magenta(`[ENVIRONMENT] command: ${e} ${t.join(" ")}
-`)));let p=e;if(["node","npm","npx","pod"].includes(e)){let y=P.dirname(process.execPath),D=P.join(y,e);h.existsSync(D)&&(p=D,o&&o(S.dim(`[EXEC] Using absolute path: ${p}
-`)))}let f=Zi(p,t,{stdio:"pipe",cwd:i,shell:!0,env:u,detached:process.platform!=="win32"});if(r){if(r.aborted){if(f.pid)try{process.kill(-f.pid,"SIGTERM")}catch{f.kill()}return l(new Error("Command aborted"))}r.addEventListener("abort",()=>{if(f.pid)try{process.kill(-f.pid,"SIGTERM")}catch{f.kill()}l(new Error("Command aborted"))})}f.stdout.on("data",y=>{let D=y.toString();process.stdout.write(D),o&&o(D)}),f.stderr.on("data",y=>{let D=y.toString();process.stderr.write(D),o&&o(D)}),f.on("close",y=>{y===0?a(y):l(new Error(`Command failed with code ${y}: ${e} ${t.join(" ")}`))}),f.on("error",y=>l(y))}),Zo=e=>{let t=Math.floor(e/1e3%60),i=Math.floor(e/(1e3*60)%60),n=Math.floor(e/(1e3*60*60)%24),o=[];return n>0&&o.push(`${n}h`),i>0&&o.push(`${i}m`),(t>0||o.length===0)&&o.push(`${t}s`),o.join(" ")},nt=(e,t)=>{let i=[];try{if(!h.existsSync(e))return i;let n=h.readdirSync(e);for(let o of n){let r=P.join(e,o);try{let a=h.statSync(r);if(t.some(s=>o.endsWith(s))){i.push(P.resolve(r));continue}a.isDirectory()&&(i=i.concat(nt(r,t)))}catch{}}}catch{}return i},oi=async(e,t,i={},n,o={})=>{let r=xt(),a=Date.now(),l=e.platform,s=e.buildProfile||"production",c=()=>Ye(i,s,e),d=async(g,A={})=>{if(n)for(let I=1;I<=3;I++)try{await v.patch(`/builds/${n}/${t}`,{status:g,...A});return}catch(M){let U=M?.response?.data?.message||M?.message||String(M);console.error(`[reportStatus] attempt ${I}/3 failed (status=${g}): ${U}`),I<3&&await new Promise(F=>setTimeout(F,2e3))}},u=new AbortController,{signal:p}=u,f=null;n&&(f=setInterval(async()=>{try{(await v.get(`/builds/${n}/${t}`)).data.status==="cancelled"&&(b.warn(S.yellow(`
-\u{1F6D1} Build cancelled from dashboard. Terminating...`)),u.abort(),f&&clearInterval(f))}catch{}},5e3));let y=P.join(process.cwd(),".mach-cache"),D="setup",$="",L=null,B=async()=>{if(!$||!n)return;let g=$;$="";try{let A=g;Object.values(i).forEach(I=>{if(I&&I.length>5){let M=I.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");A=A.replace(new RegExp(M,"g"),"[SECRET]")}}),await v.post(`/builds/${n}/${t}/logs`,{log:A,step:D})}catch{}},te=async()=>{L&&(clearTimeout(L),L=null),await B(),qo(y,t),f&&(clearInterval(f),f=null);try{let g=P.join($e.tmpdir(),`${m.buildPrefix}-${t}.keychain-db`);h.existsSync(g)&&(j(`security delete-keychain "${g}"`,{stdio:"ignore"}),b.info(S.dim("\u{1F511} Build keychain deleted.")))}catch{}try{let g=P.join($e.homedir(),"Library/MobileDevice/Provisioning Profiles");if(h.existsSync(g)){let A=h.readdirSync(g).filter(I=>I.includes(t)||I.startsWith(`${m.nameLower}-temp-${t}`));for(let I of A)h.unlinkSync(P.join(g,I))}}catch{}},E=async g=>{n&&($+=g,$.length>=8192?(L&&(clearTimeout(L),L=null),await B()):L||(L=setTimeout(()=>{L=null,B()},2e3)))},H=async g=>{D=g,await E(`[STEP_START:${g}] ${Math.floor(Date.now()/1e3)}
-`)},_=async(g,A,I,M)=>await xe(g,A,I,M,U=>{E(U)},p);b.info(S.blue(`\u{1F680} Starting local build for ${l} (${s})...`));try{Xo(y,t)}catch(g){throw await d("failed",{error:g.message}),g}if(await d("building"),await H("setup"),n&&l==="ios"&&!e.simulator)try{let g=parseInt(i.BUILD_NUMBER||"0",10),A=await v.post(`/projects/${n}/next-build-number`,{platform:"ios",startFrom:g});A.data.status==="success"&&(i.BUILD_NUMBER=String(A.data.buildNumber),b.info(S.dim(`Auto build number: ${i.BUILD_NUMBER}`)),await E(`[BUILD_NUMBER] ${i.BUILD_NUMBER}
-`))}catch(g){b.warn(S.yellow(`Could not fetch auto build number: ${g.message}`))}await H("lock"),e.developmentClient?(b.info(S.blue("\u2139\uFE0F  Configuring build to INCLUDE expo-dev-client (Development Client mode)...")),delete process.env.EXPO_NO_DEV_CLIENT,delete process.env.EXPO_AUTOLINKING_EXCLUDE):(b.info(S.blue("\u2139\uFE0F  Configuring build to EXCLUDE expo-dev-client (Production/Staging mode)...")),process.env.EXPO_NO_DEV_CLIENT="1",process.env.EXPO_AUTOLINKING_EXCLUDE="expo-dev-client");try{await H("clone"),b.info(S.dim("Preparing source...")),await H("read_config");let g=P.join(process.cwd(),m.configFileName);if(h.existsSync(g)){let C=JSON.parse(h.readFileSync(g,"utf-8"))?.build?.[s]||{};await E(`[CONFIG] Profile: ${s}, distribution: ${C.distribution||"not set"}, simulator: ${C.simulator||!1}
-`)}if(await H("read_package"),e.nodeVersion){let O=process.env.NVM_DIR||P.join($e.homedir(),".nvm"),C=P.join(O,"versions","node"),K;if(h.existsSync(C)){let T=h.readdirSync(C).sort().reverse(),Q=e.nodeVersion.startsWith("v")?e.nodeVersion:`v${e.nodeVersion}`,J=T.find(X=>X===Q||X.startsWith(Q+".")||X.startsWith(`v${e.nodeVersion}.`));J&&(K=P.join(C,J,"bin"))}if(K&&h.existsSync(K)){let T=process.env.PATH||"";process.env.PATH=`${K}:${T}`,await E(`[NODE] Switched to Node ${e.nodeVersion} \u2014 using ${K}
-`),b.info(S.green(`\u2713 Node switched to ${e.nodeVersion} (${K})`))}else await E(`[NODE] Warning: Node ${e.nodeVersion} not found in nvm. Run: nvm install ${e.nodeVersion} on the build machine.
-`),b.warn(S.yellow(`Node ${e.nodeVersion} not found in nvm \u2014 using system default`))}await H("deps"),r.start("Checking dependencies...");let A=Yo(y),I=zo(process.cwd()),M=h.existsSync("node_modules"),U=h.existsSync("yarn.lock"),F=h.existsSync("bun.lockb");M&&A.node&&A.node!==I&&(r.stop("Dependency fingerprint changed \u2014 clearing node_modules for clean install..."),await E(`[CACHE] package.json/lockfile changed \u2014 wiping node_modules
-`),h.rmSync(P.join(process.cwd(),"node_modules"),{recursive:!0,force:!0}),M=!1);let R="npm",k=["install","--prefer-offline"];U?(R="yarn",k=["install","--prefer-offline"]):F&&(R="bun",k=["install"]),M?r.stop("Cached node_modules found. Syncing dependencies..."):r.stop("No cached dependencies. Running fresh install..."),e.preBuild&&(b.info(S.blue("Running pre-install hook...")),b.info(S.dim(`> ${e.preBuild}`)),await H("prebuild"),await _("bash",[e.preBuild],process.cwd(),c())),b.info(S.dim(`Running ${R} ${k.join(" ")}...`)),await _(R,k,process.cwd(),c()),A.node=I,qi(y,A);let x=JSON.parse(h.readFileSync("package.json","utf-8")),G=x.dependencies?.expo||x.devDependencies?.expo,q=e.iosBundleIdentifier||"",ce=e.name||"";if(G){r.start(`Enforcing ${m.name} configuration...`);let O=P.join(process.cwd(),"app.json"),C=null;if(h.existsSync(O)){C=h.readFileSync(O,"utf-8");let T=JSON.parse(C);T.expo=T.expo||{},ce||(ce=T.expo.name||""),l==="ios"&&!q&&(q=T.expo?.ios?.bundleIdentifier||""),e.name&&(T.expo.name=e.name),e.scheme&&(T.expo.scheme=e.scheme),l==="ios"&&e.iosBundleIdentifier?(T.expo.ios=T.expo.ios||{},T.expo.ios.bundleIdentifier=e.iosBundleIdentifier):l==="android"&&e.androidPackage&&(T.expo.android=T.expo.android||{},T.expo.android.package=e.androidPackage),h.writeFileSync(O,JSON.stringify(T,null,2))}let K=["exec","--","expo","prebuild","--platform",l,"--no-install"];try{if(await H("prebuild"),await _("npm",K,process.cwd(),c()),l==="ios"&&h.existsSync("ios")){await H("pods"),b.info(S.blue("Running pod install..."));try{let T=P.resolve("ios"),Q=P.join(T,"Podfile");if(!h.existsSync(Q))throw new Error("ios/Podfile not found. Skipping pod install.");let J=h.readFileSync(Q,"utf-8"),X=e.iosDeploymentTarget||"13.4";if(!e.developmentClient&&(b.info(S.blue("\u2139\uFE0F  Patching Podfile to EXCLUDE expo-dev-client...")),J.includes("use_expo_modules!")&&!J.includes("exclude:"))){let ze=/use_expo_modules!(\s*)$/m;ze.test(J)?J=J.replace(ze,'use_expo_modules!(exclude: ["expo-dev-client"])$1'):J=J.replace("use_expo_modules!",'use_expo_modules!(exclude: ["expo-dev-client"])')}let fe=`
+`;var cn=e=>e.replace(/\\/g,"\\\\").replace(/"/g,'\\"').replace(/\$/g,"\\$").replace(/`/g,"\\`"),un=async(e,t,i={},n)=>{let r=yo();e.sshHost||(e.sshHost="localhost",ot.message(Ke.yellow("No SSH host provided, defaulting to localhost."))),r.start(`Connecting to remote Mac at ${Ke.cyan(e.sshHost)}...`);let o=e.sshUser||process.env.USER||"ubuntu",s=e.sshKey,l=`${o}@${e.sshHost}`,a=`ssh ${s?`-i ${s}`:""} -o StrictHostKeyChecking=no ${l}`,c=`scp ${s?`-i ${s}`:""} -o StrictHostKeyChecking=no`;try{let d=o==="ubuntu"?"/home/ubuntu":`/Users/${o}`,u=(i.PROJECT_ID||"default_project").replace(/[^a-zA-Z0-9-_]/g,"_"),p=`${d}/${f.remoteWorkspacesDir}/${u}`;r.message(`Preparing stable workspace: ${p}...`),yt(`${a} "mkdir -p ${p}"`,{stdio:"inherit"}),r.message("Transferring source code...");let m=`/tmp/${f.nameLower}-source-${t}.zip`;yt(`${c} ${m} ${l}:${p}/source.zip`,{stdio:"inherit"});let E=e.iosApiKeyPath?`${p}/api_key.p8`:"",U="";e.iosApiKeyPath&&(r.message("Uploading App Store Connect API key..."),yt(`${c} ${e.iosApiKeyPath} ${l}:${E}`),e.iosApiKeyId&&e.iosApiKeyIssuer&&(U=`-authenticationKeyID ${e.iosApiKeyId} -authenticationKeyIssuerID ${e.iosApiKeyIssuer} -authenticationKeyPath ${E}`));let R={};if(n)try{let D=await v.post(`/builds/${n}/${t}/build-urls`,{platform:"ios"});D.data.status==="success"&&(R=D.data.urls)}catch(D){ot.warn(Ke.yellow(`Could not fetch build URLs: ${D.message}`))}let F="";if(R.credentials&&R.credentials.length>0)for(let D of R.credentials)D.type==="p12"?F+=`curl -sf -o "$CERT_DIR/${D.name}" "${D.downloadUrl}" || true
+`:D.type==="mobileprovision"&&(F+=`curl -sf -o "$PROV_TEMP/${D.name}" "${D.downloadUrl}" || true
+`);r.message("Generating macOS build script...");let T=process.env.CODEARTIFACT_AUTH_TOKEN?`export CODEARTIFACT_AUTH_TOKEN="${process.env.CODEARTIFACT_AUTH_TOKEN}"
+`:"";if(i)for(let[D,_]of Object.entries(i)){let M=_.replace(/"/g,'\\"').replace(/\$/g,"\\$").replace(/`/g,"\\`");T+=`export ${D}="${M}"
+`}let B=e.buildProfile||"production",h=Xe(i,B,e),j=rt(h),$=[T,R.logUpload?`export PRESIGNED_LOG_UPLOAD="${R.logUpload}"`:"",R.doneMarker?`export PRESIGNED_DONE_MARKER="${R.doneMarker}"`:"",R.cacheDerivedDataDownload?`export PRESIGNED_CACHE_DD_DOWNLOAD="${R.cacheDerivedDataDownload}"`:"",R.cacheDerivedDataUpload?`export PRESIGNED_CACHE_DD_UPLOAD="${R.cacheDerivedDataUpload}"`:"",R.cacheNodeModulesDownload?`export PRESIGNED_CACHE_NODE_DOWNLOAD="${R.cacheNodeModulesDownload}"`:"",R.cacheNodeModulesUpload?`export PRESIGNED_CACHE_NODE_UPLOAD="${R.cacheNodeModulesUpload}"`:"",R.cachePodsDownload?`export PRESIGNED_CACHE_PODS_DOWNLOAD="${R.cachePodsDownload}"`:"",R.cachePodsUpload?`export PRESIGNED_CACHE_PODS_UPLOAD="${R.cachePodsUpload}"`:"",R.artifactIpaUpload?`export PRESIGNED_ARTIFACT_IPA_UPLOAD="${R.artifactIpaUpload}"`:"",R.artifactAppZipUpload?`export PRESIGNED_ARTIFACT_APP_ZIP_UPLOAD="${R.artifactAppZipUpload}"`:"",`export BUILD_ID="${t}"`,`export MACH_BUILD_PROFILE="${cn(B)}"`,`export MACH_APP_NAME="${cn(h.MACH_APP_NAME)}"`,`export MACH_ENV_FINGERPRINT="${j}"`,"export EXPO_NO_DOTENV=1",`export ${f.envPrefix}PROJECT_ID="${u}"`,i.MATCH_ENCRYPTION_PASSPHRASE?`export MATCH_PASSWORD="${i.MATCH_ENCRYPTION_PASSPHRASE}"`:"",i.APPLE_TEAM_ID?`export FASTLANE_TEAM_ID="${i.APPLE_TEAM_ID}"`:"",`export MATCH_KEYCHAIN_NAME="${f.credentialsKeychain}"`,`export MATCH_KEYCHAIN_PASSWORD="${f.keychainPassword}"`].filter(Boolean).join(`
+`),I=e.nodeVersion?[`echo "[NODE] Switching to Node ${e.nodeVersion}..."`,'export NVM_DIR="$HOME/.nvm"','[ -s "$NVM_DIR/nvm.sh" ] && . "$NVM_DIR/nvm.sh" --no-use',`nvm install ${e.nodeVersion} 2>/dev/null || true`,`nvm use ${e.nodeVersion} --silent`,`export PATH="$NVM_DIR/versions/node/$(nvm version ${e.nodeVersion})/bin:$PATH"`,'echo "[NODE] Now using: $(node -v) at $(which node)"'].join(`
+`):"",w=dn,b={"{{REMOTE_DIR}}":p,"{{ENV_VARS}}":$,"{{CREDENTIAL_DOWNLOADS}}":F,"{{IOS_SCHEME}}":e.iosScheme||"","{{IOS_CONFIG}}":e.iosConfiguration||"Release","{{TEAM_ID}}":e.iosTeamId||"","{{AUTH_PARAMS}}":U,"{{IS_SIMULATOR}}":e.simulator?"true":"false","{{BUILD_ID}}":t,"{{EXPORT_METHOD}}":e.iosExportMethod||"ad-hoc","{{NODE_VERSION_SETUP}}":I};Object.entries(b).forEach(([D,_])=>{w=w.split(D).join(_)});let L=`/tmp/${f.nameLower}-mac-build-${t}.sh`;if(So.writeFileSync(L,w),yt(`${c} ${L} ${l}:${p}/build.sh`),r.stop("Remote script uploaded."),ot.info(Ke.cyan("Executing remote build. This might take a while...")),yt(`${a} "bash ${p}/build.sh"`,{stdio:"inherit"}),r.stop("Remote build finished!"),n){r.start("Fetching artifact links...");try{let _=(await v.get(`/builds/${n}/${t}/artifacts`)).data.artifacts||[],M=e.simulator===!0;if(_.length===0&&!M)throw r.stop("Build Failed!"),new Error("Build completed but no artifacts were generated. Check build logs for errors.");if(r.stop("Build Successful!"),_.length>0){ot.success("Build Artifacts Ready:");for(let P of _)console.log(`
+${Ke.yellow(P.name)}:
+${Ke.cyan(P.downloadUrl)}`);console.log(`
+${Ke.dim("Note: Links are valid for 7 days.")}`)}else M&&ot.warn("Simulator build completed. No artifacts uploaded.")}catch(D){r.stop("Could not fetch artifacts"),ot.warn(Ke.yellow(`Artifact listing failed: ${D.message}`))}}}catch(d){throw r.stop("iOS Build Failed"),d}};import Eo from"crypto";import Pe from"axios";import pn from"fs";var ke=6e4,bo=12e4,pi=4,Me=e=>encodeURIComponent(e),Ao=e=>new Promise(t=>setTimeout(t,e));async function $e(e,t){let i;for(let n=1;n<=pi;n++)try{return await t()}catch(r){if(i=r,n>=pi||!Io(r))throw r;let o=Number(r.response?.headers?.["retry-after"]),s=Number.isFinite(o)&&o>0?o*1e3:Math.min(2e3*n*n,15e3);console.log(`[Google Play] ${e} failed (attempt ${n}/${pi}); retrying in ${Math.round(s/1e3)}s...`),await Ao(s)}throw i}function Io(e){let t=e.response?.status;return t?t===408||t===409||t===425||t===429||t>=500:!0}async function fn(e,t){let i;try{let n=await Ut(t),r=Me(e);if(i=(await $e("create edit",()=>Pe.post(`https://androidpublisher.googleapis.com/androidpublisher/v3/applications/${r}/edits`,{},{headers:{Authorization:`Bearer ${n}`,Connection:"close"},timeout:ke}))).data.id,!i)throw new Error("Google Play edit insert succeeded but did not return an edit id.");let s=Me(i),l=0,c=(await $e("list tracks",()=>Pe.get(`https://androidpublisher.googleapis.com/androidpublisher/v3/applications/${r}/edits/${s}/tracks`,{headers:{Authorization:`Bearer ${n}`,Connection:"close"},timeout:ke}))).data.tracks||[];for(let d of c)if(d.releases){for(let u of d.releases)if(u.versionCodes)for(let p of u.versionCodes){let m=parseInt(p,10);m>l&&(l=m)}}try{let u=(await $e("list bundles",()=>Pe.get(`https://androidpublisher.googleapis.com/androidpublisher/v3/applications/${r}/edits/${s}/bundles`,{headers:{Authorization:`Bearer ${n}`,Connection:"close"},timeout:ke}))).data.bundles||[];for(let p of u)p.versionCode&&p.versionCode>l&&(l=p.versionCode)}catch{}try{let u=(await $e("list APKs",()=>Pe.get(`https://androidpublisher.googleapis.com/androidpublisher/v3/applications/${r}/edits/${s}/apks`,{headers:{Authorization:`Bearer ${n}`,Connection:"close"},timeout:ke}))).data.apks||[];for(let p of u)p.versionCode&&p.versionCode>l&&(l=p.versionCode)}catch{}return l}catch(n){let r=n.response?.data?.error?.message||n.message;throw new Error(`Google Play API Error: ${r}`)}finally{if(i)try{let n=await Ut(t);await $e("delete edit",()=>Pe.delete(`https://androidpublisher.googleapis.com/androidpublisher/v3/applications/${Me(e)}/edits/${Me(i)}`,{headers:{Authorization:`Bearer ${n}`,Connection:"close"},timeout:ke}))}catch{}}}async function mn(e){let{packageName:t,serviceAccount:i,aabPath:n,track:r,releaseStatus:o,userFraction:s,changesNotSentForReview:l}=e,a;try{let d={Authorization:`Bearer ${await Ut(i)}`,Connection:"close"},u=Me(t);if(a=(await $e("create edit",()=>Pe.post(`https://androidpublisher.googleapis.com/androidpublisher/v3/applications/${u}/edits`,{},{headers:d,timeout:ke}))).data.id,!a)throw new Error("Google Play edit insert succeeded but did not return an edit id.");let m=Me(a),E=pn.statSync(n),U=await $e("upload AAB",()=>Pe.post(`https://androidpublisher.googleapis.com/upload/androidpublisher/v3/applications/${u}/edits/${m}/bundles`,pn.createReadStream(n),{headers:{...d,"Content-Type":"application/octet-stream","Content-Length":E.size},maxBodyLength:1/0,maxContentLength:1/0,params:{uploadType:"media"},timeout:bo})),R=Number(U.data.versionCode);if(!R)throw new Error("Google Play upload succeeded but did not return a versionCode.");let F={versionCodes:[String(R)],status:o};return(o==="inProgress"||o==="halted")&&typeof s=="number"&&(F.userFraction=s),await $e("update track",()=>Pe.put(`https://androidpublisher.googleapis.com/androidpublisher/v3/applications/${u}/edits/${m}/tracks/${Me(r)}`,{releases:[F]},{headers:d,timeout:ke})),await $e("commit edit",()=>Pe.post(`https://androidpublisher.googleapis.com/androidpublisher/v3/applications/${u}/edits/${m}:commit`,{},{headers:d,params:l?{changesNotSentForReview:!0}:void 0,timeout:ke})),{editId:a,versionCode:R,track:r,releaseStatus:o,userFraction:s}}catch(c){if(a)try{let u=await Ut(i);await $e("delete edit",()=>Pe.delete(`https://androidpublisher.googleapis.com/androidpublisher/v3/applications/${Me(t)}/edits/${Me(a)}`,{headers:{Authorization:`Bearer ${u}`,Connection:"close"},timeout:ke}))}catch{}let d=c.response?.data?.error?.message||c.message;throw new Error(`Google Play API Error: ${d}`)}}async function Ut(e){let t=Math.floor(Date.now()/1e3),i=t+3600,n={alg:"RS256",typ:"JWT"},r={iss:e.client_email,sub:e.client_email,aud:"https://oauth2.googleapis.com/token",iat:t,exp:i,scope:"https://www.googleapis.com/auth/androidpublisher"},o=Buffer.from(JSON.stringify(n)).toString("base64url"),s=Buffer.from(JSON.stringify(r)).toString("base64url"),l=`${o}.${s}`,a=Eo.createSign("RSA-SHA256");a.update(l);let c=a.sign(e.private_key,"base64url"),d=`${l}.${c}`;return(await $e("OAuth token exchange",()=>Pe.post("https://oauth2.googleapis.com/token",{grant_type:"urn:ietf:params:oauth:grant-type:jwt-bearer",assertion:d},{headers:{Connection:"close"},timeout:ke}))).data.access_token}import _o from"crypto";import gn from"axios";var mi="https://api.appstoreconnect.apple.com/v1",hn=6e4,fi=4,Po=e=>new Promise(t=>setTimeout(t,e));function $o(e,t,i){let n=Math.floor(Date.now()/1e3),r=Buffer.from(JSON.stringify({alg:"ES256",kid:e,typ:"JWT"})).toString("base64url"),o=Buffer.from(JSON.stringify({iss:t,iat:n,exp:n+1200,aud:"appstoreconnect-v1"})).toString("base64url"),s=`${r}.${o}`,l=_o.createSign("SHA256");l.update(s);let a=l.sign({key:i,dsaEncoding:"ieee-p1363"}).toString("base64url");return`${s}.${a}`}function wo(e){let t=e.response?.status;return t?t===408||t===409||t===425||t===429||t>=500:!0}async function yn(e,t){let i;for(let n=1;n<=fi;n++)try{return await t()}catch(r){if(i=r,n>=fi||!wo(r))throw r;let o=Number(r.response?.headers?.["retry-after"]),s=Number.isFinite(o)&&o>0?o*1e3:Math.min(2e3*n*n,15e3);console.log(`[App Store Connect] ${e} failed (attempt ${n}/${fi}); retrying in ${Math.round(s/1e3)}s...`),await Po(s)}throw i}function Sn(e){return{Authorization:`Bearer ${$o(e.keyId,e.issuerId,e.privateKey)}`,"Content-Type":"application/json",Connection:"close"}}function Ro(e){let t=e.response?.data?.errors;return Array.isArray(t)&&t.length>0?t.map(i=>i.detail||i.title||i.code).filter(Boolean).join("; "):e.response?.data?.error?.message||e.message||"Unknown App Store Connect error"}function Mt(e){let t=String(e||"").trim();if(/^\d+(?:\.\d+){0,2}$/.test(t))return t.split(".").map(i=>Number(i))}function Do(e,t){let i=Mt(e),n=Mt(t);if(!i&&!n)return 0;if(!i)return-1;if(!n)return 1;let r=Math.max(i.length,n.length);for(let o=0;o<r;o++){let s=i[o]||0,l=n[o]||0;if(s!==l)return s>l?1:-1}return 0}function vo(e){let t=Mt(e);return!t||t.length===0?"1":(t[t.length-1]+=1,t.join("."))}async function Oo(e,t,i){if(t)return t;if(!i)throw new Error("Set ios.ascAppId or ios.bundleIdentifier so Mach can find the App Store Connect app.");let r=(await yn("lookup app by bundle ID",()=>gn.get(`${mi}/apps`,{headers:Sn(e),params:{"filter[bundleId]":i,limit:1},timeout:hn}))).data?.data?.[0];if(!r?.id)throw new Error(`No App Store Connect app found for bundle ID ${i}. Set ios.ascAppId in mach.config.json if the app exists.`);return r.id}async function En(e){let t={keyId:e.keyId,issuerId:e.issuerId,privateKey:e.privateKey};try{let i=await Oo(t,e.ascAppId,e.bundleId),n=`${mi}/builds`,r="0",o,s=0;for(;n&&s<10;){s+=1;let l=await yn("list builds",()=>gn.get(n,{headers:Sn(t),params:n===`${mi}/builds`?{"filter[app]":i,"fields[builds]":"version,uploadedDate",sort:"-uploadedDate",limit:200}:void 0,timeout:hn})),a=l.data?.data||[];for(let c of a){let d=String(c.attributes?.version||"").trim();Mt(d)&&Do(d,r)>0&&(r=d,o=c.attributes?.uploadedDate)}n=l.data?.links?.next}return{appId:i,latestBuildNumber:r,nextBuildNumber:vo(r),latestUploadedDate:o}}catch(i){throw new Error(`App Store Connect API Error: ${Ro(i)}`)}}import{spinner as Ft,log as S,isCancel as Bt,confirm as Co,select as hi}from"@clack/prompts";import y from"chalk";import g from"fs";import A from"path";import{execFileSync as gi,execSync as z,spawn as _n}from"child_process";import ue from"os";import No from"crypto";var Pn=(e,t)=>t.filter(i=>g.existsSync(A.join(e,i))).reduce((i,n)=>i.update(g.readFileSync(A.join(e,n))),No.createHash("sha256")).digest("hex").slice(0,16),To=e=>Pn(e,["package.json","yarn.lock","package-lock.json","bun.lockb"]),ko=e=>Pn(e,["Podfile","Podfile.lock"]),xo=e=>{let t=A.join(e,"fingerprint.json");try{return JSON.parse(g.readFileSync(t,"utf-8"))}catch{return{}}},bn=(e,t)=>{g.mkdirSync(e,{recursive:!0}),g.writeFileSync(A.join(e,"fingerprint.json"),JSON.stringify(t,null,2))},Lo=7200*1e3,Uo=(e,t)=>{g.mkdirSync(e,{recursive:!0});let i=A.join(e,"build.lock");if(g.existsSync(i))try{let n=JSON.parse(g.readFileSync(i,"utf-8")),r=Date.now()-(n.timestamp||0);if(r<Lo)throw new Error(`Another build is already running for this project (build ${n.buildId}, started ${Math.round(r/6e4)}m ago). Cancel it from the dashboard first, or wait for it to complete.`)}catch(n){if(n.message.includes("Another build"))throw n}g.writeFileSync(i,JSON.stringify({buildId:t,pid:process.pid,timestamp:Date.now()}))},Mo=(e,t)=>{let i=A.join(e,"build.lock");try{g.existsSync(i)&&JSON.parse(g.readFileSync(i,"utf-8")).buildId===t&&g.unlinkSync(i)}catch{}},An=2e5,In=(e,t)=>{let i=e+t;return i.length>An?i.slice(-An):i},$n=e=>e.replace(/\u001b\[[0-9;]*m/g,""),Fo=(e,t,i,n)=>{let r=$n(n).replace(/\r/g,`
+`).split(`
+`).map(a=>a.trimEnd()).filter(Boolean),o=r.filter(a=>/\berror:|fatal error:|xcodebuild: error|The following build commands failed|Command PhaseScriptExecution failed|CodeSign|Provisioning profile|No profiles|requires a provisioning profile|Undefined symbols|ld:|clang: error|SwiftCompile|CompileC/i.test(a)),s=o.length>0?o.slice(-40):r.slice(-80),l=o.length>0?"Key failure output":"Last command output";return[`Command failed with code ${i}: ${e} ${t.join(" ")}`,s.length>0?`
+${l}:
+${s.join(`
+`)}`:""].join("")},Bo=e=>e==="xcodebuild"&&process.env.MACH_XCODE_FULL_LOGS!=="1",Ho=e=>{let t=$n(e).trim();return t?/\berror:|fatal error:|xcodebuild: error|The following build commands failed|Command PhaseScriptExecution failed|CodeSign|Provisioning profile|No profiles|requires a provisioning profile|Undefined symbols|ld:|clang: error|SwiftCompile|CompileC|CFBundleVersion|ARCHIVE SUCCEEDED|ARCHIVE FAILED|EXPORT SUCCEEDED|EXPORT FAILED|Exported .* to:|\[IPA VALID\]/i.test(t):!1},qe=e=>{try{g.existsSync(e)&&g.rmSync(e,{recursive:!0,force:!0})}catch{}},jo=(e,t)=>{try{if(!g.existsSync(e))return;for(let i of g.readdirSync(e))t(i)&&qe(A.join(e,i))}catch{}},wn=e=>{S.info(y.dim("Clearing Metro/Hermes JS transform caches..."));let t=ue.tmpdir();jo(t,i=>i==="metro-cache"||i.startsWith("metro-")||i.startsWith("haste-map-")||i.startsWith("react-native-packager-cache-")),qe(A.join(e,".expo")),qe(A.join(e,"node_modules/.cache/metro")),qe(A.join(ue.homedir(),".cache/metro")),qe(A.join(ue.homedir(),".cache/react-native-packager")),qe(A.join(ue.homedir(),"Library/Caches/metro")),qe(A.join(ue.homedir(),"Library/Caches/react-native-packager"))},xe=(e,t,i=process.cwd(),n={},r,o)=>new Promise((s,l)=>{let a="",c=Bo(e),d=Date.now(),u=["/opt/homebrew/bin","/usr/local/bin","/usr/bin","/bin","/usr/sbin","/sbin",A.join(ue.homedir(),".npm-global/bin")],m=[...(process.env.PATH||"").split(":"),...u].filter((T,B,h)=>T&&h.indexOf(T)===B).join(":");process.env[`${f.envPrefix}DEBUG`]&&console.log(y.magenta(`[${f.nameUpper}_DEBUG] Execution PATH: ${m}`));let E={...process.env,...n,PATH:m,LANG:"en_US.UTF-8",LC_ALL:"en_US.UTF-8"};r&&process.env[`${f.envPrefix}DEBUG`]&&(r(y.magenta(`[ENVIRONMENT] node: ${process.execPath}
+`)),r(y.magenta(`[ENVIRONMENT] PATH: ${m}
+`)),r(y.magenta(`[ENVIRONMENT] command: ${e} ${t.join(" ")}
+`)));let U=e;if(["node","npm","npx","pod"].includes(e)){let T=A.dirname(process.execPath),B=A.join(T,e);g.existsSync(B)&&(U=B,r&&r(y.dim(`[EXEC] Using absolute path: ${U}
+`)))}let R=_n(U,t,{stdio:"pipe",cwd:i,shell:!0,env:E,detached:process.platform!=="win32"});if(o){if(o.aborted){if(R.pid)try{process.kill(-R.pid,"SIGTERM")}catch{R.kill()}return l(new Error("Command aborted"))}o.addEventListener("abort",()=>{if(R.pid)try{process.kill(-R.pid,"SIGTERM")}catch{R.kill()}l(new Error("Command aborted"))})}let F=(T,B)=>{if(!c){B.write(T);return}let h=T.replace(/\r/g,`
+`).split(`
+`).filter(Ho);if(h.length>0){B.write(`${h.join(`
+`)}
+`),d=Date.now();return}let j=Date.now();j-d>3e4&&(B.write(`[xcodebuild] still running; detailed output is streamed to Mach logs.
+`),d=j)};R.stdout.on("data",T=>{let B=T.toString();a=In(a,B),F(B,process.stdout),r&&r(B)}),R.stderr.on("data",T=>{let B=T.toString();a=In(a,B),F(B,process.stderr),r&&r(B)}),R.on("close",T=>{T===0?s(T):l(new Error(Fo(e,t,T,a)))}),R.on("error",T=>l(T))}),Go=e=>{let t=Math.floor(e/1e3%60),i=Math.floor(e/(1e3*60)%60),n=Math.floor(e/(1e3*60*60)%24),r=[];return n>0&&r.push(`${n}h`),i>0&&r.push(`${i}m`),(t>0||r.length===0)&&r.push(`${t}s`),r.join(" ")},Ze=(e,t)=>{let i=[];try{if(!g.existsSync(e))return i;let n=g.readdirSync(e);for(let r of n){let o=A.join(e,r);try{let s=g.statSync(o);if(t.some(a=>r.endsWith(a))){i.push(A.resolve(o));continue}s.isDirectory()&&(i=i.concat(Ze(o,t)))}catch{}}}catch{}return i},Ko=/^\d+(?:\.\d+){0,2}$/,Rn=e=>{let t=String(e||"").trim();return!t||t==="undefined"||t==="null"?null:Ko.test(t)?t:null},Dn=(e,t)=>{let i=Rn(e);if(!i)throw new Error(`Invalid iOS CFBundleVersion from ${t}: "${e||""}". Apple requires one to three period-separated integers, for example "42" or "1.2.3". If you see "[Decryption Failed]", fix/remove the broken BUILD_NUMBER secret and rebuild.`);return i},vn=(e,t)=>gi("/usr/libexec/PlistBuddy",["-c",`Print :${t}`,e],{encoding:"utf-8"}).trim(),Vo=e=>{let t=A.join(e,"Info.plist");if(!g.existsSync(t))throw new Error(`Could not validate iOS build number: ${t} not found.`);return Dn(vn(t,"CFBundleVersion"),t)},zo=e=>{let i=gi("unzip",["-Z1",e],{encoding:"utf-8"}).split(`
+`).find(r=>/^Payload\/[^/]+\.app\/Info\.plist$/.test(r.trim()));if(!i)throw new Error(`Could not validate iOS build number: ${A.basename(e)} has no Payload/*.app/Info.plist.`);let n=g.mkdtempSync(A.join(ue.tmpdir(),`${f.nameLower}-ipa-plist-`));try{let r=A.join(n,"Info.plist"),o=gi("unzip",["-p",e,i.trim()]);return g.writeFileSync(r,o),Dn(vn(r,"CFBundleVersion"),`${A.basename(e)}:${i.trim()}`)}finally{g.rmSync(n,{recursive:!0,force:!0})}},yi=async(e,t,i={},n,r={})=>{let o=Ft(),s=Date.now(),l=e.platform,a=e.buildProfile||"production",c=()=>Xe(i,a,e),d=async(I,w={})=>{if(n)for(let b=1;b<=3;b++)try{await v.patch(`/builds/${n}/${t}`,{status:I,...w});return}catch(L){let D=L?.response?.data?.message||L?.message||String(L);console.error(`[reportStatus] attempt ${b}/3 failed (status=${I}): ${D}`),b<3&&await new Promise(_=>setTimeout(_,2e3))}},u=new AbortController,{signal:p}=u,m=null;n&&(m=setInterval(async()=>{try{(await v.get(`/builds/${n}/${t}`)).data.status==="cancelled"&&(S.warn(y.yellow(`
+\u{1F6D1} Build cancelled from dashboard. Terminating...`)),u.abort(),m&&clearInterval(m))}catch{}},5e3));let E=A.join(process.cwd(),".mach-cache"),U="setup",R="",F=null,T=async()=>{if(!R||!n)return;let I=R;R="";try{let w=I;Object.values(i).forEach(b=>{if(b&&b.length>5){let L=b.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");w=w.replace(new RegExp(L,"g"),"[SECRET]")}}),await v.post(`/builds/${n}/${t}/logs`,{log:w,step:U})}catch{}},B=async()=>{F&&(clearTimeout(F),F=null),await T(),Mo(E,t),m&&(clearInterval(m),m=null);try{let I=A.join(ue.tmpdir(),`${f.buildPrefix}-${t}.keychain-db`);g.existsSync(I)&&(z(`security delete-keychain "${I}"`,{stdio:"ignore"}),S.info(y.dim("\u{1F511} Build keychain deleted.")))}catch{}try{let I=A.join(ue.homedir(),"Library/MobileDevice/Provisioning Profiles");if(g.existsSync(I)){let w=g.readdirSync(I).filter(b=>b.includes(t)||b.startsWith(`${f.nameLower}-temp-${t}`));for(let b of w)g.unlinkSync(A.join(I,b))}}catch{}},h=async I=>{n&&(R+=I,R.length>=8192?(F&&(clearTimeout(F),F=null),await T()):F||(F=setTimeout(()=>{F=null,T()},2e3)))},j=async I=>{U=I,await h(`[STEP_START:${I}] ${Math.floor(Date.now()/1e3)}
+`)},$=async(I,w,b,L)=>await xe(I,w,b,L,D=>{h(D)},p);S.info(y.blue(`\u{1F680} Starting local build for ${l} (${a})...`));try{Uo(E,t)}catch(I){throw await d("failed",{error:I.message}),I}if(await d("building"),await j("setup"),l==="ios"&&!e.simulator&&i.MACH_IOS_BUILD_NUMBER_LOCKED==="1"&&i.BUILD_NUMBER)S.info(y.dim(`Auto build number: ${i.BUILD_NUMBER}`)),await h(`[BUILD_NUMBER] ${i.BUILD_NUMBER}
+`);else if(n&&l==="ios"&&!e.simulator)try{let I=parseInt(i.BUILD_NUMBER||"0",10),w=Number.isFinite(I)?I:0,b=await v.post(`/projects/${n}/next-build-number`,{platform:"ios",startFrom:w});b.data.status==="success"&&(i.BUILD_NUMBER=String(b.data.buildNumber),S.info(y.dim(`Auto build number: ${i.BUILD_NUMBER}`)),await h(`[BUILD_NUMBER] ${i.BUILD_NUMBER}
+`))}catch(I){S.warn(y.yellow(`Could not fetch auto build number: ${I.message}`))}await j("lock"),e.developmentClient?(S.info(y.blue("\u2139\uFE0F  Configuring build to INCLUDE expo-dev-client (Development Client mode)...")),delete process.env.EXPO_NO_DEV_CLIENT,delete process.env.EXPO_AUTOLINKING_EXCLUDE):(S.info(y.blue("\u2139\uFE0F  Configuring build to EXCLUDE expo-dev-client (Production/Staging mode)...")),process.env.EXPO_NO_DEV_CLIENT="1",process.env.EXPO_AUTOLINKING_EXCLUDE="expo-dev-client");try{await j("clone"),S.info(y.dim("Preparing source...")),await j("read_config");let I=A.join(process.cwd(),f.configFileName);if(g.existsSync(I)){let x=JSON.parse(g.readFileSync(I,"utf-8"))?.build?.[a]||{};await h(`[CONFIG] Profile: ${a}, distribution: ${x.distribution||"not set"}, simulator: ${x.simulator||!1}
+`)}if(await j("read_package"),e.nodeVersion){let H=process.env.NVM_DIR||A.join(ue.homedir(),".nvm"),x=A.join(H,"versions","node"),J;if(g.existsSync(x)){let C=g.readdirSync(x).sort().reverse(),W=e.nodeVersion.startsWith("v")?e.nodeVersion:`v${e.nodeVersion}`,Y=C.find(ee=>ee===W||ee.startsWith(W+".")||ee.startsWith(`v${e.nodeVersion}.`));Y&&(J=A.join(x,Y,"bin"))}if(J&&g.existsSync(J)){let C=process.env.PATH||"";process.env.PATH=`${J}:${C}`,await h(`[NODE] Switched to Node ${e.nodeVersion} \u2014 using ${J}
+`),S.info(y.green(`\u2713 Node switched to ${e.nodeVersion} (${J})`))}else await h(`[NODE] Warning: Node ${e.nodeVersion} not found in nvm. Run: nvm install ${e.nodeVersion} on the build machine.
+`),S.warn(y.yellow(`Node ${e.nodeVersion} not found in nvm \u2014 using system default`))}await j("deps"),o.start("Checking dependencies...");let w=xo(E),b=To(process.cwd()),L=g.existsSync("node_modules"),D=g.existsSync("yarn.lock"),_=g.existsSync("bun.lockb");L&&w.node&&w.node!==b&&(o.stop("Dependency fingerprint changed \u2014 clearing node_modules for clean install..."),await h(`[CACHE] package.json/lockfile changed \u2014 wiping node_modules
+`),g.rmSync(A.join(process.cwd(),"node_modules"),{recursive:!0,force:!0}),L=!1);let M="npm",P=["install","--prefer-offline"];D?(M="yarn",P=["install","--prefer-offline"]):_&&(M="bun",P=["install"]),L?o.stop("Cached node_modules found. Syncing dependencies..."):o.stop("No cached dependencies. Running fresh install..."),e.preBuild&&(S.info(y.blue("Running pre-install hook...")),S.info(y.dim(`> ${e.preBuild}`)),await j("prebuild"),await $("bash",[e.preBuild],process.cwd(),c())),S.info(y.dim(`Running ${M} ${P.join(" ")}...`)),await $(M,P,process.cwd(),c()),w.node=b,bn(E,w);let k=JSON.parse(g.readFileSync("package.json","utf-8")),G=k.dependencies?.expo||k.devDependencies?.expo,V=e.iosBundleIdentifier||"",ce=e.name||"";if(G){o.start(`Enforcing ${f.name} configuration...`);let H=A.join(process.cwd(),"app.json"),x=null;if(g.existsSync(H)){x=g.readFileSync(H,"utf-8");let C=JSON.parse(x);C.expo=C.expo||{},ce||(ce=C.expo.name||""),l==="ios"&&!V&&(V=C.expo?.ios?.bundleIdentifier||""),e.name&&(C.expo.name=e.name),e.scheme&&(C.expo.scheme=e.scheme),l==="ios"&&e.iosBundleIdentifier?(C.expo.ios=C.expo.ios||{},C.expo.ios.bundleIdentifier=e.iosBundleIdentifier):l==="android"&&e.androidPackage&&(C.expo.android=C.expo.android||{},C.expo.android.package=e.androidPackage),g.writeFileSync(H,JSON.stringify(C,null,2))}let J=["exec","--","expo","prebuild","--platform",l,"--no-install"];try{if(await j("prebuild"),await $("npm",J,process.cwd(),c()),l==="ios"&&g.existsSync("ios")){await j("pods"),S.info(y.blue("Running pod install..."));try{let C=A.resolve("ios"),W=A.join(C,"Podfile");if(!g.existsSync(W))throw new Error("ios/Podfile not found. Skipping pod install.");let Y=g.readFileSync(W,"utf-8"),ee=e.iosDeploymentTarget||"13.4";if(!e.developmentClient&&(S.info(y.blue("\u2139\uFE0F  Patching Podfile to EXCLUDE expo-dev-client...")),Y.includes("use_expo_modules!")&&!Y.includes("exclude:"))){let Je=/use_expo_modules!(\s*)$/m;Je.test(Y)?Y=Y.replace(Je,'use_expo_modules!(exclude: ["expo-dev-client"])$1'):Y=Y.replace("use_expo_modules!",'use_expo_modules!(exclude: ["expo-dev-client"])')}let de=`
       installer.generated_projects.each do |project|
         project.targets.each do |target|
           target.build_configurations.each do |config|
-            config.build_settings['IPHONEOS_DEPLOYMENT_TARGET'] = '${X}'
+            config.build_settings['IPHONEOS_DEPLOYMENT_TARGET'] = '${ee}'
           end
         end
       end
       installer.pods_project.targets.each do |target|
         target.build_configurations.each do |config|
-          config.build_settings['IPHONEOS_DEPLOYMENT_TARGET'] = '${X}'
+          config.build_settings['IPHONEOS_DEPLOYMENT_TARGET'] = '${ee}'
         end
       end
-`,Me=/post_install\s+do\s+\|installer\|/;if(Me.test(J))b.info(S.dim(`Injecting deployment target (${X}) into existing post_install hook...`)),J=J.replace(Me,`post_install do |installer|
-${fe}`),h.writeFileSync(Q,J);else{b.info(S.dim(`Appending new post_install hook for deployment target (${X})...`));let ze=`
+`,Ue=/post_install\s+do\s+\|installer\|/;if(Ue.test(Y))S.info(y.dim(`Injecting deployment target (${ee}) into existing post_install hook...`)),Y=Y.replace(Ue,`post_install do |installer|
+${de}`),g.writeFileSync(W,Y);else{S.info(y.dim(`Appending new post_install hook for deployment target (${ee})...`));let Je=`
 post_install do |installer|
-${fe}
+${de}
 end
-`;h.appendFileSync(Q,ze)}let Ze="/opt/homebrew/bin/pod",dt=h.existsSync(Ze)?Ze:"pod",Qe=Wo(T);h.existsSync(P.join(T,"Pods"))&&A.pods&&A.pods!==Qe&&(await E(`[CACHE] Podfile/Podfile.lock changed \u2014 wiping ios/Pods
-`),b.info(S.dim("Podfile fingerprint changed \u2014 clearing Pods for clean install...")),h.rmSync(P.join(T,"Pods"),{recursive:!0,force:!0})),b.info(S.dim(`Using pod command: ${dt} in ${T}`)),await _(dt,["install"],T,c()),A.pods=Qe,qi(y,A)}catch(T){let Q=T.message||"Unknown error";b.warn(S.yellow(`Native "pod" command failed: ${Q}`)),b.info(S.dim("Falling back to npm exec pod-install...")),b.info(S.magenta(`${m.nameUpper}_DEBUG: Executing pod-install override via npx --yes pod-install@latest`)),await _("npx",["--yes","pod-install@latest","ios"],process.cwd(),c())}if(h.existsSync("ios/Pods")){b.info(S.dim("Disabling signing for Pod targets to prevent conflicts..."));try{j(`find ios/Pods -name "project.pbxproj" -exec sed -i '' 's/buildSettings = {/buildSettings = { CODE_SIGNING_ALLOWED = NO; CODE_SIGNING_REQUIRED = NO; PROVISIONING_PROFILE_SPECIFIER = ""; EXPANDED_CODE_SIGN_IDENTITY = "";/g' {} +`,{stdio:"ignore"})}catch{}}}}finally{C&&h.writeFileSync(O,C)}r.stop(`Expo prebuild complete (${m.name} config enforced).`)}let W=[];if(l==="android")await H("build"),W=await Qo(e,s,i,O=>E(O),p);else if(l==="ios"){await H("signing"),b.info(S.dim("Preparing credentials..."));let O=o?.distributionType;W=await er(e,t,s,i,n,C=>E(C),p,O,C=>H(C))}e.postBuild&&(b.info(S.blue("Running post-build hook...")),b.info(S.dim(`> ${e.postBuild}`)),await _(e.postBuild,[],process.cwd(),c()));let Ce=Zo(Date.now()-a);if(b.success(S.green(`
-\u2713 Local build completed successfully in ${Ce}`)),await d("building",{...q&&{bundleId:q},...ce&&{appName:ce}}),W.length>0&&(b.info(S.cyan(`
-\u{1F4E6} Generated Artifacts:`)),W.forEach(O=>{let C=P.resolve(O);b.info(S.dim(`  - ${O}`)),b.info(S.gray(`    Path: ${C}`))}),e.interactive)){let O=await Ko({message:"Install on connected device?"});if(!Lt(O)&&O){if(l==="android"){let C=W.find(K=>K.endsWith(".apk"))||W[0];await ir(C,K=>E(K))}else if(l==="ios"){let C=W.find(T=>T.endsWith(".ipa"))||W.find(T=>T.endsWith(".app"))||W[0],K=Fe("ios");e.simulator?await nr(C,K||"",T=>E(T)):await or(C,K||"",T=>E(T))}}}await H("upload");let pe=[];for(let O of W)try{let C=P.join($e.tmpdir(),`${t}-${P.basename(O)}`);h.copyFileSync(O,C),pe.push(C),b.info(S.dim(`  \u{1F4CB} Preserved artifact: ${P.basename(O)}`))}catch{b.warn(S.yellow(`  Failed to preserve artifact: ${P.basename(O)}`))}W=pe,b.info(S.dim("\u{1F9F9} Cleaning workspace (preserving dependency cache)..."));try{let O=process.cwd(),C=new Set(["node_modules"]),K=h.readdirSync(O),T=0;for(let Q of K)if(!C.has(Q)){if(Q==="ios"){let J=P.join(O,"ios"),X=h.readdirSync(J);for(let fe of X)if(fe!=="Pods")try{h.rmSync(P.join(J,fe),{recursive:!0,force:!0}),T++}catch{}continue}try{h.rmSync(P.join(O,Q),{recursive:!0,force:!0}),T++}catch{}}b.info(S.dim(`  Cleaned ${T} items. Cached: node_modules${h.existsSync(P.join(O,"ios","Pods"))?", ios/Pods":""}`)),b.info(S.green("\u{1F512} Security: No source code retained on build server. Only public dependencies cached."))}catch{b.warn(S.yellow("Post-build cleanup encountered errors (non-fatal)."))}try{let C=P.join($e.homedir(),m.workspacesDir),K=j(`df -k "${C}" | tail -1 | awk '{print $4}'`,{encoding:"utf8"}).trim(),T=parseInt(K,10)*1024;if(T<53687091200&&h.existsSync(C)){b.info(S.dim(`  \u26A0\uFE0F Low disk space (${(T/1024/1024/1024).toFixed(0)} GB free). Running cache eviction...`));let Q=P.basename(process.cwd()),J=h.readdirSync(C).filter(X=>X!==Q).map(X=>{let fe=P.join(C,X);try{let Me=h.statSync(fe);return Me.isDirectory()?{name:X,dir:fe,mtime:Me.mtimeMs}:null}catch{return null}}).filter(Boolean);J.sort((X,fe)=>X.mtime-fe.mtime);for(let X of J){if(T>=53687091200)break;try{h.rmSync(X.dir,{recursive:!0,force:!0}),b.info(S.dim(`  \u{1F5D1}\uFE0F Evicted stale workspace: ${X.name}`));let fe=j(`df -k "${C}" | tail -1 | awk '{print $4}'`,{encoding:"utf8"}).trim();if(parseInt(fe,10)*1024>=53687091200)break}catch{}}}}catch{}return await te(),W}catch(g){throw await te(),g.message==="Command aborted"?(b.warn(S.yellow(`
-\u274C Build aborted.`)),await d("failed",{error:"Aborted by user"}),g):(b.error(S.red(`
-\u2717 Local build failed: ${g.message}`)),await d("failed",{error:g.message}),g)}},Qo=async(e,t,i={},n,o)=>{let r=h.existsSync("android/gradlew")?"android/gradlew":h.existsSync("gradlew")?"./gradlew":null;if(!r)throw new Error("Could not find gradlew. Is this an Android project?");let a=e.developmentClient?"assembleDebug":"assembleRelease";!e.developmentClient&&e.distribution==="store"?a="bundleRelease":!e.developmentClient&&e.distribution==="internal"&&(a="assembleRelease");let l=e.buildCommand||a;b.info(S.blue(`Running Android build: ${l}...`));let s=r.includes("android/")?"android":".",c=(r.includes("android/"),"./gradlew"),d=[l],u={...i,MACH_BUILD_PROFILE:t,MACH_APP_NAME:e.appName||e.name||"App"};if(i.ANDROID_VERSION_CODE){let f=P.join(s,"app/build.gradle");if(h.existsSync(f)){let y=i.ANDROID_VERSION_CODE,D=h.readFileSync(f,"utf-8");D=D.replace(/versionCode\s+\d+/,`versionCode ${y}`),h.writeFileSync(f,D),b.info(S.green(`\u2713 Applied Android versionCode ${y}`))}d.push(`-Pandroid.injected.version.code=${i.ANDROID_VERSION_CODE}`)}for(let f of["app/build","build",".cxx"]){let y=P.join(s,f);h.existsSync(y)&&h.rmSync(y,{recursive:!0,force:!0})}await xe(c,d,s,u,n,o);let p=P.join(s,"app/build/outputs");return nt(p,[".apk",".aab"])},er=async(e,t,i,n={},o,r,a,l,s)=>{if(process.platform!=="darwin")throw new Error("iOS builds can only be run on macOS.");let c=P.resolve(process.cwd(),h.existsSync("ios")?"ios":"."),d=h.readdirSync(c),u=d.find(g=>g.endsWith(".xcworkspace")),p=d.find(g=>g.endsWith(".xcodeproj")),f=Ye(n,i,e);if(!u&&!p)throw new Error("Could not find Xcode workspace or project in ios/ directory.");try{let g=j("xcode-select -p").toString().trim();b.info(S.dim(`Using Xcode at: ${g}`))}catch{b.warn(S.dim("Could not detect Xcode path."))}b.info(S.blue("Running iOS build via xcodebuild..."));let y=u?u.replace(".xcworkspace",""):p?.replace(".xcodeproj",""),D=e.iosScheme||y||e.scheme,$=e.developmentClient?"Debug":e.iosConfiguration||"Release",L=(o||"default").replace(/[^a-zA-Z0-9-_]/g,"_"),B=P.join($e.homedir(),`Library/Developer/Xcode/DerivedData/${m.nameLower}`,L);h.mkdirSync(B,{recursive:!0});let te=tt(f),E=P.join(B,".mach-env-hash"),H=P.join(B,"Build"),_=h.existsSync(E)?h.readFileSync(E,"utf-8").trim():"";if(h.existsSync(H)&&_!==te&&(b.info(S.dim(_?"Build environment changed \u2014 clearing iOS DerivedData build products.":"DerivedData has no environment stamp \u2014 clearing iOS build products.")),h.rmSync(H,{recursive:!0,force:!0})),h.writeFileSync(E,te),e.simulator){b.info(S.dim(`Building for simulator (Scheme: ${D}, Config: ${$})...`)),await xe("xcodebuild",[u?"-workspace":"-project",u||p,"-scheme",D,"-configuration",$,"-sdk","iphonesimulator","-derivedDataPath",B,"CODE_SIGNING_ALLOWED=NO","CODE_SIGNING_REQUIRED=NO"],c,f,r,a);let g=P.join(B,"Build/Products",`${$}-iphonesimulator`),A=nt(g,[".app"]);if(A.length>0){let I=A[0],M=P.basename(I,".app"),U=P.join(g,`${M}_simulator.zip`);return b.info(S.dim(`Creating simulator artifact: ${U}...`)),j(`cd "${g}" && zip -r "${U}" "${P.basename(I)}"`),[U]}return[]}else{b.info(S.dim(`Archiving (Scheme: ${D}, Config: ${$})...`));let g=P.join(c,"build.xcarchive"),A=P.join(c,"export");h.rmSync(g,{recursive:!0,force:!0}),h.rmSync(A,{recursive:!0,force:!0}),h.rmSync(P.join(c,"build"),{recursive:!0,force:!0});let I=n.IOS_DIST_P12,M=n.IOS_PROVISIONING_PROFILE,U=n.IOS_P12_PASSWORD||"",F=[],R,k,x={isAppStore:!1,isDevelopment:!1};if(I&&M){b.info(S.blue("\u{1F510} CI/CD Signing: Importing certificates..."));try{let O=`${m.buildPrefix}-${t}.keychain-db`,C=P.join($e.tmpdir(),O),K=m.keychainPassword;j(`security create-keychain -p "${K}" "${C}" 2>/dev/null || true`),j(`security set-keychain-settings -t 3600 -l "${C}"`),j(`security unlock-keychain -p "${K}" "${C}"`);let T=P.join($e.tmpdir(),`cert-${t}.p12`),Q=Buffer.from(I,"base64");h.writeFileSync(T,Q),b.info(S.dim(`P12 data size: ${Q.length} bytes, first bytes: ${Q.slice(0,4).toString("hex")}`)),(Q.length<100||Q[0]!==48)&&(b.warn(S.yellow("\u26A0\uFE0F  P12 data looks corrupted or was not decrypted correctly.")),b.warn(S.yellow("    This usually means MACH_ENCRYPTION_KEY on the Remote API differs from when credentials were uploaded.")));let J=[U,"",m.keychainPassword],X=!1;for(let me of J)try{j(`security import "${T}" -k "${C}" -P "${me}" -A -T /usr/bin/codesign -T /usr/bin/security`,{stdio:"pipe"}),X=!0,b.info(S.dim(`\u2713 P12 imported successfully with password: ${me?"[set]":"[empty]"}`));break}catch(Ne){b.info(S.dim(`  P12 import attempt with password ${me?`"${me.substring(0,3)}..."`:"[empty]"} failed: ${Ne.message?.split(`
-`)[0]||"unknown"}`))}if(!X)throw new Error("Failed to import P12.");h.unlinkSync(T),j(`security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "${K}" "${C}"`);let fe=j("security list-keychains -d user",{encoding:"utf-8"}).split(`
-`).map(me=>me.trim().replace(/^"|"$/g,"")).filter(me=>me.length>0),Me=[C,...fe].map(me=>`"${me}"`).join(" ");j(`security list-keychains -d user -s ${Me}`),j(`security default-keychain -s "${C}"`);let Ze=P.join($e.homedir(),"Library/MobileDevice/Provisioning Profiles");h.mkdirSync(Ze,{recursive:!0});let dt=Buffer.from(M,"base64"),Qe=P.join(Ze,`${m.nameLower}-temp-${t}.mobileprovision`);h.writeFileSync(Qe,dt);let Ct=dt.toString("utf-8"),ze=/<key>get-task-allow<\/key>\s*<true\/>/.test(Ct);x={isAppStore:!Ct.includes("<key>ProvisionedDevices</key>")&&!ze,isDevelopment:ze};try{let Ne=j(`security cms -D -i "${Qe}"`,{encoding:"utf-8"}).match(/<key>UUID<\/key>\s*<string>([^<]+)<\/string>/);k=Ne?Ne[1]:void 0}catch{let Ne=Ct.match(/<key>UUID<\/key>\s*<string>([^<]+)<\/string>/);k=Ne?Ne[1]:void 0}k||(b.warn("Could not extract UUID from provisioning profile. Using fallback."),k=`${m.nameLower}-${t}`);let Qt=P.join(Ze,`${k}.mobileprovision`);h.existsSync(Qt)&&h.unlinkSync(Qt),h.renameSync(Qe,Qt);try{let Ne=j(`security find-identity -v -p codesigning "${C}"`,{encoding:"utf-8"}).match(/"((?:Apple|iPhone) (?:Distribution|Developer|Development)[^"]*)"/);Ne&&(R=Ne[1],b.info(S.blue(`Identity auto-detected from keychain: "${R}"`)))}catch{}R||(R=x.isDevelopment?"Apple Development":"Apple Distribution",b.info(S.blue(`Identity fallback (profile heuristic): "${R}"`))),b.info(S.dim(`Profile type: ${x.isDevelopment?"Development":x.isAppStore?"App Store":"Ad-Hoc"}`)),b.info(S.dim(`Identity Detection: get-task-allow=${x.isDevelopment}, Selected Identity="${R}"`)),F.push("CODE_SIGN_STYLE=Manual"),F.push(`CODE_SIGN_IDENTITY="${R}"`),F.push(`PROVISIONING_PROFILE_SPECIFIER=${k}`),e.iosTeamId&&F.push(`DEVELOPMENT_TEAM=${e.iosTeamId}`)}catch(O){throw b.error(`Signing setup failed: ${O.message}`),O}}else F.push("-allowProvisioningUpdates"),e.iosTeamId&&F.push(`DEVELOPMENT_TEAM=${e.iosTeamId}`);s&&await s("archive"),b.info(S.blue(`Archive detected Identity: "${R}"`)),b.info(S.blue(`Archive detected UUID: "${k}"`)),await xe("xcodebuild",["archive",u?"-workspace":"-project",u||p,"-scheme",D,"-configuration",$,"-archivePath",g,"-derivedDataPath",B,...F],c,f,r,a);let G;k?(x.isAppStore?G="app-store":x.isDevelopment?G="development":G="ad-hoc",b.info(S.blue(`Export method from profile: "${G}"`))):(G=e.distribution==="store"?"app-store":e.distribution==="internal"?"ad-hoc":"development",b.warn(S.yellow(`No profile UUID detected. Export method from distribution flag: "${G}"`)));let q=e.iosExportMethod||G,ce=Fe("ios"),W=P.join(c,"ExportOptions.plist"),Ce=`<?xml version="1.0" encoding="UTF-8"?>
+`;g.appendFileSync(W,Je)}let ft="/opt/homebrew/bin/pod",Nt=g.existsSync(ft)?ft:"pod",Tt=ko(C);g.existsSync(A.join(C,"Pods"))&&w.pods&&w.pods!==Tt&&(await h(`[CACHE] Podfile/Podfile.lock changed \u2014 wiping ios/Pods
+`),S.info(y.dim("Podfile fingerprint changed \u2014 clearing Pods for clean install...")),g.rmSync(A.join(C,"Pods"),{recursive:!0,force:!0})),S.info(y.dim(`Using pod command: ${Nt} in ${C}`)),await $(Nt,["install"],C,c()),w.pods=Tt,bn(E,w)}catch(C){let W=C.message||"Unknown error";S.warn(y.yellow(`Native "pod" command failed: ${W}`)),S.info(y.dim("Falling back to npm exec pod-install...")),S.info(y.magenta(`${f.nameUpper}_DEBUG: Executing pod-install override via npx --yes pod-install@latest`)),await $("npx",["--yes","pod-install@latest","ios"],process.cwd(),c())}if(g.existsSync("ios/Pods")){S.info(y.dim("Disabling signing for Pod targets to prevent conflicts..."));try{z(`find ios/Pods -name "project.pbxproj" -exec sed -i '' 's/buildSettings = {/buildSettings = { CODE_SIGNING_ALLOWED = NO; CODE_SIGNING_REQUIRED = NO; PROVISIONING_PROFILE_SPECIFIER = ""; EXPANDED_CODE_SIGN_IDENTITY = "";/g' {} +`,{stdio:"ignore"})}catch{}}}}finally{x&&g.writeFileSync(H,x)}o.stop(`Expo prebuild complete (${f.name} config enforced).`)}let K=[];if(l==="android")await j("build"),K=await Wo(e,a,i,H=>h(H),p);else if(l==="ios"){await j("signing"),S.info(y.dim("Preparing credentials..."));let H=r?.distributionType;K=await Yo(e,t,a,i,n,x=>h(x),p,H,x=>j(x))}e.postBuild&&(S.info(y.blue("Running post-build hook...")),S.info(y.dim(`> ${e.postBuild}`)),await $(e.postBuild,[],process.cwd(),c()));let ae=Go(Date.now()-s);if(S.success(y.green(`
+\u2713 Local build completed successfully in ${ae}`)),await d("building",{...V&&{bundleId:V},...ce&&{appName:ce}}),K.length>0&&(S.info(y.cyan(`
+\u{1F4E6} Generated Artifacts:`)),K.forEach(H=>{let x=A.resolve(H);S.info(y.dim(`  - ${H}`)),S.info(y.gray(`    Path: ${x}`))}),e.interactive)){let H=await Co({message:"Install on connected device?"});if(!Bt(H)&&H){if(l==="android"){let x=K.find(J=>J.endsWith(".apk"))||K[0];await Xo(x,J=>h(J))}else if(l==="ios"){let x=K.find(C=>C.endsWith(".ipa"))||K.find(C=>C.endsWith(".app"))||K[0],J=Fe("ios");e.simulator?await qo(x,J||"",C=>h(C)):await Zo(x,J||"",C=>h(C))}}}await j("upload");let ne=[];for(let H of K)try{let x=A.join(ue.tmpdir(),`${t}-${A.basename(H)}`);g.copyFileSync(H,x),ne.push(x),S.info(y.dim(`  \u{1F4CB} Preserved artifact: ${A.basename(H)}`))}catch{S.warn(y.yellow(`  Failed to preserve artifact: ${A.basename(H)}`))}K=ne,S.info(y.dim("\u{1F9F9} Cleaning workspace (preserving dependency cache)..."));try{let H=process.cwd(),x=new Set(["node_modules"]),J=g.readdirSync(H),C=0;for(let W of J)if(!x.has(W)){if(W==="ios"){let Y=A.join(H,"ios"),ee=g.readdirSync(Y);for(let de of ee)if(de!=="Pods")try{g.rmSync(A.join(Y,de),{recursive:!0,force:!0}),C++}catch{}continue}try{g.rmSync(A.join(H,W),{recursive:!0,force:!0}),C++}catch{}}S.info(y.dim(`  Cleaned ${C} items. Cached: node_modules${g.existsSync(A.join(H,"ios","Pods"))?", ios/Pods":""}`)),S.info(y.green("\u{1F512} Security: No source code retained on build server. Only public dependencies cached."))}catch{S.warn(y.yellow("Post-build cleanup encountered errors (non-fatal)."))}try{let x=A.join(ue.homedir(),f.workspacesDir),J=z(`df -k "${x}" | tail -1 | awk '{print $4}'`,{encoding:"utf8"}).trim(),C=parseInt(J,10)*1024;if(C<53687091200&&g.existsSync(x)){S.info(y.dim(`  \u26A0\uFE0F Low disk space (${(C/1024/1024/1024).toFixed(0)} GB free). Running cache eviction...`));let W=A.basename(process.cwd()),Y=g.readdirSync(x).filter(ee=>ee!==W).map(ee=>{let de=A.join(x,ee);try{let Ue=g.statSync(de);return Ue.isDirectory()?{name:ee,dir:de,mtime:Ue.mtimeMs}:null}catch{return null}}).filter(Boolean);Y.sort((ee,de)=>ee.mtime-de.mtime);for(let ee of Y){if(C>=53687091200)break;try{g.rmSync(ee.dir,{recursive:!0,force:!0}),S.info(y.dim(`  \u{1F5D1}\uFE0F Evicted stale workspace: ${ee.name}`));let de=z(`df -k "${x}" | tail -1 | awk '{print $4}'`,{encoding:"utf8"}).trim();if(parseInt(de,10)*1024>=53687091200)break}catch{}}}}catch{}return await B(),K}catch(I){throw await B(),I.message==="Command aborted"?(S.warn(y.yellow(`
+\u274C Build aborted.`)),await d("failed",{error:"Aborted by user"}),I):(S.error(y.red(`
+\u2717 Local build failed: ${I.message}`)),await d("failed",{error:I.message}),I)}},Wo=async(e,t,i={},n,r)=>{let o=g.existsSync("android/gradlew")?"android/gradlew":g.existsSync("gradlew")?"./gradlew":null;if(!o)throw new Error("Could not find gradlew. Is this an Android project?");let s=e.developmentClient?"assembleDebug":"assembleRelease";!e.developmentClient&&e.distribution==="store"?s="bundleRelease":!e.developmentClient&&e.distribution==="internal"&&(s="assembleRelease");let l=e.buildCommand||s;S.info(y.blue(`Running Android build: ${l}...`));let a=o.includes("android/")?"android":".",c=(o.includes("android/"),"./gradlew"),d=[l],u={...i,EXPO_NO_DOTENV:"1",MACH_BUILD_PROFILE:t,MACH_APP_NAME:e.appName||e.name||"App"};if(i.ANDROID_VERSION_CODE){let m=A.join(a,"app/build.gradle");if(g.existsSync(m)){let E=i.ANDROID_VERSION_CODE,U=g.readFileSync(m,"utf-8");U=U.replace(/versionCode\s+\d+/,`versionCode ${E}`),g.writeFileSync(m,U),S.info(y.green(`\u2713 Applied Android versionCode ${E}`))}d.push(`-Pandroid.injected.version.code=${i.ANDROID_VERSION_CODE}`)}for(let m of["app/build","build",".cxx"]){let E=A.join(a,m);g.existsSync(E)&&g.rmSync(E,{recursive:!0,force:!0})}wn(process.cwd()),await xe(c,d,a,u,n,r);let p=A.join(a,"app/build/outputs");return Ze(p,[".apk",".aab"])},Yo=async(e,t,i,n={},r,o,s,l,a)=>{if(process.platform!=="darwin")throw new Error("iOS builds can only be run on macOS.");let c=A.resolve(process.cwd(),g.existsSync("ios")?"ios":"."),d=g.readdirSync(c),u=d.find(b=>b.endsWith(".xcworkspace")),p=d.find(b=>b.endsWith(".xcodeproj")),m=Xe(n,i,e),E=Rn(m.BUILD_NUMBER||m.CURRENT_PROJECT_VERSION);if((m.BUILD_NUMBER||m.CURRENT_PROJECT_VERSION)&&!E)throw new Error(`Invalid iOS BUILD_NUMBER/CURRENT_PROJECT_VERSION: "${m.BUILD_NUMBER||m.CURRENT_PROJECT_VERSION}". Apple requires one to three period-separated integers. Fix the Dashboard secret or remove it so Mach can use its auto build number.`);let U=E?[`BUILD_NUMBER=${E}`,`CURRENT_PROJECT_VERSION=${E}`]:[];if(E&&(m.BUILD_NUMBER=E,m.CURRENT_PROJECT_VERSION=E,S.info(y.dim(`Using iOS build number: ${E}`))),!u&&!p)throw new Error("Could not find Xcode workspace or project in ios/ directory.");try{let b=z("xcode-select -p").toString().trim();S.info(y.dim(`Using Xcode at: ${b}`))}catch{S.warn(y.dim("Could not detect Xcode path."))}S.info(y.blue("Running iOS build via xcodebuild..."));let R=u?u.replace(".xcworkspace",""):p?.replace(".xcodeproj",""),F=e.iosScheme||R||e.scheme,T=e.developmentClient?"Debug":e.iosConfiguration||"Release",B=(r||"default").replace(/[^a-zA-Z0-9-_]/g,"_"),h=A.join(ue.homedir(),`Library/Developer/Xcode/DerivedData/${f.nameLower}`,B);g.mkdirSync(h,{recursive:!0});let j=rt(m),$=A.join(h,".mach-env-hash"),I=A.join(h,"Build"),w=g.existsSync($)?g.readFileSync($,"utf-8").trim():"";if(g.existsSync(I)){let b=w&&w!==j?"Build environment changed \u2014 clearing iOS DerivedData build products.":w?"Clearing iOS DerivedData build products to force a fresh JS bundle.":"DerivedData has no environment stamp \u2014 clearing iOS build products.";S.info(y.dim(b)),g.rmSync(I,{recursive:!0,force:!0})}if(g.writeFileSync($,j),wn(process.cwd()),e.simulator){S.info(y.dim(`Building for simulator (Scheme: ${F}, Config: ${T})...`)),await xe("xcodebuild",[u?"-workspace":"-project",u||p,"-scheme",F,"-configuration",T,"-sdk","iphonesimulator","-derivedDataPath",h,...U,"CODE_SIGNING_ALLOWED=NO","CODE_SIGNING_REQUIRED=NO"],c,m,o,s);let b=A.join(h,"Build/Products",`${T}-iphonesimulator`),L=Ze(b,[".app"]);if(L.length>0){let D=L[0],_=A.basename(D,".app"),M=A.join(b,`${_}_simulator.zip`);return S.info(y.dim(`Creating simulator artifact: ${M}...`)),z(`cd "${b}" && zip -r "${M}" "${A.basename(D)}"`),[M]}return[]}else{S.info(y.dim(`Archiving (Scheme: ${F}, Config: ${T})...`));let b=A.join(c,"build.xcarchive"),L=A.join(c,"export");g.rmSync(b,{recursive:!0,force:!0}),g.rmSync(L,{recursive:!0,force:!0});let D=n.IOS_DIST_P12,_=n.IOS_PROVISIONING_PROFILE,M=n.IOS_P12_PASSWORD||"",P=[],k,G,V={isAppStore:!1,isDevelopment:!1};if(D&&_){S.info(y.blue("\u{1F510} CI/CD Signing: Importing certificates..."));try{let C=`${f.buildPrefix}-${t}.keychain-db`,W=A.join(ue.tmpdir(),C),Y=f.keychainPassword;z(`security create-keychain -p "${Y}" "${W}" 2>/dev/null || true`),z(`security set-keychain-settings -t 3600 -l "${W}"`),z(`security unlock-keychain -p "${Y}" "${W}"`);let ee=A.join(ue.tmpdir(),`cert-${t}.p12`),de=Buffer.from(D,"base64");g.writeFileSync(ee,de),S.info(y.dim(`P12 data size: ${de.length} bytes, first bytes: ${de.slice(0,4).toString("hex")}`)),(de.length<100||de[0]!==48)&&(S.warn(y.yellow("\u26A0\uFE0F  P12 data looks corrupted or was not decrypted correctly.")),S.warn(y.yellow("    This usually means MACH_ENCRYPTION_KEY on the Remote API differs from when credentials were uploaded.")));let Ue=[M,"",f.keychainPassword],ft=!1;for(let he of Ue)try{z(`security import "${ee}" -k "${W}" -P "${he}" -A -T /usr/bin/codesign -T /usr/bin/security`,{stdio:"pipe"}),ft=!0,S.info(y.dim(`\u2713 P12 imported successfully with password: ${he?"[set]":"[empty]"}`));break}catch(Ne){S.info(y.dim(`  P12 import attempt with password ${he?`"${he.substring(0,3)}..."`:"[empty]"} failed: ${Ne.message?.split(`
+`)[0]||"unknown"}`))}if(!ft)throw new Error("Failed to import P12.");g.unlinkSync(ee),z(`security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "${Y}" "${W}"`);let Nt=z("security list-keychains -d user",{encoding:"utf-8"}).split(`
+`).map(he=>he.trim().replace(/^"|"$/g,"")).filter(he=>he.length>0),Tt=[W,...Nt].map(he=>`"${he}"`).join(" ");z(`security list-keychains -d user -s ${Tt}`),z(`security default-keychain -s "${W}"`);let kt=A.join(ue.homedir(),"Library/MobileDevice/Provisioning Profiles");g.mkdirSync(kt,{recursive:!0});let Je=Buffer.from(_,"base64"),ai=A.join(kt,`${f.nameLower}-temp-${t}.mobileprovision`);g.writeFileSync(ai,Je);let li=Je.toString("utf-8"),Gi=/<key>get-task-allow<\/key>\s*<true\/>/.test(li);V={isAppStore:!li.includes("<key>ProvisionedDevices</key>")&&!Gi,isDevelopment:Gi};try{let Ne=z(`security cms -D -i "${ai}"`,{encoding:"utf-8"}).match(/<key>UUID<\/key>\s*<string>([^<]+)<\/string>/);G=Ne?Ne[1]:void 0}catch{let Ne=li.match(/<key>UUID<\/key>\s*<string>([^<]+)<\/string>/);G=Ne?Ne[1]:void 0}G||(S.warn("Could not extract UUID from provisioning profile. Using fallback."),G=`${f.nameLower}-${t}`);let di=A.join(kt,`${G}.mobileprovision`);g.existsSync(di)&&g.unlinkSync(di),g.renameSync(ai,di);try{let Ne=z(`security find-identity -v -p codesigning "${W}"`,{encoding:"utf-8"}).match(/"((?:Apple|iPhone) (?:Distribution|Developer|Development)[^"]*)"/);Ne&&(k=Ne[1],S.info(y.blue(`Identity auto-detected from keychain: "${k}"`)))}catch{}k||(k=V.isDevelopment?"Apple Development":"Apple Distribution",S.info(y.blue(`Identity fallback (profile heuristic): "${k}"`))),S.info(y.dim(`Profile type: ${V.isDevelopment?"Development":V.isAppStore?"App Store":"Ad-Hoc"}`)),S.info(y.dim(`Identity Detection: get-task-allow=${V.isDevelopment}, Selected Identity="${k}"`)),P.push("CODE_SIGN_STYLE=Manual"),P.push(`CODE_SIGN_IDENTITY="${k}"`),P.push(`PROVISIONING_PROFILE_SPECIFIER=${G}`),e.iosTeamId&&P.push(`DEVELOPMENT_TEAM=${e.iosTeamId}`)}catch(C){throw S.error(`Signing setup failed: ${C.message}`),C}}else P.push("-allowProvisioningUpdates"),e.iosTeamId&&P.push(`DEVELOPMENT_TEAM=${e.iosTeamId}`);a&&await a("archive"),S.info(y.blue(`Archive detected Identity: "${k}"`)),S.info(y.blue(`Archive detected UUID: "${G}"`)),await xe("xcodebuild",["archive",u?"-workspace":"-project",u||p,"-scheme",F,"-configuration",T,"-archivePath",b,"-derivedDataPath",h,...U,...P],c,m,o,s);let ce=Ze(A.join(b,"Products","Applications"),[".app"]);for(let C of ce){let W=Vo(C);S.info(y.dim(`Validated iOS CFBundleVersion ${W} in ${A.basename(C)}`))}let K;G?(V.isAppStore?K="app-store":V.isDevelopment?K="development":K="ad-hoc",S.info(y.blue(`Export method from profile: "${K}"`))):(K=e.distribution==="store"?"app-store":e.distribution==="internal"?"ad-hoc":"development",S.warn(y.yellow(`No profile UUID detected. Export method from distribution flag: "${K}"`)));let ae=e.iosExportMethod||K,ne=Fe("ios"),H=A.join(c,"ExportOptions.plist"),x=`<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
     <key>method</key>
-    <string>${q}</string>
+    <string>${ae}</string>
     <key>destination</key>
     <string>export</string>
     <key>signingStyle</key>
-    <string>${k?"manual":"automatic"}</string>
+    <string>${G?"manual":"automatic"}</string>
     <key>thinning</key>
     <string>&lt;none&gt;</string>
     ${e.iosTeamId?`<key>teamID</key><string>${e.iosTeamId}</string>`:""}
-    ${ce&&k?`
+    ${ne&&G?`
     <key>provisioningProfiles</key>
     <dict>
-        <key>${ce}</key>
-        <string>${k}</string>
+        <key>${ne}</key>
+        <string>${G}</string>
     </dict>`:""}
 </dict>
-</plist>`;if(h.writeFileSync(W,Ce),process.env[`${m.envPrefix}DEBUG`]&&b.info(S.magenta(`[${m.nameUpper}_DEBUG] ExportOptions.plist:
-${Ce}`)),s&&await s("export"),b.info(S.blue(`Exporting with Bundle ID: "${ce}"`)),b.info(S.blue(`Exporting with Method: "${q}"`)),r){r(S.magenta(`
+</plist>`;if(g.writeFileSync(H,x),process.env[`${f.envPrefix}DEBUG`]&&S.info(y.magenta(`[${f.nameUpper}_DEBUG] ExportOptions.plist:
+${x}`)),a&&await a("export"),S.info(y.blue(`Exporting with Bundle ID: "${ne}"`)),S.info(y.blue(`Exporting with Method: "${ae}"`)),o){o(y.magenta(`
 [DIAGNOSTIC] Checking available signing identities...
-`));try{let O=j("security find-identity -v -p codesigning",{encoding:"utf-8"});r(S.magenta(`${O}
-`))}catch(O){r(S.red(`[DIAGNOSTIC] Failed to list identities: ${O.message}
-`))}}await xe("xcodebuild",["-exportArchive","-archivePath",g,"-exportPath",A,"-exportOptionsPlist",W],c,f,r,a),s&&await s("validate");let pe=nt(A,[".ipa"]);for(let O of pe)try{j(`unzip -t "${O}"`,{stdio:"pipe"}),r&&r(`[IPA VALID] ${P.basename(O)} \u2014 archive integrity OK
-`)}catch{let K=`IPA validation failed for ${P.basename(O)}: archive may be corrupt`;throw r&&r(`[IPA CORRUPT] ${K}
-`),new Error(K)}return pe}},Fe=e=>{try{let t=P.join(process.cwd(),m.configFileName);if(h.existsSync(t)){let i=JSON.parse(h.readFileSync(t,"utf-8"));if(e==="android"&&i.android?.package)return i.android.package;if(e==="ios"&&i.ios?.bundleIdentifier)return i.ios.bundleIdentifier}if(e==="android"){let i=["android/app/build.gradle","app/build.gradle","build.gradle"];for(let n of i)if(h.existsSync(n)){let r=h.readFileSync(n,"utf-8").match(/applicationId\s+['"]([^'"]+)['"]/);if(r)return r[1]}}else{let i=P.resolve(process.cwd(),h.existsSync("ios")?"ios":"."),n=nt(i,["Info.plist"]).filter(a=>!a.includes("/Pods/")&&!a.includes("/build/")&&!a.includes("/DerivedData/"));n.sort((a,l)=>l.split("/").length-a.split("/").length);for(let a of n){let s=h.readFileSync(a,"utf-8").match(/<key>CFBundleIdentifier<\/key>\s*<string>([^<]+)<\/string>/);if(s&&!s[1].includes("$"))return s[1]}let o=nt(i,[".xcodeproj"]);if(o.length>0){let a=P.join(o[0],"project.pbxproj");if(h.existsSync(a)){let s=h.readFileSync(a,"utf-8").match(/PRODUCT_BUNDLE_IDENTIFIER\s*=\s*"?([^";\s]+)"?;/);if(s)return s[1]}}let r=["app.json","app.config.json","app.config.js","app.config.ts"];for(let a of r)if(h.existsSync(a)){let s=h.readFileSync(a,"utf-8").match(/"bundleIdentifier":\s*"([^"]+)"/);if(s)return s[1]}}}catch{return null}return null},tr=()=>{try{return j("emulator -version",{stdio:"ignore"}),"emulator"}catch{let t=$e.homedir(),i=[P.join(t,"Library/Android/sdk/emulator/emulator"),P.join(t,"Android/Sdk/emulator/emulator"),"/usr/local/lib/android/sdk/emulator/emulator"];for(let n of i)if(h.existsSync(n))return n}return"emulator"},ir=async(e,t)=>{let i=xt();try{if(j("adb devices").toString().split(`
-`).slice(1).map(a=>a.trim()).filter(a=>a.length>0&&!a.startsWith("*")).map(a=>a.split("	")[0]).length===0){b.warn(S.yellow("No Android devices or emulators found."));let a=tr(),l=[];try{l=j(`${a} -list-avds`).toString().split(`
-`).filter(s=>s.trim().length>0)}catch{}if(l.length>0){let s=await ni({message:"Select an emulator to launch:",options:l.map(u=>({value:u,label:u}))});if(Lt(s))return;i.start(`Launching emulator ${s}...`),Zi(a,["-avd",s],{detached:!0,stdio:"ignore"}).unref();let c=0,d=!1;for(;c<60;){try{if(j("adb shell getprop sys.boot_completed",{stdio:"pipe"}).toString().trim()==="1"){d=!0;break}}catch{}await new Promise(u=>setTimeout(u,2e3)),c++}if(!d)throw i.stop("Emulator launch timed out."),new Error("Emulator launch timed out. Please try launching it manually.");i.stop("Emulator launched.")}else throw new Error("No devices found and no emulators available to launch. (Make sure Android SDK is installed)")}i.start("Installing APK on device..."),await xe("adb",["install","-r",e],process.cwd(),{},t),i.stop("Installation complete.");let r=Fe("android");if(r){b.info(S.blue(`\u{1F680} Launching ${r}...`));try{j(`adb shell dumpsys package ${r}`).toString().split(`
-`).find(s=>s.includes("android.intent.action.MAIN")&&s.includes("android.intent.category.LAUNCHER"))?j(`adb shell monkey -p ${r} -c android.intent.category.LAUNCHER 1`,{stdio:"ignore"}):j(`adb shell monkey -p ${r} -c android.intent.category.LAUNCHER 1`,{stdio:"ignore"})}catch{b.warn("Could not auto-launch app. You may need to open it manually.")}}}catch(n){i.stop("Installation failed."),b.error(S.red(`Failed to install APK: ${n.message}`))}},nr=async(e,t,i)=>{let n=xt();try{if(!j("xcrun simctl list devices booted").toString().includes("(Booted)")){b.warn(S.yellow("No iOS Simulator is currently booted."));let r=j("xcrun simctl list devices --json").toString(),a=JSON.parse(r).devices,l=[];Object.keys(a).forEach(u=>{a[u].forEach(p=>{p.isAvailable&&l.push({...p,runtime:u})})});let s=await ni({message:"Select a simulator to launch:",options:l.map(u=>({value:u.udid,label:`${u.name} (${u.runtime.split(".").pop()})`}))});if(Lt(s))return;n.start(`Booting ${s}...`),j(`xcrun simctl boot ${s}`),j(`open -a Simulator --args -CurrentDeviceUDID ${s}`);let c=0,d=!1;for(;c<30;){try{if(j("xcrun simctl list devices booted").toString().includes(s)){d=!0;break}}catch{}await new Promise(u=>setTimeout(u,2e3)),c++}if(!d)throw n.stop("Simulator boot timed out."),new Error("Simulator boot timed out.");n.stop("Simulator booted.")}n.start("Installing on iOS Simulator..."),await xe("xcrun",["simctl","install","booted",e],process.cwd(),{},i),n.stop("Installation complete."),b.info(S.blue(`\u{1F680} Launching ${t}...`)),await xe("xcrun",["simctl","launch","booted",t],process.cwd(),{},i)}catch(o){n.stop("Installation failed."),b.error(S.red(`Failed to install on Simulator: ${o.message}`))}},or=async(e,t,i)=>{let n=xt();n.start("Scanning for connected iOS devices...");try{let o=j("xcrun devicectl list devices --json-output -").toString(),a=(JSON.parse(o).result?.devices||[]).filter(s=>s.connectionProperties?.transportType==="wired"||s.connectionProperties?.transportType==="localNetwork");if(a.length===0)throw n.stop("No connected iOS devices found."),new Error("Please connect your iPhone via USB or ensure it is on the same Wi-Fi for wireless debugging.");let l=a[0].identifier;if(a.length>1){n.stop();let s=await ni({message:"Select a device to install on:",options:a.map(c=>({value:c.identifier,label:`${c.deviceProperties?.name||c.name||c.model?.name} (${c.model?.name||"iPhone"}) - ${c.identifier}`}))});if(Lt(s))return;l=s,n.start(`Installing on ${l}...`)}else n.message(`Installing on ${a[0].model.name}...`);await xe("xcrun",["devicectl","device","install","app","--device",l,e],process.cwd(),{},i),n.stop("Installation complete."),b.info(S.blue(`\u{1F680} Launching ${t}...`)),await xe("xcrun",["devicectl","device","launch","app","--device",l,t],process.cwd(),{},i)}catch(o){n.stop("Installation failed."),b.error(S.red(`Failed to install on device: ${o.message}`)),b.info(S.dim('Make sure your device is unlocked and "Developer Mode" is enabled in Settings -> Privacy & Security.'))}};import en from"fs";import tn from"path";import{isCancel as ri,log as He,select as nn,spinner as rr,text as sr}from"@clack/prompts";import ot from"chalk";async function on(e){let t=await si(e);t&&(He.success(ot.green(`Maestro run ${t.status||"queued"}: ${t.testRunId}`)),t.launchDeferredReason&&He.warn(ot.yellow(t.launchDeferredReason)),t.dashboardUrl&&He.info(ot.dim("View test run: ")+ot.white.underline(t.dashboardUrl)))}async function si(e){let t=Te(`./${m.configFileName}`),i=e.projectId||t?.projectId,n=e.profile||e.buildProfile||"production";if(!i)return He.error(`No projectId found. Run \`${m.nameLower} link\` first or pass an internal project id.`),null;let o=e.platform;if(!o&&e.latest){let s=await nn({message:"Select platform for the latest build:",options:[{value:"android",label:"Android"},{value:"ios",label:"iOS"}]});if(ri(s))return null;o=s}let r=await ar(e);if(!r)return null;if(r.kind==="latest"&&!o)return He.error("Pass --platform when using --latest."),null;if(r.kind==="artifact-url"&&!o)return He.error("Pass --platform when using --artifact-url."),null;let a=lr(e.maestroRetries);if(a===null)return null;let l=rr();e.quiet||l.start("Queuing Maestro run...");try{let s=await v.post("/tests/maestro",{projectId:i,platform:o,profile:n,latest:r.kind==="latest",buildId:r.kind==="build-id"?r.value:e.buildId,buildUrl:r.kind==="build-url"?r.value:e.buildUrl,artifactUrl:r.kind==="artifact-url"?r.value:e.artifactUrl,flows:e.maestroFlows||".maestro",device:e.maestroDevice||(o==="ios"?"iphone_15":"pixel_6"),retries:a,record:!!e.maestroRecord});if(s.data.status!=="success")throw new Error(s.data.message||"Failed to queue Maestro run");let c=s.data.testRun,d={testRunId:c.testRunId,status:c.status,projectId:i,buildId:c.buildId,platform:c.platform,dashboardUrl:c.dashboardUrl||`${ut}/tests/${c.testRunId}`,launchDeferredReason:c.launchDeferredReason};return cr(e,d),e.quiet||l.stop("Maestro run queued"),d}catch(s){e.quiet||l.stop("Could not queue Maestro run");let c=s.response?.data?.message||s.message||"Unknown error";return He.error(ot.red(`Maestro queue failed: ${c}`)),null}}async function ar(e){if(e.buildId)return{kind:"build-id",value:e.buildId};if(e.buildUrl)return{kind:"build-url",value:e.buildUrl};if(e.artifactUrl)return{kind:"artifact-url",value:e.artifactUrl};if(e.latest)return{kind:"latest"};let t=await nn({message:"Select app artifact source for Maestro:",options:[{value:"latest",label:"Latest successful build"},{value:"build-id",label:"Build ID"},{value:"build-url",label:`${m.name} build URL`},{value:"artifact-url",label:"Direct artifact URL"}]});if(ri(t))return null;if(t==="latest")return{kind:"latest"};let i=await sr({message:t==="build-id"?"Enter build ID:":t==="build-url"?`Enter ${m.name} build URL:`:"Enter artifact URL:",validate:n=>{let o=String(n||"").trim();if(!o)return"Value is required";if((t==="build-url"||t==="artifact-url")&&!o.startsWith("http"))return"Must be a URL"}});return ri(i)?null:{kind:t,value:String(i).trim()}}function lr(e){if(e==null||e==="")return 1;let t=Number(e);return!Number.isInteger(t)||t<0||t>10?(He.error("--maestro-retries must be an integer between 0 and 10."),null):t}function cr(e,t){if(!e.jsonOutput)return;let i=tn.resolve(e.jsonOutput),n={...t,updatedAt:new Date().toISOString()};try{let o=tn.dirname(i);o&&o!=="."&&en.mkdirSync(o,{recursive:!0}),en.writeFileSync(i,JSON.stringify(n,null,2))}catch(o){He.warn(ot.yellow(`Could not write Maestro metadata JSON: ${o.message}`))}}var Mt=async e=>{e.platform!=="android"&&e.platform!=="ios"&&(w.error(`Platform ${e.platform} is not supported. Use 'android' or 'ios'.`),process.exit(1));let t=ai(),i=e.buildId||dr(),n=e.projectId,o=Date.now(),r=!!n,a=async l=>{if(n)try{await v.patch(`/builds/${n}/${i}`,{status:"failed",error:l})}catch{}};if(e.local&&e.buildId){e.quiet||t.start(`Preparing isolated workspace for build: ${e.buildId}`);try{let l=await v.get(`/builds/${n}/${e.buildId}/source-url`);if(l.data.status!=="success")throw new Error("Failed to get source download URL from API");let s=await ht.get(l.data.downloadUrl,{responseType:"stream"}),c=(n||e.projectId||"default").replace(/[^a-zA-Z0-9-_]/g,"_"),d=Se.join(ur.homedir(),m.workspacesDir,c);re.mkdirSync(d,{recursive:!0});let u=new Set(["node_modules",`.${m.nameLower}-cache-meta`]),p=new Set(["Pods"]);if(re.existsSync(d)){let L=re.readdirSync(d);for(let B of L){if(u.has(B))continue;if(B==="ios"){let E=Se.join(d,"ios");try{let H=re.readdirSync(E);for(let _ of H)if(!p.has(_))try{re.rmSync(Se.join(E,_),{recursive:!0,force:!0})}catch{}}catch{}continue}let te=Se.join(d,B);try{re.rmSync(te,{recursive:!0,force:!0})}catch{}}}let f=Se.join(d,"source.zip"),y=s.data,D=re.createWriteStream(f);await new Promise((L,B)=>{y.pipe(D),y.on("error",te=>B(te)),D.on("finish",()=>L())}),new ln(f).extractAllTo(d,!0);try{re.unlinkSync(f)}catch{}process.chdir(d),w.info(N.green(`\u2713 Persistent workspace ready: ${d}`)),w.info(N.dim(`  \u{1F4E6} Cached dirs preserved: node_modules=${re.existsSync(Se.join(d,"node_modules"))?"\u2705":"\u274C"}, Pods=${re.existsSync(Se.join(d,"ios","Pods"))?"\u2705":"\u274C"}`)),t.stop()}catch(l){t.stop(`Failed to prepare isolated workspace: ${l.message}`),n&&await a(`Setup Error: ${l.message}`),process.exit(1)}}try{let l=e.repo;if(!l)try{l=an("git config --get remote.origin.url").toString().trim()}catch{w.warn("Could not detect git repository URL.")}!l&&e.dryRun,l||(l="https://github.com/placeholder/repo.git"),w.info(`Build ID: ${N.cyan(i)}`);let s={},c={},d=Te(`./${m.configFileName}`);if(d){n=d.projectId;let _=e.buildProfile||"production",g=We(d,_);!g&&e.buildProfile&&(w.error(`Build profile '${_}' not found in ${m.configFileName}`),process.exit(1));let A=g||{};process.env.MACH_DEBUG&&w.info(N.dim(`Build profile: ${_} | Platform: ${e.platform} | Distribution: ${A.distribution||"store"} | Environment: ${A.environment||_}`)),A.env&&(c=A.env,w.info(N.blue(`Use Build Profile: ${_}`)));let I=e.platform,M=A[I]||{},U=["developmentClient","simulator","distribution","buildCommand","apk","iosScheme","preBuild","postBuild","scheme","environment","androidPackage","iosBundleIdentifier","name","iosDeploymentTarget","iosApiKeyId","iosApiKeyIssuer","iosApiKeyPath","iosTeamId","iosConfiguration","iosExportMethod","branch","repo","instanceType","ami","bucket","region","nodeVersion"];e.name=d.name,e.appName=d.name,e.androidPackage=d.android?.package,e.iosBundleIdentifier=d.ios?.bundleIdentifier,e.iosScheme=d.ios?.iosScheme,!e.nodeVersion&&d.nodeVersion&&(e.nodeVersion=d.nodeVersion);let F=x=>x==="androidPackage"?M.androidPackage??M.package??A.androidPackage??A.android?.package:x==="iosBundleIdentifier"?M.iosBundleIdentifier??M.bundleIdentifier??A.iosBundleIdentifier??A.ios?.bundleIdentifier:M[x]!==void 0?M[x]:A[x];for(let x of U){let G=F(x),q=x==="androidPackage"||x==="iosBundleIdentifier";G!==void 0&&(e[x]===void 0||q)&&(e[x]=G)}e.branch=e.branch||"main",e.iosConfiguration=e.iosConfiguration||(e.developmentClient||e.simulator?"Debug":"Release"),e.sshUser=e.sshUser||process.env.USER||"ubuntu",e.simulator===void 0&&(e.simulator=!1),e.local===void 0&&(e.local=!1),e.verbose===void 0&&(e.verbose=!1);let R=x=>{if(!x)return x;if(x.startsWith("scripts.")){let G=x.split(".")[1],q=d.scripts?.[G];if(q)return q;w.warn(`Script reference not found: ${x}`)}return x};e.buildCommand=R(e.buildCommand),e.preBuild=R(e.preBuild),e.postBuild=R(e.postBuild),!e.scheme&&d.scheme&&(e.scheme=d.scheme);let k={...et(d,m.envPrefix),...et(A,`${m.envPrefix}PROFILE_`)};s={...s,...c,...k},process.env.IOS_P12_PASSWORD&&!s.IOS_P12_PASSWORD&&(s.IOS_P12_PASSWORD=process.env.IOS_P12_PASSWORD),process.env.MATCH_PASSWORD&&!s.MATCH_PASSWORD&&(s.MATCH_PASSWORD=process.env.MATCH_PASSWORD),e.platform==="ios"&&(!e.iosTeamId&&A.ios?.appleTeamId&&(e.iosTeamId=A.ios.appleTeamId),!e.iosTeamId&&d.submit?.[_]?.ios?.appleTeamId&&(e.iosTeamId=d.submit[_].ios.appleTeamId),!e.iosTeamId&&d.submit?.production?.ios?.appleTeamId&&(w.warn(N.yellow(`Check: Using 'production' Team ID for '${_}' build.`)),e.iosTeamId=d.submit.production.ios.appleTeamId),e.iosTeamId?w.info(N.magenta(`\u2713 Injected iOS Team ID from config: ${e.iosTeamId}`)):w.warn(N.yellow("\u26A0\uFE0F No iOS Team ID found. Signing might fail if not managed automatically via Expo.")))}let u="unknown";try{u=an("git rev-parse --abbrev-ref HEAD").toString().trim()}catch{w.warn("Failed to detect git branch.")}let p="1.0.0";try{re.existsSync("./package.json")&&(p=JSON.parse(re.readFileSync("./package.json","utf-8")).version||"1.0.0")}catch{}let f=e.buildProfile||"production",y="Internal";e.developmentClient?y="DevelopmentClient":f.toLowerCase().includes("store")||f.toLowerCase()==="production"?y="Store":f.toLowerCase().includes("preview")||f.toLowerCase().includes("staging")?y="Staging":(f.toLowerCase().includes("development")||f.toLowerCase().includes("dev"))&&(y="Development");let D=e.platform==="ios"?"iOS":"Android",$=e.platform==="ios"&&e.simulator?" (Simulator)":"",L=`${D}${$} v${p} (${y})`;if(yt(e,{status:"created",projectId:n,buildId:i,platform:e.platform,profile:f,branch:u,version:p,buildType:y,developmentClient:!!e.developmentClient,summary:L}),n){try{let _=e.buildProfile||"production",g=e.environment||_;w.info(N.blue(`Fetching managed secrets for profile: ${_} (environment: ${g})...`));let I=(await v.get(`/projects/${n}/secrets/export?env=${g}`)).data;I.status==="success"&&I.secrets&&(s={...s,...I.secrets},Object.keys(I.secrets).length>0&&w.info(N.magenta(`\u2713 Injected ${Object.keys(I.secrets).length} secrets from Dashboard.`)))}catch(_){w.warn(`Failed to load managed secrets from Dashboard: ${_.message}`)}try{w.info(N.blue("Fetching managed credentials..."));let _="development";e.distribution==="store"?_="store":e.distribution==="internal"&&(_=e.platform==="ios"?"adhoc":"internal"),e.developmentClient&&(_="development");let g=await v.get("/credentials/resolve",{params:{projectId:n,platform:e.platform,bundleId:e.iosBundleIdentifier||e.androidPackage,distributionType:_}});if(g.data.status==="success"&&g.data.credentials){let A=g.data.credentials;w.info(N.magenta(`\u2713 Found ${A.length} relevant credentials.`));let I=A.filter(R=>{if(R.distributionType){let k=_==="internal"?"adhoc":_;return R.distributionType===k||R.distributionType===_}return!0});w.info(N.dim(`  Filtered to ${I.length} credentials for distributionType: ${_}`));let M=!1,U=!1,F=!1;for(let R of I)if(R.downloadUrl)try{let k="",x=5;for(;x>0;)try{let G=await ht.get(R.downloadUrl,{responseType:"arraybuffer",timeout:3e4,headers:{Connection:"close"}});k=Buffer.from(G.data).toString("base64");break}catch(G){if(x--,x===0)throw G;w.warn(N.dim(`  - Temporary network error downloading ${R.name}. Retrying... (${5-x}/5)`)),await new Promise(q=>setTimeout(q,2e3))}if(R.type==="ios_cert"&&!M)s.IOS_DIST_P12=k,R.password?(s.IOS_P12_PASSWORD=R.password,w.info(N.dim(`  - Injected ${R.name} as IOS_DIST_P12 with password from credential record`))):w.info(N.dim(`  - Injected ${R.name} as IOS_DIST_P12`)),M=!0;else if(R.type==="ios_profile"&&!U)s.IOS_PROVISIONING_PROFILE=k,w.info(N.dim(`  - Injected ${R.name} as IOS_PROVISIONING_PROFILE`)),U=!0;else if(R.type==="android_keystore"&&!F){s.ANDROID_KEYSTORE_BASE64=k;let G=R.keystorePassword||R.password,q=R.keyPassword||R.keystorePassword||R.password,ce=R.alias||R.meta?.alias;if(G)s.ANDROID_STORE_PASSWORD=G,w.info(N.dim("  - Injected keystore password from credential record"));else{let pe=["ANDROID_STORE_PASSWORD",...[_==="store"?"PRODUCTION":_==="internal"?"STAGING":"DEVELOPMENT",_.toUpperCase(),"PRODUCTION","STORE","INTERNAL","STAGING","RELEASE","DEBUG"].map(O=>`KEYSTORE_PASSWORD_${O}`),"KEYSTORE_PASSWORD"].find(O=>!!s[O]);pe&&s[pe]&&(s.ANDROID_STORE_PASSWORD=s[pe])}if(q?(s.ANDROID_KEY_PASSWORD=q,w.info(N.dim("  - Injected key password from credential record"))):s.ANDROID_KEY_PASSWORD=s.ANDROID_STORE_PASSWORD||"",ce)s.ANDROID_KEY_ALIAS=ce;else{let W=["ANDROID_KEY_ALIAS","KEYSTORE_ALIAS"].find(Ce=>!!s[Ce]);W&&(s.ANDROID_KEY_ALIAS=s[W])}w.info(N.dim(`  - Injected ${R.name} as ANDROID_KEYSTORE_BASE64`)),F=!0}}catch(k){w.warn(`Failed to download credential ${R.name}: ${k.message}`)}}if(e.platform==="android"){let A=e.buildProfile||"production",I=We(d,A)||{},F=((I.android||{}).versionCode??I.androidVersionCode??d.android?.versionCode??d.expo?.android?.versionCode)==="auto",R=e.autoVersion||F&&e.distribution==="store";if(F&&!R&&w.info(N.dim(`  Skipping Google Play versionCode lookup for ${e.distribution||"non-store"} build. Pass --auto-version to force it.`)),R){t.start("Resolving latest versionCode from Google Play...");try{let k=e.androidPackage||d.android?.package||d.expo?.android?.package||d.name,x=(g.data.credentials||[]).find(pe=>pe.type==="google_service_account"&&(!pe.bundleId||pe.bundleId===k));if(!x){let O=((await v.get(`/credentials/${n}`)).data.credentials||[]).filter(C=>C.type==="google_service_account");if(x=O.find(C=>C.type==="google_service_account"&&C.bundleId===k),!x&&O.length>0){let C=O.map(K=>K.bundleId).filter(Boolean).join(", ");throw new Error(`Google Service Account not found for package ${k}. Found service credential(s) for: ${C}.`)}}if(!x)throw new Error(`Google Service Account not found for package ${k}. Upload it under this package in Dashboard or run '${m.nameLower} credentials:service --platform android --package-name ${k}'.`);let G=await v.get(`/credentials/${x.credentialId}/download`,{params:{projectId:n}});if(G.data.status!=="success"||!G.data.downloadUrl)throw new Error("Failed to get secure download URL for service account");let ce=(await ht.get(G.data.downloadUrl,{headers:{Connection:"close"}})).data,W=await Ji(k,ce);if(W==null)throw new Error("Could not retrieve any version information from Google Play.");let Ce=W+1;s.ANDROID_VERSION_CODE=Ce.toString(),t.stop(`\u2713 Resolved versionCode: ${N.green(Ce)} (Latest on Play Store: ${W})`)}catch(k){t.stop("Version resolution failed");let x=k.response?.data?.error?.message||k.message;throw new Error(`Auto-versioning failed: ${x}. Fix Google Play service account permissions or remove android.versionCode="auto".`)}}}if(e.platform==="ios"&&!e.simulator){let A=!!s.IOS_DIST_P12,I=!!s.IOS_PROVISIONING_PROFILE;if(!A||!I){let M=[...A?[]:["Distribution Certificate"],...I?[]:["Provisioning Profile"]].join(" and ");w.error(N.red(`Missing iOS credentials: ${M}`)),e.quiet&&process.exit(1);let U=e.yes||await rn({message:"Would you like to generate these credentials now?",initialValue:!0});if(U&&!sn(U))return await pt({platform:"ios",profile:f}),e.quiet||w.info(N.green("\u2713 Credentials setup complete! Restarting build phase...")),Mt(e);e.quiet||w.info(N.yellow(`Run \`${m.nameLower} credentials\` to set up signing credentials manually.`)),process.exit(1)}}if(e.platform==="android"&&!e.developmentClient&&(e.distribution==="internal"||e.distribution==="store")&&!(!!s.ANDROID_KEYSTORE_BASE64||!!s.ANDROID_KEYSTORE)){w.error(N.red("Missing Android credentials: Signing Keystore")),e.quiet&&process.exit(1);let I=e.yes||await rn({message:"Would you like to automatically create and upload an Android Keystore for this profile now?",initialValue:!0});if(I&&!sn(I))return await pt({platform:"android",profile:f}),e.quiet||w.info(N.green("\u2713 Android Keystore setup complete! Restarting build phase...")),Mt(e);e.quiet||w.info(N.yellow(`Run \`${m.nameLower} credentials --platform android\` to set up a signing keystore manually.`)),process.exit(1)}}catch(_){w.warn(`Failed to resolve credentials: ${_.message}`)}}let B=!!(e.local&&e.buildId),te=!!(e.local||e.sshHost),E=!te&&!B;if(B){w.info(N.magenta("\u{1F3D7}\uFE0F Runner Mode: Executing isolated build task..."));let _=await oi({...e,interactive:!1},i,s,n,{branch:u,version:p,summary:L,buildType:y});await H(_),process.exit(0)}async function H(_){if(n&&_.length>0){let g=ai(),A=[];e.quiet||g.start("Uploading artifacts to Dashboard...");try{for(let I of _){let M=Se.basename(I),U=re.readFileSync(I),F=Se.extname(M).toLowerCase(),R="application/octet-stream",k=await v.post(`/builds/${n}/${i}/artifact-upload-url`,{fileName:M,fileType:R});if(k.data.status!=="success")throw new Error(`Failed to get upload URL for ${M}`);let x=!1;for(let G=1;G<=3;G++)try{await ht.put(k.data.uploadUrl,U,{headers:{"Content-Type":R},maxBodyLength:1/0,maxContentLength:1/0,timeout:12e4}),x=!0;break}catch(q){if(w.warn(N.yellow(`Artifact upload attempt ${G}/3 failed (${q.code||q.message})`)),G<3)await new Promise(ce=>setTimeout(ce,3e3*G));else throw q}x&&A.push({name:M,url:k.data.downloadUrl,size:U.length,type:F.substring(1)})}e.quiet||g.stop("Artifacts uploaded.")}catch(I){e.quiet||g.stop("Failed to upload artifacts."),w.error(N.red(`Upload error: ${I.message}`));try{await v.patch(`/builds/${n}/${i}`,{status:"completed",artifacts:_.map(M=>Se.basename(M)),endTime:Date.now()})}catch(M){w.warn(N.yellow(`Could not set fallback build status: ${M.message}`))}return}if(n&&A.length>0)try{w.info(N.cyan(`
-\u{1F517} Download Links:`));for(let I of A)w.info(N.dim(`  - ${I.name}: `)+N.blue.underline(I.url));await v.patch(`/builds/${n}/${i}`,{status:"success",artifacts:A,endTime:Date.now()}),yt(e,{status:"success",projectId:n,buildId:i,platform:e.platform,profile:f,branch:u,version:p,buildType:y,developmentClient:!!e.developmentClient,summary:L,artifacts:A}),w.success(N.green(`
-\u2713 Build completed and reported to dashboard.`)),e.maestro&&!B&&await cn(n,i,e,f)}catch(I){w.warn(N.yellow(`
-\u26A0\uFE0F Could not report to dashboard: ${I.message}`))}}else if(n)try{await v.patch(`/builds/${n}/${i}`,{status:"completed",endTime:Date.now()}),yt(e,{status:"completed",projectId:n,buildId:i,platform:e.platform,profile:f,branch:u,version:p,buildType:y,developmentClient:!!e.developmentClient,summary:L})}catch{}}if(te){if(w.info(N.cyan(`\u{1F680} Direct Build Mode: Executing on ${e.sshHost||"local"}...`)),n&&!r){let _=process.argv.slice(3).join(" ");await v.post("/builds",{projectId:n,buildId:i,platform:e.platform,status:"building",branch:u,version:p,summary:L,startTime:o,buildType:y,buildProfile:f,buildArgs:_,simulator:!!e.simulator,developmentClient:!!e.developmentClient})}if(e.sshHost&&e.platform==="ios"){let _=await Wi(e,i,s,n)}else{let _=await oi({...e,interactive:!!e.local},i,s,n,{branch:u,version:p,summary:L,buildType:y});await H(_)}return}if(E&&(w.info(N.blue("\u{1F6F0}\uFE0F Cloud Initiator Mode: Preparing orchestration...")),!e.dryRun)){e.quiet||t.start("Zipping and uploading local source...");let _=await v.post("/builds/source-upload-url",{projectId:n,buildId:i});if(_.data.status!=="success")throw t.stop("Failed to get upload URL."),new Error("Failed to get source upload URL from API");let g=new ln,A=re.readdirSync("."),I=["node_modules",".git","dist","build","builds",".gradle",".idea","android/build","ios/build","ios/Pods",`.${m.nameLower}_cli`];for(let F of A){if(I.includes(F))continue;re.statSync(F).isDirectory()?g.addLocalFolder(F,F):g.addLocalFile(F)}let M=g.toBuffer();e.quiet||t.message(`Uploading source (${(M.length/1024/1024).toFixed(1)} MB)...`);let U=!1;for(let F=1;F<=3;F++)try{await ht.put(_.data.uploadUrl,M,{headers:{"Content-Type":"application/zip"},maxBodyLength:1/0,maxContentLength:1/0,timeout:12e4}),U=!0;break}catch(R){if(F<3)t.message(`Upload attempt ${F} failed (${R.code||R.message}), retrying...`),await new Promise(k=>setTimeout(k,2e3*F));else throw R}if(e.quiet||t.stop("Source uploaded"),n){let F=process.argv.slice(3).join(" ");await v.post("/builds",{projectId:n,buildId:i,platform:e.platform,status:"pending",branch:u,version:p,summary:L,startTime:o,buildType:y,buildProfile:f,buildArgs:F,simulator:!!e.simulator,developmentClient:!!e.developmentClient}),w.info(N.green("\u2713 Cloud build registered."))}e.platform==="android"&&await Ki(e,i,s,n,e.preBuild),e.quiet||w.info(N.cyan("\u{1F4E1} Connecting to build stream...")),await pr(n,i,e),e.maestro&&await cn(n,i,e,f);return}}catch(l){let s=l.message||"Build failed";l.response?.data?.message?s=l.response.data.message:l.message.includes("status code 402")?s="Insufficient wallet balance. Please add credits in the Dashboard.":l.message.includes("status code 403")&&(s="Monthly build quota exceeded. Upgrade your plan in the Dashboard."),n&&!e.local&&await a(s),w.error(N.red(`\u2717 Build failed: ${s}`)),process.exit(1)}};async function cn(e,t,i,n){w.info(N.cyan(`
-\u{1F3BC} Queuing managed Maestro test...`)),await si({projectId:e,buildId:t,platform:i.platform,profile:n,maestroFlows:i.maestroFlows,maestroDevice:i.maestroDevice,maestroRetries:i.maestroRetries,maestroRecord:i.maestroRecord,quiet:i.quiet})}function dn(e){return`${ut}/build/${e}`}function yt(e,t){if(!e.jsonOutput)return;let i=Se.resolve(e.jsonOutput),n={...t,url:t.url||dn(t.buildId),dashboardUrl:t.dashboardUrl||dn(t.buildId),updatedAt:new Date().toISOString()};try{let o=Se.dirname(i);o&&o!=="."&&re.mkdirSync(o,{recursive:!0}),re.writeFileSync(i,JSON.stringify(n,null,2))}catch(o){w.warn(N.yellow(`Could not write build metadata JSON: ${o.message}`))}}async function pr(e,t,i){let n=ai(),o="pending",r=0,a=0;for(i.quiet||n.start("Connecting to build stream...");;){try{let s=(await v.get(`/builds/${e}/${t}`)).data.build;if(s){if(o=s.status,o==="building")i.quiet||n.message("Build in progress...");else if(o==="failed")i.quiet||n.stop("Build failed."),yt(i,{status:"failed",projectId:e,buildId:t,platform:i.platform,profile:s.buildProfile,buildType:s.buildType,developmentClient:!!s.developmentClient,version:s.version,summary:s.summary,error:s.error||"Unknown error",artifacts:s.artifacts||[]}),w.error(N.red(`
-\u2717 Build failed: ${s.error||"Unknown error"}`)),process.exit(1);else if(o==="completed"||o==="success"){i.quiet||n.stop("Build successful!"),yt(i,{status:o,projectId:e,buildId:t,platform:i.platform,profile:s.buildProfile,buildType:s.buildType,developmentClient:!!s.developmentClient,version:s.version,summary:s.summary,artifacts:s.artifacts||[]}),w.success(N.green(`
-\u2713 Build completed successfully!`));try{i.quiet||(w.info(N.magenta(`
-\u{1F4F1} Installation Hub:`)),w.info(N.dim("  - View & Install Build: ")+N.white.underline(`${ut}/build/${t}`)))}catch{}return}else if(o!=="pending"){i.quiet||n.stop(`Build status: ${o}`);return}}try{let d=(await v.get(`/builds/${e}/${t}/logs`)).data;if(d&&typeof d=="string"&&!i.quiet){let u=d.split(`
-`);if(u.length>r){for(let p=r;p<u.length;p++)u[p].trim()&&console.log(N.dim(`  ${u[p]}`));r=u.length}}}catch{}a=0}catch{a++,a>10&&(n.stop("Connection lost."),w.error(N.red(`
-\u2717 Lost connection to Dashboard API.`)),process.exit(1))}await new Promise(l=>setTimeout(l,3e3))}}import fr from"http";import{execSync as De,spawn as un}from"child_process";import li from"chalk";import{log as rt}from"@clack/prompts";import mr from"axios";import di from"fs";import gr from"os";import ci from"path";var St=7070;function hr(){let e=[];try{let t=De("adb devices -l",{stdio:"pipe"}).toString(),i=new Set;t.split(`
-`).forEach(n=>{if(n.includes("List of devices")||!n.trim())return;let o=n.split(/\s+/);if(o.length<2||o[1]!=="device")return;let r=o[0];i.add(r);let a=n.match(/model:([^\s]+)/);e.push({id:r,platform:"android",type:r.startsWith("emulator-")?"emulator":"physical",name:a?a[1].replace(/_/g," "):r,status:"online",details:n.trim()})})}catch{}try{let t=`${process.env.ANDROID_HOME||`${process.env.HOME}/Library/Android/sdk`}/emulator/emulator`,n=De(`${t} -list-avds`,{stdio:"pipe"}).toString().split(`
-`).filter(r=>!!r.trim()),o=e.some(r=>r.platform==="android"&&r.id.startsWith("emulator-"));n.forEach(r=>{o||e.push({id:r,platform:"android",type:"emulator",name:r.replace(/_/g," "),status:"offline",details:`Android Virtual Device: ${r}`})})}catch{}if(process.platform!=="darwin")return e;try{let t=De("/usr/bin/xcrun simctl list devices --json",{stdio:"pipe"}).toString(),i=JSON.parse(t);Object.entries(i.devices).forEach(([n,o])=>{o.forEach(r=>{r.isAvailable&&e.push({id:r.udid,platform:"ios",type:"simulator",name:r.name,status:r.state?.toLowerCase()==="booted"?"online":"offline",runtime:n,details:`${r.name} (${n})`})})})}catch{}try{let t=De("/usr/bin/xcrun devicectl list devices --json-output -",{stdio:"pipe"}).toString();(JSON.parse(t).result?.devices||[]).forEach(n=>{let o=n.connectionProperties?.transportType;(o==="wired"||o==="localNetwork")&&e.push({id:n.identifier,platform:"ios",type:"physical",name:n.deviceProperties?.name||"iPhone",status:"online",details:`${n.deviceProperties?.name||"iPhone"} (${n.model?.name||n.hardwareModel||""}) - ${o}`})})}catch{}return e}async function pn(e){let t=[];for await(let i of e)t.push(Buffer.isBuffer(i)?i:Buffer.from(i));return t.length===0?{}:JSON.parse(Buffer.concat(t).toString("utf-8"))}async function yr(e,t){let i=await mr({method:"GET",url:e,responseType:"stream",timeout:12e4}),n=di.createWriteStream(t);i.data.pipe(n),await new Promise((o,r)=>{n.on("finish",o),n.on("error",r)})}async function Sr(e,t,i){let n=i||(t.toLowerCase().includes(".apk")?"android":"ios"),o=t.toLowerCase().includes(".ipa"),r=di.mkdtempSync(ci.join(gr.tmpdir(),`${St}-install-`)),a=ci.join(r,n==="android"?"install.apk":o?"install.ipa":"install.zip");try{if(await yr(t,a),n==="android"){De(`adb -s ${JSON.stringify(e)} install -r ${JSON.stringify(a)}`,{stdio:"pipe"});return}if(process.platform!=="darwin")throw new Error("iOS local install requires macOS.");De(`unzip -o ${JSON.stringify(a)} -d ${JSON.stringify(r)}`,{stdio:"pipe"});let l="";try{l=De(`find ${JSON.stringify(ci.join(r,"Payload"))} -maxdepth 1 -name "*.app" 2>/dev/null | head -n 1`,{stdio:"pipe"}).toString().trim()}catch{}if(l||(l=De(`find ${JSON.stringify(r)} -name "*.app" -type d | head -n 1`,{stdio:"pipe"}).toString().trim()),!l)throw new Error(`No .app bundle found inside the ${o?"IPA":"archive"}.`);try{De(`/usr/bin/xcrun devicectl device install app --device ${JSON.stringify(e)} ${JSON.stringify(l)}`,{stdio:"pipe"})}catch(s){try{De(`/usr/bin/xcrun simctl install ${JSON.stringify(e)} ${JSON.stringify(l)}`,{stdio:"pipe"})}catch{throw new Error(s.stderr?.toString().trim()||s.message||"iOS install failed.")}}}finally{di.rmSync(r,{recursive:!0,force:!0})}}function Er(e,t){if(!e)throw new Error("Device id is required.");if(t==="ios"){if(process.platform!=="darwin")throw new Error("iOS Simulator launch requires macOS.");return De(`/usr/bin/xcrun simctl boot ${JSON.stringify(e)}`,{stdio:"pipe"}),un("open",["-a","Simulator"],{detached:!0,stdio:"ignore"}).unref(),"Simulator booting..."}if(t==="android"){let i=`${process.env.ANDROID_HOME||`${process.env.HOME}/Library/Android/sdk`}/emulator/emulator`;return un(i,["-avd",e],{detached:!0,stdio:"ignore"}).unref(),"Emulator booting in background..."}throw new Error("Invalid platform.")}async function fn(){process.platform!=="darwin"&&rt.warn("Running on non-macOS \u2014 iOS discovery unavailable, Android only.");let e=fr.createServer((n,o)=>{if(o.setHeader("Access-Control-Allow-Origin","*"),o.setHeader("Access-Control-Allow-Methods","GET, POST, OPTIONS"),o.setHeader("Access-Control-Allow-Headers","Content-Type, Authorization"),n.method==="OPTIONS"){o.writeHead(204),o.end();return}let r=new URL(n.url||"/",`http://localhost:${St}`);if(n.method==="GET"&&r.pathname==="/local/devices"){try{let a=hr();o.writeHead(200,{"Content-Type":"application/json"}),o.end(JSON.stringify({status:"success",targets:a}))}catch(a){o.writeHead(500,{"Content-Type":"application/json"}),o.end(JSON.stringify({status:"error",message:a.message}))}return}if(n.method==="POST"&&r.pathname==="/install-local"){t(n,o);return}if(n.method==="POST"&&r.pathname==="/local/boot"){i(n,o);return}o.writeHead(404),o.end()}),t=async(n,o)=>{try{let{deviceId:r,artifactUrl:a,platform:l}=await pn(n);if(!r||!a){o.writeHead(400,{"Content-Type":"application/json"}),o.end(JSON.stringify({status:"error",message:"deviceId and artifactUrl are required"}));return}await Sr(r,a,l),o.writeHead(200,{"Content-Type":"application/json"}),o.end(JSON.stringify({status:"success",message:`Installed on ${r}`}))}catch(r){o.writeHead(500,{"Content-Type":"application/json"}),o.end(JSON.stringify({status:"error",message:r.message||"Local install failed"}))}},i=async(n,o)=>{try{let{id:r,platform:a}=await pn(n),l=Er(r,a);o.writeHead(200,{"Content-Type":"application/json"}),o.end(JSON.stringify({status:"success",message:l}))}catch(r){o.writeHead(500,{"Content-Type":"application/json"}),o.end(JSON.stringify({status:"error",message:r.message||"Local device launch failed"}))}};e.listen(St,"127.0.0.1",()=>{rt.success(li.green(`Local device agent running on http://localhost:${St}`)),rt.info(li.dim("Keep this running while using the Install Hub on the dashboard.")),rt.info(li.dim("Press Ctrl+C to stop."))}),e.on("error",n=>{n.code==="EADDRINUSE"?rt.error(`Port ${St} is already in use \u2014 agent may already be running.`):rt.error(`Agent error: ${n.message}`),process.exit(1)}),await new Promise(()=>{})}import{createRequire as Sa}from"module";import{text as br,password as _r,spinner as Ir,isCancel as hn}from"@clack/prompts";import mi from"chalk";import Et from"fs";import mn from"path";import Ar from"os";var ui=mn.join(Ar.homedir(),m.configDir),pi=mn.join(ui,"config.json");function fi(){if(!Et.existsSync(pi))return{};try{return JSON.parse(Et.readFileSync(pi,"utf-8"))}catch{return{}}}function gn(e){Et.existsSync(ui)||Et.mkdirSync(ui,{recursive:!0});let i={...fi(),...e};Et.writeFileSync(pi,JSON.stringify(i,null,2))}async function yn(){let e=fi(),t=await br({message:"Enter your email:",placeholder:"user@example.com",initialValue:e.lastLoginEmail,validate(o){if(o.length===0)return"Email is required!"}});if(hn(t))return;let i=await _r({message:"Enter your password:",validate(o){if(o.length===0)return"Password is required!"}});if(hn(i))return;let n=Ir();n.start("Authenticating...");try{let r=await(await fetch(`${Nt}/login`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({username:t,password:i})})).json();r.status==="success"&&r.user.token?(Ri({id:r.user.id,email:t,token:r.user.token,refreshToken:r.user.refreshToken}),gn({lastLoginEmail:t}),n.stop(mi.green("Login successful!"))):n.stop(mi.red("Login failed: "+(r.message||"Unknown error")))}catch(o){n.stop(mi.red("Network error: "+o.message))}}import{outro as Pr,select as $r,spinner as Dr,isCancel as Rr}from"@clack/prompts";import Ut from"chalk";import gi from"fs";import vr from"path";var Sn=e=>e==="1234567890"||e==="ABC123DEFG"||e==="XXXXXXXXXX"?"":typeof e=="string"?e:"",wr=()=>process.versions.node.split(".")[0]||"24";async function En(){if(!ge()){console.log(Ut.red(`You are not logged in. Run \`${m.nameLower} login\` first.`));return}let t=Dr();t.start("Fetching projects...");try{let{data:i}=await v.get("/projects");if(t.stop("Projects loaded."),i.status!=="success"||!i.projects||i.projects.length===0){console.log(Ut.yellow(`No projects found. Run \`${m.nameLower} init\` to create one.`));return}let n=i.projects.map(y=>({value:y.projectId,label:`${y.name} (${y.slug})`})),o=await $r({message:"Select a project to link:",options:n});if(Rr(o))return;let r=vr.join(process.cwd(),m.configFileName),a={};if(gi.existsSync(r))try{a=JSON.parse(gi.readFileSync(r,"utf-8"))}catch{}let l=i.projects.find(y=>y.projectId===o),s=a.android?.package||Fe("android"),c=a.ios?.bundleIdentifier||Fe("ios"),d=a.android||{},u=a.submit?.production?.android||{},p=a.submit?.production?.ios||{},f={projectId:o,name:l?.name,slug:l?.slug,nodeVersion:a.nodeVersion||wr(),scheme:l?.slug?.toLowerCase()||"app",android:{...d,package:s||"",versionCode:d.versionCode||"auto"},ios:{bundleIdentifier:c||""},build:{development:{environment:"development",distribution:"internal"},staging:{environment:"staging",distribution:"internal"},production:{environment:"production",distribution:"store"}},submit:{production:{android:{...u,track:u.track||"internal",releaseStatus:u.releaseStatus||"completed"},ios:{ascAppId:Sn(p.ascAppId),appleTeamId:Sn(p.appleTeamId)}}}};gi.writeFileSync(r,JSON.stringify(f,null,2)),Pr(Ut.green(`Linked to project ${f.name} (${f.slug})`))}catch(i){t.stop(Ut.red("Error fetching projects: "+i.message))}}import{outro as Or,text as Ft,select as Cr,spinner as Nr,isCancel as At}from"@clack/prompts";import bt from"chalk";import Tr from"fs";import kr from"path";import{randomUUID as xr}from"crypto";var Lr=()=>process.versions.node.split(".")[0]||"24";async function An(){if(!ge()){console.log(bt.red(`You are not logged in. Run \`${m.nameLower} login\` first.`));return}let t=await Ft({message:"Project Name:",placeholder:"My Awesome App",validate(l){if(l.length===0)return"Name is required!"}});if(At(t))return;let i=await Ft({message:"Project Slug (URL friendly):",placeholder:"my-awesome-app",validate(l){if(l.length===0)return"Slug is required!";if(!/^[a-z0-9-]+$/.test(l))return"Slug must be lowercase alphanumeric with dashes."}});if(At(i))return;let n=await Cr({message:"Platform:",options:[{value:"android",label:"Android"},{value:"ios",label:"iOS"},{value:"web",label:"Web"},{value:"all",label:"All Platforms"}]});if(At(n))return;let o="";if(n==="android"||n==="all"){let l=Fe("android");if(o=await Ft({message:"Android Package Name:",initialValue:l||"",placeholder:"com.example.app",validate(s){if(s.length===0)return"Package name is required for Android!"}}),At(o))return}let r="";if(n==="ios"||n==="all"){let l=Fe("ios");if(r=await Ft({message:"iOS Bundle Identifier:",initialValue:l||"",placeholder:"com.example.app",validate(s){if(s.length===0)return"Bundle ID is required for iOS!"}}),At(r))return}let a=Nr();a.start("Creating project...");try{let l=xr(),c={projectId:l,name:t,slug:i,storageType:"managed",platforms:n==="all"?["android","ios","web"]:[n]},{data:d}=await v.post("/projects",c);if(d.status==="success"){a.stop(bt.green("Project created successfully!"));let u=kr.join(process.cwd(),m.configFileName);Tr.writeFileSync(u,JSON.stringify({projectId:l,name:t,slug:i,nodeVersion:Lr(),...o?{android:{package:o,versionCode:"auto"}}:{},...r?{ios:{bundleIdentifier:r}}:{},build:{development:{environment:"development",distribution:"internal"},staging:{environment:"staging",distribution:"internal"},production:{environment:"production",distribution:"store"}},submit:{production:{android:{track:"internal",releaseStatus:"completed"},ios:{ascAppId:"",appleTeamId:""}}}},null,2)),Or(bt.green(`Initialized project ${t} and linked locally!`))}else a.stop(bt.red("creation failed: "+d.message))}catch(l){a.stop(bt.red("Network error: "+l.message))}}import{spinner as _n,log as Ee}from"@clack/prompts";import Ht from"chalk";import bn from"fs";import Mr from"path";async function In(e,t){let i=ge();if(!i){Ee.error(`You are not logged in. Run \`${m.nameLower} login\` first.`);return}let n=Mr.join(process.cwd(),m.configFileName);if(!bn.existsSync(n)){Ee.error(`No ${m.configFileName} found. Run \`${m.nameLower} init\` or \`${m.nameLower} link\` first.`);return}let o;try{o=JSON.parse(bn.readFileSync(n,"utf-8"))}catch{Ee.error(`Failed to parse ${m.configFileName}`);return}let{projectId:r}=o;if(!r){Ee.error(`${m.configFileName} is missing projectId.`);return}e==="set"?await Ur(r,t,i):e==="list"?await Fr(r,i):Ee.error(`Unknown env action: ${e}. Use 'set' or 'list'.`)}async function Ur(e,t,i){if(t.length===0){Ee.error(`Usage: ${m.nameLower} env set KEY=VALUE [KEY2=VALUE2 ...]`);return}let n=_n();n.start("Setting environment variables...");let o=0,r=0;for(let a of t){let[l,...s]=a.split("="),c=s.join("=");if(!l||c===void 0){Ee.warn(`Invalid format for argument: ${a}. Expected KEY=VALUE.`),r++;continue}try{let d={key:l.trim(),value:c,type:"env",environment:"global",visibility:"secret"},{data:u}=await v.post(`/projects/${e}/secrets`,d);u.status==="success"?o++:(Ee.error(`Failed to set ${l}: ${u.message}`),r++)}catch(d){Ee.error(`Network error setting ${l}: ${d.message}`),r++}}n.stop(`Set ${o} variable(s). ${r>0?`${r} failed.`:""}`)}async function Fr(e,t){let i=_n();i.start("Fetching environment variables...");try{let{data:n}=await v.get(`/projects/${e}/secrets`);if(n.status==="success"){i.stop("Fetched variables.");let o=n.secrets||[];o.length===0?Ee.info("No environment variables found for this project."):(Ee.info(Ht.bold("Environment Variables (Global & Scoped):")),o.forEach(r=>{let a=r.visibility==="plain"?r.value:"********";console.log(`  ${Ht.cyan(r.key)} = ${a}  ${Ht.gray(`[${r.environment}]`)}`)}))}else i.stop(Ht.red(`Failed to fetch variables: ${n.message}`))}catch(n){i.stop("Failed to fetch variables."),Ee.error(`Network error: ${n.message}`)}}import{spinner as st,text as _t,select as Ei,isCancel as je,cancel as Ai}from"@clack/prompts";import ee from"chalk";import Y from"fs";import de from"path";import{spawn as Hr,spawnSync as Je}from"child_process";import Rn from"axios";import Xe from"os";import Br from"crypto";var Gr={completed:"completed",draft:"draft",halted:"halted",inprogress:"inProgress","in-progress":"inProgress"},jr=e=>e?.type==="google_service_account",Bt=e=>e?.bundleId||e?.packageName||e?.meta?.packageName||e?.meta?.bundleId;async function vn(e){let t=st(),i=ge(),n=`./${m.configFileName}`;if(!Y.existsSync(n)){le(`No ${m.configFileName} found. Run \`${m.nameLower} init\` or \`${m.nameLower} link\` first.`);return}let o=JSON.parse(Y.readFileSync(n,"utf-8")),{projectId:r}=o,a=e.profile||e.buildProfile||"production";if(!r){le(`${m.configFileName} is missing projectId.`);return}ae(ee.dim(`Submit for project: ${o.name||r} | Profile: ${a}`));let l=e.platform;if(!l){let E=await Ei({message:"Select platform to submit:",options:[{value:"ios",label:"iOS (App Store Connect / TestFlight)"},{value:"android",label:"Android (Google Play Console)"}]});if(je(E)){Ai("Operation cancelled");return}l=E}let s=await Qr(r,l,e,i?.token);if(!s)return;ae(`Using artifact: ${ee.green(de.basename(s))} `);let c=l==="android"?Kr(o,a):void 0;t.start("Fetching submission credentials from Dashboard...");let d;try{let H=(await v.get(`/credentials/${r}`)).data.credentials||[];if(l==="android"&&!c){t.stop("Package name missing"),le("Could not resolve Android package name. Set android.package in mach.config.json/app.json.");return}let _=H.filter(jr),g=l==="ios"?H.filter(A=>A.type==="asc_api_key"):Vr(_,c);if(g.length===0){if(t.stop("Credentials missing"),le(l==="android"?`No Google Play service credential found for package ${c}.`:`No Service Credentials found for ${l}.`),l==="android"){let A=_.map(Bt).filter(Boolean).join(", ");A&&ae(`Found Google Play service credential(s) for: ${A}`),ae(`Use '${m.nameLower} credentials:service --platform android --package-name ${c}' or upload it under that package in the Dashboard.`)}else ae(`Use '${m.nameLower} credentials:service --platform ${l}' or use the Dashboard to upload them.`);return}if(g.length===1)d=g[0],t.stop(`Using: ${d.name}`),l==="android"&&Bt(d)==="*"&&ae(ee.yellow(`Using legacy wildcard Google Play credential for ${c}. Upload a package-scoped credential when possible.`));else{t.stop("Multiple credentials found");let A=await Ei({message:`Choose a ${l==="ios"?"App Store Connect":"Google Play"} credential:`,options:g.map(I=>({value:I.credentialId,label:I.name,hint:`${I.keyId?`ID: ${I.keyId}`:""} ${I.issuerId?`(Issuer: ${I.issuerId.substring(0,8)}...)`:""}`}))});if(je(A)){Ai("Submission cancelled");return}d=g.find(I=>I.credentialId===A),ae(`Using selected: ${ee.green(d.name)}`)}}catch(E){t.stop("Failed to fetch credentials"),le(`API Error: ${E.message} `);return}let u=Y.mkdtempSync(de.join(Xe.tmpdir(),`${m.nameLower}-submit-`)),p=d.keyId||d.meta?.keyId,f=d.issuerId||d.meta?.issuerId,y=d.type==="asc_api_key"?`AuthKey_${p}.p8`:"service-account.json",D=de.join(u,y);t.start("Downloading secure key...");try{let E=await v.get(`/credentials/${d.credentialId}/download`,{params:{projectId:r}});if(E.data.status!=="success"||!E.data.downloadUrl)throw new Error("Failed to get secure download URL");let H=await Rn.get(E.data.downloadUrl,{responseType:"arraybuffer"});Y.writeFileSync(D,Buffer.from(H.data)),t.stop("Key downloaded to secure temp storage")}catch(E){t.stop("Download failed"),le(`Failed to download key: ${E.message}`);try{Y.rmSync(u,{recursive:!0,force:!0})}catch{}return}ae(ee.blue(`Initiating ${l==="ios"?"TestFlight":"Google Play"} submission...`));let $,L,B,te=!1;try{l==="android"&&($=e.track||o.submit?.[a]?.android?.track||o.submit?.production?.android?.track||"internal",L=Yr(o,a,e.releaseStatus),B=Xr(o,a,e.rollout),te=qr(o,a,e.changesNotSentForReview),Zr(L,B))}catch(E){le(E.message),$n(u);return}try{if(l==="ios"){if(!p){let g=await _t({message:"Enter App Store Connect Key ID (e.g. 2X948D...):",validate:A=>A.length>0?void 0:"Key ID is required"});if(je(g))return;p=g}if(!f||f==="undefined"){let g=await _t({message:"Enter App Store Connect Issuer ID (Found on ASC Keys page):",validate:A=>A.length>0?void 0:"Issuer ID is required"});if(je(g))return;f=g}ae(`Using ASC Key ID: ${p}`),ae(`Using ASC Issuer ID: ${f}`);let E=zr(o,a),H=Wr(o,a,e),_=H?await ts(s,D,f,p,E,H):await es(s,D,f,p,E);if(_&&_.apiKeyJsonPath)throw ae(ee.cyan(`
-[DIAGNOSTIC] API key written to: ${_.apiKeyJsonPath}
-`)),new Error("fastlane pilot execution failed");Dn(`${l==="ios"?"App Store":"Google Play"} submission successful!`)}else await ss(s,D,$||"internal",c,L||"completed",B,te,a),Dn("Google Play submission successful!")}catch(E){le(`Submission failed: ${E.message}`)}finally{$n(u),s.includes(`${m.nameLower}-artifact-`)}}function Kr(e,t){if(e.submit?.[t]?.android?.package)return e.submit[t].android.package;let i=wi(e,t);if(i)return i;let n=de.join(process.cwd(),"app.json");if(Y.existsSync(n))try{return JSON.parse(Y.readFileSync(n,"utf-8")).expo?.android?.package}catch{}let o=de.join(process.cwd(),"app.config.json");if(Y.existsSync(o))try{let r=JSON.parse(Y.readFileSync(o,"utf-8"));return r.expo?.android?.package||r.android?.package}catch{}}function Vr(e,t){let i=e.filter(r=>Bt(r)===t);if(i.length>0)return i;let n=e.filter(r=>{let a=Bt(r);return!a||a==="*"});return e.length>0&&e.length===n.length?n:[]}function zr(e,t){return e.submit?.[t]?.ios?.bundleIdentifier?e.submit[t].ios.bundleIdentifier:e.submit?.[t]?.ios?.bundleId?e.submit[t].ios.bundleId:Oi(e,t)}function Wr(e,t,i){let n=e.submit?.[t]?.ios||{},o=e.submit?.production?.ios||{},r=i.sshHost||n.sshHost||o.sshHost||process.env.MACH_IOS_SUBMIT_SSH_HOST;return r?{sshHost:r,sshUser:i.sshUser||n.sshUser||o.sshUser||process.env.MACH_IOS_SUBMIT_SSH_USER||process.env.USER||"ubuntu",sshKey:i.sshKey||n.sshKey||o.sshKey||process.env.MACH_IOS_SUBMIT_SSH_KEY}:null}function Yr(e,t,i){let n=i||e.submit?.[t]?.android?.releaseStatus||e.submit?.production?.android?.releaseStatus||"completed";return Jr(n)}function Jr(e){let t=Gr[String(e).trim().toLowerCase()];if(!t)throw new Error(`Invalid Android release status "${e}". Use completed, draft, halted, or inProgress.`);return t}function Xr(e,t,i){let n=i??e.submit?.[t]?.android?.rollout??e.submit?.[t]?.android?.userFraction??e.submit?.[t]?.android?.rolloutFraction??e.submit?.production?.android?.rollout??e.submit?.production?.android?.userFraction??e.submit?.production?.android?.rolloutFraction;if(n==null||n==="")return;let o=Number(n);if(!Number.isFinite(o)||o<=0||o>=1)throw new Error(`Invalid Android rollout fraction "${n}". Use a number greater than 0 and less than 1, for example 0.1.`);return o}function qr(e,t,i){let n=i??e.submit?.[t]?.android?.changesNotSentForReview??e.submit?.[t]?.android?.changes_not_sent_for_review??e.submit?.production?.android?.changesNotSentForReview??e.submit?.production?.android?.changes_not_sent_for_review??!1;return n===!0||n==="true"||n==="1"}function Zr(e,t){if(e==="inProgress"&&t===void 0)throw new Error("Google Play staged rollout requires --rollout <fraction> when --release-status inProgress is used.");if(e!=="inProgress"&&e!=="halted"&&t!==void 0)throw new Error("Android rollout fraction can only be used with --release-status inProgress or halted.")}async function Qr(e,t,i,n){let o=i.buildId?"id":i.latest?"latest":null;if(!o){let a=await Ei({message:"Select artifact source:",options:[{value:"latest",label:`Latest Production Build (${m.name})`},{value:"id",label:`Input Build ID (${m.name})`},{value:"url",label:"Remote URL"},{value:"local",label:"Local File Path"}]});if(je(a))return Ai("Operation cancelled"),null;o=a}if(o==="local"){let a=await _t({message:"Enter path to artifact (.ipa/.aab):",validate:l=>{if(!Y.existsSync(l))return"File not found";if(t==="ios"&&!l.endsWith(".ipa"))return"Must be an .ipa file";if(t==="android"&&!l.endsWith(".aab"))return"Must be an .aab file"}});return je(a)?null:a}let r=st();if(o==="latest"){let a=i.profile||i.buildProfile;r.start(`Fetching latest${a?` ${a}`:""} build...`);try{let l=await v.get(`/builds/${e}`,{params:{limit:50}});if(l.data.status!=="success")throw new Error(l.data.message);let s=l.data.builds||[],c=a?.toLowerCase(),d=E=>E.platform?.toLowerCase()===t.toLowerCase()&&E.status?.toLowerCase()==="success",u=E=>c?[E.buildProfile,E.profile,E.profileName,E.buildType].filter(Boolean).some(H=>String(H).toLowerCase()===c):!0,p=s.filter(E=>d(E)&&u(E)),f=p.find(E=>E.buildType?.toLowerCase()==="store"||E.distribution?.toLowerCase()==="store")||p[0],y=s.some(E=>E.platform?.toLowerCase()===t.toLowerCase()&&E.status?.toLowerCase()==="success");if(!f)return r.stop("No suitable build found"),le(a&&y?`No successful ${t} builds found for profile "${a}".`:"No successful builds found for this platform."),null;r.stop(`Found build: ${f.buildId}`);let D=f.artifacts||[];if(D.length===0||D.every(E=>!(E.url||E.downloadUrl)))try{let E=await v.get(`/builds/${e}/${f.buildId}/artifacts`);E.data.status==="success"&&E.data.artifacts?.length>0?(D=E.data.artifacts.map(H=>({...H,url:H.url||H.downloadUrl})),console.log(ee.cyan(`  [RECOVERY] Fetched ${D.length} artifact(s) with download URLs.`))):console.log(ee.yellow("  [RECOVERY] /artifacts endpoint returned 0 artifacts."))}catch(E){console.log(ee.red(`  [RECOVERY] /artifacts fetch failed: ${E.message}`))}let L=t==="ios",B=D.find(E=>{let H=(E.type||"").toLowerCase(),_=(E.name||"").toLowerCase();if(console.log(ee.dim(`    - Checking: ${E.name} (Type: ${E.type}, HasLink: ${!!(E.url||E.downloadUrl)})`)),H)return H===(L?"ipa":"aab");let g=L?".ipa":".aab",A=(E.url||E.downloadUrl||"").toLowerCase();return _.endsWith(g)||A.includes(g)});if(!B||!(B.url||B.downloadUrl))return le("Build found but artifact URL is missing."),null;let te=B.url||B.downloadUrl;return await hi(te,L?"ios":"android")}catch(l){return r.stop("Fetch failed"),le(`API Error: ${l.message}`),null}}if(o==="id"){let a=i.buildId||await _t({message:"Enter Build ID:",validate:l=>l.length<5?"Invalid ID":void 0});if(je(a))return null;r.start("Fetching build...");try{let l=await v.get(`/build/${a}`);if(l.data.status!=="success")throw new Error(l.data.message);let s=l.data.build;if(!s)throw new Error("Build not found");let c=t==="ios",d=s.artifacts?.find(u=>{if(u.type)return u.type===(c?"ipa":"aab");let p=c?".ipa":".aab";return u.name&&u.name.endsWith(p)||u.url&&u.url.includes(p)});return!d||!d.url?(r.stop("Missing artifact"),le("Artifact URL not found on build record."),null):(r.stop(`Found build: ${s.buildId}`),await hi(d.url,c?"ios":"android"))}catch(l){return r.stop("Fetch failed"),le(l.message),null}}if(o==="url"){let a=await _t({message:"Enter Artifact URL:",validate:l=>l.startsWith("http")?void 0:"Must be a valid URL"});return je(a)?null:await hi(a,t)}return null}async function hi(e,t,i=3){let n=st();n.start("Downloading artifact...");let o=Y.mkdtempSync(de.join(Xe.tmpdir(),`${m.nameLower}-artifact-`)),r=`app.${t==="ios"?"ipa":"aab"}`,a=de.join(o,r);for(let l=1;l<=i;l++)try{l>1&&(n.message(`Downloading artifact (Retry ${l}/${i})...`),await new Promise(d=>setTimeout(d,2e3*l)));let s=Y.createWriteStream(a),c=await Rn({url:e,method:"GET",responseType:"stream",timeout:6e4});return await new Promise((d,u)=>{c.data.pipe(s);let p=!1;c.data.on("error",f=>{p||(p=!0,s.close(),u(f))}),s.on("finish",()=>{p||d()}),s.on("error",f=>{p||(p=!0,u(f))})}),n.stop("Download complete"),a}catch(s){if(l===i)throw n.stop("Download failed"),s}throw new Error("Download failed after retries")}async function es(e,t,i,n,o){let r=st();if(o&&ae(`Bundle ID: ${ee.green(o)}`),!i||!n)throw le(`Missing credentials: issuerId=${i}, keyId=${n}. Check your Dashboard.`),new Error("Missing ASC API Key Metadata (IssuerID or KeyID)");let a=wn(t,i,n),l=ls();return r.start("Uploading to TestFlight (pilot)..."),new Promise((s,c)=>{let d=Hr(l.command,["pilot","upload","--ipa",e,"--api_key_path",a,"--skip_submission","true","--skip_waiting_for_build_processing","true"],{stdio:"inherit",env:l.env});d.on("close",u=>{if(u!==0)r.stop("Pilot failed"),s({apiKeyJsonPath:a});else{r.stop("IPA uploaded to TestFlight");try{Y.unlinkSync(a)}catch{}s({apiKeyJsonPath:null})}}),d.on("error",u=>{try{Y.unlinkSync(a)}catch{}r.stop("Pilot execution error"),c(ds(u))})})}async function ts(e,t,i,n,o,r){let a=st();if(o&&ae(`Bundle ID: ${ee.green(o)}`),!i||!n)throw le(`Missing credentials: issuerId=${i}, keyId=${n}. Check your Dashboard.`),new Error("Missing ASC API Key Metadata (IssuerID or KeyID)");let l=wn(t,i,n),s=`${r.sshUser}@${r.sshHost}`,c=is(r),d=ns(r),u="",p="";try{if(a.start(`Preparing remote iOS submit runner (${s})...`),u=os("ssh",[...c,"mktemp -d /tmp/mach-submit.XXXXXX"]).trim(),!u)throw new Error("Remote runner did not return a temp directory.");a.stop(`Remote runner ready: ${s}`),a.start("Uploading IPA and App Store Connect key to remote runner..."),yi("scp",[...d,e,`${s}:${u}/app.ipa`],"IPA upload to remote runner"),yi("scp",[...d,l,`${s}:${u}/api_key.json`],"ASC key upload to remote runner"),p=de.join(Xe.tmpdir(),`${m.nameLower}-ios-submit-${Date.now()}.sh`),Y.writeFileSync(p,rs(u)),yi("scp",[...d,p,`${s}:${u}/submit.sh`],"submit script upload to remote runner"),a.stop("Remote submit inputs uploaded"),a.start("Uploading to TestFlight on remote runner...");let f=`chmod +x ${It(`${u}/submit.sh`)} && bash ${It(`${u}/submit.sh`)}`,y=Je("ssh",[...c,f],{stdio:"inherit"});if(y.error)throw bi("ssh",y.error);if(y.status!==0)throw new Error(`Remote iOS submit failed with exit code ${y.status}.`);return a.stop("IPA uploaded to TestFlight"),{apiKeyJsonPath:null}}catch(f){throw a.stop("Remote iOS submit failed"),f}finally{try{Y.unlinkSync(l)}catch{}if(p)try{Y.unlinkSync(p)}catch{}if(u)try{Je("ssh",[...c,`rm -rf ${It(u)}`],{stdio:"ignore"})}catch{}}}function wn(e,t,i){let n=Y.readFileSync(e,"utf8"),o;try{o=Br.createPrivateKey(n).export({type:"pkcs8",format:"pem"})}catch{ae("Key normalization failed, falling back to manual re-wrapping..."),o=`-----BEGIN PRIVATE KEY-----
+`));try{let C=z("security find-identity -v -p codesigning",{encoding:"utf-8"});o(y.magenta(`${C}
+`))}catch(C){o(y.red(`[DIAGNOSTIC] Failed to list identities: ${C.message}
+`))}}await xe("xcodebuild",["-exportArchive","-archivePath",b,"-exportPath",L,"-exportOptionsPlist",H],c,m,o,s),a&&await a("validate");let J=Ze(L,[".ipa"]);for(let C of J)try{z(`unzip -t "${C}"`,{stdio:"pipe"});let W=zo(C);o&&o(`[IPA VALID] ${A.basename(C)} \u2014 archive integrity OK
+`),o&&o(`[IPA VALID] CFBundleVersion ${W}
+`)}catch(W){let Y=`IPA validation failed for ${A.basename(C)}: ${W.message||"archive may be corrupt"}`;throw o&&o(`[IPA CORRUPT] ${Y}
+`),new Error(Y)}return J}},Fe=e=>{try{let t=A.join(process.cwd(),f.configFileName);if(g.existsSync(t)){let i=JSON.parse(g.readFileSync(t,"utf-8"));if(e==="android"&&i.android?.package)return i.android.package;if(e==="ios"&&i.ios?.bundleIdentifier)return i.ios.bundleIdentifier}if(e==="android"){let i=["android/app/build.gradle","app/build.gradle","build.gradle"];for(let n of i)if(g.existsSync(n)){let o=g.readFileSync(n,"utf-8").match(/applicationId\s+['"]([^'"]+)['"]/);if(o)return o[1]}}else{let i=A.resolve(process.cwd(),g.existsSync("ios")?"ios":"."),n=Ze(i,["Info.plist"]).filter(s=>!s.includes("/Pods/")&&!s.includes("/build/")&&!s.includes("/DerivedData/"));n.sort((s,l)=>l.split("/").length-s.split("/").length);for(let s of n){let a=g.readFileSync(s,"utf-8").match(/<key>CFBundleIdentifier<\/key>\s*<string>([^<]+)<\/string>/);if(a&&!a[1].includes("$"))return a[1]}let r=Ze(i,[".xcodeproj"]);if(r.length>0){let s=A.join(r[0],"project.pbxproj");if(g.existsSync(s)){let a=g.readFileSync(s,"utf-8").match(/PRODUCT_BUNDLE_IDENTIFIER\s*=\s*"?([^";\s]+)"?;/);if(a)return a[1]}}let o=["app.json","app.config.json","app.config.js","app.config.ts"];for(let s of o)if(g.existsSync(s)){let a=g.readFileSync(s,"utf-8").match(/"bundleIdentifier":\s*"([^"]+)"/);if(a)return a[1]}}}catch{return null}return null},Jo=()=>{try{return z("emulator -version",{stdio:"ignore"}),"emulator"}catch{let t=ue.homedir(),i=[A.join(t,"Library/Android/sdk/emulator/emulator"),A.join(t,"Android/Sdk/emulator/emulator"),"/usr/local/lib/android/sdk/emulator/emulator"];for(let n of i)if(g.existsSync(n))return n}return"emulator"},Xo=async(e,t)=>{let i=Ft();try{if(z("adb devices").toString().split(`
+`).slice(1).map(s=>s.trim()).filter(s=>s.length>0&&!s.startsWith("*")).map(s=>s.split("	")[0]).length===0){S.warn(y.yellow("No Android devices or emulators found."));let s=Jo(),l=[];try{l=z(`${s} -list-avds`).toString().split(`
+`).filter(a=>a.trim().length>0)}catch{}if(l.length>0){let a=await hi({message:"Select an emulator to launch:",options:l.map(u=>({value:u,label:u}))});if(Bt(a))return;i.start(`Launching emulator ${a}...`),_n(s,["-avd",a],{detached:!0,stdio:"ignore"}).unref();let c=0,d=!1;for(;c<60;){try{if(z("adb shell getprop sys.boot_completed",{stdio:"pipe"}).toString().trim()==="1"){d=!0;break}}catch{}await new Promise(u=>setTimeout(u,2e3)),c++}if(!d)throw i.stop("Emulator launch timed out."),new Error("Emulator launch timed out. Please try launching it manually.");i.stop("Emulator launched.")}else throw new Error("No devices found and no emulators available to launch. (Make sure Android SDK is installed)")}i.start("Installing APK on device..."),await xe("adb",["install","-r",e],process.cwd(),{},t),i.stop("Installation complete.");let o=Fe("android");if(o){S.info(y.blue(`\u{1F680} Launching ${o}...`));try{z(`adb shell dumpsys package ${o}`).toString().split(`
+`).find(a=>a.includes("android.intent.action.MAIN")&&a.includes("android.intent.category.LAUNCHER"))?z(`adb shell monkey -p ${o} -c android.intent.category.LAUNCHER 1`,{stdio:"ignore"}):z(`adb shell monkey -p ${o} -c android.intent.category.LAUNCHER 1`,{stdio:"ignore"})}catch{S.warn("Could not auto-launch app. You may need to open it manually.")}}}catch(n){i.stop("Installation failed."),S.error(y.red(`Failed to install APK: ${n.message}`))}},qo=async(e,t,i)=>{let n=Ft();try{if(!z("xcrun simctl list devices booted").toString().includes("(Booted)")){S.warn(y.yellow("No iOS Simulator is currently booted."));let o=z("xcrun simctl list devices --json").toString(),s=JSON.parse(o).devices,l=[];Object.keys(s).forEach(u=>{s[u].forEach(p=>{p.isAvailable&&l.push({...p,runtime:u})})});let a=await hi({message:"Select a simulator to launch:",options:l.map(u=>({value:u.udid,label:`${u.name} (${u.runtime.split(".").pop()})`}))});if(Bt(a))return;n.start(`Booting ${a}...`),z(`xcrun simctl boot ${a}`),z(`open -a Simulator --args -CurrentDeviceUDID ${a}`);let c=0,d=!1;for(;c<30;){try{if(z("xcrun simctl list devices booted").toString().includes(a)){d=!0;break}}catch{}await new Promise(u=>setTimeout(u,2e3)),c++}if(!d)throw n.stop("Simulator boot timed out."),new Error("Simulator boot timed out.");n.stop("Simulator booted.")}n.start("Installing on iOS Simulator..."),await xe("xcrun",["simctl","install","booted",e],process.cwd(),{},i),n.stop("Installation complete."),S.info(y.blue(`\u{1F680} Launching ${t}...`)),await xe("xcrun",["simctl","launch","booted",t],process.cwd(),{},i)}catch(r){n.stop("Installation failed."),S.error(y.red(`Failed to install on Simulator: ${r.message}`))}},Zo=async(e,t,i)=>{let n=Ft();n.start("Scanning for connected iOS devices...");try{let r=z("xcrun devicectl list devices --json-output -").toString(),s=(JSON.parse(r).result?.devices||[]).filter(a=>a.connectionProperties?.transportType==="wired"||a.connectionProperties?.transportType==="localNetwork");if(s.length===0)throw n.stop("No connected iOS devices found."),new Error("Please connect your iPhone via USB or ensure it is on the same Wi-Fi for wireless debugging.");let l=s[0].identifier;if(s.length>1){n.stop();let a=await hi({message:"Select a device to install on:",options:s.map(c=>({value:c.identifier,label:`${c.deviceProperties?.name||c.name||c.model?.name} (${c.model?.name||"iPhone"}) - ${c.identifier}`}))});if(Bt(a))return;l=a,n.start(`Installing on ${l}...`)}else n.message(`Installing on ${s[0].model.name}...`);await xe("xcrun",["devicectl","device","install","app","--device",l,e],process.cwd(),{},i),n.stop("Installation complete."),S.info(y.blue(`\u{1F680} Launching ${t}...`)),await xe("xcrun",["devicectl","device","launch","app","--device",l,t],process.cwd(),{},i)}catch(r){n.stop("Installation failed."),S.error(y.red(`Failed to install on device: ${r.message}`)),S.info(y.dim('Make sure your device is unlocked and "Developer Mode" is enabled in Settings -> Privacy & Security.'))}};import On from"fs";import Cn from"path";import{isCancel as Si,log as Be,select as Nn,spinner as Qo,text as es}from"@clack/prompts";import st from"chalk";async function Tn(e){let t=await Ei(e);t&&(Be.success(st.green(`Maestro run ${t.status||"queued"}: ${t.testRunId}`)),t.launchDeferredReason&&Be.warn(st.yellow(t.launchDeferredReason)),t.dashboardUrl&&Be.info(st.dim("View test run: ")+st.white.underline(t.dashboardUrl)))}async function Ei(e){let t=Te(`./${f.configFileName}`),i=e.projectId||t?.projectId,n=e.profile||e.buildProfile||"production";if(!i)return Be.error(`No projectId found. Run \`${f.nameLower} link\` first or pass an internal project id.`),null;let r=e.platform;if(!r&&e.latest){let a=await Nn({message:"Select platform for the latest build:",options:[{value:"android",label:"Android"},{value:"ios",label:"iOS"}]});if(Si(a))return null;r=a}let o=await ts(e);if(!o)return null;if(o.kind==="latest"&&!r)return Be.error("Pass --platform when using --latest."),null;if(o.kind==="artifact-url"&&!r)return Be.error("Pass --platform when using --artifact-url."),null;let s=is(e.maestroRetries);if(s===null)return null;let l=Qo();e.quiet||l.start("Queuing Maestro run...");try{let a=await v.post("/tests/maestro",{projectId:i,platform:r,profile:n,latest:o.kind==="latest",buildId:o.kind==="build-id"?o.value:e.buildId,buildUrl:o.kind==="build-url"?o.value:e.buildUrl,artifactUrl:o.kind==="artifact-url"?o.value:e.artifactUrl,flows:e.maestroFlows||".maestro",device:e.maestroDevice||(r==="ios"?"iphone_15":"pixel_6"),retries:s,record:!!e.maestroRecord});if(a.data.status!=="success")throw new Error(a.data.message||"Failed to queue Maestro run");let c=a.data.testRun,d={testRunId:c.testRunId,status:c.status,projectId:i,buildId:c.buildId,platform:c.platform,dashboardUrl:c.dashboardUrl||`${je}/tests/${c.testRunId}`,launchDeferredReason:c.launchDeferredReason};return ns(e,d),e.quiet||l.stop("Maestro run queued"),d}catch(a){e.quiet||l.stop("Could not queue Maestro run");let c=a.response?.data?.message||a.message||"Unknown error";return Be.error(st.red(`Maestro queue failed: ${c}`)),null}}async function ts(e){if(e.buildId)return{kind:"build-id",value:e.buildId};if(e.buildUrl)return{kind:"build-url",value:e.buildUrl};if(e.artifactUrl)return{kind:"artifact-url",value:e.artifactUrl};if(e.latest)return{kind:"latest"};let t=await Nn({message:"Select app artifact source for Maestro:",options:[{value:"latest",label:"Latest successful build"},{value:"build-id",label:"Build ID"},{value:"build-url",label:`${f.name} build URL`},{value:"artifact-url",label:"Direct artifact URL"}]});if(Si(t))return null;if(t==="latest")return{kind:"latest"};let i=await es({message:t==="build-id"?"Enter build ID:":t==="build-url"?`Enter ${f.name} build URL:`:"Enter artifact URL:",validate:n=>{let r=String(n||"").trim();if(!r)return"Value is required";if((t==="build-url"||t==="artifact-url")&&!r.startsWith("http"))return"Must be a URL"}});return Si(i)?null:{kind:t,value:String(i).trim()}}function is(e){if(e==null||e==="")return 1;let t=Number(e);return!Number.isInteger(t)||t<0||t>10?(Be.error("--maestro-retries must be an integer between 0 and 10."),null):t}function ns(e,t){if(!e.jsonOutput)return;let i=Cn.resolve(e.jsonOutput),n={...t,updatedAt:new Date().toISOString()};try{let r=Cn.dirname(i);r&&r!=="."&&On.mkdirSync(r,{recursive:!0}),On.writeFileSync(i,JSON.stringify(n,null,2))}catch(r){Be.warn(st.yellow(`Could not write Maestro metadata JSON: ${r.message}`))}}var jt=8,ss=6,jn=e=>new Promise(t=>setTimeout(t,e)),as=e=>{let t=e.response?.status,i=e.code||"",n=e.message||"";return t?t===408||t===409||t===425||t===429||t>=500||/ECONNRESET|ETIMEDOUT|EAI_AGAIN|ENOTFOUND|ECONNABORTED|socket hang up|network|timeout/i.test(`${i} ${n}`):!0},Ht=async(e,t,i=ss)=>{let n;for(let r=1;r<=i;r++)try{return await t()}catch(o){if(n=o,!as(o)||r>=i)break;let s=Math.min(6e4,2e3*Math.pow(2,r-1)),l=o.response?.status||o.code||o.message||"network error";O.warn(N.yellow(`${e} failed transiently (${l}). Retrying in ${Math.round(s/1e3)}s... (${r}/${i})`)),await jn(s)}throw n},ls=e=>{let t=e.response?.status;return t?t===408||t===429||t>=500:!0},Gt=e=>e.credentialId||e.id,ds=async(e,t)=>{let i=Gt(e);if(!i)return e.downloadUrl;let n=await v.get(`/credentials/${i}/download`,{params:{projectId:t}});return n.data?.status==="success"&&n.data?.downloadUrl?n.data.downloadUrl:e.downloadUrl},Gn=async(e,t)=>{let i=e.downloadUrl;for(let n=1;n<=jt;n++)try{if((!i||n>1)&&(i=await ds(e,t)),!i)throw new Error(`Credential ${e.name||Gt(e)||"unknown"} has no download URL.`);let r=await St.get(i,{responseType:"arraybuffer",timeout:6e4,maxContentLength:1/0,maxBodyLength:1/0,headers:{Connection:"close"}});return Buffer.from(r.data).toString("base64")}catch(r){if(n>=jt||!ls(r))throw r;let o=Math.min(1500*n*n,15e3);O.warn(N.dim(`  - Temporary network error downloading ${e.name}. Retrying... (${n}/${jt})`)),await jn(o)}throw new Error(`Failed to download credential ${e.name||Gt(e)||"unknown"}.`)},cs=async(e,t)=>{let i=await Gn(e,t);return Buffer.from(i,"base64").toString("utf8")},us=(e,t)=>t?.ios?.buildNumber??t?.iosBuildNumber??e?.ios?.buildNumber??e?.expo?.ios?.buildNumber,ps=(e,t,i)=>t?.ios?.ascAppId??t?.ascAppId??e?.ios?.ascAppId??e?.submit?.[i]?.ios?.ascAppId??e?.submit?.production?.ios?.ascAppId,Mn=e=>e.bundleId||e.bundleIdentifier||e.meta?.bundleId||e.meta?.bundleIdentifier,Fn=(e,t)=>{let i=e.filter(n=>n.type==="asc_api_key");if(i.length!==0){if(t){let n=i.find(o=>Mn(o)===t);if(n)return n;let r=i.find(o=>Mn(o)==="*");if(r)return r}return i[0]}},fs=e=>typeof e=="string"&&e.trim().toLowerCase()==="auto",Kt=async e=>{if(e.failOnly){(!e.projectId||!e.buildId)&&(O.error(N.red("--project-id and --build-id are required with --fail-only.")),process.exit(1));let l=e.error||"Build runner failed before it could report a final status.";try{await v.patch(`/builds/${e.projectId}/${e.buildId}`,{status:"failed",error:l,endTime:Date.now()}),O.info(N.yellow(`Marked build ${e.buildId} as failed.`));return}catch(a){O.error(N.red(`Could not mark build failed: ${a.message}`)),process.exit(1)}}e.platform!=="android"&&e.platform!=="ios"&&(O.error(`Platform ${e.platform} is not supported. Use 'android' or 'ios'.`),process.exit(1));let t=bi(),i=e.buildId||rs(),n=e.projectId,r=Date.now(),o=!!n,s=async l=>{if(n)try{await v.patch(`/builds/${n}/${i}`,{status:"failed",error:l})}catch{}};if(e.local&&e.buildId){e.quiet||t.start(`Preparing isolated workspace for build: ${e.buildId}`);try{let l=await v.get(`/builds/${n}/${e.buildId}/source-url`);if(l.data.status!=="success")throw new Error("Failed to get source download URL from API");let a=await St.get(l.data.downloadUrl,{responseType:"stream"}),c=(n||e.projectId||"default").replace(/[^a-zA-Z0-9-_]/g,"_"),d=we.join(os.homedir(),f.workspacesDir,c);pe.mkdirSync(d,{recursive:!0});let u=new Set(["node_modules",`.${f.nameLower}-cache-meta`]),p=new Set(["Pods"]);if(pe.existsSync(d)){let F=pe.readdirSync(d);for(let T of F){if(u.has(T))continue;if(T==="ios"){let h=we.join(d,"ios");try{let j=pe.readdirSync(h);for(let $ of j)if(!p.has($))try{pe.rmSync(we.join(h,$),{recursive:!0,force:!0})}catch{}}catch{}continue}let B=we.join(d,T);try{pe.rmSync(B,{recursive:!0,force:!0})}catch{}}}let m=we.join(d,"source.zip"),E=a.data,U=pe.createWriteStream(m);await new Promise((F,T)=>{E.pipe(U),E.on("error",B=>T(B)),U.on("finish",()=>F())}),new Un(m).extractAllTo(d,!0);try{pe.unlinkSync(m)}catch{}process.chdir(d),O.info(N.green(`\u2713 Persistent workspace ready: ${d}`)),O.info(N.dim(`  \u{1F4E6} Cached dirs preserved: node_modules=${pe.existsSync(we.join(d,"node_modules"))?"\u2705":"\u274C"}, Pods=${pe.existsSync(we.join(d,"ios","Pods"))?"\u2705":"\u274C"}`)),t.stop()}catch(l){t.stop(`Failed to prepare isolated workspace: ${l.message}`),n&&await s(`Setup Error: ${l.message}`),process.exit(1)}}try{let l=e.repo;if(!l)try{l=Ln("git config --get remote.origin.url").toString().trim()}catch{O.warn("Could not detect git repository URL.")}!l&&e.dryRun,l||(l="https://github.com/placeholder/repo.git"),O.info(`Build ID: ${N.cyan(i)}`);let a={},c={},d=Te(`./${f.configFileName}`);if(d){n=d.projectId;let $=e.buildProfile||"production",I=Ge(d,$);!I&&e.buildProfile&&(O.error(`Build profile '${$}' not found in ${f.configFileName}`),process.exit(1));let w=I||{};process.env.MACH_DEBUG&&O.info(N.dim(`Build profile: ${$} | Platform: ${e.platform} | Distribution: ${w.distribution||"store"} | Environment: ${w.environment||$}`)),w.env&&(c=w.env,O.info(N.blue(`Use Build Profile: ${$}`)));let b=e.platform,L=w[b]||{},D=["developmentClient","simulator","distribution","buildCommand","apk","iosScheme","preBuild","postBuild","scheme","environment","androidPackage","iosBundleIdentifier","name","iosDeploymentTarget","iosApiKeyId","iosApiKeyIssuer","iosApiKeyPath","iosTeamId","iosConfiguration","iosExportMethod","branch","repo","instanceType","ami","bucket","region","nodeVersion"];e.name=d.name,e.appName=d.name,e.androidPackage=d.android?.package,e.iosBundleIdentifier=d.ios?.bundleIdentifier,e.iosScheme=d.ios?.iosScheme,!e.nodeVersion&&d.nodeVersion&&(e.nodeVersion=d.nodeVersion);let _=k=>k==="androidPackage"?L.androidPackage??L.package??w.androidPackage??w.android?.package:k==="iosBundleIdentifier"?L.iosBundleIdentifier??L.bundleIdentifier??w.iosBundleIdentifier??w.ios?.bundleIdentifier:L[k]!==void 0?L[k]:w[k];for(let k of D){let G=_(k),V=k==="androidPackage"||k==="iosBundleIdentifier";G!==void 0&&(e[k]===void 0||V)&&(e[k]=G)}e.branch=e.branch||"main",e.iosConfiguration=e.iosConfiguration||(e.developmentClient||e.simulator?"Debug":"Release"),e.sshUser=e.sshUser||process.env.USER||"ubuntu",e.simulator===void 0&&(e.simulator=!1),e.local===void 0&&(e.local=!1),e.verbose===void 0&&(e.verbose=!1);let M=k=>{if(!k)return k;if(k.startsWith("scripts.")){let G=k.split(".")[1],V=d.scripts?.[G];if(V)return V;O.warn(`Script reference not found: ${k}`)}return k};e.buildCommand=M(e.buildCommand),e.preBuild=M(e.preBuild),e.postBuild=M(e.postBuild),!e.scheme&&d.scheme&&(e.scheme=d.scheme);let P={...nt(d,f.envPrefix),...nt(w,`${f.envPrefix}PROFILE_`)};a={...a,...c,...P},process.env.IOS_P12_PASSWORD&&!a.IOS_P12_PASSWORD&&(a.IOS_P12_PASSWORD=process.env.IOS_P12_PASSWORD),process.env.MATCH_PASSWORD&&!a.MATCH_PASSWORD&&(a.MATCH_PASSWORD=process.env.MATCH_PASSWORD),e.platform==="ios"&&(!e.iosTeamId&&w.ios?.appleTeamId&&(e.iosTeamId=w.ios.appleTeamId),!e.iosTeamId&&d.submit?.[$]?.ios?.appleTeamId&&(e.iosTeamId=d.submit[$].ios.appleTeamId),!e.iosTeamId&&d.submit?.production?.ios?.appleTeamId&&(O.warn(N.yellow(`Check: Using 'production' Team ID for '${$}' build.`)),e.iosTeamId=d.submit.production.ios.appleTeamId),e.iosTeamId?O.info(N.magenta(`\u2713 Injected iOS Team ID from config: ${e.iosTeamId}`)):O.warn(N.yellow("\u26A0\uFE0F No iOS Team ID found. Signing might fail if not managed automatically via Expo.")))}let u="unknown";try{u=Ln("git rev-parse --abbrev-ref HEAD").toString().trim()}catch{O.warn("Failed to detect git branch.")}let p="1.0.0";try{pe.existsSync("./package.json")&&(p=JSON.parse(pe.readFileSync("./package.json","utf-8")).version||"1.0.0")}catch{}let m=e.buildProfile||"production",E="Internal";e.developmentClient?E="DevelopmentClient":m.toLowerCase().includes("store")||m.toLowerCase()==="production"?E="Store":m.toLowerCase().includes("preview")||m.toLowerCase().includes("staging")?E="Staging":(m.toLowerCase().includes("development")||m.toLowerCase().includes("dev"))&&(E="Development");let U=e.platform==="ios"?"iOS":"Android",R=e.platform==="ios"&&e.simulator?" (Simulator)":"",F=`${U}${R} v${p} (${E})`;if(Vt(e,{status:"created",projectId:n,buildId:i,platform:e.platform,profile:m,branch:u,version:p,buildType:E,developmentClient:!!e.developmentClient,summary:F}),n){try{let $=e.buildProfile||"production",I=e.environment||$;O.info(N.blue(`Fetching managed secrets for profile: ${$} (environment: ${I})...`));let b=(await v.get(`/projects/${n}/secrets/export?env=${I}`)).data;b.status==="success"&&b.secrets&&(a={...a,...b.secrets},Object.keys(b.secrets).length>0&&O.info(N.magenta(`\u2713 Injected ${Object.keys(b.secrets).length} secrets from Dashboard.`)))}catch($){O.warn(`Failed to load managed secrets from Dashboard: ${$.message}`)}try{O.info(N.blue("Fetching managed credentials..."));let $="development";e.distribution==="store"?$="store":e.distribution==="internal"&&($=e.platform==="ios"?"adhoc":"internal"),e.developmentClient&&($="development");let I=await v.get("/credentials/resolve",{params:{projectId:n,platform:e.platform,bundleId:e.iosBundleIdentifier||e.androidPackage,distributionType:$}});if(I.data.status==="success"&&I.data.credentials){let w=I.data.credentials;O.info(N.magenta(`\u2713 Found ${w.length} relevant credentials.`));let b=w.filter(P=>{if(P.distributionType){let k=$==="internal"?"adhoc":$;return P.distributionType===k||P.distributionType===$}return!0});O.info(N.dim(`  Filtered to ${b.length} credentials for distributionType: ${$}`));let L=!1,D=!1,_=!1,M=[];for(let P of b)if(!(P.type==="ios_cert"&&L||P.type==="ios_profile"&&D||P.type==="android_keystore"&&_)&&["ios_cert","ios_profile","android_keystore"].includes(P.type)&&(P.downloadUrl||Gt(P)))try{let G=await Gn(P,n);if(P.type==="ios_cert"&&!L)a.IOS_DIST_P12=G,P.password?(a.IOS_P12_PASSWORD=P.password,O.info(N.dim(`  - Injected ${P.name} as IOS_DIST_P12 with password from credential record`))):O.info(N.dim(`  - Injected ${P.name} as IOS_DIST_P12`)),L=!0;else if(P.type==="ios_profile"&&!D)a.IOS_PROVISIONING_PROFILE=G,O.info(N.dim(`  - Injected ${P.name} as IOS_PROVISIONING_PROFILE`)),D=!0;else if(P.type==="android_keystore"&&!_){a.ANDROID_KEYSTORE_BASE64=G;let V=P.keystorePassword||P.password,ce=P.keyPassword||P.keystorePassword||P.password,K=P.alias||P.meta?.alias;if(V)a.ANDROID_STORE_PASSWORD=V,O.info(N.dim("  - Injected keystore password from credential record"));else{let H=["ANDROID_STORE_PASSWORD",...[$==="store"?"PRODUCTION":$==="internal"?"STAGING":"DEVELOPMENT",$.toUpperCase(),"PRODUCTION","STORE","INTERNAL","STAGING","RELEASE","DEBUG"].map(x=>`KEYSTORE_PASSWORD_${x}`),"KEYSTORE_PASSWORD"].find(x=>!!a[x]);H&&a[H]&&(a.ANDROID_STORE_PASSWORD=a[H])}if(ce?(a.ANDROID_KEY_PASSWORD=ce,O.info(N.dim("  - Injected key password from credential record"))):a.ANDROID_KEY_PASSWORD=a.ANDROID_STORE_PASSWORD||"",K)a.ANDROID_KEY_ALIAS=K;else{let ae=["ANDROID_KEY_ALIAS","KEYSTORE_ALIAS"].find(ne=>!!a[ne]);ae&&(a.ANDROID_KEY_ALIAS=a[ae])}O.info(N.dim(`  - Injected ${P.name} as ANDROID_KEYSTORE_BASE64`)),_=!0}}catch(G){M.push(`${P.name||P.type}: ${G.message}`)}if(M.length>0)throw new Error(`Credential download failed after ${jt} attempts:
+${M.map(P=>`- ${P}`).join(`
+`)}`)}if(e.platform==="ios"&&!e.simulator){let w=e.buildProfile||"production",b=Ge(d,w)||{},L=us(d,b),D=fs(L),_=e.distribution==="store",M=L===void 0&&_,P=e.autoVersion||D&&_||M,k=e.autoVersion||D&&_;if(D&&!_&&O.info(N.dim(`  Skipping App Store Connect buildNumber lookup for ${e.distribution||"non-store"} build. Pass --auto-version to force it.`)),P){let G=e.iosBundleIdentifier||d.ios?.bundleIdentifier||d.expo?.ios?.bundleIdentifier,V=ps(d,b,w),ce=I.data.credentials||[],K=Fn(ce,G);if(!K&&(k||M)){let ae=await v.get(`/credentials/${n}`);K=Fn(ae.data.credentials||[],G)}if(K){t.start("Resolving latest iOS buildNumber from App Store Connect...");try{let ae=K.keyId||K.meta?.keyId,ne=K.issuerId||K.meta?.issuerId;if(!ae||!ne)throw new Error("App Store Connect credential is missing keyId or issuerId.");let H=await cs(K,n),x=await En({keyId:ae,issuerId:ne,privateKey:H,ascAppId:V,bundleId:G}),J=/^\d+$/.test(x.latestBuildNumber);J?(a.BUILD_NUMBER=x.latestBuildNumber,delete a.MACH_IOS_BUILD_NUMBER_LOCKED):(a.BUILD_NUMBER=x.nextBuildNumber,a.CURRENT_PROJECT_VERSION=x.nextBuildNumber,a.MACH_IOS_BUILD_NUMBER_LOCKED="1"),t.stop(J?`\u2713 Latest iOS buildNumber on App Store Connect: ${N.green(x.latestBuildNumber)} (Mach will assign >= ${x.nextBuildNumber})`:`\u2713 Resolved iOS buildNumber: ${N.green(x.nextBuildNumber)} (Latest on App Store Connect: ${x.latestBuildNumber})`)}catch(ae){t.stop("iOS buildNumber lookup failed");let ne=ae.response?.data?.error?.message||ae.message;if(k)throw new Error(`Auto-versioning failed: ${ne}. Fix App Store Connect API key permissions or remove ios.buildNumber="auto".`);O.warn(N.yellow(`Could not check App Store Connect buildNumber: ${ne}. Falling back to Mach counter.`))}}else if(k)throw new Error(`Auto-versioning failed: App Store Connect API key not found. Upload it with '${f.nameLower} credentials:service --platform ios'.`)}}if(e.platform==="android"){let w=e.buildProfile||"production",b=Ge(d,w)||{},_=((b.android||{}).versionCode??b.androidVersionCode??d.android?.versionCode??d.expo?.android?.versionCode)==="auto",M=e.autoVersion||_&&e.distribution==="store";if(_&&!M&&O.info(N.dim(`  Skipping Google Play versionCode lookup for ${e.distribution||"non-store"} build. Pass --auto-version to force it.`)),M){t.start("Resolving latest versionCode from Google Play...");try{let P=e.androidPackage||d.android?.package||d.expo?.android?.package||d.name,k=(I.data.credentials||[]).find(ne=>ne.type==="google_service_account"&&(!ne.bundleId||ne.bundleId===P));if(!k){let H=((await v.get(`/credentials/${n}`)).data.credentials||[]).filter(x=>x.type==="google_service_account");if(k=H.find(x=>x.type==="google_service_account"&&x.bundleId===P),!k&&H.length>0){let x=H.map(J=>J.bundleId).filter(Boolean).join(", ");throw new Error(`Google Service Account not found for package ${P}. Found service credential(s) for: ${x}.`)}}if(!k)throw new Error(`Google Service Account not found for package ${P}. Upload it under this package in Dashboard or run '${f.nameLower} credentials:service --platform android --package-name ${P}'.`);let G=await v.get(`/credentials/${k.credentialId}/download`,{params:{projectId:n}});if(G.data.status!=="success"||!G.data.downloadUrl)throw new Error("Failed to get secure download URL for service account");let ce=(await St.get(G.data.downloadUrl,{headers:{Connection:"close"}})).data,K=await fn(P,ce);if(K==null)throw new Error("Could not retrieve any version information from Google Play.");let ae=K+1;a.ANDROID_VERSION_CODE=ae.toString(),t.stop(`\u2713 Resolved versionCode: ${N.green(ae)} (Latest on Play Store: ${K})`)}catch(P){t.stop("Version resolution failed");let k=P.response?.data?.error?.message||P.message;throw new Error(`Auto-versioning failed: ${k}. Fix Google Play service account permissions or remove android.versionCode="auto".`)}}}if(e.platform==="ios"&&!e.simulator){let w=!!a.IOS_DIST_P12,b=!!a.IOS_PROVISIONING_PROFILE;if(!w||!b){let L=[...w?[]:["Distribution Certificate"],...b?[]:["Provisioning Profile"]].join(" and ");O.error(N.red(`Missing iOS credentials: ${L}`)),e.quiet&&process.exit(1);let D=e.yes||await kn({message:"Would you like to generate these credentials now?",initialValue:!0});if(D&&!xn(D))return await mt({platform:"ios",profile:m}),e.quiet||O.info(N.green("\u2713 Credentials setup complete! Restarting build phase...")),Kt(e);e.quiet||O.info(N.yellow(`Run \`${f.nameLower} credentials\` to set up signing credentials manually.`)),process.exit(1)}}if(e.platform==="android"&&!e.developmentClient&&(e.distribution==="internal"||e.distribution==="store")&&!(!!a.ANDROID_KEYSTORE_BASE64||!!a.ANDROID_KEYSTORE)){O.error(N.red("Missing Android credentials: Signing Keystore")),e.quiet&&process.exit(1);let b=e.yes||await kn({message:"Would you like to automatically create and upload an Android Keystore for this profile now?",initialValue:!0});if(b&&!xn(b))return await mt({platform:"android",profile:m}),e.quiet||O.info(N.green("\u2713 Android Keystore setup complete! Restarting build phase...")),Kt(e);e.quiet||O.info(N.yellow(`Run \`${f.nameLower} credentials --platform android\` to set up a signing keystore manually.`)),process.exit(1)}}catch($){(String($.message||"").startsWith("Credential download failed")||String($.message||"").startsWith("Auto-versioning failed"))&&(O.error(N.red($.message)),process.exit(1)),O.warn(`Failed to resolve credentials: ${$.message}`)}}let T=!!(e.local&&e.buildId),B=!!(e.local||e.sshHost),h=!B&&!T;if(T){O.info(N.magenta("\u{1F3D7}\uFE0F Runner Mode: Executing isolated build task..."));let $=await yi({...e,interactive:!1},i,a,n,{branch:u,version:p,summary:F,buildType:E});await j($),process.exit(0)}async function j($){let I=async w=>{if(n)try{await Ht("Report failed build status",()=>v.patch(`/builds/${n}/${i}`,{status:"failed",error:w,endTime:Date.now()}),3)}catch(b){O.warn(N.yellow(`Could not report failed build status: ${b.message}`))}};if(n&&$.length>0){let w=bi(),b=[];e.quiet||w.start("Uploading artifacts to Dashboard...");try{for(let L of $){let D=we.basename(L),_=pe.readFileSync(L),M=we.extname(D).toLowerCase(),P="application/octet-stream",k=await Ht(`Create artifact upload URL for ${D}`,()=>v.post(`/builds/${n}/${i}/artifact-upload-url`,{fileName:D,fileType:P}));if(k.data.status!=="success")throw new Error(`Failed to get upload URL for ${D}`);await Ht(`Upload artifact ${D}`,()=>St.put(k.data.uploadUrl,_,{headers:{"Content-Type":P,Connection:"close"},maxBodyLength:1/0,maxContentLength:1/0,timeout:3e5})),b.push({name:D,url:k.data.downloadUrl,size:_.length,type:M.substring(1)})}e.quiet||w.stop("Artifacts uploaded.")}catch(L){e.quiet||w.stop("Failed to upload artifacts.");let D=`Artifact upload failed: ${L.message}`;throw O.error(N.red(D)),await I(D),new Error(D)}if(n&&b.length>0)try{O.info(N.cyan(`
+\u{1F517} Download Links:`));for(let L of b)O.info(N.dim(`  - ${L.name}: `)+N.blue.underline(L.url));await Ht("Finalize build in dashboard",()=>v.patch(`/builds/${n}/${i}`,{status:"success",artifacts:b,endTime:Date.now()})),Vt(e,{status:"success",projectId:n,buildId:i,platform:e.platform,profile:m,branch:u,version:p,buildType:E,developmentClient:!!e.developmentClient,summary:F,artifacts:b}),O.success(N.green(`
+\u2713 Build completed and reported to dashboard.`)),e.maestro&&!T&&await Bn(n,i,e,m)}catch(L){let D=`Build artifact uploaded but dashboard finalization failed: ${L.message}`;throw O.error(N.red(`
+${D}`)),await I(D),new Error(D)}}else if(n){let w="Build completed but produced no uploadable artifacts.";throw O.error(N.red(w)),await I(w),new Error(w)}}if(B){if(O.info(N.cyan(`\u{1F680} Direct Build Mode: Executing on ${e.sshHost||"local"}...`)),n&&!o){let $=process.argv.slice(3).join(" ");await v.post("/builds",{projectId:n,buildId:i,platform:e.platform,status:"building",branch:u,version:p,summary:F,startTime:r,buildType:E,buildProfile:m,buildArgs:$,simulator:!!e.simulator,developmentClient:!!e.developmentClient})}if(e.sshHost&&e.platform==="ios"){let $=await un(e,i,a,n)}else{let $=await yi({...e,interactive:!!e.local},i,a,n,{branch:u,version:p,summary:F,buildType:E});await j($)}return}if(h&&(O.info(N.blue("\u{1F6F0}\uFE0F Cloud Initiator Mode: Preparing orchestration...")),!e.dryRun)){e.quiet||t.start("Zipping and uploading local source...");let $=await v.post("/builds/source-upload-url",{projectId:n,buildId:i});if($.data.status!=="success")throw t.stop("Failed to get upload URL."),new Error("Failed to get source upload URL from API");let I=new Un,w=pe.readdirSync("."),b=["node_modules",".git","dist","build","builds",".gradle",".idea","android/build","ios/build","ios/Pods",`.${f.nameLower}_cli`];for(let _ of w){if(b.includes(_))continue;pe.statSync(_).isDirectory()?I.addLocalFolder(_,_):I.addLocalFile(_)}let L=I.toBuffer();e.quiet||t.message(`Uploading source (${(L.length/1024/1024).toFixed(1)} MB)...`);let D=!1;for(let _=1;_<=3;_++)try{await St.put($.data.uploadUrl,L,{headers:{"Content-Type":"application/zip"},maxBodyLength:1/0,maxContentLength:1/0,timeout:12e4}),D=!0;break}catch(M){if(_<3)t.message(`Upload attempt ${_} failed (${M.code||M.message}), retrying...`),await new Promise(P=>setTimeout(P,2e3*_));else throw M}if(e.quiet||t.stop("Source uploaded"),n){let _=process.argv.slice(3).join(" ");await v.post("/builds",{projectId:n,buildId:i,platform:e.platform,status:"pending",branch:u,version:p,summary:F,startTime:r,buildType:E,buildProfile:m,buildArgs:_,simulator:!!e.simulator,developmentClient:!!e.developmentClient}),O.info(N.green("\u2713 Cloud build registered."))}e.platform==="android"&&await ln(e,i,a,n,e.preBuild),e.quiet||O.info(N.cyan("\u{1F4E1} Connecting to build stream...")),await ms(n,i,e),e.maestro&&await Bn(n,i,e,m);return}}catch(l){let a=l.message||"Build failed";l.response?.data?.message?a=l.response.data.message:l.message.includes("status code 402")?a="Insufficient wallet balance. Please add credits in the Dashboard.":l.message.includes("status code 403")&&(a="Monthly build quota exceeded. Upgrade your plan in the Dashboard."),n&&!e.local&&await s(a),O.error(N.red(`\u2717 Build failed: ${a}`)),process.exit(1)}};async function Bn(e,t,i,n){O.info(N.cyan(`
+\u{1F3BC} Queuing managed Maestro test...`)),await Ei({projectId:e,buildId:t,platform:i.platform,profile:n,maestroFlows:i.maestroFlows,maestroDevice:i.maestroDevice,maestroRetries:i.maestroRetries,maestroRecord:i.maestroRecord,quiet:i.quiet})}function Hn(e){return`${je}/build/${e}`}function Vt(e,t){if(!e.jsonOutput)return;let i=we.resolve(e.jsonOutput),n={...t,url:t.url||Hn(t.buildId),dashboardUrl:t.dashboardUrl||Hn(t.buildId),updatedAt:new Date().toISOString()};try{let r=we.dirname(i);r&&r!=="."&&pe.mkdirSync(r,{recursive:!0}),pe.writeFileSync(i,JSON.stringify(n,null,2))}catch(r){O.warn(N.yellow(`Could not write build metadata JSON: ${r.message}`))}}async function ms(e,t,i){let n=bi(),r="pending",o=0,s=0;for(i.quiet||n.start("Connecting to build stream...");;){try{let a=(await v.get(`/builds/${e}/${t}`)).data.build;if(a){if(r=a.status,r==="building")i.quiet||n.message("Build in progress...");else if(r==="failed")i.quiet||n.stop("Build failed."),Vt(i,{status:"failed",projectId:e,buildId:t,platform:i.platform,profile:a.buildProfile,buildType:a.buildType,developmentClient:!!a.developmentClient,version:a.version,summary:a.summary,error:a.error||"Unknown error",artifacts:a.artifacts||[]}),O.error(N.red(`
+\u2717 Build failed: ${a.error||"Unknown error"}`)),process.exit(1);else if(r==="completed"||r==="success"){i.quiet||n.stop("Build successful!"),Vt(i,{status:r,projectId:e,buildId:t,platform:i.platform,profile:a.buildProfile,buildType:a.buildType,developmentClient:!!a.developmentClient,version:a.version,summary:a.summary,artifacts:a.artifacts||[]}),O.success(N.green(`
+\u2713 Build completed successfully!`));try{i.quiet||(O.info(N.magenta(`
+\u{1F4F1} Installation Hub:`)),O.info(N.dim("  - View & Install Build: ")+N.white.underline(`${je}/build/${t}`)))}catch{}return}else if(r!=="pending"){i.quiet||n.stop(`Build status: ${r}`);return}}try{let d=(await v.get(`/builds/${e}/${t}/logs`)).data;if(d&&typeof d=="string"&&!i.quiet){let u=d.split(`
+`);if(u.length>o){for(let p=o;p<u.length;p++)u[p].trim()&&console.log(N.dim(`  ${u[p]}`));o=u.length}}}catch{}s=0}catch{s++,s>10&&(n.stop("Connection lost."),O.error(N.red(`
+\u2717 Lost connection to Dashboard API.`)),process.exit(1))}await new Promise(l=>setTimeout(l,3e3))}}import gs from"http";import{execSync as Re,spawn as Kn}from"child_process";import Ai from"chalk";import{log as at}from"@clack/prompts";import hs from"axios";import _i from"fs";import ys from"os";import Ii from"path";var Et=7070;function Ss(){let e=[];try{let t=Re("adb devices -l",{stdio:"pipe"}).toString(),i=new Set;t.split(`
+`).forEach(n=>{if(n.includes("List of devices")||!n.trim())return;let r=n.split(/\s+/);if(r.length<2||r[1]!=="device")return;let o=r[0];i.add(o);let s=n.match(/model:([^\s]+)/);e.push({id:o,platform:"android",type:o.startsWith("emulator-")?"emulator":"physical",name:s?s[1].replace(/_/g," "):o,status:"online",details:n.trim()})})}catch{}try{let t=`${process.env.ANDROID_HOME||`${process.env.HOME}/Library/Android/sdk`}/emulator/emulator`,n=Re(`${t} -list-avds`,{stdio:"pipe"}).toString().split(`
+`).filter(o=>!!o.trim()),r=e.some(o=>o.platform==="android"&&o.id.startsWith("emulator-"));n.forEach(o=>{r||e.push({id:o,platform:"android",type:"emulator",name:o.replace(/_/g," "),status:"offline",details:`Android Virtual Device: ${o}`})})}catch{}if(process.platform!=="darwin")return e;try{let t=Re("/usr/bin/xcrun simctl list devices --json",{stdio:"pipe"}).toString(),i=JSON.parse(t);Object.entries(i.devices).forEach(([n,r])=>{r.forEach(o=>{o.isAvailable&&e.push({id:o.udid,platform:"ios",type:"simulator",name:o.name,status:o.state?.toLowerCase()==="booted"?"online":"offline",runtime:n,details:`${o.name} (${n})`})})})}catch{}try{let t=Re("/usr/bin/xcrun devicectl list devices --json-output -",{stdio:"pipe"}).toString();(JSON.parse(t).result?.devices||[]).forEach(n=>{let r=n.connectionProperties?.transportType;(r==="wired"||r==="localNetwork")&&e.push({id:n.identifier,platform:"ios",type:"physical",name:n.deviceProperties?.name||"iPhone",status:"online",details:`${n.deviceProperties?.name||"iPhone"} (${n.model?.name||n.hardwareModel||""}) - ${r}`})})}catch{}return e}async function Vn(e){let t=[];for await(let i of e)t.push(Buffer.isBuffer(i)?i:Buffer.from(i));return t.length===0?{}:JSON.parse(Buffer.concat(t).toString("utf-8"))}async function Es(e,t){let i=await hs({method:"GET",url:e,responseType:"stream",timeout:12e4}),n=_i.createWriteStream(t);i.data.pipe(n),await new Promise((r,o)=>{n.on("finish",r),n.on("error",o)})}async function bs(e,t,i){let n=i||(t.toLowerCase().includes(".apk")?"android":"ios"),r=t.toLowerCase().includes(".ipa"),o=_i.mkdtempSync(Ii.join(ys.tmpdir(),`${Et}-install-`)),s=Ii.join(o,n==="android"?"install.apk":r?"install.ipa":"install.zip");try{if(await Es(t,s),n==="android"){Re(`adb -s ${JSON.stringify(e)} install -r ${JSON.stringify(s)}`,{stdio:"pipe"});return}if(process.platform!=="darwin")throw new Error("iOS local install requires macOS.");Re(`unzip -o ${JSON.stringify(s)} -d ${JSON.stringify(o)}`,{stdio:"pipe"});let l="";try{l=Re(`find ${JSON.stringify(Ii.join(o,"Payload"))} -maxdepth 1 -name "*.app" 2>/dev/null | head -n 1`,{stdio:"pipe"}).toString().trim()}catch{}if(l||(l=Re(`find ${JSON.stringify(o)} -name "*.app" -type d | head -n 1`,{stdio:"pipe"}).toString().trim()),!l)throw new Error(`No .app bundle found inside the ${r?"IPA":"archive"}.`);try{Re(`/usr/bin/xcrun devicectl device install app --device ${JSON.stringify(e)} ${JSON.stringify(l)}`,{stdio:"pipe"})}catch(a){try{Re(`/usr/bin/xcrun simctl install ${JSON.stringify(e)} ${JSON.stringify(l)}`,{stdio:"pipe"})}catch{throw new Error(a.stderr?.toString().trim()||a.message||"iOS install failed.")}}}finally{_i.rmSync(o,{recursive:!0,force:!0})}}function As(e,t){if(!e)throw new Error("Device id is required.");if(t==="ios"){if(process.platform!=="darwin")throw new Error("iOS Simulator launch requires macOS.");return Re(`/usr/bin/xcrun simctl boot ${JSON.stringify(e)}`,{stdio:"pipe"}),Kn("open",["-a","Simulator"],{detached:!0,stdio:"ignore"}).unref(),"Simulator booting..."}if(t==="android"){let i=`${process.env.ANDROID_HOME||`${process.env.HOME}/Library/Android/sdk`}/emulator/emulator`;return Kn(i,["-avd",e],{detached:!0,stdio:"ignore"}).unref(),"Emulator booting in background..."}throw new Error("Invalid platform.")}async function zn(){process.platform!=="darwin"&&at.warn("Running on non-macOS \u2014 iOS discovery unavailable, Android only.");let e=gs.createServer((n,r)=>{if(r.setHeader("Access-Control-Allow-Origin","*"),r.setHeader("Access-Control-Allow-Methods","GET, POST, OPTIONS"),r.setHeader("Access-Control-Allow-Headers","Content-Type, Authorization"),n.method==="OPTIONS"){r.writeHead(204),r.end();return}let o=new URL(n.url||"/",`http://localhost:${Et}`);if(n.method==="GET"&&o.pathname==="/local/devices"){try{let s=Ss();r.writeHead(200,{"Content-Type":"application/json"}),r.end(JSON.stringify({status:"success",targets:s}))}catch(s){r.writeHead(500,{"Content-Type":"application/json"}),r.end(JSON.stringify({status:"error",message:s.message}))}return}if(n.method==="POST"&&o.pathname==="/install-local"){t(n,r);return}if(n.method==="POST"&&o.pathname==="/local/boot"){i(n,r);return}r.writeHead(404),r.end()}),t=async(n,r)=>{try{let{deviceId:o,artifactUrl:s,platform:l}=await Vn(n);if(!o||!s){r.writeHead(400,{"Content-Type":"application/json"}),r.end(JSON.stringify({status:"error",message:"deviceId and artifactUrl are required"}));return}await bs(o,s,l),r.writeHead(200,{"Content-Type":"application/json"}),r.end(JSON.stringify({status:"success",message:`Installed on ${o}`}))}catch(o){r.writeHead(500,{"Content-Type":"application/json"}),r.end(JSON.stringify({status:"error",message:o.message||"Local install failed"}))}},i=async(n,r)=>{try{let{id:o,platform:s}=await Vn(n),l=As(o,s);r.writeHead(200,{"Content-Type":"application/json"}),r.end(JSON.stringify({status:"success",message:l}))}catch(o){r.writeHead(500,{"Content-Type":"application/json"}),r.end(JSON.stringify({status:"error",message:o.message||"Local device launch failed"}))}};e.listen(Et,"127.0.0.1",()=>{at.success(Ai.green(`Local device agent running on http://localhost:${Et}`)),at.info(Ai.dim("Keep this running while using the Install Hub on the dashboard.")),at.info(Ai.dim("Press Ctrl+C to stop."))}),e.on("error",n=>{n.code==="EADDRINUSE"?at.error(`Port ${Et} is already in use \u2014 agent may already be running.`):at.error(`Agent error: ${n.message}`),process.exit(1)}),await new Promise(()=>{})}import{createRequire as kl}from"module";import{text as _s,password as Ps,spinner as $s,isCancel as Jn}from"@clack/prompts";import Ri from"chalk";import bt from"fs";import Wn from"path";import Is from"os";var Pi=Wn.join(Is.homedir(),f.configDir),$i=Wn.join(Pi,"config.json");function wi(){if(!bt.existsSync($i))return{};try{return JSON.parse(bt.readFileSync($i,"utf-8"))}catch{return{}}}function Yn(e){bt.existsSync(Pi)||bt.mkdirSync(Pi,{recursive:!0});let i={...wi(),...e};bt.writeFileSync($i,JSON.stringify(i,null,2))}async function Xn(){let e=wi(),t=await _s({message:"Enter your email:",placeholder:"user@example.com",initialValue:e.lastLoginEmail,validate(r){if(r.length===0)return"Email is required!"}});if(Jn(t))return;let i=await Ps({message:"Enter your password:",validate(r){if(r.length===0)return"Password is required!"}});if(Jn(i))return;let n=$s();n.start("Authenticating...");try{let o=await(await fetch(`${xt}/login`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({username:t,password:i})})).json();o.status==="success"&&o.user.token?(Ki({id:o.user.id,email:t,token:o.user.token,refreshToken:o.user.refreshToken}),Yn({lastLoginEmail:t}),n.stop(Ri.green("Login successful!"))):n.stop(Ri.red("Login failed: "+(o.message||"Unknown error")))}catch(r){n.stop(Ri.red("Network error: "+r.message))}}import{outro as ws,select as Rs,spinner as Ds,isCancel as vs}from"@clack/prompts";import zt from"chalk";import Di from"fs";import Os from"path";var qn=e=>e==="1234567890"||e==="ABC123DEFG"||e==="XXXXXXXXXX"?"":typeof e=="string"?e:"",Cs=()=>process.versions.node.split(".")[0]||"24";async function Zn(){if(!ye()){console.log(zt.red(`You are not logged in. Run \`${f.nameLower} login\` first.`));return}let t=Ds();t.start("Fetching projects...");try{let{data:i}=await v.get("/projects");if(t.stop("Projects loaded."),i.status!=="success"||!i.projects||i.projects.length===0){console.log(zt.yellow(`No projects found. Run \`${f.nameLower} init\` to create one.`));return}let n=i.projects.map(E=>({value:E.projectId,label:`${E.name} (${E.slug})`})),r=await Rs({message:"Select a project to link:",options:n});if(vs(r))return;let o=Os.join(process.cwd(),f.configFileName),s={};if(Di.existsSync(o))try{s=JSON.parse(Di.readFileSync(o,"utf-8"))}catch{}let l=i.projects.find(E=>E.projectId===r),a=s.android?.package||Fe("android"),c=s.ios?.bundleIdentifier||Fe("ios"),d=s.android||{},u=s.submit?.production?.android||{},p=s.submit?.production?.ios||{},m={projectId:r,name:l?.name,slug:l?.slug,nodeVersion:s.nodeVersion||Cs(),scheme:l?.slug?.toLowerCase()||"app",android:{...d,package:a||"",versionCode:d.versionCode||"auto"},ios:{bundleIdentifier:c||"",buildNumber:s.ios?.buildNumber||"auto"},build:{development:{environment:"development",distribution:"internal"},staging:{environment:"staging",distribution:"internal"},production:{environment:"production",distribution:"store"}},submit:{production:{android:{...u,track:u.track||"internal",releaseStatus:u.releaseStatus||"completed"},ios:{ascAppId:qn(p.ascAppId),appleTeamId:qn(p.appleTeamId)}}}};Di.writeFileSync(o,JSON.stringify(m,null,2)),ws(zt.green(`Linked to project ${m.name} (${m.slug})`))}catch(i){t.stop(zt.red("Error fetching projects: "+i.message))}}import{outro as Ns,text as Wt,select as Ts,spinner as ks,isCancel as At}from"@clack/prompts";import It from"chalk";import xs from"fs";import Ls from"path";import{randomUUID as Us}from"crypto";var Ms=()=>process.versions.node.split(".")[0]||"24";async function Qn(){if(!ye()){console.log(It.red(`You are not logged in. Run \`${f.nameLower} login\` first.`));return}let t=await Wt({message:"Project Name:",placeholder:"My Awesome App",validate(l){if(l.length===0)return"Name is required!"}});if(At(t))return;let i=await Wt({message:"Project Slug (URL friendly):",placeholder:"my-awesome-app",validate(l){if(l.length===0)return"Slug is required!";if(!/^[a-z0-9-]+$/.test(l))return"Slug must be lowercase alphanumeric with dashes."}});if(At(i))return;let n=await Ts({message:"Platform:",options:[{value:"android",label:"Android"},{value:"ios",label:"iOS"},{value:"web",label:"Web"},{value:"all",label:"All Platforms"}]});if(At(n))return;let r="";if(n==="android"||n==="all"){let l=Fe("android");if(r=await Wt({message:"Android Package Name:",initialValue:l||"",placeholder:"com.example.app",validate(a){if(a.length===0)return"Package name is required for Android!"}}),At(r))return}let o="";if(n==="ios"||n==="all"){let l=Fe("ios");if(o=await Wt({message:"iOS Bundle Identifier:",initialValue:l||"",placeholder:"com.example.app",validate(a){if(a.length===0)return"Bundle ID is required for iOS!"}}),At(o))return}let s=ks();s.start("Creating project...");try{let l=Us(),c={projectId:l,name:t,slug:i,storageType:"managed",platforms:n==="all"?["android","ios","web"]:[n]},{data:d}=await v.post("/projects",c);if(d.status==="success"){s.stop(It.green("Project created successfully!"));let u=Ls.join(process.cwd(),f.configFileName);xs.writeFileSync(u,JSON.stringify({projectId:l,name:t,slug:i,nodeVersion:Ms(),...r?{android:{package:r,versionCode:"auto"}}:{},...o?{ios:{bundleIdentifier:o,buildNumber:"auto"}}:{},build:{development:{environment:"development",distribution:"internal"},staging:{environment:"staging",distribution:"internal"},production:{environment:"production",distribution:"store"}},submit:{production:{android:{track:"internal",releaseStatus:"completed"},ios:{ascAppId:"",appleTeamId:""}}}},null,2)),Ns(It.green(`Initialized project ${t} and linked locally!`))}else s.stop(It.red("creation failed: "+d.message))}catch(l){s.stop(It.red("Network error: "+l.message))}}import{spinner as tr,log as be}from"@clack/prompts";import Yt from"chalk";import er from"fs";import Fs from"path";function ir(e,t,i,n){let r=e?.response?.status,o=e?.response?.data?.message||e?.response?.data?.error,s=n?` ${n}`:"";return r===401?`Not logged in or token expired while trying to ${i}${s}. Run \`${f.nameLower} login\` and try again.`:r===403?[`Permission denied while trying to ${i}${s}.`,o?`API says: ${o}.`:void 0,`Current Mach account/token does not have access to project ${t}.`,`Run \`${f.nameLower} login\` with the correct account, or ask a project owner to grant access.`].filter(Boolean).join(" "):r===404?[`Project or environment endpoint was not found while trying to ${i}${s}.`,`Project ID: ${t}.`,o?`API says: ${o}.`:void 0].filter(Boolean).join(" "):r?`Failed to ${i}${s}: ${o||`API returned HTTP ${r}`}`:`Network error while trying to ${i}${s}: ${e?.message||"Unknown error"}`}async function nr(e,t){let i=ye();if(!i){be.error(`You are not logged in. Run \`${f.nameLower} login\` first.`);return}let n=Fs.join(process.cwd(),f.configFileName);if(!er.existsSync(n)){be.error(`No ${f.configFileName} found. Run \`${f.nameLower} init\` or \`${f.nameLower} link\` first.`);return}let r;try{r=JSON.parse(er.readFileSync(n,"utf-8"))}catch{be.error(`Failed to parse ${f.configFileName}`);return}let{projectId:o}=r;if(!o){be.error(`${f.configFileName} is missing projectId.`);return}e==="set"?await Bs(o,t,i):e==="list"?await Hs(o,i):be.error(`Unknown env action: ${e}. Use 'set' or 'list'.`)}async function Bs(e,t,i){if(t.length===0){be.error(`Usage: ${f.nameLower} env set KEY=VALUE [KEY2=VALUE2 ...]`);return}let n=tr();n.start("Setting environment variables...");let r=0,o=0;for(let s of t){let[l,...a]=s.split("="),c=a.join("=");if(!l||c===void 0){be.warn(`Invalid format for argument: ${s}. Expected KEY=VALUE.`),o++;continue}try{let d={key:l.trim(),value:c,type:"env",environment:"global",visibility:"secret"},{data:u}=await v.post(`/projects/${e}/secrets`,d);u.status==="success"?r++:(be.error(`Failed to set ${l}: ${u.message}`),o++)}catch(d){be.error(ir(d,e,"set",l)),o++}}n.stop(`Set ${r} variable(s). ${o>0?`${o} failed.`:""}`)}async function Hs(e,t){let i=tr();i.start("Fetching environment variables...");try{let{data:n}=await v.get(`/projects/${e}/secrets`);if(n.status==="success"){i.stop("Fetched variables.");let r=n.secrets||[];r.length===0?be.info("No environment variables found for this project."):(be.info(Yt.bold("Environment Variables (Global & Scoped):")),r.forEach(o=>{let s=o.visibility==="plain"?o.value:"********";console.log(`  ${Yt.cyan(o.key)} = ${s}  ${Yt.gray(`[${o.environment}]`)}`)}))}else i.stop(Yt.red(`Failed to fetch variables: ${n.message}`))}catch(n){i.stop("Failed to fetch variables."),be.error(ir(n,e,"list"))}}import{spinner as ze,text as _t,select as Ni,isCancel as Ve,cancel as Ti,log as or}from"@clack/prompts";import te from"chalk";import X from"fs";import fe from"path";import{spawn as js,spawnSync as Qe}from"child_process";import sr from"axios";import tt from"os";import Li from"crypto";var Gs=5e3,Ks=12,Vs={completed:"completed",draft:"draft",halted:"halted",inprogress:"inProgress","in-progress":"inProgress"},zs=e=>e?.type==="google_service_account",Jt=e=>e?.bundleId||e?.packageName||e?.meta?.packageName||e?.meta?.bundleId;async function ar(e){let t=ze(),i=ye(),n=Ws(e);if(!n){process.exitCode=1;return}let r=e.projectId||n.projectId,o=e.profile||e.buildProfile||"production";if(!r){Z(`${f.configFileName} is missing projectId. Pass --project-id in runner mode.`),process.exitCode=1;return}n.projectId=r,re(te.dim(`Submit for project: ${n.name||r} | Profile: ${o}`));let s=e.platform;if(!s){let _=await Ni({message:"Select platform to submit:",options:[{value:"ios",label:"iOS (App Store Connect / TestFlight)"},{value:"android",label:"Android (Google Play Console)"}]});if(Ve(_)){Ti("Operation cancelled");return}s=_}if(s=String(s).toLowerCase(),s!=="ios"&&s!=="android"){Z(`Platform ${s} is not supported. Use 'ios' or 'android'.`),process.exitCode=1;return}let l=s==="ios"&&!e.local&&e.sshHost?la(n,o,e):null;if(s==="ios"&&!e.local&&!l){await Ys(n,o,e);return}let a=e.submitId,c=!!(e.local&&a),d=a||null,u=async(_,M={})=>{d&&await Zs(r,d,{status:_,...M})},p=s==="android"?oa(n,o):void 0,m=s==="ios"?aa(n,o):void 0,E,U,R,F=!1;try{s==="android"&&(E=e.track||n.submit?.[o]?.android?.track||n.submit?.production?.android?.track||"internal",U=da(n,o,e.releaseStatus),R=ua(n,o,e.rollout),F=pa(n,o,e.changesNotSentForReview),fa(U,R))}catch(_){Z(_.message),process.exitCode=1;return}if(s==="android"&&!c&&(d=await Js(n,r,s,o,e,{packageName:p,track:E,releaseStatus:U,rollout:R,changesNotSentForReview:F}),!d)){Z("Could not create submission tracking record. Submission was not started."),process.exitCode=1;return}await u("running",{platform:s,profile:o,packageName:p,track:E,releaseStatus:U,rollout:R,startTime:Date.now()});let T=null,B=null;try{B=await ma(r,s,e,i?.token),T=B?.filePath||null}catch(_){await u("failed",{error:`Failed to resolve submission artifact: ${_.message}`,endTime:Date.now()}),Z(`Failed to resolve submission artifact: ${_.message}`),process.exitCode=1;return}if(!T){await u("failed",{error:"No suitable artifact found for submission.",endTime:Date.now()}),process.exitCode=1;return}await u("running",{buildId:B?.buildId,artifactName:B?.artifactName,artifactSource:B?.source}),re(`Using artifact: ${te.green(fe.basename(T))} `),t.start("Fetching submission credentials from Dashboard...");let h;try{let M=(await v.get(`/credentials/${r}`)).data.credentials||[];if(s==="android"&&!p){t.stop("Package name missing"),Z("Could not resolve Android package name. Set android.package in mach.config.json/app.json."),await u("failed",{error:"Could not resolve Android package name.",endTime:Date.now()}),process.exitCode=1;return}let P=M.filter(zs),k=s==="ios"?M.filter(G=>G.type==="asc_api_key"):sa(P,p);if(k.length===0){if(t.stop("Credentials missing"),Z(s==="android"?`No Google Play service credential found for package ${p}.`:`No Service Credentials found for ${s}.`),s==="android"){let G=P.map(Jt).filter(Boolean).join(", ");G&&re(`Found Google Play service credential(s) for: ${G}`),re(`Use '${f.nameLower} credentials:service --platform android --package-name ${p}' or upload it under that package in the Dashboard.`)}else re(`Use '${f.nameLower} credentials:service --platform ${s}' or use the Dashboard to upload them.`);await u("failed",{error:`No submission credentials found for ${s}.`,endTime:Date.now()}),process.exitCode=1;return}if(h=ta(k,e.credentialId),!h&&s==="ios"&&m&&(h=ia(k,m)),h||k.length===1)h=h||k[0],t.stop(`Using: ${h.name}`),s==="android"&&Jt(h)==="*"&&re(te.yellow(`Using legacy wildcard Google Play credential for ${p}. Upload a package-scoped credential when possible.`));else{if(t.stop("Multiple credentials found"),na()){let V=k.map(ce=>`${ce.name||"credential"} (${ce.credentialId||ce.id||"no-id"})`).join(", ");Z(`Multiple ${s==="ios"?"App Store Connect":"Google Play"} credentials found. Use --credential-id in CI. Available: ${V}`),await u("failed",{error:"Multiple submission credentials found; --credential-id is required in CI.",endTime:Date.now()}),process.exitCode=1;return}let G=await Ni({message:`Choose a ${s==="ios"?"App Store Connect":"Google Play"} credential:`,options:k.map(V=>({value:V.credentialId,label:V.name,hint:`${V.keyId?`ID: ${V.keyId}`:""} ${V.issuerId?`(Issuer: ${V.issuerId.substring(0,8)}...)`:""}`}))});if(Ve(G)){Ti("Submission cancelled"),await u("failed",{error:"Submission cancelled while selecting credential.",endTime:Date.now()}),process.exitCode=1;return}h=k.find(V=>V.credentialId===G),re(`Using selected: ${te.green(h.name)}`)}}catch(_){t.stop("Failed to fetch credentials"),Z(`API Error: ${_.message} `),await u("failed",{error:`Failed to fetch credentials: ${_.message}`,endTime:Date.now()}),process.exitCode=1;return}let j=X.mkdtempSync(fe.join(tt.tmpdir(),`${f.nameLower}-submit-`)),$=h.keyId||h.meta?.keyId,I=h.issuerId||h.meta?.issuerId,w=h.type==="asc_api_key"?`AuthKey_${$}.p8`:"service-account.json",b=fe.join(j,w);t.start("Downloading secure key...");try{let _=await v.get(`/credentials/${h.credentialId}/download`,{params:{projectId:r}});if(_.data.status!=="success"||!_.data.downloadUrl)throw new Error("Failed to get secure download URL");let M=await sr.get(_.data.downloadUrl,{responseType:"arraybuffer"});X.writeFileSync(b,Buffer.from(M.data)),t.stop("Key downloaded to secure temp storage")}catch(_){t.stop("Download failed"),Z(`Failed to download key: ${_.message}`);try{X.rmSync(j,{recursive:!0,force:!0})}catch{}await u("failed",{error:`Failed to download credential key: ${_.message}`,endTime:Date.now()}),process.exitCode=1;return}re(te.blue(`Initiating ${s==="ios"?"TestFlight":"Google Play"} submission...`));let L=!1,D;try{if(s==="ios"){if(!$){let M=await _t({message:"Enter App Store Connect Key ID (e.g. 2X948D...):",validate:P=>P.length>0?void 0:"Key ID is required"});if(Ve(M)){await u("failed",{error:"Submission cancelled while entering ASC Key ID.",endTime:Date.now()}),process.exitCode=1;return}$=M}if(!I||I==="undefined"){let M=await _t({message:"Enter App Store Connect Issuer ID (Found on ASC Keys page):",validate:P=>P.length>0?void 0:"Issuer ID is required"});if(Ve(M)){await u("failed",{error:"Submission cancelled while entering ASC Issuer ID.",endTime:Date.now()}),process.exitCode=1;return}I=M}re(`Using ASC Key ID: ${$}`),re(`Using ASC Issuer ID: ${I}`);let _=l?await ha(T,b,I,$,m,l):await ga(T,b,I,$,m);xi(`${s==="ios"?"App Store":"Google Play"} submission successful!`),L=!0}else D=await Aa(T,b,E||"internal",p,U||"completed",R,F,o),xi("Google Play submission successful!"),L=!0}catch(_){Z(`Submission failed: ${_.message}`),await u("failed",{error:_.message,endTime:Date.now()}),lt(e,{status:"failed",projectId:r,submitId:d,platform:s,profile:o,buildId:B?.buildId||e.buildId,artifactName:B?.artifactName,error:_.message,dashboardUrl:d?et(d,r):void 0}),process.exitCode=1}finally{L&&(await u("success",{endTime:Date.now(),versionCode:D?.versionCode,track:E,releaseStatus:U}),lt(e,{status:"success",projectId:r,submitId:d,platform:s,profile:o,buildId:B?.buildId||e.buildId,artifactName:B?.artifactName,versionCode:D?.versionCode,track:E,releaseStatus:U,dashboardUrl:d?et(d,r):void 0})),Ra(j),T&&T.includes(`${f.nameLower}-artifact-`)}}function Ws(e){let t=`./${f.configFileName}`;if(X.existsSync(t))try{return JSON.parse(X.readFileSync(t,"utf-8"))}catch(i){return Z(`Failed to read ${f.configFileName}: ${i.message}`),null}return e.projectId?{projectId:e.projectId}:(Z(`No ${f.configFileName} found. Run \`${f.nameLower} init\` or \`${f.nameLower} link\` first.`),null)}async function Ys(e,t,i){let n=i.projectId||e.projectId;if(!n){Z(`${f.configFileName} is missing projectId.`),process.exitCode=1;return}let r=i.submitId||Li.randomUUID(),o=!!i.latest||!i.buildId,s=Xs({...i,latest:o,profile:t,projectId:n,submitId:r}),l={projectId:n,submitId:r,platform:"ios",profile:t,latest:o,buildId:i.buildId,credentialId:i.credentialId,status:"pending",source:"cli",submitArgs:process.argv.slice(3).join(" "),runnerArgs:s,runnerCommand:[f.nameLower,"submit",...s].map(ra).join(" "),appName:e.name,startTime:Date.now()},a=ze();a.start("Queuing iOS submit on macOS runner...");try{let c=await v.post("/submissions",l),d=c.data?.submission||c.data?.submit||{},u=c.data?.dashboardUrl||et(r,n);a.stop("iOS submit queued"),re(`Submission ID: ${te.cyan(r)}`),re(`Dashboard: ${te.blue.underline(u)}`),lt(i,{status:"pending",projectId:n,submitId:r,platform:"ios",profile:t,latest:o,buildId:i.buildId,dashboardUrl:u}),await qs(n,r,i)}catch(c){a.stop("Could not queue iOS submit"),Z(ea(c)),process.exitCode=1}}async function Js(e,t,i,n,r,o={}){let s=r.submitId||Li.randomUUID(),l=!!r.latest||!r.buildId,a={projectId:t,submitId:s,platform:i,profile:n,latest:l,buildId:r.buildId,credentialId:r.credentialId,status:"running",source:"cli-direct",submitArgs:process.argv.slice(3).join(" "),appName:e.name,startTime:Date.now(),...o};try{let c=await v.post("/submissions",a),d=c.data?.submission||c.data?.submit||{},u=c.data?.dashboardUrl||d.dashboardUrl||et(s,t);return re(`Submission ID: ${te.cyan(s)}`),re(`Dashboard: ${te.blue.underline(u)}`),lt(r,{status:"running",projectId:t,submitId:s,platform:i,profile:n,latest:l,buildId:r.buildId,dashboardUrl:u}),s}catch(c){let d=c.response?.data?.message||c.response?.data?.error||c.message;return re(te.yellow(`Could not create submission tracking record: ${d}`)),null}}function Xs(e){let t=["--local","--submit-id",e.submitId,"--project-id",e.projectId,"--platform","ios","--profile",e.profile||"production"];return e.buildId?t.push("--build-id",e.buildId):t.push("--latest"),e.credentialId&&t.push("--credential-id",e.credentialId),e.quiet&&t.push("--quiet"),e.jsonOutput&&t.push("--json-output",e.jsonOutput),t.filter(i=>i!=null&&i!=="")}async function qs(e,t,i){let n=ze(),r=0,o=0;for(i.quiet||n.start("Waiting for iOS submit runner...");;)try{let s=await v.get(`/submissions/${e}/${t}`),l=s.data?.submission||s.data?.submit||s.data,a=String(l?.status||"pending").toLowerCase();r=0;let c=Array.isArray(l?.logs)?l.logs:[];for(let d=o;d<c.length;d++){let u=c[d];u&&console.log(te.dim(String(u)))}if(o=c.length,["success","completed","succeeded"].includes(a)){i.quiet||n.stop("iOS submit completed"),xi("App Store submission successful!"),lt(i,{status:"success",projectId:e,submitId:t,platform:"ios",profile:l?.profile||i.profile||"production",buildId:l?.buildId||i.buildId,artifactName:l?.artifactName,dashboardUrl:l?.dashboardUrl||et(t,e)});return}if(["failed","error","cancelled","canceled"].includes(a)){i.quiet||n.stop("iOS submit failed");let d=l?.error||l?.message||"Unknown iOS submit failure.";Z(d),lt(i,{status:"failed",projectId:e,submitId:t,platform:"ios",profile:l?.profile||i.profile||"production",buildId:l?.buildId||i.buildId,artifactName:l?.artifactName,error:d,dashboardUrl:l?.dashboardUrl||et(t,e)}),process.exitCode=1;return}i.quiet||n.message(`iOS submit ${a}...`),await ki(Gs)}catch(s){if(r++,r>=Ks){i.quiet||n.stop("Lost connection to iOS submit status"),Z(`Could not fetch iOS submit status after ${r} attempts: ${s.message}`),process.exitCode=1;return}await ki(Math.min(2e3*r,15e3))}}async function Zs(e,t,i){let n;for(let r=1;r<=3;r++)try{await v.patch(`/submissions/${e}/${t}`,i);return}catch(o){if(n=o,r>=3||!Qs(o))break;await ki(1e3*r)}or.warn(te.dim(`Could not report submission status: ${n?.message||n}`))}function Qs(e){let t=e.response?.status;return!t||t===408||t===409||t===425||t===429||t>=500}function ea(e){let t=e.response?.status,i=e.response?.data?.message||e.response?.data?.error;return t===404||t===405?["Managed iOS submit is not enabled on this Mach API yet.","Deploy the API/dashboard submission orchestration endpoint, then retry the same command.","Expected API: POST /submissions and GET/PATCH /submissions/:projectId/:submitId."].join(`
+`):i||e.message||String(e)}function et(e,t){if(!e)return je;let i=t?`?projectId=${encodeURIComponent(t)}`:"";return`${je}/submissions/${e}${i}`}function lt(e,t){if(!e.jsonOutput)return;let i=fe.resolve(e.jsonOutput),n={...t,url:t.url||t.dashboardUrl||et(t.submitId,t.projectId),updatedAt:new Date().toISOString()};try{let r=fe.dirname(i);r&&r!=="."&&X.mkdirSync(r,{recursive:!0}),X.writeFileSync(i,JSON.stringify(n,null,2))}catch(r){or.warn(te.yellow(`Could not write submission metadata JSON: ${r.message}`))}}function ta(e,t){return t&&e.find(i=>i.credentialId===t||i.id===t||i.keyId===t||i.meta?.keyId===t)||null}function ia(e,t){let i=e.filter(n=>[n.bundleId,n.bundleIdentifier,n.appIdentifier,n.meta?.bundleId,n.meta?.bundleIdentifier,n.meta?.appIdentifier].filter(Boolean).map(String).includes(t));return i.length===1?i[0]:null}function na(){return process.env.CI==="true"||process.env.CI==="1"||!process.stdin.isTTY}function ki(e){return new Promise(t=>setTimeout(t,e))}function ra(e){return/^[a-zA-Z0-9_./:=@-]+$/.test(e)?e:`'${e.replace(/'/g,"'\\''")}'`}function oa(e,t){if(e.submit?.[t]?.android?.package)return e.submit[t].android.package;let i=zi(e,t);if(i)return i;let n=fe.join(process.cwd(),"app.json");if(X.existsSync(n))try{return JSON.parse(X.readFileSync(n,"utf-8")).expo?.android?.package}catch{}let r=fe.join(process.cwd(),"app.config.json");if(X.existsSync(r))try{let o=JSON.parse(X.readFileSync(r,"utf-8"));return o.expo?.android?.package||o.android?.package}catch{}}function sa(e,t){let i=e.filter(o=>Jt(o)===t);if(i.length>0)return i;let n=e.filter(o=>{let s=Jt(o);return!s||s==="*"});return e.length>0&&e.length===n.length?n:[]}function aa(e,t){return e.submit?.[t]?.ios?.bundleIdentifier?e.submit[t].ios.bundleIdentifier:e.submit?.[t]?.ios?.bundleId?e.submit[t].ios.bundleId:Wi(e,t)}function la(e,t,i){let n=e.submit?.[t]?.ios||{},r=e.submit?.production?.ios||{},o=i.sshHost||n.sshHost||r.sshHost||process.env.MACH_IOS_SUBMIT_SSH_HOST;return o?{sshHost:o,sshUser:i.sshUser||n.sshUser||r.sshUser||process.env.MACH_IOS_SUBMIT_SSH_USER||process.env.USER||"ubuntu",sshKey:i.sshKey||n.sshKey||r.sshKey||process.env.MACH_IOS_SUBMIT_SSH_KEY}:null}function da(e,t,i){let n=i||e.submit?.[t]?.android?.releaseStatus||e.submit?.production?.android?.releaseStatus||"completed";return ca(n)}function ca(e){let t=Vs[String(e).trim().toLowerCase()];if(!t)throw new Error(`Invalid Android release status "${e}". Use completed, draft, halted, or inProgress.`);return t}function ua(e,t,i){let n=i??e.submit?.[t]?.android?.rollout??e.submit?.[t]?.android?.userFraction??e.submit?.[t]?.android?.rolloutFraction??e.submit?.production?.android?.rollout??e.submit?.production?.android?.userFraction??e.submit?.production?.android?.rolloutFraction;if(n==null||n==="")return;let r=Number(n);if(!Number.isFinite(r)||r<=0||r>=1)throw new Error(`Invalid Android rollout fraction "${n}". Use a number greater than 0 and less than 1, for example 0.1.`);return r}function pa(e,t,i){let n=i??e.submit?.[t]?.android?.changesNotSentForReview??e.submit?.[t]?.android?.changes_not_sent_for_review??e.submit?.production?.android?.changesNotSentForReview??e.submit?.production?.android?.changes_not_sent_for_review??!1;return n===!0||n==="true"||n==="1"}function fa(e,t){if(e==="inProgress"&&t===void 0)throw new Error("Google Play staged rollout requires --rollout <fraction> when --release-status inProgress is used.");if(e!=="inProgress"&&e!=="halted"&&t!==void 0)throw new Error("Android rollout fraction can only be used with --release-status inProgress or halted.")}async function ma(e,t,i,n){let r=i.buildId?"id":i.latest?"latest":null;if(!r){let s=await Ni({message:"Select artifact source:",options:[{value:"latest",label:`Latest Production Build (${f.name})`},{value:"id",label:`Input Build ID (${f.name})`},{value:"url",label:"Remote URL"},{value:"local",label:"Local File Path"}]});if(Ve(s))return Ti("Operation cancelled"),null;r=s}if(r==="local"){let s=await _t({message:"Enter path to artifact (.ipa/.aab):",validate:l=>{if(!X.existsSync(l))return"File not found";if(t==="ios"&&!l.endsWith(".ipa"))return"Must be an .ipa file";if(t==="android"&&!l.endsWith(".aab"))return"Must be an .aab file"}});return Ve(s)?null:{filePath:s,source:"local"}}let o=ze();if(r==="latest"){let s=i.profile||i.buildProfile;o.start(`Fetching latest${s?` ${s}`:""} build...`);try{let l=await v.get(`/builds/${e}`,{params:{limit:50}});if(l.data.status!=="success")throw new Error(l.data.message);let a=l.data.builds||[],c=s?.toLowerCase(),d=h=>h.platform?.toLowerCase()===t.toLowerCase()&&h.status?.toLowerCase()==="success",u=h=>c?[h.buildProfile,h.profile,h.profileName,h.buildType].filter(Boolean).some(j=>String(j).toLowerCase()===c):!0,p=a.filter(h=>d(h)&&u(h)),m=p.find(h=>h.buildType?.toLowerCase()==="store"||h.distribution?.toLowerCase()==="store")||p[0],E=a.some(h=>h.platform?.toLowerCase()===t.toLowerCase()&&h.status?.toLowerCase()==="success");if(!m)return o.stop("No suitable build found"),Z(s&&E?`No successful ${t} builds found for profile "${s}".`:"No successful builds found for this platform."),null;o.stop(`Found build: ${m.buildId}`);let U=m.artifacts||[];if(U.length===0||U.every(h=>!(h.url||h.downloadUrl)))try{let h=await v.get(`/builds/${e}/${m.buildId}/artifacts`);h.data.status==="success"&&h.data.artifacts?.length>0?(U=h.data.artifacts.map(j=>({...j,url:j.url||j.downloadUrl})),console.log(te.cyan(`  [RECOVERY] Fetched ${U.length} artifact(s) with download URLs.`))):console.log(te.yellow("  [RECOVERY] /artifacts endpoint returned 0 artifacts."))}catch(h){console.log(te.red(`  [RECOVERY] /artifacts fetch failed: ${h.message}`))}let F=t==="ios",T=U.find(h=>{let j=(h.type||"").toLowerCase(),$=(h.name||"").toLowerCase();if(console.log(te.dim(`    - Checking: ${h.name} (Type: ${h.type}, HasLink: ${!!(h.url||h.downloadUrl)})`)),j)return j===(F?"ipa":"aab");let I=F?".ipa":".aab",w=(h.url||h.downloadUrl||"").toLowerCase();return $.endsWith(I)||w.includes(I)});if(!T||!(T.url||T.downloadUrl))return Z("Build found but artifact URL is missing."),null;let B=T.url||T.downloadUrl;return{filePath:await vi(B,F?"ios":"android"),buildId:m.buildId,artifactName:T.name,source:"latest"}}catch(l){return o.stop("Fetch failed"),Z(`API Error: ${l.message}`),null}}if(r==="id"){let s=i.buildId||await _t({message:"Enter Build ID:",validate:l=>l.length<5?"Invalid ID":void 0});if(Ve(s))return null;o.start("Fetching build...");try{let l=await v.get(`/build/${s}`);if(l.data.status!=="success")throw new Error(l.data.message);let a=l.data.build;if(!a)throw new Error("Build not found");let c=t==="ios",d=a.artifacts?.find(u=>{if(u.type)return u.type===(c?"ipa":"aab");let p=c?".ipa":".aab";return u.name&&u.name.endsWith(p)||u.url&&u.url.includes(p)});return!d||!d.url?(o.stop("Missing artifact"),Z("Artifact URL not found on build record."),null):(o.stop(`Found build: ${a.buildId}`),{filePath:await vi(d.url,c?"ios":"android"),buildId:a.buildId||String(s),artifactName:d.name,source:"id"})}catch(l){return o.stop("Fetch failed"),Z(l.message),null}}if(r==="url"){let s=await _t({message:"Enter Artifact URL:",validate:l=>l.startsWith("http")?void 0:"Must be a valid URL"});return Ve(s)?null:{filePath:await vi(s,t),source:"url"}}return null}async function vi(e,t,i=3){let n=ze();n.start("Downloading artifact...");let r=X.mkdtempSync(fe.join(tt.tmpdir(),`${f.nameLower}-artifact-`)),o=`app.${t==="ios"?"ipa":"aab"}`,s=fe.join(r,o);for(let l=1;l<=i;l++)try{l>1&&(n.message(`Downloading artifact (Retry ${l}/${i})...`),await new Promise(d=>setTimeout(d,2e3*l)));let a=X.createWriteStream(s),c=await sr({url:e,method:"GET",responseType:"stream",timeout:6e4});return await new Promise((d,u)=>{c.data.pipe(a);let p=!1;c.data.on("error",m=>{p||(p=!0,a.close(),u(m))}),a.on("finish",()=>{p||d()}),a.on("error",m=>{p||(p=!0,u(m))})}),n.stop("Download complete"),s}catch(a){if(l===i)throw n.stop("Download failed"),a}throw new Error("Download failed after retries")}async function ga(e,t,i,n,r){let o=ze();if(r&&re(`Bundle ID: ${te.green(r)}`),!i||!n)throw Z(`Missing credentials: issuerId=${i}, keyId=${n}. Check your Dashboard.`),new Error("Missing ASC API Key Metadata (IssuerID or KeyID)");let s=lr(t,i,n),l=_a();return o.start("Uploading to TestFlight (pilot)..."),new Promise((a,c)=>{let d=js(l.command,["pilot","upload","--ipa",e,"--api_key_path",s,"--skip_submission","true","--skip_waiting_for_build_processing","true"],{stdio:"inherit",env:l.env});d.on("close",u=>{if(u!==0){o.stop("Pilot failed");try{X.unlinkSync(s)}catch{}c(new Error(`fastlane pilot failed with exit code ${u??"unknown"}.`))}else{o.stop("IPA uploaded to TestFlight");try{X.unlinkSync(s)}catch{}a({})}}),d.on("error",u=>{try{X.unlinkSync(s)}catch{}o.stop("Pilot execution error"),c($a(u))})})}async function ha(e,t,i,n,r,o){let s=ze();if(r&&re(`Bundle ID: ${te.green(r)}`),!i||!n)throw Z(`Missing credentials: issuerId=${i}, keyId=${n}. Check your Dashboard.`),new Error("Missing ASC API Key Metadata (IssuerID or KeyID)");let l=lr(t,i,n),a=`${o.sshUser}@${o.sshHost}`,c=ya(o),d=Sa(o),u="",p="";try{if(s.start(`Preparing remote iOS submit runner (${a})...`),u=Ea("ssh",[...c,"mktemp -d /tmp/mach-submit.XXXXXX"]).trim(),!u)throw new Error("Remote runner did not return a temp directory.");s.stop(`Remote runner ready: ${a}`),s.start("Uploading IPA and App Store Connect key to remote runner..."),Oi("scp",[...d,e,`${a}:${u}/app.ipa`],"IPA upload to remote runner"),Oi("scp",[...d,l,`${a}:${u}/api_key.json`],"ASC key upload to remote runner"),p=fe.join(tt.tmpdir(),`${f.nameLower}-ios-submit-${Date.now()}.sh`),X.writeFileSync(p,ba(u)),Oi("scp",[...d,p,`${a}:${u}/submit.sh`],"submit script upload to remote runner"),s.stop("Remote submit inputs uploaded"),s.start("Uploading to TestFlight on remote runner...");let m=`chmod +x ${Pt(`${u}/submit.sh`)} && bash ${Pt(`${u}/submit.sh`)}`,E=Qe("ssh",[...c,m],{stdio:"inherit"});if(E.error)throw Ui("ssh",E.error);if(E.status!==0)throw new Error(`Remote iOS submit failed with exit code ${E.status}.`);return s.stop("IPA uploaded to TestFlight"),{apiKeyJsonPath:null}}catch(m){throw s.stop("Remote iOS submit failed"),m}finally{try{X.unlinkSync(l)}catch{}if(p)try{X.unlinkSync(p)}catch{}if(u)try{Qe("ssh",[...c,`rm -rf ${Pt(u)}`],{stdio:"ignore"})}catch{}}}function lr(e,t,i){let n=X.readFileSync(e,"utf8"),r;try{r=Li.createPrivateKey(n).export({type:"pkcs8",format:"pem"})}catch{re("Key normalization failed, falling back to manual re-wrapping..."),r=`-----BEGIN PRIVATE KEY-----
 ${(n.replace(/-----BEGIN[^-]*-----/g,"").replace(/-----END[^-]*-----/g,"").replace(/\s+/g,"").match(/.{1,64}/g)||[]).join(`
 `)}
------END PRIVATE KEY-----`}console.log(ee.yellow(`
-[DIAGNOSTIC] Key ID: ${i}`)),console.log(ee.yellow(`[DIAGNOSTIC] Issuer ID: ${t}`)),console.log(ee.yellow(`[DIAGNOSTIC] Key Checksum (Start): ${o.substring(0,45).replace(/\n/g,"\\n")}`)),console.log(ee.yellow(`[DIAGNOSTIC] Key Checksum (End):   ${o.substring(o.length-28).replace(/\n/g,"\\n")}
-`));let r=de.join(Xe.tmpdir(),`api_key_${i}_${Date.now()}.json`),a={key_id:i,issuer_id:t,key:o,in_house:!1};return Y.writeFileSync(r,JSON.stringify(a,null,2)),r}function is(e){let t=["-o","StrictHostKeyChecking=no","-o","ServerAliveInterval=30"];return e.sshKey&&t.push("-i",e.sshKey),t.push(`${e.sshUser}@${e.sshHost}`),t}function ns(e){let t=["-o","StrictHostKeyChecking=no","-o","ServerAliveInterval=30"];return e.sshKey&&t.push("-i",e.sshKey),t}function os(e,t){let i=Je(e,t,{encoding:"utf-8",stdio:["ignore","pipe","inherit"]});if(i.error)throw bi(e,i.error);if(i.status!==0)throw new Error(`${e} failed with exit code ${i.status}.`);return i.stdout||""}function yi(e,t,i){let n=Je(e,t,{stdio:"inherit"});if(n.error)throw bi(e,n.error);if(n.status!==0)throw new Error(`${i} failed with exit code ${n.status}.`)}function bi(e,t){return t?.code==="ENOENT"?new Error(`${e} was not found on this machine. Install OpenSSH client tools or run iOS submit directly on the macOS runner.`):t}function It(e){return`'${e.replace(/'/g,"'\\''")}'`}function rs(e){let t=It(`${e}/app.ipa`),i=It(`${e}/api_key.json`);return`#!/bin/bash
+-----END PRIVATE KEY-----`}let o=fe.join(tt.tmpdir(),`api_key_${i}_${Date.now()}.json`),s={key_id:i,issuer_id:t,key:r,in_house:!1};return X.writeFileSync(o,JSON.stringify(s,null,2)),o}function ya(e){let t=["-o","StrictHostKeyChecking=no","-o","ServerAliveInterval=30"];return e.sshKey&&t.push("-i",e.sshKey),t.push(`${e.sshUser}@${e.sshHost}`),t}function Sa(e){let t=["-o","StrictHostKeyChecking=no","-o","ServerAliveInterval=30"];return e.sshKey&&t.push("-i",e.sshKey),t}function Ea(e,t){let i=Qe(e,t,{encoding:"utf-8",stdio:["ignore","pipe","inherit"]});if(i.error)throw Ui(e,i.error);if(i.status!==0)throw new Error(`${e} failed with exit code ${i.status}.`);return i.stdout||""}function Oi(e,t,i){let n=Qe(e,t,{stdio:"inherit"});if(n.error)throw Ui(e,n.error);if(n.status!==0)throw new Error(`${i} failed with exit code ${n.status}.`)}function Ui(e,t){return t?.code==="ENOENT"?new Error(`${e} was not found on this machine. Install OpenSSH client tools or run iOS submit directly on the macOS runner.`):t}function Pt(e){return`'${e.replace(/'/g,"'\\''")}'`}function ba(e){let t=Pt(`${e}/app.ipa`),i=Pt(`${e}/api_key.json`);return`#!/bin/bash
 set -euo pipefail
 
 export PATH="/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin:$HOME/.local/share/fastlane/3.4.0/bin:$PATH"
@@ -1094,26 +1138,26 @@ fastlane pilot upload \\
   --api_key_path ${i} \\
   --skip_submission true \\
   --skip_waiting_for_build_processing true
-`}async function ss(e,t,i="internal",n,o="completed",r,a=!1,l="production"){let s=st();if(!n||n==="*")throw new Error("Android package name is required for Google Play submission.");let c=r!==void 0?` (${r} rollout)`:"";s.start(`Uploading to Google Play ${i} track with ${o} release status${c}...`);try{let d=JSON.parse(Y.readFileSync(t,"utf-8"));as(d);let u=await Xi({packageName:n,serviceAccount:d,aabPath:e,track:i,releaseStatus:o,userFraction:r,changesNotSentForReview:a});s.stop(`AAB uploaded to ${i} track (versionCode ${u.versionCode})`)}catch(d){throw s.stop("Google Play upload failed"),new Error(us(d,i,n,l))}}function as(e){if(!e?.client_email||!e?.private_key)throw new Error("Invalid Google service account JSON: missing client_email or private_key.")}function Si(){let e=process.env.HOME||Xe.homedir(),t=process.env.FASTLANE_GEM_HOME||de.join(e,".local/share/fastlane/3.4.0"),i=[process.env.FASTLANE_BIN_DIR,"/usr/local/opt/ruby/bin","/opt/homebrew/opt/ruby/bin","/usr/local/bin","/opt/homebrew/bin","/usr/local/Cellar/fastlane/2.227.0/libexec/bin",de.join(t,"bin"),process.env.PATH].filter(Boolean).join(":");return{...process.env,PATH:i,GEM_HOME:t,GEM_PATH:[t,"/usr/local/Cellar/fastlane/2.227.0/libexec",process.env.GEM_PATH].filter(Boolean).join(":"),FASTLANE_INSTALLED_VIA_HOMEBREW:"true",FASTLANE_SKIP_UPDATE_CHECK:"1",FASTLANE_HIDE_CHANGELOG:"1",CI:process.env.CI||"1"}}function ls(){let e=Si(),t=Pn(e);if(t)return t;if(process.env.MACH_SKIP_FASTLANE_INSTALL!=="1"){cs(e);let i=Pn(Si());if(i)return i}return{command:"fastlane",env:Si()}}function Pn(e){let t=process.env.HOME||Xe.homedir(),i=[process.env.FASTLANE_BINARY,"/usr/local/bin/fastlane","/opt/homebrew/bin/fastlane","/usr/local/Cellar/fastlane/2.227.0/libexec/bin/fastlane",de.join(process.env.FASTLANE_GEM_HOME||de.join(t,".local/share/fastlane/3.4.0"),"bin/fastlane"),"fastlane"].filter(Boolean);for(let n of i){if(n.includes("/")&&!Y.existsSync(n))continue;if(!Je(n,["--version"],{env:e,stdio:"ignore"}).error)return{command:n,env:e}}return null}function cs(e){let t=Je("gem",["--version"],{env:e,stdio:"ignore"});if(t.error||t.status!==0)return;let i=process.env.HOME||Xe.homedir(),n=process.env.FASTLANE_GEM_HOME||de.join(i,".local/share/fastlane/3.4.0"),o=de.join(n,"bin");Y.mkdirSync(o,{recursive:!0}),ae(ee.dim("fastlane not found. Installing fastlane into the local Mach runner cache..."));let r=Je("gem",["install","fastlane","-NV","--install-dir",n,"--bindir",o],{env:{...e,GEM_HOME:n,GEM_PATH:[n,e.GEM_PATH].filter(Boolean).join(":")},stdio:"inherit"});(r.error||r.status!==0)&&ae(ee.yellow("Automatic fastlane install failed; Mach will try PATH resolution once more."))}function ds(e){return e?.code!=="ENOENT"?e:new Error(["fastlane was not found on PATH.","Mach submit uses Fastlane for iOS TestFlight/App Store uploads.","Run iOS submit on a macOS runner with Fastlane, or expose it via FASTLANE_BINARY / FASTLANE_BIN_DIR.","Example: gem install fastlane -NV"].join(`
-`))}function us(e,t,i,n="production"){let o=e?.message||String(e);if(/changesNotSentForReview/i.test(o))return["Google Play rejected the commit because this change may need explicit review handling.",`Package: ${i||"unknown"} | Track: ${t}`,`Retry with: ${m.nameLower} submit --latest --platform android --profile ${n} --track ${t} --changes-not-sent-for-review`,"Then send the change for review from Google Play Console if required."].join(`
-`);if(/caller does not have permission|permission denied|insufficient permissions|not authorized/i.test(o))return["Google Play rejected the service account permissions.",`Package: ${i||"unknown"} | Track: ${t}`,"Grant this service account access to the app in Play Console with release permissions, then retry."].join(`
-`);if(/package.*not found|application.*not found|no application was found/i.test(o))return["Google Play could not find this package for the selected service account.",`Package: ${i||"unknown"} | Track: ${t}`,"Check android.package / submit.<profile>.android.package and make sure the app exists in this Play Console account."].join(`
-`);if(/only releases with status draft|draft app/i.test(o))return["Google Play requires a draft release for this app state.",`Package: ${i||"unknown"} | Track: ${t}`,`Retry with: ${m.nameLower} submit --latest --platform android --profile ${n} --track ${t} --release-status draft`].join(`
-`);if(o.includes("does not allow any existing users to upgrade"))return["Google Play rejected this release because the uploaded AAB is not an upgrade for existing users.",`Package: ${i||"unknown"} | Track: ${t}`,"Build a new Android artifact with a higher versionCode, then submit that build.",`Recommended: ${m.nameLower} build --platform android --profile ${n} --auto-version`,`Then: ${m.nameLower} submit --latest --platform android --profile ${n} --track ${t}`].join(`
-`);if(/version code \d+ has already been used/i.test(o))return[o.match(/version code \d+ has already been used[^\n]*/i)?.[0]||"Version code has already been used.",`Package: ${i||"unknown"} | Track: ${t}`,"Build a new Android artifact with a higher versionCode, then submit that build.",`Recommended: ${m.nameLower} build --platform android --profile ${n} --auto-version`].join(`
-`);let r=o.match(/Google Api Error:[^\n]+/)||o.match(/Google Play API Error:[^\n]+/);return r?r[0]:o||"Google Play submission failed"}function $n(e){try{Y.existsSync(e)&&Y.rmSync(e,{recursive:!0,force:!0})}catch{}}function le(e){console.log(ee.red(`\u274C ${e}`))}function ae(e){console.log(ee.gray(`\u2022 ${e}`))}function Dn(e){console.log(ee.green(`\u2713 ${e}`))}import{spinner as ps,log as qe,outro as fs}from"@clack/prompts";import _i from"chalk";import On from"fs";import ms from"path";import{execSync as gs}from"child_process";import hs from"adm-zip";import ys from"axios";import{randomUUID as Ss}from"crypto";async function Cn(e){qe.info(_i.magenta("\u{1F680} Starting Over-The-Air (OTA) Update via Mach..."));let t=Te();(!t||!t.projectId)&&(qe.error(`No ${m.configFileName} found or missing projectId. Run \`mach link\` first.`),process.exit(1));let i=t.projectId,n=e.branch||"production",o="1.0.0";try{o=JSON.parse(On.readFileSync("./package.json","utf-8")).version||"1.0.0"}catch{qe.warn("Could not read package.json version. Defaulting to 1.0.0")}let r=ps();r.start(`Compiling JavaScript bundles for OTA (Channel: ${n}, Runtime: ${o})...`);try{gs("npx expo export --platform all",{stdio:"ignore"})}catch(c){r.stop("Compilation failed."),qe.error(`Failed to export JS bundles using Expo: ${c.message}`),process.exit(1)}r.message("Zipping artifact payload...");let a=ms.join(process.cwd(),"dist");On.existsSync(a)||(r.stop("Missing dist folder."),qe.error("The `dist` directory was not created. Export failed."),process.exit(1));let l=new hs;l.addLocalFolder(a,"dist");let s=l.toBuffer();r.message("Uploading payload to Mach Cloud...");try{let c=Ss(),d=await v.post("/builds/source-upload-url",{projectId:i,buildId:c});if(d.data.status!=="success")throw new Error("Could not secure upload bucket URL");let{uploadUrl:u,key:p}=d.data;await ys.put(u,s,{headers:{"Content-Type":"application/zip"},maxBodyLength:1/0,maxContentLength:1/0}),r.message(`Promoting Update to ${n}...`),await v.post("/updates/publish",{projectId:i,channelName:n,runtimeVersion:o,platform:"android",updateId:`${c}-android`,manifestKey:p}),await v.post("/updates/publish",{projectId:i,channelName:n,runtimeVersion:o,platform:"ios",updateId:`${c}-ios`,manifestKey:p}),r.stop("Update Live!"),fs(_i.green(`\u2713 OTA Update natively shipped to the '${n}' channel.`)),qe.info(_i.dim(`Any app running runtime '${o}' will download this bundle smoothly.`))}catch(c){r.stop("Update failed during Cloud Sync."),qe.error(`Upload error: ${c.message}`),process.exit(1)}}import{intro as Es,outro as Nn,log as at}from"@clack/prompts";import Le from"chalk";async function Tn(){Es(Le.blue(`${m.name} CLI - User Profile`));let e=ge();if(!e){at.warn(Le.yellow("You are not logged in.")),at.info(`Run \`${m.nameLower} login\` to authenticate.`),Nn();return}at.info(`${Le.bold("Logged in as:")} ${Le.green(e.email)}`);try{await v.get("/projects");let i=ge().token.split(".");if(i.length===3){let n=JSON.parse(Buffer.from(i[1],"base64").toString());if(n.exp){let o=new Date(n.exp*1e3),r=new Date,a=o.getTime()-r.getTime();if(a>0){let l=Math.round(a/6e4),s=(l/60).toFixed(1);at.info(`${Le.bold("Token status:")} Valid (Expires in ~${s}h / ${l}m)`)}else at.warn(`${Le.bold("Token status:")} ${Le.red("Expired")} (Auto-refresh failed)`)}}}catch{at.warn(`${Le.bold("Token status:")} ${Le.red("Unreachable")} (Session might be truly expired)${Nt}`)}Nn(Le.blue("---"))}import{spawn as _s}from"child_process";import{log as Ke}from"@clack/prompts";import Ae from"chalk";import Is from"fs";import As from"net";async function bs(e){return new Promise(t=>{let i=As.createServer();i.once("error",n=>{n.code==="EADDRINUSE"?t(!0):t(!1)}),i.once("listening",()=>{i.close(),t(!1)}),i.listen(e,"0.0.0.0")})}async function kn(e,t=20){let i=e;for(;i<e+t;){if(!await bs(i))return i;i++}throw new Error(`Could not find an available port after ${t} attempts starting from ${e}.`)}var xn=async e=>{Ke.info(Ae.blue(`Starting ${m.name} Dev Orchestrator...`));let t=Te(),i=e.buildProfile||"development",n=t?We(t,i):null,o={...process.env};if(t?.projectId)try{Ke.info(Ae.dim(`Fetching managed secrets for profile: ${i}...`));let u=await v.get(`/projects/${t.projectId}/secrets/export?env=${i}`);u.data?.status==="success"&&u.data.secrets&&(Object.assign(o,u.data.secrets),Ke.info(Ae.magenta(`\u2713 Injected secrets from ${m.name} Dashboard.`)))}catch{Ke.warn("Could not fetch managed secrets. Running with local env only.")}t&&Object.assign(o,et(t,m.envPrefix)),n&&(Object.assign(o,et(n,`${m.envPrefix}PROFILE_`)),n.env&&Object.assign(o,n.env));let r=!1;try{let u=JSON.parse(Is.readFileSync("package.json","utf-8"));r=!!(u.dependencies?.expo||u.devDependencies?.expo)}catch{Ke.warn("Could not parse package.json. Defaulting to Bare React Native mode.")}let a=Number(e.port||n?.port||8081),l=await kn(a);l!==a&&Ke.info(Ae.yellow(`Port ${a} is busy. ${m.name} is using ${l} instead.`));let s=process.platform==="win32"?"npx.cmd":"npx",c=[];if(r?(c=["expo","start","--port",String(l)],e.clear&&c.push("--clear"),e.tunnel&&c.push("--tunnel"),e.lan&&c.push("--lan"),e.localhost&&c.push("--localhost"),e.ios&&c.push("--ios"),e.android&&c.push("--android"),e.web&&c.push("--web")):(c=["react-native","start","--port",String(l)],e.clear&&c.push("--clear")),r){let u=[`${Ae.cyan("i")}  open iOS simulator`,`${Ae.cyan("a")}  open Android emulator/device`,`${Ae.cyan("w")}  open web`,`${Ae.cyan("r")}  reload app`];Ke.info([Ae.bold("Launch controls"),...u.map(p=>`  ${p}`),"",Ae.dim("Direct launch: mach start --ios | --android | --web"),Ae.dim(`Metro URL: http://localhost:${l}`)].join(`
-`))}else Ke.info(Ae.dim(`Metro URL: http://localhost:${l}`));let d=_s(s,c,{stdio:"inherit",env:o});return new Promise((u,p)=>{d.on("exit",f=>{f===0?u():p(new Error(`Dev server exited with code ${f}`))}),d.on("error",f=>{p(f)})})};import{log as he}from"@clack/prompts";import Re from"chalk";var Ln=async e=>{let t=Te();t||(he.error(Re.red(`No ${m.configFileName} found in the current directory.`)),process.exit(1));let i=e.profile||"development",n=We(t,i);if(e.json){console.log(JSON.stringify({project:t,resolved:n},null,2));return}he.info(Re.bgBlue.white(` Resolved ${m.name} Config [${i}] `)),he.info(Re.dim("----------------------------------------")),he.info(`${Re.blue("Project ID:")} ${t.projectId}`),he.info(`${Re.blue("Name:")} ${t.name}`),he.info(`${Re.blue("Scheme:")} ${t.scheme}`),n?(he.info(Re.dim(`
-Profile Settings:`)),he.info(`${Re.cyan("Distribution:")} ${n.distribution||"none"}`),he.info(`${Re.cyan("Development Client:")} ${n.developmentClient||"false"}`),n.env&&Object.keys(n.env).length>0&&(he.info(Re.dim(`
-Environment Variables:`)),Object.entries(n.env).forEach(([o,r])=>{he.info(`  ${o}=${r}`)}))):he.warn(`Profile '${i}' not found.`),he.info(Re.dim("----------------------------------------"))};import{log as ve,spinner as Dt,text as Mn,select as Un,confirm as Ps,isCancel as Pt,cancel as $t,outro as Rt,note as $s}from"@clack/prompts";import z from"chalk";import{execSync as Ds}from"child_process";async function Rs(){try{let e=Ds("xcrun devicectl list devices --json-output -",{stdio:["pipe","pipe","pipe"]}).toString();return(JSON.parse(e).result?.devices||[]).filter(n=>n.connectionProperties?.transportType==="wired"||n.connectionProperties?.transportType==="localNetwork").map(n=>({udid:n.identifier,name:n.deviceProperties?.name||"Unknown Device",model:n.hardwareProperties?.marketingName||"iPhone"}))}catch{return[]}}async function vs(e){let t=e.udid,i=e.name,n="";if(!t){let r=Dt();r.start("Scanning for connected iOS devices...");let a=await Rs();if(r.stop(a.length>0?`Found ${a.length} device(s)`:"No devices detected"),a.length===1)t=a[0].udid,i=i||a[0].name,n=a[0].model,ve.info(`Detected: ${z.bold(i)} (${z.dim(t.substring(0,12)+"...")})`);else if(a.length>1){let l=await Un({message:"Select a device to register:",options:a.map(c=>({value:c.udid,label:`${c.name} (${c.model})`,hint:c.udid.substring(0,12)+"..."}))});if(Pt(l)){$t("Cancelled");return}t=l;let s=a.find(c=>c.udid===t);i=i||s.name,n=s.model}else{ve.info(z.dim("No connected devices found. Enter UDID manually."));let l=await Mn({message:"Device UDID:",placeholder:"00008101-XXXXXXXXXXXX",validate(s){if(s.length<10)return"UDID seems too short"}});if(Pt(l)){$t("Cancelled");return}t=l}}if(!i){let r=await Mn({message:"Device name:",placeholder:"Nitesh's iPhone",validate(a){if(a.length===0)return"Name is required"}});if(Pt(r)){$t("Cancelled");return}i=r}let o=Dt();o.start("Registering device...");try{await v.post("/devices",{udid:t,name:i,platform:"ios",model:n||void 0,addedVia:"cli"}),o.stop(z.green("Device registered!")),ve.info(`  ${z.bold("Name:")} ${i}`),ve.info(`  ${z.bold("UDID:")} ${z.dim(t)}`)}catch(r){o.stop(z.red("Failed to register device")),ve.error(r.response?.data?.message||r.message)}Rt(z.blue("---"))}async function ws(){let e=Dt();e.start("Fetching registered devices...");try{let i=(await v.get("/devices")).data.devices||[];if(e.stop(`${i.length} device(s) registered`),i.length===0){ve.info(z.dim(`No devices registered yet. Run \`${m.nameLower} device register\` to add one.`)),Rt(z.blue("---"));return}let n=i.map(o=>{let r=new Date(o.createdAt).toLocaleDateString();return`  ${z.bold(o.name.padEnd(24))} ${z.dim(o.udid.padEnd(28))} ${z.cyan(o.addedVia.padEnd(10))} ${z.dim(r)}`});$s(`  ${z.bold("Name".padEnd(24))} ${"UDID".padEnd(28)} ${"Via".padEnd(10)} Date
+`}async function Aa(e,t,i="internal",n,r="completed",o,s=!1,l="production"){let a=ze();if(!n||n==="*")throw new Error("Android package name is required for Google Play submission.");let c=o!==void 0?` (${o} rollout)`:"";a.start(`Uploading to Google Play ${i} track with ${r} release status${c}...`);try{let d=JSON.parse(X.readFileSync(t,"utf-8"));Ia(d);let u=await mn({packageName:n,serviceAccount:d,aabPath:e,track:i,releaseStatus:r,userFraction:o,changesNotSentForReview:s});return a.stop(`AAB uploaded to ${i} track (versionCode ${u.versionCode})`),u}catch(d){throw a.stop("Google Play upload failed"),new Error(wa(d,i,n,l))}}function Ia(e){if(!e?.client_email||!e?.private_key)throw new Error("Invalid Google service account JSON: missing client_email or private_key.")}function Ci(){let e=process.env.HOME||tt.homedir(),t=process.env.FASTLANE_GEM_HOME||fe.join(e,".local/share/fastlane/3.4.0"),i=[process.env.FASTLANE_BIN_DIR,"/usr/local/opt/ruby/bin","/opt/homebrew/opt/ruby/bin","/usr/local/bin","/opt/homebrew/bin","/usr/local/Cellar/fastlane/2.227.0/libexec/bin",fe.join(t,"bin"),process.env.PATH].filter(Boolean).join(":");return{...process.env,PATH:i,GEM_HOME:t,GEM_PATH:[t,"/usr/local/Cellar/fastlane/2.227.0/libexec",process.env.GEM_PATH].filter(Boolean).join(":"),FASTLANE_INSTALLED_VIA_HOMEBREW:"true",FASTLANE_SKIP_UPDATE_CHECK:"1",FASTLANE_HIDE_CHANGELOG:"1",LANG:process.env.LANG||"en_US.UTF-8",LC_ALL:process.env.LC_ALL||"en_US.UTF-8",CI:process.env.CI||"1"}}function _a(){let e=Ci(),t=rr(e);if(t)return t;if(process.env.MACH_SKIP_FASTLANE_INSTALL!=="1"){Pa(e);let i=rr(Ci());if(i)return i}return{command:"fastlane",env:Ci()}}function rr(e){let t=process.env.HOME||tt.homedir(),i=[process.env.FASTLANE_BINARY,"/usr/local/bin/fastlane","/opt/homebrew/bin/fastlane","/usr/local/Cellar/fastlane/2.227.0/libexec/bin/fastlane",fe.join(process.env.FASTLANE_GEM_HOME||fe.join(t,".local/share/fastlane/3.4.0"),"bin/fastlane"),"fastlane"].filter(Boolean);for(let n of i){if(n.includes("/")&&!X.existsSync(n))continue;if(!Qe(n,["--version"],{env:e,stdio:"ignore"}).error)return{command:n,env:e}}return null}function Pa(e){let t=Qe("gem",["--version"],{env:e,stdio:"ignore"});if(t.error||t.status!==0)return;let i=process.env.HOME||tt.homedir(),n=process.env.FASTLANE_GEM_HOME||fe.join(i,".local/share/fastlane/3.4.0"),r=fe.join(n,"bin");X.mkdirSync(r,{recursive:!0}),re(te.dim("fastlane not found. Installing fastlane into the local Mach runner cache..."));let o=Qe("gem",["install","fastlane","-NV","--install-dir",n,"--bindir",r],{env:{...e,GEM_HOME:n,GEM_PATH:[n,e.GEM_PATH].filter(Boolean).join(":")},stdio:"inherit"});(o.error||o.status!==0)&&re(te.yellow("Automatic fastlane install failed; Mach will try PATH resolution once more."))}function $a(e){return e?.code!=="ENOENT"?e:new Error(["fastlane was not found on PATH.","Mach submit uses Fastlane for iOS TestFlight/App Store uploads.","Run iOS submit on a macOS runner with Fastlane, or expose it via FASTLANE_BINARY / FASTLANE_BIN_DIR.","Example: gem install fastlane -NV"].join(`
+`))}function wa(e,t,i,n="production"){let r=e?.message||String(e);if(/changesNotSentForReview/i.test(r))return["Google Play rejected the commit because this change may need explicit review handling.",`Package: ${i||"unknown"} | Track: ${t}`,`Retry with: ${f.nameLower} submit --latest --platform android --profile ${n} --track ${t} --changes-not-sent-for-review`,"Then send the change for review from Google Play Console if required."].join(`
+`);if(/caller does not have permission|permission denied|insufficient permissions|not authorized/i.test(r))return["Google Play rejected the service account permissions.",`Package: ${i||"unknown"} | Track: ${t}`,"Grant this service account access to the app in Play Console with release permissions, then retry."].join(`
+`);if(/package.*not found|application.*not found|no application was found/i.test(r))return["Google Play could not find this package for the selected service account.",`Package: ${i||"unknown"} | Track: ${t}`,"Check android.package / submit.<profile>.android.package and make sure the app exists in this Play Console account."].join(`
+`);if(/only releases with status draft|draft app/i.test(r))return["Google Play requires a draft release for this app state.",`Package: ${i||"unknown"} | Track: ${t}`,`Retry with: ${f.nameLower} submit --latest --platform android --profile ${n} --track ${t} --release-status draft`].join(`
+`);if(r.includes("does not allow any existing users to upgrade"))return["Google Play rejected this release because the uploaded AAB is not an upgrade for existing users.",`Package: ${i||"unknown"} | Track: ${t}`,"Build a new Android artifact with a higher versionCode, then submit that build.",`Recommended: ${f.nameLower} build --platform android --profile ${n} --auto-version`,`Then: ${f.nameLower} submit --latest --platform android --profile ${n} --track ${t}`].join(`
+`);if(/version code \d+ has already been used/i.test(r))return[r.match(/version code \d+ has already been used[^\n]*/i)?.[0]||"Version code has already been used.",`Package: ${i||"unknown"} | Track: ${t}`,"Build a new Android artifact with a higher versionCode, then submit that build.",`Recommended: ${f.nameLower} build --platform android --profile ${n} --auto-version`].join(`
+`);let o=r.match(/Google Api Error:[^\n]+/)||r.match(/Google Play API Error:[^\n]+/);return o?o[0]:r||"Google Play submission failed"}function Ra(e){try{X.existsSync(e)&&X.rmSync(e,{recursive:!0,force:!0})}catch{}}function Z(e){console.log(te.red(`\u274C ${e}`))}function re(e){console.log(te.gray(`\u2022 ${e}`))}function xi(e){console.log(te.green(`\u2713 ${e}`))}import{spinner as Da,log as it,outro as va}from"@clack/prompts";import Mi from"chalk";import dr from"fs";import Oa from"path";import{execSync as Ca}from"child_process";import Na from"adm-zip";import Ta from"axios";import{randomUUID as ka}from"crypto";async function cr(e){it.info(Mi.magenta("\u{1F680} Starting Over-The-Air (OTA) Update via Mach..."));let t=Te();(!t||!t.projectId)&&(it.error(`No ${f.configFileName} found or missing projectId. Run \`mach link\` first.`),process.exit(1));let i=t.projectId,n=e.branch||"production",r="1.0.0";try{r=JSON.parse(dr.readFileSync("./package.json","utf-8")).version||"1.0.0"}catch{it.warn("Could not read package.json version. Defaulting to 1.0.0")}let o=Da();o.start(`Compiling JavaScript bundles for OTA (Channel: ${n}, Runtime: ${r})...`);try{Ca("npx expo export --platform all",{stdio:"ignore"})}catch(c){o.stop("Compilation failed."),it.error(`Failed to export JS bundles using Expo: ${c.message}`),process.exit(1)}o.message("Zipping artifact payload...");let s=Oa.join(process.cwd(),"dist");dr.existsSync(s)||(o.stop("Missing dist folder."),it.error("The `dist` directory was not created. Export failed."),process.exit(1));let l=new Na;l.addLocalFolder(s,"dist");let a=l.toBuffer();o.message("Uploading payload to Mach Cloud...");try{let c=ka(),d=await v.post("/builds/source-upload-url",{projectId:i,buildId:c});if(d.data.status!=="success")throw new Error("Could not secure upload bucket URL");let{uploadUrl:u,key:p}=d.data;await Ta.put(u,a,{headers:{"Content-Type":"application/zip"},maxBodyLength:1/0,maxContentLength:1/0}),o.message(`Promoting Update to ${n}...`),await v.post("/updates/publish",{projectId:i,channelName:n,runtimeVersion:r,platform:"android",updateId:`${c}-android`,manifestKey:p}),await v.post("/updates/publish",{projectId:i,channelName:n,runtimeVersion:r,platform:"ios",updateId:`${c}-ios`,manifestKey:p}),o.stop("Update Live!"),va(Mi.green(`\u2713 OTA Update natively shipped to the '${n}' channel.`)),it.info(Mi.dim(`Any app running runtime '${r}' will download this bundle smoothly.`))}catch(c){o.stop("Update failed during Cloud Sync."),it.error(`Upload error: ${c.message}`),process.exit(1)}}import{intro as xa,outro as ur,log as dt}from"@clack/prompts";import Le from"chalk";async function pr(){xa(Le.blue(`${f.name} CLI - User Profile`));let e=ye();if(!e){dt.warn(Le.yellow("You are not logged in.")),dt.info(`Run \`${f.nameLower} login\` to authenticate.`),ur();return}dt.info(`${Le.bold("Logged in as:")} ${Le.green(e.email)}`);try{await v.get("/projects");let i=ye().token.split(".");if(i.length===3){let n=JSON.parse(Buffer.from(i[1],"base64").toString());if(n.exp){let r=new Date(n.exp*1e3),o=new Date,s=r.getTime()-o.getTime();if(s>0){let l=Math.round(s/6e4),a=(l/60).toFixed(1);dt.info(`${Le.bold("Token status:")} Valid (Expires in ~${a}h / ${l}m)`)}else dt.warn(`${Le.bold("Token status:")} ${Le.red("Expired")} (Auto-refresh failed)`)}}}catch{dt.warn(`${Le.bold("Token status:")} ${Le.red("Unreachable")} (Session might be truly expired)${xt}`)}ur(Le.blue("---"))}import{spawn as Ma}from"child_process";import{log as We}from"@clack/prompts";import Ae from"chalk";import Fa from"fs";import La from"net";async function Ua(e){return new Promise(t=>{let i=La.createServer();i.once("error",n=>{n.code==="EADDRINUSE"?t(!0):t(!1)}),i.once("listening",()=>{i.close(),t(!1)}),i.listen(e,"0.0.0.0")})}async function fr(e,t=20){let i=e;for(;i<e+t;){if(!await Ua(i))return i;i++}throw new Error(`Could not find an available port after ${t} attempts starting from ${e}.`)}var mr=async e=>{We.info(Ae.blue(`Starting ${f.name} Dev Orchestrator...`));let t=Te(),i=e.buildProfile||"development",n=t?Ge(t,i):null,r={...process.env};if(t?.projectId)try{We.info(Ae.dim(`Fetching managed secrets for profile: ${i}...`));let u=await v.get(`/projects/${t.projectId}/secrets/export?env=${i}`);u.data?.status==="success"&&u.data.secrets&&(Object.assign(r,u.data.secrets),We.info(Ae.magenta(`\u2713 Injected secrets from ${f.name} Dashboard.`)))}catch{We.warn("Could not fetch managed secrets. Running with local env only.")}t&&Object.assign(r,nt(t,f.envPrefix)),n&&(Object.assign(r,nt(n,`${f.envPrefix}PROFILE_`)),n.env&&Object.assign(r,n.env));let o=!1;try{let u=JSON.parse(Fa.readFileSync("package.json","utf-8"));o=!!(u.dependencies?.expo||u.devDependencies?.expo)}catch{We.warn("Could not parse package.json. Defaulting to Bare React Native mode.")}let s=Number(e.port||n?.port||8081),l=await fr(s);l!==s&&We.info(Ae.yellow(`Port ${s} is busy. ${f.name} is using ${l} instead.`));let a=process.platform==="win32"?"npx.cmd":"npx",c=[];if(o?(c=["expo","start","--port",String(l)],e.clear&&c.push("--clear"),e.tunnel&&c.push("--tunnel"),e.lan&&c.push("--lan"),e.localhost&&c.push("--localhost"),e.ios&&c.push("--ios"),e.android&&c.push("--android"),e.web&&c.push("--web")):(c=["react-native","start","--port",String(l)],e.clear&&c.push("--clear")),o){let u=[`${Ae.cyan("i")}  open iOS simulator`,`${Ae.cyan("a")}  open Android emulator/device`,`${Ae.cyan("w")}  open web`,`${Ae.cyan("r")}  reload app`];We.info([Ae.bold("Launch controls"),...u.map(p=>`  ${p}`),"",Ae.dim("Direct launch: mach start --ios | --android | --web"),Ae.dim(`Metro URL: http://localhost:${l}`)].join(`
+`))}else We.info(Ae.dim(`Metro URL: http://localhost:${l}`));let d=Ma(a,c,{stdio:"inherit",env:r});return new Promise((u,p)=>{d.on("exit",m=>{m===0?u():p(new Error(`Dev server exited with code ${m}`))}),d.on("error",m=>{p(m)})})};import{log as Se}from"@clack/prompts";import De from"chalk";var gr=async e=>{let t=Te();t||(Se.error(De.red(`No ${f.configFileName} found in the current directory.`)),process.exit(1));let i=e.profile||"development",n=Ge(t,i);if(e.json){console.log(JSON.stringify({project:t,resolved:n},null,2));return}Se.info(De.bgBlue.white(` Resolved ${f.name} Config [${i}] `)),Se.info(De.dim("----------------------------------------")),Se.info(`${De.blue("Project ID:")} ${t.projectId}`),Se.info(`${De.blue("Name:")} ${t.name}`),Se.info(`${De.blue("Scheme:")} ${t.scheme}`),n?(Se.info(De.dim(`
+Profile Settings:`)),Se.info(`${De.cyan("Distribution:")} ${n.distribution||"none"}`),Se.info(`${De.cyan("Development Client:")} ${n.developmentClient||"false"}`),n.env&&Object.keys(n.env).length>0&&(Se.info(De.dim(`
+Environment Variables:`)),Object.entries(n.env).forEach(([r,o])=>{Se.info(`  ${r}=${o}`)}))):Se.warn(`Profile '${i}' not found.`),Se.info(De.dim("----------------------------------------"))};import{log as ve,spinner as Rt,text as hr,select as yr,confirm as Ba,isCancel as $t,cancel as wt,outro as Dt,note as Ha}from"@clack/prompts";import Q from"chalk";import{execSync as ja}from"child_process";async function Ga(){try{let e=ja("xcrun devicectl list devices --json-output -",{stdio:["pipe","pipe","pipe"]}).toString();return(JSON.parse(e).result?.devices||[]).filter(n=>n.connectionProperties?.transportType==="wired"||n.connectionProperties?.transportType==="localNetwork").map(n=>({udid:n.identifier,name:n.deviceProperties?.name||"Unknown Device",model:n.hardwareProperties?.marketingName||"iPhone"}))}catch{return[]}}async function Ka(e){let t=e.udid,i=e.name,n="";if(!t){let o=Rt();o.start("Scanning for connected iOS devices...");let s=await Ga();if(o.stop(s.length>0?`Found ${s.length} device(s)`:"No devices detected"),s.length===1)t=s[0].udid,i=i||s[0].name,n=s[0].model,ve.info(`Detected: ${Q.bold(i)} (${Q.dim(t.substring(0,12)+"...")})`);else if(s.length>1){let l=await yr({message:"Select a device to register:",options:s.map(c=>({value:c.udid,label:`${c.name} (${c.model})`,hint:c.udid.substring(0,12)+"..."}))});if($t(l)){wt("Cancelled");return}t=l;let a=s.find(c=>c.udid===t);i=i||a.name,n=a.model}else{ve.info(Q.dim("No connected devices found. Enter UDID manually."));let l=await hr({message:"Device UDID:",placeholder:"00008101-XXXXXXXXXXXX",validate(a){if(a.length<10)return"UDID seems too short"}});if($t(l)){wt("Cancelled");return}t=l}}if(!i){let o=await hr({message:"Device name:",placeholder:"Nitesh's iPhone",validate(s){if(s.length===0)return"Name is required"}});if($t(o)){wt("Cancelled");return}i=o}let r=Rt();r.start("Registering device...");try{await v.post("/devices",{udid:t,name:i,platform:"ios",model:n||void 0,addedVia:"cli"}),r.stop(Q.green("Device registered!")),ve.info(`  ${Q.bold("Name:")} ${i}`),ve.info(`  ${Q.bold("UDID:")} ${Q.dim(t)}`)}catch(o){r.stop(Q.red("Failed to register device")),ve.error(o.response?.data?.message||o.message)}Dt(Q.blue("---"))}async function Va(){let e=Rt();e.start("Fetching registered devices...");try{let i=(await v.get("/devices")).data.devices||[];if(e.stop(`${i.length} device(s) registered`),i.length===0){ve.info(Q.dim(`No devices registered yet. Run \`${f.nameLower} device register\` to add one.`)),Dt(Q.blue("---"));return}let n=i.map(r=>{let o=new Date(r.createdAt).toLocaleDateString();return`  ${Q.bold(r.name.padEnd(24))} ${Q.dim(r.udid.padEnd(28))} ${Q.cyan(r.addedVia.padEnd(10))} ${Q.dim(o)}`});Ha(`  ${Q.bold("Name".padEnd(24))} ${"UDID".padEnd(28)} ${"Via".padEnd(10)} Date
 `+n.join(`
-`),"Registered Devices")}catch(t){e.stop(z.red("Failed to fetch devices")),ve.error(t.response?.data?.message||t.message)}Rt(z.blue("---"))}async function Os(e){let t=e.udid;if(!t){let o=Dt();o.start("Fetching registered devices...");try{let a=(await v.get("/devices")).data.devices||[];if(o.stop(`${a.length} device(s) found`),a.length===0){ve.info(z.dim("No devices to remove.")),Rt(z.blue("---"));return}let l=await Un({message:"Select device to remove:",options:a.map(s=>({value:s.udid,label:s.name,hint:s.udid.substring(0,12)+"..."}))});if(Pt(l)){$t("Cancelled");return}t=l}catch(r){o.stop(z.red("Failed to fetch devices")),ve.error(r.response?.data?.message||r.message);return}}let i=await Ps({message:`Remove device ${z.dim(t.substring(0,12)+"...")}?`});if(Pt(i)||!i){$t("Cancelled");return}let n=Dt();n.start("Removing device...");try{await v.delete(`/devices/${encodeURIComponent(t)}`),n.stop(z.green("Device removed"))}catch(o){n.stop(z.red("Failed to remove device")),ve.error(o.response?.data?.message||o.message)}Rt(z.blue("---"))}async function Gt(e,t){switch(e){case"register":await vs(t);break;case"list":await ws();break;case"remove":await Os(t);break;default:ve.error(`Unknown action: ${e}`)}}import{log as _e,spinner as mo}from"@clack/prompts";import Oe from"chalk";import Zt from"path";import Ot from"fs";import da from"os";import ua from"axios";var be=(r=>(r.CRITICAL="critical",r.HIGH="high",r.MEDIUM="medium",r.LOW="low",r.INFO="info",r))(be||{}),we=(s=>(s.PERMISSIONS="permissions",s.SECRETS="secrets",s.DEPENDENCIES="dependencies",s.STORAGE="storage",s.NETWORK="network",s.DEBUG="debug",s.MANIFEST="manifest",s.ATS="ats",s))(we||{});import{spinner as no,log as wt}from"@clack/prompts";import ye from"chalk";import{execSync as ea}from"child_process";import oo from"fs";import ro from"path";import Ve from"fs";import vt from"path";import{execSync as Cs}from"child_process";var Fn={"android.permission.READ_PHONE_STATE":{severity:"high",description:"Can read phone number, IMEI, carrier info"},"android.permission.CALL_PHONE":{severity:"high",description:"Can make calls without user interaction"},"android.permission.SEND_SMS":{severity:"high",description:"Can send SMS without user interaction"},"android.permission.READ_SMS":{severity:"high",description:"Can read user SMS messages"},"android.permission.READ_CONTACTS":{severity:"medium",description:"Can read user contacts"},"android.permission.WRITE_CONTACTS":{severity:"medium",description:"Can modify user contacts"},"android.permission.READ_CALL_LOG":{severity:"high",description:"Can read call history"},"android.permission.CAMERA":{severity:"medium",description:"Camera access"},"android.permission.RECORD_AUDIO":{severity:"medium",description:"Microphone access"},"android.permission.ACCESS_FINE_LOCATION":{severity:"medium",description:"Precise GPS location"},"android.permission.ACCESS_COARSE_LOCATION":{severity:"medium",description:"Approximate location"},"android.permission.ACCESS_BACKGROUND_LOCATION":{severity:"high",description:"Background location tracking"},"android.permission.READ_EXTERNAL_STORAGE":{severity:"medium",description:"Read files on device"},"android.permission.WRITE_EXTERNAL_STORAGE":{severity:"medium",description:"Write files on device"},"android.permission.READ_MEDIA_IMAGES":{severity:"low",description:"Read photos"},"android.permission.READ_MEDIA_VIDEO":{severity:"low",description:"Read videos"},"android.permission.SYSTEM_ALERT_WINDOW":{severity:"high",description:"Draw overlays on other apps"},"android.permission.REQUEST_INSTALL_PACKAGES":{severity:"high",description:"Can install APKs"}},Ns={NSCameraUsageDescription:{severity:"medium",description:"Camera access declared"},NSMicrophoneUsageDescription:{severity:"medium",description:"Microphone access declared"},NSLocationWhenInUseUsageDescription:{severity:"medium",description:"Location (in-use) declared"},NSLocationAlwaysUsageDescription:{severity:"high",description:"Background location declared"},NSContactsUsageDescription:{severity:"medium",description:"Contacts access declared"},NSCalendarsUsageDescription:{severity:"low",description:"Calendar access declared"},NSPhotoLibraryUsageDescription:{severity:"low",description:"Photo library access declared"}};function Ts(e){try{let i=Cs("npx expo config --type introspect --json 2>/dev/null",{cwd:e,encoding:"utf-8",timeout:3e4});return JSON.parse(i)}catch{}let t=vt.join(e,"app.json");if(Ve.existsSync(t))try{let i=JSON.parse(Ve.readFileSync(t,"utf-8"));return i.expo||i}catch{}return null}function ks(e){let t=[],i=vt.join(e,"node_modules");if(!Ve.existsSync(i))return t;let n=/<uses-permission\s+android:name="([^"]+)"/g;function o(r,a){let l=vt.join(r,"android","src","main","AndroidManifest.xml");if(!Ve.existsSync(l))return;let s=Ve.readFileSync(l,"utf-8"),c;for(;(c=n.exec(s))!==null;)t.push({pkg:a,permission:c[1]});n.lastIndex=0}for(let r of Ve.readdirSync(i)){if(r.startsWith("."))continue;let a=vt.join(i,r);if(r.startsWith("@")){if(!Ve.statSync(a).isDirectory())continue;for(let l of Ve.readdirSync(a))o(vt.join(a,l),`${r}/${l}`)}else o(a,r)}return t}async function Hn(e,t){let i=[],n=1,o=Ts(e),r=o?.android?.permissions||[],a=o?.android?.blockedPermissions||[];for(let c of r){let d=Fn[c];d&&i.push({id:`PERM-${String(n++).padStart(3,"0")}`,title:`${c.split(".").pop()} declared`,description:d.description,severity:d.severity,category:"permissions",file:"app.config.ts",recommendation:"Remove from permissions if not needed, or add justification."})}let l=ks(e);for(let{pkg:c,permission:d}of l){let u=Fn[d];u&&(a.includes(d)||r.includes(d)||i.push({id:`PERM-${String(n++).padStart(3,"0")}`,title:`${d.split(".").pop()} injected by ${c}`,description:`${u.description}. Auto-injected via ${c} AndroidManifest.xml`,severity:u.severity,category:"permissions",file:`node_modules/${c}/android/src/main/AndroidManifest.xml`,recommendation:`Add "${d}" to blockedPermissions if not needed.`,autoFixable:!0}))}let s=o?.ios?.infoPlist||{};for(let[c,d]of Object.entries(Ns))c in s&&i.push({id:`PERM-${String(n++).padStart(3,"0")}`,title:`iOS: ${c} declared`,description:d.description,severity:d.severity,category:"permissions",file:"app.config.ts",recommendation:`Remove ${c} from infoPlist if the app does not use this capability.`});return{category:"permissions",label:"Permission Audit",findings:i,durationMs:0}}import Ii from"fs";import jt from"path";var xs=[{id:"SEC-001",pattern:/(['"`])(?:sk|pk)_(?:live|test)_[a-zA-Z0-9]{20,}\1/g,severity:"critical",label:"Stripe API Key"},{id:"SEC-002",pattern:/(['"`])AIza[0-9A-Za-z\-_]{35}\1/g,severity:"high",label:"Google API Key"},{id:"SEC-003",pattern:/(['"`])AKIA[0-9A-Z]{16}\1/g,severity:"critical",label:"AWS Access Key ID"},{id:"SEC-004",pattern:/-----BEGIN (?:RSA |EC )?PRIVATE KEY-----/g,severity:"critical",label:"Private key in source"},{id:"SEC-005",pattern:/(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{36,}/g,severity:"high",label:"GitHub Token"},{id:"SEC-006",pattern:/xox[bpors]-[a-zA-Z0-9-]{10,}/g,severity:"high",label:"Slack Token"},{id:"SEC-007",pattern:/(?:password|secret|apikey|api_key)\s*[:=]\s*['"`][^'"`\n]{8,}['"`]/gi,severity:"high",label:"Hardcoded credential"}],Ls=new Set([".ts",".tsx",".js",".jsx"]),Ms=new Set(["node_modules",".expo",".git","android","ios","dist","build","__tests__","__mocks__"]);function Bn(e){let t=[],i=Ii.readdirSync(e,{withFileTypes:!0});for(let n of i){if(Ms.has(n.name))continue;let o=jt.join(e,n.name);n.isDirectory()?t.push(...Bn(o)):Ls.has(jt.extname(n.name))&&t.push(o)}return t}function Us(e){let t=e.trim();return t.startsWith("//")||t.startsWith("*")||t.startsWith("/*")}function Fs(e){return/process\.env\./i.test(e)||/import\.meta\.env/i.test(e)}async function Gn(e,t){let i=[],n=jt.join(e,"src"),o=Ii.existsSync(n)?n:e,r=Bn(o);for(let a of r){let s=Ii.readFileSync(a,"utf-8").split(`
-`),c=jt.relative(e,a);for(let d=0;d<s.length;d++){let u=s[d];if(!Us(u)&&!Fs(u))for(let{id:p,pattern:f,severity:y,label:D}of xs)f.lastIndex=0,f.test(u)&&i.push({id:p,title:D,description:`Potential ${D.toLowerCase()} found in source code`,severity:y,category:"secrets",file:c,line:d+1,recommendation:`Move to environment variables or a secrets manager. Use \`${m.nameLower} env set\` for managed secrets.`})}}return{category:"secrets",label:"Secrets Detection",findings:i,durationMs:0}}import{execSync as Hs}from"child_process";var Bs={critical:"critical",high:"high",moderate:"medium",low:"low",info:"info"};async function jn(e,t){let i=[],n=1,o;try{o=Hs("npm audit --json 2>/dev/null",{cwd:e,encoding:"utf-8",timeout:6e4})}catch(l){if(o=l.stdout||"",!o)return{category:"dependencies",label:"Dependency CVEs",findings:[],durationMs:0,error:"Failed to run npm audit. Ensure npm is available and dependencies are installed."}}let r;try{r=JSON.parse(o)}catch{return{category:"dependencies",label:"Dependency CVEs",findings:[],durationMs:0,error:"Failed to parse npm audit output."}}let a=r.vulnerabilities||{};for(let[l,s]of Object.entries(a)){let c=Bs[s.severity]||"info",d=Array.isArray(s.via)?s.via.map(u=>typeof u=="string"?u:u.title||u.name).join(", "):String(s.via);i.push({id:`DEP-${String(n++).padStart(3,"0")}`,title:`${l} \u2014 ${s.severity}`,description:`Via: ${d}. Range: ${s.range||"unknown"}`,severity:c,category:"dependencies",recommendation:s.fixAvailable?`Run \`npm audit fix\` or update ${l} to a patched version.`:"No fix available yet. Monitor for updates or evaluate alternatives.",autoFixable:!!s.fixAvailable})}return{category:"dependencies",label:"Dependency CVEs",findings:i,durationMs:0}}import Kt from"fs";import Vt from"path";var Gs=/(?:token|password|credential|secret|apiKey|api_key|session|auth|jwt|refresh_token|access_token|private_key|pin|otp)/i,Kn=/AsyncStorage\s*\.\s*(?:setItem|mergeItem)\s*\(\s*['"`]([^'"`]+)['"`]/g,js=/from\s+['"]@react-native-async-storage\/async-storage['"]|from\s+['"]react-native['"].*AsyncStorage/,Ks=new Set([".ts",".tsx",".js",".jsx"]),Vs=new Set(["node_modules",".expo",".git","android","ios","dist","build"]);function Vn(e){let t=[];if(!Kt.existsSync(e))return t;let i=Kt.readdirSync(e,{withFileTypes:!0});for(let n of i){if(Vs.has(n.name))continue;let o=Vt.join(e,n.name);n.isDirectory()?t.push(...Vn(o)):Ks.has(Vt.extname(n.name))&&t.push(o)}return t}async function zn(e,t){let i=[],n=1,o=Vt.join(e,"src"),r=Kt.existsSync(o)?o:e,a=Vn(r);for(let l of a){let s=Kt.readFileSync(l,"utf-8");if(!js.test(s))continue;let c=s.split(`
-`),d=Vt.relative(e,l);for(let u=0;u<c.length;u++){let p=c[u];Kn.lastIndex=0;let f;for(;(f=Kn.exec(p))!==null;){let y=f[1];Gs.test(y)&&i.push({id:`STOR-${String(n++).padStart(3,"0")}`,title:`AsyncStorage used for "${y}"`,description:`Sensitive data key "${y}" stored in AsyncStorage (unencrypted).`,severity:"high",category:"storage",file:d,line:u+1,recommendation:"Use expo-secure-store (SecureStore) for sensitive data instead of AsyncStorage."})}}}return{category:"storage",label:"Insecure Storage",findings:i,durationMs:0}}import zt from"fs";import Wt from"path";var Wn=/['"`](http:\/\/(?!localhost|127\.0\.0\.1|10\.|192\.168\.|0\.0\.0\.0|172\.(?:1[6-9]|2\d|3[01])\.)[^'"`\s]+)['"`]/g,zs=/\/api\/|\/v[0-9]+\/|\/graphql|\/rest\//i,Ws=new Set([".ts",".tsx",".js",".jsx"]),Ys=new Set(["node_modules",".expo",".git","android","ios","dist","build","__tests__","__mocks__"]);function Yn(e){let t=[];if(!zt.existsSync(e))return t;let i=zt.readdirSync(e,{withFileTypes:!0});for(let n of i){if(Ys.has(n.name))continue;let o=Wt.join(e,n.name);n.isDirectory()?t.push(...Yn(o)):Ws.has(Wt.extname(n.name))&&t.push(o)}return t}async function Jn(e,t){let i=[],n=1,o=Wt.join(e,"src"),r=zt.existsSync(o)?o:e,a=Yn(r);for(let l of a){let c=zt.readFileSync(l,"utf-8").split(`
-`),d=Wt.relative(e,l);for(let u=0;u<c.length;u++){let p=c[u],f=p.trim();if(f.startsWith("//")||f.startsWith("*"))continue;Wn.lastIndex=0;let y;for(;(y=Wn.exec(p))!==null;){let D=y[1],$=zs.test(D);i.push({id:`NET-${String(n++).padStart(3,"0")}`,title:`Insecure HTTP URL${$?" (API endpoint)":""}`,description:`Plain HTTP URL found: ${D}`,severity:$?"high":"medium",category:"network",file:d,line:u+1,recommendation:"Use HTTPS instead of HTTP for all network requests."})}}}return{category:"network",label:"HTTP URLs",findings:i,durationMs:0}}import Yt from"fs";import Jt from"path";var Xn=/(?:debug|debugMode|devMode|enableDebug)\s*[:=]\s*true/gi,qn=/console\.(?:log|warn|info|debug)\s*\([^)]*(?:token|password|secret|credential|key|auth)/gi,Js=new Set([".ts",".tsx",".js",".jsx"]),Xs=new Set(["node_modules",".expo",".git","android","ios","dist","build","__tests__","__mocks__"]);function Zn(e){let t=[];if(!Yt.existsSync(e))return t;let i=Yt.readdirSync(e,{withFileTypes:!0});for(let n of i){if(Xs.has(n.name))continue;let o=Jt.join(e,n.name);n.isDirectory()?t.push(...Zn(o)):Js.has(Jt.extname(n.name))&&t.push(o)}return t}async function Qn(e,t){let i=[],n=1,o=Jt.join(e,"src"),r=Yt.existsSync(o)?o:e,a=Zn(r);for(let l of a){let c=Yt.readFileSync(l,"utf-8").split(`
-`),d=Jt.relative(e,l);for(let u=0;u<c.length;u++){let p=c[u],f=p.trim();if(!(f.startsWith("//")||f.startsWith("*"))&&(Xn.lastIndex=0,Xn.test(p)&&i.push({id:`DBG-${String(n++).padStart(3,"0")}`,title:"Hardcoded debug flag",description:"Debug/dev mode enabled in source code",severity:"medium",category:"debug",file:d,line:u+1,recommendation:"Use __DEV__ or environment variables instead of hardcoded debug flags."}),qn.lastIndex=0,qn.test(p))){let y=c.slice(Math.max(0,u-3),u).join(`
-`);/__DEV__/.test(y)||i.push({id:`DBG-${String(n++).padStart(3,"0")}`,title:"Sensitive data in console log",description:"Console log may expose sensitive data (token, password, etc.) in production",severity:"medium",category:"debug",file:d,line:u+1,recommendation:"Wrap in __DEV__ check or remove sensitive data from console output."})}}}return{category:"debug",label:"Debug/Dev Flags",findings:i,durationMs:0}}import eo from"fs";import Pi from"path";var qs=new Set(["androidx.work.impl.background.systemjob.SystemJobService","androidx.work.impl.diagnostics.DiagnosticsReceiver","com.google.firebase.iid.FirebaseInstanceIdReceiver","com.google.android.gms.auth.api.signin.RevocationBoundService","androidx.profileinstaller.ProfileInstallReceiver","com.google.firebase.messaging.FirebaseMessagingService","com.google.android.gms.measurement.AppMeasurementService","com.google.android.gms.measurement.AppMeasurementJobService"]);function Zs(e){let t=[Pi.join(e,"android","app","src","main","AndroidManifest.xml"),Pi.join(e,"android","AndroidManifest.xml")];for(let i of t)if(eo.existsSync(i))return i;return null}async function to(e,t){let i=[],n=1,o=Zs(e);if(!o)return{category:"manifest",label:"Android Manifest",findings:[],durationMs:0,error:"No AndroidManifest.xml found. Run with --prebuild or run `expo prebuild` first."};let r=eo.readFileSync(o,"utf-8"),a=Pi.relative(e,o),l=/<(activity|service|receiver|provider)\s+([^>]*?)(?:\/>|>)/gs,s;for(;(s=l.exec(r))!==null;){let c=s[1],d=s[2],p=d.match(/android:name="([^"]+)"/)?.[1]||"unknown";if(qs.has(p))continue;let f=/android:exported="true"/.test(d),y=/android:permission="/.test(d);f&&!y&&i.push({id:`MAN-${String(n++).padStart(3,"0")}`,title:`Exported ${c}: ${p.split(".").pop()}`,description:`${p} is exported=true without android:permission protection`,severity:"medium",category:"manifest",file:a,recommendation:'Set android:exported="false" or add an android:permission attribute.'})}return/android:allowBackup="true"/.test(r)&&i.push({id:`MAN-${String(n++).padStart(3,"0")}`,title:"allowBackup is enabled",description:'android:allowBackup="true" allows data extraction via ADB backup',severity:"medium",category:"manifest",file:a,recommendation:'Set android:allowBackup="false" via expo-build-properties plugin.',autoFixable:!0}),/android:debuggable="true"/.test(r)&&i.push({id:`MAN-${String(n++).padStart(3,"0")}`,title:"App is debuggable",description:'android:debuggable="true" allows attaching a debugger in production',severity:"critical",category:"manifest",file:a,recommendation:"Ensure debuggable is false for production builds. This is usually set automatically for release builds."}),{category:"manifest",label:"Android Manifest",findings:i,durationMs:0}}import Xt from"fs";import $i from"path";function Qs(e){let t=$i.join(e,"ios");if(!Xt.existsSync(t))return null;let i=Xt.readdirSync(t,{withFileTypes:!0});for(let n of i){if(!n.isDirectory()||n.name==="Pods"||n.name.startsWith("."))continue;let o=$i.join(t,n.name,"Info.plist");if(Xt.existsSync(o))return o}return null}async function io(e,t){let i=[],n=1,o=Qs(e);if(!o)return{category:"ats",label:"iOS ATS Config",findings:[],durationMs:0,error:"No Info.plist found. Run with --prebuild or run `expo prebuild` first."};let r=Xt.readFileSync(o,"utf-8"),a=$i.relative(e,o),l=r.match(/<key>NSAppTransportSecurity<\/key>\s*<dict>([\s\S]*?)<\/dict>/);if(l){let s=l[1];/<key>NSAllowsArbitraryLoads<\/key>\s*<true\s*\/>/.test(s)&&i.push({id:`ATS-${String(n++).padStart(3,"0")}`,title:"ATS disabled \u2014 NSAllowsArbitraryLoads",description:"App Transport Security is completely disabled. All HTTP connections are allowed.",severity:"critical",category:"ats",file:a,recommendation:"Remove NSAllowsArbitraryLoads or set to false. Use domain-specific exceptions only if absolutely necessary."});let c=s.match(/<key>NSExceptionDomains<\/key>\s*<dict>([\s\S]*?)<\/dict>/);if(c){let d=c[1].match(/<key>([^<]+)<\/key>/g);if(d)for(let u of d){let p=u.replace(/<\/?key>/g,"");p!=="NSExceptionDomains"&&i.push({id:`ATS-${String(n++).padStart(3,"0")}`,title:`ATS exception: ${p}`,description:`ATS exception configured for ${p}`,severity:"low",category:"ats",file:a,recommendation:`Verify that the ATS exception for ${p} is necessary. Use HTTPS where possible.`})}}}return{category:"ats",label:"iOS ATS Config",findings:i,durationMs:0}}var ta=[{category:"permissions",label:"Permission Audit",fn:Hn,requiresPrebuild:!1},{category:"secrets",label:"Secrets Detection",fn:Gn,requiresPrebuild:!1},{category:"dependencies",label:"Dependency CVEs",fn:jn,requiresPrebuild:!1},{category:"storage",label:"Insecure Storage",fn:zn,requiresPrebuild:!1},{category:"network",label:"HTTP URLs",fn:Jn,requiresPrebuild:!1},{category:"debug",label:"Debug/Dev Flags",fn:Qn,requiresPrebuild:!1},{category:"manifest",label:"Android Manifest",fn:to,requiresPrebuild:!0},{category:"ats",label:"iOS ATS Config",fn:io,requiresPrebuild:!0}];async function so(e,t){let i=ta;t.category&&(i=i.filter(a=>a.category===t.category),i.length===0&&(wt.error(ye.red(`Unknown category: ${t.category}`)),wt.info(ye.dim(`Available: ${Object.values(we).join(", ")}`)),process.exit(1)));let n=i.filter(a=>!a.requiresPrebuild),o=i.filter(a=>a.requiresPrebuild),r=[];for(let a of n){let l=no();l.start(ye.dim(`Running ${a.label}...`));try{let s=Date.now(),c=await a.fn(e,t);c.durationMs=Date.now()-s,r.push(c);let d=c.findings.length;l.stop(d>0?ye.yellow(`${a.label} \u2014 ${d} finding(s)`):ye.green(`${a.label} \u2014 clean`))}catch(s){l.stop(ye.red(`${a.label} \u2014 error`)),r.push({category:a.category,label:a.label,findings:[],durationMs:0,error:s.message})}}if(o.length>0){let a=ro.join(e,"android"),l=ro.join(e,"ios"),s=oo.existsSync(a)||oo.existsSync(l);if(!s&&t.prebuild){t.json||wt.info(ye.dim(`
-Running expo prebuild for deeper analysis...`));try{ea("npx expo prebuild --no-install",{cwd:e,stdio:"pipe"})}catch{return wt.warn(ye.yellow("Prebuild failed \u2014 skipping manifest/plist checks.")),r}}else if(!s)return t.json||wt.info(ye.dim(`
-Skipping manifest/plist checks \u2014 no android/ios dirs. Use --prebuild to generate them.`)),r;for(let c of o){let d=no();d.start(ye.dim(`Running ${c.label}...`));try{let u=Date.now(),p=await c.fn(e,t);p.durationMs=Date.now()-u,r.push(p);let f=p.findings.length;d.stop(f>0?ye.yellow(`${c.label} \u2014 ${f} finding(s)`):ye.green(`${c.label} \u2014 clean`))}catch(u){d.stop(ye.red(`${c.label} \u2014 error`)),r.push({category:c.category,label:c.label,findings:[],durationMs:0,error:u.message})}}}return r}import oe from"chalk";import{log as ie}from"@clack/prompts";var lt={critical:oe.bgRed.white.bold,high:oe.red.bold,medium:oe.yellow.bold,low:oe.blue,info:oe.dim},qt={critical:0,high:1,medium:2,low:3,info:4};function ia(e,t){if(!t)return!0;let i=qt[t];return i===void 0?!0:qt[e]<=i}function ao(e,t){let i=0,n={critical:0,high:0,medium:0,low:0,info:0};for(let a of e){let l=a.findings.filter(c=>ia(c.severity,t));if(l.length===0&&!a.error)continue;if(ie.info(""),ie.info(oe.bold(`  ${a.label}`)+oe.dim(`  ${l.length} finding(s)`)),ie.info(oe.dim("  "+"\u2500".repeat(60))),a.error){ie.error(oe.red(`  Error: ${a.error}`));continue}let s=[...l].sort((c,d)=>qt[c.severity]-qt[d.severity]);for(let c of s){let d=lt[c.severity](` ${c.severity.toUpperCase()} `);ie.info(`  ${d}  ${oe.bold(c.id)}  ${c.title}`),ie.info(oe.dim(`          ${c.description}`)),c.file&&ie.info(oe.dim(`          File: ${c.file}${c.line?`:${c.line}`:""}`)),ie.info(oe.cyan(`          Fix: ${c.recommendation}`)),ie.info(""),n[c.severity]++,i++}}ie.info(""),ie.info(oe.bold("  Summary")),ie.info(oe.dim("  "+"\u2500".repeat(60))),ie.info(`  Total: ${oe.bold(String(i))} finding(s)`),ie.info(`  ${lt.critical(` ${n.critical} Critical `)}  ${lt.high(` ${n.high} High `)}  ${lt.medium(` ${n.medium} Medium `)}  ${lt.low(` ${n.low} Low `)}  ${lt.info(` ${n.info} Info `)}`);let o=n.critical>0,r=n.high>0;o||r?(ie.info(""),ie.error(oe.red.bold(`  FAIL \u2014 ${n.critical} critical, ${n.high} high issue(s) found`))):i>0?(ie.info(""),ie.warn(oe.yellow("  PASS (with warnings) \u2014 no critical or high issues"))):(ie.info(""),ie.success(oe.green.bold("  PASS \u2014 no issues found")))}function lo(e,t){let i=e.flatMap(o=>o.findings),n={};for(let o of Object.values(be))n[o]=i.filter(r=>r.severity===o).length;return{version:"1.0.0",timestamp:new Date().toISOString(),project:t.name||"unknown",projectVersion:t.version||"0.0.0",summary:{total:i.length,...n},passed:n.critical===0&&n.high===0,checks:e.map(o=>({category:o.category,label:o.label,findingCount:o.findings.length,durationMs:o.durationMs,error:o.error||null})),findings:i}}import{log as ne,spinner as na}from"@clack/prompts";import Z from"chalk";import Be from"fs";import oa from"os";import ct from"path";import{execSync as ra}from"child_process";var co=16384,sa=1,aa=Buffer.from([127,69,76,70]);async function uo(e){ne.info(Z.bold.underline("16KB Page Alignment Check")),console.log("");let t=ct.resolve(e);if(!Be.existsSync(t))return ne.error(Z.red(`APK file not found: ${t}`)),!1;if(!t.endsWith(".apk"))return ne.error(Z.red("The provided file is not an APK file.")),!1;let i=na();i.start("Extracting and analyzing native libraries...");let n=Be.mkdtempSync(ct.join(oa.tmpdir(),"mach-16kb-"));try{try{ra(`unzip -o -q "${t}" "lib/arm64-v8a/*.so" "lib/x86_64/*.so" -d "${n}" 2>/dev/null`,{encoding:"utf-8",maxBuffer:50*1024*1024})}catch{}let o=po(ct.join(n,"lib"));if(o.length===0)return i.stop("Analysis complete."),ne.info(Z.yellow("No arm64-v8a or x86_64 native libraries found in the APK.")),ne.info(Z.dim("16KB alignment check only applies to arm64-v8a and x86_64 architectures.")),!0;let r=[];for(let s of o){let c=ct.relative(n,s),d=ca(c),u=ct.basename(s),p=la(s);p!==null&&r.push({name:u,filePath:c,arch:d,align:p,compatible:p>=co})}if(i.stop("Analysis complete."),r.length===0)return ne.info(Z.yellow("No valid ELF shared libraries found.")),!0;let a=r.filter(s=>!s.compatible),l=r.filter(s=>s.compatible);if(ne.info(Z.dim(`Checked ${r.length} native librar${r.length===1?"y":"ies"}
-`)),a.length>0){ne.info(Z.red.bold(`Incompatible libraries:
-`));for(let s of a)ne.error(Z.red(`${Z.bold(s.name)} ${Z.dim(`(${s.arch})`)}`)),ne.info(Z.dim(`  PT_LOAD alignment: 2**${Math.log2(s.align)} (${s.align} bytes, needs 2**14 = ${co})`))}return l.length>0&&(console.log(""),ne.success(Z.green(`${l.length} librar${l.length===1?"y":"ies"} correctly aligned (2**14 or higher).`))),console.log(""),a.length===0?(ne.success(Z.green.bold("ELF Verification Successful. APK is 16KB compatible.")),!0):(ne.error(Z.red.bold(`Found ${a.length} unaligned lib${a.length===1?"":"s"} (arm64-v8a/x86_64 libs need to be aligned).`)),console.log(""),ne.info(Z.yellow("To fix this:")),ne.info(Z.dim("  1. Rebuild with NDK r28+ which defaults to 16KB page alignment")),ne.info(Z.dim("  2. Or set -DANDROID_SUPPORT_FLEXIBLE_PAGE_SIZES=ON in CMake")),ne.info(Z.dim("  3. Update third-party libraries that ship prebuilt .so files")),ne.info(Z.dim("  4. After rebuilding: zipalign -p -f -v 16 input.apk output.apk")),console.log(""),ne.info(Z.dim("Reference: https://developer.android.com/guide/practices/page-sizes")),!1)}catch(o){return i.stop("Analysis failed."),ne.error(Z.red(`Failed to analyze APK: ${o.message}`)),!1}finally{try{Be.rmSync(n,{recursive:!0,force:!0})}catch{}}}function la(e){let t=Be.openSync(e,"r");try{let i=Buffer.alloc(64);if(Be.readSync(t,i,0,64,0),!i.subarray(0,4).equals(aa))return null;let n=i[4]===2,o=i[5]===1,r=(p,f)=>o?p.readUInt16LE(f):p.readUInt16BE(f),a=(p,f)=>o?p.readUInt32LE(f):p.readUInt32BE(f),l=(p,f)=>Number(o?p.readBigUInt64LE(f):p.readBigUInt64BE(f)),s,c,d;n?(s=l(i,32),c=r(i,54),d=r(i,56)):(s=a(i,28),c=r(i,42),d=r(i,44));let u=null;for(let p=0;p<d;p++){let f=Buffer.alloc(c);if(Be.readSync(t,f,0,c,s+p*c),a(f,0)!==sa)continue;let D;n?D=l(f,48):D=a(f,28),D>0&&(u===null||D<u)&&(u=D)}return u??0}catch{return null}finally{Be.closeSync(t)}}function po(e){let t=[];if(!Be.existsSync(e))return t;let i=Be.readdirSync(e,{withFileTypes:!0});for(let n of i){let o=ct.join(e,n.name);n.isDirectory()?t.push(...po(o)):n.name.endsWith(".so")&&t.push(o)}return t}function ca(e){return e.includes("arm64-v8a")?"arm64-v8a":e.includes("x86_64")?"x86_64":"unknown"}var go=async e=>{if(ge()||(_e.error(Oe.red(`You are not logged in. Run \`${m.nameLower} login\` first.`)),process.exit(1)),e.apk){await pa(e);return}let i=process.cwd(),n=Zt.join(i,"package.json");Ot.existsSync(n)||(_e.error(Oe.red("No package.json found. Run this command from a project root.")),process.exit(1));let o=JSON.parse(Ot.readFileSync(n,"utf-8")),r=!!(o.dependencies?.expo||o.devDependencies?.expo);e.json||(_e.info(Oe.dim(`Project: ${o.name||"unknown"} v${o.version||"0.0.0"}`)),_e.info(Oe.dim(`Type: ${r?"Expo":"Bare React Native"}`)),_e.info(""));let a={json:e.json,fix:e.fix,category:e.category,severity:e.severity,prebuild:e.prebuild},l=await so(i,a);e.json?console.log(JSON.stringify(lo(l,o),null,2)):ao(l,e.severity);let s=l.some(d=>d.findings.some(u=>u.severity==="critical")),c=l.some(d=>d.findings.some(u=>u.severity==="high"));(s||c)&&process.exit(1)},fo=["16kb"];async function pa(e){let t=e.category?.toLowerCase();t&&!fo.includes(t)&&(_e.error(Oe.red(`Unknown APK check category: "${t}"`)),_e.info(Oe.dim(`Available APK checks: ${fo.join(", ")}`)),process.exit(1));let i=await fa(e.apk);i||process.exit(1);let n=!t,o=!1;(n||t==="16kb")&&(await uo(i)||(o=!0)),o&&process.exit(1)}async function fa(e){if(e.startsWith("build:")){let i=e.slice(6);return await ma(i)}if(e.startsWith("http://")||e.startsWith("https://"))return await ho(e);let t=Zt.resolve(e);return Ot.existsSync(t)?t:(_e.error(Oe.red(`APK file not found: ${t}`)),null)}async function ma(e){let t=mo();t.start(`Fetching APK from build ${e}...`);try{let i=await v.get(`/build/${e}`);if(i.data.status!=="success")throw new Error(i.data.message);let n=i.data.build;if(!n)throw new Error("Build not found");let o=n.artifacts?.find(r=>r.type?r.type==="apk":r.name?.endsWith(".apk")||r.url?.includes(".apk"));return!o||!o.url?(t.stop("No APK artifact found"),_e.error(Oe.red("This build does not have an APK artifact.")),_e.info(Oe.dim("Make sure the build produced an APK (not just an AAB).")),null):(t.stop(`Found build: ${n.buildId||e}`),await ho(o.url))}catch(i){return t.stop("Failed to fetch build"),_e.error(Oe.red(i.message)),null}}async function ho(e){let t=mo();t.start("Downloading APK...");try{let i=Ot.mkdtempSync(Zt.join(da.tmpdir(),`${m.nameLower}-audit-`)),n=Zt.join(i,"app.apk"),o=await ua.get(e,{responseType:"arraybuffer"});Ot.writeFileSync(n,o.data);let r=(o.data.length/(1024*1024)).toFixed(1);return t.stop(`Downloaded APK (${r} MB)`),n}catch(i){return t.stop("Download failed"),_e.error(Oe.red(`Failed to download APK: ${i.message}`)),null}}var ya=console.log;console.log=()=>{};ha();console.log=ya;ue(se.bgCyan.black(m.cliTag("Production Build Orchestrator")));var Ea=Sa(import.meta.url),Aa=Ea("../package.json"),V=new ga;V.name(m.nameLower).description(`${m.name} CLI: Powerful Cloud Infrastructure Tools`).version(Aa.version).option("-y, --yes","Automatically answer yes to all prompts",!1).option("--quiet","Suppress non-essential output",!1);V.command("agent").description("Start local device discovery agent for the Install Hub (port 7070)").action(async()=>{await fn()});V.command("host").description("Setup AWS S3 static hosting and CloudFront").action(async()=>{ue(se.bgCyan.black(m.cliTag("Hosting"))),await Ti()});V.command("sitemap").description("Generate sitemap.xml from Expo Router app structure").option("-o, --output <path>","Output path for sitemap.xml","./public/sitemap.xml").action(async e=>{ue(se.bgCyan.black(m.cliTag("Sitemap Generator"))),await Mi(e)});V.command("build").description("Run a build on a cloud provider (AWS Spot Instances)").argument("[platform]","Target platform (android, ios)").option("--platform <os>","Target platform alias (android, ios) [Optional]").option("--repo <url>","Git Repository URL").option("--branch <name>","Git Branch").option("--ami <id>","AMI ID").option("--bucket <name>","S3 Bucket for artifacts").option("--region <region>","AWS Region").option("--aws-profile <name>","AWS Credentials Profile").option("-p, --build-profile <name>","Build Profile (e.g. production, staging)","production").option("--profile <name>","Build Profile (alias for --build-profile)").option("--dry-run","Generate User Data script without launching").option("--keep-instance","Do not terminate the instance after build").option("--subnet <id>","VPC Subnet ID to launch the instance in").option("--security-group <id>","VPC Security Group ID to use").option("--ssh-host <host>","Remote host for iOS build (SSH)").option("--ssh-user <user>","SSH username for remote host").option("--ssh-key <path>","Path to private SSH key for remote host").option("--ios-scheme <scheme>","iOS Scheme to build").option("--ios-team-id <id>","Apple Development Team ID").option("--ios-configuration <config>","Xcode configuration (Release/Debug)").option("--ios-export-method <method>","Export method (ad-hoc, app-store, development, enterprise)").option("--ios-api-key-id <id>","App Store Connect API Key ID").option("--ios-api-key-issuer <id>","App Store Connect API Key Issuer ID").option("--ios-api-key-path <path>","Path to App Store Connect API Key (.p8) file").option("--simulator","Build for iOS Simulator (no signing required)").addOption(new yo("--build-id <id>","Internal build ID").hideHelp()).addOption(new yo("--project-id <id>","Internal project ID").hideHelp()).option("--local","Run build on local machine").option("--auto-version","Automatically fetch and increment versionCode from Google Play").option("--verbose","Enable verbose logging").option("--json-output <path>","Write build metadata JSON to a file for CI/CD").option("--maestro","Queue a managed Maestro test run after a successful build").option("--maestro-flows <path>","Maestro flow file or directory (default: .maestro)").option("--maestro-device <device>","Managed Maestro device profile").option("--maestro-retries <n>","Retries for the Maestro run","1").option("--maestro-record","Enable screen recording where supported").option("-y, --yes","Automatically answer yes to all prompts",!1).option("--quiet","Suppress non-essential output",!1).action(async(e,t)=>{let i=V.opts();t.yes=t.yes||i.yes,t.quiet=t.quiet||i.quiet,t.platform=e||t.platform,t.buildProfile=t.profile||t.buildProfile,t.quiet||ue(se.bgCyan.black(m.cliTag("Cloud Build"))),await Mt(t)});V.command("maestro").description("Run managed Maestro tests for an existing Mach build or artifact").option("--platform <os>","Target platform (android/ios)").option("-p, --profile <name>","Build profile to resolve when using --latest","production").option("--latest","Use the latest successful build for the platform/profile").option("--build-id <id>","Use a specific Mach build ID").option("--build-url <url>","Use a Mach build URL").option("--artifact-url <url>","Use a direct APK or iOS simulator app artifact URL").option("--maestro-flows <path>","Maestro flow file or directory (default: .maestro)").option("--maestro-device <device>","Managed Maestro device profile").option("--maestro-retries <n>","Retries for the Maestro run","1").option("--maestro-record","Enable screen recording where supported").option("--json-output <path>","Write test run metadata JSON to a file for CI/CD").action(async e=>{ue(se.bgCyan.black(m.cliTag("Maestro Testing"))),await on(e)});V.command("update").description("Deploy an Over-The-Air (OTA) update to your live channel").option("--branch <name>","Channel or Branch to deploy to (e.g., production)","production").action(async e=>{ue(se.bgCyan.black(m.cliTag("OTA Update"))),await Cn(e)});V.command("submit").description("Automated Store Submission (App Store / Google Play)").option("--platform <os>","Target platform (ios/android)").option("-p, --profile <name>","Build/submission profile to submit from (e.g. production, preprod)").option("--track <track>","Google Play Track (internal, alpha, beta, production)").option("--release-status <status>","Google Play release status (completed, draft, halted, inProgress)").option("--rollout <fraction>","Google Play staged rollout fraction for inProgress releases (example: 0.1)").option("--changes-not-sent-for-review","Commit Google Play changes without automatically sending them for review").option("--ssh-host <host>","Remote macOS host for iOS submission").option("--ssh-user <user>","SSH username for remote iOS submission").option("--ssh-key <path>","Path to private SSH key for remote iOS submission").option("--latest","Use the latest successful build for submission").option("--build-id <id>","Use a specific build ID for submission").action(async e=>{ue(se.bgCyan.black(m.cliTag("Store Submission"))),await vn(e)});V.command("login").description(`Login to ${m.name} Dashboard`).action(async()=>{ue(se.bgCyan.black(m.cliTag("Login"))),await yn()});V.command("link").description(`Link local directory to a ${m.name} Project`).action(async()=>{ue(se.bgCyan.black(m.cliTag("Link Project"))),await En()});V.command("me").description("Display currently logged in user details").action(async()=>{await Tn()});V.command("init").description(`Create a new ${m.name} Project`).action(async()=>{ue(se.bgCyan.black(m.cliTag("Init Project"))),await An()});V.command("env").description("Manage Environment Variables").argument("<action>","Action to perform: set or list").argument("[args...]","Key=Value pairs for set action").action(async(e,t)=>{ue(se.bgCyan.black(m.cliTag("Env Manager"))),await In(e,t)});V.command("start").description("Start the development server (Metro)").option("-p, --build-profile <name>","Build profile (e.g. development, staging)","development").option("--tunnel","Use ngrok tunnel").option("--lan","Use LAN IP").option("--localhost","Use localhost").option("-c, --clear","Clear Metro cache").option("--port <number>","Port to listen on").option("--ios","Start on iOS").option("--android","Start on Android").option("--web","Start on Web").action(async e=>{ue(se.bgCyan.black(m.cliTag("Dev Server"))),await xn(e)});V.command("config").description("Show resolved configuration for a profile").option("-p, --profile <name>","Build profile to resolve","development").option("--json","Output as JSON").action(async e=>{await Ln(e)});V.command("credentials").description("Unified, interactive credential management (iOS/Android)").option("-p, --profile <name>","Build profile (production, staging, development)").option("--force","Force recreate certificates (nuke existing on Apple Portal)",!1).action(async e=>{let{credentialsMainCommand:t}=await import("./credentials-UTJERDGT.js");await t(e)});V.command("credentials:setup").description("Automated credential provisioning (iOS/Android) [Legacy]").requiredOption("--platform <os>","Platform: ios or android").option("--profile <name>","Build profile (production, staging, development)").option("--bundle-id <id>","Bundle ID / Package Name (optional, auto-detected)").option("--team-id <id>","Apple Team ID (iOS only)").option("--key-alias <alias>","Android keystore alias (optional, auto-generated)").option("--aws-profile <name>","AWS Credentials Profile (for S3 storage)").option("--force","Force recreate certificates (nuke existing on Apple Portal)",!1).action(async e=>{ue(se.bgCyan.black(m.cliTag("Credentials Setup"))),await pt(e),So(se.green("Done!"))});V.command("credentials:service").description("Upload Service Credentials (ASC API Key / Google Service JSON) [Legacy]").requiredOption("--platform <os>","Platform: ios or android").option("--file <path>","Path to credential file (.p8 or .json)").option("--issuer-id <id>","ASC API Key Issuer ID (iOS only)").option("--key-id <id>","ASC API Key ID (iOS only)").option("--bundle-id <id>","Bundle identifier / Android package name to attach this service credential to").option("--package-name <name>","Android package name to attach this service credential to").option("-p, --profile <name>","Build profile to resolve package/bundle identifier from config").action(async e=>{ue(se.bgCyan.black(m.cliTag("Service Credentials"))),await Ci(e),So(se.green("Done!"))});var Di=V.command("device").description("Manage registered iOS test devices");Di.command("register").description("Register a connected iOS device or enter UDID manually").option("--udid <udid>","Device UDID (skip auto-detection)").option("--name <name>","Device name").action(async e=>{await Gt("register",e)});Di.command("list").description("List all registered devices").action(async()=>{await Gt("list",{})});Di.command("remove").description("Remove a registered device").option("--udid <udid>","Device UDID to remove").action(async e=>{await Gt("remove",e)});V.command("audit").description("Run automated security audit on the project or APK").option("--apk <path>","Path to APK file (runs APK diagnostics like 16KB alignment)").option("--json","Output results as JSON (for CI/CD)").option("--fix","Auto-apply fixes where possible").option("--category <name>","Run only a specific check category (e.g. 16kb, permissions, secrets)").option("--severity <level>","Minimum severity to display (critical, high, medium, low, info)").option("--prebuild","Run expo prebuild for deeper manifest/plist analysis").action(async e=>{ue(se.bgCyan.black(m.cliTag(e.apk?"APK Audit":"Security Audit"))),await go(e)});var ba=new Set(["login"]);V.hook("preAction",(e,t)=>{let i=t.name();ba.has(i)||vi()});V.on("command:*",()=>{console.error(`Invalid command: %s
-See --help for a list of available commands.`,V.args.join(" ")),process.exit(1)});process.argv.slice(2).length||V.help();V.parse(process.argv);
+`),"Registered Devices")}catch(t){e.stop(Q.red("Failed to fetch devices")),ve.error(t.response?.data?.message||t.message)}Dt(Q.blue("---"))}async function za(e){let t=e.udid;if(!t){let r=Rt();r.start("Fetching registered devices...");try{let s=(await v.get("/devices")).data.devices||[];if(r.stop(`${s.length} device(s) found`),s.length===0){ve.info(Q.dim("No devices to remove.")),Dt(Q.blue("---"));return}let l=await yr({message:"Select device to remove:",options:s.map(a=>({value:a.udid,label:a.name,hint:a.udid.substring(0,12)+"..."}))});if($t(l)){wt("Cancelled");return}t=l}catch(o){r.stop(Q.red("Failed to fetch devices")),ve.error(o.response?.data?.message||o.message);return}}let i=await Ba({message:`Remove device ${Q.dim(t.substring(0,12)+"...")}?`});if($t(i)||!i){wt("Cancelled");return}let n=Rt();n.start("Removing device...");try{await v.delete(`/devices/${encodeURIComponent(t)}`),n.stop(Q.green("Device removed"))}catch(r){n.stop(Q.red("Failed to remove device")),ve.error(r.response?.data?.message||r.message)}Dt(Q.blue("---"))}async function Xt(e,t){switch(e){case"register":await Ka(t);break;case"list":await Va();break;case"remove":await za(t);break;default:ve.error(`Unknown action: ${e}`)}}import{log as _e,spinner as zr}from"@clack/prompts";import Ce from"chalk";import si from"path";import Ct from"fs";import wl from"os";import Rl from"axios";var Ie=(o=>(o.CRITICAL="critical",o.HIGH="high",o.MEDIUM="medium",o.LOW="low",o.INFO="info",o))(Ie||{}),Oe=(a=>(a.PERMISSIONS="permissions",a.SECRETS="secrets",a.DEPENDENCIES="dependencies",a.STORAGE="storage",a.NETWORK="network",a.DEBUG="debug",a.MANIFEST="manifest",a.ATS="ats",a))(Oe||{});import{spinner as Lr,log as Ot}from"@clack/prompts";import Ee from"chalk";import{execSync as hl}from"child_process";import Ur from"fs";import Mr from"path";import Ye from"fs";import vt from"path";import{execSync as Wa}from"child_process";var Sr={"android.permission.READ_PHONE_STATE":{severity:"high",description:"Can read phone number, IMEI, carrier info"},"android.permission.CALL_PHONE":{severity:"high",description:"Can make calls without user interaction"},"android.permission.SEND_SMS":{severity:"high",description:"Can send SMS without user interaction"},"android.permission.READ_SMS":{severity:"high",description:"Can read user SMS messages"},"android.permission.READ_CONTACTS":{severity:"medium",description:"Can read user contacts"},"android.permission.WRITE_CONTACTS":{severity:"medium",description:"Can modify user contacts"},"android.permission.READ_CALL_LOG":{severity:"high",description:"Can read call history"},"android.permission.CAMERA":{severity:"medium",description:"Camera access"},"android.permission.RECORD_AUDIO":{severity:"medium",description:"Microphone access"},"android.permission.ACCESS_FINE_LOCATION":{severity:"medium",description:"Precise GPS location"},"android.permission.ACCESS_COARSE_LOCATION":{severity:"medium",description:"Approximate location"},"android.permission.ACCESS_BACKGROUND_LOCATION":{severity:"high",description:"Background location tracking"},"android.permission.READ_EXTERNAL_STORAGE":{severity:"medium",description:"Read files on device"},"android.permission.WRITE_EXTERNAL_STORAGE":{severity:"medium",description:"Write files on device"},"android.permission.READ_MEDIA_IMAGES":{severity:"low",description:"Read photos"},"android.permission.READ_MEDIA_VIDEO":{severity:"low",description:"Read videos"},"android.permission.SYSTEM_ALERT_WINDOW":{severity:"high",description:"Draw overlays on other apps"},"android.permission.REQUEST_INSTALL_PACKAGES":{severity:"high",description:"Can install APKs"}},Ya={NSCameraUsageDescription:{severity:"medium",description:"Camera access declared"},NSMicrophoneUsageDescription:{severity:"medium",description:"Microphone access declared"},NSLocationWhenInUseUsageDescription:{severity:"medium",description:"Location (in-use) declared"},NSLocationAlwaysUsageDescription:{severity:"high",description:"Background location declared"},NSContactsUsageDescription:{severity:"medium",description:"Contacts access declared"},NSCalendarsUsageDescription:{severity:"low",description:"Calendar access declared"},NSPhotoLibraryUsageDescription:{severity:"low",description:"Photo library access declared"}};function Ja(e){try{let i=Wa("npx expo config --type introspect --json 2>/dev/null",{cwd:e,encoding:"utf-8",timeout:3e4});return JSON.parse(i)}catch{}let t=vt.join(e,"app.json");if(Ye.existsSync(t))try{let i=JSON.parse(Ye.readFileSync(t,"utf-8"));return i.expo||i}catch{}return null}function Xa(e){let t=[],i=vt.join(e,"node_modules");if(!Ye.existsSync(i))return t;let n=/<uses-permission\s+android:name="([^"]+)"/g;function r(o,s){let l=vt.join(o,"android","src","main","AndroidManifest.xml");if(!Ye.existsSync(l))return;let a=Ye.readFileSync(l,"utf-8"),c;for(;(c=n.exec(a))!==null;)t.push({pkg:s,permission:c[1]});n.lastIndex=0}for(let o of Ye.readdirSync(i)){if(o.startsWith("."))continue;let s=vt.join(i,o);if(o.startsWith("@")){if(!Ye.statSync(s).isDirectory())continue;for(let l of Ye.readdirSync(s))r(vt.join(s,l),`${o}/${l}`)}else r(s,o)}return t}async function Er(e,t){let i=[],n=1,r=Ja(e),o=r?.android?.permissions||[],s=r?.android?.blockedPermissions||[];for(let c of o){let d=Sr[c];d&&i.push({id:`PERM-${String(n++).padStart(3,"0")}`,title:`${c.split(".").pop()} declared`,description:d.description,severity:d.severity,category:"permissions",file:"app.config.ts",recommendation:"Remove from permissions if not needed, or add justification."})}let l=Xa(e);for(let{pkg:c,permission:d}of l){let u=Sr[d];u&&(s.includes(d)||o.includes(d)||i.push({id:`PERM-${String(n++).padStart(3,"0")}`,title:`${d.split(".").pop()} injected by ${c}`,description:`${u.description}. Auto-injected via ${c} AndroidManifest.xml`,severity:u.severity,category:"permissions",file:`node_modules/${c}/android/src/main/AndroidManifest.xml`,recommendation:`Add "${d}" to blockedPermissions if not needed.`,autoFixable:!0}))}let a=r?.ios?.infoPlist||{};for(let[c,d]of Object.entries(Ya))c in a&&i.push({id:`PERM-${String(n++).padStart(3,"0")}`,title:`iOS: ${c} declared`,description:d.description,severity:d.severity,category:"permissions",file:"app.config.ts",recommendation:`Remove ${c} from infoPlist if the app does not use this capability.`});return{category:"permissions",label:"Permission Audit",findings:i,durationMs:0}}import Fi from"fs";import qt from"path";var qa=[{id:"SEC-001",pattern:/(['"`])(?:sk|pk)_(?:live|test)_[a-zA-Z0-9]{20,}\1/g,severity:"critical",label:"Stripe API Key"},{id:"SEC-002",pattern:/(['"`])AIza[0-9A-Za-z\-_]{35}\1/g,severity:"high",label:"Google API Key"},{id:"SEC-003",pattern:/(['"`])AKIA[0-9A-Z]{16}\1/g,severity:"critical",label:"AWS Access Key ID"},{id:"SEC-004",pattern:/-----BEGIN (?:RSA |EC )?PRIVATE KEY-----/g,severity:"critical",label:"Private key in source"},{id:"SEC-005",pattern:/(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{36,}/g,severity:"high",label:"GitHub Token"},{id:"SEC-006",pattern:/xox[bpors]-[a-zA-Z0-9-]{10,}/g,severity:"high",label:"Slack Token"},{id:"SEC-007",pattern:/(?:password|secret|apikey|api_key)\s*[:=]\s*['"`][^'"`\n]{8,}['"`]/gi,severity:"high",label:"Hardcoded credential"}],Za=new Set([".ts",".tsx",".js",".jsx"]),Qa=new Set(["node_modules",".expo",".git","android","ios","dist","build","__tests__","__mocks__"]);function br(e){let t=[],i=Fi.readdirSync(e,{withFileTypes:!0});for(let n of i){if(Qa.has(n.name))continue;let r=qt.join(e,n.name);n.isDirectory()?t.push(...br(r)):Za.has(qt.extname(n.name))&&t.push(r)}return t}function el(e){let t=e.trim();return t.startsWith("//")||t.startsWith("*")||t.startsWith("/*")}function tl(e){return/process\.env\./i.test(e)||/import\.meta\.env/i.test(e)}async function Ar(e,t){let i=[],n=qt.join(e,"src"),r=Fi.existsSync(n)?n:e,o=br(r);for(let s of o){let a=Fi.readFileSync(s,"utf-8").split(`
+`),c=qt.relative(e,s);for(let d=0;d<a.length;d++){let u=a[d];if(!el(u)&&!tl(u))for(let{id:p,pattern:m,severity:E,label:U}of qa)m.lastIndex=0,m.test(u)&&i.push({id:p,title:U,description:`Potential ${U.toLowerCase()} found in source code`,severity:E,category:"secrets",file:c,line:d+1,recommendation:`Move to environment variables or a secrets manager. Use \`${f.nameLower} env set\` for managed secrets.`})}}return{category:"secrets",label:"Secrets Detection",findings:i,durationMs:0}}import{execSync as il}from"child_process";var nl={critical:"critical",high:"high",moderate:"medium",low:"low",info:"info"};async function Ir(e,t){let i=[],n=1,r;try{r=il("npm audit --json 2>/dev/null",{cwd:e,encoding:"utf-8",timeout:6e4})}catch(l){if(r=l.stdout||"",!r)return{category:"dependencies",label:"Dependency CVEs",findings:[],durationMs:0,error:"Failed to run npm audit. Ensure npm is available and dependencies are installed."}}let o;try{o=JSON.parse(r)}catch{return{category:"dependencies",label:"Dependency CVEs",findings:[],durationMs:0,error:"Failed to parse npm audit output."}}let s=o.vulnerabilities||{};for(let[l,a]of Object.entries(s)){let c=nl[a.severity]||"info",d=Array.isArray(a.via)?a.via.map(u=>typeof u=="string"?u:u.title||u.name).join(", "):String(a.via);i.push({id:`DEP-${String(n++).padStart(3,"0")}`,title:`${l} \u2014 ${a.severity}`,description:`Via: ${d}. Range: ${a.range||"unknown"}`,severity:c,category:"dependencies",recommendation:a.fixAvailable?`Run \`npm audit fix\` or update ${l} to a patched version.`:"No fix available yet. Monitor for updates or evaluate alternatives.",autoFixable:!!a.fixAvailable})}return{category:"dependencies",label:"Dependency CVEs",findings:i,durationMs:0}}import Zt from"fs";import Qt from"path";var rl=/(?:token|password|credential|secret|apiKey|api_key|session|auth|jwt|refresh_token|access_token|private_key|pin|otp)/i,_r=/AsyncStorage\s*\.\s*(?:setItem|mergeItem)\s*\(\s*['"`]([^'"`]+)['"`]/g,ol=/from\s+['"]@react-native-async-storage\/async-storage['"]|from\s+['"]react-native['"].*AsyncStorage/,sl=new Set([".ts",".tsx",".js",".jsx"]),al=new Set(["node_modules",".expo",".git","android","ios","dist","build"]);function Pr(e){let t=[];if(!Zt.existsSync(e))return t;let i=Zt.readdirSync(e,{withFileTypes:!0});for(let n of i){if(al.has(n.name))continue;let r=Qt.join(e,n.name);n.isDirectory()?t.push(...Pr(r)):sl.has(Qt.extname(n.name))&&t.push(r)}return t}async function $r(e,t){let i=[],n=1,r=Qt.join(e,"src"),o=Zt.existsSync(r)?r:e,s=Pr(o);for(let l of s){let a=Zt.readFileSync(l,"utf-8");if(!ol.test(a))continue;let c=a.split(`
+`),d=Qt.relative(e,l);for(let u=0;u<c.length;u++){let p=c[u];_r.lastIndex=0;let m;for(;(m=_r.exec(p))!==null;){let E=m[1];rl.test(E)&&i.push({id:`STOR-${String(n++).padStart(3,"0")}`,title:`AsyncStorage used for "${E}"`,description:`Sensitive data key "${E}" stored in AsyncStorage (unencrypted).`,severity:"high",category:"storage",file:d,line:u+1,recommendation:"Use expo-secure-store (SecureStore) for sensitive data instead of AsyncStorage."})}}}return{category:"storage",label:"Insecure Storage",findings:i,durationMs:0}}import ei from"fs";import ti from"path";var wr=/['"`](http:\/\/(?!localhost|127\.0\.0\.1|10\.|192\.168\.|0\.0\.0\.0|172\.(?:1[6-9]|2\d|3[01])\.)[^'"`\s]+)['"`]/g,ll=/\/api\/|\/v[0-9]+\/|\/graphql|\/rest\//i,dl=new Set([".ts",".tsx",".js",".jsx"]),cl=new Set(["node_modules",".expo",".git","android","ios","dist","build","__tests__","__mocks__"]);function Rr(e){let t=[];if(!ei.existsSync(e))return t;let i=ei.readdirSync(e,{withFileTypes:!0});for(let n of i){if(cl.has(n.name))continue;let r=ti.join(e,n.name);n.isDirectory()?t.push(...Rr(r)):dl.has(ti.extname(n.name))&&t.push(r)}return t}async function Dr(e,t){let i=[],n=1,r=ti.join(e,"src"),o=ei.existsSync(r)?r:e,s=Rr(o);for(let l of s){let c=ei.readFileSync(l,"utf-8").split(`
+`),d=ti.relative(e,l);for(let u=0;u<c.length;u++){let p=c[u],m=p.trim();if(m.startsWith("//")||m.startsWith("*"))continue;wr.lastIndex=0;let E;for(;(E=wr.exec(p))!==null;){let U=E[1],R=ll.test(U);i.push({id:`NET-${String(n++).padStart(3,"0")}`,title:`Insecure HTTP URL${R?" (API endpoint)":""}`,description:`Plain HTTP URL found: ${U}`,severity:R?"high":"medium",category:"network",file:d,line:u+1,recommendation:"Use HTTPS instead of HTTP for all network requests."})}}}return{category:"network",label:"HTTP URLs",findings:i,durationMs:0}}import ii from"fs";import ni from"path";var vr=/(?:debug|debugMode|devMode|enableDebug)\s*[:=]\s*true/gi,Or=/console\.(?:log|warn|info|debug)\s*\([^)]*(?:token|password|secret|credential|key|auth)/gi,ul=new Set([".ts",".tsx",".js",".jsx"]),pl=new Set(["node_modules",".expo",".git","android","ios","dist","build","__tests__","__mocks__"]);function Cr(e){let t=[];if(!ii.existsSync(e))return t;let i=ii.readdirSync(e,{withFileTypes:!0});for(let n of i){if(pl.has(n.name))continue;let r=ni.join(e,n.name);n.isDirectory()?t.push(...Cr(r)):ul.has(ni.extname(n.name))&&t.push(r)}return t}async function Nr(e,t){let i=[],n=1,r=ni.join(e,"src"),o=ii.existsSync(r)?r:e,s=Cr(o);for(let l of s){let c=ii.readFileSync(l,"utf-8").split(`
+`),d=ni.relative(e,l);for(let u=0;u<c.length;u++){let p=c[u],m=p.trim();if(!(m.startsWith("//")||m.startsWith("*"))&&(vr.lastIndex=0,vr.test(p)&&i.push({id:`DBG-${String(n++).padStart(3,"0")}`,title:"Hardcoded debug flag",description:"Debug/dev mode enabled in source code",severity:"medium",category:"debug",file:d,line:u+1,recommendation:"Use __DEV__ or environment variables instead of hardcoded debug flags."}),Or.lastIndex=0,Or.test(p))){let E=c.slice(Math.max(0,u-3),u).join(`
+`);/__DEV__/.test(E)||i.push({id:`DBG-${String(n++).padStart(3,"0")}`,title:"Sensitive data in console log",description:"Console log may expose sensitive data (token, password, etc.) in production",severity:"medium",category:"debug",file:d,line:u+1,recommendation:"Wrap in __DEV__ check or remove sensitive data from console output."})}}}return{category:"debug",label:"Debug/Dev Flags",findings:i,durationMs:0}}import Tr from"fs";import Bi from"path";var fl=new Set(["androidx.work.impl.background.systemjob.SystemJobService","androidx.work.impl.diagnostics.DiagnosticsReceiver","com.google.firebase.iid.FirebaseInstanceIdReceiver","com.google.android.gms.auth.api.signin.RevocationBoundService","androidx.profileinstaller.ProfileInstallReceiver","com.google.firebase.messaging.FirebaseMessagingService","com.google.android.gms.measurement.AppMeasurementService","com.google.android.gms.measurement.AppMeasurementJobService"]);function ml(e){let t=[Bi.join(e,"android","app","src","main","AndroidManifest.xml"),Bi.join(e,"android","AndroidManifest.xml")];for(let i of t)if(Tr.existsSync(i))return i;return null}async function kr(e,t){let i=[],n=1,r=ml(e);if(!r)return{category:"manifest",label:"Android Manifest",findings:[],durationMs:0,error:"No AndroidManifest.xml found. Run with --prebuild or run `expo prebuild` first."};let o=Tr.readFileSync(r,"utf-8"),s=Bi.relative(e,r),l=/<(activity|service|receiver|provider)\s+([^>]*?)(?:\/>|>)/gs,a;for(;(a=l.exec(o))!==null;){let c=a[1],d=a[2],p=d.match(/android:name="([^"]+)"/)?.[1]||"unknown";if(fl.has(p))continue;let m=/android:exported="true"/.test(d),E=/android:permission="/.test(d);m&&!E&&i.push({id:`MAN-${String(n++).padStart(3,"0")}`,title:`Exported ${c}: ${p.split(".").pop()}`,description:`${p} is exported=true without android:permission protection`,severity:"medium",category:"manifest",file:s,recommendation:'Set android:exported="false" or add an android:permission attribute.'})}return/android:allowBackup="true"/.test(o)&&i.push({id:`MAN-${String(n++).padStart(3,"0")}`,title:"allowBackup is enabled",description:'android:allowBackup="true" allows data extraction via ADB backup',severity:"medium",category:"manifest",file:s,recommendation:'Set android:allowBackup="false" via expo-build-properties plugin.',autoFixable:!0}),/android:debuggable="true"/.test(o)&&i.push({id:`MAN-${String(n++).padStart(3,"0")}`,title:"App is debuggable",description:'android:debuggable="true" allows attaching a debugger in production',severity:"critical",category:"manifest",file:s,recommendation:"Ensure debuggable is false for production builds. This is usually set automatically for release builds."}),{category:"manifest",label:"Android Manifest",findings:i,durationMs:0}}import ri from"fs";import Hi from"path";function gl(e){let t=Hi.join(e,"ios");if(!ri.existsSync(t))return null;let i=ri.readdirSync(t,{withFileTypes:!0});for(let n of i){if(!n.isDirectory()||n.name==="Pods"||n.name.startsWith("."))continue;let r=Hi.join(t,n.name,"Info.plist");if(ri.existsSync(r))return r}return null}async function xr(e,t){let i=[],n=1,r=gl(e);if(!r)return{category:"ats",label:"iOS ATS Config",findings:[],durationMs:0,error:"No Info.plist found. Run with --prebuild or run `expo prebuild` first."};let o=ri.readFileSync(r,"utf-8"),s=Hi.relative(e,r),l=o.match(/<key>NSAppTransportSecurity<\/key>\s*<dict>([\s\S]*?)<\/dict>/);if(l){let a=l[1];/<key>NSAllowsArbitraryLoads<\/key>\s*<true\s*\/>/.test(a)&&i.push({id:`ATS-${String(n++).padStart(3,"0")}`,title:"ATS disabled \u2014 NSAllowsArbitraryLoads",description:"App Transport Security is completely disabled. All HTTP connections are allowed.",severity:"critical",category:"ats",file:s,recommendation:"Remove NSAllowsArbitraryLoads or set to false. Use domain-specific exceptions only if absolutely necessary."});let c=a.match(/<key>NSExceptionDomains<\/key>\s*<dict>([\s\S]*?)<\/dict>/);if(c){let d=c[1].match(/<key>([^<]+)<\/key>/g);if(d)for(let u of d){let p=u.replace(/<\/?key>/g,"");p!=="NSExceptionDomains"&&i.push({id:`ATS-${String(n++).padStart(3,"0")}`,title:`ATS exception: ${p}`,description:`ATS exception configured for ${p}`,severity:"low",category:"ats",file:s,recommendation:`Verify that the ATS exception for ${p} is necessary. Use HTTPS where possible.`})}}}return{category:"ats",label:"iOS ATS Config",findings:i,durationMs:0}}var yl=[{category:"permissions",label:"Permission Audit",fn:Er,requiresPrebuild:!1},{category:"secrets",label:"Secrets Detection",fn:Ar,requiresPrebuild:!1},{category:"dependencies",label:"Dependency CVEs",fn:Ir,requiresPrebuild:!1},{category:"storage",label:"Insecure Storage",fn:$r,requiresPrebuild:!1},{category:"network",label:"HTTP URLs",fn:Dr,requiresPrebuild:!1},{category:"debug",label:"Debug/Dev Flags",fn:Nr,requiresPrebuild:!1},{category:"manifest",label:"Android Manifest",fn:kr,requiresPrebuild:!0},{category:"ats",label:"iOS ATS Config",fn:xr,requiresPrebuild:!0}];async function Fr(e,t){let i=yl;t.category&&(i=i.filter(s=>s.category===t.category),i.length===0&&(Ot.error(Ee.red(`Unknown category: ${t.category}`)),Ot.info(Ee.dim(`Available: ${Object.values(Oe).join(", ")}`)),process.exit(1)));let n=i.filter(s=>!s.requiresPrebuild),r=i.filter(s=>s.requiresPrebuild),o=[];for(let s of n){let l=Lr();l.start(Ee.dim(`Running ${s.label}...`));try{let a=Date.now(),c=await s.fn(e,t);c.durationMs=Date.now()-a,o.push(c);let d=c.findings.length;l.stop(d>0?Ee.yellow(`${s.label} \u2014 ${d} finding(s)`):Ee.green(`${s.label} \u2014 clean`))}catch(a){l.stop(Ee.red(`${s.label} \u2014 error`)),o.push({category:s.category,label:s.label,findings:[],durationMs:0,error:a.message})}}if(r.length>0){let s=Mr.join(e,"android"),l=Mr.join(e,"ios"),a=Ur.existsSync(s)||Ur.existsSync(l);if(!a&&t.prebuild){t.json||Ot.info(Ee.dim(`
+Running expo prebuild for deeper analysis...`));try{hl("npx expo prebuild --no-install",{cwd:e,stdio:"pipe"})}catch{return Ot.warn(Ee.yellow("Prebuild failed \u2014 skipping manifest/plist checks.")),o}}else if(!a)return t.json||Ot.info(Ee.dim(`
+Skipping manifest/plist checks \u2014 no android/ios dirs. Use --prebuild to generate them.`)),o;for(let c of r){let d=Lr();d.start(Ee.dim(`Running ${c.label}...`));try{let u=Date.now(),p=await c.fn(e,t);p.durationMs=Date.now()-u,o.push(p);let m=p.findings.length;d.stop(m>0?Ee.yellow(`${c.label} \u2014 ${m} finding(s)`):Ee.green(`${c.label} \u2014 clean`))}catch(u){d.stop(Ee.red(`${c.label} \u2014 error`)),o.push({category:c.category,label:c.label,findings:[],durationMs:0,error:u.message})}}}return o}import le from"chalk";import{log as oe}from"@clack/prompts";var ct={critical:le.bgRed.white.bold,high:le.red.bold,medium:le.yellow.bold,low:le.blue,info:le.dim},oi={critical:0,high:1,medium:2,low:3,info:4};function Sl(e,t){if(!t)return!0;let i=oi[t];return i===void 0?!0:oi[e]<=i}function Br(e,t){let i=0,n={critical:0,high:0,medium:0,low:0,info:0};for(let s of e){let l=s.findings.filter(c=>Sl(c.severity,t));if(l.length===0&&!s.error)continue;if(oe.info(""),oe.info(le.bold(`  ${s.label}`)+le.dim(`  ${l.length} finding(s)`)),oe.info(le.dim("  "+"\u2500".repeat(60))),s.error){oe.error(le.red(`  Error: ${s.error}`));continue}let a=[...l].sort((c,d)=>oi[c.severity]-oi[d.severity]);for(let c of a){let d=ct[c.severity](` ${c.severity.toUpperCase()} `);oe.info(`  ${d}  ${le.bold(c.id)}  ${c.title}`),oe.info(le.dim(`          ${c.description}`)),c.file&&oe.info(le.dim(`          File: ${c.file}${c.line?`:${c.line}`:""}`)),oe.info(le.cyan(`          Fix: ${c.recommendation}`)),oe.info(""),n[c.severity]++,i++}}oe.info(""),oe.info(le.bold("  Summary")),oe.info(le.dim("  "+"\u2500".repeat(60))),oe.info(`  Total: ${le.bold(String(i))} finding(s)`),oe.info(`  ${ct.critical(` ${n.critical} Critical `)}  ${ct.high(` ${n.high} High `)}  ${ct.medium(` ${n.medium} Medium `)}  ${ct.low(` ${n.low} Low `)}  ${ct.info(` ${n.info} Info `)}`);let r=n.critical>0,o=n.high>0;r||o?(oe.info(""),oe.error(le.red.bold(`  FAIL \u2014 ${n.critical} critical, ${n.high} high issue(s) found`))):i>0?(oe.info(""),oe.warn(le.yellow("  PASS (with warnings) \u2014 no critical or high issues"))):(oe.info(""),oe.success(le.green.bold("  PASS \u2014 no issues found")))}function Hr(e,t){let i=e.flatMap(r=>r.findings),n={};for(let r of Object.values(Ie))n[r]=i.filter(o=>o.severity===r).length;return{version:"1.0.0",timestamp:new Date().toISOString(),project:t.name||"unknown",projectVersion:t.version||"0.0.0",summary:{total:i.length,...n},passed:n.critical===0&&n.high===0,checks:e.map(r=>({category:r.category,label:r.label,findingCount:r.findings.length,durationMs:r.durationMs,error:r.error||null})),findings:i}}import{log as se,spinner as El}from"@clack/prompts";import ie from"chalk";import He from"fs";import bl from"os";import ut from"path";import{execSync as Al}from"child_process";var jr=16384,Il=1,_l=Buffer.from([127,69,76,70]);async function Gr(e){se.info(ie.bold.underline("16KB Page Alignment Check")),console.log("");let t=ut.resolve(e);if(!He.existsSync(t))return se.error(ie.red(`APK file not found: ${t}`)),!1;if(!t.endsWith(".apk"))return se.error(ie.red("The provided file is not an APK file.")),!1;let i=El();i.start("Extracting and analyzing native libraries...");let n=He.mkdtempSync(ut.join(bl.tmpdir(),"mach-16kb-"));try{try{Al(`unzip -o -q "${t}" "lib/arm64-v8a/*.so" "lib/x86_64/*.so" -d "${n}" 2>/dev/null`,{encoding:"utf-8",maxBuffer:50*1024*1024})}catch{}let r=Kr(ut.join(n,"lib"));if(r.length===0)return i.stop("Analysis complete."),se.info(ie.yellow("No arm64-v8a or x86_64 native libraries found in the APK.")),se.info(ie.dim("16KB alignment check only applies to arm64-v8a and x86_64 architectures.")),!0;let o=[];for(let a of r){let c=ut.relative(n,a),d=$l(c),u=ut.basename(a),p=Pl(a);p!==null&&o.push({name:u,filePath:c,arch:d,align:p,compatible:p>=jr})}if(i.stop("Analysis complete."),o.length===0)return se.info(ie.yellow("No valid ELF shared libraries found.")),!0;let s=o.filter(a=>!a.compatible),l=o.filter(a=>a.compatible);if(se.info(ie.dim(`Checked ${o.length} native librar${o.length===1?"y":"ies"}
+`)),s.length>0){se.info(ie.red.bold(`Incompatible libraries:
+`));for(let a of s)se.error(ie.red(`${ie.bold(a.name)} ${ie.dim(`(${a.arch})`)}`)),se.info(ie.dim(`  PT_LOAD alignment: 2**${Math.log2(a.align)} (${a.align} bytes, needs 2**14 = ${jr})`))}return l.length>0&&(console.log(""),se.success(ie.green(`${l.length} librar${l.length===1?"y":"ies"} correctly aligned (2**14 or higher).`))),console.log(""),s.length===0?(se.success(ie.green.bold("ELF Verification Successful. APK is 16KB compatible.")),!0):(se.error(ie.red.bold(`Found ${s.length} unaligned lib${s.length===1?"":"s"} (arm64-v8a/x86_64 libs need to be aligned).`)),console.log(""),se.info(ie.yellow("To fix this:")),se.info(ie.dim("  1. Rebuild with NDK r28+ which defaults to 16KB page alignment")),se.info(ie.dim("  2. Or set -DANDROID_SUPPORT_FLEXIBLE_PAGE_SIZES=ON in CMake")),se.info(ie.dim("  3. Update third-party libraries that ship prebuilt .so files")),se.info(ie.dim("  4. After rebuilding: zipalign -p -f -v 16 input.apk output.apk")),console.log(""),se.info(ie.dim("Reference: https://developer.android.com/guide/practices/page-sizes")),!1)}catch(r){return i.stop("Analysis failed."),se.error(ie.red(`Failed to analyze APK: ${r.message}`)),!1}finally{try{He.rmSync(n,{recursive:!0,force:!0})}catch{}}}function Pl(e){let t=He.openSync(e,"r");try{let i=Buffer.alloc(64);if(He.readSync(t,i,0,64,0),!i.subarray(0,4).equals(_l))return null;let n=i[4]===2,r=i[5]===1,o=(p,m)=>r?p.readUInt16LE(m):p.readUInt16BE(m),s=(p,m)=>r?p.readUInt32LE(m):p.readUInt32BE(m),l=(p,m)=>Number(r?p.readBigUInt64LE(m):p.readBigUInt64BE(m)),a,c,d;n?(a=l(i,32),c=o(i,54),d=o(i,56)):(a=s(i,28),c=o(i,42),d=o(i,44));let u=null;for(let p=0;p<d;p++){let m=Buffer.alloc(c);if(He.readSync(t,m,0,c,a+p*c),s(m,0)!==Il)continue;let U;n?U=l(m,48):U=s(m,28),U>0&&(u===null||U<u)&&(u=U)}return u??0}catch{return null}finally{He.closeSync(t)}}function Kr(e){let t=[];if(!He.existsSync(e))return t;let i=He.readdirSync(e,{withFileTypes:!0});for(let n of i){let r=ut.join(e,n.name);n.isDirectory()?t.push(...Kr(r)):n.name.endsWith(".so")&&t.push(r)}return t}function $l(e){return e.includes("arm64-v8a")?"arm64-v8a":e.includes("x86_64")?"x86_64":"unknown"}var Wr=async e=>{if(ye()||(_e.error(Ce.red(`You are not logged in. Run \`${f.nameLower} login\` first.`)),process.exit(1)),e.apk){await Dl(e);return}let i=process.cwd(),n=si.join(i,"package.json");Ct.existsSync(n)||(_e.error(Ce.red("No package.json found. Run this command from a project root.")),process.exit(1));let r=JSON.parse(Ct.readFileSync(n,"utf-8")),o=!!(r.dependencies?.expo||r.devDependencies?.expo);e.json||(_e.info(Ce.dim(`Project: ${r.name||"unknown"} v${r.version||"0.0.0"}`)),_e.info(Ce.dim(`Type: ${o?"Expo":"Bare React Native"}`)),_e.info(""));let s={json:e.json,fix:e.fix,category:e.category,severity:e.severity,prebuild:e.prebuild},l=await Fr(i,s);e.json?console.log(JSON.stringify(Hr(l,r),null,2)):Br(l,e.severity);let a=l.some(d=>d.findings.some(u=>u.severity==="critical")),c=l.some(d=>d.findings.some(u=>u.severity==="high"));(a||c)&&process.exit(1)},Vr=["16kb"];async function Dl(e){let t=e.category?.toLowerCase();t&&!Vr.includes(t)&&(_e.error(Ce.red(`Unknown APK check category: "${t}"`)),_e.info(Ce.dim(`Available APK checks: ${Vr.join(", ")}`)),process.exit(1));let i=await vl(e.apk);i||process.exit(1);let n=!t,r=!1;(n||t==="16kb")&&(await Gr(i)||(r=!0)),r&&process.exit(1)}async function vl(e){if(e.startsWith("build:")){let i=e.slice(6);return await Ol(i)}if(e.startsWith("http://")||e.startsWith("https://"))return await Yr(e);let t=si.resolve(e);return Ct.existsSync(t)?t:(_e.error(Ce.red(`APK file not found: ${t}`)),null)}async function Ol(e){let t=zr();t.start(`Fetching APK from build ${e}...`);try{let i=await v.get(`/build/${e}`);if(i.data.status!=="success")throw new Error(i.data.message);let n=i.data.build;if(!n)throw new Error("Build not found");let r=n.artifacts?.find(o=>o.type?o.type==="apk":o.name?.endsWith(".apk")||o.url?.includes(".apk"));return!r||!r.url?(t.stop("No APK artifact found"),_e.error(Ce.red("This build does not have an APK artifact.")),_e.info(Ce.dim("Make sure the build produced an APK (not just an AAB).")),null):(t.stop(`Found build: ${n.buildId||e}`),await Yr(r.url))}catch(i){return t.stop("Failed to fetch build"),_e.error(Ce.red(i.message)),null}}async function Yr(e){let t=zr();t.start("Downloading APK...");try{let i=Ct.mkdtempSync(si.join(wl.tmpdir(),`${f.nameLower}-audit-`)),n=si.join(i,"app.apk"),r=await Rl.get(e,{responseType:"arraybuffer"});Ct.writeFileSync(n,r.data);let o=(r.data.length/(1024*1024)).toFixed(1);return t.stop(`Downloaded APK (${o} MB)`),n}catch(i){return t.stop("Download failed"),_e.error(Ce.red(`Failed to download APK: ${i.message}`)),null}}var Tl=console.log;console.log=()=>{};Nl();console.log=Tl;ge(me.bgCyan.black(f.cliTag("Production Build Orchestrator")));var xl=kl(import.meta.url),Ll=xl("../package.json"),q=new Cl;q.name(f.nameLower).description(`${f.name} CLI: Powerful Cloud Infrastructure Tools`).version(Ll.version).option("-y, --yes","Automatically answer yes to all prompts",!1).option("--quiet","Suppress non-essential output",!1);q.command("agent").description("Start local device discovery agent for the Install Hub (port 7070)").action(async()=>{await zn()});q.command("host").description("Setup AWS S3 static hosting and CloudFront").action(async()=>{ge(me.bgCyan.black(f.cliTag("Hosting"))),await Xi()});q.command("sitemap").description("Generate sitemap.xml from Expo Router app structure").option("-o, --output <path>","Output path for sitemap.xml","./public/sitemap.xml").action(async e=>{ge(me.bgCyan.black(f.cliTag("Sitemap Generator"))),await en(e)});q.command("build").description("Run a build on a cloud provider (AWS Spot Instances)").argument("[platform]","Target platform (android, ios)").option("--platform <os>","Target platform alias (android, ios) [Optional]").option("--repo <url>","Git Repository URL").option("--branch <name>","Git Branch").option("--ami <id>","AMI ID").option("--bucket <name>","S3 Bucket for artifacts").option("--region <region>","AWS Region").option("--aws-profile <name>","AWS Credentials Profile").option("-p, --build-profile <name>","Build Profile (e.g. production, staging)","production").option("--profile <name>","Build Profile (alias for --build-profile)").option("--dry-run","Generate User Data script without launching").option("--keep-instance","Do not terminate the instance after build").option("--subnet <id>","VPC Subnet ID to launch the instance in").option("--security-group <id>","VPC Security Group ID to use").option("--ssh-host <host>","Remote host for iOS build (SSH)").option("--ssh-user <user>","SSH username for remote host").option("--ssh-key <path>","Path to private SSH key for remote host").option("--ios-scheme <scheme>","iOS Scheme to build").option("--ios-team-id <id>","Apple Development Team ID").option("--ios-configuration <config>","Xcode configuration (Release/Debug)").option("--ios-export-method <method>","Export method (ad-hoc, app-store, development, enterprise)").option("--ios-api-key-id <id>","App Store Connect API Key ID").option("--ios-api-key-issuer <id>","App Store Connect API Key Issuer ID").option("--ios-api-key-path <path>","Path to App Store Connect API Key (.p8) file").option("--simulator","Build for iOS Simulator (no signing required)").addOption(new pt("--build-id <id>","Internal build ID").hideHelp()).addOption(new pt("--project-id <id>","Internal project ID").hideHelp()).addOption(new pt("--fail-only","Internal: mark an existing build failed").hideHelp()).addOption(new pt("--error <message>","Internal failure message").hideHelp()).option("--local","Run build on local machine").option("--auto-version","Automatically fetch and increment Android versionCode or iOS buildNumber from the store").option("--verbose","Enable verbose logging").option("--json-output <path>","Write build metadata JSON to a file for CI/CD").option("--maestro","Queue a managed Maestro test run after a successful build").option("--maestro-flows <path>","Maestro flow file or directory (default: .maestro)").option("--maestro-device <device>","Managed Maestro device profile").option("--maestro-retries <n>","Retries for the Maestro run","1").option("--maestro-record","Enable screen recording where supported").option("-y, --yes","Automatically answer yes to all prompts",!1).option("--quiet","Suppress non-essential output",!1).action(async(e,t)=>{let i=q.opts();t.yes=t.yes||i.yes,t.quiet=t.quiet||i.quiet,t.platform=e||t.platform,t.buildProfile=t.profile||t.buildProfile,t.quiet||ge(me.bgCyan.black(f.cliTag("Cloud Build"))),await Kt(t)});q.command("maestro").description("Run managed Maestro tests for an existing Mach build or artifact").option("--platform <os>","Target platform (android/ios)").option("-p, --profile <name>","Build profile to resolve when using --latest","production").option("--latest","Use the latest successful build for the platform/profile").option("--build-id <id>","Use a specific Mach build ID").option("--build-url <url>","Use a Mach build URL").option("--artifact-url <url>","Use a direct APK or iOS simulator app artifact URL").option("--maestro-flows <path>","Maestro flow file or directory (default: .maestro)").option("--maestro-device <device>","Managed Maestro device profile").option("--maestro-retries <n>","Retries for the Maestro run","1").option("--maestro-record","Enable screen recording where supported").option("--json-output <path>","Write test run metadata JSON to a file for CI/CD").action(async e=>{ge(me.bgCyan.black(f.cliTag("Maestro Testing"))),await Tn(e)});q.command("update").description("Deploy an Over-The-Air (OTA) update to your live channel").option("--branch <name>","Channel or Branch to deploy to (e.g., production)","production").action(async e=>{ge(me.bgCyan.black(f.cliTag("OTA Update"))),await cr(e)});q.command("submit").description("Automated Store Submission (App Store / Google Play)").option("--platform <os>","Target platform (ios/android)").option("-p, --profile <name>","Build/submission profile to submit from (e.g. production, preprod)").option("--track <track>","Google Play Track (internal, alpha, beta, production)").option("--release-status <status>","Google Play release status (completed, draft, halted, inProgress)").option("--rollout <fraction>","Google Play staged rollout fraction for inProgress releases (example: 0.1)").option("--changes-not-sent-for-review","Commit Google Play changes without automatically sending them for review").option("--ssh-host <host>","Remote macOS host for iOS submission").option("--ssh-user <user>","SSH username for remote iOS submission").option("--ssh-key <path>","Path to private SSH key for remote iOS submission").option("--credential-id <id>","Service credential ID to use when multiple submission credentials exist").option("--local","Run submission on this machine (internal runner mode for iOS)").addOption(new pt("--submit-id <id>","Internal submission ID").hideHelp()).addOption(new pt("--project-id <id>","Internal project ID").hideHelp()).option("--json-output <path>","Write submission metadata JSON to a file for CI/CD").option("--latest","Use the latest successful build for submission").option("--build-id <id>","Use a specific build ID for submission").action(async e=>{let t=q.opts();e.quiet=e.quiet||t.quiet,e.yes=e.yes||t.yes,ge(me.bgCyan.black(f.cliTag("Store Submission"))),await ar(e)});q.command("login").description(`Login to ${f.name} Dashboard`).action(async()=>{ge(me.bgCyan.black(f.cliTag("Login"))),await Xn()});q.command("link").description(`Link local directory to a ${f.name} Project`).action(async()=>{ge(me.bgCyan.black(f.cliTag("Link Project"))),await Zn()});q.command("me").description("Display currently logged in user details").action(async()=>{await pr()});q.command("init").description(`Create a new ${f.name} Project`).action(async()=>{ge(me.bgCyan.black(f.cliTag("Init Project"))),await Qn()});q.command("env").description("Manage Environment Variables").argument("<action>","Action to perform: set or list").argument("[args...]","Key=Value pairs for set action").action(async(e,t)=>{ge(me.bgCyan.black(f.cliTag("Env Manager"))),await nr(e,t)});q.command("start").description("Start the development server (Metro)").option("-p, --build-profile <name>","Build profile (e.g. development, staging)","development").option("--tunnel","Use ngrok tunnel").option("--lan","Use LAN IP").option("--localhost","Use localhost").option("-c, --clear","Clear Metro cache").option("--port <number>","Port to listen on").option("--ios","Start on iOS").option("--android","Start on Android").option("--web","Start on Web").action(async e=>{ge(me.bgCyan.black(f.cliTag("Dev Server"))),await mr(e)});q.command("config").description("Show resolved configuration for a profile").option("-p, --profile <name>","Build profile to resolve","development").option("--json","Output as JSON").action(async e=>{await gr(e)});q.command("credentials").description("Unified, interactive credential management (iOS/Android)").option("-p, --profile <name>","Build profile (production, staging, development)").option("--force","Force recreate certificates (nuke existing on Apple Portal)",!1).action(async e=>{let{credentialsMainCommand:t}=await import("./credentials-TQV5IUCS.js");await t(e)});q.command("credentials:setup").description("Automated credential provisioning (iOS/Android) [Legacy]").requiredOption("--platform <os>","Platform: ios or android").option("--profile <name>","Build profile (production, staging, development)").option("--bundle-id <id>","Bundle ID / Package Name (optional, auto-detected)").option("--team-id <id>","Apple Team ID (iOS only)").option("--key-alias <alias>","Android keystore alias (optional, auto-generated)").option("--aws-profile <name>","AWS Credentials Profile (for S3 storage)").option("--force","Force recreate certificates (nuke existing on Apple Portal)",!1).action(async e=>{ge(me.bgCyan.black(f.cliTag("Credentials Setup"))),await mt(e),Jr(me.green("Done!"))});q.command("credentials:service").description("Upload Service Credentials (ASC API Key / Google Service JSON) [Legacy]").requiredOption("--platform <os>","Platform: ios or android").option("--file <path>","Path to credential file (.p8 or .json)").option("--issuer-id <id>","ASC API Key Issuer ID (iOS only)").option("--key-id <id>","ASC API Key ID (iOS only)").option("--bundle-id <id>","Bundle identifier / Android package name to attach this service credential to").option("--package-name <name>","Android package name to attach this service credential to").option("-p, --profile <name>","Build profile to resolve package/bundle identifier from config").action(async e=>{ge(me.bgCyan.black(f.cliTag("Service Credentials"))),await Yi(e),Jr(me.green("Done!"))});var ji=q.command("device").description("Manage registered iOS test devices");ji.command("register").description("Register a connected iOS device or enter UDID manually").option("--udid <udid>","Device UDID (skip auto-detection)").option("--name <name>","Device name").action(async e=>{await Xt("register",e)});ji.command("list").description("List all registered devices").action(async()=>{await Xt("list",{})});ji.command("remove").description("Remove a registered device").option("--udid <udid>","Device UDID to remove").action(async e=>{await Xt("remove",e)});q.command("audit").description("Run automated security audit on the project or APK").option("--apk <path>","Path to APK file (runs APK diagnostics like 16KB alignment)").option("--json","Output results as JSON (for CI/CD)").option("--fix","Auto-apply fixes where possible").option("--category <name>","Run only a specific check category (e.g. 16kb, permissions, secrets)").option("--severity <level>","Minimum severity to display (critical, high, medium, low, info)").option("--prebuild","Run expo prebuild for deeper manifest/plist analysis").action(async e=>{ge(me.bgCyan.black(f.cliTag(e.apk?"APK Audit":"Security Audit"))),await Wr(e)});var Ul=new Set(["login"]);q.hook("preAction",(e,t)=>{let i=t.name();Ul.has(i)||Vi()});q.on("command:*",()=>{console.error(`Invalid command: %s
+See --help for a list of available commands.`,q.args.join(" ")),process.exit(1)});process.argv.slice(2).length||q.help();q.parse(process.argv);