@radhya/mach 1.9.1 → 1.9.4

package/README.md

@@ -54,7 +54,7 @@ mach maestro --latest --platform android --profile e2e-test
 mach maestro --build-id <buildId>
 ```
 
-The architecture, command design, Android/iOS runner strategy, Spot EC2 recommendation, and AMI checklist are documented in [docs/maestro-managed-testing-plan.md](docs/maestro-managed-testing-plan.md).
+Mach manages the test execution infrastructure for you, so projects do not need a separate Maestro Cloud setup.
 
 ## Cloud Builds
 
@@ -111,7 +111,7 @@ Set `MACH_DASHBOARD_URL` only for local or staging dashboards. Production build
 
 ### Bitbucket Pipelines
 
-Mach works in Bitbucket through a Dashboard access token. Create a token in **Dashboard → Settings → Access Tokens**, save it as `MACH_TOKEN`, and use `--json-output` to pass build URLs to Slack.
+Mach works in Bitbucket through a Dashboard access token. Create a token in **Dashboard → Settings → Access Tokens**, save it as `MACH_TOKEN`, and use `--json-output` when a pipeline needs the Mach build URL for later steps.
 
 ```yaml
 image: node:24.13.1
@@ -126,13 +126,7 @@ definitions:
         script:
           - npm ci
           - npm install -g @radhya/mach@latest
-          # Keep --auto-version for store builds. Omit it for internal/dev-client builds unless that package exists in the store.
-          - mach build --platform android --profile $MACH_BUILD_PROFILE --auto-version --json-output mach-android-build.json
-          - ANDROID_URL=$(node -pe "require('./mach-android-build.json').url")
-          - pipe: atlassian/slack-notify:2.0.0
-            variables:
-              WEBHOOK_URL: $SLACK_WEBHOOK_URL
-              MESSAGE: "$SLACK_MESSAGE_PREFIX (Android): $ANDROID_URL"
+          - mach build --platform android --profile production --auto-version --json-output mach-android-build.json
 
     - step: &submit-android
         name: Submit Android
@@ -142,149 +136,20 @@ definitions:
         script:
           - npm ci
           - npm install -g @radhya/mach@latest
-          - mach submit --latest --platform android --profile $MACH_SUBMIT_PROFILE --track ${MACH_ANDROID_TRACK:-internal} --release-status ${MACH_ANDROID_RELEASE_STATUS:-completed} ${MACH_ANDROID_ROLLOUT:+--rollout $MACH_ANDROID_ROLLOUT} ${MACH_ANDROID_CHANGES_NOT_SENT_FOR_REVIEW:+--changes-not-sent-for-review}
+          - mach submit --latest --platform android --profile production
 ```
 
-Android submission uses the Google Play Developer API directly, so Bitbucket/Linux runners do not need Ruby or Fastlane for `.aab` uploads. Mach retries transient Play API failures before failing, records Android submissions in the Dashboard, and does not start the macOS runner for Android. iOS submission is queued through Mach and executed on the configured macOS GitLab runner, so the public command is the same from macOS, Linux, Windows, or CI. GitLab pipeline details are kept internal; users see the Mach submission URL and status.
+Android submission uses the Google Play Developer API directly, so Bitbucket/Linux runners do not need Ruby or Fastlane for `.aab` uploads. Mach retries transient Play API failures before failing and records Android submissions in the Dashboard. iOS submission is queued through Mach, so the public command is the same from macOS, Linux, Windows, or CI. Users see the Mach submission URL and status.
 
-Required Bitbucket variables:
-
-| Variable                                   | Required       | Description                                                                 |
-| ------------------------------------------ | -------------- | --------------------------------------------------------------------------- |
-| `MACH_TOKEN`                               | Yes            | Dashboard access token for CI/CD auth                                       |
-| `MACH_BUILD_PROFILE`                       | Yes            | Build profile from `mach.config.json`, e.g. `production`                    |
-| `MACH_SUBMIT_PROFILE`                      | Yes            | Profile used by `mach submit --latest`, e.g. `production`                   |
-| `MACH_ANDROID_TRACK`                       | Android submit | Google Play track, e.g. `internal`, `alpha`, `beta`, `production`           |
-| `MACH_ANDROID_RELEASE_STATUS`              | Android submit | Google Play release status: `completed`, `draft`, `halted`, or `inProgress` |
-| `MACH_ANDROID_ROLLOUT`                     | Android submit | Optional staged rollout fraction for `inProgress`, e.g. `0.1`               |
-| `MACH_ANDROID_CHANGES_NOT_SENT_FOR_REVIEW` | Android submit | Optional flag to commit Play changes without automatically sending review   |
-| `SLACK_WEBHOOK_URL`                        | Slack          | Incoming webhook for build notifications                                    |
-| `SLACK_MESSAGE_PREFIX`                     | Slack          | Message prefix such as project/environment name                             |
-
-Before enabling CI, make sure `mach.config.json` is committed, credentials are uploaded in the Dashboard, and Android service credentials are attached to the exact package id.
+Before enabling CI, make sure `mach.config.json` is committed, `MACH_TOKEN` is configured as a secure CI variable, credentials are uploaded in the Dashboard, and Android service credentials are attached to the exact package id.
 
 For iOS submit, the user-facing command is universal:
 
 ```bash
-mach submit --latest --platform ios --profile $MACH_SUBMIT_PROFILE
+mach submit --latest --platform ios --profile production
 ```
 
-The macOS runner executes the internal runner command after the Mach API triggers GitLab. A robust combined build/submit `.gitlab-ci.yml` looks like this:
-
-```yaml
-# --- GLOBAL CONFIG ---
-stages:
-  - build
-  - submit
-
-variables:
-  GIT_STRATEGY: none
-
-# --- iOS BUILD JOB ---
-skye_m4_build:
-  stage: build
-  tags:
-    - m4-mini
-    - ios-build
-  rules:
-    - if: '$MACH_ACTION == "submit_ios"'
-      when: never
-    - when: on_success
-  script: |
-    set -euo pipefail
-    source ~/.zshrc || source ~/.bashrc || true
-
-    echo "Starting MACH Cloud Build on M4 Mac Mini..."
-    echo "Build ID: $BUILD_ID"
-    echo "Project ID: $PROJECT_ID"
-    echo "Platform: $PLATFORM"
-
-    export AWS_DEFAULT_REGION="ap-south-1"
-
-    echo "Fetching build token from SSM..."
-    export MACH_TOKEN=$(aws ssm get-parameter \
-      --name "/skye/builds/$BUILD_ID/token" \
-      --with-decryption \
-      --query 'Parameter.Value' \
-      --region ap-south-1 \
-      --output text)
-
-    if [ -z "${MACH_TOKEN:-}" ] || [ "$MACH_TOKEN" = "None" ]; then
-      echo "Failed to fetch MACH_TOKEN from SSM"
-      exit 1
-    fi
-
-    aws ssm delete-parameter --name "/skye/builds/$BUILD_ID/token" --region ap-south-1 || true
-
-    echo "Fetching source from S3..."
-    aws s3 cp s3://$S3_BUCKET/builds/$BUILD_ID/source.zip source.zip --quiet --region ap-south-1
-
-    echo "Extracting source..."
-    unzip -o -q source.zip
-
-    echo "Running Mach local build..."
-    mach build --local \
-      --build-id "$BUILD_ID" \
-      --project-id "$PROJECT_ID" \
-      --platform "$PLATFORM" \
-      $BUILD_ARGS
-  after_script:
-    - |
-      if [ "${CI_JOB_STATUS:-}" != "success" ] && [ -n "${BUILD_ID:-}" ] && [ -n "${PROJECT_ID:-}" ] && [ -n "${MACH_TOKEN:-}" ]; then
-        mach build --fail-only \
-          --build-id "$BUILD_ID" \
-          --project-id "$PROJECT_ID" \
-          --platform "${PLATFORM:-ios}" \
-          --error "GitLab iOS runner failed before the build could report a final status."
-      fi
-    - if [ -n "${BUILD_ID:-}" ]; then aws ssm delete-parameter --name "/skye/builds/$BUILD_ID/token" --region ap-south-1 2>/dev/null || true; fi
-
-# --- iOS SUBMIT JOB ---
-skye_m4_ios_submit:
-  stage: submit
-  tags:
-    - m4-mini
-    - ios-build
-  rules:
-    - if: '$MACH_ACTION == "submit_ios"'
-      when: on_success
-    - when: never
-  script: |
-    set -euo pipefail
-    source ~/.zshrc || source ~/.bashrc || true
-
-    echo "Starting MACH iOS Submit on M4 Mac Mini..."
-    echo "Submit ID: $SUBMIT_ID"
-    echo "Project ID: $PROJECT_ID"
-    echo "Profile: ${MACH_SUBMIT_PROFILE:-production}"
-    echo "Build ID: ${BUILD_ID:-latest}"
-
-    export AWS_DEFAULT_REGION="ap-south-1"
-
-    echo "Fetching submit token from SSM..."
-    export MACH_TOKEN=$(aws ssm get-parameter \
-      --name "/skye/submissions/$SUBMIT_ID/token" \
-      --with-decryption \
-      --query 'Parameter.Value' \
-      --region ap-south-1 \
-      --output text)
-
-    if [ -z "${MACH_TOKEN:-}" ] || [ "$MACH_TOKEN" = "None" ]; then
-      echo "Failed to fetch MACH_TOKEN from SSM"
-      exit 1
-    fi
-
-    aws ssm delete-parameter --name "/skye/submissions/$SUBMIT_ID/token" --region ap-south-1 || true
-
-    echo "Running Mach local iOS submit..."
-    if [ -n "${BUILD_ID:-}" ]; then
-      mach submit --local --submit-id "$SUBMIT_ID" --project-id "$PROJECT_ID" --platform ios --profile "${MACH_SUBMIT_PROFILE:-production}" --build-id "$BUILD_ID"
-    else
-      mach submit --local --submit-id "$SUBMIT_ID" --project-id "$PROJECT_ID" --platform ios --profile "${MACH_SUBMIT_PROFILE:-production}" --latest
-    fi
-  after_script:
-    - if [ -n "${SUBMIT_ID:-}" ]; then aws ssm delete-parameter --name "/skye/submissions/$SUBMIT_ID/token" --region ap-south-1 2>/dev/null || true; fi
-```
+Mach handles the managed macOS submission environment internally. No provider-specific macOS job needs to be added to a user's CI configuration.
 
 ## Credential Management
 
@@ -444,19 +309,7 @@ Mach includes the resolved environment in the build fingerprint, so development,
 
 ### Android Keystore Passwords
 
-The keystore file is stored encrypted in the Dashboard. Provide its passwords as secrets so Mach can inject them during the Gradle build:
-
-```bash
-mach env set KEYSTORE_PASSWORD_PRODUCTION=my_super_secret_password
-```
-
-If your keystore password and key alias password differ:
-
-```bash
-mach env set KEYSTORE_PASSWORD_PRODUCTION=my_key_pass KEYSTORE_STORE_PASSWORD_PRODUCTION=my_store_pass
-```
-
-Replace `PRODUCTION` with `STAGING` or `DEVELOPMENT` to match your build profile.
+The keystore file and its passwords are stored encrypted in the Dashboard when managed through `mach credentials`. Legacy projects can still provide Android signing passwords as environment-scoped secrets in the Dashboard, but managed credentials are recommended so passwords stay attached to the keystore record.
 
 ## Automated Versioning
 
@@ -518,7 +371,7 @@ Android submit reads `submit.<profile>.android.track`, `submit.<profile>.android
 
 Android submit does not require Fastlane. Mach uploads the `.aab`, assigns the returned `versionCode` to the requested track, commits the edit through the Google Play Developer API, and records the submission in the Dashboard. Transient Google Play failures are retried up to four times before the command fails.
 
-iOS submit queues a managed submission through Mach and runs Fastlane `pilot` on the macOS GitLab runner. Runner jobs call `mach submit --local ...`; users and CI call the normal `mach submit --platform ios ...` command. The Dashboard submission row is connected to the build, records who created it, and is marked failed if the runner or upload fails. If `--ssh-host` or `submit.<profile>.ios.sshHost` is set, Mach can also upload the `.ipa` and App Store Connect API key to that macOS runner, run `pilot` remotely, then remove the remote temp files.
+iOS submit queues a managed submission through Mach. Users and CI call the normal `mach submit --platform ios ...` command, and Mach handles the required macOS upload environment. The Dashboard submission row is connected to the build, records who created it, and is marked failed if the upload fails.
 
 If `--profile` is provided with `--latest`, Mach chooses the latest successful build from that profile only. This avoids accidentally submitting a staging or preprod build to production.
 

package/dist/{chunk-YBL2LBMW.js → chunk-NZ4K6LDA.js}

@@ -1,4 +1,4 @@
-var n={name:"Mach",nameLower:"mach",nameUpper:"MACH",company:"Radhya Softlabs",npmScope:"@radhya",configFileName:"mach.config.json",configDir:".mach",workspacesDir:".mach-workspaces",remoteWorkspacesDir:"mach_workspaces",envPrefix:"MACH_",bucketPrefix:"mach-builds",buildPrefix:"mach-build",credentialsKeychain:"mach-credentials.keychain",keychainPassword:"mach",cliTag:e=>` Mach CLI - ${e} `,fastlanePrefix:"mach",jsonStartMarker:"___MACH_JSON_START___",jsonEndMarker:"___MACH_JSON_END___",prewarmedMarker:"/opt/mach-prewarmed"};import i from"fs";import f from"path";import h from"os";import x from"axios";var m=f.join(h.homedir(),n.configDir),u=f.join(m,"credentials.json");function k(e){i.existsSync(m)||i.mkdirSync(m,{recursive:!0}),i.writeFileSync(u,JSON.stringify(e,null,2))}function c(){if(!i.existsSync(u))return null;try{return JSON.parse(i.readFileSync(u,"utf-8"))}catch{return null}}function w(){let e=c();if(e?.token)return e;let r=process.env[`${n.envPrefix}TOKEN`];if(r)return{token:r,email:"token-auth"};console.error(`\x1B[31mAuthentication required.\x1B[0m Either:
+var n={name:"Mach",nameLower:"mach",nameUpper:"MACH",company:"Radhya Softlabs",npmScope:"@radhya",configFileName:"mach.config.json",configDir:".mach",workspacesDir:".mach-workspaces",remoteWorkspacesDir:"mach_workspaces",envPrefix:"MACH_",bucketPrefix:"mach-builds",buildPrefix:"mach-build",credentialsKeychain:"mach-credentials.keychain",keychainPassword:"mach",cliTag:e=>` Mach CLI - ${e} `,fastlanePrefix:"mach",jsonStartMarker:"___MACH_JSON_START___",jsonEndMarker:"___MACH_JSON_END___",prewarmedMarker:"/opt/mach-prewarmed"};import i from"fs";import f from"path";import k from"os";import x from"axios";var m=f.join(k.homedir(),n.configDir),u=f.join(m,"credentials.json");function l(){return process.env[`${n.envPrefix}TOKEN`]?.trim()||void 0}function _(e){i.existsSync(m)||i.mkdirSync(m,{recursive:!0}),i.writeFileSync(u,JSON.stringify(e,null,2))}function c(){let e=l();if(e)return{token:e,email:"token-auth"};if(!i.existsSync(u))return null;try{return JSON.parse(i.readFileSync(u,"utf-8"))}catch{return null}}function w(){let e=l();if(e)return{token:e,email:"token-auth"};let r=c();if(r?.token)return r;console.error(`\x1B[31mAuthentication required.\x1B[0m Either:
   1. Run \x1B[33m${n.nameLower} login\x1B[0m for interactive login
-  2. Set \x1B[33m${n.envPrefix}TOKEN\x1B[0m environment variable for CI/CD`),process.exit(1)}async function l(e){let r=c();if(!r||!r.refreshToken)return null;try{let t=await x.post(`${e}/refresh-token`,{username:r.email,refreshToken:r.refreshToken});if(t.data.status==="success"&&t.data.user){let s={...r,id:t.data.user.id||r.id,token:t.data.user.token,refreshToken:t.data.user.refreshToken||r.refreshToken};return k(s),s.token}}catch{}return null}import v from"axios";import _ from"dotenv";import p from"path";import{fileURLToPath as y}from"url";var A=p.dirname(y(import.meta.url));_.config({path:p.join(A,"../.env")});var o=process.env[`${n.envPrefix}API_URL`]||"https://mach-api.securejs.in",C="https://getmach.dev",T=o.includes("localhost:3001")||o.includes("127.0.0.1:3001")?o.replace("3001","8081"):C,I=process.env[`${n.envPrefix}DASHBOARD_URL`]||T;var a=v.create({baseURL:o,headers:{Connection:"close"}});a.interceptors.request.use(e=>{let t=c()?.token||process.env[`${n.envPrefix}TOKEN`];return t&&(e.headers.Authorization=`Bearer ${t}`),e},e=>Promise.reject(e));a.interceptors.response.use(e=>e,async e=>{let{config:r}=e;if((!e.response||e.code==="ECONNRESET"||e.code==="ETIMEDOUT")&&(!r._retryCount||r._retryCount<3)){r._retryCount=(r._retryCount||0)+1;let s=Math.pow(2,r._retryCount-1)*1e3;return console.warn(`\x1B[33m[NETWORK] Transient error (${e.code||"UNKNOWN"}). Retrying in ${s/1e3}s... (Attempt ${r._retryCount}/3)\x1B[0m`),await new Promise(d=>setTimeout(d,s)),a(r)}return Promise.reject(e)});a.interceptors.response.use(e=>e,async e=>{let r=e.config;if(e.response?.status===401&&!r._retry){if(r._retry=!0,process.env[`${n.envPrefix}TOKEN`])return console.error(`\x1B[31mAuthentication failed.\x1B[0m Your ${n.envPrefix}TOKEN may be invalid or expired.
-Generate a new token at the ${n.name} Dashboard \u2192 Settings \u2192 Access Tokens.`),Promise.reject(e);try{let s=await l(o);if(s)return r.headers.Authorization=`Bearer ${s}`,a(r)}catch(s){return Promise.reject(s)}}return Promise.reject(e)});export{n as a,k as b,c,w as d,o as e,I as f,a as g};
+  2. Set \x1B[33m${n.envPrefix}TOKEN\x1B[0m environment variable for CI/CD`),process.exit(1)}async function d(e){let r=c();if(!r||!r.refreshToken)return null;try{let t=await x.post(`${e}/refresh-token`,{username:r.email,refreshToken:r.refreshToken});if(t.data.status==="success"&&t.data.user){let o={...r,id:t.data.user.id||r.id,token:t.data.user.token,refreshToken:t.data.user.refreshToken||r.refreshToken};return _(o),o.token}}catch{}return null}import g from"axios";import T from"dotenv";import p from"path";import{fileURLToPath as y}from"url";var A=p.dirname(y(import.meta.url));T.config({path:p.join(A,"../.env")});var s=process.env[`${n.envPrefix}API_URL`]||"https://mach-api.securejs.in",C="https://getmach.dev",v=s.includes("localhost:3001")||s.includes("127.0.0.1:3001")?s.replace("3001","8081"):C,j=process.env[`${n.envPrefix}DASHBOARD_URL`]||v;var a=g.create({baseURL:s,headers:{Connection:"close"}});a.interceptors.request.use(e=>{let t=c()?.token||process.env[`${n.envPrefix}TOKEN`];return t&&(e.headers.Authorization=`Bearer ${t}`),e},e=>Promise.reject(e));a.interceptors.response.use(e=>e,async e=>{let{config:r}=e;if((!e.response||e.code==="ECONNRESET"||e.code==="ETIMEDOUT")&&(!r._retryCount||r._retryCount<3)){r._retryCount=(r._retryCount||0)+1;let o=Math.pow(2,r._retryCount-1)*1e3;return console.warn(`\x1B[33m[NETWORK] Transient error (${e.code||"UNKNOWN"}). Retrying in ${o/1e3}s... (Attempt ${r._retryCount}/3)\x1B[0m`),await new Promise(h=>setTimeout(h,o)),a(r)}return Promise.reject(e)});a.interceptors.response.use(e=>e,async e=>{let r=e.config;if(e.response?.status===401&&!r._retry){if(r._retry=!0,process.env[`${n.envPrefix}TOKEN`])return console.error(`\x1B[31mAuthentication failed.\x1B[0m Your ${n.envPrefix}TOKEN may be invalid or expired.
+Generate a new token at the ${n.name} Dashboard \u2192 Settings \u2192 Access Tokens.`),Promise.reject(e);try{let o=await d(s);if(o)return r.headers.Authorization=`Bearer ${o}`,a(r)}catch(o){return Promise.reject(o)}}return Promise.reject(e)});export{n as a,_ as b,c,w as d,s as e,j as f,a as g};

package/dist/chunk-RMK5OZVN.js

@@ -0,0 +1,58 @@
+import{a as f,g as v}from"./chunk-NZ4K6LDA.js";import{log as r,spinner as te,text as _,password as ce,select as K,confirm as He,isCancel as W,cancel as U,intro as Pe,outro as Te,note as ve}from"@clack/prompts";import{log as R,spinner as q,text as $,select as M,isCancel as F,cancel as T,note as oe,confirm as he}from"@clack/prompts";import V from"chalk";import{spawnSync as j}from"child_process";import G from"fs";import x from"path";import ue from"os";import se from"fs";function ot(n){if(n){if(!se.existsSync(n))return null;try{return JSON.parse(se.readFileSync(n,"utf-8"))}catch{return null}}if(!se.existsSync(`./${f.configFileName}`))return null;try{return JSON.parse(se.readFileSync(`./${f.configFileName}`,"utf-8"))}catch{return null}}function L(n,e,i=new Set){if(i.has(e))throw new Error(`Circular inheritance detected in profile: ${e}`);i.add(e);let a=n.build?.[e];if(!a)return null;let t={...a};if(a.extends){let s=L(n,a.extends,i);s&&(t={...s,...a,env:{...s.env,...a.env},ios:{...s.ios,...a.ios},android:{...s.android,...a.android}})}if(t.envGroups&&Array.isArray(t.envGroups)){let s={};for(let c of t.envGroups){let d=n.envGroups?.[c];d?Object.assign(s,d):log.warn(`Environment group not found: ${c}`)}t.env={...s,...t.env}}return t}function ae(n,e){let i=e?L(n,e)||{}:{};if(i.android?.package)return i.android.package;if(i.androidPackage)return i.androidPackage;if(n.android?.package)return n.android.package;if(n.expo?.android?.package)return n.expo.android.package}function re(n,e){let i=e?L(n,e)||{}:{};if(i.ios?.bundleIdentifier)return i.ios.bundleIdentifier;if(i.iosBundleIdentifier)return i.iosBundleIdentifier;if(n.ios?.bundleIdentifier)return n.ios.bundleIdentifier;if(n.ios?.bundleId)return n.ios.bundleId;if(n.expo?.ios?.bundleIdentifier)return n.expo.ios.bundleIdentifier}var ct=(n,e=`${f.envPrefix}`)=>{let i={},a=(t,s)=>{if(t)for(let c in t){let d=t[c],g=`${s}${c.toUpperCase().replace(/[^A-Z0-9]/g,"_")}`;d!==null&&typeof d=="object"&&!Array.isArray(d)?a(d,`${g}_`):i[g]=String(d)}};return a(n,e),i};var Fe="cmVxdWlyZSAnc3BhY2VzaGlwJwpyZXF1aXJlICdqc29uJwoKZGVmIHJlYWRfdGVhbV9maWVsZCh0ZWFtLCAqa2V5cykKICBrZXlzLmVhY2ggZG8gfGtleXwKICAgIGJlZ2luCiAgICAgIHZhbHVlID0gdGVhbVtrZXldIGlmIHRlYW0ucmVzcG9uZF90bz8oOltdKQogICAgICByZXR1cm4gdmFsdWUgaWYgdmFsdWUgJiYgdmFsdWUudG9fcy5sZW5ndGggPiAwCiAgICByZXNjdWUKICAgIGVuZAoKICAgIG1ldGhvZF9uYW1lID0ga2V5LnRvX3MKICAgIGlmIHRlYW0ucmVzcG9uZF90bz8obWV0aG9kX25hbWUpCiAgICAgIHZhbHVlID0gdGVhbS5wdWJsaWNfc2VuZChtZXRob2RfbmFtZSkKICAgICAgcmV0dXJuIHZhbHVlIGlmIHZhbHVlICYmIHZhbHVlLnRvX3MubGVuZ3RoID4gMAogICAgZW5kCiAgZW5kCgogIG5pbAplbmQKCmRlZiBub3JtYWxpemVfdGVhbV9uYW1lKG5hbWUpCiAgbmFtZS50b19zLmRvd25jYXNlLmdzdWIoL1teYS16MC05XSsvLCAnICcpLnN0cmlwCmVuZAoKZGVmIHBvcnRhbF90ZWFtX25hbWUKICB0ZWFtX2lkID0gRU5WWydGQVNUTEFORV9URUFNX0lEJ10udG9fcwogIHRlYW1zID0gU3BhY2VzaGlwOjpQb3J0YWwuY2xpZW50LnRlYW1zCiAgdGVhbXMgPSB0ZWFtcy52YWx1ZXMgaWYgdGVhbXMuaXNfYT8oSGFzaCkKCiAgdGVhbSA9IEFycmF5KHRlYW1zKS5maW5kIGRvIHx0fAogICAgWwogICAgICByZWFkX3RlYW1fZmllbGQodCwgJ3RlYW1JZCcsIDp0ZWFtSWQpLAogICAgICByZWFkX3RlYW1fZmllbGQodCwgJ3RlYW1faWQnLCA6dGVhbV9pZCksCiAgICAgIHJlYWRfdGVhbV9maWVsZCh0LCAnaWQnLCA6aWQpCiAgICBdLmNvbXBhY3QubWFwKCY6dG9fcykuaW5jbHVkZT8odGVhbV9pZCkKICBlbmQKCiAgcmVhZF90ZWFtX2ZpZWxkKHRlYW0sICduYW1lJywgOm5hbWUsICd0ZWFtTmFtZScsIDp0ZWFtTmFtZSwgJ2Rpc3BsYXlOYW1lJywgOmRpc3BsYXlOYW1lKQpyZXNjdWUgPT4gZQogICRzdGRlcnIucHV0cyAiREVCVUc6IENvdWxkIG5vdCByZXNvbHZlIERldmVsb3BlciBQb3J0YWwgdGVhbSBuYW1lOiAje2UubWVzc2FnZX0iCiAgbmlsCmVuZAoKZGVmIHR1bmVzX3RlYW1faWQodGVhbSkKICByZWFkX3RlYW1fZmllbGQoCiAgICB0ZWFtLAogICAgJ3Byb3ZpZGVySWQnLCA6cHJvdmlkZXJJZCwKICAgICdwcm92aWRlcl9pZCcsIDpwcm92aWRlcl9pZCwKICAgICdjb250ZW50UHJvdmlkZXJJZCcsIDpjb250ZW50UHJvdmlkZXJJZCwKICAgICdjb250ZW50X3Byb3ZpZGVyX2lkJywgOmNvbnRlbnRfcHJvdmlkZXJfaWQsCiAgICAndGVhbUlkJywgOnRlYW1JZCwKICAgICd0ZWFtX2lkJywgOnRlYW1faWQsCiAgICAnaWQnLCA6aWQKICApLnRvX3MKZW5kCgpkZWYgdHVuZXNfdGVhbV9uYW1lKHRlYW0pCiAgcmVhZF90ZWFtX2ZpZWxkKAogICAgdGVhbSwKICAgICduYW1lJywgOm5hbWUsCiAgICAnY29udGVudFByb3ZpZGVyTmFtZScsIDpjb250ZW50UHJvdmlkZXJOYW1lLAogICAgJ2NvbnRlbnRfcHJvdmlkZXJfbmFtZScsIDpjb250ZW50X3Byb3ZpZGVyX25hbWUsCiAgICAndGVhbU5hbWUnLCA6dGVhbU5hbWUsCiAgICAnZGlzcGxheU5hbWUnLCA6ZGlzcGxheU5hbWUKICApLnRvX3MKZW5kCgpkZWYgYXZhaWxhYmxlX3R1bmVzX3RlYW1zCiAgdGVhbXMgPSBTcGFjZXNoaXA6OlR1bmVzLmNsaWVudC50ZWFtcwogIHRlYW1zID0gdGVhbXMudmFsdWVzIGlmIHRlYW1zLmlzX2E/KEhhc2gpCiAgQXJyYXkodGVhbXMpCnJlc2N1ZSA9PiBlCiAgJHN0ZGVyci5wdXRzICJERUJVRzogQ291bGQgbm90IGluc3BlY3QgQXBwIFN0b3JlIENvbm5lY3QgdGVhbXM6ICN7ZS5tZXNzYWdlfSIKICBbXQplbmQKCmRlZiBzZWxlY3RfYXBwX3N0b3JlX2Nvbm5lY3RfdGVhbQogIGV4cGxpY2l0X3RlYW1faWQgPSBFTlZbJ0ZBU1RMQU5FX0lUQ19URUFNX0lEJ10gfHwgRU5WWydGQVNUTEFORV9BU0NfVEVBTV9JRCddCiAgaWYgZXhwbGljaXRfdGVhbV9pZCAmJiBleHBsaWNpdF90ZWFtX2lkLnRvX3MubGVuZ3RoID4gMAogICAgU3BhY2VzaGlwOjpUdW5lcy5zZWxlY3RfdGVhbSh0ZWFtX2lkOiBleHBsaWNpdF90ZWFtX2lkKQogICAgcmV0dXJuIGV4cGxpY2l0X3RlYW1faWQKICBlbmQKCiAgZGV2ZWxvcGVyX3RlYW1faWQgPSBFTlZbJ0ZBU1RMQU5FX1RFQU1fSUQnXS50b19zCiAgZGV2ZWxvcGVyX3RlYW1fbmFtZSA9IHBvcnRhbF90ZWFtX25hbWUKICB0ZWFtcyA9IGF2YWlsYWJsZV90dW5lc190ZWFtcwoKICBpZiBkZXZlbG9wZXJfdGVhbV9uYW1lICYmIGRldmVsb3Blcl90ZWFtX25hbWUubGVuZ3RoID4gMAogICAgbm9ybWFsaXplZF9kZXZlbG9wZXJfbmFtZSA9IG5vcm1hbGl6ZV90ZWFtX25hbWUoZGV2ZWxvcGVyX3RlYW1fbmFtZSkKICAgIG1hdGNoZWRfdGVhbSA9IHRlYW1zLmZpbmQgeyB8dGVhbXwgbm9ybWFsaXplX3RlYW1fbmFtZSh0dW5lc190ZWFtX25hbWUodGVhbSkpID09IG5vcm1hbGl6ZWRfZGV2ZWxvcGVyX25hbWUgfQoKICAgIGlmIG1hdGNoZWRfdGVhbQogICAgICBtYXRjaGVkX2lkID0gdHVuZXNfdGVhbV9pZChtYXRjaGVkX3RlYW0pCiAgICAgIG1hdGNoZWRfbmFtZSA9IHR1bmVzX3RlYW1fbmFtZShtYXRjaGVkX3RlYW0pCiAgICAgIFNwYWNlc2hpcDo6VHVuZXMuc2VsZWN0X3RlYW0odGVhbV9pZDogbWF0Y2hlZF9pZCkKICAgICAgJHN0ZGVyci5wdXRzICJERUJVRzogQXV0by1zZWxlY3RlZCBBcHAgU3RvcmUgQ29ubmVjdCB0ZWFtICN7bWF0Y2hlZF9pZH0gKCN7bWF0Y2hlZF9uYW1lfSkgZm9yIERldmVsb3BlciBUZWFtICN7ZGV2ZWxvcGVyX3RlYW1faWR9IgogICAgICByZXR1cm4gbWF0Y2hlZF9pZAogICAgZW5kCiAgZW5kCgogIGlmIHRlYW1zLmxlbmd0aCA9PSAxCiAgICBvbmx5X3RlYW0gPSB0ZWFtcy5maXJzdAogICAgb25seV90ZWFtX2lkID0gdHVuZXNfdGVhbV9pZChvbmx5X3RlYW0pCiAgICBTcGFjZXNoaXA6OlR1bmVzLnNlbGVjdF90ZWFtKHRlYW1faWQ6IG9ubHlfdGVhbV9pZCkKICAgICRzdGRlcnIucHV0cyAiREVCVUc6IEF1dG8tc2VsZWN0ZWQgb25seSBBcHAgU3RvcmUgQ29ubmVjdCB0ZWFtICN7b25seV90ZWFtX2lkfSAoI3t0dW5lc190ZWFtX25hbWUob25seV90ZWFtKX0pIgogICAgcmV0dXJuIG9ubHlfdGVhbV9pZAogIGVuZAoKICAkc3RkZXJyLnB1dHMgIkVSUk9SOiBDb3VsZCBub3QgbWFwIEFwcGxlIERldmVsb3BlciBUZWFtIElEICcje2RldmVsb3Blcl90ZWFtX2lkfScje2RldmVsb3Blcl90ZWFtX25hbWUgPyAiICgje2RldmVsb3Blcl90ZWFtX25hbWV9KSIgOiAnJ30gdG8gQXBwIFN0b3JlIENvbm5lY3QuIgogICRzdGRlcnIucHV0cyAiQXZhaWxhYmxlIEFwcCBTdG9yZSBDb25uZWN0IHRlYW1zOiIKICB0ZWFtcy5lYWNoIGRvIHx0ZWFtfAogICAgJHN0ZGVyci5wdXRzICItICN7dHVuZXNfdGVhbV9pZCh0ZWFtKX0gKCN7dHVuZXNfdGVhbV9uYW1lKHRlYW0pfSkiCiAgZW5kCiAgZXhpdCAxCmVuZAoKZGVmIGxpc3RfdGVhbXMKICBiZWdpbgogICAgU3BhY2VzaGlwOjpQb3J0YWwubG9naW4oRU5WWydGQVNUTEFORV9VU0VSJ10pCiAgICBTcGFjZXNoaXA6OlBvcnRhbC5zZWxlY3RfdGVhbSh0ZWFtX2lkOiBFTlZbJ0ZBU1RMQU5FX1RFQU1fSUQnXSkKCiAgICBkZXZlbG9wZXJfdGVhbV9uYW1lID0gcG9ydGFsX3RlYW1fbmFtZQoKICAgIFNwYWNlc2hpcDo6VHVuZXMubG9naW4oRU5WWydGQVNUTEFORV9VU0VSJ10pCiAgICBub3JtYWxpemVkX2RldmVsb3Blcl9uYW1lID0gbm9ybWFsaXplX3RlYW1fbmFtZShkZXZlbG9wZXJfdGVhbV9uYW1lKQogICAgdGVhbXMgPSBhdmFpbGFibGVfdHVuZXNfdGVhbXMubWFwIGRvIHx0ZWFtfAogICAgICB0ZWFtX25hbWUgPSB0dW5lc190ZWFtX25hbWUodGVhbSkKICAgICAgewogICAgICAgIGlkOiB0dW5lc190ZWFtX2lkKHRlYW0pLAogICAgICAgIG5hbWU6IHRlYW1fbmFtZSwKICAgICAgICByZWNvbW1lbmRlZDogbm9ybWFsaXplZF9kZXZlbG9wZXJfbmFtZS5sZW5ndGggPiAwICYmIG5vcm1hbGl6ZV90ZWFtX25hbWUodGVhbV9uYW1lKSA9PSBub3JtYWxpemVkX2RldmVsb3Blcl9uYW1lCiAgICAgIH0KICAgIGVuZAoKICAgIHB1dHMgIl9fX01BQ0hfSlNPTl9TVEFSVF9fXyIgKyB7CiAgICAgIGRldmVsb3BlclRlYW1JZDogRU5WWydGQVNUTEFORV9URUFNX0lEJ10sCiAgICAgIGRldmVsb3BlclRlYW1OYW1lOiBkZXZlbG9wZXJfdGVhbV9uYW1lLAogICAgICB0ZWFtczogdGVhbXMKICAgIH0udG9fanNvbiArICJfX19NQUNIX0pTT05fRU5EX19fIgogIHJlc2N1ZSA9PiBlCiAgICAkc3RkZXJyLnB1dHMgIkVSUk9SOiAje2UubWVzc2FnZX0iCiAgICBleGl0IDEKICBlbmQKZW5kCgpkZWYgbGlzdF9rZXlzCiAgYmVnaW4KICAgIFNwYWNlc2hpcDo6UG9ydGFsLmxvZ2luKEVOVlsnRkFTVExBTkVfVVNFUiddKQogICAgU3BhY2VzaGlwOjpQb3J0YWwuc2VsZWN0X3RlYW0odGVhbV9pZDogRU5WWydGQVNUTEFORV9URUFNX0lEJ10pCiAgICAKICAgIFNwYWNlc2hpcDo6VHVuZXMubG9naW4oRU5WWydGQVNUTEFORV9VU0VSJ10pCiAgICBzZWxlY3RfYXBwX3N0b3JlX2Nvbm5lY3RfdGVhbQogICAgCiAgICAjIFVzZSBUdW5lcyBjbGllbnQgd2hpY2ggcG9pbnRzIHRvIGFwcHN0b3JlY29ubmVjdC5hcHBsZS5jb20KICAgIGNsaWVudCA9IFNwYWNlc2hpcDo6VHVuZXMuY2xpZW50CiAgICAjIFVzZSByb290LXJlbGF0aXZlIFVSTCB0byByZXBsYWNlIHRoZSBkZWZhdWx0IFR1bmVzIHBhdGggKC9XZWJPYmplY3RzLy4uLikKICAgIHJlc3BvbnNlID0gY2xpZW50LnJlcXVlc3QoOmdldCwgJy9pcmlzL3YxL2FwaUtleXMnKQogICAgCiAgICBpZiByZXNwb25zZS5ib2R5Lm5pbD8gfHwgIXJlc3BvbnNlLmJvZHkuaXNfYT8oSGFzaCkKICAgICAgcmFpc2UgIkFQSSByZXR1cm5lZCBlbXB0eSBvciBpbnZhbGlkIHJlc3BvbnNlIGJvZHkgZm9yIGxpc3Rpbmcga2V5cyIKICAgIGVuZAogICAgCiAgICAkc3RkZXJyLnB1dHMgIkRFQlVHOiBGdWxsIExpc3QgUmVzcG9uc2U6ICN7cmVzcG9uc2UuYm9keS50b19qc29ufSIKICAgIAogICAga2V5cyA9IHJlc3BvbnNlLmJvZHlbJ2RhdGEnXSB8fCBbXQogICAgCiAgICBvdXRwdXQgPSBrZXlzLm1hcCBkbyB8a3wKICAgICAgYXR0ciA9IGtbJ2F0dHJpYnV0ZXMnXSB8fCB7fQogICAgICB7CiAgICAgICAgaWQ6IGtbJ2lkJ10sCiAgICAgICAgbmFtZTogYXR0clsnbmFtZSddLAogICAgICAgIGlzc3VlcklkOiBhdHRyWydpc3N1ZXJJZCddLAogICAgICAgIHJvbGU6IGF0dHJbJ3JvbGVzJ10mLmZpcnN0LAogICAgICAgIHJldm9jYWJsZTogYXR0clsncmV2b2NhYmxlJ10KICAgICAgfQogICAgZW5kCiAgICAKICAgIHB1dHMgIl9fX01BQ0hfSlNPTl9TVEFSVF9fXyIgKyBvdXRwdXQudG9fanNvbiArICJfX19NQUNIX0pTT05fRU5EX19fIgogIHJlc2N1ZSA9PiBlCiAgICAkc3RkZXJyLnB1dHMgIkVSUk9SOiAje2UubWVzc2FnZX0iCiAgICBpZiBkZWZpbmVkPyhyZXNwb25zZSkgJiYgcmVzcG9uc2UgJiYgcmVzcG9uc2UuYm9keQogICAgICAkc3RkZXJyLnB1dHMgIlJlc3BvbnNlIEJvZHk6ICN7cmVzcG9uc2UuYm9keS50b19qc29ufSIKICAgIGVuZAogICAgZXhpdCAxCiAgZW5kCmVuZAoKZGVmIGNyZWF0ZV9rZXkobmFtZSwgcm9sZSA9ICdBRE1JTicpCiAgYmVnaW4KICAgIFNwYWNlc2hpcDo6UG9ydGFsLmxvZ2luKEVOVlsnRkFTVExBTkVfVVNFUiddKQogICAgU3BhY2VzaGlwOjpQb3J0YWwuc2VsZWN0X3RlYW0odGVhbV9pZDogRU5WWydGQVNUTEFORV9URUFNX0lEJ10pCiAgICAKICAgIFNwYWNlc2hpcDo6VHVuZXMubG9naW4oRU5WWydGQVNUTEFORV9VU0VSJ10pCiAgICBzZWxlY3RfYXBwX3N0b3JlX2Nvbm5lY3RfdGVhbQogICAgCiAgICBjbGllbnQgPSBTcGFjZXNoaXA6OlR1bmVzLmNsaWVudAogICAgCiAgICAjIFRydW5jYXRlIG5pY2tuYW1lIHRvIDMwIGNoYXJzIGFzIHBlciBBcHBsZSdzIGxpbWl0CiAgICAjIFdlIGtlZXAgdGhlIG9yaWdpbmFsICduYW1lJyBmb3IgbG9nZ2luZyBidXQgc2VuZCB0cnVuY2F0ZWQgJ25pY2tuYW1lJyB0byBBUEkKICAgIHNhZmVfbmlja25hbWUgPSBuYW1lWzAsIDMwXQogICAgCiAgICBwYXlsb2FkID0gewogICAgICBkYXRhOiB7CiAgICAgICAgdHlwZTogImFwaUtleXMiLAogICAgICAgIGF0dHJpYnV0ZXM6IHsKICAgICAgICAgIG5pY2tuYW1lOiBzYWZlX25pY2tuYW1lLAogICAgICAgICAga2V5VHlwZTogIlBVQkxJQ19BUEkiLAogICAgICAgICAgcm9sZXM6IFtyb2xlXSwKICAgICAgICAgIGFsbEFwcHNWaXNpYmxlOiB0cnVlCiAgICAgICAgfQogICAgICB9CiAgICB9CiAgICAKICAgIHJlc3BvbnNlID0gY2xpZW50LnJlcXVlc3QoOnBvc3QpIGRvIHxyZXF8CiAgICAgIHJlcS51cmwgIi9pcmlzL3YxL2FwaUtleXMiCiAgICAgIHJlcS5ib2R5ID0gcGF5bG9hZC50b19qc29uCiAgICAgIHJlcS5oZWFkZXJzWydDb250ZW50LVR5cGUnXSA9ICdhcHBsaWNhdGlvbi9qc29uJwogICAgICByZXEuaGVhZGVyc1snQWNjZXB0J10gPSAnYXBwbGljYXRpb24vdm5kLmFwaStqc29uLCBhcHBsaWNhdGlvbi9qc29uLCB0ZXh0L2phdmFzY3JpcHQsICovKjsgcT0wLjAxJwogICAgICByZXEuaGVhZGVyc1snWC1SZXF1ZXN0ZWQtV2l0aCddID0gJ1hNTEh0dHBSZXF1ZXN0JwogICAgICByZXEuaGVhZGVyc1snUmVmZXJlciddID0gJ2h0dHBzOi8vYXBwc3RvcmVjb25uZWN0LmFwcGxlLmNvbS9hY2Nlc3MvYXBpJwogICAgICByZXEuaGVhZGVyc1snWC1BcHBsZS1XaWRnZXQtS2V5J10gPSBjbGllbnQud2lkZ2V0X2tleSBpZiBjbGllbnQucmVzcG9uZF90bz8oOndpZGdldF9rZXkpCiAgICBlbmQKICAgIAogICAgIyBERUJVRzogSW5zcGVjdCB0aGUgcmF3IHJlc3BvbnNlIG9iamVjdAogICAgJHN0ZGVyci5wdXRzICJERUJVRzogUmVzcG9uc2UgQ2xhc3M6ICN7cmVzcG9uc2UuY2xhc3N9IgogICAgJHN0ZGVyci5wdXRzICJERUJVRzogUmVzcG9uc2UgSGVhZGVyczogI3tyZXNwb25zZS5oZWFkZXJzfSIKICAgICRzdGRlcnIucHV0cyAiREVCVUc6IFJlc3BvbnNlIEJvZHk6ICN7cmVzcG9uc2UuYm9keS50b19qc29ufSIKICAgIAogICAgaWYgcmVzcG9uc2UuYm9keS5uaWw/IHx8ICFyZXNwb25zZS5ib2R5LmlzX2E/KEhhc2gpIHx8IHJlc3BvbnNlLmJvZHlbJ2RhdGEnXS5uaWw/CiAgICAgIGVycm9yX21zZyA9ICJBUEkgZmFpbGVkIHRvIGNyZWF0ZSBrZXkuIgogICAgICBpZiByZXNwb25zZS5ib2R5ICYmIHJlc3BvbnNlLmJvZHlbJ2Vycm9ycyddCiAgICAgICAgZXJyb3JfbXNnICs9ICIgRXJyb3JzOiAiICsgcmVzcG9uc2UuYm9keVsnZXJyb3JzJ10ubWFwe3xlfCBlWydkZXRhaWwnXX0uam9pbignLCAnKQogICAgICBlbmQKICAgICAgcmFpc2UgZXJyb3JfbXNnCiAgICBlbmQKICAgIAogICAga2V5X2RhdGEgPSByZXNwb25zZS5ib2R5WydkYXRhJ10KICAgIGF0dHIgPSBrZXlfZGF0YVsnYXR0cmlidXRlcyddIHx8IHt9CgogICAgIyBUaGUgLnA4IGNvbnRlbnQgaXMgdXN1YWxseSBpbiAncHJpdmF0ZUtleScgb3IgJ2tleUNvbnRlbnQnIG9uIHRoZSBJTklUSUFMIENSRUFURSByZXNwb25zZQogICAgcDhfY29udGVudCA9IGF0dHJbJ3ByaXZhdGVLZXknXSB8fCBhdHRyWydrZXlDb250ZW50J10KICAgIAogICAgaWYgcDhfY29udGVudC5uaWw/CiAgICAgICRzdGRlcnIucHV0cyAiREVCVUc6IEtleSBjb250ZW50IG1pc3NpbmcgaW4gcmVzcG9uc2UuIEF0dGVtcHRpbmcgcmV0cmlldmFsIHZpYSBkb3dubG9hZC9leHBvcnQgZW5kcG9pbnRzLi4uIiAKICAgICAgCiAgICAgIHBhdGhzX3RvX3RyeSA9IFsKICAgICAgICAiaHR0cHM6Ly9hcHBzdG9yZWNvbm5lY3QuYXBwbGUuY29tL2lyaXMvdjEvYXBpS2V5cy8je2tleV9kYXRhWydpZCddfS9kb3dubG9hZCIsCiAgICAgICAgImh0dHBzOi8vYXBwc3RvcmVjb25uZWN0LmFwcGxlLmNvbS9pcmlzL3YxL2FwaUtleXMvI3trZXlfZGF0YVsnaWQnXX0vZXhwb3J0IgogICAgICBdCiAgICAgIAogICAgICBwYXRoc190b190cnkuZWFjaCBkbyB8cGF0aHwKICAgICAgICBiZWdpbgogICAgICAgICAgJHN0ZGVyci5wdXRzICJERUJVRzogVHJ5aW5nICN7cGF0aH0uLi4iCiAgICAgICAgICBkb3dubG9hZF9yZXNwID0gY2xpZW50LnJlcXVlc3QoOmdldCkgZG8gfHJlcXwKICAgICAgICAgICAgcmVxLnVybCBwYXRoCiAgICAgICAgICAgIHJlcS5oZWFkZXJzWydBY2NlcHQnXSA9ICdhcHBsaWNhdGlvbi92bmQuYXBpK2pzb24sIGFwcGxpY2F0aW9uL2pzb24sIHRleHQvamF2YXNjcmlwdCwgKi8qOyBxPTAuMDEnCiAgICAgICAgICAgIHJlcS5oZWFkZXJzWydYLVJlcXVlc3RlZC1XaXRoJ10gPSAnWE1MSHR0cFJlcXVlc3QnCiAgICAgICAgICAgIHJlcS5oZWFkZXJzWydSZWZlcmVyJ10gPSAnaHR0cHM6Ly9hcHBzdG9yZWNvbm5lY3QuYXBwbGUuY29tL2FjY2Vzcy9hcGknCiAgICAgICAgICBlbmQKICAgICAgICAgICRzdGRlcnIucHV0cyAiREVCVUc6IFJlc3BvbnNlIENsYXNzOiAje2Rvd25sb2FkX3Jlc3AuYm9keS5jbGFzc30iCiAgICAgICAgICAkc3RkZXJyLnB1dHMgIkRFQlVHOiBSZXNwb25zZSBTdGF0dXM6ICN7ZG93bmxvYWRfcmVzcC5zdGF0dXN9IiBpZiBkb3dubG9hZF9yZXNwLnJlc3BvbmRfdG8/KDpzdGF0dXMpCiAgICAgICAgICAKICAgICAgICAgIGlmIGRvd25sb2FkX3Jlc3AuYm9keSAmJiAhZG93bmxvYWRfcmVzcC5ib2R5LnRvX3MuaW5jbHVkZT8oJyJlcnJvcnMiPT4nKQogICAgICAgICAgICAgaWYgZG93bmxvYWRfcmVzcC5ib2R5LmlzX2E/KEhhc2gpCiAgICAgICAgICAgICAgIHA4X2NvbnRlbnQgPSBkb3dubG9hZF9yZXNwLmJvZHlbJ2tleUNvbnRlbnQnXSB8fCBkb3dubG9hZF9yZXNwLmJvZHlbJ2NvbnRlbnQnXSB8fCBkb3dubG9hZF9yZXNwLmJvZHkuZGlnKCdkYXRhJywgJ2F0dHJpYnV0ZXMnLCAncHJpdmF0ZUtleScpCiAgICAgICAgICAgICBlbHNlCiAgICAgICAgICAgICAgIHA4X2NvbnRlbnQgPSBkb3dubG9hZF9yZXNwLmJvZHkKICAgICAgICAgICAgIGVuZAogICAgICAgICAgICAgCiAgICAgICAgICAgICBpZiBwOF9jb250ZW50ICYmIHA4X2NvbnRlbnQudG9fcy5zdGFydF93aXRoPygnLS0tLS1CRUdJTicpCiAgICAgICAgICAgICAgICRzdGRlcnIucHV0cyAiREVCVUc6IFJldHJpZXZhbCB2aWEgI3twYXRofSBzdWNjZXNzZnVsISBDb250ZW50IGxlbmd0aDogI3twOF9jb250ZW50LnRvX3MubGVuZ3RofSIKICAgICAgICAgICAgICAgYnJlYWsKICAgICAgICAgICAgIGVsc2UKICAgICAgICAgICAgICAgJHN0ZGVyci5wdXRzICJERUJVRzogUmVzcG9uc2UgZnJvbSAje3BhdGh9IGRpZCBub3QgY29udGFpbiBhIHZhbGlkIHByaXZhdGUga2V5LiIKICAgICAgICAgICAgICAgcDhfY29udGVudCA9IG5pbAogICAgICAgICAgICAgZW5kCiAgICAgICAgICBlbHNlCiAgICAgICAgICAgICAkc3RkZXJyLnB1dHMgIkRFQlVHOiBSZXNwb25zZSBmcm9tICN7cGF0aH0gZW1wdHkgb3IgY29udGFpbnMgZXJyb3JzLiIKICAgICAgICAgIGVuZAogICAgICAgIHJlc2N1ZSA9PiBlCiAgICAgICAgICAkc3RkZXJyLnB1dHMgIkRFQlVHOiBBdHRlbXB0IGZvciAje3BhdGh9IGZhaWxlZDogI3tlLm1lc3NhZ2V9IgogICAgICAgIGVuZAogICAgICBlbmQKICAgIGVuZAoKICAgICMgRklOQUwgVkFMSURBVElPTjogRW5zdXJlIGl0J3Mgbm90IGEgUnVieSBoYXNoIHN0cmluZyByZXByZXNlbnRhdGlvbiBvciBlcnJvcgogICAgaWYgcDhfY29udGVudC5pc19hPyhIYXNoKSB8fCBwOF9jb250ZW50LnRvX3MuaW5jbHVkZT8oJyJlcnJvcnMiPT4nKSB8fCAhcDhfY29udGVudC50b19zLnN0YXJ0X3dpdGg/KCctLS0tLUJFR0lOJykKICAgICAgJHN0ZGVyci5wdXRzICJERUJVRzogSW52YWxpZCBrZXkgY29udGVudCBkZXRlY3RlZC4iCiAgICAgIHA4X2NvbnRlbnQgPSBuaWwKICAgIGVuZAoKICAgIGlmIHA4X2NvbnRlbnQubmlsPwogICAgICAkc3RkZXJyLnB1dHMgIkRFQlVHOiBGYWlsZWQgdG8gcmV0cmlldmUga2V5IGNvbnRlbnQuIgogICAgZW5kCiAgICAKICAgIHJlc3VsdCA9IHsKICAgICAgaWQ6IGtleV9kYXRhWydpZCddLAogICAgICBuYW1lOiBhdHRyWyduaWNrbmFtZSddIHx8IGF0dHJbJ25hbWUnXSwKICAgICAgaXNzdWVySWQ6IGF0dHJbJ2lzc3VlcklkJ10sCiAgICAgIGtleUNvbnRlbnQ6IHA4X2NvbnRlbnQsCiAgICAgIHJhd19yZXNwb25zZTogcmVzcG9uc2UuYm9keSAjIEluY2x1ZGUgdGhpcyBmb3IgZGVidWdnaW5nIHdoZW4ga2V5Q29udGVudCBpcyBuaWwKICAgIH0KICAgIAogICAgcHV0cyAiX19fTUFDSF9KU09OX1NUQVJUX19fIiArIHJlc3VsdC50b19qc29uICsgIl9fX01BQ0hfSlNPTl9FTkRfX18iCiAgcmVzY3VlID0+IGUKICAgICRzdGRlcnIucHV0cyAiRVJST1I6ICN7ZS5tZXNzYWdlfSIKICAgIGlmIGRlZmluZWQ/KHJlc3BvbnNlKSAmJiByZXNwb25zZSAmJiByZXNwb25zZS5ib2R5CiAgICAgICAkc3RkZXJyLnB1dHMgIlJlc3BvbnNlIEJvZHk6ICN7cmVzcG9uc2UuYm9keS50b19qc29ufSIKICAgIGVuZAogICAgZXhpdCAxCiAgZW5kCmVuZAoKZGVmIGRlbGV0ZV9rZXkoaWQpCiAgYmVnaW4KICAgIFNwYWNlc2hpcDo6UG9ydGFsLmxvZ2luKEVOVlsnRkFTVExBTkVfVVNFUiddKQogICAgU3BhY2VzaGlwOjpQb3J0YWwuc2VsZWN0X3RlYW0odGVhbV9pZDogRU5WWydGQVNUTEFORV9URUFNX0lEJ10pCiAgICAKICAgIFNwYWNlc2hpcDo6VHVuZXMubG9naW4oRU5WWydGQVNUTEFORV9VU0VSJ10pCiAgICBzZWxlY3RfYXBwX3N0b3JlX2Nvbm5lY3RfdGVhbQogICAgCiAgICBjbGllbnQgPSBTcGFjZXNoaXA6OlR1bmVzLmNsaWVudAogICAgY2xpZW50LnJlcXVlc3QoOmRlbGV0ZSwgIi9pcmlzL3YxL2FwaUtleXMvI3tpZH0iKQogICAgcHV0cyAiU1VDQ0VTUyIKICByZXNjdWUgPT4gZQogICAgJHN0ZGVyci5wdXRzICJFUlJPUjogI3tlLm1lc3NhZ2V9IgogICAgZXhpdCAxCiAgZW5kCmVuZAoKY29tbWFuZCA9IEFSR1ZbMF0KaWYgY29tbWFuZCA9PSAnbGlzdCcKICBsaXN0X2tleXMKZWxzaWYgY29tbWFuZCA9PSAndGVhbXMnCiAgbGlzdF90ZWFtcwplbHNpZiBjb21tYW5kID09ICdjcmVhdGUnCiAgY3JlYXRlX2tleShBUkdWWzFdIHx8ICJNYWNoIEFQSSBLZXkgI3tUaW1lLm5vdy50b19pfSIpCmVsc2lmIGNvbW1hbmQgPT0gJ2RlbGV0ZScKICBkZWxldGVfa2V5KEFSR1ZbMV0pCmVuZAo=";function le(){let n=x.join(ue.tmpdir(),f.nameLower);G.existsSync(n)||G.mkdirSync(n,{recursive:!0});let e=x.join(n,"manage_asc_keys.rb");return G.writeFileSync(e,Buffer.from(Fe,"base64").toString("utf-8"),{mode:493}),e}function de(){return{...process.env,PATH:`/usr/local/opt/ruby/bin:/usr/local/Cellar/fastlane/2.227.0/libexec/bin:${process.env.HOME}/.local/share/fastlane/3.4.0/bin:${process.env.PATH}`,GEM_HOME:process.env.FASTLANE_GEM_HOME||`${process.env.HOME}/.local/share/fastlane/3.4.0`,GEM_PATH:(process.env.FASTLANE_GEM_HOME||`${process.env.HOME}/.local/share/fastlane/3.4.0`)+":/usr/local/Cellar/fastlane/2.227.0/libexec",FASTLANE_INSTALLED_VIA_HOMEBREW:"true",CI:"1"}}function Ie(n){let e=new Map,i=/-\s+(\d+)\s+\(([^)]+)\)/g,a=/\d+\)\s+"([^"]+)"\s+\((\d+)\)/g,t;for(;(t=i.exec(n))!==null;)e.set(t[1],{id:t[1],name:t[2]});for(;(t=a.exec(n))!==null;)e.set(t[2],{id:t[2],name:t[1]});return Array.from(e.values())}function me(n){return n.submit?.production?.ios?.appStoreConnectTeamId||n.submit?.production?.ios?.itcTeamId||n.submit?.production?.ios?.appleConnectTeamId}function be(n,e,i){return{...de(),FASTLANE_USER:n,FASTLANE_TEAM_ID:e,...i?{FASTLANE_ITC_TEAM_ID:i,FASTLANE_ASC_TEAM_ID:i}:{}}}async function Ne(n,e,i,a){let t=q();t.start("Fetching App Store Connect providers...");let s=j("ruby",[n,"teams"],{env:be(i,a),stdio:["inherit","pipe","pipe"],encoding:"utf-8"});if(s.status!==0){t.stop("Could not fetch providers");let I=Ie(`${s.stdout||""}
+${s.stderr||""}`);if(I.length>0)return ge(e,I,"Select the App Store Connect provider for this API key:");R.warn(V.yellow(`Could not list App Store Connect providers: ${s.stderr||"Unknown error"}`));return}let c=(s.stdout||"").match(new RegExp(`${f.jsonStartMarker}(.*)${f.jsonEndMarker}`));if(!c){t.stop("Could not parse providers");return}let d=JSON.parse(c[1]),g=(d.teams||[]).filter(I=>I.id&&I.name);if(t.stop(g.length===1?"Found 1 provider":`Found ${g.length} providers`),g.length===0)return;if(g.length===1)return R.success(V.green(`\u2713 Using App Store Connect provider ${g[0].name} (${g[0].id})`)),g[0].id;let y=g.filter(I=>I.recommended),u=g.filter(I=>!I.recommended);return ge(e,[...y,...u],`Select the App Store Connect provider for Developer Team ${d.developerTeamName||a}:`)}async function ge(n,e,i){let a=await M({message:i,options:e.map(s=>({value:s.id,label:s.name,hint:`${s.id}${s.recommended?" \xB7 recommended":""}`}))});if(F(a))return T("Operation cancelled"),null;let t=a;return R.success(V.green(`\u2713 Using App Store Connect Provider ID ${t}`)),t}var Se=async n=>{let e=q(),i=n.platform,a=`./${f.configFileName}`;if(!G.existsSync(a)){R.error(`No ${f.configFileName} found. Run \`${f.nameLower} init\` or \`${f.nameLower} link\` first.`);return}let t=JSON.parse(G.readFileSync(a,"utf-8")),{projectId:s}=t,c=n.profile||"production";if(!s){R.error(`${f.configFileName} is missing projectId.`);return}let d=n.file,g=i==="android"?n.packageName||n.bundleId:n.bundleId||re(t,c)||"*";if(i==="android"&&!g&&(g=await Ee(s,t,c),g===null))return;if(i==="ios"&&!d){let p=await M({message:"Manage App Store Connect API Key:",options:[{value:"magic",label:"\u2728 Create new automatically",hint:"Requires Apple ID + 2FA"},{value:"manual",label:"\u{1F50D} Configure manually",hint:"Provide existing .p8 file"},{value:"delete",label:"\u{1F5D1}\uFE0F  Delete an existing Key"}]});if(F(p)){T("Operation cancelled");return}if(p==="magic"){await Je(s,t);return}if(p==="delete"){await xe(s,t);return}}if(!d){let p=i==="ios"?"https://appstoreconnect.apple.com/access/api":"https://console.cloud.google.com/apis/credentials";oe(`To submit to the ${i==="ios"?"App Store":"Google Play Store"}, you need a Service Key:
+
+1. Open: ${V.cyan(p)}
+`+(i==="ios"?`2. Generate an "App Store Connect API Key" with ${V.bold("Admin")} role.
+3. Download the ${V.bold(".p8")} file.`:`2. Create a "Service Account", generate a ${V.bold("JSON")} key.
+3. Download the ${V.bold(".json")} file.`),"Guided Setup"),e.start("Scanning for downloaded keys...");let l=Ue(i);if(e.stop(l.length>0?`Detected ${l.length} potential key(s)`:"No keys detected automatically"),l.length>0){let C=await M({message:"Found these potential keys. Use one of them?",options:[...l.map(A=>({value:A.path,label:`${x.basename(A.path)} (${A.location})`})),{value:"manual",label:"Enter path manually..."}]});if(F(C)){T("Operation cancelled");return}C!=="manual"&&(d=C)}if(!d){let C=await $({message:`Paste the path to your ${i==="ios"?".p8":".json"} file:`,validate:A=>G.existsSync(A)?void 0:"File not found"});if(F(C)){T("Operation cancelled");return}d=C}}let y=n.issuerId,u=n.keyId;if(i==="ios"){if(!u&&d){let p=x.basename(d).match(/AuthKey_(.*)\.p8/);p&&(u=p[1],R.info(`Auto-detected Key ID from filename: ${V.green(u)}`))}if(!y){let p=await $({message:"Enter App Store Connect Issuer ID (Found on the Keys page):",validate:l=>l.length>0?void 0:"Issuer ID is required"});if(F(p)){T("Operation cancelled");return}y=p}if(!u){let p=await $({message:"Enter App Store Connect Key ID:",validate:l=>l.length>0?void 0:"Key ID is required"});if(F(p)){T("Operation cancelled");return}u=p}}if(i==="android"&&(!g||g==="*")){let p=await Ze();if(p===null)return;g=p}let I=t.submit?.production?.ios?.appleTeamId,m=me(t);await pe(s,d,i,y,u,g,{teamId:i==="ios"?I:void 0,developerTeamId:i==="ios"?I:void 0,appStoreConnectTeamId:i==="ios"?m:void 0,providerId:i==="ios"?m:void 0})};async function Ee(n,e,i){let a=await Be(n),t=Ye(e,i);if(t&&!a.includes(t)&&a.unshift(t),a.length>0){let s=await M({message:"Select Android package for this Google Play service key:",options:[...a.map(c=>({value:c,label:c,hint:c===t?"from config":void 0})),{value:"manual",label:"Enter another package name..."}]});if(F(s))return T("Operation cancelled"),null;if(s==="manual")return Ze();if(s!=="manual")return s}if(t){let s=await he({message:`Use Android package from local config (${t})?`,initialValue:!0});if(F(s))return T("Operation cancelled"),null;if(s)return t}}async function Ze(){let n=await $({message:"Android package name for this Google Play service key:",placeholder:"com.example.app",validate:e=>e.includes(".")?void 0:"Enter a valid package name"});return F(n)?(T("Operation cancelled"),null):n}async function Be(n){try{let i=(await v.get(`/credentials/${n}`)).data.credentials||[],a=new Set;for(let t of i)(t.platform==="android"||t.type==="android_keystore"||t.type==="google_service_account")&&t.bundleId&&t.bundleId!=="*"&&a.add(t.bundleId);return Array.from(a).sort()}catch(e){return R.warn(V.yellow(`Could not fetch saved Android package identifiers: ${e.message}`)),[]}}function Ye(n,e){let i=ae(n,e);if(i)return i;let a=x.join(process.cwd(),"app.json");if(G.existsSync(a))try{return JSON.parse(G.readFileSync(a,"utf-8")).expo?.android?.package}catch{}let t=x.join(process.cwd(),"app.config.json");if(G.existsSync(t))try{let s=JSON.parse(G.readFileSync(t,"utf-8"));return s.expo?.android?.package||s.android?.package}catch{}}async function Je(n,e){let i=q(),a=e.submit?.production?.ios?.appleId,t=e.submit?.production?.ios?.appleTeamId,s=me(e);if(!a){let g=await $({message:"Apple ID:",placeholder:"your-email@example.com"});if(F(g))return;a=g}if(!t){let g=await $({message:"Apple Team ID:",placeholder:"e.g. 4523G95823"});if(F(g))return;t=g,e.submit||(e.submit={production:{ios:{}}}),e.submit.production||(e.submit.production={ios:{}}),e.submit.production.ios||(e.submit.production.ios={}),e.submit.production.ios.appleTeamId=t,G.writeFileSync(`./${f.configFileName}`,JSON.stringify(e,null,2))}let c=await $({message:"Enter a name for the new API Key:",initialValue:`[${f.name}] Project ${n}`});if(F(c))return;let d=le();if(!G.existsSync(d)){R.error(`Magic Error: Helper script not found at ${d}`);return}try{let g=await Ne(d,e,a,t);if(g===null)return;if(g)s=g;else if(!s)return;i.start("Creating App Store Connect API Key...");let y=Z=>j("ruby",[d,"create",c],{env:be(a,t,Z),stdio:["inherit","pipe","pipe"],encoding:"utf-8"}),u=y(s),I=u.stdout||"",m=u.stderr||"";if(u.status!==0){let Z=Ie(`${I}
+${m}`);if(Z.length>0){i.stop("Select App Store Connect team"),oe(`Apple Developer Team IDs look like ${V.bold(t)}.
+App Store Connect API keys use a numeric provider/team ID instead.`,"Team ID mismatch");let k=await ge(e,Z,"Select the App Store Connect provider for this API key:");if(!k)return;s=k,i.start("Creating API Key with selected App Store Connect team..."),u=y(s),I=u.stdout||"",m=u.stderr||""}}if(m&&(m.includes("DEBUG:")||m.includes("ERROR:"))&&m.split(`
+`).forEach(Z=>{Z.trim()&&R.info(V.dim(`[Ruby] ${Z.trim()}`))}),u.status!==0){i.stop("Failed"),R.error(`Magic creation failed: ${m}`);return}let p=I.match(new RegExp(`${f.jsonStartMarker}(.*)${f.jsonEndMarker}`));if(!p){i.stop("Parse Error"),R.error("Could not parse response from Apple Portal.");return}let l=JSON.parse(p[1]),{id:C,issuerId:A,keyContent:N}=l;if(i.stop("Key Created Successfully"),R.success(`\u2713 Created Key ID: ${V.green(C)}`),!A){oe(`Your Issuer ID is shown at the top of:
+  ${V.cyan("https://appstoreconnect.apple.com/access/integrations/api")}
+
+It looks like: ${V.dim("xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx")}`,"One More Thing");let Z=await $({message:"Enter your App Store Connect Issuer ID:",validate:k=>k.trim().length>0?void 0:"Issuer ID is required"});if(F(Z)){T("Operation cancelled.");return}A=Z.trim()}if(N){let Z=x.join(ue.tmpdir(),`AuthKey_${C}.p8`);G.writeFileSync(Z,N),await pe(n,Z,"ios",A,C,e.ios?.bundleIdentifier||"*",{teamId:t,developerTeamId:t,appStoreConnectTeamId:s,providerId:s}),G.unlinkSync(Z)}else{R.warn(V.yellow("\u26A0\uFE0F  Apple did not return the private key in the response.")),oe(`Download the .p8 file manually:
+
+  1. Open: ${V.cyan("https://appstoreconnect.apple.com/access/integrations/api")}
+  2. Find Key ID: ${V.green(C)}
+  3. Click ${V.bold("Download API Key")} (only available once)
+  4. Drag & drop the downloaded .p8 file below`,"Manual Step Required");let Z=await $({message:"Path to the downloaded .p8 file (drag & drop here):",validate:k=>G.existsSync(k)?void 0:"File not found"});if(F(Z)){T("Operation cancelled. Credential ID was registered but key content is missing.");return}await pe(n,Z,"ios",A,C,e.ios?.bundleIdentifier||"*",{teamId:t,developerTeamId:t,appStoreConnectTeamId:s,providerId:s})}}catch(g){i.stop("Error"),R.error(`Error: ${g.message}`)}}async function xe(n,e){let i=q(),a=e.submit?.production?.ios?.appleId,t=e.submit?.production?.ios?.appleTeamId,s=me(e);if(!a){let d=await $({message:"Apple ID:"});if(F(d))return;a=d}if(!t){let d=await $({message:"Apple Team ID:"});if(F(d))return;t=d,e.submit||(e.submit={production:{ios:{}}}),e.submit.production||(e.submit.production={ios:{}}),e.submit.production.ios||(e.submit.production.ios={}),e.submit.production.ios.appleTeamId=t,G.writeFileSync(`./${f.configFileName}`,JSON.stringify(e,null,2))}i.start("Fetching existing API Keys...");let c=le();if(!G.existsSync(c)){R.error(`Magic Error: Helper script not found at ${c}`);return}try{let d=l=>j("ruby",[c,"list"],{env:{...de(),FASTLANE_USER:a,FASTLANE_TEAM_ID:t,...l?{FASTLANE_ITC_TEAM_ID:l,FASTLANE_ASC_TEAM_ID:l}:{}},stdio:["inherit","pipe","pipe"],encoding:"utf-8"}),g=d(s);if(g.status!==0){let l=Ie(`${g.stdout||""}
+${g.stderr||""}`);if(l.length>0){i.stop("Select App Store Connect team");let C=await M({message:"Select the App Store Connect team to list API keys:",options:l.map(A=>({value:A.id,label:A.name,hint:A.id}))});if(F(C)){T("Operation cancelled");return}s=C,i.start("Fetching existing API Keys..."),g=d(s)}}if(g.status!==0){i.stop("Failed"),R.error(`Listing failed: ${g.stderr}`);return}let y=g.stdout.match(new RegExp(`${f.jsonStartMarker}(.*)${f.jsonEndMarker}`));if(!y){i.stop("Parse Error");return}let u=JSON.parse(y[1]);if(i.stop(`Found ${u.length} keys`),u.length===0){R.info("No API Keys found on this team.");return}let I=await M({message:"Select a key to delete from Apple Developer Portal:",options:[...u.map(l=>({value:l.id,label:`ID: ${l.id} - ${l.name} (${l.role})`})),{value:"cancel",label:"Cancel"}]});if(F(I)||I==="cancel")return;let m=await he({message:`Are you sure you want to delete Key ${I}? This cannot be undone.`});if(!m||F(m))return;i.start(`Deleting Key ${I}...`);let p=j("ruby",[le(),"delete",I],{env:{...de(),FASTLANE_USER:a,FASTLANE_TEAM_ID:t,...s?{FASTLANE_ITC_TEAM_ID:s,FASTLANE_ASC_TEAM_ID:s}:{}},stdio:"pipe",encoding:"utf-8"});p.status===0?(i.stop("Deleted"),R.success(`\u2713 Key ${I} has been removed from Apple Portal.`)):(i.stop("Deletion Failed"),R.error(`Error: ${p.stderr}`))}catch(d){i.stop("Error"),R.error(`Error: ${d.message}`)}}async function pe(n,e,i,a,t,s="*",c={}){let d=q();d.start(`Uploading Service Credentials for ${i}...`);try{let g=i==="ios"?"asc_api_key":"google_service_account",y=new URL(import.meta.url),u=x.dirname(y.pathname),I=[x.join(u,"isolated-upload.js"),x.join(u,"commands","isolated-upload.js"),x.resolve(u,"../commands/isolated-upload.js"),x.resolve(process.cwd(),`node_modules/.bin/${f.nameLower}-upload`)],m="";for(let l of I)if(G.existsSync(l)){m=l;break}if(!m)throw new Error("Could not locate isolated-upload.js. Ensure the CLI is properly installed.");let p=j("node",[m,n,e,g,s,"service","undefined","undefined",a||"undefined",t||"undefined","undefined","undefined","undefined",c.teamId||"undefined",c.teamName||"undefined",c.developerTeamId||"undefined",c.appStoreConnectTeamId||"undefined",c.providerId||"undefined",c.providerName||"undefined"],{stdio:"pipe",encoding:"utf-8",env:{...process.env,AT_CLI_ISOLATED:"1"}});if(p.status!==0){let l=p.stderr||p.stdout||"Unknown upload failure";d.stop("Upload Failed"),R.error(V.red(`Upload Failed: ${l}`));return}p.stdout.includes("SUCCESS")?(d.stop("Upload Success"),R.success(V.green(`\u2713 Service Credentials for ${i} uploaded successfully.`))):(d.stop("Upload Summary"),R.warn(V.yellow(`Upload finished but success not confirmed: ${p.stdout}`)))}catch(g){d.stop("Upload Error"),R.error(V.red(`Error: ${g.message}`))}}function Ue(n){let e=n==="ios"?".p8":".json",i=[],a=[{path:"./",label:"Project Root"},{path:x.join(ue.homedir(),"Downloads"),label:"Downloads"}];for(let t of a)if(G.existsSync(t.path))try{let s=G.readdirSync(t.path);for(let c of s)if(c.endsWith(e)){if(n==="android"&&!G.readFileSync(x.join(t.path,c),"utf8").includes("service_account")||n==="ios"&&!c.startsWith("AuthKey"))continue;i.push({path:x.join(t.path,c),location:t.label})}}catch{}return i}import Ve from"axios";import o from"chalk";import{execSync as H,spawnSync as z}from"child_process";import fe from"crypto";import b from"fs";import X from"path";import ye from"os";Ve.defaults.proxy=!1;function Ae(n,e){if(!b.existsSync(n))return;let i=b.readdirSync(n);for(let a of i){let t=X.join(n,a);if(b.statSync(t).isDirectory()){let c=Ae(t,e);if(c)return c}else if(e.test(a))return t}}var ee=n=>String(n||"").trim().toLowerCase().replace(/_/g,"-"),Ge=n=>{let e=n.toLowerCase();return e==="production"||e==="prod"||e.includes("store")||e.endsWith("-production")||e.endsWith("-prod")},$e=n=>{let e=n.toLowerCase();return e==="staging"||e==="stage"||e.includes("preview")||e.includes("adhoc")||e.includes("ad-hoc")||e.endsWith("-staging")||e.endsWith("-stage")},_e=(n,e)=>{let i=L(n,e)||{},a=ee(i.distribution),t=ee(i.iosExportMethod||i.ios?.exportMethod),s=ee(i.environment);return t==="app-store"||a==="store"?"store":t==="development"||a==="development"?"development":t==="ad-hoc"||t==="adhoc"||a==="ad-hoc"||a==="adhoc"||a==="internal"?"adhoc":s==="production"||s==="store"?"store":s==="development"||s==="dev"?"development":s==="staging"||s==="stage"||s==="preview"?"adhoc":Ge(e)?"store":$e(e)?"adhoc":"development"},De=(n,e)=>{let i=L(n,e)||{},a=ee(i.distribution),t=ee(i.environment);return a==="store"||t==="production"||t==="store"||Ge(e)?"store":"internal"};function Ke(n,e,i){let a=b.readFileSync(i,"utf8"),t=Math.floor(Date.now()/1e3),s=Buffer.from(JSON.stringify({alg:"ES256",kid:n,typ:"JWT"})).toString("base64url"),c=Buffer.from(JSON.stringify({iss:e,iat:t,exp:t+1200,aud:"appstoreconnect-v1"})).toString("base64url"),d=`${s}.${c}`,g=fe.createSign("SHA256");g.update(d);let y=g.sign({key:a,dsaEncoding:"ieee-p1363"}).toString("base64url");return`${d}.${y}`}async function Oe(n,e,i,a){let t=Ke(e,i,a),s=(await import("axios")).default;for(let c of n)try{await s.post("https://api.appstoreconnect.apple.com/v1/devices",{data:{type:"devices",attributes:{name:c.name,udid:c.udid,platform:"IOS"}}},{headers:{Authorization:`Bearer ${t}`,"Content-Type":"application/json"}}),r.info(o.dim(`  \u2713 Registered: ${c.name}`))}catch(d){let g=d.response?.data?.errors;g?.some(u=>u.code==="ENTITY_ERROR.ATTRIBUTE.INVALID.DUPLICATE"||u.detail?.toLowerCase().includes("already registered")||u.detail?.toLowerCase().includes("already exists"))?r.info(o.dim(`  Already on Portal: ${c.name}`)):r.warn(o.yellow(`  Could not register ${c.name}: ${g?.[0]?.detail||d.message}`))}}var we=async n=>{Pe(o.bgCyan.black(f.cliTag("Credentials")));let e=await K({message:"Select platform:",options:[{value:"ios",label:"iOS"},{value:"android",label:"Android"}]});W(e)&&(U("Operation cancelled"),process.exit(0));let i=await K({message:"What do you want to do?",options:[{value:"setup",label:"Build Credentials (Certs/Profiles)",hint:"Manage everything needed to build your project"},{value:"download",label:"Download credentials (credentials.json)",hint:"Sync credentials from Dashboard to local project"},{value:"service",label:"App Store Connect API Key (Magic)",hint:"Manage your API Key for automated submission"},{value:"push",label:"Push Notifications (Placeholder)",hint:"Manage your Apple Push Notifications Key"},{value:"back",label:"Go back"},{value:"exit",label:"Exit"}].filter(a=>!(e==="android"&&(a.value==="service"&&(a.label="Google Service Account (JSON)"),a.value==="push")))});if((W(i)||i==="exit")&&(U("Operation cancelled"),process.exit(0)),i==="back")return we(n);if(i==="setup")await Le({...n,platform:e});else if(i==="download")await tt({...n,platform:e});else if(i==="service")await Se({...n,platform:e});else if(i==="push")return ve("Push Notifications management is coming soon!","Coming Soon"),we(n);Te(o.green("Done!"))},Le=async n=>{let e=te(),i=n.platform,a=n.profile;if(!a){let d=await K({message:"Select credential type:",options:[{value:"development",label:"Development",hint:"Local testing & simulators"},{value:"staging",label:"Ad Hoc / Staging",hint:"Internal distribution & device testing"},{value:"production",label:"Production / App Store",hint:"App Store & Play Store submission"}]});W(d)&&(U("Operation cancelled"),process.exit(0)),a=d}let t=`./${f.configFileName}`;if(!b.existsSync(t)){r.error(`No ${f.configFileName} found. Run \`${f.nameLower} init\` or \`${f.nameLower} link\` first.`);return}let s=JSON.parse(b.readFileSync(t,"utf-8")),{projectId:c}=s;if(!c){r.error(`${f.configFileName} is missing projectId.`);return}if(n.awsProfile&&r.warn(o.yellow(`Ignoring --aws-profile. Authenticating with ${f.name} Cloud...`)),r.info(o.dim(`Setting up credentials for: ${a}`)),i==="ios")await Me(c,a,n,s);else{let d=De(s,a);await je(c,a,d,n,s)}};async function Me(n,e,i,a){let t=i.bundleId;if(!t){let g=a.submit?.[e]?.ios?.bundleIdentifier||a.submit?.[e]?.ios?.bundleId||re(a,e),y=[];try{let I=(await v.get(`/credentials/${n}`)).data.credentials||[];y=[...new Set(I.filter(m=>m.platform==="ios"&&m.bundleId&&m.bundleId!=="*").map(m=>m.bundleId))]}catch{}if(g&&!y.includes(g)&&y.unshift(g),y.length>0){let u=[...y.map(m=>({value:m,label:m,hint:m===g?"from config":void 0})),{value:"__new__",label:"+ Enter a new Bundle ID"}],I=await K({message:"Which Bundle ID are you setting up credentials for?",options:u});if(W(I)&&(U("Operation cancelled"),process.exit(0)),I==="__new__"){let m=await _({message:"iOS Bundle ID (e.g. com.example.app):",placeholder:"com.example.app",validate:p=>p.includes(".")?void 0:"Please enter a valid Bundle ID"});W(m)&&(U("Operation cancelled"),process.exit(0)),t=m}else t=I}else{let u=await _({message:"iOS Bundle ID (e.g. com.example.app):",placeholder:"com.example.app",validate:I=>I.includes(".")?void 0:"Please enter a valid Bundle ID"});W(u)&&(U("Operation cancelled"),process.exit(0)),t=u}}r.info(o.dim(`Bundle ID: ${t}`));let s=_e(a,e),c=a.submit?.production?.ios?.appleId;c&&r.info(o.dim(`Using Apple ID from config: ${c}`)),await Qe(n,t,e,s,s==="store"?"appstore":s==="adhoc"?"adhoc":"development",i,a,c)}async function ze(n){let e="MATCH_ENCRYPTION_PASSPHRASE";try{let c=((await v.get(`/projects/${n}/secrets/export?env=development`)).data.secrets||{})[e];if(c&&!c.includes("[Decryption Failed]"))return r.info(o.dim("Using existing encryption passphrase from Dashboard")),r.info(o.cyan(`MATCH_PASSWORD: ${c}`)),c;if(c&&c.includes("[Decryption Failed]")){r.warn(o.yellow("\u26A0\uFE0F  Existing MATCH_PASSWORD could not be decrypted (encryption key changed).")),r.info(o.dim("Generating a fresh passphrase and cleaning old certificates..."));let d=fe.randomBytes(32).toString("base64");try{await v.post(`/projects/${n}/secrets`,{key:e,value:d,type:"managed",description:"Encryption passphrase for iOS certificates (fastlane match)",visibility:"secret"}),r.success(o.green("\u2713 New encryption passphrase generated and saved"))}catch{}try{await v.post("/credentials/clean-match-storage",{projectId:n}),r.success(o.green("\u2713 Cleaned old certificates from storage"))}catch{}return d}}catch(t){r.info(o.dim(`Could not fetch existing passphrase from Dashboard: ${t.message}`))}let i=await K({message:"No active encryption passphrase found on Dashboard. What would you like to do?",options:[{value:"generate",label:"Generate a new secure passphrase",hint:"Safe for first-time setup"},{value:"enter",label:"Enter existing passphrase manually",hint:"Required if you already have certs in S3"},{value:"cancel",label:"Cancel",hint:"Quit"}]});if((W(i)||i==="cancel")&&(U("Operation cancelled"),process.exit(0)),i==="enter"){let t=await ce({message:"Enter your MATCH_PASSWORD (encryption passphrase):",validate:c=>c.length>0?void 0:"Passphrase is required"});W(t)&&(U("Operation cancelled"),process.exit(0));let s=t;try{await v.post(`/projects/${n}/secrets`,{key:e,value:s,type:"managed",description:"Encryption passphrase for iOS certificates (fastlane match)"}),r.success(o.green("\u2713 Saved passphrase to Dashboard"))}catch{}return s}let a=fe.randomBytes(32).toString("base64");try{await v.post(`/projects/${n}/secrets`,{key:e,value:a,type:"managed",description:"Encryption passphrase for iOS certificates (fastlane match)",visibility:"secret"}),r.success(o.green("\u2713 Generated and saved encryption passphrase to Dashboard")),r.info(o.cyan(`MATCH_PASSWORD: ${a}`))}catch(t){r.warn(o.yellow(`Could not save passphrase to Dashboard: ${t.message}`))}return a}async function Qe(n,e,i,a,t,s,c,d){let g=te();r.info(o.blue("Configuring iOS certificate management..."));let y;if(!d){let u=await _({message:"Apple ID (for Apple Developer Portal):",placeholder:"your-email@example.com",validate:I=>I.includes("@")?void 0:"Please enter a valid email"});W(u)&&(U("Operation cancelled"),process.exit(0)),d=u}g.start(`Fetching ${t} certificates...`);try{let u=await ze(n),I="",m="";try{let A=await v.post("/credentials/build-server-token",{projectId:n});A.data.status==="success"&&A.data.credentials&&(process.env.AWS_ACCESS_KEY_ID=A.data.credentials.accessKeyId,process.env.AWS_SECRET_ACCESS_KEY=A.data.credentials.secretAccessKey,A.data.credentials.sessionToken&&(process.env.AWS_SESSION_TOKEN=A.data.credentials.sessionToken),m=A.data.credentials.region||"ap-south-1",I=A.data.credentials.bucket||f.bucketPrefix,process.env.AWS_REGION=m,delete process.env.AWS_PROFILE)}catch(A){throw r.error(`Failed to authenticate with ${f.name} Cloud.`),A}if(!I||!m){r.error(`Failed to resolve S3 configuration from ${f.name} Cloud.`);return}let p=s.teamId||c.submit?.production?.ios?.appleTeamId;if(!p)try{let N=(await v.get(`/projects/${n}/secrets`)).data.secrets?.find(Z=>Z.key==="APPLE_TEAM_ID");N&&(p=N.value,r.info(o.dim(`Using Team ID from Dashboard: ${p}`)))}catch{}if(p&&p===c.submit?.production?.ios?.appleTeamId&&r.info(o.dim(`Using Apple Team ID from config: ${p}`)),!p){r.warn(o.yellow(`
+Apple Team ID is required to fetch certificates.`)),r.info(o.dim("You can find this at: https://developer.apple.com/account \u2192 Membership Details"));let A=await _({message:"Enter your 10-character Apple Team ID:",placeholder:"e.g. SA56KTS33U",validate:N=>N.length===10?void 0:"Team ID must be exactly 10 characters"});W(A)&&(U("Operation cancelled"),process.exit(0)),p=A,await Re(n,p)}g.stop("Starting certificate sync...");let l=`${f.buildPrefix}-${p}.keychain-db`,C=f.keychainPassword;try{let N=`${process.env.HOME||"/Users/"+(process.env.USER||f.nameLower)}/Library/Keychains/${l}`;r.info(o.dim(`Ensuring keychain exists: ${l}`));try{H(`security create-keychain -p ${C} ${l} 2>/dev/null || true`),H(`security unlock-keychain -p ${C} ${l}`),H(`security set-keychain-settings ${l}`);let S=H("security list-keychains -d user").toString();if(!S.includes(l)){r.info(o.dim(`Adding ${l} to search list`));let h=[...S.replace(/"/g,"").split(`
+`).map(B=>B.trim()).filter(B=>B.length>0),N].join(" ");H(`security list-keychains -d user -s ${h}`)}}catch(S){r.warn(o.dim("Keychain setup warning (non-critical): "+S.message))}let Z,k;try{let w=((await v.get(`/credentials/${n}`)).data.credentials||[]).find(h=>h.type==="asc_api_key"&&h.issuerId);if(w){let h=await v.get(`/credentials/${w.credentialId}/download`,{params:{projectId:n}});if(h.data.downloadUrl){let J=await(await import("axios")).default.get(h.data.downloadUrl,{responseType:"arraybuffer"}),O=X.join(ye.tmpdir(),`mach-asc-${Date.now()}`);b.mkdirSync(O,{recursive:!0}),y=X.join(O,`AuthKey_${w.keyId}.p8`),b.writeFileSync(y,Buffer.from(J.data)),Z=w.keyId,k=w.issuerId,r.success(o.green("\u2713 ASC API key loaded \u2014 no 2FA required for Portal operations"))}}}catch(S){r.warn(o.dim(`Could not load ASC API key: ${S.message}. Will fall back to Apple ID auth.`))}r.info(o.dim("Generating secure P12 export password..."));let P=ke();r.success(o.green("\u2713 Secure P12 password generated."));let Y={...process.env,AWS_REGION:process.env.AWS_REGION||"ap-south-1",AWS_ACCESS_KEY_ID:process.env.AWS_ACCESS_KEY_ID,AWS_SECRET_ACCESS_KEY:process.env.AWS_SECRET_ACCESS_KEY,SSL_CERT_FILE:"/etc/ssl/cert.pem",AWS_CA_BUNDLE:"/etc/ssl/cert.pem",FASTLANE_SSL_CA_CERT:"/etc/ssl/cert.pem",MATCH_PASSWORD:u,FASTLANE_USER:d,FASTLANE_SKIP_UPDATE_CHECK:"1",FASTLANE_TEAM_ID:p,MATCH_KEYCHAIN_NAME:N,MATCH_KEYCHAIN_PASSWORD:C,TERM:process.env.TERM||"xterm-256color",SHELL:process.env.SHELL||"/bin/zsh",MATCH_OUTPUT_PATH:X.join(process.cwd(),"temp_match"),MATCH_STORAGE_MODE:"s3",MATCH_S3_REGION:m,MATCH_S3_BUCKET:I,MATCH_S3_OBJECT_PREFIX:"ios-certificates/",MATCH_USERNAME:d,MATCH_APP_IDENTIFIER:e,MATCH_TYPE:t,[`${f.envPrefix}P12_PASSWORD`]:P,...y&&Z&&k?{APP_STORE_CONNECT_API_KEY_KEY_ID:Z,APP_STORE_CONNECT_API_KEY_ISSUER_ID:k,APP_STORE_CONNECT_API_KEY_KEY_FILEPATH:y,FASTLANE_SKIP_2FA:"1"}:{}};if(s.force){r.warn(o.yellow(`
+\u26A0\uFE0F  Force flag detected: Hard resetting ${t} certificates...`)),r.info(o.dim("Detected decryption failure loop. Clearing remote storage directly to allow fresh generation.")),r.info(o.cyan(`Current MATCH_PASSWORD: ${u}`)),r.info(o.dim(`Cleaning match storage for Team ID: ${p}...`));try{(await v.post("/credentials/clean-match-storage",{projectId:n,teamId:p})).data.status==="success"&&r.success(o.green(`\u2713 Cleared S3 storage for Team ID: ${p}`))}catch(S){r.warn(o.yellow(`S3 cleanup via API failed: ${S.message}`)),r.info(o.dim("Continuing to attempt standard nuke..."))}try{H(`fastlane match nuke ${t} --skip_confirmation`,{stdio:"inherit",cwd:process.cwd(),env:Y}),r.success(o.green(`\u2713 Nuked existing ${t} credentials`))}catch{r.warn(o.yellow("Standard nuke failed (likely due to password mismatch).")),r.info(o.dim("Since S3 was cleared manually, proceeding to generation..."))}}if(t==="adhoc"||t==="development")try{r.info(o.blue("Fetching registered devices..."));let w=(await v.get("/devices")).data.devices||[];if(w.length===0)r.warn(o.yellow("No registered devices found. Profile will only include devices already on the Apple Developer Portal.")),r.info(o.dim(`Register devices with: ${f.nameLower} device register`));else{let{multiselect:h}=await import("@clack/prompts"),B=await h({message:`Select devices to include in the ${t} profile:`,options:w.map(J=>({value:J.udid,label:`${J.name} (${J.udid.substring(0,12)}...)`,hint:J.model||J.platform})),initialValues:w.map(J=>J.udid)});if(!W(B)&&B.length>0){let J=w.filter(O=>B.includes(O.udid));if(r.info(o.blue(`Registering ${J.length} device(s) on Apple Developer Portal...`)),y&&Z&&k)await Oe(J,Z,k,y);else{r.info(o.dim("You will be prompted for a 2FA code once \u2014 type it and press Enter."));for(let O of J){let Xe=O.name.replace(/"/g,'\\"');z(`fastlane run register_device name:"${Xe}" udid:"${O.udid}"`,{shell:!0,env:Y,stdio:"inherit",cwd:process.cwd()})}}r.info(o.green("\u2713 Device registration complete."))}}}catch(S){r.warn(o.yellow(`Could not fetch registered devices: ${S.message}`)),r.info(o.dim("Continuing without explicit device registration."))}try{let S=z(`fastlane match ${t} --app_identifier "${e}" --profile_name "${f.nameLower} ${t} ${e}"`,{shell:!0,cwd:process.cwd(),env:Y,stdio:"inherit",encoding:"utf-8"});if(S.status!==0){r.warn(o.yellow(`
+Certificate sync failed. Attempting to create App ID and retry...`));try{H(`fastlane produce --app_identifier "${e}" --app_name "${e}" --skip_itc`,{stdio:"inherit",env:Y}),r.success(o.green("\u2713 App ID created successfully")),r.info(o.blue("Retrying certificate sync...")),S=z(`fastlane match ${t} --app_identifier "${e}" --profile_name "${f.nameLower} ${t} ${e}"`,{shell:!0,cwd:process.cwd(),env:Y,stdio:"inherit",encoding:"utf-8"})}catch{}if(S.status!==0)throw new Error("fastlane match failed")}}catch(S){r.warn(o.yellow(`
+Sync failed. This often happens if the encryption passphrase (MATCH_PASSWORD) is incorrect or session expired.`)),r.info(o.cyan(`Failed MATCH_PASSWORD was: ${u}`));let w=await K({message:"What would you like to do?",options:[{value:"retry_password",label:"Retry with a different MATCH_PASSWORD",hint:"Manually enter the decryption passphrase"},{value:"check_portal",label:"Check Apple Portal (Resolve certificate limits)",hint:"See if you have too many certificates"},{value:"manual",label:"Fallback to manual upload",hint:"Provide .p12 and .mobileprovision files"},{value:"cancel",label:"Cancel",hint:"Go back"}]});if(W(w)||w==="cancel")throw S;if(w==="retry_password"){r.info(o.dim(`
+You are overriding the dashboard passphrase for this session.`));let h=await ce({message:"Enter the correct MATCH_PASSWORD for this project:"});if(h&&!W(h)){u=h,r.info(o.blue("Retrying with provided passphrase...")),r.info(o.cyan(`New MATCH_PASSWORD: ${u}`));let B={...Y,MATCH_PASSWORD:u};if(z(`fastlane match ${t}`,{shell:!0,stdio:"inherit",cwd:process.cwd(),env:B}).status===0)await v.post(`/projects/${n}/secrets`,{key:"MATCH_ENCRYPTION_PASSPHRASE",value:u,description:"Encryption passphrase for iOS certificates (fastlane match)",visibility:"secret"}),r.success(o.green("\u2713 Dashboard passphrase updated.")),r.info(o.cyan(`MATCH_PASSWORD: ${u}`));else throw new Error("Sync failed again with provided passphrase.")}else throw S}else if(w==="check_portal")try{let h=await Ce(Y,t);if(h.length>0){if(r.info(o.dim(`Found ${h.length} existing ${t} certificates on the portal.`)),await it(t,Y,n,h)&&(r.info(o.blue("Retrying certificate sync...")),z(`fastlane match ${t}`,{shell:!0,stdio:"inherit",cwd:process.cwd(),env:Y}).status!==0))throw new Error("Retry failed")}else throw r.error(o.red("No existing certificates found on portal to resolve.")),S}catch(h){throw r.warn(o.dim(`Portal check warning: ${h.message}`)),S}else throw S}r.success(o.green("\u2713 Certificates fetched and synced"));let E=X.join(process.cwd(),"temp_match"),D=X.join(E,`${f.fastlanePrefix}_export.p12`),ne=Ae(E,/\.mobileprovision$/);try{let w=`${process.env.HOME||"/Users/"+(process.env.USER||f.nameLower)}/Library/Keychains/${l}`;b.existsSync(E)||b.mkdirSync(E,{recursive:!0}),r.info(o.dim("Exporting certificate from keychain for dashboard upload..."));let h=H(`security find-identity -v -p codesigning "${w}"`,{encoding:"utf-8"});r.info(o.dim(`Identities in keychain:
+${h.trim()}`)),H(`security export -k "${w}" -t identities -f pkcs12 -o "${D}" -P ""`,{stdio:"ignore"});try{let B=H(`openssl pkcs12 -in "${D}" -nokeys -passin pass: -legacy 2>/dev/null || openssl pkcs12 -in "${D}" -nokeys -passin pass: 2>/dev/null`,{encoding:"utf-8"});if(!B.includes(p))throw new Error(`Exported P12 does not contain identity for team ${p}. Found: ${B.substring(0,200)}`);r.success(o.green(`\u2713 P12 verified \u2014 contains correct team identity (${p})`))}catch(B){throw new Error(`P12 verification failed: ${B.message}`)}}catch{r.warn(o.dim("Could not export certificate from keychain."))}s.teamId&&!p&&await Re(n,s.teamId);let ie=b.existsSync(D)?D:Ae(E,/\.p12$/);if(ie&&ne){let S,w;try{let h=await Ce(Y,t);h.length>0&&(S=h[0].expires,w=h[0].id)}catch{r.warn(o.dim("Could not fetch expiration date or ID for dashboard record."))}await Q(n,ie,"ios_cert",e,a,void 0,S,s.teamId||p,w,P),await Q(n,ne,"ios_profile",e,a,void 0,S,s.teamId||p),r.success(o.green("\u2713 Both iOS certificate and provisioning profile uploaded successfully"));try{b.existsSync("./temp_match")&&b.rmSync("./temp_match",{recursive:!0,force:!0})}catch{}}else r.warn(o.yellow("Certificates generated but not found in expected location.")),r.info(o.dim("Falling back to manual upload...")),await We(n,e,a)}catch(A){g.stop("Certificate fetch failed"),r.error(o.red(`Error: ${A.message}`)),r.info(o.dim("Falling back to manual upload...")),await We(n,e,a)}}catch(u){g.stop("iOS setup failed"),r.error(o.red(`Error: ${u.message}`))}finally{if(y)try{b.rmSync(X.dirname(y),{recursive:!0,force:!0})}catch{}}}async function Re(n,e){try{await v.post(`/projects/${n}/secrets`,{key:"APPLE_TEAM_ID",value:e,description:"Apple Developer Team ID (used for iOS signing)"}),r.success(o.green(`\u2713 Saved Team ID ${e} to Dashboard`))}catch(i){r.warn(o.yellow(`Could not save Team ID to Dashboard: ${i.message}`))}}async function We(n,e,i){r.info(o.yellow(`
+Manual Upload Mode`)),r.info("Please provide your certificate and provisioning profile:");let a=await _({message:"Path to .p12 certificate file:",validate:c=>b.existsSync(c)?void 0:"File not found"});W(a)&&(U("Operation cancelled"),process.exit(0));let t=await _({message:"Path to .mobileprovision file:",validate:c=>b.existsSync(c)?void 0:"File not found"});W(t)&&(U("Operation cancelled"),process.exit(0));let s=te();s.start(`Uploading to ${f.name} Dashboard...`);try{await Q(n,a,"ios_cert",e,i),await Q(n,t,"ios_profile",e,i),s.stop("Upload complete"),r.success(o.green("\u2713 iOS credentials uploaded successfully"))}catch(c){throw s.stop("Upload failed"),c}}async function je(n,e,i,a,t){let s=te();r.step(o.blue("Android Credential Setup"));let c=a.bundleId;if(!c){let I=ae(t,e),m=[];try{let l=(await v.get(`/credentials/${n}`)).data.credentials||[];m=[...new Set(l.filter(C=>C.platform==="android"&&C.bundleId&&C.bundleId!=="*").map(C=>C.bundleId))]}catch{}if(I&&!m.includes(I)&&m.unshift(I),m.length>0){let p=[...m.map(C=>({value:C,label:C,hint:C===I?"from config":void 0})),{value:"__new__",label:"+ Enter a new Package Name"}],l=await K({message:"Which Package Name are you setting up credentials for?",options:p});if(W(l)&&(U("Operation cancelled"),process.exit(0)),l==="__new__"){let C=await _({message:"Android Package Name (e.g. com.example.app):",placeholder:"com.example.app",validate:A=>A.includes(".")?void 0:"Please enter a valid package name"});W(C)&&(U("Operation cancelled"),process.exit(0)),c=C}else c=l}else{let p=await _({message:"Android Package Name (e.g. com.example.app):",placeholder:"com.example.app",validate:l=>l.includes(".")?void 0:"Please enter a valid package name"});W(p)&&(U("Operation cancelled"),process.exit(0)),c=p}}try{let p=((await v.get(`/credentials/${n}`)).data.credentials||[]).find(l=>l.platform==="android"&&l.distributionType===i&&l.bundleId===c);if(p){r.warn(o.yellow(`\u26A0\uFE0F  Existing Android credentials found for ${i}`));let l=await _({message:"What would you like to do? (use/new/cancel)",validate:C=>{let A=C.toLowerCase();if(!(A==="use"||A==="new"||A==="cancel"))return"Please type: use, new, or cancel"}});if(W(l)||l.toLowerCase()==="cancel")return;if(l.toLowerCase()==="use"){r.success(o.green("\u2713 Using existing credentials."));return}await v.delete(`/credentials/${p.credentialId}?projectId=${n}`)}}catch{}let d="./android/app/my-release-key.jks";if(b.existsSync(d)){let I=await He({message:"Upload existing keystore?"});if(I&&!W(I)){let m=await _({message:"Key alias:",initialValue:"my-key-alias"});if(W(m))return;let p=await ce({message:"Keystore password:"});if(W(p))return;let l=await ce({message:"Key password (leave blank if same as keystore password):"});if(W(l))return;let C=l.trim()||p;await Q(n,d,"android_keystore",c,i,m,void 0,void 0,void 0,void 0,p,C),r.success(o.green("\u2713 Keystore uploaded"));return}}r.info(o.blue("Generating new Android keystore..."));let g=a.keyAlias||`${f.nameLower}-${nt()}`,y=ke(),u=`./${f.nameLower}-${e}.jks`;b.existsSync(u)&&b.unlinkSync(u),s.start("Generating keystore...");try{let I=y.replace(/'/g,"'\\''");H(`keytool -genkeypair -v -keystore "${u}" -alias "${g}" -keyalg RSA -keysize 2048 -validity 10000 -storepass '${I}' -keypass '${I}' -dname "CN=${f.name} Build, OU=Mobile, O=Company, L=City, S=State, C=US"`,{stdio:"inherit"}),s.stop("Keystore generated"),await Q(n,u,"android_keystore",c,i,g,void 0,void 0,void 0,void 0,y,y),r.success(o.green("\u2713 Android credentials uploaded successfully")),r.info(o.cyan(`Key Alias: ${g}`))}catch(I){throw s.stop("Generation failed"),new Error(`Keystore generation failed: ${I.message}`)}}var qe=n=>new Promise(e=>setTimeout(e,n));function et(n){return/ECONNRESET|ETIMEDOUT|EAI_AGAIN|ENOTFOUND|ECONNABORTED|socket hang up|network|timeout|temporar/i.test(n)||/API_ERROR:\s*(408|409|425|429|5\d\d)/i.test(n)}async function Q(n,e,i,a,t,s,c,d,g,y,u,I){let m=X.basename(e);r.info(o.dim(`Uploading ${m} (Isolated process)...`));let p=new URL(import.meta.url),l=X.dirname(p.pathname),A=[X.join(l,"commands","isolated-upload.js"),n,e,i,a,t,s||"undefined",c||"undefined",d||"undefined",g||"undefined",y||"undefined",u||"undefined",I||"undefined"],N="",Z=5;for(let k=1;k<=Z;k++){let P=z("node",A,{stdio:"pipe",encoding:"utf-8",env:{...process.env,AT_CLI_ISOLATED:"1"}});if(P.status===0&&P.stdout.includes("SUCCESS")){r.info(o.dim(`\u2713 ${m} uploaded and registered.`));return}if(P.status===0){r.warn(o.yellow(`Isolated upload finished but success not confirmed: ${P.stdout}`));return}if(N=(P.stderr||P.stdout||P.error?.message||"Unknown isolated upload failure").trim(),!et(N)||k>=Z)throw r.error(o.red(`Isolated Upload Failed: ${N}`)),new Error(N);let E=Math.min(3e4,1500*Math.pow(2,k-1));r.warn(o.yellow(`Upload failed with a transient error. Retrying ${m} in ${Math.round(E/1e3)}s... (${k}/${Z})`)),await qe(E)}throw new Error(N||"Unknown isolated upload failure")}async function tt(n){let e=te(),i=n.platform,a=`./${f.configFileName}`;if(!b.existsSync(a)){r.error(`No ${f.configFileName} found. Run \`${f.nameLower} init\` or \`${f.nameLower} link\` first.`);return}let t=JSON.parse(b.readFileSync(a,"utf-8")),{projectId:s}=t;if(!s){r.error(`${f.configFileName} is missing projectId.`);return}try{e.start("Fetching project secrets...");let d=(await v.get(`/projects/${s}/secrets/export?env=all`)).data.secrets||{};e.stop("Secrets fetched and merged."),e.start("Fetching credentials...");let y=(await v.get(`/credentials/${s}`)).data.credentials||[];e.stop(`Found ${y.length} metadata records.`);let u=y.filter(l=>l.platform===i);if(u.length===0){r.info(`No ${i} credentials found on Dashboard.`);return}let I="./credentials.json",m={};if(b.existsSync(I))try{m=JSON.parse(b.readFileSync(I,"utf-8"))}catch{r.warn("Could not parse existing credentials.json, creating a new one.")}m[i]||(m[i]={});let p=X.join(process.cwd(),"credentials",i);b.existsSync(p)||b.mkdirSync(p,{recursive:!0});for(let l of u){e.start(`Downloading ${l.type} (${l.distributionType})...`);try{let C=await v.get(`/credentials/${l.credentialId}/download?projectId=${s}`);if(C.data.status==="success"&&C.data.downloadUrl){let A=X.join(process.cwd(),"credentials",i,l.distributionType);b.existsSync(A)||b.mkdirSync(A,{recursive:!0});let N=l.s3Key?.split(".").pop()||(l.type.includes("keystore")?"jks":l.type.includes("cert")?"p12":"mobileprovision"),Z=`${l.type}.${N}`,k=X.join(A,Z),P=await Ve.get(C.data.downloadUrl,{responseType:"arraybuffer"});b.writeFileSync(k,Buffer.from(P.data));let Y=X.join("credentials",i,l.distributionType,Z);if(i==="android"){if(l.type==="android_keystore"){let E=l.distributionType==="store"?"PRODUCTION":l.distributionType==="internal"?"STAGING":"DEVELOPMENT",D=["PRODUCTION","STORE","INTERNAL","STAGING","DEVELOPMENT","RELEASE","DEBUG"],ne=[`KEYSTORE_PASSWORD_${E}`,`KEYSTORE_PASSWORD_${l.distributionType.toUpperCase()}`,...D.map(h=>`KEYSTORE_PASSWORD_${h}`),"ANDROID_KEYSTONE_PASSWORD","KEYSTORE_PASSWORD"],ie=[`KEYSTORE_ALIAS_${E}`,`KEYSTORE_ALIAS_${l.distributionType.toUpperCase()}`,...D.map(h=>`KEYSTORE_ALIAS_${h}`),"KEYSTORE_ALIAS"],S=ne.map(h=>d[h]).find(h=>!!h)||"",w=ie.map(h=>d[h]).find(h=>!!h)||l.meta?.alias||"";m.android.keystore={keystorePath:Y,keystorePassword:S,keyAlias:w,keyPassword:S}}}else if(i==="ios"){let E=l.distributionType==="store"?"production":l.distributionType==="adhoc"?"staging":"development";m.ios[E]||(m.ios[E]={}),l.type==="ios_cert"?(m.ios[E].certificatePath=Y,m.ios[E].certificatePassword=d.IOS_P12_PASSWORD||""):l.type==="ios_profile"&&(m.ios[E].provisioningProfilePath=Y)}e.stop(`\u2713 ${l.type} (${l.distributionType}) saved.`)}}catch(C){let A=C.response?.data?.message||C.message;e.stop(o.dim(`- Skipped ${l.type} (${l.distributionType}): ${A}`))}}b.writeFileSync(I,JSON.stringify(m,null,2)),r.success(o.green("\u2713 Local credentials.json updated.")),ve("Credentials have been synced to your local machine. Ensure credentials.json and credentials/ is added to your .gitignore.","Sync Complete")}catch(c){e.stop(o.red("Sync failed.")),r.error(`Error: ${c.message}`)}}function ke(){let n="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_+=",e="";for(let i=0;i<24;i++)e+=n.charAt(Math.floor(Math.random()*n.length));return e}function nt(n=8){let e="abcdefghijklmnopqrstuvwxyz0123456789",i="";for(let a=0;a<n;a++)i+=e.charAt(Math.floor(Math.random()*e.length));return i}async function it(n,e,i,a){let t=a||await Ce(e,n);if(!t||t.length===0)return!1;let s=await K({message:"Select a certificate to revoke:",options:[...t.map(c=>({value:`revoke:${c.id}`,label:`Revoke: ${c.name} (${c.expires})`})),{value:"nuke",label:"Revoke All"},{value:"cancel",label:"Cancel"}]});return W(s)||s==="cancel"?!1:s==="nuke"?(H(`fastlane match nuke ${n}`,{stdio:"inherit",cwd:process.cwd(),env:e}),!0):typeof s=="string"&&s.startsWith("revoke:")?(await st(e,s.split(":")[1]),!0):!1}async function Ce(n,e){let i=e==="development"?"development":"distribution",a=`
+lane :${f.fastlanePrefix}_list_certs do
+  require 'spaceship'
+  require 'json'
+  begin
+    Spaceship::Portal.login(ENV['FASTLANE_USER'])
+    Spaceship::Portal.select_team(team_id: ENV['FASTLANE_TEAM_ID'])
+    output = Spaceship::Portal.certificate.all.select { |c|
+      if "${i}" == "development"
+        c.type_display_id.downcase.include?("development")
+      else
+        c.type_display_id.downcase.include?("distribution") || c.type_display_id.downcase.include?("production")
+      end
+    }.map { |c| { id: c.id, name: c.name, expires: c.expires.strftime('%Y-%m-%d'), type: c.type_display_id } }
+    puts "${f.jsonStartMarker}" + output.to_json + "${f.jsonEndMarker}"
+  rescue => e
+    $stderr.puts "ERROR: #{e.message}"
+    exit 1
+  end
+end`,t=X.join(ye.tmpdir(),`/tmp/${f.nameLower}-list-certs-${Date.now()}`),s=X.join(t,"fastlane"),c=X.join(s,"Fastfile");try{b.existsSync(s)||b.mkdirSync(s,{recursive:!0}),b.writeFileSync(c,a);let g=H(`fastlane ${f.fastlanePrefix}_list_certs`,{env:{...n,CI:"1",FASTLANE_FASTFILE:c},cwd:t,stdio:["inherit","pipe","inherit"]}).toString().match(new RegExp(`${f.jsonStartMarker}(.*)${f.jsonEndMarker}`));return g?JSON.parse(g[1]):[]}finally{b.existsSync(t)&&b.rmSync(t,{recursive:!0,force:!0})}}async function st(n,e){let i=`
+lane :${f.fastlanePrefix}_revoke_cert do
+  require 'spaceship'
+  begin
+    Spaceship::Portal.login(ENV['FASTLANE_USER'])
+    Spaceship::Portal.select_team(team_id: ENV['FASTLANE_TEAM_ID'])
+    cert = Spaceship::Portal.certificate.all.find { |c| c.id == "${e}" }
+    cert.revoke! if cert
+  rescue => e
+    $stderr.puts "ERROR: #{e.message}"
+    exit 1
+  end
+end`,a=X.join(ye.tmpdir(),`/tmp/${f.nameLower}-revoke-cert-${Date.now()}`),t=X.join(a,"fastlane"),s=X.join(t,"Fastfile");try{b.existsSync(t)||b.mkdirSync(t,{recursive:!0}),b.writeFileSync(s,i),H(`fastlane ${f.fastlanePrefix}_revoke_cert`,{env:{...n,CI:"1",FASTLANE_FASTFILE:s},cwd:a,stdio:["inherit","pipe","inherit"]})}finally{b.existsSync(a)&&b.rmSync(a,{recursive:!0,force:!0})}}export{ot as a,L as b,ae as c,re as d,ct as e,Se as f,we as g,Le as h,tt as i};

package/dist/commands/isolated-upload.js

@@ -1 +1 @@
-import{g as r}from"../chunk-YBL2LBMW.js";import P from"fs";import A from"path";var C=n=>new Promise(e=>setTimeout(e,n));function S(n){let e=n?.response?.status,t=n?.code||"",a=n?.message||"";return!e||e===408||e===409||e===425||e===429||e>=500||/ECONNRESET|ETIMEDOUT|EAI_AGAIN|ENOTFOUND|ECONNABORTED|socket hang up|network|timeout/i.test(`${t} ${a}`)}async function u(n,e,t=5){let a;for(let d=1;d<=t;d++)try{return await e()}catch(s){if(a=s,!S(s)||d>=t)break;let o=Math.min(3e4,1500*Math.pow(2,d-1));console.warn(`[UPLOAD_RETRY] ${n} failed transiently. Retrying in ${Math.round(o/1e3)}s... (${d}/${t})`),await C(o)}throw a}async function b(){let[n,e,t,a,d,s,o,f,p,c,l,m,y,I,w,T,R,E]=process.argv.slice(2);try{let i=A.basename(e),h=P.readFileSync(e),N=await u("create upload URL",()=>r.post("/credentials/upload-url",{projectId:n,fileName:i,fileType:"application/octet-stream",type:t,distributionType:d})),{uploadUrl:g,key:O,fileId:$}=N.data,k=(await import("axios")).default;await u("upload file to storage",()=>k.put(g,h,{headers:{"Content-Type":"application/octet-stream"},maxContentLength:1/0,maxBodyLength:1/0,timeout:18e4})),await u("register credential",()=>r.post("/credentials",{projectId:n,id:$,name:`${t} - ${d}`,type:t,bundleId:a,distributionType:d,s3Key:O,alias:s==="undefined"?void 0:s,expiresAt:o==="undefined"?void 0:o,issuerId:f==="undefined"?void 0:f,keyId:p==="undefined"?void 0:p,password:c==="undefined"?void 0:c,keystorePassword:l==="undefined"?void 0:l,keyPassword:m==="undefined"?void 0:m,teamId:y==="undefined"?void 0:y,teamName:I==="undefined"?void 0:I,developerTeamId:w==="undefined"?void 0:w,appStoreConnectTeamId:T==="undefined"?void 0:T,providerId:R==="undefined"?void 0:R,providerName:E==="undefined"?void 0:E})),console.log("SUCCESS"),process.exit(0)}catch(i){i.response?console.error(`API_ERROR: ${i.response.status} - ${JSON.stringify(i.response.data)}`):console.error(`NETWORK_ERROR: ${i.message}`),process.exit(1)}}b();
+import{g as r}from"../chunk-NZ4K6LDA.js";import P from"fs";import A from"path";var C=n=>new Promise(e=>setTimeout(e,n));function S(n){let e=n?.response?.status,t=n?.code||"",a=n?.message||"";return!e||e===408||e===409||e===425||e===429||e>=500||/ECONNRESET|ETIMEDOUT|EAI_AGAIN|ENOTFOUND|ECONNABORTED|socket hang up|network|timeout/i.test(`${t} ${a}`)}async function u(n,e,t=5){let a;for(let d=1;d<=t;d++)try{return await e()}catch(s){if(a=s,!S(s)||d>=t)break;let o=Math.min(3e4,1500*Math.pow(2,d-1));console.warn(`[UPLOAD_RETRY] ${n} failed transiently. Retrying in ${Math.round(o/1e3)}s... (${d}/${t})`),await C(o)}throw a}async function b(){let[n,e,t,a,d,s,o,f,p,c,l,m,y,I,w,T,R,E]=process.argv.slice(2);try{let i=A.basename(e),h=P.readFileSync(e),N=await u("create upload URL",()=>r.post("/credentials/upload-url",{projectId:n,fileName:i,fileType:"application/octet-stream",type:t,distributionType:d})),{uploadUrl:g,key:O,fileId:$}=N.data,k=(await import("axios")).default;await u("upload file to storage",()=>k.put(g,h,{headers:{"Content-Type":"application/octet-stream"},maxContentLength:1/0,maxBodyLength:1/0,timeout:18e4})),await u("register credential",()=>r.post("/credentials",{projectId:n,id:$,name:`${t} - ${d}`,type:t,bundleId:a,distributionType:d,s3Key:O,alias:s==="undefined"?void 0:s,expiresAt:o==="undefined"?void 0:o,issuerId:f==="undefined"?void 0:f,keyId:p==="undefined"?void 0:p,password:c==="undefined"?void 0:c,keystorePassword:l==="undefined"?void 0:l,keyPassword:m==="undefined"?void 0:m,teamId:y==="undefined"?void 0:y,teamName:I==="undefined"?void 0:I,developerTeamId:w==="undefined"?void 0:w,appStoreConnectTeamId:T==="undefined"?void 0:T,providerId:R==="undefined"?void 0:R,providerName:E==="undefined"?void 0:E})),console.log("SUCCESS"),process.exit(0)}catch(i){i.response?console.error(`API_ERROR: ${i.response.status} - ${JSON.stringify(i.response.data)}`):console.error(`NETWORK_ERROR: ${i.message}`),process.exit(1)}}b();

package/dist/credentials-VIDAT2N5.js

@@ -0,0 +1 @@
+import{g as a,h as b,i as c}from"./chunk-RMK5OZVN.js";import"./chunk-NZ4K6LDA.js";export{a as credentialsMainCommand,b as credentialsSetupCommand,c as downloadCredentialsCommand};