@radhya/mach 1.9.5 → 1.9.7

package/dist/index.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import{a as Te,b as Ge,c as Yi,d as Ji,e as nt,f as qi,h as mt}from"./chunk-H4NBOSTT.js";import{a as f,b as zi,c as ye,d as Wi,e as Lt,f as je,g as C}from"./chunk-NZ4K6LDA.js";import{Command as Wl,Option as pt}from"commander";import{configDotenv as Yl}from"dotenv";import{intro as me,outro as ro}from"@clack/prompts";import fe from"chalk";import{text as Xi,confirm as oo,spinner as so,isCancel as ui,cancel as gt,note as ao,outro as lo}from"@clack/prompts";import ht from"chalk";async function Zi(){try{let e=await Xi({message:"Enter Bucket Name:",placeholder:"e.g. my-app-dev",validate(r){if(r.length===0)return"Bucket name is required"}});ui(e)&&(gt("Operation cancelled."),process.exit(0));let t=await Xi({message:"Enter Region:",initialValue:"ap-south-1"});ui(t)&&(gt("Operation cancelled."),process.exit(0));let i=await oo({message:"Do you want to create a CloudFront Distribution for this bucket?",initialValue:!0});ui(i)&&(gt("Operation cancelled."),process.exit(0));let n=so();n.start("Setting up hosting infrastructure...");try{let r=await C.post("/hosting/setup",{bucketName:e,region:t,createCloudFront:i});if(r.data.status!=="success")throw new Error(r.data.message||"Hosting setup failed");n.stop("Hosting setup complete!");let o=r.data,s=`Bucket Name:      ${ht.cyan(o.bucketName)}
+import{a as Te,b as Ge,c as Yi,d as Ji,e as nt,f as Xi,h as mt}from"./chunk-DHVPMCZJ.js";import{a as f,b as zi,c as ye,d as Wi,e as Lt,f as je,g as C}from"./chunk-NZ4K6LDA.js";import{Command as Wl,Option as pt}from"commander";import{configDotenv as Yl}from"dotenv";import{intro as me,outro as ro}from"@clack/prompts";import fe from"chalk";import{text as qi,confirm as oo,spinner as so,isCancel as ui,cancel as gt,note as ao,outro as lo}from"@clack/prompts";import ht from"chalk";async function Zi(){try{let e=await qi({message:"Enter Bucket Name:",placeholder:"e.g. my-app-dev",validate(r){if(r.length===0)return"Bucket name is required"}});ui(e)&&(gt("Operation cancelled."),process.exit(0));let t=await qi({message:"Enter Region:",initialValue:"ap-south-1"});ui(t)&&(gt("Operation cancelled."),process.exit(0));let i=await oo({message:"Do you want to create a CloudFront Distribution for this bucket?",initialValue:!0});ui(i)&&(gt("Operation cancelled."),process.exit(0));let n=so();n.start("Setting up hosting infrastructure...");try{let r=await C.post("/hosting/setup",{bucketName:e,region:t,createCloudFront:i});if(r.data.status!=="success")throw new Error(r.data.message||"Hosting setup failed");n.stop("Hosting setup complete!");let o=r.data,s=`Bucket Name:      ${ht.cyan(o.bucketName)}
 `;s+=`Region:           ${ht.cyan(o.region)}
 `,s+=`S3 Website URL:   ${ht.blue(o.s3WebsiteUrl)}`,o.cloudFrontId&&(s+=`
 
@@ -81,7 +81,6 @@ function step_marker() {
   local MARKER="[STEP_START:$1] $(date +%s)"
   echo ""
   echo "$MARKER"
-  echo "$MARKER" >> /var/log/user-data.log
   sync
 }
 
@@ -95,12 +94,16 @@ function report_status() {
   local STATUS=$1
   local ERROR_MSG=$2
   if [ ! -z "$MACH_API_URL" ] && [ ! -z "$MACH_PROJECT_ID" ] && [ ! -z "$MACH_BUILD_ID" ]; then
-    PAYLOAD="{"status":"$STATUS""
-    if [ ! -z "$ERROR_MSG" ]; then
-      PAYLOAD="$PAYLOAD,"error":"$ERROR_MSG""
-    fi
-    PAYLOAD="$PAYLOAD}"
-    curl -s -X POST "$MACH_API_URL/builds/$MACH_PROJECT_ID/$MACH_BUILD_ID/worker-status"       -H "Content-Type: application/json"       -d "$PAYLOAD" || true
+    PAYLOAD=$(STATUS="$STATUS" ERROR_MSG="$ERROR_MSG" python3 -c 'import json, os; payload = {"status": os.environ.get("STATUS", "")}; error = os.environ.get("ERROR_MSG", ""); payload.update({"error": error} if error else {}); print(json.dumps(payload))')
+    HTTP_CODE=$(curl -sS -o /tmp/mach-worker-status-response.txt -w "%{http_code}" -X POST "$MACH_API_URL/builds/$MACH_PROJECT_ID/$MACH_BUILD_ID/worker-status"       -H "Content-Type: application/json"       --data-binary "$PAYLOAD" || echo "000")
+    case "$HTTP_CODE" in
+      2*) ;;
+      *)
+        echo "[WARN] Failed to report build status '$STATUS' to Mach API (HTTP $HTTP_CODE)."
+        head -c 500 /tmp/mach-worker-status-response.txt 2>/dev/null || true
+        echo ""
+        ;;
+    esac
   fi
 }
 
@@ -123,6 +126,9 @@ UPLOADER_PID=$!
       echo "[SPOT] Interruption notice received \u2014 flushing logs and notifying API..."
       upload_logs
       report_status "interrupted" "Spot instance interrupted by AWS \u2014 build will be retried automatically"
+      touch done
+      [ ! -z "$PRESIGNED_DONE_MARKER" ] && curl -X PUT -T done "$PRESIGNED_DONE_MARKER" --silent
+      sudo shutdown -h now
       exit 0
     fi
   done
@@ -514,8 +520,8 @@ for pid in "\${cache_pids[@]}"; do wait "$pid" || true; done
 echo "Build orchestrator finished. Auto-terminating instance in 5 seconds..."
 sleep 5
 sudo shutdown -h now
-`;import bo from"crypto";var Ao="mach-env-v2-js-bundle-cache",Io=new Set(["BUILD_ID","BUILD_NUMBER","ANDROID_VERSION_CODE","MACH_TOKEN","MACH_DEBUG","MACH_ENV_FINGERPRINT","CODEARTIFACT_AUTH_TOKEN","EXPO_ZQRN_BB_REPO_TOKEN","SENTRY_AUTH_TOKEN","IOS_DIST_P12","IOS_PROVISIONING_PROFILE","IOS_P12_PASSWORD","MATCH_ENCRYPTION_PASSPHRASE","MATCH_PASSWORD","MATCH_KEYCHAIN_NAME","MATCH_KEYCHAIN_PASSWORD","APPLE_TEAM_ID","FASTLANE_TEAM_ID","ANDROID_KEYSTORE","ANDROID_KEYSTORE_BASE64","ANDROID_STORE_PASSWORD","ANDROID_KEY_PASSWORD","ANDROID_KEY_ALIAS","KEYSTORE_PASSWORD","KEYSTORE_ALIAS","AWS_ACCESS_KEY_ID","AWS_SECRET_ACCESS_KEY","AWS_SESSION_TOKEN","AWS_SECURITY_TOKEN","GITHUB_TOKEN","NPM_TOKEN"]),_o=["PRESIGNED_","KEYSTORE_PASSWORD_"],Po=e=>!e||Io.has(e)?!1:!_o.some(t=>e.startsWith(t)),qe=(e,t,i)=>({...e,EXPO_NO_DOTENV:"1",MACH_BUILD_PROFILE:t,MACH_APP_NAME:i.appName||i.name||"App"}),rt=e=>{let t=Object.entries(e).filter(([i])=>Po(i)).sort(([i],[n])=>i.localeCompare(n));return bo.createHash("sha256").update(JSON.stringify({version:Ao,entries:t})).digest("hex")};var dn=e=>e.replace(/\\/g,"\\\\").replace(/"/g,'\\"').replace(/\$/g,"\\$").replace(/`/g,"\\`"),cn=async(e,t,i={},n,r)=>{let o=$o(),s=e.buildProfile||"production",l=s==="production",a=e.apk===!0,d=e.developmentClient?"assembleDebug":l?"bundleRelease":"assembleRelease",c=e.buildCommand||(a?"assembleRelease":d),u=e.nodeVersion?[`echo "[NODE] Switching to Node ${e.nodeVersion}..."`,`CURRENT_MAJOR=$(node -e "process.stdout.write(process.version.split('.')[0].replace('v',''))" 2>/dev/null || echo "0")`,`if [ "$CURRENT_MAJOR" != "${e.nodeVersion}" ]; then`,`  curl -fsSL https://deb.nodesource.com/setup_${e.nodeVersion}.x | bash - 2>&1`,"  apt-get install -y nodejs 2>&1",'  echo "[NODE] Installed Node $(node -v)"',"else",'  echo "[NODE] Already on Node $(node -v) \u2014 no switch needed"',"fi"].join(`
-`):"",p;if(r){let w=ln.isAbsolute(r)?r:ln.resolve(process.cwd(),r);an.existsSync(w)?(p=an.readFileSync(w,"utf-8"),Ut.info(sn.magenta(`\u2713 Loaded preBuild hook: ${r}`))):Ut.warn(`preBuild script not found at ${w} \u2014 skipping`)}let m=qe(i,s,e),I=rt(m),L=on.replace(/\{\{BUILD_ID\}\}/g,t).replace(/\{\{BUILD_COMMAND\}\}/g,c).replace("{{NODE_VERSION_SETUP}}",u).replace("{{ENV_VARS}}",`
+`;import bo from"crypto";var Ao="mach-env-v2-js-bundle-cache",Io=new Set(["BUILD_ID","BUILD_NUMBER","ANDROID_VERSION_CODE","MACH_TOKEN","MACH_DEBUG","MACH_ENV_FINGERPRINT","CODEARTIFACT_AUTH_TOKEN","EXPO_ZQRN_BB_REPO_TOKEN","SENTRY_AUTH_TOKEN","IOS_DIST_P12","IOS_PROVISIONING_PROFILE","IOS_P12_PASSWORD","MATCH_ENCRYPTION_PASSPHRASE","MATCH_PASSWORD","MATCH_KEYCHAIN_NAME","MATCH_KEYCHAIN_PASSWORD","APPLE_TEAM_ID","FASTLANE_TEAM_ID","ANDROID_KEYSTORE","ANDROID_KEYSTORE_BASE64","ANDROID_STORE_PASSWORD","ANDROID_KEY_PASSWORD","ANDROID_KEY_ALIAS","KEYSTORE_PASSWORD","KEYSTORE_ALIAS","AWS_ACCESS_KEY_ID","AWS_SECRET_ACCESS_KEY","AWS_SESSION_TOKEN","AWS_SECURITY_TOKEN","GITHUB_TOKEN","NPM_TOKEN"]),_o=["PRESIGNED_","KEYSTORE_PASSWORD_"],Po=e=>!e||Io.has(e)?!1:!_o.some(t=>e.startsWith(t)),Xe=(e,t,i)=>({...e,EXPO_NO_DOTENV:"1",MACH_BUILD_PROFILE:t,MACH_APP_NAME:i.appName||i.name||"App"}),rt=e=>{let t=Object.entries(e).filter(([i])=>Po(i)).sort(([i],[n])=>i.localeCompare(n));return bo.createHash("sha256").update(JSON.stringify({version:Ao,entries:t})).digest("hex")};var dn=e=>e.replace(/\\/g,"\\\\").replace(/"/g,'\\"').replace(/\$/g,"\\$").replace(/`/g,"\\`"),cn=async(e,t,i={},n,r)=>{let o=$o(),s=e.buildProfile||"production",l=s==="production",a=e.apk===!0,d=e.developmentClient?"assembleDebug":l?"bundleRelease":"assembleRelease",c=e.buildCommand||(a?"assembleRelease":d),u=e.nodeVersion?[`echo "[NODE] Switching to Node ${e.nodeVersion}..."`,`CURRENT_MAJOR=$(node -e "process.stdout.write(process.version.split('.')[0].replace('v',''))" 2>/dev/null || echo "0")`,`if [ "$CURRENT_MAJOR" != "${e.nodeVersion}" ]; then`,`  curl -fsSL https://deb.nodesource.com/setup_${e.nodeVersion}.x | bash - 2>&1`,"  apt-get install -y nodejs 2>&1",'  echo "[NODE] Installed Node $(node -v)"',"else",'  echo "[NODE] Already on Node $(node -v) \u2014 no switch needed"',"fi"].join(`
+`):"",p;if(r){let w=ln.isAbsolute(r)?r:ln.resolve(process.cwd(),r);an.existsSync(w)?(p=an.readFileSync(w,"utf-8"),Ut.info(sn.magenta(`\u2713 Loaded preBuild hook: ${r}`))):Ut.warn(`preBuild script not found at ${w} \u2014 skipping`)}let m=Xe(i,s,e),I=rt(m),L=on.replace(/\{\{BUILD_ID\}\}/g,t).replace(/\{\{BUILD_COMMAND\}\}/g,c).replace("{{NODE_VERSION_SETUP}}",u).replace("{{ENV_VARS}}",`
 export MACH_APP_NAME="${dn(m.MACH_APP_NAME)}"
 export MACH_BUILD_PROFILE="${dn(s)}"
 export MACH_ENV_FINGERPRINT="${I}"
@@ -1009,7 +1015,7 @@ fi
 `:R.type==="mobileprovision"&&(B+=`curl -sf -o "$PROV_TEMP/${R.name}" "${R.downloadUrl}" || true
 `);r.message("Generating macOS build script...");let k=process.env.CODEARTIFACT_AUTH_TOKEN?`export CODEARTIFACT_AUTH_TOKEN="${process.env.CODEARTIFACT_AUTH_TOKEN}"
 `:"";if(i)for(let[R,$]of Object.entries(i)){let U=$.replace(/"/g,'\\"').replace(/\$/g,"\\$").replace(/`/g,"\\`");k+=`export ${R}="${U}"
-`}let j=e.buildProfile||"production",h=qe(i,j,e),K=rt(h),_=[k,w.logUpload?`export PRESIGNED_LOG_UPLOAD="${w.logUpload}"`:"",w.doneMarker?`export PRESIGNED_DONE_MARKER="${w.doneMarker}"`:"",w.cacheDerivedDataDownload?`export PRESIGNED_CACHE_DD_DOWNLOAD="${w.cacheDerivedDataDownload}"`:"",w.cacheDerivedDataUpload?`export PRESIGNED_CACHE_DD_UPLOAD="${w.cacheDerivedDataUpload}"`:"",w.cacheNodeModulesDownload?`export PRESIGNED_CACHE_NODE_DOWNLOAD="${w.cacheNodeModulesDownload}"`:"",w.cacheNodeModulesUpload?`export PRESIGNED_CACHE_NODE_UPLOAD="${w.cacheNodeModulesUpload}"`:"",w.cachePodsDownload?`export PRESIGNED_CACHE_PODS_DOWNLOAD="${w.cachePodsDownload}"`:"",w.cachePodsUpload?`export PRESIGNED_CACHE_PODS_UPLOAD="${w.cachePodsUpload}"`:"",w.artifactIpaUpload?`export PRESIGNED_ARTIFACT_IPA_UPLOAD="${w.artifactIpaUpload}"`:"",w.artifactAppZipUpload?`export PRESIGNED_ARTIFACT_APP_ZIP_UPLOAD="${w.artifactAppZipUpload}"`:"",`export BUILD_ID="${t}"`,`export MACH_BUILD_PROFILE="${pn(j)}"`,`export MACH_APP_NAME="${pn(h.MACH_APP_NAME)}"`,`export MACH_ENV_FINGERPRINT="${K}"`,"export EXPO_NO_DOTENV=1",`export ${f.envPrefix}PROJECT_ID="${u}"`,i.MATCH_ENCRYPTION_PASSPHRASE?`export MATCH_PASSWORD="${i.MATCH_ENCRYPTION_PASSPHRASE}"`:"",i.APPLE_TEAM_ID?`export FASTLANE_TEAM_ID="${i.APPLE_TEAM_ID}"`:"",`export MATCH_KEYCHAIN_NAME="${f.credentialsKeychain}"`,`export MATCH_KEYCHAIN_PASSWORD="${f.keychainPassword}"`].filter(Boolean).join(`
+`}let j=e.buildProfile||"production",h=Xe(i,j,e),K=rt(h),_=[k,w.logUpload?`export PRESIGNED_LOG_UPLOAD="${w.logUpload}"`:"",w.doneMarker?`export PRESIGNED_DONE_MARKER="${w.doneMarker}"`:"",w.cacheDerivedDataDownload?`export PRESIGNED_CACHE_DD_DOWNLOAD="${w.cacheDerivedDataDownload}"`:"",w.cacheDerivedDataUpload?`export PRESIGNED_CACHE_DD_UPLOAD="${w.cacheDerivedDataUpload}"`:"",w.cacheNodeModulesDownload?`export PRESIGNED_CACHE_NODE_DOWNLOAD="${w.cacheNodeModulesDownload}"`:"",w.cacheNodeModulesUpload?`export PRESIGNED_CACHE_NODE_UPLOAD="${w.cacheNodeModulesUpload}"`:"",w.cachePodsDownload?`export PRESIGNED_CACHE_PODS_DOWNLOAD="${w.cachePodsDownload}"`:"",w.cachePodsUpload?`export PRESIGNED_CACHE_PODS_UPLOAD="${w.cachePodsUpload}"`:"",w.artifactIpaUpload?`export PRESIGNED_ARTIFACT_IPA_UPLOAD="${w.artifactIpaUpload}"`:"",w.artifactAppZipUpload?`export PRESIGNED_ARTIFACT_APP_ZIP_UPLOAD="${w.artifactAppZipUpload}"`:"",`export BUILD_ID="${t}"`,`export MACH_BUILD_PROFILE="${pn(j)}"`,`export MACH_APP_NAME="${pn(h.MACH_APP_NAME)}"`,`export MACH_ENV_FINGERPRINT="${K}"`,"export EXPO_NO_DOTENV=1",`export ${f.envPrefix}PROJECT_ID="${u}"`,i.MATCH_ENCRYPTION_PASSPHRASE?`export MATCH_PASSWORD="${i.MATCH_ENCRYPTION_PASSPHRASE}"`:"",i.APPLE_TEAM_ID?`export FASTLANE_TEAM_ID="${i.APPLE_TEAM_ID}"`:"",`export MATCH_KEYCHAIN_NAME="${f.credentialsKeychain}"`,`export MATCH_KEYCHAIN_PASSWORD="${f.keychainPassword}"`].filter(Boolean).join(`
 `),S=e.nodeVersion?[`echo "[NODE] Switching to Node ${e.nodeVersion}..."`,'export NVM_DIR="$HOME/.nvm"','[ -s "$NVM_DIR/nvm.sh" ] && . "$NVM_DIR/nvm.sh" --no-use',`nvm install ${e.nodeVersion} 2>/dev/null || true`,`nvm use ${e.nodeVersion} --silent`,`export PATH="$NVM_DIR/versions/node/$(nvm version ${e.nodeVersion})/bin:$PATH"`,'echo "[NODE] Now using: $(node -v) at $(which node)"'].join(`
 `):"",O=un,D={"{{REMOTE_DIR}}":p,"{{ENV_VARS}}":_,"{{CREDENTIAL_DOWNLOADS}}":B,"{{IOS_SCHEME}}":e.iosScheme||"","{{IOS_CONFIG}}":e.iosConfiguration||"Release","{{TEAM_ID}}":e.iosTeamId||"","{{AUTH_PARAMS}}":L,"{{IS_SIMULATOR}}":e.simulator?"true":"false","{{BUILD_ID}}":t,"{{EXPORT_METHOD}}":e.iosExportMethod||"ad-hoc","{{NODE_VERSION_SETUP}}":S};Object.entries(D).forEach(([R,$])=>{O=O.split(R).join($)});let T=`/tmp/${f.nameLower}-mac-build-${t}.sh`;if(Do.writeFileSync(T,O),yt(`${d} ${T} ${l}:${p}/build.sh`),r.stop("Remote script uploaded."),ot.info(Ke.cyan("Executing remote build. This might take a while...")),yt(`${a} "bash ${p}/build.sh"`,{stdio:"inherit"}),r.stop("Remote build finished!"),n){r.start("Fetching artifact links...");try{let $=(await C.get(`/builds/${n}/${t}/artifacts`)).data.artifacts||[],U=e.simulator===!0;if($.length===0&&!U)throw r.stop("Build Failed!"),new Error("Build completed but no artifacts were generated. Check build logs for errors.");if(r.stop("Build Successful!"),$.length>0){ot.success("Build Artifacts Ready:");for(let G of $)console.log(`
 ${Ke.yellow(G.name)}:
@@ -1019,17 +1025,17 @@ ${Ke.dim("Note: Links are valid for 7 days.")}`)}else U&&ot.warn("Simulator buil
 `).map(a=>a.trimEnd()).filter(Boolean),o=r.filter(a=>/\berror:|fatal error:|xcodebuild: error|The following build commands failed|Command PhaseScriptExecution failed|CodeSign|Provisioning profile|No profiles|requires a provisioning profile|Undefined symbols|ld:|clang: error|SwiftCompile|CompileC/i.test(a)),s=o.length>0?o.slice(-40):r.slice(-80),l=o.length>0?"Key failure output":"Last command output";return[`Command failed with code ${i}: ${e} ${t.join(" ")}`,s.length>0?`
 ${l}:
 ${s.join(`
-`)}`:""].join("")},Jo=e=>e==="xcodebuild"&&process.env.MACH_XCODE_FULL_LOGS!=="1",qo=e=>{let t=Dn(e).trim();return t?/\berror:|fatal error:|xcodebuild: error|The following build commands failed|Command PhaseScriptExecution failed|CodeSign|Provisioning profile|No profiles|requires a provisioning profile|Undefined symbols|ld:|clang: error|SwiftCompile|CompileC|CFBundleVersion|ARCHIVE SUCCEEDED|ARCHIVE FAILED|EXPORT SUCCEEDED|EXPORT FAILED|Exported .* to:|\[IPA VALID\]/i.test(t):!1},Xe=e=>{try{g.existsSync(e)&&g.rmSync(e,{recursive:!0,force:!0})}catch{}},Xo=(e,t)=>{try{if(!g.existsSync(e))return;for(let i of g.readdirSync(e))t(i)&&Xe(P.join(e,i))}catch{}},Rn=e=>{b.info(y.dim("Clearing Metro/Hermes JS transform caches..."));let t=ue.tmpdir();Xo(t,i=>i==="metro-cache"||i.startsWith("metro-")||i.startsWith("haste-map-")||i.startsWith("react-native-packager-cache-")),Xe(P.join(e,".expo")),Xe(P.join(e,"node_modules/.cache/metro")),Xe(P.join(ue.homedir(),".cache/metro")),Xe(P.join(ue.homedir(),".cache/react-native-packager")),Xe(P.join(ue.homedir(),"Library/Caches/metro")),Xe(P.join(ue.homedir(),"Library/Caches/react-native-packager"))},xe=(e,t,i=process.cwd(),n={},r,o)=>new Promise((s,l)=>{let a="",d=Jo(e),c=Date.now(),u=["/opt/homebrew/bin","/usr/local/bin","/usr/bin","/bin","/usr/sbin","/sbin",P.join(ue.homedir(),".npm-global/bin")],m=[...(process.env.PATH||"").split(":"),...u].filter((k,j,h)=>k&&h.indexOf(k)===j).join(":");process.env[`${f.envPrefix}DEBUG`]&&console.log(y.magenta(`[${f.nameUpper}_DEBUG] Execution PATH: ${m}`));let I={...process.env,...n,PATH:m,LANG:"en_US.UTF-8",LC_ALL:"en_US.UTF-8"};r&&process.env[`${f.envPrefix}DEBUG`]&&(r(y.magenta(`[ENVIRONMENT] node: ${process.execPath}
+`)}`:""].join("")},Jo=e=>e==="xcodebuild"&&process.env.MACH_XCODE_FULL_LOGS!=="1",Xo=e=>{let t=Dn(e).trim();return t?/\berror:|fatal error:|xcodebuild: error|The following build commands failed|Command PhaseScriptExecution failed|CodeSign|Provisioning profile|No profiles|requires a provisioning profile|Undefined symbols|ld:|clang: error|SwiftCompile|CompileC|CFBundleVersion|ARCHIVE SUCCEEDED|ARCHIVE FAILED|EXPORT SUCCEEDED|EXPORT FAILED|Exported .* to:|\[IPA VALID\]/i.test(t):!1},qe=e=>{try{g.existsSync(e)&&g.rmSync(e,{recursive:!0,force:!0})}catch{}},qo=(e,t)=>{try{if(!g.existsSync(e))return;for(let i of g.readdirSync(e))t(i)&&qe(P.join(e,i))}catch{}},Rn=e=>{b.info(y.dim("Clearing Metro/Hermes JS transform caches..."));let t=ue.tmpdir();qo(t,i=>i==="metro-cache"||i.startsWith("metro-")||i.startsWith("haste-map-")||i.startsWith("react-native-packager-cache-")),qe(P.join(e,".expo")),qe(P.join(e,"node_modules/.cache/metro")),qe(P.join(ue.homedir(),".cache/metro")),qe(P.join(ue.homedir(),".cache/react-native-packager")),qe(P.join(ue.homedir(),"Library/Caches/metro")),qe(P.join(ue.homedir(),"Library/Caches/react-native-packager"))},xe=(e,t,i=process.cwd(),n={},r,o)=>new Promise((s,l)=>{let a="",d=Jo(e),c=Date.now(),u=["/opt/homebrew/bin","/usr/local/bin","/usr/bin","/bin","/usr/sbin","/sbin",P.join(ue.homedir(),".npm-global/bin")],m=[...(process.env.PATH||"").split(":"),...u].filter((k,j,h)=>k&&h.indexOf(k)===j).join(":");process.env[`${f.envPrefix}DEBUG`]&&console.log(y.magenta(`[${f.nameUpper}_DEBUG] Execution PATH: ${m}`));let I={...process.env,...n,PATH:m,LANG:"en_US.UTF-8",LC_ALL:"en_US.UTF-8"};r&&process.env[`${f.envPrefix}DEBUG`]&&(r(y.magenta(`[ENVIRONMENT] node: ${process.execPath}
 `)),r(y.magenta(`[ENVIRONMENT] PATH: ${m}
 `)),r(y.magenta(`[ENVIRONMENT] command: ${e} ${t.join(" ")}
 `)));let L=e;if(["node","npm","npx","pod"].includes(e)){let k=P.dirname(process.execPath),j=P.join(k,e);g.existsSync(j)&&(L=j,r&&r(y.dim(`[EXEC] Using absolute path: ${L}
 `)))}let w=$n(L,t,{stdio:"pipe",cwd:i,shell:!0,env:I,detached:process.platform!=="win32"});if(o){if(o.aborted){if(w.pid)try{process.kill(-w.pid,"SIGTERM")}catch{w.kill()}return l(new Error("Command aborted"))}o.addEventListener("abort",()=>{if(w.pid)try{process.kill(-w.pid,"SIGTERM")}catch{w.kill()}l(new Error("Command aborted"))})}let B=(k,j)=>{if(!d){j.write(k);return}let h=k.replace(/\r/g,`
 `).split(`
-`).filter(qo);if(h.length>0){j.write(`${h.join(`
+`).filter(Xo);if(h.length>0){j.write(`${h.join(`
 `)}
 `),c=Date.now();return}let K=Date.now();K-c>3e4&&(j.write(`[xcodebuild] still running; detailed output is streamed to Mach logs.
 `),c=K)};w.stdout.on("data",k=>{let j=k.toString();a=Pn(a,j),B(j,process.stdout),r&&r(j)}),w.stderr.on("data",k=>{let j=k.toString();a=Pn(a,j),B(j,process.stderr),r&&r(j)}),w.on("close",k=>{k===0?s(k):l(new Error(Yo(e,t,k,a)))}),w.on("error",k=>l(k))}),Zo=e=>{let t=Math.floor(e/1e3%60),i=Math.floor(e/(1e3*60)%60),n=Math.floor(e/(1e3*60*60)%24),r=[];return n>0&&r.push(`${n}h`),i>0&&r.push(`${i}m`),(t>0||r.length===0)&&r.push(`${t}s`),r.join(" ")},Ze=(e,t)=>{let i=[];try{if(!g.existsSync(e))return i;let n=g.readdirSync(e);for(let r of n){let o=P.join(e,r);try{let s=g.statSync(o);if(t.some(a=>r.endsWith(a))){i.push(P.resolve(o));continue}s.isDirectory()&&(i=i.concat(Ze(o,t)))}catch{}}}catch{}return i},Qo=/^\d+(?:\.\d+){0,2}$/,vn=e=>{let t=String(e||"").trim();return!t||t==="undefined"||t==="null"?null:Qo.test(t)?t:null},On=(e,t)=>{let i=vn(e);if(!i)throw new Error(`Invalid iOS CFBundleVersion from ${t}: "${e||""}". Apple requires one to three period-separated integers, for example "42" or "1.2.3". If you see "[Decryption Failed]", fix/remove the broken BUILD_NUMBER secret and rebuild.`);return i},Cn=(e,t)=>hi("/usr/libexec/PlistBuddy",["-c",`Print :${t}`,e],{encoding:"utf-8"}).trim(),es=e=>{let t=P.join(e,"Info.plist");if(!g.existsSync(t))throw new Error(`Could not validate iOS build number: ${t} not found.`);return On(Cn(t,"CFBundleVersion"),t)},ts=e=>{let i=hi("unzip",["-Z1",e],{encoding:"utf-8"}).split(`
-`).find(r=>/^Payload\/[^/]+\.app\/Info\.plist$/.test(r.trim()));if(!i)throw new Error(`Could not validate iOS build number: ${P.basename(e)} has no Payload/*.app/Info.plist.`);let n=g.mkdtempSync(P.join(ue.tmpdir(),`${f.nameLower}-ipa-plist-`));try{let r=P.join(n,"Info.plist"),o=hi("unzip",["-p",e,i.trim()]);return g.writeFileSync(r,o),On(Cn(r,"CFBundleVersion"),`${P.basename(e)}:${i.trim()}`)}finally{g.rmSync(n,{recursive:!0,force:!0})}},Si=async(e,t,i={},n,r={})=>{let o=Ft(),s=Date.now(),l=e.platform,a=e.buildProfile||"production",d=()=>qe(i,a,e),c=async(S,O={})=>{if(n)for(let D=1;D<=3;D++)try{await C.patch(`/builds/${n}/${t}`,{status:S,...O});return}catch(T){let R=T?.response?.data?.message||T?.message||String(T);console.error(`[reportStatus] attempt ${D}/3 failed (status=${S}): ${R}`),D<3&&await new Promise($=>setTimeout($,2e3))}},u=new AbortController,{signal:p}=u,m=null;n&&(m=setInterval(async()=>{try{(await C.get(`/builds/${n}/${t}`)).data.status==="cancelled"&&(b.warn(y.yellow(`
+`).find(r=>/^Payload\/[^/]+\.app\/Info\.plist$/.test(r.trim()));if(!i)throw new Error(`Could not validate iOS build number: ${P.basename(e)} has no Payload/*.app/Info.plist.`);let n=g.mkdtempSync(P.join(ue.tmpdir(),`${f.nameLower}-ipa-plist-`));try{let r=P.join(n,"Info.plist"),o=hi("unzip",["-p",e,i.trim()]);return g.writeFileSync(r,o),On(Cn(r,"CFBundleVersion"),`${P.basename(e)}:${i.trim()}`)}finally{g.rmSync(n,{recursive:!0,force:!0})}},Si=async(e,t,i={},n,r={})=>{let o=Ft(),s=Date.now(),l=e.platform,a=e.buildProfile||"production",d=()=>Xe(i,a,e),c=async(S,O={})=>{if(n)for(let D=1;D<=3;D++)try{await C.patch(`/builds/${n}/${t}`,{status:S,...O});return}catch(T){let R=T?.response?.data?.message||T?.message||String(T);console.error(`[reportStatus] attempt ${D}/3 failed (status=${S}): ${R}`),D<3&&await new Promise($=>setTimeout($,2e3))}},u=new AbortController,{signal:p}=u,m=null;n&&(m=setInterval(async()=>{try{(await C.get(`/builds/${n}/${t}`)).data.status==="cancelled"&&(b.warn(y.yellow(`
 \u{1F6D1} Build cancelled from dashboard. Terminating...`)),u.abort(),m&&clearInterval(m))}catch{}},5e3));let I=P.join(process.cwd(),".mach-cache"),L="setup",w="",B=null,k=async()=>{if(!w||!n)return;let S=w;w="";try{let O=S;Object.values(i).forEach(D=>{if(D&&D.length>5){let T=D.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");O=O.replace(new RegExp(T,"g"),"[SECRET]")}}),await C.post(`/builds/${n}/${t}/logs`,{log:O,step:L})}catch{}},j=async()=>{B&&(clearTimeout(B),B=null),await k(),Wo(I,t),m&&(clearInterval(m),m=null);try{let S=P.join(ue.tmpdir(),`${f.buildPrefix}-${t}.keychain-db`);g.existsSync(S)&&(Y(`security delete-keychain "${S}"`,{stdio:"ignore"}),b.info(y.dim("\u{1F511} Build keychain deleted.")))}catch{}try{let S=P.join(ue.homedir(),"Library/MobileDevice/Provisioning Profiles");if(g.existsSync(S)){let O=g.readdirSync(S).filter(D=>D.includes(t)||D.startsWith(`${f.nameLower}-temp-${t}`));for(let D of O)g.unlinkSync(P.join(S,D))}}catch{}},h=async S=>{n&&(w+=S,w.length>=8192?(B&&(clearTimeout(B),B=null),await k()):B||(B=setTimeout(()=>{B=null,k()},2e3)))},K=async S=>{L=S,await h(`[STEP_START:${S}] ${Math.floor(Date.now()/1e3)}
 `)},_=async(S,O,D,T)=>await xe(S,O,D,T,R=>{h(R)},p);b.info(y.blue(`\u{1F680} Starting local build for ${l} (${a})...`));try{zo(I,t)}catch(S){throw await c("failed",{error:S.message}),S}if(await c("building"),await K("setup"),l==="ios"&&!e.simulator&&i.MACH_IOS_BUILD_NUMBER_LOCKED==="1"&&i.BUILD_NUMBER)b.info(y.dim(`Auto build number: ${i.BUILD_NUMBER}`)),await h(`[BUILD_NUMBER] ${i.BUILD_NUMBER}
 `);else if(n&&l==="ios"&&!e.simulator)try{let S=parseInt(i.BUILD_NUMBER||"0",10),O=Number.isFinite(S)?S:0,D=await C.post(`/projects/${n}/next-build-number`,{platform:"ios",startFrom:O});D.data.status==="success"&&(i.BUILD_NUMBER=String(D.data.buildNumber),b.info(y.dim(`Auto build number: ${i.BUILD_NUMBER}`)),await h(`[BUILD_NUMBER] ${i.BUILD_NUMBER}
@@ -1060,7 +1066,7 @@ end
 \u2713 Local build completed successfully in ${he}`)),await c("building",{...E&&{bundleId:E},...ne&&{appName:ne}}),z.length>0&&(b.info(y.cyan(`
 \u{1F4E6} Generated Artifacts:`)),z.forEach(F=>{let M=P.resolve(F);b.info(y.dim(`  - ${F}`)),b.info(y.gray(`    Path: ${M}`))}),e.interactive)){let F=await Fo({message:"Install on connected device?"});if(!Ht(F)&&F){if(l==="android"){let M=z.find(W=>W.endsWith(".apk"))||z[0];await os(M,W=>h(W))}else if(l==="ios"){let M=z.find(A=>A.endsWith(".ipa"))||z.find(A=>A.endsWith(".app"))||z[0],W=Be("ios");e.simulator?await ss(M,W||"",A=>h(A)):await as(M,W||"",A=>h(A))}}}await K("upload");let ie=[];for(let F of z)try{let M=P.join(ue.tmpdir(),`${t}-${P.basename(F)}`);g.copyFileSync(F,M),ie.push(M),b.info(y.dim(`  \u{1F4CB} Preserved artifact: ${P.basename(F)}`))}catch{b.warn(y.yellow(`  Failed to preserve artifact: ${P.basename(F)}`))}z=ie,b.info(y.dim("\u{1F9F9} Cleaning workspace (preserving dependency cache)..."));try{let F=process.cwd(),M=new Set(["node_modules"]),W=g.readdirSync(F),A=0;for(let V of W)if(!M.has(V)){if(V==="ios"){let J=P.join(F,"ios"),ee=g.readdirSync(J);for(let ce of ee)if(ce!=="Pods")try{g.rmSync(P.join(J,ce),{recursive:!0,force:!0}),A++}catch{}continue}try{g.rmSync(P.join(F,V),{recursive:!0,force:!0}),A++}catch{}}b.info(y.dim(`  Cleaned ${A} items. Cached: node_modules${g.existsSync(P.join(F,"ios","Pods"))?", ios/Pods":""}`)),b.info(y.green("\u{1F512} Security: No source code retained on build server. Only public dependencies cached."))}catch{b.warn(y.yellow("Post-build cleanup encountered errors (non-fatal)."))}try{let M=P.join(ue.homedir(),f.workspacesDir),W=Y(`df -k "${M}" | tail -1 | awk '{print $4}'`,{encoding:"utf8"}).trim(),A=parseInt(W,10)*1024;if(A<53687091200&&g.existsSync(M)){b.info(y.dim(`  \u26A0\uFE0F Low disk space (${(A/1024/1024/1024).toFixed(0)} GB free). Running cache eviction...`));let V=P.basename(process.cwd()),J=g.readdirSync(M).filter(ee=>ee!==V).map(ee=>{let ce=P.join(M,ee);try{let Ue=g.statSync(ce);return Ue.isDirectory()?{name:ee,dir:ce,mtime:Ue.mtimeMs}:null}catch{return null}}).filter(Boolean);J.sort((ee,ce)=>ee.mtime-ce.mtime);for(let ee of J){if(A>=53687091200)break;try{g.rmSync(ee.dir,{recursive:!0,force:!0}),b.info(y.dim(`  \u{1F5D1}\uFE0F Evicted stale workspace: ${ee.name}`));let ce=Y(`df -k "${M}" | tail -1 | awk '{print $4}'`,{encoding:"utf8"}).trim();if(parseInt(ce,10)*1024>=53687091200)break}catch{}}}}catch{}return await j(),z}catch(S){throw await j(),S.message==="Command aborted"?(b.warn(y.yellow(`
 \u274C Build aborted.`)),await c("failed",{error:"Aborted by user"}),S):(b.error(y.red(`
-\u2717 Local build failed: ${S.message}`)),await c("failed",{error:S.message}),S)}},is=async(e,t,i={},n,r)=>{let o=g.existsSync("android/gradlew")?"android/gradlew":g.existsSync("gradlew")?"./gradlew":null;if(!o)throw new Error("Could not find gradlew. Is this an Android project?");let s=e.developmentClient?"assembleDebug":"assembleRelease";!e.developmentClient&&e.distribution==="store"?s="bundleRelease":!e.developmentClient&&e.distribution==="internal"&&(s="assembleRelease");let l=e.buildCommand||s;b.info(y.blue(`Running Android build: ${l}...`));let a=o.includes("android/")?"android":".",d=(o.includes("android/"),"./gradlew"),c=[l],u={...i,EXPO_NO_DOTENV:"1",MACH_BUILD_PROFILE:t,MACH_APP_NAME:e.appName||e.name||"App"};if(i.ANDROID_VERSION_CODE){let m=P.join(a,"app/build.gradle");if(g.existsSync(m)){let I=i.ANDROID_VERSION_CODE,L=g.readFileSync(m,"utf-8");L=L.replace(/versionCode\s+\d+/,`versionCode ${I}`),g.writeFileSync(m,L),b.info(y.green(`\u2713 Applied Android versionCode ${I}`))}c.push(`-Pandroid.injected.version.code=${i.ANDROID_VERSION_CODE}`)}for(let m of["app/build","build",".cxx"]){let I=P.join(a,m);g.existsSync(I)&&g.rmSync(I,{recursive:!0,force:!0})}Rn(process.cwd()),await xe(d,c,a,u,n,r);let p=P.join(a,"app/build/outputs");return Ze(p,[".apk",".aab"])},ns=async(e,t,i,n={},r,o,s,l,a)=>{if(process.platform!=="darwin")throw new Error("iOS builds can only be run on macOS.");let d=P.resolve(process.cwd(),g.existsSync("ios")?"ios":"."),c=g.readdirSync(d),u=c.find(D=>D.endsWith(".xcworkspace")),p=c.find(D=>D.endsWith(".xcodeproj")),m=qe(n,i,e),I=vn(m.BUILD_NUMBER||m.CURRENT_PROJECT_VERSION);if((m.BUILD_NUMBER||m.CURRENT_PROJECT_VERSION)&&!I)throw new Error(`Invalid iOS BUILD_NUMBER/CURRENT_PROJECT_VERSION: "${m.BUILD_NUMBER||m.CURRENT_PROJECT_VERSION}". Apple requires one to three period-separated integers. Fix the Dashboard secret or remove it so Mach can use its auto build number.`);let L=I?[`BUILD_NUMBER=${I}`,`CURRENT_PROJECT_VERSION=${I}`]:[];if(I&&(m.BUILD_NUMBER=I,m.CURRENT_PROJECT_VERSION=I,b.info(y.dim(`Using iOS build number: ${I}`))),!u&&!p)throw new Error("Could not find Xcode workspace or project in ios/ directory.");try{let D=Y("xcode-select -p").toString().trim();b.info(y.dim(`Using Xcode at: ${D}`))}catch{b.warn(y.dim("Could not detect Xcode path."))}b.info(y.blue("Running iOS build via xcodebuild..."));let w=u?u.replace(".xcworkspace",""):p?.replace(".xcodeproj",""),B=e.iosScheme||w||e.scheme,k=e.developmentClient?"Debug":e.iosConfiguration||"Release",j=(r||"default").replace(/[^a-zA-Z0-9-_]/g,"_"),h=P.join(ue.homedir(),`Library/Developer/Xcode/DerivedData/${f.nameLower}`,j);g.mkdirSync(h,{recursive:!0});let K=rt(m),_=P.join(h,".mach-env-hash"),S=P.join(h,"Build"),O=g.existsSync(_)?g.readFileSync(_,"utf-8").trim():"";if(g.existsSync(S)){let D=O&&O!==K?"Build environment changed \u2014 clearing iOS DerivedData build products.":O?"Clearing iOS DerivedData build products to force a fresh JS bundle.":"DerivedData has no environment stamp \u2014 clearing iOS build products.";b.info(y.dim(D)),g.rmSync(S,{recursive:!0,force:!0})}if(g.writeFileSync(_,K),Rn(process.cwd()),e.simulator){b.info(y.dim(`Building for simulator (Scheme: ${B}, Config: ${k})...`)),await xe("xcodebuild",[u?"-workspace":"-project",u||p,"-scheme",B,"-configuration",k,"-sdk","iphonesimulator","-derivedDataPath",h,...L,"CODE_SIGNING_ALLOWED=NO","CODE_SIGNING_REQUIRED=NO"],d,m,o,s);let D=P.join(h,"Build/Products",`${k}-iphonesimulator`),T=Ze(D,[".app"]);if(T.length>0){let R=T[0],$=P.basename(R,".app"),U=P.join(D,`${$}_simulator.zip`);return b.info(y.dim(`Creating simulator artifact: ${U}...`)),Y(`cd "${D}" && zip -r "${U}" "${P.basename(R)}"`),[U]}return[]}else{b.info(y.dim(`Archiving (Scheme: ${B}, Config: ${k})...`));let D=P.join(d,"build.xcarchive"),T=P.join(d,"export");g.rmSync(D,{recursive:!0,force:!0}),g.rmSync(T,{recursive:!0,force:!0});let R=n.IOS_DIST_P12,$=n.IOS_PROVISIONING_PROFILE,U=n.IOS_P12_PASSWORD||"",G=[],x,H,E={isAppStore:!1,isDevelopment:!1};if(R&&$){b.info(y.blue("\u{1F510} CI/CD Signing: Importing certificates..."));try{let A=`${f.buildPrefix}-${t}.keychain-db`,V=P.join(ue.tmpdir(),A),J=f.keychainPassword;Y(`security create-keychain -p "${J}" "${V}" 2>/dev/null || true`),Y(`security set-keychain-settings -t 3600 -l "${V}"`),Y(`security unlock-keychain -p "${J}" "${V}"`);let ee=P.join(ue.tmpdir(),`cert-${t}.p12`),ce=Buffer.from(R,"base64");g.writeFileSync(ee,ce),b.info(y.dim(`P12 data size: ${ce.length} bytes, first bytes: ${ce.slice(0,4).toString("hex")}`)),(ce.length<100||ce[0]!==48)&&(b.warn(y.yellow("\u26A0\uFE0F  P12 data looks corrupted or was not decrypted correctly.")),b.warn(y.yellow("    This usually means MACH_ENCRYPTION_KEY on the Remote API differs from when credentials were uploaded.")));let Ue=[U,"",f.keychainPassword],ft=!1;for(let ge of Ue)try{Y(`security import "${ee}" -k "${V}" -P "${ge}" -A -T /usr/bin/codesign -T /usr/bin/security`,{stdio:"pipe"}),ft=!0,b.info(y.dim(`\u2713 P12 imported successfully with password: ${ge?"[set]":"[empty]"}`));break}catch(Ne){b.info(y.dim(`  P12 import attempt with password ${ge?`"${ge.substring(0,3)}..."`:"[empty]"} failed: ${Ne.message?.split(`
+\u2717 Local build failed: ${S.message}`)),await c("failed",{error:S.message}),S)}},is=async(e,t,i={},n,r)=>{let o=g.existsSync("android/gradlew")?"android/gradlew":g.existsSync("gradlew")?"./gradlew":null;if(!o)throw new Error("Could not find gradlew. Is this an Android project?");let s=e.developmentClient?"assembleDebug":"assembleRelease";!e.developmentClient&&e.distribution==="store"?s="bundleRelease":!e.developmentClient&&e.distribution==="internal"&&(s="assembleRelease");let l=e.buildCommand||s;b.info(y.blue(`Running Android build: ${l}...`));let a=o.includes("android/")?"android":".",d=(o.includes("android/"),"./gradlew"),c=[l],u={...i,EXPO_NO_DOTENV:"1",MACH_BUILD_PROFILE:t,MACH_APP_NAME:e.appName||e.name||"App"};if(i.ANDROID_VERSION_CODE){let m=P.join(a,"app/build.gradle");if(g.existsSync(m)){let I=i.ANDROID_VERSION_CODE,L=g.readFileSync(m,"utf-8");L=L.replace(/versionCode\s+\d+/,`versionCode ${I}`),g.writeFileSync(m,L),b.info(y.green(`\u2713 Applied Android versionCode ${I}`))}c.push(`-Pandroid.injected.version.code=${i.ANDROID_VERSION_CODE}`)}for(let m of["app/build","build",".cxx"]){let I=P.join(a,m);g.existsSync(I)&&g.rmSync(I,{recursive:!0,force:!0})}Rn(process.cwd()),await xe(d,c,a,u,n,r);let p=P.join(a,"app/build/outputs");return Ze(p,[".apk",".aab"])},ns=async(e,t,i,n={},r,o,s,l,a)=>{if(process.platform!=="darwin")throw new Error("iOS builds can only be run on macOS.");let d=P.resolve(process.cwd(),g.existsSync("ios")?"ios":"."),c=g.readdirSync(d),u=c.find(D=>D.endsWith(".xcworkspace")),p=c.find(D=>D.endsWith(".xcodeproj")),m=Xe(n,i,e),I=vn(m.BUILD_NUMBER||m.CURRENT_PROJECT_VERSION);if((m.BUILD_NUMBER||m.CURRENT_PROJECT_VERSION)&&!I)throw new Error(`Invalid iOS BUILD_NUMBER/CURRENT_PROJECT_VERSION: "${m.BUILD_NUMBER||m.CURRENT_PROJECT_VERSION}". Apple requires one to three period-separated integers. Fix the Dashboard secret or remove it so Mach can use its auto build number.`);let L=I?[`BUILD_NUMBER=${I}`,`CURRENT_PROJECT_VERSION=${I}`]:[];if(I&&(m.BUILD_NUMBER=I,m.CURRENT_PROJECT_VERSION=I,b.info(y.dim(`Using iOS build number: ${I}`))),!u&&!p)throw new Error("Could not find Xcode workspace or project in ios/ directory.");try{let D=Y("xcode-select -p").toString().trim();b.info(y.dim(`Using Xcode at: ${D}`))}catch{b.warn(y.dim("Could not detect Xcode path."))}b.info(y.blue("Running iOS build via xcodebuild..."));let w=u?u.replace(".xcworkspace",""):p?.replace(".xcodeproj",""),B=e.iosScheme||w||e.scheme,k=e.developmentClient?"Debug":e.iosConfiguration||"Release",j=(r||"default").replace(/[^a-zA-Z0-9-_]/g,"_"),h=P.join(ue.homedir(),`Library/Developer/Xcode/DerivedData/${f.nameLower}`,j);g.mkdirSync(h,{recursive:!0});let K=rt(m),_=P.join(h,".mach-env-hash"),S=P.join(h,"Build"),O=g.existsSync(_)?g.readFileSync(_,"utf-8").trim():"";if(g.existsSync(S)){let D=O&&O!==K?"Build environment changed \u2014 clearing iOS DerivedData build products.":O?"Clearing iOS DerivedData build products to force a fresh JS bundle.":"DerivedData has no environment stamp \u2014 clearing iOS build products.";b.info(y.dim(D)),g.rmSync(S,{recursive:!0,force:!0})}if(g.writeFileSync(_,K),Rn(process.cwd()),e.simulator){b.info(y.dim(`Building for simulator (Scheme: ${B}, Config: ${k})...`)),await xe("xcodebuild",[u?"-workspace":"-project",u||p,"-scheme",B,"-configuration",k,"-sdk","iphonesimulator","-derivedDataPath",h,...L,"CODE_SIGNING_ALLOWED=NO","CODE_SIGNING_REQUIRED=NO"],d,m,o,s);let D=P.join(h,"Build/Products",`${k}-iphonesimulator`),T=Ze(D,[".app"]);if(T.length>0){let R=T[0],$=P.basename(R,".app"),U=P.join(D,`${$}_simulator.zip`);return b.info(y.dim(`Creating simulator artifact: ${U}...`)),Y(`cd "${D}" && zip -r "${U}" "${P.basename(R)}"`),[U]}return[]}else{b.info(y.dim(`Archiving (Scheme: ${B}, Config: ${k})...`));let D=P.join(d,"build.xcarchive"),T=P.join(d,"export");g.rmSync(D,{recursive:!0,force:!0}),g.rmSync(T,{recursive:!0,force:!0});let R=n.IOS_DIST_P12,$=n.IOS_PROVISIONING_PROFILE,U=n.IOS_P12_PASSWORD||"",G=[],x,H,E={isAppStore:!1,isDevelopment:!1};if(R&&$){b.info(y.blue("\u{1F510} CI/CD Signing: Importing certificates..."));try{let A=`${f.buildPrefix}-${t}.keychain-db`,V=P.join(ue.tmpdir(),A),J=f.keychainPassword;Y(`security create-keychain -p "${J}" "${V}" 2>/dev/null || true`),Y(`security set-keychain-settings -t 3600 -l "${V}"`),Y(`security unlock-keychain -p "${J}" "${V}"`);let ee=P.join(ue.tmpdir(),`cert-${t}.p12`),ce=Buffer.from(R,"base64");g.writeFileSync(ee,ce),b.info(y.dim(`P12 data size: ${ce.length} bytes, first bytes: ${ce.slice(0,4).toString("hex")}`)),(ce.length<100||ce[0]!==48)&&(b.warn(y.yellow("\u26A0\uFE0F  P12 data looks corrupted or was not decrypted correctly.")),b.warn(y.yellow("    This usually means MACH_ENCRYPTION_KEY on the Remote API differs from when credentials were uploaded.")));let Ue=[U,"",f.keychainPassword],ft=!1;for(let ge of Ue)try{Y(`security import "${ee}" -k "${V}" -P "${ge}" -A -T /usr/bin/codesign -T /usr/bin/security`,{stdio:"pipe"}),ft=!0,b.info(y.dim(`\u2713 P12 imported successfully with password: ${ge?"[set]":"[empty]"}`));break}catch(Ne){b.info(y.dim(`  P12 import attempt with password ${ge?`"${ge.substring(0,3)}..."`:"[empty]"} failed: ${Ne.message?.split(`
 `)[0]||"unknown"}`))}if(!ft)throw new Error("Failed to import P12.");g.unlinkSync(ee),Y(`security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "${J}" "${V}"`);let Tt=Y("security list-keychains -d user",{encoding:"utf-8"}).split(`
 `).map(ge=>ge.trim().replace(/^"|"$/g,"")).filter(ge=>ge.length>0),kt=[V,...Tt].map(ge=>`"${ge}"`).join(" ");Y(`security list-keychains -d user -s ${kt}`),Y(`security default-keychain -s "${V}"`);let xt=P.join(ue.homedir(),"Library/MobileDevice/Provisioning Profiles");g.mkdirSync(xt,{recursive:!0});let Je=Buffer.from($,"base64"),li=P.join(xt,`${f.nameLower}-temp-${t}.mobileprovision`);g.writeFileSync(li,Je);let di=Je.toString("utf-8"),Vi=/<key>get-task-allow<\/key>\s*<true\/>/.test(di);E={isAppStore:!di.includes("<key>ProvisionedDevices</key>")&&!Vi,isDevelopment:Vi};try{let Ne=Y(`security cms -D -i "${li}"`,{encoding:"utf-8"}).match(/<key>UUID<\/key>\s*<string>([^<]+)<\/string>/);H=Ne?Ne[1]:void 0}catch{let Ne=di.match(/<key>UUID<\/key>\s*<string>([^<]+)<\/string>/);H=Ne?Ne[1]:void 0}H||(b.warn("Could not extract UUID from provisioning profile. Using fallback."),H=`${f.nameLower}-${t}`);let ci=P.join(xt,`${H}.mobileprovision`);g.existsSync(ci)&&g.unlinkSync(ci),g.renameSync(li,ci);try{let Ne=Y(`security find-identity -v -p codesigning "${V}"`,{encoding:"utf-8"}).match(/"((?:Apple|iPhone) (?:Distribution|Developer|Development)[^"]*)"/);Ne&&(x=Ne[1],b.info(y.blue(`Identity auto-detected from keychain: "${x}"`)))}catch{}x||(x=E.isDevelopment?"Apple Development":"Apple Distribution",b.info(y.blue(`Identity fallback (profile heuristic): "${x}"`))),b.info(y.dim(`Profile type: ${E.isDevelopment?"Development":E.isAppStore?"App Store":"Ad-Hoc"}`)),b.info(y.dim(`Identity Detection: get-task-allow=${E.isDevelopment}, Selected Identity="${x}"`)),G.push("CODE_SIGN_STYLE=Manual"),G.push(`CODE_SIGN_IDENTITY="${x}"`),G.push(`PROVISIONING_PROFILE_SPECIFIER=${H}`),e.iosTeamId&&G.push(`DEVELOPMENT_TEAM=${e.iosTeamId}`)}catch(A){throw b.error(`Signing setup failed: ${A.message}`),A}}else G.push("-allowProvisioningUpdates"),e.iosTeamId&&G.push(`DEVELOPMENT_TEAM=${e.iosTeamId}`);a&&await a("archive"),b.info(y.blue(`Archive detected Identity: "${x}"`)),b.info(y.blue(`Archive detected UUID: "${H}"`)),await xe("xcodebuild",["archive",u?"-workspace":"-project",u||p,"-scheme",B,"-configuration",k,"-archivePath",D,"-derivedDataPath",h,...L,...G],d,m,o,s);let ne=Ze(P.join(D,"Products","Applications"),[".app"]);for(let A of ne){let V=es(A);b.info(y.dim(`Validated iOS CFBundleVersion ${V} in ${P.basename(A)}`))}let z;H?(E.isAppStore?z="app-store":E.isDevelopment?z="development":z="ad-hoc",b.info(y.blue(`Export method from profile: "${z}"`))):(z=e.distribution==="store"?"app-store":e.distribution==="internal"?"ad-hoc":"development",b.warn(y.yellow(`No profile UUID detected. Export method from distribution flag: "${z}"`)));let he=e.iosExportMethod||z,ie=e.iosBundleIdentifier||Be("ios"),F=P.join(d,"ExportOptions.plist"),M=`<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
@@ -1093,9 +1099,9 @@ ${M}`)),a&&await a("export"),b.info(y.blue(`Exporting with Bundle ID: "${ie}"`))
 `),new Error(J)}return W}},Be=e=>{try{let t=P.join(process.cwd(),f.configFileName);if(g.existsSync(t)){let i=JSON.parse(g.readFileSync(t,"utf-8"));if(e==="android"&&i.android?.package)return i.android.package;if(e==="ios"&&i.ios?.bundleIdentifier)return i.ios.bundleIdentifier}if(e==="android"){let i=["android/app/build.gradle","app/build.gradle","build.gradle"];for(let n of i)if(g.existsSync(n)){let o=g.readFileSync(n,"utf-8").match(/applicationId\s+['"]([^'"]+)['"]/);if(o)return o[1]}}else{let i=P.resolve(process.cwd(),g.existsSync("ios")?"ios":"."),n=Ze(i,["Info.plist"]).filter(s=>!s.includes("/Pods/")&&!s.includes("/build/")&&!s.includes("/DerivedData/"));n.sort((s,l)=>l.split("/").length-s.split("/").length);for(let s of n){let a=g.readFileSync(s,"utf-8").match(/<key>CFBundleIdentifier<\/key>\s*<string>([^<]+)<\/string>/);if(a&&!a[1].includes("$"))return a[1]}let r=Ze(i,[".xcodeproj"]);if(r.length>0){let s=P.join(r[0],"project.pbxproj");if(g.existsSync(s)){let a=g.readFileSync(s,"utf-8").match(/PRODUCT_BUNDLE_IDENTIFIER\s*=\s*"?([^";\s]+)"?;/);if(a)return a[1]}}let o=["app.json","app.config.json","app.config.js","app.config.ts"];for(let s of o)if(g.existsSync(s)){let a=g.readFileSync(s,"utf-8").match(/"bundleIdentifier":\s*"([^"]+)"/);if(a)return a[1]}}}catch{return null}return null},rs=()=>{try{return Y("emulator -version",{stdio:"ignore"}),"emulator"}catch{let t=ue.homedir(),i=[P.join(t,"Library/Android/sdk/emulator/emulator"),P.join(t,"Android/Sdk/emulator/emulator"),"/usr/local/lib/android/sdk/emulator/emulator"];for(let n of i)if(g.existsSync(n))return n}return"emulator"},os=async(e,t)=>{let i=Ft();try{if(Y("adb devices").toString().split(`
 `).slice(1).map(s=>s.trim()).filter(s=>s.length>0&&!s.startsWith("*")).map(s=>s.split("	")[0]).length===0){b.warn(y.yellow("No Android devices or emulators found."));let s=rs(),l=[];try{l=Y(`${s} -list-avds`).toString().split(`
 `).filter(a=>a.trim().length>0)}catch{}if(l.length>0){let a=await yi({message:"Select an emulator to launch:",options:l.map(u=>({value:u,label:u}))});if(Ht(a))return;i.start(`Launching emulator ${a}...`),$n(s,["-avd",a],{detached:!0,stdio:"ignore"}).unref();let d=0,c=!1;for(;d<60;){try{if(Y("adb shell getprop sys.boot_completed",{stdio:"pipe"}).toString().trim()==="1"){c=!0;break}}catch{}await new Promise(u=>setTimeout(u,2e3)),d++}if(!c)throw i.stop("Emulator launch timed out."),new Error("Emulator launch timed out. Please try launching it manually.");i.stop("Emulator launched.")}else throw new Error("No devices found and no emulators available to launch. (Make sure Android SDK is installed)")}i.start("Installing APK on device..."),await xe("adb",["install","-r",e],process.cwd(),{},t),i.stop("Installation complete.");let o=Be("android");if(o){b.info(y.blue(`\u{1F680} Launching ${o}...`));try{Y(`adb shell dumpsys package ${o}`).toString().split(`
-`).find(a=>a.includes("android.intent.action.MAIN")&&a.includes("android.intent.category.LAUNCHER"))?Y(`adb shell monkey -p ${o} -c android.intent.category.LAUNCHER 1`,{stdio:"ignore"}):Y(`adb shell monkey -p ${o} -c android.intent.category.LAUNCHER 1`,{stdio:"ignore"})}catch{b.warn("Could not auto-launch app. You may need to open it manually.")}}}catch(n){i.stop("Installation failed."),b.error(y.red(`Failed to install APK: ${n.message}`))}},ss=async(e,t,i)=>{let n=Ft();try{if(!Y("xcrun simctl list devices booted").toString().includes("(Booted)")){b.warn(y.yellow("No iOS Simulator is currently booted."));let o=Y("xcrun simctl list devices --json").toString(),s=JSON.parse(o).devices,l=[];Object.keys(s).forEach(u=>{s[u].forEach(p=>{p.isAvailable&&l.push({...p,runtime:u})})});let a=await yi({message:"Select a simulator to launch:",options:l.map(u=>({value:u.udid,label:`${u.name} (${u.runtime.split(".").pop()})`}))});if(Ht(a))return;n.start(`Booting ${a}...`),Y(`xcrun simctl boot ${a}`),Y(`open -a Simulator --args -CurrentDeviceUDID ${a}`);let d=0,c=!1;for(;d<30;){try{if(Y("xcrun simctl list devices booted").toString().includes(a)){c=!0;break}}catch{}await new Promise(u=>setTimeout(u,2e3)),d++}if(!c)throw n.stop("Simulator boot timed out."),new Error("Simulator boot timed out.");n.stop("Simulator booted.")}n.start("Installing on iOS Simulator..."),await xe("xcrun",["simctl","install","booted",e],process.cwd(),{},i),n.stop("Installation complete."),b.info(y.blue(`\u{1F680} Launching ${t}...`)),await xe("xcrun",["simctl","launch","booted",t],process.cwd(),{},i)}catch(r){n.stop("Installation failed."),b.error(y.red(`Failed to install on Simulator: ${r.message}`))}},as=async(e,t,i)=>{let n=Ft();n.start("Scanning for connected iOS devices...");try{let r=Y("xcrun devicectl list devices --json-output -").toString(),s=(JSON.parse(r).result?.devices||[]).filter(a=>a.connectionProperties?.transportType==="wired"||a.connectionProperties?.transportType==="localNetwork");if(s.length===0)throw n.stop("No connected iOS devices found."),new Error("Please connect your iPhone via USB or ensure it is on the same Wi-Fi for wireless debugging.");let l=s[0].identifier;if(s.length>1){n.stop();let a=await yi({message:"Select a device to install on:",options:s.map(d=>({value:d.identifier,label:`${d.deviceProperties?.name||d.name||d.model?.name} (${d.model?.name||"iPhone"}) - ${d.identifier}`}))});if(Ht(a))return;l=a,n.start(`Installing on ${l}...`)}else n.message(`Installing on ${s[0].model.name}...`);await xe("xcrun",["devicectl","device","install","app","--device",l,e],process.cwd(),{},i),n.stop("Installation complete."),b.info(y.blue(`\u{1F680} Launching ${t}...`)),await xe("xcrun",["devicectl","device","launch","app","--device",l,t],process.cwd(),{},i)}catch(r){n.stop("Installation failed."),b.error(y.red(`Failed to install on device: ${r.message}`)),b.info(y.dim('Make sure your device is unlocked and "Developer Mode" is enabled in Settings -> Privacy & Security.'))}};import Nn from"fs";import Tn from"path";import{isCancel as Ei,log as Fe,select as kn,spinner as ls,text as ds}from"@clack/prompts";import st from"chalk";async function xn(e){let t=await bi(e);t&&(Fe.success(st.green(`Maestro run ${t.status||"queued"}: ${t.testRunId}`)),t.launchDeferredReason&&Fe.warn(st.yellow(t.launchDeferredReason)),t.dashboardUrl&&Fe.info(st.dim("View test run: ")+st.white.underline(t.dashboardUrl)))}async function bi(e){let t=Te(`./${f.configFileName}`),i=e.projectId||t?.projectId,n=e.profile||e.buildProfile||"production";if(!i)return Fe.error(`No projectId found. Run \`${f.nameLower} link\` first or pass an internal project id.`),null;let r=e.platform;if(!r&&e.latest){let a=await kn({message:"Select platform for the latest build:",options:[{value:"android",label:"Android"},{value:"ios",label:"iOS"}]});if(Ei(a))return null;r=a}let o=await cs(e);if(!o)return null;if(o.kind==="latest"&&!r)return Fe.error("Pass --platform when using --latest."),null;if(o.kind==="artifact-url"&&!r)return Fe.error("Pass --platform when using --artifact-url."),null;let s=us(e.maestroRetries);if(s===null)return null;let l=ls();e.quiet||l.start("Queuing Maestro run...");try{let a=await C.post("/tests/maestro",{projectId:i,platform:r,profile:n,latest:o.kind==="latest",buildId:o.kind==="build-id"?o.value:e.buildId,buildUrl:o.kind==="build-url"?o.value:e.buildUrl,artifactUrl:o.kind==="artifact-url"?o.value:e.artifactUrl,flows:e.maestroFlows||".maestro",device:e.maestroDevice||(r==="ios"?"iphone_15":"pixel_6"),retries:s,record:!!e.maestroRecord});if(a.data.status!=="success")throw new Error(a.data.message||"Failed to queue Maestro run");let d=a.data.testRun,c={testRunId:d.testRunId,status:d.status,projectId:i,buildId:d.buildId,platform:d.platform,dashboardUrl:d.dashboardUrl||`${je}/tests/${d.testRunId}`,launchDeferredReason:d.launchDeferredReason};return ps(e,c),e.quiet||l.stop("Maestro run queued"),c}catch(a){e.quiet||l.stop("Could not queue Maestro run");let d=a.response?.data?.message||a.message||"Unknown error";return Fe.error(st.red(`Maestro queue failed: ${d}`)),null}}async function cs(e){if(e.buildId)return{kind:"build-id",value:e.buildId};if(e.buildUrl)return{kind:"build-url",value:e.buildUrl};if(e.artifactUrl)return{kind:"artifact-url",value:e.artifactUrl};if(e.latest)return{kind:"latest"};let t=await kn({message:"Select app artifact source for Maestro:",options:[{value:"latest",label:"Latest successful build"},{value:"build-id",label:"Build ID"},{value:"build-url",label:`${f.name} build URL`},{value:"artifact-url",label:"Direct artifact URL"}]});if(Ei(t))return null;if(t==="latest")return{kind:"latest"};let i=await ds({message:t==="build-id"?"Enter build ID:":t==="build-url"?`Enter ${f.name} build URL:`:"Enter artifact URL:",validate:n=>{let r=String(n||"").trim();if(!r)return"Value is required";if((t==="build-url"||t==="artifact-url")&&!r.startsWith("http"))return"Must be a URL"}});return Ei(i)?null:{kind:t,value:String(i).trim()}}function us(e){if(e==null||e==="")return 1;let t=Number(e);return!Number.isInteger(t)||t<0||t>10?(Fe.error("--maestro-retries must be an integer between 0 and 10."),null):t}function ps(e,t){if(!e.jsonOutput)return;let i=Tn.resolve(e.jsonOutput),n={...t,updatedAt:new Date().toISOString()};try{let r=Tn.dirname(i);r&&r!=="."&&Nn.mkdirSync(r,{recursive:!0}),Nn.writeFileSync(i,JSON.stringify(n,null,2))}catch(r){Fe.warn(st.yellow(`Could not write Maestro metadata JSON: ${r.message}`))}}var Ai=8,gs=6,Yn=e=>new Promise(t=>setTimeout(t,e)),hs=e=>{let t=e.response?.status,i=e.code||"",n=e.message||"";return t?t===408||t===409||t===425||t===429||t>=500||/ECONNRESET|ETIMEDOUT|EAI_AGAIN|ENOTFOUND|ECONNABORTED|socket hang up|network|timeout/i.test(`${i} ${n}`):!0},jt=async(e,t,i=gs)=>{let n;for(let r=1;r<=i;r++)try{return await t()}catch(o){if(n=o,!hs(o)||r>=i)break;let s=Math.min(6e4,2e3*Math.pow(2,r-1)),l=o.response?.status||o.code||o.message||"network error";v.warn(N.yellow(`${e} failed transiently (${l}). Retrying in ${Math.round(s/1e3)}s... (${r}/${i})`)),await Yn(s)}throw n},ys=e=>{let t=e.response?.status;return t?t===408||t===429||t>=500:!0},Et=e=>e.credentialId||e.id,Ss=async(e,t)=>{let i=Et(e);if(!i)return e.downloadUrl;let n=await C.get(`/credentials/${i}/download`,{params:{projectId:t}});return n.data?.status==="success"&&n.data?.downloadUrl?n.data.downloadUrl:e.downloadUrl},Jn=async(e,t)=>{let i=e.downloadUrl;for(let n=1;n<=Ai;n++)try{if((!i||n>1)&&(i=await Ss(e,t)),!i)throw new Error(`Credential ${e.name||Et(e)||"unknown"} has no download URL.`);let r=await St.get(i,{responseType:"arraybuffer",timeout:6e4,maxContentLength:1/0,maxBodyLength:1/0,headers:{Connection:"close"}});return Buffer.from(r.data).toString("base64")}catch(r){if(n>=Ai||!ys(r))throw r;let o=Math.min(1500*n*n,15e3);v.warn(N.dim(`  - Temporary network error downloading ${e.name}. Retrying... (${n}/${Ai})`)),await Yn(o)}throw new Error(`Failed to download credential ${e.name||Et(e)||"unknown"}.`)},Es=async(e,t)=>{let i=await Jn(e,t);return Buffer.from(i,"base64").toString("utf8")},bs=(e,t)=>t?.ios?.buildNumber??t?.iosBuildNumber??e?.ios?.buildNumber??e?.expo?.ios?.buildNumber,As=(e,t,i)=>t?.ios?.ascAppId??t?.ascAppId??e?.ios?.ascAppId??e?.submit?.[i]?.ios?.ascAppId??e?.submit?.production?.ios?.ascAppId,Fn=e=>e.bundleId||e.bundleIdentifier||e.meta?.bundleId||e.meta?.bundleIdentifier,Hn=(e,t)=>{let i=e.filter(n=>n.type==="asc_api_key");if(i.length!==0){if(t){let n=i.find(o=>Fn(o)===t);if(n)return n;let r=i.find(o=>Fn(o)==="*");if(r)return r}return i[0]}},Is=e=>typeof e=="string"&&e.trim().toLowerCase()==="auto",qn=(e,t,i=[])=>{if(!oe.existsSync(e))return i;let n;try{n=oe.readdirSync(e,{withFileTypes:!0})}catch{return i}for(let r of n){if(r.name==="Pods"||r.name==="build"||r.name==="DerivedData")continue;let o=Se.join(e,r.name);r.isDirectory()?qn(o,t,i):r.name===t&&i.push(o)}return i},_s=(e,t,i)=>{let n=`${i} ${t.environment||""}`.toLowerCase(),r=e.toLowerCase(),o=0;return(n.includes("development")||n.includes("dev"))&&/(^|[.-])dev(elopment)?($|[.-])/.test(r)&&(o+=20),(n.includes("staging")||n.includes("stage"))&&/(^|[.-])stag(e|ing)?($|[.-])/.test(r)&&(o+=20),(n.includes("production")||n.includes("prod"))&&(/(^|[.-])(dev|development|stag|stage|staging)($|[.-])/.test(r)||(o+=20)),o},Ps=(e,t)=>{let i=Se.resolve(process.cwd(),oe.existsSync("ios")?"ios":"."),n=qn(i,"project.pbxproj"),r=[];for(let o of n)try{let l=oe.readFileSync(o,"utf8").matchAll(/PRODUCT_BUNDLE_IDENTIFIER\s*=\s*"?([^";\s]+)"?;/g);for(let a of l){let d=a[1]?.trim();d&&!d.includes("$")&&!d.startsWith("com.apple.")&&!r.includes(d)&&r.push(d)}}catch{}if(r.length!==0)return r.length===1?r[0]:r.map(o=>({bundleId:o,score:_s(o,e,t)})).sort((o,s)=>s.score-o.score)[0]?.bundleId},Gt=e=>String(e||"").trim().toLowerCase().replace(/_/g,"-"),Kt=(e,t)=>{let i=Gt(e);return t==="ios"&&(i==="internal"||i==="ad-hoc")?"adhoc":t==="android"&&["internal","adhoc","ad-hoc","development","dev","staging","stage"].includes(i)?"internal":i},jn=(e,t,i)=>{let n=Kt(e.distributionType||e.meta?.distributionType,i);return n?n===Kt(t,i):!0},Gn=(e,t,i)=>{let n=Kt(e.distributionType||e.meta?.distributionType,i),r=Kt(t,i);return n?n===r?3:i==="android"&&r!=="store"&&n!=="store"?2:0:1},$s=e=>{let t=e.toLowerCase();return t==="development"||t==="dev"||t.startsWith("development-")||t.startsWith("dev-")||t.endsWith("-development")||t.endsWith("-dev")},ws=e=>{let t=e.toLowerCase();return t.includes("staging")||t.includes("stage")||t.includes("preview")||t.includes("adhoc")||t.includes("ad-hoc")},Ds=(e,t)=>{let i=Gt(e.distribution),n=Gt(e.iosExportMethod),r=Gt(e.environment);return e.platform!=="ios"?i==="store"?"store":"internal":e.developmentClient||e.simulator?"development":n==="app-store"||i==="store"?"store":n==="development"||i==="development"?"development":n==="ad-hoc"||n==="adhoc"||i==="ad-hoc"||i==="adhoc"||i==="internal"?"adhoc":r==="production"||r==="store"?"store":r==="development"||r==="dev"?"development":r==="staging"||r==="stage"||r==="preview"?"adhoc":t.toLowerCase()==="production"||t.toLowerCase().includes("store")?"store":$s(t)?"development":(ws(t),"adhoc")},Xn=e=>e.bundleId||e.bundleIdentifier||e.packageName||e.meta?.bundleId||e.meta?.bundleIdentifier||e.meta?.packageName,Kn=(e,t)=>{if(!t)return!0;let i=Xn(e);return!i||i==="*"||i===t},Vn=(e,t)=>{let i=Xn(e);return!t||!i?0:i===t?2:i==="*"?1:-1},Zn=e=>{try{let t=Buffer.from(e,"base64").toString("utf8"),i=t.match(/<key>application-identifier<\/key>\s*<string>([^<]+)<\/string>/)?.[1]?.trim();if(!i)return;let n=t.match(/<key>TeamIdentifier<\/key>\s*<array>\s*<string>([^<]+)<\/string>/)?.[1]?.trim();if(n&&i.startsWith(`${n}.`))return i.slice(n.length+1);let r=i.indexOf(".");return r>=0?i.slice(r+1):i}catch{return}},Rs=(e,t)=>{if(e===t||e==="*")return!0;if(e.endsWith(".*")){let i=e.slice(0,-2);return t.startsWith(`${i}.`)}return!1},vs=(e,t)=>{if(!t)return!0;let i=Zn(e);if(i)return Rs(i,t);try{return Buffer.from(e,"base64").toString("latin1").includes(t)}catch{return!0}},Vt=async e=>{if(e.failOnly){(!e.projectId||!e.buildId)&&(v.error(N.red("--project-id and --build-id are required with --fail-only.")),process.exit(1));let l=e.error||"Build runner failed before it could report a final status.";try{await C.patch(`/builds/${e.projectId}/${e.buildId}`,{status:"failed",error:l,endTime:Date.now()}),v.info(N.yellow(`Marked build ${e.buildId} as failed.`));return}catch(a){v.error(N.red(`Could not mark build failed: ${a.message}`)),process.exit(1)}}e.platform!=="android"&&e.platform!=="ios"&&(v.error(`Platform ${e.platform} is not supported. Use 'android' or 'ios'.`),process.exit(1));let t=Ii(),i=e.buildId||fs(),n=e.projectId,r=Date.now(),o=!!n,s=async l=>{if(n)try{await C.patch(`/builds/${n}/${i}`,{status:"failed",error:l})}catch{}};if(e.local&&e.buildId){e.quiet||t.start(`Preparing isolated workspace for build: ${e.buildId}`);try{let l=await C.get(`/builds/${n}/${e.buildId}/source-url`);if(l.data.status!=="success")throw new Error("Failed to get source download URL from API");let a=await St.get(l.data.downloadUrl,{responseType:"stream"}),d=(n||e.projectId||"default").replace(/[^a-zA-Z0-9-_]/g,"_"),c=Se.join(ms.homedir(),f.workspacesDir,d);oe.mkdirSync(c,{recursive:!0});let u=new Set(["node_modules",`.${f.nameLower}-cache-meta`]),p=new Set(["Pods"]);if(oe.existsSync(c)){let B=oe.readdirSync(c);for(let k of B){if(u.has(k))continue;if(k==="ios"){let h=Se.join(c,"ios");try{let K=oe.readdirSync(h);for(let _ of K)if(!p.has(_))try{oe.rmSync(Se.join(h,_),{recursive:!0,force:!0})}catch{}}catch{}continue}let j=Se.join(c,k);try{oe.rmSync(j,{recursive:!0,force:!0})}catch{}}}let m=Se.join(c,"source.zip"),I=a.data,L=oe.createWriteStream(m);await new Promise((B,k)=>{I.pipe(L),I.on("error",j=>k(j)),L.on("finish",()=>B())}),new Bn(m).extractAllTo(c,!0);try{oe.unlinkSync(m)}catch{}process.chdir(c),v.info(N.green(`\u2713 Persistent workspace ready: ${c}`)),v.info(N.dim(`  \u{1F4E6} Cached dirs preserved: node_modules=${oe.existsSync(Se.join(c,"node_modules"))?"\u2705":"\u274C"}, Pods=${oe.existsSync(Se.join(c,"ios","Pods"))?"\u2705":"\u274C"}`)),t.stop()}catch(l){t.stop(`Failed to prepare isolated workspace: ${l.message}`),n&&await s(`Setup Error: ${l.message}`),process.exit(1)}}try{let l=e.repo;if(!l)try{l=Mn("git config --get remote.origin.url").toString().trim()}catch{v.warn("Could not detect git repository URL.")}!l&&e.dryRun,l||(l="https://github.com/placeholder/repo.git"),v.info(`Build ID: ${N.cyan(i)}`);let a={},d={},c=Te(`./${f.configFileName}`);if(c){n=c.projectId;let _=e.buildProfile||"production",S=Ge(c,_);!S&&e.buildProfile&&(v.error(`Build profile '${_}' not found in ${f.configFileName}`),process.exit(1));let O=S||{};process.env.MACH_DEBUG&&v.info(N.dim(`Build profile: ${_} | Platform: ${e.platform} | Distribution: ${O.distribution||"store"} | Environment: ${O.environment||_}`)),O.env&&(d=O.env,v.info(N.blue(`Use Build Profile: ${_}`)));let D=e.platform,T=O[D]||{},R=["developmentClient","simulator","distribution","buildCommand","apk","iosScheme","preBuild","postBuild","scheme","environment","androidPackage","iosBundleIdentifier","name","iosDeploymentTarget","iosApiKeyId","iosApiKeyIssuer","iosApiKeyPath","iosTeamId","iosConfiguration","iosExportMethod","branch","repo","instanceType","ami","bucket","region","nodeVersion"];e.name=c.name,e.appName=c.name,e.androidPackage=c.android?.package,e.iosBundleIdentifier=c.ios?.bundleIdentifier,e.iosScheme=c.ios?.iosScheme,!e.nodeVersion&&c.nodeVersion&&(e.nodeVersion=c.nodeVersion);let $=x=>x==="androidPackage"?T.androidPackage??T.package??O.androidPackage??O.android?.package:x==="iosBundleIdentifier"?T.iosBundleIdentifier??T.bundleIdentifier??O.iosBundleIdentifier??O.ios?.bundleIdentifier:T[x]!==void 0?T[x]:O[x];for(let x of R){let H=$(x),E=x==="androidPackage"||x==="iosBundleIdentifier";H!==void 0&&(e[x]===void 0||E)&&(e[x]=H)}if(e.platform==="ios"&&!(T.iosBundleIdentifier??T.bundleIdentifier??O.iosBundleIdentifier??O.ios?.bundleIdentifier)){let H=Ps(e,_);H&&H!==e.iosBundleIdentifier&&(v.warn(N.yellow(`Detected native iOS bundle identifier ${H}; using it for credential lookup. Set build.${_}.ios.bundleIdentifier to make this explicit.`)),e.iosBundleIdentifier=H)}e.branch=e.branch||"main",e.iosConfiguration=e.iosConfiguration||(e.developmentClient||e.simulator?"Debug":"Release"),e.sshUser=e.sshUser||process.env.USER||"ubuntu",e.simulator===void 0&&(e.simulator=!1),e.local===void 0&&(e.local=!1),e.verbose===void 0&&(e.verbose=!1);let U=x=>{if(!x)return x;if(x.startsWith("scripts.")){let H=x.split(".")[1],E=c.scripts?.[H];if(E)return E;v.warn(`Script reference not found: ${x}`)}return x};e.buildCommand=U(e.buildCommand),e.preBuild=U(e.preBuild),e.postBuild=U(e.postBuild),!e.scheme&&c.scheme&&(e.scheme=c.scheme);let G={...nt(c,f.envPrefix),...nt(O,`${f.envPrefix}PROFILE_`)};a={...a,...d,...G},process.env.IOS_P12_PASSWORD&&!a.IOS_P12_PASSWORD&&(a.IOS_P12_PASSWORD=process.env.IOS_P12_PASSWORD),process.env.MATCH_PASSWORD&&!a.MATCH_PASSWORD&&(a.MATCH_PASSWORD=process.env.MATCH_PASSWORD),e.platform==="ios"&&(!e.iosTeamId&&O.ios?.appleTeamId&&(e.iosTeamId=O.ios.appleTeamId),!e.iosTeamId&&c.submit?.[_]?.ios?.appleTeamId&&(e.iosTeamId=c.submit[_].ios.appleTeamId),!e.iosTeamId&&c.submit?.production?.ios?.appleTeamId&&(v.warn(N.yellow(`Check: Using 'production' Team ID for '${_}' build.`)),e.iosTeamId=c.submit.production.ios.appleTeamId),e.iosTeamId?v.info(N.magenta(`\u2713 Injected iOS Team ID from config: ${e.iosTeamId}`)):v.warn(N.yellow("\u26A0\uFE0F No iOS Team ID found. Signing might fail if not managed automatically via Expo.")))}let u="unknown";try{u=Mn("git rev-parse --abbrev-ref HEAD").toString().trim()}catch{v.warn("Failed to detect git branch.")}let p="1.0.0";try{oe.existsSync("./package.json")&&(p=JSON.parse(oe.readFileSync("./package.json","utf-8")).version||"1.0.0")}catch{}let m=e.buildProfile||"production",I="Internal";e.developmentClient?I="DevelopmentClient":m.toLowerCase().includes("store")||m.toLowerCase()==="production"?I="Store":m.toLowerCase().includes("preview")||m.toLowerCase().includes("staging")?I="Staging":(m.toLowerCase().includes("development")||m.toLowerCase().includes("dev"))&&(I="Development");let L=e.platform==="ios"?"iOS":"Android",w=e.platform==="ios"&&e.simulator?" (Simulator)":"",B=`${L}${w} v${p} (${I})`;if(zt(e,{status:"created",projectId:n,buildId:i,platform:e.platform,profile:m,branch:u,version:p,buildType:I,developmentClient:!!e.developmentClient,summary:B}),n){try{let _=e.buildProfile||"production",S=e.environment||_;v.info(N.blue(`Fetching managed secrets for profile: ${_} (environment: ${S})...`));let D=(await C.get(`/projects/${n}/secrets/export?env=${S}`)).data;D.status==="success"&&D.secrets&&(a={...a,...D.secrets},Object.keys(D.secrets).length>0&&v.info(N.magenta(`\u2713 Injected ${Object.keys(D.secrets).length} secrets from Dashboard.`)))}catch(_){v.warn(`Failed to load managed secrets from Dashboard: ${_.message}`)}try{v.info(N.blue("Fetching managed credentials..."));let _=Ds(e,m),S=e.platform==="ios"?e.iosBundleIdentifier:e.androidPackage,O=e.platform==="ios"?"bundle":"package";v.info(N.dim(`  Credential target: ${O} ${S||"not set"} (${_})`));let D=await C.get("/credentials/resolve",{params:{projectId:n,platform:e.platform,bundleId:S,distributionType:_}});if(D.data.status==="success"&&D.data.credentials){let T=D.data.credentials;v.info(N.magenta(`\u2713 Found ${T.length} relevant credentials.`));let R=T.filter(E=>e.platform==="ios"&&E.type==="ios_profile"?jn(E,_,e.platform)?Kn(E,S):!1:e.platform==="android"&&E.type==="android_keystore"?Kn(E,S):!!jn(E,_,e.platform)).sort((E,ne)=>Vn(ne,S)*10+Gn(ne,_,e.platform)-(Vn(E,S)*10+Gn(E,_,e.platform)));v.info(N.dim(`  Filtered to ${R.length} credentials for distributionType: ${_}`));let $=!1,U=!1,G=!1,x=[];for(let E of R)if(!(E.type==="ios_cert"&&$||E.type==="ios_profile"&&U||E.type==="android_keystore"&&G)&&["ios_cert","ios_profile","android_keystore"].includes(E.type)&&(E.downloadUrl||Et(E)))try{let z=await Jn(E,n);if(E.type==="ios_cert"&&!$)a.IOS_DIST_P12=z,E.password?(a.IOS_P12_PASSWORD=E.password,v.info(N.dim(`  - Injected ${E.name} as IOS_DIST_P12 with password from credential record`))):v.info(N.dim(`  - Injected ${E.name} as IOS_DIST_P12`)),$=!0;else if(E.type==="ios_profile"&&!U){if(!vs(z,S)){let he=Zn(z)||"unknown";throw new Error(`Provisioning profile ${E.name||Et(E)||"unknown"} is for a different bundle ID. Expected ${S}, found ${he}. Upload a ${_} profile for ${S}.`)}a.IOS_PROVISIONING_PROFILE=z,v.info(N.dim(`  - Injected ${E.name} as IOS_PROVISIONING_PROFILE`)),U=!0}else if(E.type==="android_keystore"&&!G){a.ANDROID_KEYSTORE_BASE64=z;let he=E.keystorePassword||E.password,ie=E.keyPassword||E.keystorePassword||E.password,F=E.alias||E.meta?.alias;if(he)a.ANDROID_STORE_PASSWORD=he,v.info(N.dim("  - Injected keystore password from credential record"));else{let A=["ANDROID_STORE_PASSWORD",...[_==="store"?"PRODUCTION":_==="internal"||_==="adhoc"?"STAGING":"DEVELOPMENT",_.toUpperCase(),"PRODUCTION","STORE","INTERNAL","STAGING","RELEASE","DEBUG"].map(V=>`KEYSTORE_PASSWORD_${V}`),"KEYSTORE_PASSWORD"].find(V=>!!a[V]);A&&a[A]&&(a.ANDROID_STORE_PASSWORD=a[A])}if(ie?(a.ANDROID_KEY_PASSWORD=ie,v.info(N.dim("  - Injected key password from credential record"))):a.ANDROID_KEY_PASSWORD=a.ANDROID_STORE_PASSWORD||"",F)a.ANDROID_KEY_ALIAS=F;else{let M=["ANDROID_KEY_ALIAS","KEYSTORE_ALIAS"].find(W=>!!a[W]);M&&(a.ANDROID_KEY_ALIAS=a[M])}v.info(N.dim(`  - Injected ${E.name} as ANDROID_KEYSTORE_BASE64`)),G=!0}}catch(z){x.push(`${E.name||E.type}: ${z.message}`)}let H=e.platform==="ios"?e.simulator||$&&U:G||!R.some(E=>E.type==="android_keystore");if(x.length>0&&!H)throw new Error(`Credential setup failed:
+`).find(a=>a.includes("android.intent.action.MAIN")&&a.includes("android.intent.category.LAUNCHER"))?Y(`adb shell monkey -p ${o} -c android.intent.category.LAUNCHER 1`,{stdio:"ignore"}):Y(`adb shell monkey -p ${o} -c android.intent.category.LAUNCHER 1`,{stdio:"ignore"})}catch{b.warn("Could not auto-launch app. You may need to open it manually.")}}}catch(n){i.stop("Installation failed."),b.error(y.red(`Failed to install APK: ${n.message}`))}},ss=async(e,t,i)=>{let n=Ft();try{if(!Y("xcrun simctl list devices booted").toString().includes("(Booted)")){b.warn(y.yellow("No iOS Simulator is currently booted."));let o=Y("xcrun simctl list devices --json").toString(),s=JSON.parse(o).devices,l=[];Object.keys(s).forEach(u=>{s[u].forEach(p=>{p.isAvailable&&l.push({...p,runtime:u})})});let a=await yi({message:"Select a simulator to launch:",options:l.map(u=>({value:u.udid,label:`${u.name} (${u.runtime.split(".").pop()})`}))});if(Ht(a))return;n.start(`Booting ${a}...`),Y(`xcrun simctl boot ${a}`),Y(`open -a Simulator --args -CurrentDeviceUDID ${a}`);let d=0,c=!1;for(;d<30;){try{if(Y("xcrun simctl list devices booted").toString().includes(a)){c=!0;break}}catch{}await new Promise(u=>setTimeout(u,2e3)),d++}if(!c)throw n.stop("Simulator boot timed out."),new Error("Simulator boot timed out.");n.stop("Simulator booted.")}n.start("Installing on iOS Simulator..."),await xe("xcrun",["simctl","install","booted",e],process.cwd(),{},i),n.stop("Installation complete."),b.info(y.blue(`\u{1F680} Launching ${t}...`)),await xe("xcrun",["simctl","launch","booted",t],process.cwd(),{},i)}catch(r){n.stop("Installation failed."),b.error(y.red(`Failed to install on Simulator: ${r.message}`))}},as=async(e,t,i)=>{let n=Ft();n.start("Scanning for connected iOS devices...");try{let r=Y("xcrun devicectl list devices --json-output -").toString(),s=(JSON.parse(r).result?.devices||[]).filter(a=>a.connectionProperties?.transportType==="wired"||a.connectionProperties?.transportType==="localNetwork");if(s.length===0)throw n.stop("No connected iOS devices found."),new Error("Please connect your iPhone via USB or ensure it is on the same Wi-Fi for wireless debugging.");let l=s[0].identifier;if(s.length>1){n.stop();let a=await yi({message:"Select a device to install on:",options:s.map(d=>({value:d.identifier,label:`${d.deviceProperties?.name||d.name||d.model?.name} (${d.model?.name||"iPhone"}) - ${d.identifier}`}))});if(Ht(a))return;l=a,n.start(`Installing on ${l}...`)}else n.message(`Installing on ${s[0].model.name}...`);await xe("xcrun",["devicectl","device","install","app","--device",l,e],process.cwd(),{},i),n.stop("Installation complete."),b.info(y.blue(`\u{1F680} Launching ${t}...`)),await xe("xcrun",["devicectl","device","launch","app","--device",l,t],process.cwd(),{},i)}catch(r){n.stop("Installation failed."),b.error(y.red(`Failed to install on device: ${r.message}`)),b.info(y.dim('Make sure your device is unlocked and "Developer Mode" is enabled in Settings -> Privacy & Security.'))}};import Nn from"fs";import Tn from"path";import{isCancel as Ei,log as Fe,select as kn,spinner as ls,text as ds}from"@clack/prompts";import st from"chalk";async function xn(e){let t=await bi(e);t&&(Fe.success(st.green(`Maestro run ${t.status||"queued"}: ${t.testRunId}`)),t.launchDeferredReason&&Fe.warn(st.yellow(t.launchDeferredReason)),t.dashboardUrl&&Fe.info(st.dim("View test run: ")+st.white.underline(t.dashboardUrl)))}async function bi(e){let t=Te(`./${f.configFileName}`),i=e.projectId||t?.projectId,n=e.profile||e.buildProfile||"production";if(!i)return Fe.error(`No projectId found. Run \`${f.nameLower} link\` first or pass an internal project id.`),null;let r=e.platform;if(!r&&e.latest){let a=await kn({message:"Select platform for the latest build:",options:[{value:"android",label:"Android"},{value:"ios",label:"iOS"}]});if(Ei(a))return null;r=a}let o=await cs(e);if(!o)return null;if(o.kind==="latest"&&!r)return Fe.error("Pass --platform when using --latest."),null;if(o.kind==="artifact-url"&&!r)return Fe.error("Pass --platform when using --artifact-url."),null;let s=us(e.maestroRetries);if(s===null)return null;let l=ls();e.quiet||l.start("Queuing Maestro run...");try{let a=await C.post("/tests/maestro",{projectId:i,platform:r,profile:n,latest:o.kind==="latest",buildId:o.kind==="build-id"?o.value:e.buildId,buildUrl:o.kind==="build-url"?o.value:e.buildUrl,artifactUrl:o.kind==="artifact-url"?o.value:e.artifactUrl,flows:e.maestroFlows||".maestro",device:e.maestroDevice||(r==="ios"?"iphone_15":"pixel_6"),retries:s,record:!!e.maestroRecord});if(a.data.status!=="success")throw new Error(a.data.message||"Failed to queue Maestro run");let d=a.data.testRun,c={testRunId:d.testRunId,status:d.status,projectId:i,buildId:d.buildId,platform:d.platform,dashboardUrl:d.dashboardUrl||`${je}/tests/${d.testRunId}`,launchDeferredReason:d.launchDeferredReason};return ps(e,c),e.quiet||l.stop("Maestro run queued"),c}catch(a){e.quiet||l.stop("Could not queue Maestro run");let d=a.response?.data?.message||a.message||"Unknown error";return Fe.error(st.red(`Maestro queue failed: ${d}`)),null}}async function cs(e){if(e.buildId)return{kind:"build-id",value:e.buildId};if(e.buildUrl)return{kind:"build-url",value:e.buildUrl};if(e.artifactUrl)return{kind:"artifact-url",value:e.artifactUrl};if(e.latest)return{kind:"latest"};let t=await kn({message:"Select app artifact source for Maestro:",options:[{value:"latest",label:"Latest successful build"},{value:"build-id",label:"Build ID"},{value:"build-url",label:`${f.name} build URL`},{value:"artifact-url",label:"Direct artifact URL"}]});if(Ei(t))return null;if(t==="latest")return{kind:"latest"};let i=await ds({message:t==="build-id"?"Enter build ID:":t==="build-url"?`Enter ${f.name} build URL:`:"Enter artifact URL:",validate:n=>{let r=String(n||"").trim();if(!r)return"Value is required";if((t==="build-url"||t==="artifact-url")&&!r.startsWith("http"))return"Must be a URL"}});return Ei(i)?null:{kind:t,value:String(i).trim()}}function us(e){if(e==null||e==="")return 1;let t=Number(e);return!Number.isInteger(t)||t<0||t>10?(Fe.error("--maestro-retries must be an integer between 0 and 10."),null):t}function ps(e,t){if(!e.jsonOutput)return;let i=Tn.resolve(e.jsonOutput),n={...t,updatedAt:new Date().toISOString()};try{let r=Tn.dirname(i);r&&r!=="."&&Nn.mkdirSync(r,{recursive:!0}),Nn.writeFileSync(i,JSON.stringify(n,null,2))}catch(r){Fe.warn(st.yellow(`Could not write Maestro metadata JSON: ${r.message}`))}}var Ai=8,gs=6,Yn=e=>new Promise(t=>setTimeout(t,e)),hs=e=>{let t=e.response?.status,i=e.code||"",n=e.message||"";return t?t===408||t===409||t===425||t===429||t>=500||/ECONNRESET|ETIMEDOUT|EAI_AGAIN|ENOTFOUND|ECONNABORTED|socket hang up|network|timeout/i.test(`${i} ${n}`):!0},jt=async(e,t,i=gs)=>{let n;for(let r=1;r<=i;r++)try{return await t()}catch(o){if(n=o,!hs(o)||r>=i)break;let s=Math.min(6e4,2e3*Math.pow(2,r-1)),l=o.response?.status||o.code||o.message||"network error";v.warn(N.yellow(`${e} failed transiently (${l}). Retrying in ${Math.round(s/1e3)}s... (${r}/${i})`)),await Yn(s)}throw n},ys=e=>{let t=e.response?.status;return t?t===408||t===429||t>=500:!0},Et=e=>e.credentialId||e.id,Ss=async(e,t)=>{let i=Et(e);if(!i)return e.downloadUrl;let n=await C.get(`/credentials/${i}/download`,{params:{projectId:t,format:"raw"}});return n.data?.status==="success"&&n.data?.downloadUrl?n.data.downloadUrl:e.downloadUrl},Jn=async(e,t)=>{let i=e.downloadUrl;for(let n=1;n<=Ai;n++)try{if((!i||n>1)&&(i=await Ss(e,t)),!i)throw new Error(`Credential ${e.name||Et(e)||"unknown"} has no download URL.`);let r=await St.get(i,{responseType:"arraybuffer",timeout:6e4,maxContentLength:1/0,maxBodyLength:1/0,headers:{Connection:"close"}});return Buffer.from(r.data).toString("base64")}catch(r){if(n>=Ai||!ys(r))throw r;let o=Math.min(1500*n*n,15e3);v.warn(N.dim(`  - Temporary network error downloading ${e.name}. Retrying... (${n}/${Ai})`)),await Yn(o)}throw new Error(`Failed to download credential ${e.name||Et(e)||"unknown"}.`)},Es=async(e,t)=>{let i=await Jn(e,t);return Buffer.from(i,"base64").toString("utf8")},bs=(e,t)=>t?.ios?.buildNumber??t?.iosBuildNumber??e?.ios?.buildNumber??e?.expo?.ios?.buildNumber,As=(e,t,i)=>t?.ios?.ascAppId??t?.ascAppId??e?.ios?.ascAppId??e?.submit?.[i]?.ios?.ascAppId??e?.submit?.production?.ios?.ascAppId,Fn=e=>e.bundleId||e.bundleIdentifier||e.meta?.bundleId||e.meta?.bundleIdentifier,Hn=(e,t)=>{let i=e.filter(n=>n.type==="asc_api_key");if(i.length!==0){if(t){let n=i.find(o=>Fn(o)===t);if(n)return n;let r=i.find(o=>Fn(o)==="*");if(r)return r}return i[0]}},Is=e=>typeof e=="string"&&e.trim().toLowerCase()==="auto",Xn=(e,t,i=[])=>{if(!oe.existsSync(e))return i;let n;try{n=oe.readdirSync(e,{withFileTypes:!0})}catch{return i}for(let r of n){if(r.name==="Pods"||r.name==="build"||r.name==="DerivedData")continue;let o=Se.join(e,r.name);r.isDirectory()?Xn(o,t,i):r.name===t&&i.push(o)}return i},_s=(e,t,i)=>{let n=`${i} ${t.environment||""}`.toLowerCase(),r=e.toLowerCase(),o=0;return(n.includes("development")||n.includes("dev"))&&/(^|[.-])dev(elopment)?($|[.-])/.test(r)&&(o+=20),(n.includes("staging")||n.includes("stage"))&&/(^|[.-])stag(e|ing)?($|[.-])/.test(r)&&(o+=20),(n.includes("production")||n.includes("prod"))&&(/(^|[.-])(dev|development|stag|stage|staging)($|[.-])/.test(r)||(o+=20)),o},Ps=(e,t)=>{let i=Se.resolve(process.cwd(),oe.existsSync("ios")?"ios":"."),n=Xn(i,"project.pbxproj"),r=[];for(let o of n)try{let l=oe.readFileSync(o,"utf8").matchAll(/PRODUCT_BUNDLE_IDENTIFIER\s*=\s*"?([^";\s]+)"?;/g);for(let a of l){let d=a[1]?.trim();d&&!d.includes("$")&&!d.startsWith("com.apple.")&&!r.includes(d)&&r.push(d)}}catch{}if(r.length!==0)return r.length===1?r[0]:r.map(o=>({bundleId:o,score:_s(o,e,t)})).sort((o,s)=>s.score-o.score)[0]?.bundleId},Gt=e=>String(e||"").trim().toLowerCase().replace(/_/g,"-"),Kt=(e,t)=>{let i=Gt(e);return t==="ios"&&(i==="internal"||i==="ad-hoc")?"adhoc":t==="android"&&["internal","adhoc","ad-hoc","development","dev","staging","stage"].includes(i)?"internal":i},jn=(e,t,i)=>{let n=Kt(e.distributionType||e.meta?.distributionType,i);return n?n===Kt(t,i):!0},Gn=(e,t,i)=>{let n=Kt(e.distributionType||e.meta?.distributionType,i),r=Kt(t,i);return n?n===r?3:i==="android"&&r!=="store"&&n!=="store"?2:0:1},$s=e=>{let t=e.toLowerCase();return t==="development"||t==="dev"||t.startsWith("development-")||t.startsWith("dev-")||t.endsWith("-development")||t.endsWith("-dev")},ws=e=>{let t=e.toLowerCase();return t.includes("staging")||t.includes("stage")||t.includes("preview")||t.includes("adhoc")||t.includes("ad-hoc")},Ds=(e,t)=>{let i=Gt(e.distribution),n=Gt(e.iosExportMethod),r=Gt(e.environment);return e.platform!=="ios"?i==="store"?"store":"internal":e.developmentClient||e.simulator?"development":n==="app-store"||i==="store"?"store":n==="development"||i==="development"?"development":n==="ad-hoc"||n==="adhoc"||i==="ad-hoc"||i==="adhoc"||i==="internal"?"adhoc":r==="production"||r==="store"?"store":r==="development"||r==="dev"?"development":r==="staging"||r==="stage"||r==="preview"?"adhoc":t.toLowerCase()==="production"||t.toLowerCase().includes("store")?"store":$s(t)?"development":(ws(t),"adhoc")},qn=e=>e.bundleId||e.bundleIdentifier||e.packageName||e.meta?.bundleId||e.meta?.bundleIdentifier||e.meta?.packageName,Kn=(e,t)=>{if(!t)return!0;let i=qn(e);return!i||i==="*"||i===t},Vn=(e,t)=>{let i=qn(e);return!t||!i?0:i===t?2:i==="*"?1:-1},Zn=e=>{try{let t=Buffer.from(e,"base64").toString("utf8"),i=t.match(/<key>application-identifier<\/key>\s*<string>([^<]+)<\/string>/)?.[1]?.trim();if(!i)return;let n=t.match(/<key>TeamIdentifier<\/key>\s*<array>\s*<string>([^<]+)<\/string>/)?.[1]?.trim();if(n&&i.startsWith(`${n}.`))return i.slice(n.length+1);let r=i.indexOf(".");return r>=0?i.slice(r+1):i}catch{return}},Rs=(e,t)=>{if(e===t||e==="*")return!0;if(e.endsWith(".*")){let i=e.slice(0,-2);return t.startsWith(`${i}.`)}return!1},vs=(e,t)=>{if(!t)return!0;let i=Zn(e);if(i)return Rs(i,t);try{return Buffer.from(e,"base64").toString("latin1").includes(t)}catch{return!0}},Vt=async e=>{if(e.failOnly){(!e.projectId||!e.buildId)&&(v.error(N.red("--project-id and --build-id are required with --fail-only.")),process.exit(1));let l=e.error||"Build runner failed before it could report a final status.";try{await C.patch(`/builds/${e.projectId}/${e.buildId}`,{status:"failed",error:l,endTime:Date.now()}),v.info(N.yellow(`Marked build ${e.buildId} as failed.`));return}catch(a){v.error(N.red(`Could not mark build failed: ${a.message}`)),process.exit(1)}}e.platform!=="android"&&e.platform!=="ios"&&(v.error(`Platform ${e.platform} is not supported. Use 'android' or 'ios'.`),process.exit(1));let t=Ii(),i=e.buildId||fs(),n=e.projectId,r=Date.now(),o=!!n,s=async l=>{if(n)try{await C.patch(`/builds/${n}/${i}`,{status:"failed",error:l})}catch{}};if(e.local&&e.buildId){e.quiet||t.start(`Preparing isolated workspace for build: ${e.buildId}`);try{let l=await C.get(`/builds/${n}/${e.buildId}/source-url`);if(l.data.status!=="success")throw new Error("Failed to get source download URL from API");let a=await St.get(l.data.downloadUrl,{responseType:"stream"}),d=(n||e.projectId||"default").replace(/[^a-zA-Z0-9-_]/g,"_"),c=Se.join(ms.homedir(),f.workspacesDir,d);oe.mkdirSync(c,{recursive:!0});let u=new Set(["node_modules",`.${f.nameLower}-cache-meta`]),p=new Set(["Pods"]);if(oe.existsSync(c)){let B=oe.readdirSync(c);for(let k of B){if(u.has(k))continue;if(k==="ios"){let h=Se.join(c,"ios");try{let K=oe.readdirSync(h);for(let _ of K)if(!p.has(_))try{oe.rmSync(Se.join(h,_),{recursive:!0,force:!0})}catch{}}catch{}continue}let j=Se.join(c,k);try{oe.rmSync(j,{recursive:!0,force:!0})}catch{}}}let m=Se.join(c,"source.zip"),I=a.data,L=oe.createWriteStream(m);await new Promise((B,k)=>{I.pipe(L),I.on("error",j=>k(j)),L.on("finish",()=>B())}),new Bn(m).extractAllTo(c,!0);try{oe.unlinkSync(m)}catch{}process.chdir(c),v.info(N.green(`\u2713 Persistent workspace ready: ${c}`)),v.info(N.dim(`  \u{1F4E6} Cached dirs preserved: node_modules=${oe.existsSync(Se.join(c,"node_modules"))?"\u2705":"\u274C"}, Pods=${oe.existsSync(Se.join(c,"ios","Pods"))?"\u2705":"\u274C"}`)),t.stop()}catch(l){t.stop(`Failed to prepare isolated workspace: ${l.message}`),n&&await s(`Setup Error: ${l.message}`),process.exit(1)}}try{let l=e.repo;if(!l)try{l=Mn("git config --get remote.origin.url").toString().trim()}catch{v.warn("Could not detect git repository URL.")}!l&&e.dryRun,l||(l="https://github.com/placeholder/repo.git"),v.info(`Build ID: ${N.cyan(i)}`);let a={},d={},c=Te(`./${f.configFileName}`);if(c){n=c.projectId;let _=e.buildProfile||"production",S=Ge(c,_);!S&&e.buildProfile&&(v.error(`Build profile '${_}' not found in ${f.configFileName}`),process.exit(1));let O=S||{};process.env.MACH_DEBUG&&v.info(N.dim(`Build profile: ${_} | Platform: ${e.platform} | Distribution: ${O.distribution||"store"} | Environment: ${O.environment||_}`)),O.env&&(d=O.env,v.info(N.blue(`Use Build Profile: ${_}`)));let D=e.platform,T=O[D]||{},R=["developmentClient","simulator","distribution","buildCommand","apk","iosScheme","preBuild","postBuild","scheme","environment","androidPackage","iosBundleIdentifier","name","iosDeploymentTarget","iosApiKeyId","iosApiKeyIssuer","iosApiKeyPath","iosTeamId","iosConfiguration","iosExportMethod","branch","repo","instanceType","ami","bucket","region","nodeVersion"];e.name=c.name,e.appName=c.name,e.androidPackage=c.android?.package,e.iosBundleIdentifier=c.ios?.bundleIdentifier,e.iosScheme=c.ios?.iosScheme,!e.nodeVersion&&c.nodeVersion&&(e.nodeVersion=c.nodeVersion);let $=x=>x==="androidPackage"?T.androidPackage??T.package??O.androidPackage??O.android?.package:x==="iosBundleIdentifier"?T.iosBundleIdentifier??T.bundleIdentifier??O.iosBundleIdentifier??O.ios?.bundleIdentifier:T[x]!==void 0?T[x]:O[x];for(let x of R){let H=$(x),E=x==="androidPackage"||x==="iosBundleIdentifier";H!==void 0&&(e[x]===void 0||E)&&(e[x]=H)}if(e.platform==="ios"&&!(T.iosBundleIdentifier??T.bundleIdentifier??O.iosBundleIdentifier??O.ios?.bundleIdentifier)){let H=Ps(e,_);H&&H!==e.iosBundleIdentifier&&(v.warn(N.yellow(`Detected native iOS bundle identifier ${H}; using it for credential lookup. Set build.${_}.ios.bundleIdentifier to make this explicit.`)),e.iosBundleIdentifier=H)}e.branch=e.branch||"main",e.iosConfiguration=e.iosConfiguration||(e.developmentClient||e.simulator?"Debug":"Release"),e.sshUser=e.sshUser||process.env.USER||"ubuntu",e.simulator===void 0&&(e.simulator=!1),e.local===void 0&&(e.local=!1),e.verbose===void 0&&(e.verbose=!1);let U=x=>{if(!x)return x;if(x.startsWith("scripts.")){let H=x.split(".")[1],E=c.scripts?.[H];if(E)return E;v.warn(`Script reference not found: ${x}`)}return x};e.buildCommand=U(e.buildCommand),e.preBuild=U(e.preBuild),e.postBuild=U(e.postBuild),!e.scheme&&c.scheme&&(e.scheme=c.scheme);let G={...nt(c,f.envPrefix),...nt(O,`${f.envPrefix}PROFILE_`)};a={...a,...d,...G},process.env.IOS_P12_PASSWORD&&!a.IOS_P12_PASSWORD&&(a.IOS_P12_PASSWORD=process.env.IOS_P12_PASSWORD),process.env.MATCH_PASSWORD&&!a.MATCH_PASSWORD&&(a.MATCH_PASSWORD=process.env.MATCH_PASSWORD),e.platform==="ios"&&(!e.iosTeamId&&O.ios?.appleTeamId&&(e.iosTeamId=O.ios.appleTeamId),!e.iosTeamId&&c.submit?.[_]?.ios?.appleTeamId&&(e.iosTeamId=c.submit[_].ios.appleTeamId),!e.iosTeamId&&c.submit?.production?.ios?.appleTeamId&&(v.warn(N.yellow(`Check: Using 'production' Team ID for '${_}' build.`)),e.iosTeamId=c.submit.production.ios.appleTeamId),e.iosTeamId?v.info(N.magenta(`\u2713 Injected iOS Team ID from config: ${e.iosTeamId}`)):v.warn(N.yellow("\u26A0\uFE0F No iOS Team ID found. Signing might fail if not managed automatically via Expo.")))}let u="unknown";try{u=Mn("git rev-parse --abbrev-ref HEAD").toString().trim()}catch{v.warn("Failed to detect git branch.")}let p="1.0.0";try{oe.existsSync("./package.json")&&(p=JSON.parse(oe.readFileSync("./package.json","utf-8")).version||"1.0.0")}catch{}let m=e.buildProfile||"production",I="Internal";e.developmentClient?I="DevelopmentClient":m.toLowerCase().includes("store")||m.toLowerCase()==="production"?I="Store":m.toLowerCase().includes("preview")||m.toLowerCase().includes("staging")?I="Staging":(m.toLowerCase().includes("development")||m.toLowerCase().includes("dev"))&&(I="Development");let L=e.platform==="ios"?"iOS":"Android",w=e.platform==="ios"&&e.simulator?" (Simulator)":"",B=`${L}${w} v${p} (${I})`;if(zt(e,{status:"created",projectId:n,buildId:i,platform:e.platform,profile:m,branch:u,version:p,buildType:I,developmentClient:!!e.developmentClient,summary:B}),n){try{let _=e.buildProfile||"production",S=e.environment||_;v.info(N.blue(`Fetching managed secrets for profile: ${_} (environment: ${S})...`));let D=(await C.get(`/projects/${n}/secrets/export?env=${S}`)).data;D.status==="success"&&D.secrets&&(a={...a,...D.secrets},Object.keys(D.secrets).length>0&&v.info(N.magenta(`\u2713 Injected ${Object.keys(D.secrets).length} secrets from Dashboard.`)))}catch(_){v.warn(`Failed to load managed secrets from Dashboard: ${_.message}`)}try{v.info(N.blue("Fetching managed credentials..."));let _=Ds(e,m),S=e.platform==="ios"?e.iosBundleIdentifier:e.androidPackage,O=e.platform==="ios"?"bundle":"package";v.info(N.dim(`  Credential target: ${O} ${S||"not set"} (${_})`));let D=await C.get("/credentials/resolve",{params:{projectId:n,platform:e.platform,bundleId:S,distributionType:_}});if(D.data.status==="success"&&D.data.credentials){let T=D.data.credentials;v.info(N.magenta(`\u2713 Found ${T.length} relevant credentials.`));let R=T.filter(E=>e.platform==="ios"&&E.type==="ios_profile"?jn(E,_,e.platform)?Kn(E,S):!1:e.platform==="android"&&E.type==="android_keystore"?Kn(E,S):!!jn(E,_,e.platform)).sort((E,ne)=>Vn(ne,S)*10+Gn(ne,_,e.platform)-(Vn(E,S)*10+Gn(E,_,e.platform)));v.info(N.dim(`  Filtered to ${R.length} credentials for distributionType: ${_}`));let $=!1,U=!1,G=!1,x=[];for(let E of R)if(!(E.type==="ios_cert"&&$||E.type==="ios_profile"&&U||E.type==="android_keystore"&&G)&&["ios_cert","ios_profile","android_keystore"].includes(E.type)&&(E.downloadUrl||Et(E)))try{let z=await Jn(E,n);if(E.type==="ios_cert"&&!$)a.IOS_DIST_P12=z,E.password?(a.IOS_P12_PASSWORD=E.password,v.info(N.dim(`  - Injected ${E.name} as IOS_DIST_P12 with password from credential record`))):v.info(N.dim(`  - Injected ${E.name} as IOS_DIST_P12`)),$=!0;else if(E.type==="ios_profile"&&!U){if(!vs(z,S)){let he=Zn(z)||"unknown";throw new Error(`Provisioning profile ${E.name||Et(E)||"unknown"} is for a different bundle ID. Expected ${S}, found ${he}. Upload a ${_} profile for ${S}.`)}a.IOS_PROVISIONING_PROFILE=z,v.info(N.dim(`  - Injected ${E.name} as IOS_PROVISIONING_PROFILE`)),U=!0}else if(E.type==="android_keystore"&&!G){a.ANDROID_KEYSTORE_BASE64=z;let he=E.keystorePassword||E.password,ie=E.keyPassword||E.keystorePassword||E.password,F=E.alias||E.meta?.alias;if(he)a.ANDROID_STORE_PASSWORD=he,v.info(N.dim("  - Injected keystore password from credential record"));else{let A=["ANDROID_STORE_PASSWORD",...[_==="store"?"PRODUCTION":_==="internal"||_==="adhoc"?"STAGING":"DEVELOPMENT",_.toUpperCase(),"PRODUCTION","STORE","INTERNAL","STAGING","RELEASE","DEBUG"].map(V=>`KEYSTORE_PASSWORD_${V}`),"KEYSTORE_PASSWORD"].find(V=>!!a[V]);A&&a[A]&&(a.ANDROID_STORE_PASSWORD=a[A])}if(ie?(a.ANDROID_KEY_PASSWORD=ie,v.info(N.dim("  - Injected key password from credential record"))):a.ANDROID_KEY_PASSWORD=a.ANDROID_STORE_PASSWORD||"",F)a.ANDROID_KEY_ALIAS=F;else{let M=["ANDROID_KEY_ALIAS","KEYSTORE_ALIAS"].find(W=>!!a[W]);M&&(a.ANDROID_KEY_ALIAS=a[M])}v.info(N.dim(`  - Injected ${E.name} as ANDROID_KEYSTORE_BASE64`)),G=!0}}catch(z){x.push(`${E.name||E.type}: ${z.message}`)}let H=e.platform==="ios"?e.simulator||$&&U:G||!R.some(E=>E.type==="android_keystore");if(x.length>0&&!H)throw new Error(`Credential setup failed:
 ${x.map(E=>`- ${E}`).join(`
-`)}`);x.length>0&&v.warn(N.dim(`  Skipped ${x.length} stale or unusable credential(s).`))}if(e.platform==="ios"&&!e.simulator){let T=e.buildProfile||"production",R=Ge(c,T)||{},$=bs(c,R),U=Is($),G=e.distribution==="store",x=$===void 0&&G,H=e.autoVersion||U&&G||x,E=e.autoVersion||U&&G;if(U&&!G&&v.info(N.dim(`  Skipping App Store Connect buildNumber lookup for ${e.distribution||"non-store"} build. Pass --auto-version to force it.`)),H){let ne=e.iosBundleIdentifier||c.ios?.bundleIdentifier||c.expo?.ios?.bundleIdentifier,z=As(c,R,T),he=D.data.credentials||[],ie=Hn(he,ne);if(!ie&&(E||x)){let F=await C.get(`/credentials/${n}`);ie=Hn(F.data.credentials||[],ne)}if(ie){t.start("Resolving latest iOS buildNumber from App Store Connect...");try{let F=ie.keyId||ie.meta?.keyId,M=ie.issuerId||ie.meta?.issuerId;if(!F||!M)throw new Error("App Store Connect credential is missing keyId or issuerId.");let W=await Es(ie,n),A=await An({keyId:F,issuerId:M,privateKey:W,ascAppId:z,bundleId:ne}),V=/^\d+$/.test(A.latestBuildNumber);V?(a.BUILD_NUMBER=A.latestBuildNumber,delete a.MACH_IOS_BUILD_NUMBER_LOCKED):(a.BUILD_NUMBER=A.nextBuildNumber,a.CURRENT_PROJECT_VERSION=A.nextBuildNumber,a.MACH_IOS_BUILD_NUMBER_LOCKED="1"),t.stop(V?`\u2713 Latest iOS buildNumber on App Store Connect: ${N.green(A.latestBuildNumber)} (Mach will assign >= ${A.nextBuildNumber})`:`\u2713 Resolved iOS buildNumber: ${N.green(A.nextBuildNumber)} (Latest on App Store Connect: ${A.latestBuildNumber})`)}catch(F){t.stop("iOS buildNumber lookup failed");let M=F.response?.data?.error?.message||F.message;if(E)throw new Error(`Auto-versioning failed: ${M}. Fix App Store Connect API key permissions or remove ios.buildNumber="auto".`);v.warn(N.yellow(`Could not check App Store Connect buildNumber: ${M}. Falling back to Mach counter.`))}}else if(E)throw new Error(`Auto-versioning failed: App Store Connect API key not found. Upload it with '${f.nameLower} credentials:service --platform ios'.`)}}if(e.platform==="android"){let T=e.buildProfile||"production",R=Ge(c,T)||{},G=((R.android||{}).versionCode??R.androidVersionCode??c.android?.versionCode??c.expo?.android?.versionCode)==="auto",x=e.autoVersion||G&&e.distribution==="store";if(G&&!x&&v.info(N.dim(`  Skipping Google Play versionCode lookup for ${e.distribution||"non-store"} build. Pass --auto-version to force it.`)),x){t.start("Resolving latest versionCode from Google Play...");try{let H=e.androidPackage||c.android?.package||c.expo?.android?.package||c.name,E=(D.data.credentials||[]).find(M=>M.type==="google_service_account"&&(!M.bundleId||M.bundleId===H));if(!E){let W=((await C.get(`/credentials/${n}`)).data.credentials||[]).filter(A=>A.type==="google_service_account");if(E=W.find(A=>A.type==="google_service_account"&&A.bundleId===H),!E&&W.length>0){let A=W.map(V=>V.bundleId).filter(Boolean).join(", ");throw new Error(`Google Service Account not found for package ${H}. Found service credential(s) for: ${A}.`)}}if(!E)throw new Error(`Google Service Account not found for package ${H}. Upload it under this package in Dashboard or run '${f.nameLower} credentials:service --platform android --package-name ${H}'.`);let ne=await C.get(`/credentials/${E.credentialId}/download`,{params:{projectId:n}});if(ne.data.status!=="success"||!ne.data.downloadUrl)throw new Error("Failed to get secure download URL for service account");let he=(await St.get(ne.data.downloadUrl,{headers:{Connection:"close"}})).data,ie=await gn(H,he);if(ie==null)throw new Error("Could not retrieve any version information from Google Play.");let F=ie+1;a.ANDROID_VERSION_CODE=F.toString(),t.stop(`\u2713 Resolved versionCode: ${N.green(F)} (Latest on Play Store: ${ie})`)}catch(H){t.stop("Version resolution failed");let E=H.response?.data?.error?.message||H.message;throw new Error(`Auto-versioning failed: ${E}. Fix Google Play service account permissions or remove android.versionCode="auto".`)}}}if(e.platform==="ios"&&!e.simulator){let T=!!a.IOS_DIST_P12,R=!!a.IOS_PROVISIONING_PROFILE;if(!T||!R){let $=[...T?[]:["Distribution Certificate"],...R?[]:["Provisioning Profile"]].join(" and ");if(e.local&&e.buildId)throw new Error(`Missing iOS credentials: ${$}. Expected ${_} credentials for ${S||"the selected bundle ID"}. Run \`${f.nameLower} credentials --platform ios --profile ${m}\` and select ${S||"the correct bundle ID"}.`);v.error(N.red(`Missing iOS credentials: ${$}`)),e.quiet&&process.exit(1);let U=e.yes||await Ln({message:"Would you like to generate these credentials now?",initialValue:!0});if(U&&!Un(U))return await mt({platform:"ios",profile:m}),e.quiet||v.info(N.green("\u2713 Credentials setup complete! Restarting build phase...")),Vt(e);e.quiet||v.info(N.yellow(`Run \`${f.nameLower} credentials\` to set up signing credentials manually.`)),process.exit(1)}}if(e.platform==="android"&&!e.developmentClient&&(e.distribution==="internal"||e.distribution==="store")&&!(!!a.ANDROID_KEYSTORE_BASE64||!!a.ANDROID_KEYSTORE)){v.error(N.red("Missing Android credentials: Signing Keystore")),e.quiet&&process.exit(1);let R=e.yes||await Ln({message:"Would you like to automatically create and upload an Android Keystore for this profile now?",initialValue:!0});if(R&&!Un(R))return await mt({platform:"android",profile:m}),e.quiet||v.info(N.green("\u2713 Android Keystore setup complete! Restarting build phase...")),Vt(e);e.quiet||v.info(N.yellow(`Run \`${f.nameLower} credentials --platform android\` to set up a signing keystore manually.`)),process.exit(1)}}catch(_){(String(_.message||"").startsWith("Credential download failed")||String(_.message||"").startsWith("Credential setup failed")||String(_.message||"").startsWith("Missing iOS credentials")||String(_.message||"").startsWith("Auto-versioning failed"))&&(v.error(N.red(_.message)),process.exit(1)),e.platform==="ios"&&e.local&&e.buildId&&(v.error(N.red(`Failed to resolve iOS credentials: ${_.message}`)),process.exit(1)),v.warn(`Failed to resolve credentials: ${_.message}`)}}let k=!!(e.local&&e.buildId),j=!!(e.local||e.sshHost),h=!j&&!k;if(k){v.info(N.magenta("\u{1F3D7}\uFE0F Runner Mode: Executing isolated build task..."));let _=await Si({...e,interactive:!1},i,a,n,{branch:u,version:p,summary:B,buildType:I});await K(_),process.exit(0)}async function K(_){let S=async O=>{if(n)try{await jt("Report failed build status",()=>C.patch(`/builds/${n}/${i}`,{status:"failed",error:O,endTime:Date.now()}),3)}catch(D){v.warn(N.yellow(`Could not report failed build status: ${D.message}`))}};if(n&&_.length>0){let O=Ii(),D=[];e.quiet||O.start("Uploading artifacts to Dashboard...");try{for(let T of _){let R=Se.basename(T),$=oe.readFileSync(T),U=Se.extname(R).toLowerCase(),G="application/octet-stream",x=await jt(`Create artifact upload URL for ${R}`,()=>C.post(`/builds/${n}/${i}/artifact-upload-url`,{fileName:R,fileType:G}));if(x.data.status!=="success")throw new Error(`Failed to get upload URL for ${R}`);await jt(`Upload artifact ${R}`,()=>St.put(x.data.uploadUrl,$,{headers:{"Content-Type":G,Connection:"close"},maxBodyLength:1/0,maxContentLength:1/0,timeout:3e5})),D.push({name:R,url:x.data.downloadUrl,size:$.length,type:U.substring(1)})}e.quiet||O.stop("Artifacts uploaded.")}catch(T){e.quiet||O.stop("Failed to upload artifacts.");let R=`Artifact upload failed: ${T.message}`;throw v.error(N.red(R)),await S(R),new Error(R)}if(n&&D.length>0)try{v.info(N.cyan(`
+`)}`);x.length>0&&v.warn(N.dim(`  Skipped ${x.length} stale or unusable credential(s).`))}if(e.platform==="ios"&&!e.simulator){let T=e.buildProfile||"production",R=Ge(c,T)||{},$=bs(c,R),U=Is($),G=e.distribution==="store",x=$===void 0&&G,H=e.autoVersion||U&&G||x,E=e.autoVersion||U&&G;if(U&&!G&&v.info(N.dim(`  Skipping App Store Connect buildNumber lookup for ${e.distribution||"non-store"} build. Pass --auto-version to force it.`)),H){let ne=e.iosBundleIdentifier||c.ios?.bundleIdentifier||c.expo?.ios?.bundleIdentifier,z=As(c,R,T),he=D.data.credentials||[],ie=Hn(he,ne);if(!ie&&(E||x)){let F=await C.get(`/credentials/${n}`);ie=Hn(F.data.credentials||[],ne)}if(ie){t.start("Resolving latest iOS buildNumber from App Store Connect...");try{let F=ie.keyId||ie.meta?.keyId,M=ie.issuerId||ie.meta?.issuerId;if(!F||!M)throw new Error("App Store Connect credential is missing keyId or issuerId.");let W=await Es(ie,n),A=await An({keyId:F,issuerId:M,privateKey:W,ascAppId:z,bundleId:ne}),V=/^\d+$/.test(A.latestBuildNumber);V?(a.BUILD_NUMBER=A.latestBuildNumber,delete a.MACH_IOS_BUILD_NUMBER_LOCKED):(a.BUILD_NUMBER=A.nextBuildNumber,a.CURRENT_PROJECT_VERSION=A.nextBuildNumber,a.MACH_IOS_BUILD_NUMBER_LOCKED="1"),t.stop(V?`\u2713 Latest iOS buildNumber on App Store Connect: ${N.green(A.latestBuildNumber)} (Mach will assign >= ${A.nextBuildNumber})`:`\u2713 Resolved iOS buildNumber: ${N.green(A.nextBuildNumber)} (Latest on App Store Connect: ${A.latestBuildNumber})`)}catch(F){t.stop("iOS buildNumber lookup failed");let M=F.response?.data?.error?.message||F.message;if(E)throw new Error(`Auto-versioning failed: ${M}. Fix App Store Connect API key permissions or remove ios.buildNumber="auto".`);v.warn(N.yellow(`Could not check App Store Connect buildNumber: ${M}. Falling back to Mach counter.`))}}else if(E)throw new Error(`Auto-versioning failed: App Store Connect API key not found. Upload it with '${f.nameLower} credentials:service --platform ios'.`)}}if(e.platform==="android"){let T=e.buildProfile||"production",R=Ge(c,T)||{},G=((R.android||{}).versionCode??R.androidVersionCode??c.android?.versionCode??c.expo?.android?.versionCode)==="auto",x=e.autoVersion||G&&e.distribution==="store";if(G&&!x&&v.info(N.dim(`  Skipping Google Play versionCode lookup for ${e.distribution||"non-store"} build. Pass --auto-version to force it.`)),x){t.start("Resolving latest versionCode from Google Play...");try{let H=e.androidPackage||c.android?.package||c.expo?.android?.package||c.name,E=(D.data.credentials||[]).find(M=>M.type==="google_service_account"&&(!M.bundleId||M.bundleId===H));if(!E){let W=((await C.get(`/credentials/${n}`)).data.credentials||[]).filter(A=>A.type==="google_service_account");if(E=W.find(A=>A.type==="google_service_account"&&A.bundleId===H),!E&&W.length>0){let A=W.map(V=>V.bundleId).filter(Boolean).join(", ");throw new Error(`Google Service Account not found for package ${H}. Found service credential(s) for: ${A}.`)}}if(!E)throw new Error(`Google Service Account not found for package ${H}. Upload it under this package in Dashboard or run '${f.nameLower} credentials:service --platform android --package-name ${H}'.`);let ne=await C.get(`/credentials/${E.credentialId}/download`,{params:{projectId:n,format:"raw"}});if(ne.data.status!=="success"||!ne.data.downloadUrl)throw new Error("Failed to get secure download URL for service account");let he=(await St.get(ne.data.downloadUrl,{headers:{Connection:"close"}})).data,ie=await gn(H,he);if(ie==null)throw new Error("Could not retrieve any version information from Google Play.");let F=ie+1;a.ANDROID_VERSION_CODE=F.toString(),t.stop(`\u2713 Resolved versionCode: ${N.green(F)} (Latest on Play Store: ${ie})`)}catch(H){t.stop("Version resolution failed");let E=H.response?.data?.error?.message||H.message;throw new Error(`Auto-versioning failed: ${E}. Fix Google Play service account permissions or remove android.versionCode="auto".`)}}}if(e.platform==="ios"&&!e.simulator){let T=!!a.IOS_DIST_P12,R=!!a.IOS_PROVISIONING_PROFILE;if(!T||!R){let $=[...T?[]:["Distribution Certificate"],...R?[]:["Provisioning Profile"]].join(" and ");if(e.local&&e.buildId)throw new Error(`Missing iOS credentials: ${$}. Expected ${_} credentials for ${S||"the selected bundle ID"}. Run \`${f.nameLower} credentials --platform ios --profile ${m}\` and select ${S||"the correct bundle ID"}.`);v.error(N.red(`Missing iOS credentials: ${$}`)),e.quiet&&process.exit(1);let U=e.yes||await Ln({message:"Would you like to generate these credentials now?",initialValue:!0});if(U&&!Un(U))return await mt({platform:"ios",profile:m}),e.quiet||v.info(N.green("\u2713 Credentials setup complete! Restarting build phase...")),Vt(e);e.quiet||v.info(N.yellow(`Run \`${f.nameLower} credentials\` to set up signing credentials manually.`)),process.exit(1)}}if(e.platform==="android"&&!e.developmentClient&&(e.distribution==="internal"||e.distribution==="store")&&!(!!a.ANDROID_KEYSTORE_BASE64||!!a.ANDROID_KEYSTORE)){v.error(N.red("Missing Android credentials: Signing Keystore")),e.quiet&&process.exit(1);let R=e.yes||await Ln({message:"Would you like to automatically create and upload an Android Keystore for this profile now?",initialValue:!0});if(R&&!Un(R))return await mt({platform:"android",profile:m}),e.quiet||v.info(N.green("\u2713 Android Keystore setup complete! Restarting build phase...")),Vt(e);e.quiet||v.info(N.yellow(`Run \`${f.nameLower} credentials --platform android\` to set up a signing keystore manually.`)),process.exit(1)}}catch(_){(String(_.message||"").startsWith("Credential download failed")||String(_.message||"").startsWith("Credential setup failed")||String(_.message||"").startsWith("Missing iOS credentials")||String(_.message||"").startsWith("Auto-versioning failed"))&&(v.error(N.red(_.message)),process.exit(1)),e.platform==="ios"&&e.local&&e.buildId&&(v.error(N.red(`Failed to resolve iOS credentials: ${_.message}`)),process.exit(1)),v.warn(`Failed to resolve credentials: ${_.message}`)}}let k=!!(e.local&&e.buildId),j=!!(e.local||e.sshHost),h=!j&&!k;if(k){v.info(N.magenta("\u{1F3D7}\uFE0F Runner Mode: Executing isolated build task..."));let _=await Si({...e,interactive:!1},i,a,n,{branch:u,version:p,summary:B,buildType:I});await K(_),process.exit(0)}async function K(_){let S=async O=>{if(n)try{await jt("Report failed build status",()=>C.patch(`/builds/${n}/${i}`,{status:"failed",error:O,endTime:Date.now()}),3)}catch(D){v.warn(N.yellow(`Could not report failed build status: ${D.message}`))}};if(n&&_.length>0){let O=Ii(),D=[];e.quiet||O.start("Uploading artifacts to Dashboard...");try{for(let T of _){let R=Se.basename(T),$=oe.readFileSync(T),U=Se.extname(R).toLowerCase(),G="application/octet-stream",x=await jt(`Create artifact upload URL for ${R}`,()=>C.post(`/builds/${n}/${i}/artifact-upload-url`,{fileName:R,fileType:G}));if(x.data.status!=="success")throw new Error(`Failed to get upload URL for ${R}`);await jt(`Upload artifact ${R}`,()=>St.put(x.data.uploadUrl,$,{headers:{"Content-Type":G,Connection:"close"},maxBodyLength:1/0,maxContentLength:1/0,timeout:3e5})),D.push({name:R,url:x.data.downloadUrl,size:$.length,type:U.substring(1)})}e.quiet||O.stop("Artifacts uploaded.")}catch(T){e.quiet||O.stop("Failed to upload artifacts.");let R=`Artifact upload failed: ${T.message}`;throw v.error(N.red(R)),await S(R),new Error(R)}if(n&&D.length>0)try{v.info(N.cyan(`
 \u{1F517} Download Links:`));for(let T of D)v.info(N.dim(`  - ${T.name}: `)+N.blue.underline(T.url));await jt("Finalize build in dashboard",()=>C.patch(`/builds/${n}/${i}`,{status:"success",artifacts:D,endTime:Date.now()})),zt(e,{status:"success",projectId:n,buildId:i,platform:e.platform,profile:m,branch:u,version:p,buildType:I,developmentClient:!!e.developmentClient,summary:B,artifacts:D}),v.success(N.green(`
 \u2713 Build completed and reported to dashboard.`)),e.maestro&&!k&&await zn(n,i,e,m)}catch(T){let R=`Build artifact uploaded but dashboard finalization failed: ${T.message}`;throw v.error(N.red(`
 ${R}`)),await S(R),new Error(R)}}else if(n){let O="Build completed but produced no uploadable artifacts.";throw v.error(N.red(O)),await S(O),new Error(O)}}if(j){if(v.info(N.cyan(`\u{1F680} Direct Build Mode: Executing on ${e.sshHost||"local"}...`)),n&&!o){let _=process.argv.slice(3).join(" ");await C.post("/builds",{projectId:n,buildId:i,platform:e.platform,status:"building",branch:u,version:p,summary:B,startTime:r,buildType:I,buildProfile:m,buildArgs:_,simulator:!!e.simulator,developmentClient:!!e.developmentClient})}if(e.sshHost&&e.platform==="ios"){let _=await fn(e,i,a,n)}else{let _=await Si({...e,interactive:!!e.local},i,a,n,{branch:u,version:p,summary:B,buildType:I});await K(_)}return}if(h&&(v.info(N.blue("\u{1F6F0}\uFE0F Cloud Initiator Mode: Preparing orchestration...")),!e.dryRun)){e.quiet||t.start("Zipping and uploading local source...");let _=await C.post("/builds/source-upload-url",{projectId:n,buildId:i});if(_.data.status!=="success")throw t.stop("Failed to get upload URL."),new Error("Failed to get source upload URL from API");let S=new Bn,O=oe.readdirSync("."),D=["node_modules",".git","dist","build","builds",".gradle",".idea","android/build","ios/build","ios/Pods",`.${f.nameLower}_cli`];for(let $ of O){if(D.includes($))continue;oe.statSync($).isDirectory()?S.addLocalFolder($,$):S.addLocalFile($)}let T=S.toBuffer();e.quiet||t.message(`Uploading source (${(T.length/1024/1024).toFixed(1)} MB)...`);let R=!1;for(let $=1;$<=3;$++)try{await St.put(_.data.uploadUrl,T,{headers:{"Content-Type":"application/zip"},maxBodyLength:1/0,maxContentLength:1/0,timeout:12e4}),R=!0;break}catch(U){if($<3)t.message(`Upload attempt ${$} failed (${U.code||U.message}), retrying...`),await new Promise(G=>setTimeout(G,2e3*$));else throw U}if(e.quiet||t.stop("Source uploaded"),n){let $=process.argv.slice(3).join(" ");await C.post("/builds",{projectId:n,buildId:i,platform:e.platform,status:"pending",branch:u,version:p,summary:B,startTime:r,buildType:I,buildProfile:m,buildArgs:$,simulator:!!e.simulator,developmentClient:!!e.developmentClient}),v.info(N.green("\u2713 Cloud build registered."))}e.platform==="android"&&await cn(e,i,a,n,e.preBuild),e.quiet||v.info(N.cyan("\u{1F4E1} Connecting to build stream...")),await Os(n,i,e),e.maestro&&await zn(n,i,e,m);return}}catch(l){let a=l.message||"Build failed";l.response?.data?.message?a=l.response.data.message:l.message.includes("status code 402")?a="Insufficient wallet balance. Please add credits in the Dashboard.":l.message.includes("status code 403")&&(a="Monthly build quota exceeded. Upgrade your plan in the Dashboard."),n&&!e.local&&await s(a),v.error(N.red(`\u2717 Build failed: ${a}`)),process.exit(1)}};async function zn(e,t,i,n){v.info(N.cyan(`
@@ -1106,11 +1112,11 @@ ${R}`)),await S(R),new Error(R)}}else if(n){let O="Build completed but produced
 `);if(u.length>o){for(let p=o;p<u.length;p++)u[p].trim()&&console.log(N.dim(`  ${u[p]}`));o=u.length}}}catch{}s=0}catch{s++,s>10&&(n.stop("Connection lost."),v.error(N.red(`
 \u2717 Lost connection to Dashboard API.`)),process.exit(1))}await new Promise(l=>setTimeout(l,3e3))}}import Cs from"http";import{execSync as De,spawn as Qn}from"child_process";import _i from"chalk";import{log as at}from"@clack/prompts";import Ns from"axios";import $i from"fs";import Ts from"os";import Pi from"path";var bt=7070;function ks(){let e=[];try{let t=De("adb devices -l",{stdio:"pipe"}).toString(),i=new Set;t.split(`
 `).forEach(n=>{if(n.includes("List of devices")||!n.trim())return;let r=n.split(/\s+/);if(r.length<2||r[1]!=="device")return;let o=r[0];i.add(o);let s=n.match(/model:([^\s]+)/);e.push({id:o,platform:"android",type:o.startsWith("emulator-")?"emulator":"physical",name:s?s[1].replace(/_/g," "):o,status:"online",details:n.trim()})})}catch{}try{let t=`${process.env.ANDROID_HOME||`${process.env.HOME}/Library/Android/sdk`}/emulator/emulator`,n=De(`${t} -list-avds`,{stdio:"pipe"}).toString().split(`
-`).filter(o=>!!o.trim()),r=e.some(o=>o.platform==="android"&&o.id.startsWith("emulator-"));n.forEach(o=>{r||e.push({id:o,platform:"android",type:"emulator",name:o.replace(/_/g," "),status:"offline",details:`Android Virtual Device: ${o}`})})}catch{}if(process.platform!=="darwin")return e;try{let t=De("/usr/bin/xcrun simctl list devices --json",{stdio:"pipe"}).toString(),i=JSON.parse(t);Object.entries(i.devices).forEach(([n,r])=>{r.forEach(o=>{o.isAvailable&&e.push({id:o.udid,platform:"ios",type:"simulator",name:o.name,status:o.state?.toLowerCase()==="booted"?"online":"offline",runtime:n,details:`${o.name} (${n})`})})})}catch{}try{let t=De("/usr/bin/xcrun devicectl list devices --json-output -",{stdio:"pipe"}).toString();(JSON.parse(t).result?.devices||[]).forEach(n=>{let r=n.connectionProperties?.transportType;(r==="wired"||r==="localNetwork")&&e.push({id:n.identifier,platform:"ios",type:"physical",name:n.deviceProperties?.name||"iPhone",status:"online",details:`${n.deviceProperties?.name||"iPhone"} (${n.model?.name||n.hardwareModel||""}) - ${r}`})})}catch{}return e}async function er(e){let t=[];for await(let i of e)t.push(Buffer.isBuffer(i)?i:Buffer.from(i));return t.length===0?{}:JSON.parse(Buffer.concat(t).toString("utf-8"))}async function xs(e,t){let i=await Ns({method:"GET",url:e,responseType:"stream",timeout:12e4}),n=$i.createWriteStream(t);i.data.pipe(n),await new Promise((r,o)=>{n.on("finish",r),n.on("error",o)})}async function Ls(e,t,i){let n=i||(t.toLowerCase().includes(".apk")?"android":"ios"),r=t.toLowerCase().includes(".ipa"),o=$i.mkdtempSync(Pi.join(Ts.tmpdir(),`${bt}-install-`)),s=Pi.join(o,n==="android"?"install.apk":r?"install.ipa":"install.zip");try{if(await xs(t,s),n==="android"){De(`adb -s ${JSON.stringify(e)} install -r ${JSON.stringify(s)}`,{stdio:"pipe"});return}if(process.platform!=="darwin")throw new Error("iOS local install requires macOS.");De(`unzip -o ${JSON.stringify(s)} -d ${JSON.stringify(o)}`,{stdio:"pipe"});let l="";try{l=De(`find ${JSON.stringify(Pi.join(o,"Payload"))} -maxdepth 1 -name "*.app" 2>/dev/null | head -n 1`,{stdio:"pipe"}).toString().trim()}catch{}if(l||(l=De(`find ${JSON.stringify(o)} -name "*.app" -type d | head -n 1`,{stdio:"pipe"}).toString().trim()),!l)throw new Error(`No .app bundle found inside the ${r?"IPA":"archive"}.`);try{De(`/usr/bin/xcrun devicectl device install app --device ${JSON.stringify(e)} ${JSON.stringify(l)}`,{stdio:"pipe"})}catch(a){try{De(`/usr/bin/xcrun simctl install ${JSON.stringify(e)} ${JSON.stringify(l)}`,{stdio:"pipe"})}catch{throw new Error(a.stderr?.toString().trim()||a.message||"iOS install failed.")}}}finally{$i.rmSync(o,{recursive:!0,force:!0})}}function Us(e,t){if(!e)throw new Error("Device id is required.");if(t==="ios"){if(process.platform!=="darwin")throw new Error("iOS Simulator launch requires macOS.");return De(`/usr/bin/xcrun simctl boot ${JSON.stringify(e)}`,{stdio:"pipe"}),Qn("open",["-a","Simulator"],{detached:!0,stdio:"ignore"}).unref(),"Simulator booting..."}if(t==="android"){let i=`${process.env.ANDROID_HOME||`${process.env.HOME}/Library/Android/sdk`}/emulator/emulator`;return Qn(i,["-avd",e],{detached:!0,stdio:"ignore"}).unref(),"Emulator booting in background..."}throw new Error("Invalid platform.")}async function tr(){process.platform!=="darwin"&&at.warn("Running on non-macOS \u2014 iOS discovery unavailable, Android only.");let e=Cs.createServer((n,r)=>{if(r.setHeader("Access-Control-Allow-Origin","*"),r.setHeader("Access-Control-Allow-Methods","GET, POST, OPTIONS"),r.setHeader("Access-Control-Allow-Headers","Content-Type, Authorization"),n.method==="OPTIONS"){r.writeHead(204),r.end();return}let o=new URL(n.url||"/",`http://localhost:${bt}`);if(n.method==="GET"&&o.pathname==="/local/devices"){try{let s=ks();r.writeHead(200,{"Content-Type":"application/json"}),r.end(JSON.stringify({status:"success",targets:s}))}catch(s){r.writeHead(500,{"Content-Type":"application/json"}),r.end(JSON.stringify({status:"error",message:s.message}))}return}if(n.method==="POST"&&o.pathname==="/install-local"){t(n,r);return}if(n.method==="POST"&&o.pathname==="/local/boot"){i(n,r);return}r.writeHead(404),r.end()}),t=async(n,r)=>{try{let{deviceId:o,artifactUrl:s,platform:l}=await er(n);if(!o||!s){r.writeHead(400,{"Content-Type":"application/json"}),r.end(JSON.stringify({status:"error",message:"deviceId and artifactUrl are required"}));return}await Ls(o,s,l),r.writeHead(200,{"Content-Type":"application/json"}),r.end(JSON.stringify({status:"success",message:`Installed on ${o}`}))}catch(o){r.writeHead(500,{"Content-Type":"application/json"}),r.end(JSON.stringify({status:"error",message:o.message||"Local install failed"}))}},i=async(n,r)=>{try{let{id:o,platform:s}=await er(n),l=Us(o,s);r.writeHead(200,{"Content-Type":"application/json"}),r.end(JSON.stringify({status:"success",message:l}))}catch(o){r.writeHead(500,{"Content-Type":"application/json"}),r.end(JSON.stringify({status:"error",message:o.message||"Local device launch failed"}))}};e.listen(bt,"127.0.0.1",()=>{at.success(_i.green(`Local device agent running on http://localhost:${bt}`)),at.info(_i.dim("Keep this running while using the Install Hub on the dashboard.")),at.info(_i.dim("Press Ctrl+C to stop."))}),e.on("error",n=>{n.code==="EADDRINUSE"?at.error(`Port ${bt} is already in use \u2014 agent may already be running.`):at.error(`Agent error: ${n.message}`),process.exit(1)}),await new Promise(()=>{})}import{createRequire as ql}from"module";import{text as Bs,password as Fs,spinner as Hs,isCancel as rr}from"@clack/prompts";import vi from"chalk";import At from"fs";import ir from"path";import Ms from"os";var wi=ir.join(Ms.homedir(),f.configDir),Di=ir.join(wi,"config.json");function Ri(){if(!At.existsSync(Di))return{};try{return JSON.parse(At.readFileSync(Di,"utf-8"))}catch{return{}}}function nr(e){At.existsSync(wi)||At.mkdirSync(wi,{recursive:!0});let i={...Ri(),...e};At.writeFileSync(Di,JSON.stringify(i,null,2))}async function or(){let e=Ri(),t=await Bs({message:"Enter your email:",placeholder:"user@example.com",initialValue:e.lastLoginEmail,validate(r){if(r.length===0)return"Email is required!"}});if(rr(t))return;let i=await Fs({message:"Enter your password:",validate(r){if(r.length===0)return"Password is required!"}});if(rr(i))return;let n=Hs();n.start("Authenticating...");try{let o=await(await fetch(`${Lt}/login`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({username:t,password:i})})).json();o.status==="success"&&o.user.token?(zi({id:o.user.id,email:t,token:o.user.token,refreshToken:o.user.refreshToken}),nr({lastLoginEmail:t}),n.stop(vi.green("Login successful!"))):n.stop(vi.red("Login failed: "+(o.message||"Unknown error")))}catch(r){n.stop(vi.red("Network error: "+r.message))}}import{outro as js,select as Gs,spinner as Ks,isCancel as Vs}from"@clack/prompts";import Wt from"chalk";import Oi from"fs";import zs from"path";var sr=e=>e==="1234567890"||e==="ABC123DEFG"||e==="XXXXXXXXXX"?"":typeof e=="string"?e:"",Ws=()=>process.versions.node.split(".")[0]||"24";async function ar(){if(!ye()){console.log(Wt.red(`You are not logged in. Run \`${f.nameLower} login\` first.`));return}let t=Ks();t.start("Fetching projects...");try{let{data:i}=await C.get("/projects");if(t.stop("Projects loaded."),i.status!=="success"||!i.projects||i.projects.length===0){console.log(Wt.yellow(`No projects found. Run \`${f.nameLower} init\` to create one.`));return}let n=i.projects.map(I=>({value:I.projectId,label:`${I.name} (${I.slug})`})),r=await Gs({message:"Select a project to link:",options:n});if(Vs(r))return;let o=zs.join(process.cwd(),f.configFileName),s={};if(Oi.existsSync(o))try{s=JSON.parse(Oi.readFileSync(o,"utf-8"))}catch{}let l=i.projects.find(I=>I.projectId===r),a=s.android?.package||Be("android"),d=s.ios?.bundleIdentifier||Be("ios"),c=s.android||{},u=s.submit?.production?.android||{},p=s.submit?.production?.ios||{},m={projectId:r,name:l?.name,slug:l?.slug,nodeVersion:s.nodeVersion||Ws(),scheme:l?.slug?.toLowerCase()||"app",android:{...c,package:a||"",versionCode:c.versionCode||"auto"},ios:{bundleIdentifier:d||"",buildNumber:s.ios?.buildNumber||"auto"},build:{development:{environment:"development",distribution:"development"},staging:{environment:"staging",distribution:"internal"},production:{environment:"production",distribution:"store"}},submit:{production:{android:{...u,track:u.track||"internal",releaseStatus:u.releaseStatus||"completed"},ios:{ascAppId:sr(p.ascAppId),appleTeamId:sr(p.appleTeamId)}}}};Oi.writeFileSync(o,JSON.stringify(m,null,2)),js(Wt.green(`Linked to project ${m.name} (${m.slug})`))}catch(i){t.stop(Wt.red("Error fetching projects: "+i.message))}}import{outro as Ys,text as Yt,select as Js,spinner as qs,isCancel as It}from"@clack/prompts";import _t from"chalk";import Xs from"fs";import Zs from"path";import{randomUUID as Qs}from"crypto";var ea=()=>process.versions.node.split(".")[0]||"24";async function lr(){if(!ye()){console.log(_t.red(`You are not logged in. Run \`${f.nameLower} login\` first.`));return}let t=await Yt({message:"Project Name:",placeholder:"My Awesome App",validate(l){if(l.length===0)return"Name is required!"}});if(It(t))return;let i=await Yt({message:"Project Slug (URL friendly):",placeholder:"my-awesome-app",validate(l){if(l.length===0)return"Slug is required!";if(!/^[a-z0-9-]+$/.test(l))return"Slug must be lowercase alphanumeric with dashes."}});if(It(i))return;let n=await Js({message:"Platform:",options:[{value:"android",label:"Android"},{value:"ios",label:"iOS"},{value:"web",label:"Web"},{value:"all",label:"All Platforms"}]});if(It(n))return;let r="";if(n==="android"||n==="all"){let l=Be("android");if(r=await Yt({message:"Android Package Name:",initialValue:l||"",placeholder:"com.example.app",validate(a){if(a.length===0)return"Package name is required for Android!"}}),It(r))return}let o="";if(n==="ios"||n==="all"){let l=Be("ios");if(o=await Yt({message:"iOS Bundle Identifier:",initialValue:l||"",placeholder:"com.example.app",validate(a){if(a.length===0)return"Bundle ID is required for iOS!"}}),It(o))return}let s=qs();s.start("Creating project...");try{let l=Qs(),d={projectId:l,name:t,slug:i,storageType:"managed",platforms:n==="all"?["android","ios","web"]:[n]},{data:c}=await C.post("/projects",d);if(c.status==="success"){s.stop(_t.green("Project created successfully!"));let u=Zs.join(process.cwd(),f.configFileName);Xs.writeFileSync(u,JSON.stringify({projectId:l,name:t,slug:i,nodeVersion:ea(),...r?{android:{package:r,versionCode:"auto"}}:{},...o?{ios:{bundleIdentifier:o,buildNumber:"auto"}}:{},build:{development:{environment:"development",distribution:"development"},staging:{environment:"staging",distribution:"internal"},production:{environment:"production",distribution:"store"}},submit:{production:{android:{track:"internal",releaseStatus:"completed"},ios:{ascAppId:"",appleTeamId:""}}}},null,2)),Ys(_t.green(`Initialized project ${t} and linked locally!`))}else s.stop(_t.red("creation failed: "+c.message))}catch(l){s.stop(_t.red("Network error: "+l.message))}}import{spinner as cr,log as Ae}from"@clack/prompts";import Jt from"chalk";import dr from"fs";import ta from"path";function ur(e,t,i,n){let r=e?.response?.status,o=e?.response?.data?.message||e?.response?.data?.error,s=n?` ${n}`:"";return r===401?`Not logged in or token expired while trying to ${i}${s}. Run \`${f.nameLower} login\` and try again.`:r===403?[`Permission denied while trying to ${i}${s}.`,o?`API says: ${o}.`:void 0,`Current Mach account/token does not have access to project ${t}.`,`Run \`${f.nameLower} login\` with the correct account, or ask a project owner to grant access.`].filter(Boolean).join(" "):r===404?[`Project or environment endpoint was not found while trying to ${i}${s}.`,`Project ID: ${t}.`,o?`API says: ${o}.`:void 0].filter(Boolean).join(" "):r?`Failed to ${i}${s}: ${o||`API returned HTTP ${r}`}`:`Network error while trying to ${i}${s}: ${e?.message||"Unknown error"}`}async function pr(e,t){let i=ye();if(!i){Ae.error(`You are not logged in. Run \`${f.nameLower} login\` first.`);return}let n=ta.join(process.cwd(),f.configFileName);if(!dr.existsSync(n)){Ae.error(`No ${f.configFileName} found. Run \`${f.nameLower} init\` or \`${f.nameLower} link\` first.`);return}let r;try{r=JSON.parse(dr.readFileSync(n,"utf-8"))}catch{Ae.error(`Failed to parse ${f.configFileName}`);return}let{projectId:o}=r;if(!o){Ae.error(`${f.configFileName} is missing projectId.`);return}e==="set"?await ia(o,t,i):e==="list"?await na(o,i):Ae.error(`Unknown env action: ${e}. Use 'set' or 'list'.`)}async function ia(e,t,i){if(t.length===0){Ae.error(`Usage: ${f.nameLower} env set KEY=VALUE [KEY2=VALUE2 ...]`);return}let n=cr();n.start("Setting environment variables...");let r=0,o=0;for(let s of t){let[l,...a]=s.split("="),d=a.join("=");if(!l||d===void 0){Ae.warn(`Invalid format for argument: ${s}. Expected KEY=VALUE.`),o++;continue}try{let c={key:l.trim(),value:d,type:"env",environment:"global",visibility:"secret"},{data:u}=await C.post(`/projects/${e}/secrets`,c);u.status==="success"?r++:(Ae.error(`Failed to set ${l}: ${u.message}`),o++)}catch(c){Ae.error(ur(c,e,"set",l)),o++}}n.stop(`Set ${r} variable(s). ${o>0?`${o} failed.`:""}`)}async function na(e,t){let i=cr();i.start("Fetching environment variables...");try{let{data:n}=await C.get(`/projects/${e}/secrets`);if(n.status==="success"){i.stop("Fetched variables.");let r=n.secrets||[];r.length===0?Ae.info("No environment variables found for this project."):(Ae.info(Jt.bold("Environment Variables (Global & Scoped):")),r.forEach(o=>{let s=o.visibility==="plain"?o.value:"********";console.log(`  ${Jt.cyan(o.key)} = ${s}  ${Jt.gray(`[${o.environment}]`)}`)}))}else i.stop(Jt.red(`Failed to fetch variables: ${n.message}`))}catch(n){i.stop("Failed to fetch variables."),Ae.error(ur(n,e,"list"))}}import{spinner as ze,text as Pt,select as ki,isCancel as Ve,cancel as xi,log as mr}from"@clack/prompts";import te from"chalk";import q from"fs";import pe from"path";import{spawn as ra,spawnSync as Qe}from"child_process";import gr from"axios";import tt from"os";import Mi from"crypto";var oa=5e3,sa=12,aa={completed:"completed",draft:"draft",halted:"halted",inprogress:"inProgress","in-progress":"inProgress"},la=e=>e?.type==="google_service_account",qt=e=>e?.bundleId||e?.packageName||e?.meta?.packageName||e?.meta?.bundleId;async function hr(e){let t=ze(),i=ye(),n=da(e);if(!n){process.exitCode=1;return}let r=e.projectId||n.projectId,o=e.profile||e.buildProfile||"production";if(!r){Z(`${f.configFileName} is missing projectId. Pass --project-id in runner mode.`),process.exitCode=1;return}n.projectId=r,se(te.dim(`Submit for project: ${n.name||r} | Profile: ${o}`));let s=e.platform;if(!s){let $=await ki({message:"Select platform to submit:",options:[{value:"ios",label:"iOS (App Store Connect / TestFlight)"},{value:"android",label:"Android (Google Play Console)"}]});if(Ve($)){xi("Operation cancelled");return}s=$}if(s=String(s).toLowerCase(),s!=="ios"&&s!=="android"){Z(`Platform ${s} is not supported. Use 'ios' or 'android'.`),process.exitCode=1;return}let l=s==="ios"&&!e.local&&e.sshHost?Pa(n,o,e):null;if(s==="ios"&&!e.local&&!l){await ca(n,o,e);return}let a=e.submitId,d=!!(e.local&&a),c=a||null,u=async($,U={})=>{c&&await ma(r,c,{status:$,...U})},p=s==="android"?Aa(n,o):void 0,m=s==="ios"?_a(n,o):void 0,I,L,w,B=!1;try{s==="android"&&(I=e.track||n.submit?.[o]?.android?.track||n.submit?.production?.android?.track||"internal",L=$a(n,o,e.releaseStatus),w=Da(n,o,e.rollout),B=Ra(n,o,e.changesNotSentForReview),va(L,w))}catch($){Z($.message),process.exitCode=1;return}if(s==="android"&&!d&&(c=await ua(n,r,s,o,e,{packageName:p,track:I,releaseStatus:L,rollout:w,changesNotSentForReview:B}),!c)){Z("Could not create submission tracking record. Submission was not started."),process.exitCode=1;return}await u("running",{platform:s,profile:o,packageName:p,track:I,releaseStatus:L,rollout:w,startTime:Date.now()});let k=null,j=null;try{j=await Oa(r,s,e,i?.token),k=j?.filePath||null}catch($){await u("failed",{error:`Failed to resolve submission artifact: ${$.message}`,endTime:Date.now()}),Z(`Failed to resolve submission artifact: ${$.message}`),process.exitCode=1;return}if(!k){await u("failed",{error:"No suitable artifact found for submission.",endTime:Date.now()}),process.exitCode=1;return}await u("running",{buildId:j?.buildId,artifactName:j?.artifactName,artifactSource:j?.source}),se(`Using artifact: ${te.green(pe.basename(k))} `),t.start("Fetching submission credentials from Dashboard...");let h;try{let U=(await C.get(`/credentials/${r}`)).data.credentials||[];if(s==="android"&&!p){t.stop("Package name missing"),Z("Could not resolve Android package name. Set android.package in mach.config.json/app.json."),await u("failed",{error:"Could not resolve Android package name.",endTime:Date.now()}),process.exitCode=1;return}let G=U.filter(la),x=s==="ios"?U.filter(H=>H.type==="asc_api_key"):Ia(G,p);if(x.length===0){if(t.stop("Credentials missing"),Z(s==="android"?`No Google Play service credential found for package ${p}.`:`No Service Credentials found for ${s}.`),s==="android"){let H=G.map(qt).filter(Boolean).join(", ");H&&se(`Found Google Play service credential(s) for: ${H}`),se(`Use '${f.nameLower} credentials:service --platform android --package-name ${p}' or upload it under that package in the Dashboard.`)}else se(`Use '${f.nameLower} credentials:service --platform ${s}' or use the Dashboard to upload them.`);await u("failed",{error:`No submission credentials found for ${s}.`,endTime:Date.now()}),process.exitCode=1;return}if(h=ya(x,e.credentialId),!h&&s==="ios"&&m&&(h=Sa(x,m)),h||x.length===1)h=h||x[0],t.stop(`Using: ${h.name}`),s==="android"&&qt(h)==="*"&&se(te.yellow(`Using legacy wildcard Google Play credential for ${p}. Upload a package-scoped credential when possible.`));else{if(t.stop("Multiple credentials found"),Ea()){let E=x.map(ne=>`${ne.name||"credential"} (${ne.credentialId||ne.id||"no-id"})`).join(", ");Z(`Multiple ${s==="ios"?"App Store Connect":"Google Play"} credentials found. Use --credential-id in CI. Available: ${E}`),await u("failed",{error:"Multiple submission credentials found; --credential-id is required in CI.",endTime:Date.now()}),process.exitCode=1;return}let H=await ki({message:`Choose a ${s==="ios"?"App Store Connect":"Google Play"} credential:`,options:x.map(E=>({value:E.credentialId,label:E.name,hint:`${E.keyId?`ID: ${E.keyId}`:""} ${E.issuerId?`(Issuer: ${E.issuerId.substring(0,8)}...)`:""}`}))});if(Ve(H)){xi("Submission cancelled"),await u("failed",{error:"Submission cancelled while selecting credential.",endTime:Date.now()}),process.exitCode=1;return}h=x.find(E=>E.credentialId===H),se(`Using selected: ${te.green(h.name)}`)}}catch($){t.stop("Failed to fetch credentials"),Z(`API Error: ${$.message} `),await u("failed",{error:`Failed to fetch credentials: ${$.message}`,endTime:Date.now()}),process.exitCode=1;return}let K=q.mkdtempSync(pe.join(tt.tmpdir(),`${f.nameLower}-submit-`)),_=h.keyId||h.meta?.keyId,S=h.issuerId||h.meta?.issuerId,O=h.type==="asc_api_key"?`AuthKey_${_}.p8`:"service-account.json",D=pe.join(K,O);t.start("Downloading secure key...");try{let $=await C.get(`/credentials/${h.credentialId}/download`,{params:{projectId:r}});if($.data.status!=="success"||!$.data.downloadUrl)throw new Error("Failed to get secure download URL");let U=await gr.get($.data.downloadUrl,{responseType:"arraybuffer"});q.writeFileSync(D,Buffer.from(U.data)),t.stop("Key downloaded to secure temp storage")}catch($){t.stop("Download failed"),Z(`Failed to download key: ${$.message}`);try{q.rmSync(K,{recursive:!0,force:!0})}catch{}await u("failed",{error:`Failed to download credential key: ${$.message}`,endTime:Date.now()}),process.exitCode=1;return}se(te.blue(`Initiating ${s==="ios"?"TestFlight":"Google Play"} submission...`));let T=!1,R;try{if(s==="ios"){if(!_){let U=await Pt({message:"Enter App Store Connect Key ID (e.g. 2X948D...):",validate:G=>G.length>0?void 0:"Key ID is required"});if(Ve(U)){await u("failed",{error:"Submission cancelled while entering ASC Key ID.",endTime:Date.now()}),process.exitCode=1;return}_=U}if(!S||S==="undefined"){let U=await Pt({message:"Enter App Store Connect Issuer ID (Found on ASC Keys page):",validate:G=>G.length>0?void 0:"Issuer ID is required"});if(Ve(U)){await u("failed",{error:"Submission cancelled while entering ASC Issuer ID.",endTime:Date.now()}),process.exitCode=1;return}S=U}se(`Using ASC Key ID: ${_}`),se(`Using ASC Issuer ID: ${S}`);let $=l?await Na(k,D,S,_,m,l):await Ca(k,D,S,_,m);Ui(`${s==="ios"?"App Store":"Google Play"} submission successful!`),T=!0}else R=await Ua(k,D,I||"internal",p,L||"completed",w,B,o),Ui("Google Play submission successful!"),T=!0}catch($){Z(`Submission failed: ${$.message}`),await u("failed",{error:$.message,endTime:Date.now()}),lt(e,{status:"failed",projectId:r,submitId:c,platform:s,profile:o,buildId:j?.buildId||e.buildId,artifactName:j?.artifactName,error:$.message,dashboardUrl:c?et(c,r):void 0}),process.exitCode=1}finally{T&&(await u("success",{endTime:Date.now(),versionCode:R?.versionCode,track:I,releaseStatus:L}),lt(e,{status:"success",projectId:r,submitId:c,platform:s,profile:o,buildId:j?.buildId||e.buildId,artifactName:j?.artifactName,versionCode:R?.versionCode,track:I,releaseStatus:L,dashboardUrl:c?et(c,r):void 0})),Ga(K),k&&k.includes(`${f.nameLower}-artifact-`)}}function da(e){let t=`./${f.configFileName}`;if(q.existsSync(t))try{return JSON.parse(q.readFileSync(t,"utf-8"))}catch(i){return Z(`Failed to read ${f.configFileName}: ${i.message}`),null}return e.projectId?{projectId:e.projectId}:(Z(`No ${f.configFileName} found. Run \`${f.nameLower} init\` or \`${f.nameLower} link\` first.`),null)}async function ca(e,t,i){let n=i.projectId||e.projectId;if(!n){Z(`${f.configFileName} is missing projectId.`),process.exitCode=1;return}let r=i.submitId||Mi.randomUUID(),o=!!i.latest||!i.buildId,s=pa({...i,latest:o,profile:t,projectId:n,submitId:r}),l={projectId:n,submitId:r,platform:"ios",profile:t,latest:o,buildId:i.buildId,credentialId:i.credentialId,status:"pending",source:"cli",submitArgs:process.argv.slice(3).join(" "),runnerArgs:s,runnerCommand:[f.nameLower,"submit",...s].map(ba).join(" "),appName:e.name,startTime:Date.now()},a=ze();a.start("Queuing iOS submit on macOS runner...");try{let d=await C.post("/submissions",l),c=d.data?.submission||d.data?.submit||{},u=d.data?.dashboardUrl||et(r,n);a.stop("iOS submit queued"),se(`Submission ID: ${te.cyan(r)}`),se(`Dashboard: ${te.blue.underline(u)}`),lt(i,{status:"pending",projectId:n,submitId:r,platform:"ios",profile:t,latest:o,buildId:i.buildId,dashboardUrl:u}),await fa(n,r,i)}catch(d){a.stop("Could not queue iOS submit"),Z(ha(d)),process.exitCode=1}}async function ua(e,t,i,n,r,o={}){let s=r.submitId||Mi.randomUUID(),l=!!r.latest||!r.buildId,a={projectId:t,submitId:s,platform:i,profile:n,latest:l,buildId:r.buildId,credentialId:r.credentialId,status:"running",source:"cli-direct",submitArgs:process.argv.slice(3).join(" "),appName:e.name,startTime:Date.now(),...o};try{let d=await C.post("/submissions",a),c=d.data?.submission||d.data?.submit||{},u=d.data?.dashboardUrl||c.dashboardUrl||et(s,t);return se(`Submission ID: ${te.cyan(s)}`),se(`Dashboard: ${te.blue.underline(u)}`),lt(r,{status:"running",projectId:t,submitId:s,platform:i,profile:n,latest:l,buildId:r.buildId,dashboardUrl:u}),s}catch(d){let c=d.response?.data?.message||d.response?.data?.error||d.message;return se(te.yellow(`Could not create submission tracking record: ${c}`)),null}}function pa(e){let t=["--local","--submit-id",e.submitId,"--project-id",e.projectId,"--platform","ios","--profile",e.profile||"production"];return e.buildId?t.push("--build-id",e.buildId):t.push("--latest"),e.credentialId&&t.push("--credential-id",e.credentialId),e.quiet&&t.push("--quiet"),e.jsonOutput&&t.push("--json-output",e.jsonOutput),t.filter(i=>i!=null&&i!=="")}async function fa(e,t,i){let n=ze(),r=0,o=0;for(i.quiet||n.start("Waiting for iOS submit runner...");;)try{let s=await C.get(`/submissions/${e}/${t}`),l=s.data?.submission||s.data?.submit||s.data,a=String(l?.status||"pending").toLowerCase();r=0;let d=Array.isArray(l?.logs)?l.logs:[];for(let c=o;c<d.length;c++){let u=d[c];u&&console.log(te.dim(String(u)))}if(o=d.length,["success","completed","succeeded"].includes(a)){i.quiet||n.stop("iOS submit completed"),Ui("App Store submission successful!"),lt(i,{status:"success",projectId:e,submitId:t,platform:"ios",profile:l?.profile||i.profile||"production",buildId:l?.buildId||i.buildId,artifactName:l?.artifactName,dashboardUrl:l?.dashboardUrl||et(t,e)});return}if(["failed","error","cancelled","canceled"].includes(a)){i.quiet||n.stop("iOS submit failed");let c=l?.error||l?.message||"Unknown iOS submit failure.";Z(c),lt(i,{status:"failed",projectId:e,submitId:t,platform:"ios",profile:l?.profile||i.profile||"production",buildId:l?.buildId||i.buildId,artifactName:l?.artifactName,error:c,dashboardUrl:l?.dashboardUrl||et(t,e)}),process.exitCode=1;return}i.quiet||n.message(`iOS submit ${a}...`),await Li(oa)}catch(s){if(r++,r>=sa){i.quiet||n.stop("Lost connection to iOS submit status"),Z(`Could not fetch iOS submit status after ${r} attempts: ${s.message}`),process.exitCode=1;return}await Li(Math.min(2e3*r,15e3))}}async function ma(e,t,i){let n;for(let r=1;r<=3;r++)try{await C.patch(`/submissions/${e}/${t}`,i);return}catch(o){if(n=o,r>=3||!ga(o))break;await Li(1e3*r)}mr.warn(te.dim(`Could not report submission status: ${n?.message||n}`))}function ga(e){let t=e.response?.status;return!t||t===408||t===409||t===425||t===429||t>=500}function ha(e){let t=e.response?.status,i=e.response?.data?.message||e.response?.data?.error;return t===404||t===405?["Managed iOS submit is not enabled on this Mach API yet.","Deploy the API/dashboard submission orchestration endpoint, then retry the same command.","Expected API: POST /submissions and GET/PATCH /submissions/:projectId/:submitId."].join(`
-`):i||e.message||String(e)}function et(e,t){if(!e)return je;let i=t?`?projectId=${encodeURIComponent(t)}`:"";return`${je}/submissions/${e}${i}`}function lt(e,t){if(!e.jsonOutput)return;let i=pe.resolve(e.jsonOutput),n={...t,url:t.url||t.dashboardUrl||et(t.submitId,t.projectId),updatedAt:new Date().toISOString()};try{let r=pe.dirname(i);r&&r!=="."&&q.mkdirSync(r,{recursive:!0}),q.writeFileSync(i,JSON.stringify(n,null,2))}catch(r){mr.warn(te.yellow(`Could not write submission metadata JSON: ${r.message}`))}}function ya(e,t){return t&&e.find(i=>i.credentialId===t||i.id===t||i.keyId===t||i.meta?.keyId===t)||null}function Sa(e,t){let i=e.filter(n=>[n.bundleId,n.bundleIdentifier,n.appIdentifier,n.meta?.bundleId,n.meta?.bundleIdentifier,n.meta?.appIdentifier].filter(Boolean).map(String).includes(t));return i.length===1?i[0]:null}function Ea(){return process.env.CI==="true"||process.env.CI==="1"||!process.stdin.isTTY}function Li(e){return new Promise(t=>setTimeout(t,e))}function ba(e){return/^[a-zA-Z0-9_./:=@-]+$/.test(e)?e:`'${e.replace(/'/g,"'\\''")}'`}function Aa(e,t){if(e.submit?.[t]?.android?.package)return e.submit[t].android.package;let i=Yi(e,t);if(i)return i;let n=pe.join(process.cwd(),"app.json");if(q.existsSync(n))try{return JSON.parse(q.readFileSync(n,"utf-8")).expo?.android?.package}catch{}let r=pe.join(process.cwd(),"app.config.json");if(q.existsSync(r))try{let o=JSON.parse(q.readFileSync(r,"utf-8"));return o.expo?.android?.package||o.android?.package}catch{}}function Ia(e,t){let i=e.filter(o=>qt(o)===t);if(i.length>0)return i;let n=e.filter(o=>{let s=qt(o);return!s||s==="*"});return e.length>0&&e.length===n.length?n:[]}function _a(e,t){return e.submit?.[t]?.ios?.bundleIdentifier?e.submit[t].ios.bundleIdentifier:e.submit?.[t]?.ios?.bundleId?e.submit[t].ios.bundleId:Ji(e,t)}function Pa(e,t,i){let n=e.submit?.[t]?.ios||{},r=e.submit?.production?.ios||{},o=i.sshHost||n.sshHost||r.sshHost||process.env.MACH_IOS_SUBMIT_SSH_HOST;return o?{sshHost:o,sshUser:i.sshUser||n.sshUser||r.sshUser||process.env.MACH_IOS_SUBMIT_SSH_USER||process.env.USER||"ubuntu",sshKey:i.sshKey||n.sshKey||r.sshKey||process.env.MACH_IOS_SUBMIT_SSH_KEY}:null}function $a(e,t,i){let n=i||e.submit?.[t]?.android?.releaseStatus||e.submit?.production?.android?.releaseStatus||"completed";return wa(n)}function wa(e){let t=aa[String(e).trim().toLowerCase()];if(!t)throw new Error(`Invalid Android release status "${e}". Use completed, draft, halted, or inProgress.`);return t}function Da(e,t,i){let n=i??e.submit?.[t]?.android?.rollout??e.submit?.[t]?.android?.userFraction??e.submit?.[t]?.android?.rolloutFraction??e.submit?.production?.android?.rollout??e.submit?.production?.android?.userFraction??e.submit?.production?.android?.rolloutFraction;if(n==null||n==="")return;let r=Number(n);if(!Number.isFinite(r)||r<=0||r>=1)throw new Error(`Invalid Android rollout fraction "${n}". Use a number greater than 0 and less than 1, for example 0.1.`);return r}function Ra(e,t,i){let n=i??e.submit?.[t]?.android?.changesNotSentForReview??e.submit?.[t]?.android?.changes_not_sent_for_review??e.submit?.production?.android?.changesNotSentForReview??e.submit?.production?.android?.changes_not_sent_for_review??!1;return n===!0||n==="true"||n==="1"}function va(e,t){if(e==="inProgress"&&t===void 0)throw new Error("Google Play staged rollout requires --rollout <fraction> when --release-status inProgress is used.");if(e!=="inProgress"&&e!=="halted"&&t!==void 0)throw new Error("Android rollout fraction can only be used with --release-status inProgress or halted.")}async function Oa(e,t,i,n){let r=i.buildId?"id":i.latest?"latest":null;if(!r){let s=await ki({message:"Select artifact source:",options:[{value:"latest",label:`Latest Production Build (${f.name})`},{value:"id",label:`Input Build ID (${f.name})`},{value:"url",label:"Remote URL"},{value:"local",label:"Local File Path"}]});if(Ve(s))return xi("Operation cancelled"),null;r=s}if(r==="local"){let s=await Pt({message:"Enter path to artifact (.ipa/.aab):",validate:l=>{if(!q.existsSync(l))return"File not found";if(t==="ios"&&!l.endsWith(".ipa"))return"Must be an .ipa file";if(t==="android"&&!l.endsWith(".aab"))return"Must be an .aab file"}});return Ve(s)?null:{filePath:s,source:"local"}}let o=ze();if(r==="latest"){let s=i.profile||i.buildProfile;o.start(`Fetching latest${s?` ${s}`:""} build...`);try{let l=await C.get(`/builds/${e}`,{params:{limit:50}});if(l.data.status!=="success")throw new Error(l.data.message);let a=l.data.builds||[],d=s?.toLowerCase(),c=h=>h.platform?.toLowerCase()===t.toLowerCase()&&h.status?.toLowerCase()==="success",u=h=>d?[h.buildProfile,h.profile,h.profileName,h.buildType].filter(Boolean).some(K=>String(K).toLowerCase()===d):!0,p=a.filter(h=>c(h)&&u(h)),m=p.find(h=>h.buildType?.toLowerCase()==="store"||h.distribution?.toLowerCase()==="store")||p[0],I=a.some(h=>h.platform?.toLowerCase()===t.toLowerCase()&&h.status?.toLowerCase()==="success");if(!m)return o.stop("No suitable build found"),Z(s&&I?`No successful ${t} builds found for profile "${s}".`:"No successful builds found for this platform."),null;o.stop(`Found build: ${m.buildId}`);let L=m.artifacts||[];if(L.length===0||L.every(h=>!(h.url||h.downloadUrl)))try{let h=await C.get(`/builds/${e}/${m.buildId}/artifacts`);h.data.status==="success"&&h.data.artifacts?.length>0?(L=h.data.artifacts.map(K=>({...K,url:K.url||K.downloadUrl})),console.log(te.cyan(`  [RECOVERY] Fetched ${L.length} artifact(s) with download URLs.`))):console.log(te.yellow("  [RECOVERY] /artifacts endpoint returned 0 artifacts."))}catch(h){console.log(te.red(`  [RECOVERY] /artifacts fetch failed: ${h.message}`))}let B=t==="ios",k=L.find(h=>{let K=(h.type||"").toLowerCase(),_=(h.name||"").toLowerCase();if(console.log(te.dim(`    - Checking: ${h.name} (Type: ${h.type}, HasLink: ${!!(h.url||h.downloadUrl)})`)),K)return K===(B?"ipa":"aab");let S=B?".ipa":".aab",O=(h.url||h.downloadUrl||"").toLowerCase();return _.endsWith(S)||O.includes(S)});if(!k||!(k.url||k.downloadUrl))return Z("Build found but artifact URL is missing."),null;let j=k.url||k.downloadUrl;return{filePath:await Ci(j,B?"ios":"android"),buildId:m.buildId,artifactName:k.name,source:"latest"}}catch(l){return o.stop("Fetch failed"),Z(`API Error: ${l.message}`),null}}if(r==="id"){let s=i.buildId||await Pt({message:"Enter Build ID:",validate:l=>l.length<5?"Invalid ID":void 0});if(Ve(s))return null;o.start("Fetching build...");try{let l=await C.get(`/build/${s}`);if(l.data.status!=="success")throw new Error(l.data.message);let a=l.data.build;if(!a)throw new Error("Build not found");let d=t==="ios",c=a.artifacts?.find(u=>{if(u.type)return u.type===(d?"ipa":"aab");let p=d?".ipa":".aab";return u.name&&u.name.endsWith(p)||u.url&&u.url.includes(p)});return!c||!c.url?(o.stop("Missing artifact"),Z("Artifact URL not found on build record."),null):(o.stop(`Found build: ${a.buildId}`),{filePath:await Ci(c.url,d?"ios":"android"),buildId:a.buildId||String(s),artifactName:c.name,source:"id"})}catch(l){return o.stop("Fetch failed"),Z(l.message),null}}if(r==="url"){let s=await Pt({message:"Enter Artifact URL:",validate:l=>l.startsWith("http")?void 0:"Must be a valid URL"});return Ve(s)?null:{filePath:await Ci(s,t),source:"url"}}return null}async function Ci(e,t,i=3){let n=ze();n.start("Downloading artifact...");let r=q.mkdtempSync(pe.join(tt.tmpdir(),`${f.nameLower}-artifact-`)),o=`app.${t==="ios"?"ipa":"aab"}`,s=pe.join(r,o);for(let l=1;l<=i;l++)try{l>1&&(n.message(`Downloading artifact (Retry ${l}/${i})...`),await new Promise(c=>setTimeout(c,2e3*l)));let a=q.createWriteStream(s),d=await gr({url:e,method:"GET",responseType:"stream",timeout:6e4});return await new Promise((c,u)=>{d.data.pipe(a);let p=!1;d.data.on("error",m=>{p||(p=!0,a.close(),u(m))}),a.on("finish",()=>{p||c()}),a.on("error",m=>{p||(p=!0,u(m))})}),n.stop("Download complete"),s}catch(a){if(l===i)throw n.stop("Download failed"),a}throw new Error("Download failed after retries")}async function Ca(e,t,i,n,r){let o=ze();if(r&&se(`Bundle ID: ${te.green(r)}`),!i||!n)throw Z(`Missing credentials: issuerId=${i}, keyId=${n}. Check your Dashboard.`),new Error("Missing ASC API Key Metadata (IssuerID or KeyID)");let s=yr(t,i,n),l=Ba();return o.start("Uploading to TestFlight (pilot)..."),new Promise((a,d)=>{let c=ra(l.command,["pilot","upload","--ipa",e,"--api_key_path",s,"--skip_submission","true","--skip_waiting_for_build_processing","true"],{stdio:"inherit",env:l.env});c.on("close",u=>{if(u!==0){o.stop("Pilot failed");try{q.unlinkSync(s)}catch{}d(new Error(`fastlane pilot failed with exit code ${u??"unknown"}.`))}else{o.stop("IPA uploaded to TestFlight");try{q.unlinkSync(s)}catch{}a({})}}),c.on("error",u=>{try{q.unlinkSync(s)}catch{}o.stop("Pilot execution error"),d(Ha(u))})})}async function Na(e,t,i,n,r,o){let s=ze();if(r&&se(`Bundle ID: ${te.green(r)}`),!i||!n)throw Z(`Missing credentials: issuerId=${i}, keyId=${n}. Check your Dashboard.`),new Error("Missing ASC API Key Metadata (IssuerID or KeyID)");let l=yr(t,i,n),a=`${o.sshUser}@${o.sshHost}`,d=Ta(o),c=ka(o),u="",p="";try{if(s.start(`Preparing remote iOS submit runner (${a})...`),u=xa("ssh",[...d,"mktemp -d /tmp/mach-submit.XXXXXX"]).trim(),!u)throw new Error("Remote runner did not return a temp directory.");s.stop(`Remote runner ready: ${a}`),s.start("Uploading IPA and App Store Connect key to remote runner..."),Ni("scp",[...c,e,`${a}:${u}/app.ipa`],"IPA upload to remote runner"),Ni("scp",[...c,l,`${a}:${u}/api_key.json`],"ASC key upload to remote runner"),p=pe.join(tt.tmpdir(),`${f.nameLower}-ios-submit-${Date.now()}.sh`),q.writeFileSync(p,La(u)),Ni("scp",[...c,p,`${a}:${u}/submit.sh`],"submit script upload to remote runner"),s.stop("Remote submit inputs uploaded"),s.start("Uploading to TestFlight on remote runner...");let m=`chmod +x ${$t(`${u}/submit.sh`)} && bash ${$t(`${u}/submit.sh`)}`,I=Qe("ssh",[...d,m],{stdio:"inherit"});if(I.error)throw Bi("ssh",I.error);if(I.status!==0)throw new Error(`Remote iOS submit failed with exit code ${I.status}.`);return s.stop("IPA uploaded to TestFlight"),{apiKeyJsonPath:null}}catch(m){throw s.stop("Remote iOS submit failed"),m}finally{try{q.unlinkSync(l)}catch{}if(p)try{q.unlinkSync(p)}catch{}if(u)try{Qe("ssh",[...d,`rm -rf ${$t(u)}`],{stdio:"ignore"})}catch{}}}function yr(e,t,i){let n=q.readFileSync(e,"utf8"),r;try{r=Mi.createPrivateKey(n).export({type:"pkcs8",format:"pem"})}catch{se("Key normalization failed, falling back to manual re-wrapping..."),r=`-----BEGIN PRIVATE KEY-----
+`).filter(o=>!!o.trim()),r=e.some(o=>o.platform==="android"&&o.id.startsWith("emulator-"));n.forEach(o=>{r||e.push({id:o,platform:"android",type:"emulator",name:o.replace(/_/g," "),status:"offline",details:`Android Virtual Device: ${o}`})})}catch{}if(process.platform!=="darwin")return e;try{let t=De("/usr/bin/xcrun simctl list devices --json",{stdio:"pipe"}).toString(),i=JSON.parse(t);Object.entries(i.devices).forEach(([n,r])=>{r.forEach(o=>{o.isAvailable&&e.push({id:o.udid,platform:"ios",type:"simulator",name:o.name,status:o.state?.toLowerCase()==="booted"?"online":"offline",runtime:n,details:`${o.name} (${n})`})})})}catch{}try{let t=De("/usr/bin/xcrun devicectl list devices --json-output -",{stdio:"pipe"}).toString();(JSON.parse(t).result?.devices||[]).forEach(n=>{let r=n.connectionProperties?.transportType;(r==="wired"||r==="localNetwork")&&e.push({id:n.identifier,platform:"ios",type:"physical",name:n.deviceProperties?.name||"iPhone",status:"online",details:`${n.deviceProperties?.name||"iPhone"} (${n.model?.name||n.hardwareModel||""}) - ${r}`})})}catch{}return e}async function er(e){let t=[];for await(let i of e)t.push(Buffer.isBuffer(i)?i:Buffer.from(i));return t.length===0?{}:JSON.parse(Buffer.concat(t).toString("utf-8"))}async function xs(e,t){let i=await Ns({method:"GET",url:e,responseType:"stream",timeout:12e4}),n=$i.createWriteStream(t);i.data.pipe(n),await new Promise((r,o)=>{n.on("finish",r),n.on("error",o)})}async function Ls(e,t,i){let n=i||(t.toLowerCase().includes(".apk")?"android":"ios"),r=t.toLowerCase().includes(".ipa"),o=$i.mkdtempSync(Pi.join(Ts.tmpdir(),`${bt}-install-`)),s=Pi.join(o,n==="android"?"install.apk":r?"install.ipa":"install.zip");try{if(await xs(t,s),n==="android"){De(`adb -s ${JSON.stringify(e)} install -r ${JSON.stringify(s)}`,{stdio:"pipe"});return}if(process.platform!=="darwin")throw new Error("iOS local install requires macOS.");De(`unzip -o ${JSON.stringify(s)} -d ${JSON.stringify(o)}`,{stdio:"pipe"});let l="";try{l=De(`find ${JSON.stringify(Pi.join(o,"Payload"))} -maxdepth 1 -name "*.app" 2>/dev/null | head -n 1`,{stdio:"pipe"}).toString().trim()}catch{}if(l||(l=De(`find ${JSON.stringify(o)} -name "*.app" -type d | head -n 1`,{stdio:"pipe"}).toString().trim()),!l)throw new Error(`No .app bundle found inside the ${r?"IPA":"archive"}.`);try{De(`/usr/bin/xcrun devicectl device install app --device ${JSON.stringify(e)} ${JSON.stringify(l)}`,{stdio:"pipe"})}catch(a){try{De(`/usr/bin/xcrun simctl install ${JSON.stringify(e)} ${JSON.stringify(l)}`,{stdio:"pipe"})}catch{throw new Error(a.stderr?.toString().trim()||a.message||"iOS install failed.")}}}finally{$i.rmSync(o,{recursive:!0,force:!0})}}function Us(e,t){if(!e)throw new Error("Device id is required.");if(t==="ios"){if(process.platform!=="darwin")throw new Error("iOS Simulator launch requires macOS.");return De(`/usr/bin/xcrun simctl boot ${JSON.stringify(e)}`,{stdio:"pipe"}),Qn("open",["-a","Simulator"],{detached:!0,stdio:"ignore"}).unref(),"Simulator booting..."}if(t==="android"){let i=`${process.env.ANDROID_HOME||`${process.env.HOME}/Library/Android/sdk`}/emulator/emulator`;return Qn(i,["-avd",e],{detached:!0,stdio:"ignore"}).unref(),"Emulator booting in background..."}throw new Error("Invalid platform.")}async function tr(){process.platform!=="darwin"&&at.warn("Running on non-macOS \u2014 iOS discovery unavailable, Android only.");let e=Cs.createServer((n,r)=>{if(r.setHeader("Access-Control-Allow-Origin","*"),r.setHeader("Access-Control-Allow-Methods","GET, POST, OPTIONS"),r.setHeader("Access-Control-Allow-Headers","Content-Type, Authorization"),n.method==="OPTIONS"){r.writeHead(204),r.end();return}let o=new URL(n.url||"/",`http://localhost:${bt}`);if(n.method==="GET"&&o.pathname==="/local/devices"){try{let s=ks();r.writeHead(200,{"Content-Type":"application/json"}),r.end(JSON.stringify({status:"success",targets:s}))}catch(s){r.writeHead(500,{"Content-Type":"application/json"}),r.end(JSON.stringify({status:"error",message:s.message}))}return}if(n.method==="POST"&&o.pathname==="/install-local"){t(n,r);return}if(n.method==="POST"&&o.pathname==="/local/boot"){i(n,r);return}r.writeHead(404),r.end()}),t=async(n,r)=>{try{let{deviceId:o,artifactUrl:s,platform:l}=await er(n);if(!o||!s){r.writeHead(400,{"Content-Type":"application/json"}),r.end(JSON.stringify({status:"error",message:"deviceId and artifactUrl are required"}));return}await Ls(o,s,l),r.writeHead(200,{"Content-Type":"application/json"}),r.end(JSON.stringify({status:"success",message:`Installed on ${o}`}))}catch(o){r.writeHead(500,{"Content-Type":"application/json"}),r.end(JSON.stringify({status:"error",message:o.message||"Local install failed"}))}},i=async(n,r)=>{try{let{id:o,platform:s}=await er(n),l=Us(o,s);r.writeHead(200,{"Content-Type":"application/json"}),r.end(JSON.stringify({status:"success",message:l}))}catch(o){r.writeHead(500,{"Content-Type":"application/json"}),r.end(JSON.stringify({status:"error",message:o.message||"Local device launch failed"}))}};e.listen(bt,"127.0.0.1",()=>{at.success(_i.green(`Local device agent running on http://localhost:${bt}`)),at.info(_i.dim("Keep this running while using the Install Hub on the dashboard.")),at.info(_i.dim("Press Ctrl+C to stop."))}),e.on("error",n=>{n.code==="EADDRINUSE"?at.error(`Port ${bt} is already in use \u2014 agent may already be running.`):at.error(`Agent error: ${n.message}`),process.exit(1)}),await new Promise(()=>{})}import{createRequire as Xl}from"module";import{text as Bs,password as Fs,spinner as Hs,isCancel as rr}from"@clack/prompts";import vi from"chalk";import At from"fs";import ir from"path";import Ms from"os";var wi=ir.join(Ms.homedir(),f.configDir),Di=ir.join(wi,"config.json");function Ri(){if(!At.existsSync(Di))return{};try{return JSON.parse(At.readFileSync(Di,"utf-8"))}catch{return{}}}function nr(e){At.existsSync(wi)||At.mkdirSync(wi,{recursive:!0});let i={...Ri(),...e};At.writeFileSync(Di,JSON.stringify(i,null,2))}async function or(){let e=Ri(),t=await Bs({message:"Enter your email:",placeholder:"user@example.com",initialValue:e.lastLoginEmail,validate(r){if(r.length===0)return"Email is required!"}});if(rr(t))return;let i=await Fs({message:"Enter your password:",validate(r){if(r.length===0)return"Password is required!"}});if(rr(i))return;let n=Hs();n.start("Authenticating...");try{let o=await(await fetch(`${Lt}/login`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({username:t,password:i})})).json();o.status==="success"&&o.user.token?(zi({id:o.user.id,email:t,token:o.user.token,refreshToken:o.user.refreshToken}),nr({lastLoginEmail:t}),n.stop(vi.green("Login successful!"))):n.stop(vi.red("Login failed: "+(o.message||"Unknown error")))}catch(r){n.stop(vi.red("Network error: "+r.message))}}import{outro as js,select as Gs,spinner as Ks,isCancel as Vs}from"@clack/prompts";import Wt from"chalk";import Oi from"fs";import zs from"path";var sr=e=>e==="1234567890"||e==="ABC123DEFG"||e==="XXXXXXXXXX"?"":typeof e=="string"?e:"",Ws=()=>process.versions.node.split(".")[0]||"24";async function ar(){if(!ye()){console.log(Wt.red(`You are not logged in. Run \`${f.nameLower} login\` first.`));return}let t=Ks();t.start("Fetching projects...");try{let{data:i}=await C.get("/projects");if(t.stop("Projects loaded."),i.status!=="success"||!i.projects||i.projects.length===0){console.log(Wt.yellow(`No projects found. Run \`${f.nameLower} init\` to create one.`));return}let n=i.projects.map(I=>({value:I.projectId,label:`${I.name} (${I.slug})`})),r=await Gs({message:"Select a project to link:",options:n});if(Vs(r))return;let o=zs.join(process.cwd(),f.configFileName),s={};if(Oi.existsSync(o))try{s=JSON.parse(Oi.readFileSync(o,"utf-8"))}catch{}let l=i.projects.find(I=>I.projectId===r),a=s.android?.package||Be("android"),d=s.ios?.bundleIdentifier||Be("ios"),c=s.android||{},u=s.submit?.production?.android||{},p=s.submit?.production?.ios||{},m={projectId:r,name:l?.name,slug:l?.slug,nodeVersion:s.nodeVersion||Ws(),scheme:l?.slug?.toLowerCase()||"app",android:{...c,package:a||"",versionCode:c.versionCode||"auto"},ios:{bundleIdentifier:d||"",buildNumber:s.ios?.buildNumber||"auto"},build:{development:{environment:"development",distribution:"development"},staging:{environment:"staging",distribution:"internal"},production:{environment:"production",distribution:"store"}},submit:{production:{android:{...u,track:u.track||"internal",releaseStatus:u.releaseStatus||"completed"},ios:{ascAppId:sr(p.ascAppId),appleTeamId:sr(p.appleTeamId)}}}};Oi.writeFileSync(o,JSON.stringify(m,null,2)),js(Wt.green(`Linked to project ${m.name} (${m.slug})`))}catch(i){t.stop(Wt.red("Error fetching projects: "+i.message))}}import{outro as Ys,text as Yt,select as Js,spinner as Xs,isCancel as It}from"@clack/prompts";import _t from"chalk";import qs from"fs";import Zs from"path";import{randomUUID as Qs}from"crypto";var ea=()=>process.versions.node.split(".")[0]||"24";async function lr(){if(!ye()){console.log(_t.red(`You are not logged in. Run \`${f.nameLower} login\` first.`));return}let t=await Yt({message:"Project Name:",placeholder:"My Awesome App",validate(l){if(l.length===0)return"Name is required!"}});if(It(t))return;let i=await Yt({message:"Project Slug (URL friendly):",placeholder:"my-awesome-app",validate(l){if(l.length===0)return"Slug is required!";if(!/^[a-z0-9-]+$/.test(l))return"Slug must be lowercase alphanumeric with dashes."}});if(It(i))return;let n=await Js({message:"Platform:",options:[{value:"android",label:"Android"},{value:"ios",label:"iOS"},{value:"web",label:"Web"},{value:"all",label:"All Platforms"}]});if(It(n))return;let r="";if(n==="android"||n==="all"){let l=Be("android");if(r=await Yt({message:"Android Package Name:",initialValue:l||"",placeholder:"com.example.app",validate(a){if(a.length===0)return"Package name is required for Android!"}}),It(r))return}let o="";if(n==="ios"||n==="all"){let l=Be("ios");if(o=await Yt({message:"iOS Bundle Identifier:",initialValue:l||"",placeholder:"com.example.app",validate(a){if(a.length===0)return"Bundle ID is required for iOS!"}}),It(o))return}let s=Xs();s.start("Creating project...");try{let l=Qs(),d={projectId:l,name:t,slug:i,storageType:"managed",platforms:n==="all"?["android","ios","web"]:[n]},{data:c}=await C.post("/projects",d);if(c.status==="success"){s.stop(_t.green("Project created successfully!"));let u=Zs.join(process.cwd(),f.configFileName);qs.writeFileSync(u,JSON.stringify({projectId:l,name:t,slug:i,nodeVersion:ea(),...r?{android:{package:r,versionCode:"auto"}}:{},...o?{ios:{bundleIdentifier:o,buildNumber:"auto"}}:{},build:{development:{environment:"development",distribution:"development"},staging:{environment:"staging",distribution:"internal"},production:{environment:"production",distribution:"store"}},submit:{production:{android:{track:"internal",releaseStatus:"completed"},ios:{ascAppId:"",appleTeamId:""}}}},null,2)),Ys(_t.green(`Initialized project ${t} and linked locally!`))}else s.stop(_t.red("creation failed: "+c.message))}catch(l){s.stop(_t.red("Network error: "+l.message))}}import{spinner as cr,log as Ae}from"@clack/prompts";import Jt from"chalk";import dr from"fs";import ta from"path";function ur(e,t,i,n){let r=e?.response?.status,o=e?.response?.data?.message||e?.response?.data?.error,s=n?` ${n}`:"";return r===401?`Not logged in or token expired while trying to ${i}${s}. Run \`${f.nameLower} login\` and try again.`:r===403?[`Permission denied while trying to ${i}${s}.`,o?`API says: ${o}.`:void 0,`Current Mach account/token does not have access to project ${t}.`,`Run \`${f.nameLower} login\` with the correct account, or ask a project owner to grant access.`].filter(Boolean).join(" "):r===404?[`Project or environment endpoint was not found while trying to ${i}${s}.`,`Project ID: ${t}.`,o?`API says: ${o}.`:void 0].filter(Boolean).join(" "):r?`Failed to ${i}${s}: ${o||`API returned HTTP ${r}`}`:`Network error while trying to ${i}${s}: ${e?.message||"Unknown error"}`}async function pr(e,t){let i=ye();if(!i){Ae.error(`You are not logged in. Run \`${f.nameLower} login\` first.`);return}let n=ta.join(process.cwd(),f.configFileName);if(!dr.existsSync(n)){Ae.error(`No ${f.configFileName} found. Run \`${f.nameLower} init\` or \`${f.nameLower} link\` first.`);return}let r;try{r=JSON.parse(dr.readFileSync(n,"utf-8"))}catch{Ae.error(`Failed to parse ${f.configFileName}`);return}let{projectId:o}=r;if(!o){Ae.error(`${f.configFileName} is missing projectId.`);return}e==="set"?await ia(o,t,i):e==="list"?await na(o,i):Ae.error(`Unknown env action: ${e}. Use 'set' or 'list'.`)}async function ia(e,t,i){if(t.length===0){Ae.error(`Usage: ${f.nameLower} env set KEY=VALUE [KEY2=VALUE2 ...]`);return}let n=cr();n.start("Setting environment variables...");let r=0,o=0;for(let s of t){let[l,...a]=s.split("="),d=a.join("=");if(!l||d===void 0){Ae.warn(`Invalid format for argument: ${s}. Expected KEY=VALUE.`),o++;continue}try{let c={key:l.trim(),value:d,type:"env",environment:"global",visibility:"secret"},{data:u}=await C.post(`/projects/${e}/secrets`,c);u.status==="success"?r++:(Ae.error(`Failed to set ${l}: ${u.message}`),o++)}catch(c){Ae.error(ur(c,e,"set",l)),o++}}n.stop(`Set ${r} variable(s). ${o>0?`${o} failed.`:""}`)}async function na(e,t){let i=cr();i.start("Fetching environment variables...");try{let{data:n}=await C.get(`/projects/${e}/secrets`);if(n.status==="success"){i.stop("Fetched variables.");let r=n.secrets||[];r.length===0?Ae.info("No environment variables found for this project."):(Ae.info(Jt.bold("Environment Variables (Global & Scoped):")),r.forEach(o=>{let s=o.visibility==="plain"?o.value:"********";console.log(`  ${Jt.cyan(o.key)} = ${s}  ${Jt.gray(`[${o.environment}]`)}`)}))}else i.stop(Jt.red(`Failed to fetch variables: ${n.message}`))}catch(n){i.stop("Failed to fetch variables."),Ae.error(ur(n,e,"list"))}}import{spinner as ze,text as Pt,select as ki,isCancel as Ve,cancel as xi,log as mr}from"@clack/prompts";import te from"chalk";import X from"fs";import pe from"path";import{spawn as ra,spawnSync as Qe}from"child_process";import gr from"axios";import tt from"os";import Mi from"crypto";var oa=5e3,sa=12,aa={completed:"completed",draft:"draft",halted:"halted",inprogress:"inProgress","in-progress":"inProgress"},la=e=>e?.type==="google_service_account",Xt=e=>e?.bundleId||e?.packageName||e?.meta?.packageName||e?.meta?.bundleId;async function hr(e){let t=ze(),i=ye(),n=da(e);if(!n){process.exitCode=1;return}let r=e.projectId||n.projectId,o=e.profile||e.buildProfile||"production";if(!r){Z(`${f.configFileName} is missing projectId. Pass --project-id in runner mode.`),process.exitCode=1;return}n.projectId=r,se(te.dim(`Submit for project: ${n.name||r} | Profile: ${o}`));let s=e.platform;if(!s){let $=await ki({message:"Select platform to submit:",options:[{value:"ios",label:"iOS (App Store Connect / TestFlight)"},{value:"android",label:"Android (Google Play Console)"}]});if(Ve($)){xi("Operation cancelled");return}s=$}if(s=String(s).toLowerCase(),s!=="ios"&&s!=="android"){Z(`Platform ${s} is not supported. Use 'ios' or 'android'.`),process.exitCode=1;return}let l=s==="ios"&&!e.local&&e.sshHost?Pa(n,o,e):null;if(s==="ios"&&!e.local&&!l){await ca(n,o,e);return}let a=e.submitId,d=!!(e.local&&a),c=a||null,u=async($,U={})=>{c&&await ma(r,c,{status:$,...U})},p=s==="android"?Aa(n,o):void 0,m=s==="ios"?_a(n,o):void 0,I,L,w,B=!1;try{s==="android"&&(I=e.track||n.submit?.[o]?.android?.track||n.submit?.production?.android?.track||"internal",L=$a(n,o,e.releaseStatus),w=Da(n,o,e.rollout),B=Ra(n,o,e.changesNotSentForReview),va(L,w))}catch($){Z($.message),process.exitCode=1;return}if(s==="android"&&!d&&(c=await ua(n,r,s,o,e,{packageName:p,track:I,releaseStatus:L,rollout:w,changesNotSentForReview:B}),!c)){Z("Could not create submission tracking record. Submission was not started."),process.exitCode=1;return}await u("running",{platform:s,profile:o,packageName:p,track:I,releaseStatus:L,rollout:w,startTime:Date.now()});let k=null,j=null;try{j=await Oa(r,s,e,i?.token),k=j?.filePath||null}catch($){await u("failed",{error:`Failed to resolve submission artifact: ${$.message}`,endTime:Date.now()}),Z(`Failed to resolve submission artifact: ${$.message}`),process.exitCode=1;return}if(!k){await u("failed",{error:"No suitable artifact found for submission.",endTime:Date.now()}),process.exitCode=1;return}await u("running",{buildId:j?.buildId,artifactName:j?.artifactName,artifactSource:j?.source}),se(`Using artifact: ${te.green(pe.basename(k))} `),t.start("Fetching submission credentials from Dashboard...");let h;try{let U=(await C.get(`/credentials/${r}`)).data.credentials||[];if(s==="android"&&!p){t.stop("Package name missing"),Z("Could not resolve Android package name. Set android.package in mach.config.json/app.json."),await u("failed",{error:"Could not resolve Android package name.",endTime:Date.now()}),process.exitCode=1;return}let G=U.filter(la),x=s==="ios"?U.filter(H=>H.type==="asc_api_key"):Ia(G,p);if(x.length===0){if(t.stop("Credentials missing"),Z(s==="android"?`No Google Play service credential found for package ${p}.`:`No Service Credentials found for ${s}.`),s==="android"){let H=G.map(Xt).filter(Boolean).join(", ");H&&se(`Found Google Play service credential(s) for: ${H}`),se(`Use '${f.nameLower} credentials:service --platform android --package-name ${p}' or upload it under that package in the Dashboard.`)}else se(`Use '${f.nameLower} credentials:service --platform ${s}' or use the Dashboard to upload them.`);await u("failed",{error:`No submission credentials found for ${s}.`,endTime:Date.now()}),process.exitCode=1;return}if(h=ya(x,e.credentialId),!h&&s==="ios"&&m&&(h=Sa(x,m)),h||x.length===1)h=h||x[0],t.stop(`Using: ${h.name}`),s==="android"&&Xt(h)==="*"&&se(te.yellow(`Using legacy wildcard Google Play credential for ${p}. Upload a package-scoped credential when possible.`));else{if(t.stop("Multiple credentials found"),Ea()){let E=x.map(ne=>`${ne.name||"credential"} (${ne.credentialId||ne.id||"no-id"})`).join(", ");Z(`Multiple ${s==="ios"?"App Store Connect":"Google Play"} credentials found. Use --credential-id in CI. Available: ${E}`),await u("failed",{error:"Multiple submission credentials found; --credential-id is required in CI.",endTime:Date.now()}),process.exitCode=1;return}let H=await ki({message:`Choose a ${s==="ios"?"App Store Connect":"Google Play"} credential:`,options:x.map(E=>({value:E.credentialId,label:E.name,hint:`${E.keyId?`ID: ${E.keyId}`:""} ${E.issuerId?`(Issuer: ${E.issuerId.substring(0,8)}...)`:""}`}))});if(Ve(H)){xi("Submission cancelled"),await u("failed",{error:"Submission cancelled while selecting credential.",endTime:Date.now()}),process.exitCode=1;return}h=x.find(E=>E.credentialId===H),se(`Using selected: ${te.green(h.name)}`)}}catch($){t.stop("Failed to fetch credentials"),Z(`API Error: ${$.message} `),await u("failed",{error:`Failed to fetch credentials: ${$.message}`,endTime:Date.now()}),process.exitCode=1;return}let K=X.mkdtempSync(pe.join(tt.tmpdir(),`${f.nameLower}-submit-`)),_=h.keyId||h.meta?.keyId,S=h.issuerId||h.meta?.issuerId,O=h.type==="asc_api_key"?`AuthKey_${_}.p8`:"service-account.json",D=pe.join(K,O);t.start("Downloading secure key...");try{let $=await C.get(`/credentials/${h.credentialId}/download`,{params:{projectId:r,format:"raw"}});if($.data.status!=="success"||!$.data.downloadUrl)throw new Error("Failed to get secure download URL");let U=await gr.get($.data.downloadUrl,{responseType:"arraybuffer"});X.writeFileSync(D,Buffer.from(U.data)),t.stop("Key downloaded to secure temp storage")}catch($){t.stop("Download failed"),Z(`Failed to download key: ${$.message}`);try{X.rmSync(K,{recursive:!0,force:!0})}catch{}await u("failed",{error:`Failed to download credential key: ${$.message}`,endTime:Date.now()}),process.exitCode=1;return}se(te.blue(`Initiating ${s==="ios"?"TestFlight":"Google Play"} submission...`));let T=!1,R;try{if(s==="ios"){if(!_){let U=await Pt({message:"Enter App Store Connect Key ID (e.g. 2X948D...):",validate:G=>G.length>0?void 0:"Key ID is required"});if(Ve(U)){await u("failed",{error:"Submission cancelled while entering ASC Key ID.",endTime:Date.now()}),process.exitCode=1;return}_=U}if(!S||S==="undefined"){let U=await Pt({message:"Enter App Store Connect Issuer ID (Found on ASC Keys page):",validate:G=>G.length>0?void 0:"Issuer ID is required"});if(Ve(U)){await u("failed",{error:"Submission cancelled while entering ASC Issuer ID.",endTime:Date.now()}),process.exitCode=1;return}S=U}se(`Using ASC Key ID: ${_}`),se(`Using ASC Issuer ID: ${S}`);let $=l?await Na(k,D,S,_,m,l):await Ca(k,D,S,_,m);Ui(`${s==="ios"?"App Store":"Google Play"} submission successful!`),T=!0}else R=await Ua(k,D,I||"internal",p,L||"completed",w,B,o),Ui("Google Play submission successful!"),T=!0}catch($){Z(`Submission failed: ${$.message}`),await u("failed",{error:$.message,endTime:Date.now()}),lt(e,{status:"failed",projectId:r,submitId:c,platform:s,profile:o,buildId:j?.buildId||e.buildId,artifactName:j?.artifactName,error:$.message,dashboardUrl:c?et(c,r):void 0}),process.exitCode=1}finally{T&&(await u("success",{endTime:Date.now(),versionCode:R?.versionCode,track:I,releaseStatus:L}),lt(e,{status:"success",projectId:r,submitId:c,platform:s,profile:o,buildId:j?.buildId||e.buildId,artifactName:j?.artifactName,versionCode:R?.versionCode,track:I,releaseStatus:L,dashboardUrl:c?et(c,r):void 0})),Ga(K),k&&k.includes(`${f.nameLower}-artifact-`)}}function da(e){let t=`./${f.configFileName}`;if(X.existsSync(t))try{return JSON.parse(X.readFileSync(t,"utf-8"))}catch(i){return Z(`Failed to read ${f.configFileName}: ${i.message}`),null}return e.projectId?{projectId:e.projectId}:(Z(`No ${f.configFileName} found. Run \`${f.nameLower} init\` or \`${f.nameLower} link\` first.`),null)}async function ca(e,t,i){let n=i.projectId||e.projectId;if(!n){Z(`${f.configFileName} is missing projectId.`),process.exitCode=1;return}let r=i.submitId||Mi.randomUUID(),o=!!i.latest||!i.buildId,s=pa({...i,latest:o,profile:t,projectId:n,submitId:r}),l={projectId:n,submitId:r,platform:"ios",profile:t,latest:o,buildId:i.buildId,credentialId:i.credentialId,status:"pending",source:"cli",submitArgs:process.argv.slice(3).join(" "),runnerArgs:s,runnerCommand:[f.nameLower,"submit",...s].map(ba).join(" "),appName:e.name,startTime:Date.now()},a=ze();a.start("Queuing iOS submit on macOS runner...");try{let d=await C.post("/submissions",l),c=d.data?.submission||d.data?.submit||{},u=d.data?.dashboardUrl||et(r,n);a.stop("iOS submit queued"),se(`Submission ID: ${te.cyan(r)}`),se(`Dashboard: ${te.blue.underline(u)}`),lt(i,{status:"pending",projectId:n,submitId:r,platform:"ios",profile:t,latest:o,buildId:i.buildId,dashboardUrl:u}),await fa(n,r,i)}catch(d){a.stop("Could not queue iOS submit"),Z(ha(d)),process.exitCode=1}}async function ua(e,t,i,n,r,o={}){let s=r.submitId||Mi.randomUUID(),l=!!r.latest||!r.buildId,a={projectId:t,submitId:s,platform:i,profile:n,latest:l,buildId:r.buildId,credentialId:r.credentialId,status:"running",source:"cli-direct",submitArgs:process.argv.slice(3).join(" "),appName:e.name,startTime:Date.now(),...o};try{let d=await C.post("/submissions",a),c=d.data?.submission||d.data?.submit||{},u=d.data?.dashboardUrl||c.dashboardUrl||et(s,t);return se(`Submission ID: ${te.cyan(s)}`),se(`Dashboard: ${te.blue.underline(u)}`),lt(r,{status:"running",projectId:t,submitId:s,platform:i,profile:n,latest:l,buildId:r.buildId,dashboardUrl:u}),s}catch(d){let c=d.response?.data?.message||d.response?.data?.error||d.message;return se(te.yellow(`Could not create submission tracking record: ${c}`)),null}}function pa(e){let t=["--local","--submit-id",e.submitId,"--project-id",e.projectId,"--platform","ios","--profile",e.profile||"production"];return e.buildId?t.push("--build-id",e.buildId):t.push("--latest"),e.credentialId&&t.push("--credential-id",e.credentialId),e.quiet&&t.push("--quiet"),e.jsonOutput&&t.push("--json-output",e.jsonOutput),t.filter(i=>i!=null&&i!=="")}async function fa(e,t,i){let n=ze(),r=0,o=0;for(i.quiet||n.start("Waiting for iOS submit runner...");;)try{let s=await C.get(`/submissions/${e}/${t}`),l=s.data?.submission||s.data?.submit||s.data,a=String(l?.status||"pending").toLowerCase();r=0;let d=Array.isArray(l?.logs)?l.logs:[];for(let c=o;c<d.length;c++){let u=d[c];u&&console.log(te.dim(String(u)))}if(o=d.length,["success","completed","succeeded"].includes(a)){i.quiet||n.stop("iOS submit completed"),Ui("App Store submission successful!"),lt(i,{status:"success",projectId:e,submitId:t,platform:"ios",profile:l?.profile||i.profile||"production",buildId:l?.buildId||i.buildId,artifactName:l?.artifactName,dashboardUrl:l?.dashboardUrl||et(t,e)});return}if(["failed","error","cancelled","canceled"].includes(a)){i.quiet||n.stop("iOS submit failed");let c=l?.error||l?.message||"Unknown iOS submit failure.";Z(c),lt(i,{status:"failed",projectId:e,submitId:t,platform:"ios",profile:l?.profile||i.profile||"production",buildId:l?.buildId||i.buildId,artifactName:l?.artifactName,error:c,dashboardUrl:l?.dashboardUrl||et(t,e)}),process.exitCode=1;return}i.quiet||n.message(`iOS submit ${a}...`),await Li(oa)}catch(s){if(r++,r>=sa){i.quiet||n.stop("Lost connection to iOS submit status"),Z(`Could not fetch iOS submit status after ${r} attempts: ${s.message}`),process.exitCode=1;return}await Li(Math.min(2e3*r,15e3))}}async function ma(e,t,i){let n;for(let r=1;r<=3;r++)try{await C.patch(`/submissions/${e}/${t}`,i);return}catch(o){if(n=o,r>=3||!ga(o))break;await Li(1e3*r)}mr.warn(te.dim(`Could not report submission status: ${n?.message||n}`))}function ga(e){let t=e.response?.status;return!t||t===408||t===409||t===425||t===429||t>=500}function ha(e){let t=e.response?.status,i=e.response?.data?.message||e.response?.data?.error;return t===404||t===405?["Managed iOS submit is not enabled on this Mach API yet.","Deploy the API/dashboard submission orchestration endpoint, then retry the same command.","Expected API: POST /submissions and GET/PATCH /submissions/:projectId/:submitId."].join(`
+`):i||e.message||String(e)}function et(e,t){if(!e)return je;let i=t?`?projectId=${encodeURIComponent(t)}`:"";return`${je}/submissions/${e}${i}`}function lt(e,t){if(!e.jsonOutput)return;let i=pe.resolve(e.jsonOutput),n={...t,url:t.url||t.dashboardUrl||et(t.submitId,t.projectId),updatedAt:new Date().toISOString()};try{let r=pe.dirname(i);r&&r!=="."&&X.mkdirSync(r,{recursive:!0}),X.writeFileSync(i,JSON.stringify(n,null,2))}catch(r){mr.warn(te.yellow(`Could not write submission metadata JSON: ${r.message}`))}}function ya(e,t){return t&&e.find(i=>i.credentialId===t||i.id===t||i.keyId===t||i.meta?.keyId===t)||null}function Sa(e,t){let i=e.filter(n=>[n.bundleId,n.bundleIdentifier,n.appIdentifier,n.meta?.bundleId,n.meta?.bundleIdentifier,n.meta?.appIdentifier].filter(Boolean).map(String).includes(t));return i.length===1?i[0]:null}function Ea(){return process.env.CI==="true"||process.env.CI==="1"||!process.stdin.isTTY}function Li(e){return new Promise(t=>setTimeout(t,e))}function ba(e){return/^[a-zA-Z0-9_./:=@-]+$/.test(e)?e:`'${e.replace(/'/g,"'\\''")}'`}function Aa(e,t){if(e.submit?.[t]?.android?.package)return e.submit[t].android.package;let i=Yi(e,t);if(i)return i;let n=pe.join(process.cwd(),"app.json");if(X.existsSync(n))try{return JSON.parse(X.readFileSync(n,"utf-8")).expo?.android?.package}catch{}let r=pe.join(process.cwd(),"app.config.json");if(X.existsSync(r))try{let o=JSON.parse(X.readFileSync(r,"utf-8"));return o.expo?.android?.package||o.android?.package}catch{}}function Ia(e,t){let i=e.filter(o=>Xt(o)===t);if(i.length>0)return i;let n=e.filter(o=>{let s=Xt(o);return!s||s==="*"});return e.length>0&&e.length===n.length?n:[]}function _a(e,t){return e.submit?.[t]?.ios?.bundleIdentifier?e.submit[t].ios.bundleIdentifier:e.submit?.[t]?.ios?.bundleId?e.submit[t].ios.bundleId:Ji(e,t)}function Pa(e,t,i){let n=e.submit?.[t]?.ios||{},r=e.submit?.production?.ios||{},o=i.sshHost||n.sshHost||r.sshHost||process.env.MACH_IOS_SUBMIT_SSH_HOST;return o?{sshHost:o,sshUser:i.sshUser||n.sshUser||r.sshUser||process.env.MACH_IOS_SUBMIT_SSH_USER||process.env.USER||"ubuntu",sshKey:i.sshKey||n.sshKey||r.sshKey||process.env.MACH_IOS_SUBMIT_SSH_KEY}:null}function $a(e,t,i){let n=i||e.submit?.[t]?.android?.releaseStatus||e.submit?.production?.android?.releaseStatus||"completed";return wa(n)}function wa(e){let t=aa[String(e).trim().toLowerCase()];if(!t)throw new Error(`Invalid Android release status "${e}". Use completed, draft, halted, or inProgress.`);return t}function Da(e,t,i){let n=i??e.submit?.[t]?.android?.rollout??e.submit?.[t]?.android?.userFraction??e.submit?.[t]?.android?.rolloutFraction??e.submit?.production?.android?.rollout??e.submit?.production?.android?.userFraction??e.submit?.production?.android?.rolloutFraction;if(n==null||n==="")return;let r=Number(n);if(!Number.isFinite(r)||r<=0||r>=1)throw new Error(`Invalid Android rollout fraction "${n}". Use a number greater than 0 and less than 1, for example 0.1.`);return r}function Ra(e,t,i){let n=i??e.submit?.[t]?.android?.changesNotSentForReview??e.submit?.[t]?.android?.changes_not_sent_for_review??e.submit?.production?.android?.changesNotSentForReview??e.submit?.production?.android?.changes_not_sent_for_review??!1;return n===!0||n==="true"||n==="1"}function va(e,t){if(e==="inProgress"&&t===void 0)throw new Error("Google Play staged rollout requires --rollout <fraction> when --release-status inProgress is used.");if(e!=="inProgress"&&e!=="halted"&&t!==void 0)throw new Error("Android rollout fraction can only be used with --release-status inProgress or halted.")}async function Oa(e,t,i,n){let r=i.buildId?"id":i.latest?"latest":null;if(!r){let s=await ki({message:"Select artifact source:",options:[{value:"latest",label:`Latest Production Build (${f.name})`},{value:"id",label:`Input Build ID (${f.name})`},{value:"url",label:"Remote URL"},{value:"local",label:"Local File Path"}]});if(Ve(s))return xi("Operation cancelled"),null;r=s}if(r==="local"){let s=await Pt({message:"Enter path to artifact (.ipa/.aab):",validate:l=>{if(!X.existsSync(l))return"File not found";if(t==="ios"&&!l.endsWith(".ipa"))return"Must be an .ipa file";if(t==="android"&&!l.endsWith(".aab"))return"Must be an .aab file"}});return Ve(s)?null:{filePath:s,source:"local"}}let o=ze();if(r==="latest"){let s=i.profile||i.buildProfile;o.start(`Fetching latest${s?` ${s}`:""} build...`);try{let l=await C.get(`/builds/${e}`,{params:{limit:50}});if(l.data.status!=="success")throw new Error(l.data.message);let a=l.data.builds||[],d=s?.toLowerCase(),c=h=>h.platform?.toLowerCase()===t.toLowerCase()&&h.status?.toLowerCase()==="success",u=h=>d?[h.buildProfile,h.profile,h.profileName,h.buildType].filter(Boolean).some(K=>String(K).toLowerCase()===d):!0,p=a.filter(h=>c(h)&&u(h)),m=p.find(h=>h.buildType?.toLowerCase()==="store"||h.distribution?.toLowerCase()==="store")||p[0],I=a.some(h=>h.platform?.toLowerCase()===t.toLowerCase()&&h.status?.toLowerCase()==="success");if(!m)return o.stop("No suitable build found"),Z(s&&I?`No successful ${t} builds found for profile "${s}".`:"No successful builds found for this platform."),null;o.stop(`Found build: ${m.buildId}`);let L=m.artifacts||[];if(L.length===0||L.every(h=>!(h.url||h.downloadUrl)))try{let h=await C.get(`/builds/${e}/${m.buildId}/artifacts`);h.data.status==="success"&&h.data.artifacts?.length>0?(L=h.data.artifacts.map(K=>({...K,url:K.url||K.downloadUrl})),console.log(te.cyan(`  [RECOVERY] Fetched ${L.length} artifact(s) with download URLs.`))):console.log(te.yellow("  [RECOVERY] /artifacts endpoint returned 0 artifacts."))}catch(h){console.log(te.red(`  [RECOVERY] /artifacts fetch failed: ${h.message}`))}let B=t==="ios",k=L.find(h=>{let K=(h.type||"").toLowerCase(),_=(h.name||"").toLowerCase();if(console.log(te.dim(`    - Checking: ${h.name} (Type: ${h.type}, HasLink: ${!!(h.url||h.downloadUrl)})`)),K)return K===(B?"ipa":"aab");let S=B?".ipa":".aab",O=(h.url||h.downloadUrl||"").toLowerCase();return _.endsWith(S)||O.includes(S)});if(!k||!(k.url||k.downloadUrl))return Z("Build found but artifact URL is missing."),null;let j=k.url||k.downloadUrl;return{filePath:await Ci(j,B?"ios":"android"),buildId:m.buildId,artifactName:k.name,source:"latest"}}catch(l){return o.stop("Fetch failed"),Z(`API Error: ${l.message}`),null}}if(r==="id"){let s=i.buildId||await Pt({message:"Enter Build ID:",validate:l=>l.length<5?"Invalid ID":void 0});if(Ve(s))return null;o.start("Fetching build...");try{let l=await C.get(`/build/${s}`);if(l.data.status!=="success")throw new Error(l.data.message);let a=l.data.build;if(!a)throw new Error("Build not found");let d=t==="ios",c=a.artifacts?.find(u=>{if(u.type)return u.type===(d?"ipa":"aab");let p=d?".ipa":".aab";return u.name&&u.name.endsWith(p)||u.url&&u.url.includes(p)});return!c||!c.url?(o.stop("Missing artifact"),Z("Artifact URL not found on build record."),null):(o.stop(`Found build: ${a.buildId}`),{filePath:await Ci(c.url,d?"ios":"android"),buildId:a.buildId||String(s),artifactName:c.name,source:"id"})}catch(l){return o.stop("Fetch failed"),Z(l.message),null}}if(r==="url"){let s=await Pt({message:"Enter Artifact URL:",validate:l=>l.startsWith("http")?void 0:"Must be a valid URL"});return Ve(s)?null:{filePath:await Ci(s,t),source:"url"}}return null}async function Ci(e,t,i=3){let n=ze();n.start("Downloading artifact...");let r=X.mkdtempSync(pe.join(tt.tmpdir(),`${f.nameLower}-artifact-`)),o=`app.${t==="ios"?"ipa":"aab"}`,s=pe.join(r,o);for(let l=1;l<=i;l++)try{l>1&&(n.message(`Downloading artifact (Retry ${l}/${i})...`),await new Promise(c=>setTimeout(c,2e3*l)));let a=X.createWriteStream(s),d=await gr({url:e,method:"GET",responseType:"stream",timeout:6e4});return await new Promise((c,u)=>{d.data.pipe(a);let p=!1;d.data.on("error",m=>{p||(p=!0,a.close(),u(m))}),a.on("finish",()=>{p||c()}),a.on("error",m=>{p||(p=!0,u(m))})}),n.stop("Download complete"),s}catch(a){if(l===i)throw n.stop("Download failed"),a}throw new Error("Download failed after retries")}async function Ca(e,t,i,n,r){let o=ze();if(r&&se(`Bundle ID: ${te.green(r)}`),!i||!n)throw Z(`Missing credentials: issuerId=${i}, keyId=${n}. Check your Dashboard.`),new Error("Missing ASC API Key Metadata (IssuerID or KeyID)");let s=yr(t,i,n),l=Ba();return o.start("Uploading to TestFlight (pilot)..."),new Promise((a,d)=>{let c=ra(l.command,["pilot","upload","--ipa",e,"--api_key_path",s,"--skip_submission","true","--skip_waiting_for_build_processing","true"],{stdio:"inherit",env:l.env});c.on("close",u=>{if(u!==0){o.stop("Pilot failed");try{X.unlinkSync(s)}catch{}d(new Error(`fastlane pilot failed with exit code ${u??"unknown"}.`))}else{o.stop("IPA uploaded to TestFlight");try{X.unlinkSync(s)}catch{}a({})}}),c.on("error",u=>{try{X.unlinkSync(s)}catch{}o.stop("Pilot execution error"),d(Ha(u))})})}async function Na(e,t,i,n,r,o){let s=ze();if(r&&se(`Bundle ID: ${te.green(r)}`),!i||!n)throw Z(`Missing credentials: issuerId=${i}, keyId=${n}. Check your Dashboard.`),new Error("Missing ASC API Key Metadata (IssuerID or KeyID)");let l=yr(t,i,n),a=`${o.sshUser}@${o.sshHost}`,d=Ta(o),c=ka(o),u="",p="";try{if(s.start(`Preparing remote iOS submit runner (${a})...`),u=xa("ssh",[...d,"mktemp -d /tmp/mach-submit.XXXXXX"]).trim(),!u)throw new Error("Remote runner did not return a temp directory.");s.stop(`Remote runner ready: ${a}`),s.start("Uploading IPA and App Store Connect key to remote runner..."),Ni("scp",[...c,e,`${a}:${u}/app.ipa`],"IPA upload to remote runner"),Ni("scp",[...c,l,`${a}:${u}/api_key.json`],"ASC key upload to remote runner"),p=pe.join(tt.tmpdir(),`${f.nameLower}-ios-submit-${Date.now()}.sh`),X.writeFileSync(p,La(u)),Ni("scp",[...c,p,`${a}:${u}/submit.sh`],"submit script upload to remote runner"),s.stop("Remote submit inputs uploaded"),s.start("Uploading to TestFlight on remote runner...");let m=`chmod +x ${$t(`${u}/submit.sh`)} && bash ${$t(`${u}/submit.sh`)}`,I=Qe("ssh",[...d,m],{stdio:"inherit"});if(I.error)throw Bi("ssh",I.error);if(I.status!==0)throw new Error(`Remote iOS submit failed with exit code ${I.status}.`);return s.stop("IPA uploaded to TestFlight"),{apiKeyJsonPath:null}}catch(m){throw s.stop("Remote iOS submit failed"),m}finally{try{X.unlinkSync(l)}catch{}if(p)try{X.unlinkSync(p)}catch{}if(u)try{Qe("ssh",[...d,`rm -rf ${$t(u)}`],{stdio:"ignore"})}catch{}}}function yr(e,t,i){let n=X.readFileSync(e,"utf8"),r;try{r=Mi.createPrivateKey(n).export({type:"pkcs8",format:"pem"})}catch{se("Key normalization failed, falling back to manual re-wrapping..."),r=`-----BEGIN PRIVATE KEY-----
 ${(n.replace(/-----BEGIN[^-]*-----/g,"").replace(/-----END[^-]*-----/g,"").replace(/\s+/g,"").match(/.{1,64}/g)||[]).join(`
 `)}
------END PRIVATE KEY-----`}let o=pe.join(tt.tmpdir(),`api_key_${i}_${Date.now()}.json`),s={key_id:i,issuer_id:t,key:r,in_house:!1};return q.writeFileSync(o,JSON.stringify(s,null,2)),o}function Ta(e){let t=["-o","StrictHostKeyChecking=no","-o","ServerAliveInterval=30"];return e.sshKey&&t.push("-i",e.sshKey),t.push(`${e.sshUser}@${e.sshHost}`),t}function ka(e){let t=["-o","StrictHostKeyChecking=no","-o","ServerAliveInterval=30"];return e.sshKey&&t.push("-i",e.sshKey),t}function xa(e,t){let i=Qe(e,t,{encoding:"utf-8",stdio:["ignore","pipe","inherit"]});if(i.error)throw Bi(e,i.error);if(i.status!==0)throw new Error(`${e} failed with exit code ${i.status}.`);return i.stdout||""}function Ni(e,t,i){let n=Qe(e,t,{stdio:"inherit"});if(n.error)throw Bi(e,n.error);if(n.status!==0)throw new Error(`${i} failed with exit code ${n.status}.`)}function Bi(e,t){return t?.code==="ENOENT"?new Error(`${e} was not found on this machine. Install OpenSSH client tools or run iOS submit directly on the macOS runner.`):t}function $t(e){return`'${e.replace(/'/g,"'\\''")}'`}function La(e){let t=$t(`${e}/app.ipa`),i=$t(`${e}/api_key.json`);return`#!/bin/bash
+-----END PRIVATE KEY-----`}let o=pe.join(tt.tmpdir(),`api_key_${i}_${Date.now()}.json`),s={key_id:i,issuer_id:t,key:r,in_house:!1};return X.writeFileSync(o,JSON.stringify(s,null,2)),o}function Ta(e){let t=["-o","StrictHostKeyChecking=no","-o","ServerAliveInterval=30"];return e.sshKey&&t.push("-i",e.sshKey),t.push(`${e.sshUser}@${e.sshHost}`),t}function ka(e){let t=["-o","StrictHostKeyChecking=no","-o","ServerAliveInterval=30"];return e.sshKey&&t.push("-i",e.sshKey),t}function xa(e,t){let i=Qe(e,t,{encoding:"utf-8",stdio:["ignore","pipe","inherit"]});if(i.error)throw Bi(e,i.error);if(i.status!==0)throw new Error(`${e} failed with exit code ${i.status}.`);return i.stdout||""}function Ni(e,t,i){let n=Qe(e,t,{stdio:"inherit"});if(n.error)throw Bi(e,n.error);if(n.status!==0)throw new Error(`${i} failed with exit code ${n.status}.`)}function Bi(e,t){return t?.code==="ENOENT"?new Error(`${e} was not found on this machine. Install OpenSSH client tools or run iOS submit directly on the macOS runner.`):t}function $t(e){return`'${e.replace(/'/g,"'\\''")}'`}function La(e){let t=$t(`${e}/app.ipa`),i=$t(`${e}/api_key.json`);return`#!/bin/bash
 set -euo pipefail
 
 export PATH="/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin:$HOME/.local/share/fastlane/3.4.0/bin:$PATH"
@@ -1138,26 +1144,26 @@ fastlane pilot upload \\
   --api_key_path ${i} \\
   --skip_submission true \\
   --skip_waiting_for_build_processing true
-`}async function Ua(e,t,i="internal",n,r="completed",o,s=!1,l="production"){let a=ze();if(!n||n==="*")throw new Error("Android package name is required for Google Play submission.");let d=o!==void 0?` (${o} rollout)`:"";a.start(`Uploading to Google Play ${i} track with ${r} release status${d}...`);try{let c=JSON.parse(q.readFileSync(t,"utf-8"));Ma(c);let u=await hn({packageName:n,serviceAccount:c,aabPath:e,track:i,releaseStatus:r,userFraction:o,changesNotSentForReview:s});return a.stop(`AAB uploaded to ${i} track (versionCode ${u.versionCode})`),u}catch(c){throw a.stop("Google Play upload failed"),new Error(ja(c,i,n,l))}}function Ma(e){if(!e?.client_email||!e?.private_key)throw new Error("Invalid Google service account JSON: missing client_email or private_key.")}function Ti(){let e=process.env.HOME||tt.homedir(),t=process.env.FASTLANE_GEM_HOME||pe.join(e,".local/share/fastlane/3.4.0"),i=[process.env.FASTLANE_BIN_DIR,"/usr/local/opt/ruby/bin","/opt/homebrew/opt/ruby/bin","/usr/local/bin","/opt/homebrew/bin","/usr/local/Cellar/fastlane/2.227.0/libexec/bin",pe.join(t,"bin"),process.env.PATH].filter(Boolean).join(":");return{...process.env,PATH:i,GEM_HOME:t,GEM_PATH:[t,"/usr/local/Cellar/fastlane/2.227.0/libexec",process.env.GEM_PATH].filter(Boolean).join(":"),FASTLANE_INSTALLED_VIA_HOMEBREW:"true",FASTLANE_SKIP_UPDATE_CHECK:"1",FASTLANE_HIDE_CHANGELOG:"1",LANG:process.env.LANG||"en_US.UTF-8",LC_ALL:process.env.LC_ALL||"en_US.UTF-8",CI:process.env.CI||"1"}}function Ba(){let e=Ti(),t=fr(e);if(t)return t;if(process.env.MACH_SKIP_FASTLANE_INSTALL!=="1"){Fa(e);let i=fr(Ti());if(i)return i}return{command:"fastlane",env:Ti()}}function fr(e){let t=process.env.HOME||tt.homedir(),i=[process.env.FASTLANE_BINARY,"/usr/local/bin/fastlane","/opt/homebrew/bin/fastlane","/usr/local/Cellar/fastlane/2.227.0/libexec/bin/fastlane",pe.join(process.env.FASTLANE_GEM_HOME||pe.join(t,".local/share/fastlane/3.4.0"),"bin/fastlane"),"fastlane"].filter(Boolean);for(let n of i){if(n.includes("/")&&!q.existsSync(n))continue;if(!Qe(n,["--version"],{env:e,stdio:"ignore"}).error)return{command:n,env:e}}return null}function Fa(e){let t=Qe("gem",["--version"],{env:e,stdio:"ignore"});if(t.error||t.status!==0)return;let i=process.env.HOME||tt.homedir(),n=process.env.FASTLANE_GEM_HOME||pe.join(i,".local/share/fastlane/3.4.0"),r=pe.join(n,"bin");q.mkdirSync(r,{recursive:!0}),se(te.dim("fastlane not found. Installing fastlane into the local Mach runner cache..."));let o=Qe("gem",["install","fastlane","-NV","--install-dir",n,"--bindir",r],{env:{...e,GEM_HOME:n,GEM_PATH:[n,e.GEM_PATH].filter(Boolean).join(":")},stdio:"inherit"});(o.error||o.status!==0)&&se(te.yellow("Automatic fastlane install failed; Mach will try PATH resolution once more."))}function Ha(e){return e?.code!=="ENOENT"?e:new Error(["fastlane was not found on PATH.","Mach submit uses Fastlane for iOS TestFlight/App Store uploads.","Run iOS submit on a macOS runner with Fastlane, or expose it via FASTLANE_BINARY / FASTLANE_BIN_DIR.","Example: gem install fastlane -NV"].join(`
+`}async function Ua(e,t,i="internal",n,r="completed",o,s=!1,l="production"){let a=ze();if(!n||n==="*")throw new Error("Android package name is required for Google Play submission.");let d=o!==void 0?` (${o} rollout)`:"";a.start(`Uploading to Google Play ${i} track with ${r} release status${d}...`);try{let c=JSON.parse(X.readFileSync(t,"utf-8"));Ma(c);let u=await hn({packageName:n,serviceAccount:c,aabPath:e,track:i,releaseStatus:r,userFraction:o,changesNotSentForReview:s});return a.stop(`AAB uploaded to ${i} track (versionCode ${u.versionCode})`),u}catch(c){throw a.stop("Google Play upload failed"),new Error(ja(c,i,n,l))}}function Ma(e){if(!e?.client_email||!e?.private_key)throw new Error("Invalid Google service account JSON: missing client_email or private_key.")}function Ti(){let e=process.env.HOME||tt.homedir(),t=process.env.FASTLANE_GEM_HOME||pe.join(e,".local/share/fastlane/3.4.0"),i=[process.env.FASTLANE_BIN_DIR,"/usr/local/opt/ruby/bin","/opt/homebrew/opt/ruby/bin","/usr/local/bin","/opt/homebrew/bin","/usr/local/Cellar/fastlane/2.227.0/libexec/bin",pe.join(t,"bin"),process.env.PATH].filter(Boolean).join(":");return{...process.env,PATH:i,GEM_HOME:t,GEM_PATH:[t,"/usr/local/Cellar/fastlane/2.227.0/libexec",process.env.GEM_PATH].filter(Boolean).join(":"),FASTLANE_INSTALLED_VIA_HOMEBREW:"true",FASTLANE_SKIP_UPDATE_CHECK:"1",FASTLANE_HIDE_CHANGELOG:"1",LANG:process.env.LANG||"en_US.UTF-8",LC_ALL:process.env.LC_ALL||"en_US.UTF-8",CI:process.env.CI||"1"}}function Ba(){let e=Ti(),t=fr(e);if(t)return t;if(process.env.MACH_SKIP_FASTLANE_INSTALL!=="1"){Fa(e);let i=fr(Ti());if(i)return i}return{command:"fastlane",env:Ti()}}function fr(e){let t=process.env.HOME||tt.homedir(),i=[process.env.FASTLANE_BINARY,"/usr/local/bin/fastlane","/opt/homebrew/bin/fastlane","/usr/local/Cellar/fastlane/2.227.0/libexec/bin/fastlane",pe.join(process.env.FASTLANE_GEM_HOME||pe.join(t,".local/share/fastlane/3.4.0"),"bin/fastlane"),"fastlane"].filter(Boolean);for(let n of i){if(n.includes("/")&&!X.existsSync(n))continue;if(!Qe(n,["--version"],{env:e,stdio:"ignore"}).error)return{command:n,env:e}}return null}function Fa(e){let t=Qe("gem",["--version"],{env:e,stdio:"ignore"});if(t.error||t.status!==0)return;let i=process.env.HOME||tt.homedir(),n=process.env.FASTLANE_GEM_HOME||pe.join(i,".local/share/fastlane/3.4.0"),r=pe.join(n,"bin");X.mkdirSync(r,{recursive:!0}),se(te.dim("fastlane not found. Installing fastlane into the local Mach runner cache..."));let o=Qe("gem",["install","fastlane","-NV","--install-dir",n,"--bindir",r],{env:{...e,GEM_HOME:n,GEM_PATH:[n,e.GEM_PATH].filter(Boolean).join(":")},stdio:"inherit"});(o.error||o.status!==0)&&se(te.yellow("Automatic fastlane install failed; Mach will try PATH resolution once more."))}function Ha(e){return e?.code!=="ENOENT"?e:new Error(["fastlane was not found on PATH.","Mach submit uses Fastlane for iOS TestFlight/App Store uploads.","Run iOS submit on a macOS runner with Fastlane, or expose it via FASTLANE_BINARY / FASTLANE_BIN_DIR.","Example: gem install fastlane -NV"].join(`
 `))}function ja(e,t,i,n="production"){let r=e?.message||String(e);if(/changesNotSentForReview/i.test(r))return["Google Play rejected the commit because this change may need explicit review handling.",`Package: ${i||"unknown"} | Track: ${t}`,`Retry with: ${f.nameLower} submit --latest --platform android --profile ${n} --track ${t} --changes-not-sent-for-review`,"Then send the change for review from Google Play Console if required."].join(`
 `);if(/caller does not have permission|permission denied|insufficient permissions|not authorized/i.test(r))return["Google Play rejected the service account permissions.",`Package: ${i||"unknown"} | Track: ${t}`,"Grant this service account access to the app in Play Console with release permissions, then retry."].join(`
 `);if(/package.*not found|application.*not found|no application was found/i.test(r))return["Google Play could not find this package for the selected service account.",`Package: ${i||"unknown"} | Track: ${t}`,"Check android.package / submit.<profile>.android.package and make sure the app exists in this Play Console account."].join(`
 `);if(/only releases with status draft|draft app/i.test(r))return["Google Play requires a draft release for this app state.",`Package: ${i||"unknown"} | Track: ${t}`,`Retry with: ${f.nameLower} submit --latest --platform android --profile ${n} --track ${t} --release-status draft`].join(`
 `);if(r.includes("does not allow any existing users to upgrade"))return["Google Play rejected this release because the uploaded AAB is not an upgrade for existing users.",`Package: ${i||"unknown"} | Track: ${t}`,"Build a new Android artifact with a higher versionCode, then submit that build.",`Recommended: ${f.nameLower} build --platform android --profile ${n} --auto-version`,`Then: ${f.nameLower} submit --latest --platform android --profile ${n} --track ${t}`].join(`
 `);if(/version code \d+ has already been used/i.test(r))return[r.match(/version code \d+ has already been used[^\n]*/i)?.[0]||"Version code has already been used.",`Package: ${i||"unknown"} | Track: ${t}`,"Build a new Android artifact with a higher versionCode, then submit that build.",`Recommended: ${f.nameLower} build --platform android --profile ${n} --auto-version`].join(`
-`);let o=r.match(/Google Api Error:[^\n]+/)||r.match(/Google Play API Error:[^\n]+/);return o?o[0]:r||"Google Play submission failed"}function Ga(e){try{q.existsSync(e)&&q.rmSync(e,{recursive:!0,force:!0})}catch{}}function Z(e){console.log(te.red(`\u274C ${e}`))}function se(e){console.log(te.gray(`\u2022 ${e}`))}function Ui(e){console.log(te.green(`\u2713 ${e}`))}import{spinner as Ka,log as it,outro as Va}from"@clack/prompts";import Fi from"chalk";import Sr from"fs";import za from"path";import{execSync as Wa}from"child_process";import Ya from"adm-zip";import Ja from"axios";import{randomUUID as qa}from"crypto";async function Er(e){it.info(Fi.magenta("\u{1F680} Starting Over-The-Air (OTA) Update via Mach..."));let t=Te();(!t||!t.projectId)&&(it.error(`No ${f.configFileName} found or missing projectId. Run \`mach link\` first.`),process.exit(1));let i=t.projectId,n=e.branch||"production",r="1.0.0";try{r=JSON.parse(Sr.readFileSync("./package.json","utf-8")).version||"1.0.0"}catch{it.warn("Could not read package.json version. Defaulting to 1.0.0")}let o=Ka();o.start(`Compiling JavaScript bundles for OTA (Channel: ${n}, Runtime: ${r})...`);try{Wa("npx expo export --platform all",{stdio:"ignore"})}catch(d){o.stop("Compilation failed."),it.error(`Failed to export JS bundles using Expo: ${d.message}`),process.exit(1)}o.message("Zipping artifact payload...");let s=za.join(process.cwd(),"dist");Sr.existsSync(s)||(o.stop("Missing dist folder."),it.error("The `dist` directory was not created. Export failed."),process.exit(1));let l=new Ya;l.addLocalFolder(s,"dist");let a=l.toBuffer();o.message("Uploading payload to Mach Cloud...");try{let d=qa(),c=await C.post("/builds/source-upload-url",{projectId:i,buildId:d});if(c.data.status!=="success")throw new Error("Could not secure upload bucket URL");let{uploadUrl:u,key:p}=c.data;await Ja.put(u,a,{headers:{"Content-Type":"application/zip"},maxBodyLength:1/0,maxContentLength:1/0}),o.message(`Promoting Update to ${n}...`),await C.post("/updates/publish",{projectId:i,channelName:n,runtimeVersion:r,platform:"android",updateId:`${d}-android`,manifestKey:p}),await C.post("/updates/publish",{projectId:i,channelName:n,runtimeVersion:r,platform:"ios",updateId:`${d}-ios`,manifestKey:p}),o.stop("Update Live!"),Va(Fi.green(`\u2713 OTA Update natively shipped to the '${n}' channel.`)),it.info(Fi.dim(`Any app running runtime '${r}' will download this bundle smoothly.`))}catch(d){o.stop("Update failed during Cloud Sync."),it.error(`Upload error: ${d.message}`),process.exit(1)}}import{intro as Xa,outro as br,log as dt}from"@clack/prompts";import Le from"chalk";async function Ar(){Xa(Le.blue(`${f.name} CLI - User Profile`));let e=ye();if(!e){dt.warn(Le.yellow("You are not logged in.")),dt.info(`Run \`${f.nameLower} login\` to authenticate.`),br();return}dt.info(`${Le.bold("Logged in as:")} ${Le.green(e.email)}`);try{await C.get("/projects");let i=ye().token.split(".");if(i.length===3){let n=JSON.parse(Buffer.from(i[1],"base64").toString());if(n.exp){let r=new Date(n.exp*1e3),o=new Date,s=r.getTime()-o.getTime();if(s>0){let l=Math.round(s/6e4),a=(l/60).toFixed(1);dt.info(`${Le.bold("Token status:")} Valid (Expires in ~${a}h / ${l}m)`)}else dt.warn(`${Le.bold("Token status:")} ${Le.red("Expired")} (Auto-refresh failed)`)}}}catch{dt.warn(`${Le.bold("Token status:")} ${Le.red("Unreachable")} (Session might be truly expired)${Lt}`)}br(Le.blue("---"))}import{spawn as el}from"child_process";import{log as We}from"@clack/prompts";import Ie from"chalk";import tl from"fs";import Za from"net";async function Qa(e){return new Promise(t=>{let i=Za.createServer();i.once("error",n=>{n.code==="EADDRINUSE"?t(!0):t(!1)}),i.once("listening",()=>{i.close(),t(!1)}),i.listen(e,"0.0.0.0")})}async function Ir(e,t=20){let i=e;for(;i<e+t;){if(!await Qa(i))return i;i++}throw new Error(`Could not find an available port after ${t} attempts starting from ${e}.`)}var _r=async e=>{We.info(Ie.blue(`Starting ${f.name} Dev Orchestrator...`));let t=Te(),i=e.buildProfile||"development",n=t?Ge(t,i):null,r={...process.env};if(t?.projectId)try{We.info(Ie.dim(`Fetching managed secrets for profile: ${i}...`));let u=await C.get(`/projects/${t.projectId}/secrets/export?env=${i}`);u.data?.status==="success"&&u.data.secrets&&(Object.assign(r,u.data.secrets),We.info(Ie.magenta(`\u2713 Injected secrets from ${f.name} Dashboard.`)))}catch{We.warn("Could not fetch managed secrets. Running with local env only.")}t&&Object.assign(r,nt(t,f.envPrefix)),n&&(Object.assign(r,nt(n,`${f.envPrefix}PROFILE_`)),n.env&&Object.assign(r,n.env));let o=!1;try{let u=JSON.parse(tl.readFileSync("package.json","utf-8"));o=!!(u.dependencies?.expo||u.devDependencies?.expo)}catch{We.warn("Could not parse package.json. Defaulting to Bare React Native mode.")}let s=Number(e.port||n?.port||8081),l=await Ir(s);l!==s&&We.info(Ie.yellow(`Port ${s} is busy. ${f.name} is using ${l} instead.`));let a=process.platform==="win32"?"npx.cmd":"npx",d=[];if(o?(d=["expo","start","--port",String(l)],e.clear&&d.push("--clear"),e.tunnel&&d.push("--tunnel"),e.lan&&d.push("--lan"),e.localhost&&d.push("--localhost"),e.ios&&d.push("--ios"),e.android&&d.push("--android"),e.web&&d.push("--web")):(d=["react-native","start","--port",String(l)],e.clear&&d.push("--clear")),o){let u=[`${Ie.cyan("i")}  open iOS simulator`,`${Ie.cyan("a")}  open Android emulator/device`,`${Ie.cyan("w")}  open web`,`${Ie.cyan("r")}  reload app`];We.info([Ie.bold("Launch controls"),...u.map(p=>`  ${p}`),"",Ie.dim("Direct launch: mach start --ios | --android | --web"),Ie.dim(`Metro URL: http://localhost:${l}`)].join(`
+`);let o=r.match(/Google Api Error:[^\n]+/)||r.match(/Google Play API Error:[^\n]+/);return o?o[0]:r||"Google Play submission failed"}function Ga(e){try{X.existsSync(e)&&X.rmSync(e,{recursive:!0,force:!0})}catch{}}function Z(e){console.log(te.red(`\u274C ${e}`))}function se(e){console.log(te.gray(`\u2022 ${e}`))}function Ui(e){console.log(te.green(`\u2713 ${e}`))}import{spinner as Ka,log as it,outro as Va}from"@clack/prompts";import Fi from"chalk";import Sr from"fs";import za from"path";import{execSync as Wa}from"child_process";import Ya from"adm-zip";import Ja from"axios";import{randomUUID as Xa}from"crypto";async function Er(e){it.info(Fi.magenta("\u{1F680} Starting Over-The-Air (OTA) Update via Mach..."));let t=Te();(!t||!t.projectId)&&(it.error(`No ${f.configFileName} found or missing projectId. Run \`mach link\` first.`),process.exit(1));let i=t.projectId,n=e.branch||"production",r="1.0.0";try{r=JSON.parse(Sr.readFileSync("./package.json","utf-8")).version||"1.0.0"}catch{it.warn("Could not read package.json version. Defaulting to 1.0.0")}let o=Ka();o.start(`Compiling JavaScript bundles for OTA (Channel: ${n}, Runtime: ${r})...`);try{Wa("npx expo export --platform all",{stdio:"ignore"})}catch(d){o.stop("Compilation failed."),it.error(`Failed to export JS bundles using Expo: ${d.message}`),process.exit(1)}o.message("Zipping artifact payload...");let s=za.join(process.cwd(),"dist");Sr.existsSync(s)||(o.stop("Missing dist folder."),it.error("The `dist` directory was not created. Export failed."),process.exit(1));let l=new Ya;l.addLocalFolder(s,"dist");let a=l.toBuffer();o.message("Uploading payload to Mach Cloud...");try{let d=Xa(),c=await C.post("/builds/source-upload-url",{projectId:i,buildId:d});if(c.data.status!=="success")throw new Error("Could not secure upload bucket URL");let{uploadUrl:u,key:p}=c.data;await Ja.put(u,a,{headers:{"Content-Type":"application/zip"},maxBodyLength:1/0,maxContentLength:1/0}),o.message(`Promoting Update to ${n}...`),await C.post("/updates/publish",{projectId:i,channelName:n,runtimeVersion:r,platform:"android",updateId:`${d}-android`,manifestKey:p}),await C.post("/updates/publish",{projectId:i,channelName:n,runtimeVersion:r,platform:"ios",updateId:`${d}-ios`,manifestKey:p}),o.stop("Update Live!"),Va(Fi.green(`\u2713 OTA Update natively shipped to the '${n}' channel.`)),it.info(Fi.dim(`Any app running runtime '${r}' will download this bundle smoothly.`))}catch(d){o.stop("Update failed during Cloud Sync."),it.error(`Upload error: ${d.message}`),process.exit(1)}}import{intro as qa,outro as br,log as dt}from"@clack/prompts";import Le from"chalk";async function Ar(){qa(Le.blue(`${f.name} CLI - User Profile`));let e=ye();if(!e){dt.warn(Le.yellow("You are not logged in.")),dt.info(`Run \`${f.nameLower} login\` to authenticate.`),br();return}dt.info(`${Le.bold("Logged in as:")} ${Le.green(e.email)}`);try{await C.get("/projects");let i=ye().token.split(".");if(i.length===3){let n=JSON.parse(Buffer.from(i[1],"base64").toString());if(n.exp){let r=new Date(n.exp*1e3),o=new Date,s=r.getTime()-o.getTime();if(s>0){let l=Math.round(s/6e4),a=(l/60).toFixed(1);dt.info(`${Le.bold("Token status:")} Valid (Expires in ~${a}h / ${l}m)`)}else dt.warn(`${Le.bold("Token status:")} ${Le.red("Expired")} (Auto-refresh failed)`)}}}catch{dt.warn(`${Le.bold("Token status:")} ${Le.red("Unreachable")} (Session might be truly expired)${Lt}`)}br(Le.blue("---"))}import{spawn as el}from"child_process";import{log as We}from"@clack/prompts";import Ie from"chalk";import tl from"fs";import Za from"net";async function Qa(e){return new Promise(t=>{let i=Za.createServer();i.once("error",n=>{n.code==="EADDRINUSE"?t(!0):t(!1)}),i.once("listening",()=>{i.close(),t(!1)}),i.listen(e,"0.0.0.0")})}async function Ir(e,t=20){let i=e;for(;i<e+t;){if(!await Qa(i))return i;i++}throw new Error(`Could not find an available port after ${t} attempts starting from ${e}.`)}var _r=async e=>{We.info(Ie.blue(`Starting ${f.name} Dev Orchestrator...`));let t=Te(),i=e.buildProfile||"development",n=t?Ge(t,i):null,r={...process.env};if(t?.projectId)try{We.info(Ie.dim(`Fetching managed secrets for profile: ${i}...`));let u=await C.get(`/projects/${t.projectId}/secrets/export?env=${i}`);u.data?.status==="success"&&u.data.secrets&&(Object.assign(r,u.data.secrets),We.info(Ie.magenta(`\u2713 Injected secrets from ${f.name} Dashboard.`)))}catch{We.warn("Could not fetch managed secrets. Running with local env only.")}t&&Object.assign(r,nt(t,f.envPrefix)),n&&(Object.assign(r,nt(n,`${f.envPrefix}PROFILE_`)),n.env&&Object.assign(r,n.env));let o=!1;try{let u=JSON.parse(tl.readFileSync("package.json","utf-8"));o=!!(u.dependencies?.expo||u.devDependencies?.expo)}catch{We.warn("Could not parse package.json. Defaulting to Bare React Native mode.")}let s=Number(e.port||n?.port||8081),l=await Ir(s);l!==s&&We.info(Ie.yellow(`Port ${s} is busy. ${f.name} is using ${l} instead.`));let a=process.platform==="win32"?"npx.cmd":"npx",d=[];if(o?(d=["expo","start","--port",String(l)],e.clear&&d.push("--clear"),e.tunnel&&d.push("--tunnel"),e.lan&&d.push("--lan"),e.localhost&&d.push("--localhost"),e.ios&&d.push("--ios"),e.android&&d.push("--android"),e.web&&d.push("--web")):(d=["react-native","start","--port",String(l)],e.clear&&d.push("--clear")),o){let u=[`${Ie.cyan("i")}  open iOS simulator`,`${Ie.cyan("a")}  open Android emulator/device`,`${Ie.cyan("w")}  open web`,`${Ie.cyan("r")}  reload app`];We.info([Ie.bold("Launch controls"),...u.map(p=>`  ${p}`),"",Ie.dim("Direct launch: mach start --ios | --android | --web"),Ie.dim(`Metro URL: http://localhost:${l}`)].join(`
 `))}else We.info(Ie.dim(`Metro URL: http://localhost:${l}`));let c=el(a,d,{stdio:"inherit",env:r});return new Promise((u,p)=>{c.on("exit",m=>{m===0?u():p(new Error(`Dev server exited with code ${m}`))}),c.on("error",m=>{p(m)})})};import{log as Ee}from"@clack/prompts";import Re from"chalk";var Pr=async e=>{let t=Te();t||(Ee.error(Re.red(`No ${f.configFileName} found in the current directory.`)),process.exit(1));let i=e.profile||"development",n=Ge(t,i);if(e.json){console.log(JSON.stringify({project:t,resolved:n},null,2));return}Ee.info(Re.bgBlue.white(` Resolved ${f.name} Config [${i}] `)),Ee.info(Re.dim("----------------------------------------")),Ee.info(`${Re.blue("Project ID:")} ${t.projectId}`),Ee.info(`${Re.blue("Name:")} ${t.name}`),Ee.info(`${Re.blue("Scheme:")} ${t.scheme}`),n?(Ee.info(Re.dim(`
 Profile Settings:`)),Ee.info(`${Re.cyan("Distribution:")} ${n.distribution||"none"}`),Ee.info(`${Re.cyan("Development Client:")} ${n.developmentClient||"false"}`),n.env&&Object.keys(n.env).length>0&&(Ee.info(Re.dim(`
 Environment Variables:`)),Object.entries(n.env).forEach(([r,o])=>{Ee.info(`  ${r}=${o}`)}))):Ee.warn(`Profile '${i}' not found.`),Ee.info(Re.dim("----------------------------------------"))};import{log as ve,spinner as Rt,text as $r,select as wr,confirm as il,isCancel as wt,cancel as Dt,outro as vt,note as nl}from"@clack/prompts";import Q from"chalk";import{execSync as rl}from"child_process";async function ol(){try{let e=rl("xcrun devicectl list devices --json-output -",{stdio:["pipe","pipe","pipe"]}).toString();return(JSON.parse(e).result?.devices||[]).filter(n=>n.connectionProperties?.transportType==="wired"||n.connectionProperties?.transportType==="localNetwork").map(n=>({udid:n.identifier,name:n.deviceProperties?.name||"Unknown Device",model:n.hardwareProperties?.marketingName||"iPhone"}))}catch{return[]}}async function sl(e){let t=e.udid,i=e.name,n="";if(!t){let o=Rt();o.start("Scanning for connected iOS devices...");let s=await ol();if(o.stop(s.length>0?`Found ${s.length} device(s)`:"No devices detected"),s.length===1)t=s[0].udid,i=i||s[0].name,n=s[0].model,ve.info(`Detected: ${Q.bold(i)} (${Q.dim(t.substring(0,12)+"...")})`);else if(s.length>1){let l=await wr({message:"Select a device to register:",options:s.map(d=>({value:d.udid,label:`${d.name} (${d.model})`,hint:d.udid.substring(0,12)+"..."}))});if(wt(l)){Dt("Cancelled");return}t=l;let a=s.find(d=>d.udid===t);i=i||a.name,n=a.model}else{ve.info(Q.dim("No connected devices found. Enter UDID manually."));let l=await $r({message:"Device UDID:",placeholder:"00008101-XXXXXXXXXXXX",validate(a){if(a.length<10)return"UDID seems too short"}});if(wt(l)){Dt("Cancelled");return}t=l}}if(!i){let o=await $r({message:"Device name:",placeholder:"Nitesh's iPhone",validate(s){if(s.length===0)return"Name is required"}});if(wt(o)){Dt("Cancelled");return}i=o}let r=Rt();r.start("Registering device...");try{await C.post("/devices",{udid:t,name:i,platform:"ios",model:n||void 0,addedVia:"cli"}),r.stop(Q.green("Device registered!")),ve.info(`  ${Q.bold("Name:")} ${i}`),ve.info(`  ${Q.bold("UDID:")} ${Q.dim(t)}`)}catch(o){r.stop(Q.red("Failed to register device")),ve.error(o.response?.data?.message||o.message)}vt(Q.blue("---"))}async function al(){let e=Rt();e.start("Fetching registered devices...");try{let i=(await C.get("/devices")).data.devices||[];if(e.stop(`${i.length} device(s) registered`),i.length===0){ve.info(Q.dim(`No devices registered yet. Run \`${f.nameLower} device register\` to add one.`)),vt(Q.blue("---"));return}let n=i.map(r=>{let o=new Date(r.createdAt).toLocaleDateString();return`  ${Q.bold(r.name.padEnd(24))} ${Q.dim(r.udid.padEnd(28))} ${Q.cyan(r.addedVia.padEnd(10))} ${Q.dim(o)}`});nl(`  ${Q.bold("Name".padEnd(24))} ${"UDID".padEnd(28)} ${"Via".padEnd(10)} Date
 `+n.join(`
-`),"Registered Devices")}catch(t){e.stop(Q.red("Failed to fetch devices")),ve.error(t.response?.data?.message||t.message)}vt(Q.blue("---"))}async function ll(e){let t=e.udid;if(!t){let r=Rt();r.start("Fetching registered devices...");try{let s=(await C.get("/devices")).data.devices||[];if(r.stop(`${s.length} device(s) found`),s.length===0){ve.info(Q.dim("No devices to remove.")),vt(Q.blue("---"));return}let l=await wr({message:"Select device to remove:",options:s.map(a=>({value:a.udid,label:a.name,hint:a.udid.substring(0,12)+"..."}))});if(wt(l)){Dt("Cancelled");return}t=l}catch(o){r.stop(Q.red("Failed to fetch devices")),ve.error(o.response?.data?.message||o.message);return}}let i=await il({message:`Remove device ${Q.dim(t.substring(0,12)+"...")}?`});if(wt(i)||!i){Dt("Cancelled");return}let n=Rt();n.start("Removing device...");try{await C.delete(`/devices/${encodeURIComponent(t)}`),n.stop(Q.green("Device removed"))}catch(r){n.stop(Q.red("Failed to remove device")),ve.error(r.response?.data?.message||r.message)}vt(Q.blue("---"))}async function Xt(e,t){switch(e){case"register":await sl(t);break;case"list":await al();break;case"remove":await ll(t);break;default:ve.error(`Unknown action: ${e}`)}}import{log as Pe,spinner as to}from"@clack/prompts";import Ce from"chalk";import ai from"path";import Nt from"fs";import jl from"os";import Gl from"axios";var _e=(o=>(o.CRITICAL="critical",o.HIGH="high",o.MEDIUM="medium",o.LOW="low",o.INFO="info",o))(_e||{}),Oe=(a=>(a.PERMISSIONS="permissions",a.SECRETS="secrets",a.DEPENDENCIES="dependencies",a.STORAGE="storage",a.NETWORK="network",a.DEBUG="debug",a.MANIFEST="manifest",a.ATS="ats",a))(Oe||{});import{spinner as Vr,log as Ct}from"@clack/prompts";import be from"chalk";import{execSync as Nl}from"child_process";import zr from"fs";import Wr from"path";import Ye from"fs";import Ot from"path";import{execSync as dl}from"child_process";var Dr={"android.permission.READ_PHONE_STATE":{severity:"high",description:"Can read phone number, IMEI, carrier info"},"android.permission.CALL_PHONE":{severity:"high",description:"Can make calls without user interaction"},"android.permission.SEND_SMS":{severity:"high",description:"Can send SMS without user interaction"},"android.permission.READ_SMS":{severity:"high",description:"Can read user SMS messages"},"android.permission.READ_CONTACTS":{severity:"medium",description:"Can read user contacts"},"android.permission.WRITE_CONTACTS":{severity:"medium",description:"Can modify user contacts"},"android.permission.READ_CALL_LOG":{severity:"high",description:"Can read call history"},"android.permission.CAMERA":{severity:"medium",description:"Camera access"},"android.permission.RECORD_AUDIO":{severity:"medium",description:"Microphone access"},"android.permission.ACCESS_FINE_LOCATION":{severity:"medium",description:"Precise GPS location"},"android.permission.ACCESS_COARSE_LOCATION":{severity:"medium",description:"Approximate location"},"android.permission.ACCESS_BACKGROUND_LOCATION":{severity:"high",description:"Background location tracking"},"android.permission.READ_EXTERNAL_STORAGE":{severity:"medium",description:"Read files on device"},"android.permission.WRITE_EXTERNAL_STORAGE":{severity:"medium",description:"Write files on device"},"android.permission.READ_MEDIA_IMAGES":{severity:"low",description:"Read photos"},"android.permission.READ_MEDIA_VIDEO":{severity:"low",description:"Read videos"},"android.permission.SYSTEM_ALERT_WINDOW":{severity:"high",description:"Draw overlays on other apps"},"android.permission.REQUEST_INSTALL_PACKAGES":{severity:"high",description:"Can install APKs"}},cl={NSCameraUsageDescription:{severity:"medium",description:"Camera access declared"},NSMicrophoneUsageDescription:{severity:"medium",description:"Microphone access declared"},NSLocationWhenInUseUsageDescription:{severity:"medium",description:"Location (in-use) declared"},NSLocationAlwaysUsageDescription:{severity:"high",description:"Background location declared"},NSContactsUsageDescription:{severity:"medium",description:"Contacts access declared"},NSCalendarsUsageDescription:{severity:"low",description:"Calendar access declared"},NSPhotoLibraryUsageDescription:{severity:"low",description:"Photo library access declared"}};function ul(e){try{let i=dl("npx expo config --type introspect --json 2>/dev/null",{cwd:e,encoding:"utf-8",timeout:3e4});return JSON.parse(i)}catch{}let t=Ot.join(e,"app.json");if(Ye.existsSync(t))try{let i=JSON.parse(Ye.readFileSync(t,"utf-8"));return i.expo||i}catch{}return null}function pl(e){let t=[],i=Ot.join(e,"node_modules");if(!Ye.existsSync(i))return t;let n=/<uses-permission\s+android:name="([^"]+)"/g;function r(o,s){let l=Ot.join(o,"android","src","main","AndroidManifest.xml");if(!Ye.existsSync(l))return;let a=Ye.readFileSync(l,"utf-8"),d;for(;(d=n.exec(a))!==null;)t.push({pkg:s,permission:d[1]});n.lastIndex=0}for(let o of Ye.readdirSync(i)){if(o.startsWith("."))continue;let s=Ot.join(i,o);if(o.startsWith("@")){if(!Ye.statSync(s).isDirectory())continue;for(let l of Ye.readdirSync(s))r(Ot.join(s,l),`${o}/${l}`)}else r(s,o)}return t}async function Rr(e,t){let i=[],n=1,r=ul(e),o=r?.android?.permissions||[],s=r?.android?.blockedPermissions||[];for(let d of o){let c=Dr[d];c&&i.push({id:`PERM-${String(n++).padStart(3,"0")}`,title:`${d.split(".").pop()} declared`,description:c.description,severity:c.severity,category:"permissions",file:"app.config.ts",recommendation:"Remove from permissions if not needed, or add justification."})}let l=pl(e);for(let{pkg:d,permission:c}of l){let u=Dr[c];u&&(s.includes(c)||o.includes(c)||i.push({id:`PERM-${String(n++).padStart(3,"0")}`,title:`${c.split(".").pop()} injected by ${d}`,description:`${u.description}. Auto-injected via ${d} AndroidManifest.xml`,severity:u.severity,category:"permissions",file:`node_modules/${d}/android/src/main/AndroidManifest.xml`,recommendation:`Add "${c}" to blockedPermissions if not needed.`,autoFixable:!0}))}let a=r?.ios?.infoPlist||{};for(let[d,c]of Object.entries(cl))d in a&&i.push({id:`PERM-${String(n++).padStart(3,"0")}`,title:`iOS: ${d} declared`,description:c.description,severity:c.severity,category:"permissions",file:"app.config.ts",recommendation:`Remove ${d} from infoPlist if the app does not use this capability.`});return{category:"permissions",label:"Permission Audit",findings:i,durationMs:0}}import Hi from"fs";import Zt from"path";var fl=[{id:"SEC-001",pattern:/(['"`])(?:sk|pk)_(?:live|test)_[a-zA-Z0-9]{20,}\1/g,severity:"critical",label:"Stripe API Key"},{id:"SEC-002",pattern:/(['"`])AIza[0-9A-Za-z\-_]{35}\1/g,severity:"high",label:"Google API Key"},{id:"SEC-003",pattern:/(['"`])AKIA[0-9A-Z]{16}\1/g,severity:"critical",label:"AWS Access Key ID"},{id:"SEC-004",pattern:/-----BEGIN (?:RSA |EC )?PRIVATE KEY-----/g,severity:"critical",label:"Private key in source"},{id:"SEC-005",pattern:/(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{36,}/g,severity:"high",label:"GitHub Token"},{id:"SEC-006",pattern:/xox[bpors]-[a-zA-Z0-9-]{10,}/g,severity:"high",label:"Slack Token"},{id:"SEC-007",pattern:/(?:password|secret|apikey|api_key)\s*[:=]\s*['"`][^'"`\n]{8,}['"`]/gi,severity:"high",label:"Hardcoded credential"}],ml=new Set([".ts",".tsx",".js",".jsx"]),gl=new Set(["node_modules",".expo",".git","android","ios","dist","build","__tests__","__mocks__"]);function vr(e){let t=[],i=Hi.readdirSync(e,{withFileTypes:!0});for(let n of i){if(gl.has(n.name))continue;let r=Zt.join(e,n.name);n.isDirectory()?t.push(...vr(r)):ml.has(Zt.extname(n.name))&&t.push(r)}return t}function hl(e){let t=e.trim();return t.startsWith("//")||t.startsWith("*")||t.startsWith("/*")}function yl(e){return/process\.env\./i.test(e)||/import\.meta\.env/i.test(e)}async function Or(e,t){let i=[],n=Zt.join(e,"src"),r=Hi.existsSync(n)?n:e,o=vr(r);for(let s of o){let a=Hi.readFileSync(s,"utf-8").split(`
+`),"Registered Devices")}catch(t){e.stop(Q.red("Failed to fetch devices")),ve.error(t.response?.data?.message||t.message)}vt(Q.blue("---"))}async function ll(e){let t=e.udid;if(!t){let r=Rt();r.start("Fetching registered devices...");try{let s=(await C.get("/devices")).data.devices||[];if(r.stop(`${s.length} device(s) found`),s.length===0){ve.info(Q.dim("No devices to remove.")),vt(Q.blue("---"));return}let l=await wr({message:"Select device to remove:",options:s.map(a=>({value:a.udid,label:a.name,hint:a.udid.substring(0,12)+"..."}))});if(wt(l)){Dt("Cancelled");return}t=l}catch(o){r.stop(Q.red("Failed to fetch devices")),ve.error(o.response?.data?.message||o.message);return}}let i=await il({message:`Remove device ${Q.dim(t.substring(0,12)+"...")}?`});if(wt(i)||!i){Dt("Cancelled");return}let n=Rt();n.start("Removing device...");try{await C.delete(`/devices/${encodeURIComponent(t)}`),n.stop(Q.green("Device removed"))}catch(r){n.stop(Q.red("Failed to remove device")),ve.error(r.response?.data?.message||r.message)}vt(Q.blue("---"))}async function qt(e,t){switch(e){case"register":await sl(t);break;case"list":await al();break;case"remove":await ll(t);break;default:ve.error(`Unknown action: ${e}`)}}import{log as Pe,spinner as to}from"@clack/prompts";import Ce from"chalk";import ai from"path";import Nt from"fs";import jl from"os";import Gl from"axios";var _e=(o=>(o.CRITICAL="critical",o.HIGH="high",o.MEDIUM="medium",o.LOW="low",o.INFO="info",o))(_e||{}),Oe=(a=>(a.PERMISSIONS="permissions",a.SECRETS="secrets",a.DEPENDENCIES="dependencies",a.STORAGE="storage",a.NETWORK="network",a.DEBUG="debug",a.MANIFEST="manifest",a.ATS="ats",a))(Oe||{});import{spinner as Vr,log as Ct}from"@clack/prompts";import be from"chalk";import{execSync as Nl}from"child_process";import zr from"fs";import Wr from"path";import Ye from"fs";import Ot from"path";import{execSync as dl}from"child_process";var Dr={"android.permission.READ_PHONE_STATE":{severity:"high",description:"Can read phone number, IMEI, carrier info"},"android.permission.CALL_PHONE":{severity:"high",description:"Can make calls without user interaction"},"android.permission.SEND_SMS":{severity:"high",description:"Can send SMS without user interaction"},"android.permission.READ_SMS":{severity:"high",description:"Can read user SMS messages"},"android.permission.READ_CONTACTS":{severity:"medium",description:"Can read user contacts"},"android.permission.WRITE_CONTACTS":{severity:"medium",description:"Can modify user contacts"},"android.permission.READ_CALL_LOG":{severity:"high",description:"Can read call history"},"android.permission.CAMERA":{severity:"medium",description:"Camera access"},"android.permission.RECORD_AUDIO":{severity:"medium",description:"Microphone access"},"android.permission.ACCESS_FINE_LOCATION":{severity:"medium",description:"Precise GPS location"},"android.permission.ACCESS_COARSE_LOCATION":{severity:"medium",description:"Approximate location"},"android.permission.ACCESS_BACKGROUND_LOCATION":{severity:"high",description:"Background location tracking"},"android.permission.READ_EXTERNAL_STORAGE":{severity:"medium",description:"Read files on device"},"android.permission.WRITE_EXTERNAL_STORAGE":{severity:"medium",description:"Write files on device"},"android.permission.READ_MEDIA_IMAGES":{severity:"low",description:"Read photos"},"android.permission.READ_MEDIA_VIDEO":{severity:"low",description:"Read videos"},"android.permission.SYSTEM_ALERT_WINDOW":{severity:"high",description:"Draw overlays on other apps"},"android.permission.REQUEST_INSTALL_PACKAGES":{severity:"high",description:"Can install APKs"}},cl={NSCameraUsageDescription:{severity:"medium",description:"Camera access declared"},NSMicrophoneUsageDescription:{severity:"medium",description:"Microphone access declared"},NSLocationWhenInUseUsageDescription:{severity:"medium",description:"Location (in-use) declared"},NSLocationAlwaysUsageDescription:{severity:"high",description:"Background location declared"},NSContactsUsageDescription:{severity:"medium",description:"Contacts access declared"},NSCalendarsUsageDescription:{severity:"low",description:"Calendar access declared"},NSPhotoLibraryUsageDescription:{severity:"low",description:"Photo library access declared"}};function ul(e){try{let i=dl("npx expo config --type introspect --json 2>/dev/null",{cwd:e,encoding:"utf-8",timeout:3e4});return JSON.parse(i)}catch{}let t=Ot.join(e,"app.json");if(Ye.existsSync(t))try{let i=JSON.parse(Ye.readFileSync(t,"utf-8"));return i.expo||i}catch{}return null}function pl(e){let t=[],i=Ot.join(e,"node_modules");if(!Ye.existsSync(i))return t;let n=/<uses-permission\s+android:name="([^"]+)"/g;function r(o,s){let l=Ot.join(o,"android","src","main","AndroidManifest.xml");if(!Ye.existsSync(l))return;let a=Ye.readFileSync(l,"utf-8"),d;for(;(d=n.exec(a))!==null;)t.push({pkg:s,permission:d[1]});n.lastIndex=0}for(let o of Ye.readdirSync(i)){if(o.startsWith("."))continue;let s=Ot.join(i,o);if(o.startsWith("@")){if(!Ye.statSync(s).isDirectory())continue;for(let l of Ye.readdirSync(s))r(Ot.join(s,l),`${o}/${l}`)}else r(s,o)}return t}async function Rr(e,t){let i=[],n=1,r=ul(e),o=r?.android?.permissions||[],s=r?.android?.blockedPermissions||[];for(let d of o){let c=Dr[d];c&&i.push({id:`PERM-${String(n++).padStart(3,"0")}`,title:`${d.split(".").pop()} declared`,description:c.description,severity:c.severity,category:"permissions",file:"app.config.ts",recommendation:"Remove from permissions if not needed, or add justification."})}let l=pl(e);for(let{pkg:d,permission:c}of l){let u=Dr[c];u&&(s.includes(c)||o.includes(c)||i.push({id:`PERM-${String(n++).padStart(3,"0")}`,title:`${c.split(".").pop()} injected by ${d}`,description:`${u.description}. Auto-injected via ${d} AndroidManifest.xml`,severity:u.severity,category:"permissions",file:`node_modules/${d}/android/src/main/AndroidManifest.xml`,recommendation:`Add "${c}" to blockedPermissions if not needed.`,autoFixable:!0}))}let a=r?.ios?.infoPlist||{};for(let[d,c]of Object.entries(cl))d in a&&i.push({id:`PERM-${String(n++).padStart(3,"0")}`,title:`iOS: ${d} declared`,description:c.description,severity:c.severity,category:"permissions",file:"app.config.ts",recommendation:`Remove ${d} from infoPlist if the app does not use this capability.`});return{category:"permissions",label:"Permission Audit",findings:i,durationMs:0}}import Hi from"fs";import Zt from"path";var fl=[{id:"SEC-001",pattern:/(['"`])(?:sk|pk)_(?:live|test)_[a-zA-Z0-9]{20,}\1/g,severity:"critical",label:"Stripe API Key"},{id:"SEC-002",pattern:/(['"`])AIza[0-9A-Za-z\-_]{35}\1/g,severity:"high",label:"Google API Key"},{id:"SEC-003",pattern:/(['"`])AKIA[0-9A-Z]{16}\1/g,severity:"critical",label:"AWS Access Key ID"},{id:"SEC-004",pattern:/-----BEGIN (?:RSA |EC )?PRIVATE KEY-----/g,severity:"critical",label:"Private key in source"},{id:"SEC-005",pattern:/(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{36,}/g,severity:"high",label:"GitHub Token"},{id:"SEC-006",pattern:/xox[bpors]-[a-zA-Z0-9-]{10,}/g,severity:"high",label:"Slack Token"},{id:"SEC-007",pattern:/(?:password|secret|apikey|api_key)\s*[:=]\s*['"`][^'"`\n]{8,}['"`]/gi,severity:"high",label:"Hardcoded credential"}],ml=new Set([".ts",".tsx",".js",".jsx"]),gl=new Set(["node_modules",".expo",".git","android","ios","dist","build","__tests__","__mocks__"]);function vr(e){let t=[],i=Hi.readdirSync(e,{withFileTypes:!0});for(let n of i){if(gl.has(n.name))continue;let r=Zt.join(e,n.name);n.isDirectory()?t.push(...vr(r)):ml.has(Zt.extname(n.name))&&t.push(r)}return t}function hl(e){let t=e.trim();return t.startsWith("//")||t.startsWith("*")||t.startsWith("/*")}function yl(e){return/process\.env\./i.test(e)||/import\.meta\.env/i.test(e)}async function Or(e,t){let i=[],n=Zt.join(e,"src"),r=Hi.existsSync(n)?n:e,o=vr(r);for(let s of o){let a=Hi.readFileSync(s,"utf-8").split(`
 `),d=Zt.relative(e,s);for(let c=0;c<a.length;c++){let u=a[c];if(!hl(u)&&!yl(u))for(let{id:p,pattern:m,severity:I,label:L}of fl)m.lastIndex=0,m.test(u)&&i.push({id:p,title:L,description:`Potential ${L.toLowerCase()} found in source code`,severity:I,category:"secrets",file:d,line:c+1,recommendation:`Move to environment variables or a secrets manager. Use \`${f.nameLower} env set\` for managed secrets.`})}}return{category:"secrets",label:"Secrets Detection",findings:i,durationMs:0}}import{execSync as Sl}from"child_process";var El={critical:"critical",high:"high",moderate:"medium",low:"low",info:"info"};async function Cr(e,t){let i=[],n=1,r;try{r=Sl("npm audit --json 2>/dev/null",{cwd:e,encoding:"utf-8",timeout:6e4})}catch(l){if(r=l.stdout||"",!r)return{category:"dependencies",label:"Dependency CVEs",findings:[],durationMs:0,error:"Failed to run npm audit. Ensure npm is available and dependencies are installed."}}let o;try{o=JSON.parse(r)}catch{return{category:"dependencies",label:"Dependency CVEs",findings:[],durationMs:0,error:"Failed to parse npm audit output."}}let s=o.vulnerabilities||{};for(let[l,a]of Object.entries(s)){let d=El[a.severity]||"info",c=Array.isArray(a.via)?a.via.map(u=>typeof u=="string"?u:u.title||u.name).join(", "):String(a.via);i.push({id:`DEP-${String(n++).padStart(3,"0")}`,title:`${l} \u2014 ${a.severity}`,description:`Via: ${c}. Range: ${a.range||"unknown"}`,severity:d,category:"dependencies",recommendation:a.fixAvailable?`Run \`npm audit fix\` or update ${l} to a patched version.`:"No fix available yet. Monitor for updates or evaluate alternatives.",autoFixable:!!a.fixAvailable})}return{category:"dependencies",label:"Dependency CVEs",findings:i,durationMs:0}}import Qt from"fs";import ei from"path";var bl=/(?:token|password|credential|secret|apiKey|api_key|session|auth|jwt|refresh_token|access_token|private_key|pin|otp)/i,Nr=/AsyncStorage\s*\.\s*(?:setItem|mergeItem)\s*\(\s*['"`]([^'"`]+)['"`]/g,Al=/from\s+['"]@react-native-async-storage\/async-storage['"]|from\s+['"]react-native['"].*AsyncStorage/,Il=new Set([".ts",".tsx",".js",".jsx"]),_l=new Set(["node_modules",".expo",".git","android","ios","dist","build"]);function Tr(e){let t=[];if(!Qt.existsSync(e))return t;let i=Qt.readdirSync(e,{withFileTypes:!0});for(let n of i){if(_l.has(n.name))continue;let r=ei.join(e,n.name);n.isDirectory()?t.push(...Tr(r)):Il.has(ei.extname(n.name))&&t.push(r)}return t}async function kr(e,t){let i=[],n=1,r=ei.join(e,"src"),o=Qt.existsSync(r)?r:e,s=Tr(o);for(let l of s){let a=Qt.readFileSync(l,"utf-8");if(!Al.test(a))continue;let d=a.split(`
 `),c=ei.relative(e,l);for(let u=0;u<d.length;u++){let p=d[u];Nr.lastIndex=0;let m;for(;(m=Nr.exec(p))!==null;){let I=m[1];bl.test(I)&&i.push({id:`STOR-${String(n++).padStart(3,"0")}`,title:`AsyncStorage used for "${I}"`,description:`Sensitive data key "${I}" stored in AsyncStorage (unencrypted).`,severity:"high",category:"storage",file:c,line:u+1,recommendation:"Use expo-secure-store (SecureStore) for sensitive data instead of AsyncStorage."})}}}return{category:"storage",label:"Insecure Storage",findings:i,durationMs:0}}import ti from"fs";import ii from"path";var xr=/['"`](http:\/\/(?!localhost|127\.0\.0\.1|10\.|192\.168\.|0\.0\.0\.0|172\.(?:1[6-9]|2\d|3[01])\.)[^'"`\s]+)['"`]/g,Pl=/\/api\/|\/v[0-9]+\/|\/graphql|\/rest\//i,$l=new Set([".ts",".tsx",".js",".jsx"]),wl=new Set(["node_modules",".expo",".git","android","ios","dist","build","__tests__","__mocks__"]);function Lr(e){let t=[];if(!ti.existsSync(e))return t;let i=ti.readdirSync(e,{withFileTypes:!0});for(let n of i){if(wl.has(n.name))continue;let r=ii.join(e,n.name);n.isDirectory()?t.push(...Lr(r)):$l.has(ii.extname(n.name))&&t.push(r)}return t}async function Ur(e,t){let i=[],n=1,r=ii.join(e,"src"),o=ti.existsSync(r)?r:e,s=Lr(o);for(let l of s){let d=ti.readFileSync(l,"utf-8").split(`
 `),c=ii.relative(e,l);for(let u=0;u<d.length;u++){let p=d[u],m=p.trim();if(m.startsWith("//")||m.startsWith("*"))continue;xr.lastIndex=0;let I;for(;(I=xr.exec(p))!==null;){let L=I[1],w=Pl.test(L);i.push({id:`NET-${String(n++).padStart(3,"0")}`,title:`Insecure HTTP URL${w?" (API endpoint)":""}`,description:`Plain HTTP URL found: ${L}`,severity:w?"high":"medium",category:"network",file:c,line:u+1,recommendation:"Use HTTPS instead of HTTP for all network requests."})}}}return{category:"network",label:"HTTP URLs",findings:i,durationMs:0}}import ni from"fs";import ri from"path";var Mr=/(?:debug|debugMode|devMode|enableDebug)\s*[:=]\s*true/gi,Br=/console\.(?:log|warn|info|debug)\s*\([^)]*(?:token|password|secret|credential|key|auth)/gi,Dl=new Set([".ts",".tsx",".js",".jsx"]),Rl=new Set(["node_modules",".expo",".git","android","ios","dist","build","__tests__","__mocks__"]);function Fr(e){let t=[];if(!ni.existsSync(e))return t;let i=ni.readdirSync(e,{withFileTypes:!0});for(let n of i){if(Rl.has(n.name))continue;let r=ri.join(e,n.name);n.isDirectory()?t.push(...Fr(r)):Dl.has(ri.extname(n.name))&&t.push(r)}return t}async function Hr(e,t){let i=[],n=1,r=ri.join(e,"src"),o=ni.existsSync(r)?r:e,s=Fr(o);for(let l of s){let d=ni.readFileSync(l,"utf-8").split(`
 `),c=ri.relative(e,l);for(let u=0;u<d.length;u++){let p=d[u],m=p.trim();if(!(m.startsWith("//")||m.startsWith("*"))&&(Mr.lastIndex=0,Mr.test(p)&&i.push({id:`DBG-${String(n++).padStart(3,"0")}`,title:"Hardcoded debug flag",description:"Debug/dev mode enabled in source code",severity:"medium",category:"debug",file:c,line:u+1,recommendation:"Use __DEV__ or environment variables instead of hardcoded debug flags."}),Br.lastIndex=0,Br.test(p))){let I=d.slice(Math.max(0,u-3),u).join(`
 `);/__DEV__/.test(I)||i.push({id:`DBG-${String(n++).padStart(3,"0")}`,title:"Sensitive data in console log",description:"Console log may expose sensitive data (token, password, etc.) in production",severity:"medium",category:"debug",file:c,line:u+1,recommendation:"Wrap in __DEV__ check or remove sensitive data from console output."})}}}return{category:"debug",label:"Debug/Dev Flags",findings:i,durationMs:0}}import jr from"fs";import ji from"path";var vl=new Set(["androidx.work.impl.background.systemjob.SystemJobService","androidx.work.impl.diagnostics.DiagnosticsReceiver","com.google.firebase.iid.FirebaseInstanceIdReceiver","com.google.android.gms.auth.api.signin.RevocationBoundService","androidx.profileinstaller.ProfileInstallReceiver","com.google.firebase.messaging.FirebaseMessagingService","com.google.android.gms.measurement.AppMeasurementService","com.google.android.gms.measurement.AppMeasurementJobService"]);function Ol(e){let t=[ji.join(e,"android","app","src","main","AndroidManifest.xml"),ji.join(e,"android","AndroidManifest.xml")];for(let i of t)if(jr.existsSync(i))return i;return null}async function Gr(e,t){let i=[],n=1,r=Ol(e);if(!r)return{category:"manifest",label:"Android Manifest",findings:[],durationMs:0,error:"No AndroidManifest.xml found. Run with --prebuild or run `expo prebuild` first."};let o=jr.readFileSync(r,"utf-8"),s=ji.relative(e,r),l=/<(activity|service|receiver|provider)\s+([^>]*?)(?:\/>|>)/gs,a;for(;(a=l.exec(o))!==null;){let d=a[1],c=a[2],p=c.match(/android:name="([^"]+)"/)?.[1]||"unknown";if(vl.has(p))continue;let m=/android:exported="true"/.test(c),I=/android:permission="/.test(c);m&&!I&&i.push({id:`MAN-${String(n++).padStart(3,"0")}`,title:`Exported ${d}: ${p.split(".").pop()}`,description:`${p} is exported=true without android:permission protection`,severity:"medium",category:"manifest",file:s,recommendation:'Set android:exported="false" or add an android:permission attribute.'})}return/android:allowBackup="true"/.test(o)&&i.push({id:`MAN-${String(n++).padStart(3,"0")}`,title:"allowBackup is enabled",description:'android:allowBackup="true" allows data extraction via ADB backup',severity:"medium",category:"manifest",file:s,recommendation:'Set android:allowBackup="false" via expo-build-properties plugin.',autoFixable:!0}),/android:debuggable="true"/.test(o)&&i.push({id:`MAN-${String(n++).padStart(3,"0")}`,title:"App is debuggable",description:'android:debuggable="true" allows attaching a debugger in production',severity:"critical",category:"manifest",file:s,recommendation:"Ensure debuggable is false for production builds. This is usually set automatically for release builds."}),{category:"manifest",label:"Android Manifest",findings:i,durationMs:0}}import oi from"fs";import Gi from"path";function Cl(e){let t=Gi.join(e,"ios");if(!oi.existsSync(t))return null;let i=oi.readdirSync(t,{withFileTypes:!0});for(let n of i){if(!n.isDirectory()||n.name==="Pods"||n.name.startsWith("."))continue;let r=Gi.join(t,n.name,"Info.plist");if(oi.existsSync(r))return r}return null}async function Kr(e,t){let i=[],n=1,r=Cl(e);if(!r)return{category:"ats",label:"iOS ATS Config",findings:[],durationMs:0,error:"No Info.plist found. Run with --prebuild or run `expo prebuild` first."};let o=oi.readFileSync(r,"utf-8"),s=Gi.relative(e,r),l=o.match(/<key>NSAppTransportSecurity<\/key>\s*<dict>([\s\S]*?)<\/dict>/);if(l){let a=l[1];/<key>NSAllowsArbitraryLoads<\/key>\s*<true\s*\/>/.test(a)&&i.push({id:`ATS-${String(n++).padStart(3,"0")}`,title:"ATS disabled \u2014 NSAllowsArbitraryLoads",description:"App Transport Security is completely disabled. All HTTP connections are allowed.",severity:"critical",category:"ats",file:s,recommendation:"Remove NSAllowsArbitraryLoads or set to false. Use domain-specific exceptions only if absolutely necessary."});let d=a.match(/<key>NSExceptionDomains<\/key>\s*<dict>([\s\S]*?)<\/dict>/);if(d){let c=d[1].match(/<key>([^<]+)<\/key>/g);if(c)for(let u of c){let p=u.replace(/<\/?key>/g,"");p!=="NSExceptionDomains"&&i.push({id:`ATS-${String(n++).padStart(3,"0")}`,title:`ATS exception: ${p}`,description:`ATS exception configured for ${p}`,severity:"low",category:"ats",file:s,recommendation:`Verify that the ATS exception for ${p} is necessary. Use HTTPS where possible.`})}}}return{category:"ats",label:"iOS ATS Config",findings:i,durationMs:0}}var Tl=[{category:"permissions",label:"Permission Audit",fn:Rr,requiresPrebuild:!1},{category:"secrets",label:"Secrets Detection",fn:Or,requiresPrebuild:!1},{category:"dependencies",label:"Dependency CVEs",fn:Cr,requiresPrebuild:!1},{category:"storage",label:"Insecure Storage",fn:kr,requiresPrebuild:!1},{category:"network",label:"HTTP URLs",fn:Ur,requiresPrebuild:!1},{category:"debug",label:"Debug/Dev Flags",fn:Hr,requiresPrebuild:!1},{category:"manifest",label:"Android Manifest",fn:Gr,requiresPrebuild:!0},{category:"ats",label:"iOS ATS Config",fn:Kr,requiresPrebuild:!0}];async function Yr(e,t){let i=Tl;t.category&&(i=i.filter(s=>s.category===t.category),i.length===0&&(Ct.error(be.red(`Unknown category: ${t.category}`)),Ct.info(be.dim(`Available: ${Object.values(Oe).join(", ")}`)),process.exit(1)));let n=i.filter(s=>!s.requiresPrebuild),r=i.filter(s=>s.requiresPrebuild),o=[];for(let s of n){let l=Vr();l.start(be.dim(`Running ${s.label}...`));try{let a=Date.now(),d=await s.fn(e,t);d.durationMs=Date.now()-a,o.push(d);let c=d.findings.length;l.stop(c>0?be.yellow(`${s.label} \u2014 ${c} finding(s)`):be.green(`${s.label} \u2014 clean`))}catch(a){l.stop(be.red(`${s.label} \u2014 error`)),o.push({category:s.category,label:s.label,findings:[],durationMs:0,error:a.message})}}if(r.length>0){let s=Wr.join(e,"android"),l=Wr.join(e,"ios"),a=zr.existsSync(s)||zr.existsSync(l);if(!a&&t.prebuild){t.json||Ct.info(be.dim(`
 Running expo prebuild for deeper analysis...`));try{Nl("npx expo prebuild --no-install",{cwd:e,stdio:"pipe"})}catch{return Ct.warn(be.yellow("Prebuild failed \u2014 skipping manifest/plist checks.")),o}}else if(!a)return t.json||Ct.info(be.dim(`
-Skipping manifest/plist checks \u2014 no android/ios dirs. Use --prebuild to generate them.`)),o;for(let d of r){let c=Vr();c.start(be.dim(`Running ${d.label}...`));try{let u=Date.now(),p=await d.fn(e,t);p.durationMs=Date.now()-u,o.push(p);let m=p.findings.length;c.stop(m>0?be.yellow(`${d.label} \u2014 ${m} finding(s)`):be.green(`${d.label} \u2014 clean`))}catch(u){c.stop(be.red(`${d.label} \u2014 error`)),o.push({category:d.category,label:d.label,findings:[],durationMs:0,error:u.message})}}}return o}import de from"chalk";import{log as ae}from"@clack/prompts";var ct={critical:de.bgRed.white.bold,high:de.red.bold,medium:de.yellow.bold,low:de.blue,info:de.dim},si={critical:0,high:1,medium:2,low:3,info:4};function kl(e,t){if(!t)return!0;let i=si[t];return i===void 0?!0:si[e]<=i}function Jr(e,t){let i=0,n={critical:0,high:0,medium:0,low:0,info:0};for(let s of e){let l=s.findings.filter(d=>kl(d.severity,t));if(l.length===0&&!s.error)continue;if(ae.info(""),ae.info(de.bold(`  ${s.label}`)+de.dim(`  ${l.length} finding(s)`)),ae.info(de.dim("  "+"\u2500".repeat(60))),s.error){ae.error(de.red(`  Error: ${s.error}`));continue}let a=[...l].sort((d,c)=>si[d.severity]-si[c.severity]);for(let d of a){let c=ct[d.severity](` ${d.severity.toUpperCase()} `);ae.info(`  ${c}  ${de.bold(d.id)}  ${d.title}`),ae.info(de.dim(`          ${d.description}`)),d.file&&ae.info(de.dim(`          File: ${d.file}${d.line?`:${d.line}`:""}`)),ae.info(de.cyan(`          Fix: ${d.recommendation}`)),ae.info(""),n[d.severity]++,i++}}ae.info(""),ae.info(de.bold("  Summary")),ae.info(de.dim("  "+"\u2500".repeat(60))),ae.info(`  Total: ${de.bold(String(i))} finding(s)`),ae.info(`  ${ct.critical(` ${n.critical} Critical `)}  ${ct.high(` ${n.high} High `)}  ${ct.medium(` ${n.medium} Medium `)}  ${ct.low(` ${n.low} Low `)}  ${ct.info(` ${n.info} Info `)}`);let r=n.critical>0,o=n.high>0;r||o?(ae.info(""),ae.error(de.red.bold(`  FAIL \u2014 ${n.critical} critical, ${n.high} high issue(s) found`))):i>0?(ae.info(""),ae.warn(de.yellow("  PASS (with warnings) \u2014 no critical or high issues"))):(ae.info(""),ae.success(de.green.bold("  PASS \u2014 no issues found")))}function qr(e,t){let i=e.flatMap(r=>r.findings),n={};for(let r of Object.values(_e))n[r]=i.filter(o=>o.severity===r).length;return{version:"1.0.0",timestamp:new Date().toISOString(),project:t.name||"unknown",projectVersion:t.version||"0.0.0",summary:{total:i.length,...n},passed:n.critical===0&&n.high===0,checks:e.map(r=>({category:r.category,label:r.label,findingCount:r.findings.length,durationMs:r.durationMs,error:r.error||null})),findings:i}}import{log as le,spinner as xl}from"@clack/prompts";import re from"chalk";import He from"fs";import Ll from"os";import ut from"path";import{execSync as Ul}from"child_process";var Xr=16384,Ml=1,Bl=Buffer.from([127,69,76,70]);async function Zr(e){le.info(re.bold.underline("16KB Page Alignment Check")),console.log("");let t=ut.resolve(e);if(!He.existsSync(t))return le.error(re.red(`APK file not found: ${t}`)),!1;if(!t.endsWith(".apk"))return le.error(re.red("The provided file is not an APK file.")),!1;let i=xl();i.start("Extracting and analyzing native libraries...");let n=He.mkdtempSync(ut.join(Ll.tmpdir(),"mach-16kb-"));try{try{Ul(`unzip -o -q "${t}" "lib/arm64-v8a/*.so" "lib/x86_64/*.so" -d "${n}" 2>/dev/null`,{encoding:"utf-8",maxBuffer:50*1024*1024})}catch{}let r=Qr(ut.join(n,"lib"));if(r.length===0)return i.stop("Analysis complete."),le.info(re.yellow("No arm64-v8a or x86_64 native libraries found in the APK.")),le.info(re.dim("16KB alignment check only applies to arm64-v8a and x86_64 architectures.")),!0;let o=[];for(let a of r){let d=ut.relative(n,a),c=Hl(d),u=ut.basename(a),p=Fl(a);p!==null&&o.push({name:u,filePath:d,arch:c,align:p,compatible:p>=Xr})}if(i.stop("Analysis complete."),o.length===0)return le.info(re.yellow("No valid ELF shared libraries found.")),!0;let s=o.filter(a=>!a.compatible),l=o.filter(a=>a.compatible);if(le.info(re.dim(`Checked ${o.length} native librar${o.length===1?"y":"ies"}
+Skipping manifest/plist checks \u2014 no android/ios dirs. Use --prebuild to generate them.`)),o;for(let d of r){let c=Vr();c.start(be.dim(`Running ${d.label}...`));try{let u=Date.now(),p=await d.fn(e,t);p.durationMs=Date.now()-u,o.push(p);let m=p.findings.length;c.stop(m>0?be.yellow(`${d.label} \u2014 ${m} finding(s)`):be.green(`${d.label} \u2014 clean`))}catch(u){c.stop(be.red(`${d.label} \u2014 error`)),o.push({category:d.category,label:d.label,findings:[],durationMs:0,error:u.message})}}}return o}import de from"chalk";import{log as ae}from"@clack/prompts";var ct={critical:de.bgRed.white.bold,high:de.red.bold,medium:de.yellow.bold,low:de.blue,info:de.dim},si={critical:0,high:1,medium:2,low:3,info:4};function kl(e,t){if(!t)return!0;let i=si[t];return i===void 0?!0:si[e]<=i}function Jr(e,t){let i=0,n={critical:0,high:0,medium:0,low:0,info:0};for(let s of e){let l=s.findings.filter(d=>kl(d.severity,t));if(l.length===0&&!s.error)continue;if(ae.info(""),ae.info(de.bold(`  ${s.label}`)+de.dim(`  ${l.length} finding(s)`)),ae.info(de.dim("  "+"\u2500".repeat(60))),s.error){ae.error(de.red(`  Error: ${s.error}`));continue}let a=[...l].sort((d,c)=>si[d.severity]-si[c.severity]);for(let d of a){let c=ct[d.severity](` ${d.severity.toUpperCase()} `);ae.info(`  ${c}  ${de.bold(d.id)}  ${d.title}`),ae.info(de.dim(`          ${d.description}`)),d.file&&ae.info(de.dim(`          File: ${d.file}${d.line?`:${d.line}`:""}`)),ae.info(de.cyan(`          Fix: ${d.recommendation}`)),ae.info(""),n[d.severity]++,i++}}ae.info(""),ae.info(de.bold("  Summary")),ae.info(de.dim("  "+"\u2500".repeat(60))),ae.info(`  Total: ${de.bold(String(i))} finding(s)`),ae.info(`  ${ct.critical(` ${n.critical} Critical `)}  ${ct.high(` ${n.high} High `)}  ${ct.medium(` ${n.medium} Medium `)}  ${ct.low(` ${n.low} Low `)}  ${ct.info(` ${n.info} Info `)}`);let r=n.critical>0,o=n.high>0;r||o?(ae.info(""),ae.error(de.red.bold(`  FAIL \u2014 ${n.critical} critical, ${n.high} high issue(s) found`))):i>0?(ae.info(""),ae.warn(de.yellow("  PASS (with warnings) \u2014 no critical or high issues"))):(ae.info(""),ae.success(de.green.bold("  PASS \u2014 no issues found")))}function Xr(e,t){let i=e.flatMap(r=>r.findings),n={};for(let r of Object.values(_e))n[r]=i.filter(o=>o.severity===r).length;return{version:"1.0.0",timestamp:new Date().toISOString(),project:t.name||"unknown",projectVersion:t.version||"0.0.0",summary:{total:i.length,...n},passed:n.critical===0&&n.high===0,checks:e.map(r=>({category:r.category,label:r.label,findingCount:r.findings.length,durationMs:r.durationMs,error:r.error||null})),findings:i}}import{log as le,spinner as xl}from"@clack/prompts";import re from"chalk";import He from"fs";import Ll from"os";import ut from"path";import{execSync as Ul}from"child_process";var qr=16384,Ml=1,Bl=Buffer.from([127,69,76,70]);async function Zr(e){le.info(re.bold.underline("16KB Page Alignment Check")),console.log("");let t=ut.resolve(e);if(!He.existsSync(t))return le.error(re.red(`APK file not found: ${t}`)),!1;if(!t.endsWith(".apk"))return le.error(re.red("The provided file is not an APK file.")),!1;let i=xl();i.start("Extracting and analyzing native libraries...");let n=He.mkdtempSync(ut.join(Ll.tmpdir(),"mach-16kb-"));try{try{Ul(`unzip -o -q "${t}" "lib/arm64-v8a/*.so" "lib/x86_64/*.so" -d "${n}" 2>/dev/null`,{encoding:"utf-8",maxBuffer:50*1024*1024})}catch{}let r=Qr(ut.join(n,"lib"));if(r.length===0)return i.stop("Analysis complete."),le.info(re.yellow("No arm64-v8a or x86_64 native libraries found in the APK.")),le.info(re.dim("16KB alignment check only applies to arm64-v8a and x86_64 architectures.")),!0;let o=[];for(let a of r){let d=ut.relative(n,a),c=Hl(d),u=ut.basename(a),p=Fl(a);p!==null&&o.push({name:u,filePath:d,arch:c,align:p,compatible:p>=qr})}if(i.stop("Analysis complete."),o.length===0)return le.info(re.yellow("No valid ELF shared libraries found.")),!0;let s=o.filter(a=>!a.compatible),l=o.filter(a=>a.compatible);if(le.info(re.dim(`Checked ${o.length} native librar${o.length===1?"y":"ies"}
 `)),s.length>0){le.info(re.red.bold(`Incompatible libraries:
-`));for(let a of s)le.error(re.red(`${re.bold(a.name)} ${re.dim(`(${a.arch})`)}`)),le.info(re.dim(`  PT_LOAD alignment: 2**${Math.log2(a.align)} (${a.align} bytes, needs 2**14 = ${Xr})`))}return l.length>0&&(console.log(""),le.success(re.green(`${l.length} librar${l.length===1?"y":"ies"} correctly aligned (2**14 or higher).`))),console.log(""),s.length===0?(le.success(re.green.bold("ELF Verification Successful. APK is 16KB compatible.")),!0):(le.error(re.red.bold(`Found ${s.length} unaligned lib${s.length===1?"":"s"} (arm64-v8a/x86_64 libs need to be aligned).`)),console.log(""),le.info(re.yellow("To fix this:")),le.info(re.dim("  1. Rebuild with NDK r28+ which defaults to 16KB page alignment")),le.info(re.dim("  2. Or set -DANDROID_SUPPORT_FLEXIBLE_PAGE_SIZES=ON in CMake")),le.info(re.dim("  3. Update third-party libraries that ship prebuilt .so files")),le.info(re.dim("  4. After rebuilding: zipalign -p -f -v 16 input.apk output.apk")),console.log(""),le.info(re.dim("Reference: https://developer.android.com/guide/practices/page-sizes")),!1)}catch(r){return i.stop("Analysis failed."),le.error(re.red(`Failed to analyze APK: ${r.message}`)),!1}finally{try{He.rmSync(n,{recursive:!0,force:!0})}catch{}}}function Fl(e){let t=He.openSync(e,"r");try{let i=Buffer.alloc(64);if(He.readSync(t,i,0,64,0),!i.subarray(0,4).equals(Bl))return null;let n=i[4]===2,r=i[5]===1,o=(p,m)=>r?p.readUInt16LE(m):p.readUInt16BE(m),s=(p,m)=>r?p.readUInt32LE(m):p.readUInt32BE(m),l=(p,m)=>Number(r?p.readBigUInt64LE(m):p.readBigUInt64BE(m)),a,d,c;n?(a=l(i,32),d=o(i,54),c=o(i,56)):(a=s(i,28),d=o(i,42),c=o(i,44));let u=null;for(let p=0;p<c;p++){let m=Buffer.alloc(d);if(He.readSync(t,m,0,d,a+p*d),s(m,0)!==Ml)continue;let L;n?L=l(m,48):L=s(m,28),L>0&&(u===null||L<u)&&(u=L)}return u??0}catch{return null}finally{He.closeSync(t)}}function Qr(e){let t=[];if(!He.existsSync(e))return t;let i=He.readdirSync(e,{withFileTypes:!0});for(let n of i){let r=ut.join(e,n.name);n.isDirectory()?t.push(...Qr(r)):n.name.endsWith(".so")&&t.push(r)}return t}function Hl(e){return e.includes("arm64-v8a")?"arm64-v8a":e.includes("x86_64")?"x86_64":"unknown"}var io=async e=>{if(ye()||(Pe.error(Ce.red(`You are not logged in. Run \`${f.nameLower} login\` first.`)),process.exit(1)),e.apk){await Kl(e);return}let i=process.cwd(),n=ai.join(i,"package.json");Nt.existsSync(n)||(Pe.error(Ce.red("No package.json found. Run this command from a project root.")),process.exit(1));let r=JSON.parse(Nt.readFileSync(n,"utf-8")),o=!!(r.dependencies?.expo||r.devDependencies?.expo);e.json||(Pe.info(Ce.dim(`Project: ${r.name||"unknown"} v${r.version||"0.0.0"}`)),Pe.info(Ce.dim(`Type: ${o?"Expo":"Bare React Native"}`)),Pe.info(""));let s={json:e.json,fix:e.fix,category:e.category,severity:e.severity,prebuild:e.prebuild},l=await Yr(i,s);e.json?console.log(JSON.stringify(qr(l,r),null,2)):Jr(l,e.severity);let a=l.some(c=>c.findings.some(u=>u.severity==="critical")),d=l.some(c=>c.findings.some(u=>u.severity==="high"));(a||d)&&process.exit(1)},eo=["16kb"];async function Kl(e){let t=e.category?.toLowerCase();t&&!eo.includes(t)&&(Pe.error(Ce.red(`Unknown APK check category: "${t}"`)),Pe.info(Ce.dim(`Available APK checks: ${eo.join(", ")}`)),process.exit(1));let i=await Vl(e.apk);i||process.exit(1);let n=!t,r=!1;(n||t==="16kb")&&(await Zr(i)||(r=!0)),r&&process.exit(1)}async function Vl(e){if(e.startsWith("build:")){let i=e.slice(6);return await zl(i)}if(e.startsWith("http://")||e.startsWith("https://"))return await no(e);let t=ai.resolve(e);return Nt.existsSync(t)?t:(Pe.error(Ce.red(`APK file not found: ${t}`)),null)}async function zl(e){let t=to();t.start(`Fetching APK from build ${e}...`);try{let i=await C.get(`/build/${e}`);if(i.data.status!=="success")throw new Error(i.data.message);let n=i.data.build;if(!n)throw new Error("Build not found");let r=n.artifacts?.find(o=>o.type?o.type==="apk":o.name?.endsWith(".apk")||o.url?.includes(".apk"));return!r||!r.url?(t.stop("No APK artifact found"),Pe.error(Ce.red("This build does not have an APK artifact.")),Pe.info(Ce.dim("Make sure the build produced an APK (not just an AAB).")),null):(t.stop(`Found build: ${n.buildId||e}`),await no(r.url))}catch(i){return t.stop("Failed to fetch build"),Pe.error(Ce.red(i.message)),null}}async function no(e){let t=to();t.start("Downloading APK...");try{let i=Nt.mkdtempSync(ai.join(jl.tmpdir(),`${f.nameLower}-audit-`)),n=ai.join(i,"app.apk"),r=await Gl.get(e,{responseType:"arraybuffer"});Nt.writeFileSync(n,r.data);let o=(r.data.length/(1024*1024)).toFixed(1);return t.stop(`Downloaded APK (${o} MB)`),n}catch(i){return t.stop("Download failed"),Pe.error(Ce.red(`Failed to download APK: ${i.message}`)),null}}var Jl=console.log;console.log=()=>{};Yl();console.log=Jl;me(fe.bgCyan.black(f.cliTag("Production Build Orchestrator")));var Xl=ql(import.meta.url),Zl=Xl("../package.json"),X=new Wl;X.name(f.nameLower).description(`${f.name} CLI: Powerful Cloud Infrastructure Tools`).version(Zl.version).option("-y, --yes","Automatically answer yes to all prompts",!1).option("--quiet","Suppress non-essential output",!1);X.command("agent").description("Start local device discovery agent for the Install Hub (port 7070)").action(async()=>{await tr()});X.command("host").description("Setup AWS S3 static hosting and CloudFront").action(async()=>{me(fe.bgCyan.black(f.cliTag("Hosting"))),await Zi()});X.command("sitemap").description("Generate sitemap.xml from Expo Router app structure").option("-o, --output <path>","Output path for sitemap.xml","./public/sitemap.xml").action(async e=>{me(fe.bgCyan.black(f.cliTag("Sitemap Generator"))),await nn(e)});X.command("build").description("Run a build on a cloud provider (AWS Spot Instances)").argument("[platform]","Target platform (android, ios)").option("--platform <os>","Target platform alias (android, ios) [Optional]").option("--repo <url>","Git Repository URL").option("--branch <name>","Git Branch").option("--ami <id>","AMI ID").option("--bucket <name>","S3 Bucket for artifacts").option("--region <region>","AWS Region").option("--aws-profile <name>","AWS Credentials Profile").option("-p, --build-profile <name>","Build Profile (e.g. production, staging)","production").option("--profile <name>","Build Profile (alias for --build-profile)").option("--dry-run","Generate User Data script without launching").option("--keep-instance","Do not terminate the instance after build").option("--subnet <id>","VPC Subnet ID to launch the instance in").option("--security-group <id>","VPC Security Group ID to use").option("--ssh-host <host>","Remote host for iOS build (SSH)").option("--ssh-user <user>","SSH username for remote host").option("--ssh-key <path>","Path to private SSH key for remote host").option("--ios-scheme <scheme>","iOS Scheme to build").option("--ios-team-id <id>","Apple Development Team ID").option("--ios-configuration <config>","Xcode configuration (Release/Debug)").option("--ios-export-method <method>","Export method (ad-hoc, app-store, development, enterprise)").option("--ios-api-key-id <id>","App Store Connect API Key ID").option("--ios-api-key-issuer <id>","App Store Connect API Key Issuer ID").option("--ios-api-key-path <path>","Path to App Store Connect API Key (.p8) file").option("--simulator","Build for iOS Simulator (no signing required)").addOption(new pt("--build-id <id>","Internal build ID").hideHelp()).addOption(new pt("--project-id <id>","Internal project ID").hideHelp()).addOption(new pt("--fail-only","Internal: mark an existing build failed").hideHelp()).addOption(new pt("--error <message>","Internal failure message").hideHelp()).option("--local","Run build on local machine").option("--auto-version","Automatically fetch and increment Android versionCode or iOS buildNumber from the store").option("--verbose","Enable verbose logging").option("--json-output <path>","Write build metadata JSON to a file for CI/CD").option("--maestro","Queue a managed Maestro test run after a successful build").option("--maestro-flows <path>","Maestro flow file or directory (default: .maestro)").option("--maestro-device <device>","Managed Maestro device profile").option("--maestro-retries <n>","Retries for the Maestro run","1").option("--maestro-record","Enable screen recording where supported").option("-y, --yes","Automatically answer yes to all prompts",!1).option("--quiet","Suppress non-essential output",!1).action(async(e,t)=>{let i=X.opts();t.yes=t.yes||i.yes,t.quiet=t.quiet||i.quiet,t.platform=e||t.platform,t.buildProfile=t.profile||t.buildProfile,t.quiet||me(fe.bgCyan.black(f.cliTag("Cloud Build"))),await Vt(t)});X.command("maestro").description("Run managed Maestro tests for an existing Mach build or artifact").option("--platform <os>","Target platform (android/ios)").option("-p, --profile <name>","Build profile to resolve when using --latest","production").option("--latest","Use the latest successful build for the platform/profile").option("--build-id <id>","Use a specific Mach build ID").option("--build-url <url>","Use a Mach build URL").option("--artifact-url <url>","Use a direct APK or iOS simulator app artifact URL").option("--maestro-flows <path>","Maestro flow file or directory (default: .maestro)").option("--maestro-device <device>","Managed Maestro device profile").option("--maestro-retries <n>","Retries for the Maestro run","1").option("--maestro-record","Enable screen recording where supported").option("--json-output <path>","Write test run metadata JSON to a file for CI/CD").action(async e=>{me(fe.bgCyan.black(f.cliTag("Maestro Testing"))),await xn(e)});X.command("update").description("Deploy an Over-The-Air (OTA) update to your live channel").option("--branch <name>","Channel or Branch to deploy to (e.g., production)","production").action(async e=>{me(fe.bgCyan.black(f.cliTag("OTA Update"))),await Er(e)});X.command("submit").description("Automated Store Submission (App Store / Google Play)").option("--platform <os>","Target platform (ios/android)").option("-p, --profile <name>","Build/submission profile to submit from (e.g. production, preprod)").option("--track <track>","Google Play Track (internal, alpha, beta, production)").option("--release-status <status>","Google Play release status (completed, draft, halted, inProgress)").option("--rollout <fraction>","Google Play staged rollout fraction for inProgress releases (example: 0.1)").option("--changes-not-sent-for-review","Commit Google Play changes without automatically sending them for review").option("--ssh-host <host>","Remote macOS host for iOS submission").option("--ssh-user <user>","SSH username for remote iOS submission").option("--ssh-key <path>","Path to private SSH key for remote iOS submission").option("--credential-id <id>","Service credential ID to use when multiple submission credentials exist").option("--local","Run submission on this machine (internal runner mode for iOS)").addOption(new pt("--submit-id <id>","Internal submission ID").hideHelp()).addOption(new pt("--project-id <id>","Internal project ID").hideHelp()).option("--json-output <path>","Write submission metadata JSON to a file for CI/CD").option("--latest","Use the latest successful build for submission").option("--build-id <id>","Use a specific build ID for submission").action(async e=>{let t=X.opts();e.quiet=e.quiet||t.quiet,e.yes=e.yes||t.yes,me(fe.bgCyan.black(f.cliTag("Store Submission"))),await hr(e)});X.command("login").description(`Login to ${f.name} Dashboard`).action(async()=>{me(fe.bgCyan.black(f.cliTag("Login"))),await or()});X.command("link").description(`Link local directory to a ${f.name} Project`).action(async()=>{me(fe.bgCyan.black(f.cliTag("Link Project"))),await ar()});X.command("me").description("Display currently logged in user details").action(async()=>{await Ar()});X.command("init").description(`Create a new ${f.name} Project`).action(async()=>{me(fe.bgCyan.black(f.cliTag("Init Project"))),await lr()});X.command("env").description("Manage Environment Variables").argument("<action>","Action to perform: set or list").argument("[args...]","Key=Value pairs for set action").action(async(e,t)=>{me(fe.bgCyan.black(f.cliTag("Env Manager"))),await pr(e,t)});X.command("start").description("Start the development server (Metro)").option("-p, --build-profile <name>","Build profile (e.g. development, staging)","development").option("--tunnel","Use ngrok tunnel").option("--lan","Use LAN IP").option("--localhost","Use localhost").option("-c, --clear","Clear Metro cache").option("--port <number>","Port to listen on").option("--ios","Start on iOS").option("--android","Start on Android").option("--web","Start on Web").action(async e=>{me(fe.bgCyan.black(f.cliTag("Dev Server"))),await _r(e)});X.command("config").description("Show resolved configuration for a profile").option("-p, --profile <name>","Build profile to resolve","development").option("--json","Output as JSON").action(async e=>{await Pr(e)});X.command("credentials").description("Unified, interactive credential management (iOS/Android)").option("-p, --profile <name>","Build profile (production, staging, development)").option("--force","Force recreate certificates (nuke existing on Apple Portal)",!1).action(async e=>{let{credentialsMainCommand:t}=await import("./credentials-Y4SOYAM2.js");await t(e)});X.command("credentials:setup").description("Automated credential provisioning (iOS/Android) [Legacy]").requiredOption("--platform <os>","Platform: ios or android").option("--profile <name>","Build profile (production, staging, development)").option("--bundle-id <id>","Bundle ID / Package Name (optional, auto-detected)").option("--team-id <id>","Apple Team ID (iOS only)").option("--key-alias <alias>","Android keystore alias (optional, auto-generated)").option("--aws-profile <name>","AWS Credentials Profile (for S3 storage)").option("--force","Force recreate certificates (nuke existing on Apple Portal)",!1).action(async e=>{me(fe.bgCyan.black(f.cliTag("Credentials Setup"))),await mt(e),ro(fe.green("Done!"))});X.command("credentials:service").description("Upload Service Credentials (ASC API Key / Google Service JSON) [Legacy]").requiredOption("--platform <os>","Platform: ios or android").option("--file <path>","Path to credential file (.p8 or .json)").option("--issuer-id <id>","ASC API Key Issuer ID (iOS only)").option("--key-id <id>","ASC API Key ID (iOS only)").option("--bundle-id <id>","Bundle identifier / Android package name to attach this service credential to").option("--package-name <name>","Android package name to attach this service credential to").option("-p, --profile <name>","Build profile to resolve package/bundle identifier from config").action(async e=>{me(fe.bgCyan.black(f.cliTag("Service Credentials"))),await qi(e),ro(fe.green("Done!"))});var Ki=X.command("device").description("Manage registered iOS test devices");Ki.command("register").description("Register a connected iOS device or enter UDID manually").option("--udid <udid>","Device UDID (skip auto-detection)").option("--name <name>","Device name").action(async e=>{await Xt("register",e)});Ki.command("list").description("List all registered devices").action(async()=>{await Xt("list",{})});Ki.command("remove").description("Remove a registered device").option("--udid <udid>","Device UDID to remove").action(async e=>{await Xt("remove",e)});X.command("audit").description("Run automated security audit on the project or APK").option("--apk <path>","Path to APK file (runs APK diagnostics like 16KB alignment)").option("--json","Output results as JSON (for CI/CD)").option("--fix","Auto-apply fixes where possible").option("--category <name>","Run only a specific check category (e.g. 16kb, permissions, secrets)").option("--severity <level>","Minimum severity to display (critical, high, medium, low, info)").option("--prebuild","Run expo prebuild for deeper manifest/plist analysis").action(async e=>{me(fe.bgCyan.black(f.cliTag(e.apk?"APK Audit":"Security Audit"))),await io(e)});var Ql=new Set(["login"]);X.hook("preAction",(e,t)=>{let i=t.name();Ql.has(i)||Wi()});X.on("command:*",()=>{console.error(`Invalid command: %s
-See --help for a list of available commands.`,X.args.join(" ")),process.exit(1)});process.argv.slice(2).length||X.help();X.parse(process.argv);
+`));for(let a of s)le.error(re.red(`${re.bold(a.name)} ${re.dim(`(${a.arch})`)}`)),le.info(re.dim(`  PT_LOAD alignment: 2**${Math.log2(a.align)} (${a.align} bytes, needs 2**14 = ${qr})`))}return l.length>0&&(console.log(""),le.success(re.green(`${l.length} librar${l.length===1?"y":"ies"} correctly aligned (2**14 or higher).`))),console.log(""),s.length===0?(le.success(re.green.bold("ELF Verification Successful. APK is 16KB compatible.")),!0):(le.error(re.red.bold(`Found ${s.length} unaligned lib${s.length===1?"":"s"} (arm64-v8a/x86_64 libs need to be aligned).`)),console.log(""),le.info(re.yellow("To fix this:")),le.info(re.dim("  1. Rebuild with NDK r28+ which defaults to 16KB page alignment")),le.info(re.dim("  2. Or set -DANDROID_SUPPORT_FLEXIBLE_PAGE_SIZES=ON in CMake")),le.info(re.dim("  3. Update third-party libraries that ship prebuilt .so files")),le.info(re.dim("  4. After rebuilding: zipalign -p -f -v 16 input.apk output.apk")),console.log(""),le.info(re.dim("Reference: https://developer.android.com/guide/practices/page-sizes")),!1)}catch(r){return i.stop("Analysis failed."),le.error(re.red(`Failed to analyze APK: ${r.message}`)),!1}finally{try{He.rmSync(n,{recursive:!0,force:!0})}catch{}}}function Fl(e){let t=He.openSync(e,"r");try{let i=Buffer.alloc(64);if(He.readSync(t,i,0,64,0),!i.subarray(0,4).equals(Bl))return null;let n=i[4]===2,r=i[5]===1,o=(p,m)=>r?p.readUInt16LE(m):p.readUInt16BE(m),s=(p,m)=>r?p.readUInt32LE(m):p.readUInt32BE(m),l=(p,m)=>Number(r?p.readBigUInt64LE(m):p.readBigUInt64BE(m)),a,d,c;n?(a=l(i,32),d=o(i,54),c=o(i,56)):(a=s(i,28),d=o(i,42),c=o(i,44));let u=null;for(let p=0;p<c;p++){let m=Buffer.alloc(d);if(He.readSync(t,m,0,d,a+p*d),s(m,0)!==Ml)continue;let L;n?L=l(m,48):L=s(m,28),L>0&&(u===null||L<u)&&(u=L)}return u??0}catch{return null}finally{He.closeSync(t)}}function Qr(e){let t=[];if(!He.existsSync(e))return t;let i=He.readdirSync(e,{withFileTypes:!0});for(let n of i){let r=ut.join(e,n.name);n.isDirectory()?t.push(...Qr(r)):n.name.endsWith(".so")&&t.push(r)}return t}function Hl(e){return e.includes("arm64-v8a")?"arm64-v8a":e.includes("x86_64")?"x86_64":"unknown"}var io=async e=>{if(ye()||(Pe.error(Ce.red(`You are not logged in. Run \`${f.nameLower} login\` first.`)),process.exit(1)),e.apk){await Kl(e);return}let i=process.cwd(),n=ai.join(i,"package.json");Nt.existsSync(n)||(Pe.error(Ce.red("No package.json found. Run this command from a project root.")),process.exit(1));let r=JSON.parse(Nt.readFileSync(n,"utf-8")),o=!!(r.dependencies?.expo||r.devDependencies?.expo);e.json||(Pe.info(Ce.dim(`Project: ${r.name||"unknown"} v${r.version||"0.0.0"}`)),Pe.info(Ce.dim(`Type: ${o?"Expo":"Bare React Native"}`)),Pe.info(""));let s={json:e.json,fix:e.fix,category:e.category,severity:e.severity,prebuild:e.prebuild},l=await Yr(i,s);e.json?console.log(JSON.stringify(Xr(l,r),null,2)):Jr(l,e.severity);let a=l.some(c=>c.findings.some(u=>u.severity==="critical")),d=l.some(c=>c.findings.some(u=>u.severity==="high"));(a||d)&&process.exit(1)},eo=["16kb"];async function Kl(e){let t=e.category?.toLowerCase();t&&!eo.includes(t)&&(Pe.error(Ce.red(`Unknown APK check category: "${t}"`)),Pe.info(Ce.dim(`Available APK checks: ${eo.join(", ")}`)),process.exit(1));let i=await Vl(e.apk);i||process.exit(1);let n=!t,r=!1;(n||t==="16kb")&&(await Zr(i)||(r=!0)),r&&process.exit(1)}async function Vl(e){if(e.startsWith("build:")){let i=e.slice(6);return await zl(i)}if(e.startsWith("http://")||e.startsWith("https://"))return await no(e);let t=ai.resolve(e);return Nt.existsSync(t)?t:(Pe.error(Ce.red(`APK file not found: ${t}`)),null)}async function zl(e){let t=to();t.start(`Fetching APK from build ${e}...`);try{let i=await C.get(`/build/${e}`);if(i.data.status!=="success")throw new Error(i.data.message);let n=i.data.build;if(!n)throw new Error("Build not found");let r=n.artifacts?.find(o=>o.type?o.type==="apk":o.name?.endsWith(".apk")||o.url?.includes(".apk"));return!r||!r.url?(t.stop("No APK artifact found"),Pe.error(Ce.red("This build does not have an APK artifact.")),Pe.info(Ce.dim("Make sure the build produced an APK (not just an AAB).")),null):(t.stop(`Found build: ${n.buildId||e}`),await no(r.url))}catch(i){return t.stop("Failed to fetch build"),Pe.error(Ce.red(i.message)),null}}async function no(e){let t=to();t.start("Downloading APK...");try{let i=Nt.mkdtempSync(ai.join(jl.tmpdir(),`${f.nameLower}-audit-`)),n=ai.join(i,"app.apk"),r=await Gl.get(e,{responseType:"arraybuffer"});Nt.writeFileSync(n,r.data);let o=(r.data.length/(1024*1024)).toFixed(1);return t.stop(`Downloaded APK (${o} MB)`),n}catch(i){return t.stop("Download failed"),Pe.error(Ce.red(`Failed to download APK: ${i.message}`)),null}}var Jl=console.log;console.log=()=>{};Yl();console.log=Jl;me(fe.bgCyan.black(f.cliTag("Production Build Orchestrator")));var ql=Xl(import.meta.url),Zl=ql("../package.json"),q=new Wl;q.name(f.nameLower).description(`${f.name} CLI: Powerful Cloud Infrastructure Tools`).version(Zl.version).option("-y, --yes","Automatically answer yes to all prompts",!1).option("--quiet","Suppress non-essential output",!1);q.command("agent").description("Start local device discovery agent for the Install Hub (port 7070)").action(async()=>{await tr()});q.command("host").description("Setup AWS S3 static hosting and CloudFront").action(async()=>{me(fe.bgCyan.black(f.cliTag("Hosting"))),await Zi()});q.command("sitemap").description("Generate sitemap.xml from Expo Router app structure").option("-o, --output <path>","Output path for sitemap.xml","./public/sitemap.xml").action(async e=>{me(fe.bgCyan.black(f.cliTag("Sitemap Generator"))),await nn(e)});q.command("build").description("Run a build on a cloud provider (AWS Spot Instances)").argument("[platform]","Target platform (android, ios)").option("--platform <os>","Target platform alias (android, ios) [Optional]").option("--repo <url>","Git Repository URL").option("--branch <name>","Git Branch").option("--ami <id>","AMI ID").option("--bucket <name>","S3 Bucket for artifacts").option("--region <region>","AWS Region").option("--aws-profile <name>","AWS Credentials Profile").option("-p, --build-profile <name>","Build Profile (e.g. production, staging)","production").option("--profile <name>","Build Profile (alias for --build-profile)").option("--dry-run","Generate User Data script without launching").option("--keep-instance","Do not terminate the instance after build").option("--subnet <id>","VPC Subnet ID to launch the instance in").option("--security-group <id>","VPC Security Group ID to use").option("--ssh-host <host>","Remote host for iOS build (SSH)").option("--ssh-user <user>","SSH username for remote host").option("--ssh-key <path>","Path to private SSH key for remote host").option("--ios-scheme <scheme>","iOS Scheme to build").option("--ios-team-id <id>","Apple Development Team ID").option("--ios-configuration <config>","Xcode configuration (Release/Debug)").option("--ios-export-method <method>","Export method (ad-hoc, app-store, development, enterprise)").option("--ios-api-key-id <id>","App Store Connect API Key ID").option("--ios-api-key-issuer <id>","App Store Connect API Key Issuer ID").option("--ios-api-key-path <path>","Path to App Store Connect API Key (.p8) file").option("--simulator","Build for iOS Simulator (no signing required)").addOption(new pt("--build-id <id>","Internal build ID").hideHelp()).addOption(new pt("--project-id <id>","Internal project ID").hideHelp()).addOption(new pt("--fail-only","Internal: mark an existing build failed").hideHelp()).addOption(new pt("--error <message>","Internal failure message").hideHelp()).option("--local","Run build on local machine").option("--auto-version","Automatically fetch and increment Android versionCode or iOS buildNumber from the store").option("--verbose","Enable verbose logging").option("--json-output <path>","Write build metadata JSON to a file for CI/CD").option("--maestro","Queue a managed Maestro test run after a successful build").option("--maestro-flows <path>","Maestro flow file or directory (default: .maestro)").option("--maestro-device <device>","Managed Maestro device profile").option("--maestro-retries <n>","Retries for the Maestro run","1").option("--maestro-record","Enable screen recording where supported").option("-y, --yes","Automatically answer yes to all prompts",!1).option("--quiet","Suppress non-essential output",!1).action(async(e,t)=>{let i=q.opts();t.yes=t.yes||i.yes,t.quiet=t.quiet||i.quiet,t.platform=e||t.platform,t.buildProfile=t.profile||t.buildProfile,t.quiet||me(fe.bgCyan.black(f.cliTag("Cloud Build"))),await Vt(t)});q.command("maestro").description("Run managed Maestro tests for an existing Mach build or artifact").option("--platform <os>","Target platform (android/ios)").option("-p, --profile <name>","Build profile to resolve when using --latest","production").option("--latest","Use the latest successful build for the platform/profile").option("--build-id <id>","Use a specific Mach build ID").option("--build-url <url>","Use a Mach build URL").option("--artifact-url <url>","Use a direct APK or iOS simulator app artifact URL").option("--maestro-flows <path>","Maestro flow file or directory (default: .maestro)").option("--maestro-device <device>","Managed Maestro device profile").option("--maestro-retries <n>","Retries for the Maestro run","1").option("--maestro-record","Enable screen recording where supported").option("--json-output <path>","Write test run metadata JSON to a file for CI/CD").action(async e=>{me(fe.bgCyan.black(f.cliTag("Maestro Testing"))),await xn(e)});q.command("update").description("Deploy an Over-The-Air (OTA) update to your live channel").option("--branch <name>","Channel or Branch to deploy to (e.g., production)","production").action(async e=>{me(fe.bgCyan.black(f.cliTag("OTA Update"))),await Er(e)});q.command("submit").description("Automated Store Submission (App Store / Google Play)").option("--platform <os>","Target platform (ios/android)").option("-p, --profile <name>","Build/submission profile to submit from (e.g. production, preprod)").option("--track <track>","Google Play Track (internal, alpha, beta, production)").option("--release-status <status>","Google Play release status (completed, draft, halted, inProgress)").option("--rollout <fraction>","Google Play staged rollout fraction for inProgress releases (example: 0.1)").option("--changes-not-sent-for-review","Commit Google Play changes without automatically sending them for review").option("--ssh-host <host>","Remote macOS host for iOS submission").option("--ssh-user <user>","SSH username for remote iOS submission").option("--ssh-key <path>","Path to private SSH key for remote iOS submission").option("--credential-id <id>","Service credential ID to use when multiple submission credentials exist").option("--local","Run submission on this machine (internal runner mode for iOS)").addOption(new pt("--submit-id <id>","Internal submission ID").hideHelp()).addOption(new pt("--project-id <id>","Internal project ID").hideHelp()).option("--json-output <path>","Write submission metadata JSON to a file for CI/CD").option("--latest","Use the latest successful build for submission").option("--build-id <id>","Use a specific build ID for submission").action(async e=>{let t=q.opts();e.quiet=e.quiet||t.quiet,e.yes=e.yes||t.yes,me(fe.bgCyan.black(f.cliTag("Store Submission"))),await hr(e)});q.command("login").description(`Login to ${f.name} Dashboard`).action(async()=>{me(fe.bgCyan.black(f.cliTag("Login"))),await or()});q.command("link").description(`Link local directory to a ${f.name} Project`).action(async()=>{me(fe.bgCyan.black(f.cliTag("Link Project"))),await ar()});q.command("me").description("Display currently logged in user details").action(async()=>{await Ar()});q.command("init").description(`Create a new ${f.name} Project`).action(async()=>{me(fe.bgCyan.black(f.cliTag("Init Project"))),await lr()});q.command("env").description("Manage Environment Variables").argument("<action>","Action to perform: set or list").argument("[args...]","Key=Value pairs for set action").action(async(e,t)=>{me(fe.bgCyan.black(f.cliTag("Env Manager"))),await pr(e,t)});q.command("start").description("Start the development server (Metro)").option("-p, --build-profile <name>","Build profile (e.g. development, staging)","development").option("--tunnel","Use ngrok tunnel").option("--lan","Use LAN IP").option("--localhost","Use localhost").option("-c, --clear","Clear Metro cache").option("--port <number>","Port to listen on").option("--ios","Start on iOS").option("--android","Start on Android").option("--web","Start on Web").action(async e=>{me(fe.bgCyan.black(f.cliTag("Dev Server"))),await _r(e)});q.command("config").description("Show resolved configuration for a profile").option("-p, --profile <name>","Build profile to resolve","development").option("--json","Output as JSON").action(async e=>{await Pr(e)});q.command("credentials").description("Unified, interactive credential management (iOS/Android)").option("-p, --profile <name>","Build profile (production, staging, development)").option("--force","Force recreate certificates (nuke existing on Apple Portal)",!1).action(async e=>{let{credentialsMainCommand:t}=await import("./credentials-LDTYEZRC.js");await t(e)});q.command("credentials:setup").description("Automated credential provisioning (iOS/Android) [Legacy]").requiredOption("--platform <os>","Platform: ios or android").option("--profile <name>","Build profile (production, staging, development)").option("--bundle-id <id>","Bundle ID / Package Name (optional, auto-detected)").option("--team-id <id>","Apple Team ID (iOS only)").option("--key-alias <alias>","Android keystore alias (optional, auto-generated)").option("--aws-profile <name>","AWS Credentials Profile (for S3 storage)").option("--force","Force recreate certificates (nuke existing on Apple Portal)",!1).action(async e=>{me(fe.bgCyan.black(f.cliTag("Credentials Setup"))),await mt(e),ro(fe.green("Done!"))});q.command("credentials:service").description("Upload Service Credentials (ASC API Key / Google Service JSON) [Legacy]").requiredOption("--platform <os>","Platform: ios or android").option("--file <path>","Path to credential file (.p8 or .json)").option("--issuer-id <id>","ASC API Key Issuer ID (iOS only)").option("--key-id <id>","ASC API Key ID (iOS only)").option("--bundle-id <id>","Bundle identifier / Android package name to attach this service credential to").option("--package-name <name>","Android package name to attach this service credential to").option("-p, --profile <name>","Build profile to resolve package/bundle identifier from config").action(async e=>{me(fe.bgCyan.black(f.cliTag("Service Credentials"))),await Xi(e),ro(fe.green("Done!"))});var Ki=q.command("device").description("Manage registered iOS test devices");Ki.command("register").description("Register a connected iOS device or enter UDID manually").option("--udid <udid>","Device UDID (skip auto-detection)").option("--name <name>","Device name").action(async e=>{await qt("register",e)});Ki.command("list").description("List all registered devices").action(async()=>{await qt("list",{})});Ki.command("remove").description("Remove a registered device").option("--udid <udid>","Device UDID to remove").action(async e=>{await qt("remove",e)});q.command("audit").description("Run automated security audit on the project or APK").option("--apk <path>","Path to APK file (runs APK diagnostics like 16KB alignment)").option("--json","Output results as JSON (for CI/CD)").option("--fix","Auto-apply fixes where possible").option("--category <name>","Run only a specific check category (e.g. 16kb, permissions, secrets)").option("--severity <level>","Minimum severity to display (critical, high, medium, low, info)").option("--prebuild","Run expo prebuild for deeper manifest/plist analysis").action(async e=>{me(fe.bgCyan.black(f.cliTag(e.apk?"APK Audit":"Security Audit"))),await io(e)});var Ql=new Set(["login"]);q.hook("preAction",(e,t)=>{let i=t.name();Ql.has(i)||Wi()});q.on("command:*",()=>{console.error(`Invalid command: %s
+See --help for a list of available commands.`,q.args.join(" ")),process.exit(1)});process.argv.slice(2).length||q.help();q.parse(process.argv);