@radhya/mach 2.0.14 → 2.0.23

package/README.md

@@ -240,6 +240,12 @@ mach credentials
 
 Mach walks you through each step: choosing a bundle ID, picking a distribution type (development / ad-hoc / App Store), and syncing certificates. Everything is encrypted at rest and injected at build time.
 
+### Apple Developer Team Selection
+
+For iOS credentials, Mach asks for your Apple ID and then lists the Apple Developer teams connected to that account through `@expo/apple-utils`. If the account has multiple teams, choose the team to use for signing; if Apple cannot return the list, Mach falls back to manual Team ID entry. Fastlane is still used later for the certificate/profile sync, but it is no longer required just to display the team picker.
+
+Mach saves the selected Team ID to the Dashboard for credential storage. It also asks whether to write the Team ID into `mach.config.json` for the selected profile. Accepting the prompt writes only `submit.<profile>.ios.appleTeamId`; production defaults to yes, while development and staging default to no so local config is not cluttered unless you want profile-specific signing.
+
 ### Multiple Bundle IDs
 
 One project can have multiple bundle identifiers (e.g. `com.example.app`, `com.example.app.staging`, `com.example.app.dev`). Each bundle ID has its own independent set of credentials per distribution type. Select or add a bundle ID at the start of `mach credentials` — or skip the prompt with the `--bundle-id` flag for CI:
@@ -337,7 +343,7 @@ Create a `mach.config.json` in your project root:
 | Property               | Description                                                                                                                    |
 | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------ |
 | `ios.bundleIdentifier` | iOS bundle ID used for signing, App Store Connect lookup, and submit                                                           |
-| `ios.appleTeamId`      | Apple Developer Team ID used for iOS signing                                                                                   |
+| `ios.appleTeamId`      | Optional global Apple Developer Team ID used for iOS signing. Profile-specific `submit.<profile>.ios.appleTeamId` overrides it |
 | `ios.ascAppId`         | App Store Connect app id. Optional when Mach can find the app by bundle ID; recommended for reliable iOS buildNumber lookup    |
 | `ios.buildNumber`      | Set to `"auto"` to let Mach resolve the next iOS CFBundleVersion from App Store Connect and seed the server-side build counter |
 | `android.package`      | Android package name used for signing, Google Play lookup, and submit                                                          |

package/dist/chunk-FLX7VYCU.js

@@ -0,0 +1,69 @@
+import{a as m,h as W}from"./chunk-S64YFTRR.js";import{log as o,spinner as Ae,text as q,password as ve,select as ne,confirm as lt,isCancel as T,cancel as U,intro as Yt,outro as Dt,note as dt}from"@clack/prompts";import{log as N,spinner as Ie,text as j,select as le,isCancel as Y,cancel as L,note as we,confirm as Oe}from"@clack/prompts";import G from"chalk";import{spawnSync as fe}from"child_process";import F from"fs";import $ from"path";import Ge from"os";import ye from"fs";var It=["react-native","expo","flutter"],wn="react-native",$e=e=>{if(typeof e!="string")return;let t=e.trim();return t.length>0?t:void 0},Je=e=>$e(e)?.toUpperCase()||void 0,he=(...e)=>{for(let t of e){let n=$e(t);if(n)return n}};function At(e){if(typeof e!="string")return;let t=e.trim().toLowerCase();if(t==="react-native"||t==="react_native"||t==="reactnative")return"react-native";if(t==="expo")return"expo";if(t==="flutter")return"flutter"}function vn(e){let t=At(e?.framework);if(t)return t;let n=It.map(a=>`"${a}"`).join(", ");throw e?.framework?new Error(`${m.configFileName} has invalid framework "${e.framework}". Use one of: ${n}.`):new Error(`${m.configFileName} is missing required field "framework". Add one of: ${n}.`)}function ge(e,t="production"){let n=e?.ios||{},a=e?.submit?.[t]?.ios||{},i=e?.submit?.production?.ios||{},r=Je(n.appleTeamId||n.developerTeamId||a.appleTeamId||a.developerTeamId||i.appleTeamId||i.developerTeamId),s=he(n.appStoreConnectTeamId,n.itcTeamId,n.appleConnectTeamId,a.appStoreConnectTeamId,a.itcTeamId,a.appleConnectTeamId,i.appStoreConnectTeamId,i.itcTeamId,i.appleConnectTeamId);return{teamId:r,teamName:he(n.appleTeamName,n.teamName,n.developerTeamName,a.appleTeamName,a.teamName,a.developerTeamName,i.appleTeamName,i.teamName,i.developerTeamName),developerTeamId:Je(n.developerTeamId||a.developerTeamId||i.developerTeamId||r),appStoreConnectTeamId:s,providerId:he(n.providerId,a.providerId,i.providerId,s),providerName:he(n.providerName,n.appStoreConnectTeamName,a.providerName,a.appStoreConnectTeamName,i.providerName,i.appStoreConnectTeamName)}}function Zn(e){if(e){if(!ye.existsSync(e))return null;try{return JSON.parse(ye.readFileSync(e,"utf-8"))}catch{return null}}if(!ye.existsSync(`./${m.configFileName}`))return null;try{return JSON.parse(ye.readFileSync(`./${m.configFileName}`,"utf-8"))}catch{return null}}function re(e,t,n=new Set){if(n.has(t))throw new Error(`Circular inheritance detected in profile: ${t}`);n.add(t);let a=e.build?.[t];if(!a)return null;let i={...a};if(a.extends){let r=re(e,a.extends,n);r&&(i={...r,...a,env:{...r.env,...a.env},ios:{...r.ios,...a.ios},android:{...r.android,...a.android}})}if(i.envGroups&&Array.isArray(i.envGroups)){let r={};for(let s of i.envGroups){let l=e.envGroups?.[s];l?Object.assign(r,l):log.warn(`Environment group not found: ${s}`)}i.env={...r,...i.env}}return i}function be(e,t){let n=t?re(e,t)||{}:{};if(n.android?.package)return n.android.package;if(n.androidPackage)return n.androidPackage;if(e.android?.package)return e.android.package;if(e.expo?.android?.package)return e.expo.android.package}function Se(e,t){let n=t?re(e,t)||{}:{};if(n.ios?.bundleIdentifier)return n.ios.bundleIdentifier;if(n.iosBundleIdentifier)return n.iosBundleIdentifier;if(e.ios?.bundleIdentifier)return e.ios.bundleIdentifier;if(e.ios?.bundleId)return e.ios.bundleId;if(e.expo?.ios?.bundleIdentifier)return e.expo.ios.bundleIdentifier}var Rn=(e,t=`${m.envPrefix}`)=>{let n={},a=(i,r)=>{if(i)for(let s in i){let l=i[s],c=`${r}${s.toUpperCase().replace(/[^A-Z0-9]/g,"_")}`;l!==null&&typeof l=="object"&&!Array.isArray(l)?a(l,`${c}_`):n[c]=String(l)}};return a(e,t),n};import{cancel as Re,confirm as Ct,isCancel as We,log as ie,select as yt,text as ht}from"@clack/prompts";import ae from"chalk";import bt from"fs";import{createRequire as St}from"module";import wt from"os";import Ue from"path";var vt=St(import.meta.url),Ze=null;function Zt(){return Ze||(Ze=vt("@expo/apple-utils")),Ze}function se(){let e=process.env.HOME||wt.homedir(),t=process.env.FASTLANE_GEM_HOME||Ue.join(e,".local/share/fastlane/3.4.0");return{...process.env,PATH:[process.env.FASTLANE_BIN_DIR,"/usr/local/opt/ruby/bin","/opt/homebrew/opt/ruby/bin","/usr/local/bin","/opt/homebrew/bin","/usr/local/Cellar/fastlane/2.227.0/libexec/bin","/opt/homebrew/Cellar/fastlane/2.227.0/libexec/bin",Ue.join(t,"bin"),process.env.PATH].filter(Boolean).join(":"),GEM_HOME:t,GEM_PATH:[t,"/usr/local/Cellar/fastlane/2.227.0/libexec","/opt/homebrew/Cellar/fastlane/2.227.0/libexec",process.env.GEM_PATH].filter(Boolean).join(":"),FASTLANE_INSTALLED_VIA_HOMEBREW:"true",FASTLANE_SKIP_UPDATE_CHECK:"1",FASTLANE_HIDE_CHANGELOG:"1",LANG:process.env.LANG||"en_US.UTF-8",LC_ALL:process.env.LC_ALL||"en_US.UTF-8",CI:"1"}}function Rt(e,t="production"){return e.submit||(e.submit={}),e.submit[t]||(e.submit[t]={}),e.submit[t].ios||(e.submit[t].ios={}),e.submit[t].ios}function Wt(e,t,n="production"){if(!e||!t.id)return;let a=Rt(e,n);a.appleTeamId=t.id;try{bt.writeFileSync(`./${m.configFileName}`,JSON.stringify(e,null,2))}catch{}}function Vt(e){let t=String(e?.teamId||e?.id||"").trim().toUpperCase();return t?{id:t,name:String(e?.name||"").trim()||void 0,type:String(e?.type||"").trim()||void 0}:null}async function kt(e){try{let{Auth:t,Teams:n}=Zt(),a=await t.loginAsync({username:e},{autoResolveProvider:!0}),i=String(a?.context?.teamId||"").trim().toUpperCase(),r=await n.getTeamsAsync(),s=new Map;for(let f of r||[]){let I=Vt(f);I&&s.set(I.id,I)}let l=Array.from(s.values()),c=i?l.find(f=>f.id===i)||{id:i}:void 0;return{teams:l,selectedTeam:c}}catch(t){let n=t instanceof Error?t.message:String(t||"");return ie.warn(ae.yellow(`Apple Developer team lookup failed${n?`: ${n}`:""}`)),{teams:[]}}}async function He(){ie.warn(ae.yellow(`
+Apple Team ID is required to fetch certificates.`)),ie.info(ae.dim("You can find this at: https://developer.apple.com/account -> Membership Details"));let e=await ht({message:"Enter your 10-character Apple Team ID:",placeholder:"e.g. SA56KTS33U",validate:t=>/^[A-Z0-9]{10}$/i.test(t.trim())?void 0:"Team ID must be exactly 10 letters/numbers"});return We(e)?(Re("Operation cancelled"),null):{id:e.trim().toUpperCase()}}function Nt(e){let t=[e.id,e.type].filter(Boolean);return t.length>0?t.join(" \xB7 "):void 0}async function Tt(e,t){if(!e.config)return!1;if(e.persistConfig)return!0;if(!e.promptToPersistConfig)return!1;let n=e.profile||"production",a=await Ct({message:`Save Apple Team ID ${t} to ${m.configFileName} for "${n}" profile?`,initialValue:n==="production"});return We(a)?(Re("Operation cancelled"),null):a}async function me(e){let t=e.initialTeam?.teamId?.trim().toUpperCase();if(t){let f=e.initialTeam?.developerTeamId?.trim().toUpperCase();return{...e.initialTeam,teamId:t,developerTeamId:f||t}}ie.info(ae.blue("Fetching Apple Developer teams..."));let{teams:n,selectedTeam:a}=await kt(e.appleId),i;if(a)i=a,ie.success(ae.green(`\u2713 Using Apple Developer team ${i.name||i.id} (${i.id})`));else if(n.length===1)i=n[0],ie.success(ae.green(`\u2713 Using Apple Developer team ${i.name||i.id} (${i.id})`));else if(n.length>1){let f=await yt({message:"Select Apple Developer team:",options:[...n.map(I=>({value:I.id,label:I.name||I.id,hint:Nt(I)})),{value:"__manual__",label:"Enter Team ID manually",hint:"Use if your team is not listed"}]});if(We(f))return Re("Operation cancelled"),null;i=f==="__manual__"?await He():n.find(I=>I.id===f)||{id:f}}else ie.warn(ae.yellow("Could not list Apple Developer teams automatically.")),i=await He();if(!i)return null;let r=i.id.trim().toUpperCase(),s=i.name?.trim(),l={...e.initialTeam,teamId:r,teamName:s||e.initialTeam?.teamName,developerTeamId:r},c=await Tt(e,r);return c===null?null:(c&&Wt(e.config,{...i,id:r,name:s},e.profile),e.saveTeamId&&await e.saveTeamId(r,s),l)}var Gt="cmVxdWlyZSAnc3BhY2VzaGlwJwpyZXF1aXJlICdqc29uJwoKZGVmIHJlYWRfdGVhbV9maWVsZCh0ZWFtLCAqa2V5cykKICBrZXlzLmVhY2ggZG8gfGtleXwKICAgIGJlZ2luCiAgICAgIHZhbHVlID0gdGVhbVtrZXldIGlmIHRlYW0ucmVzcG9uZF90bz8oOltdKQogICAgICByZXR1cm4gdmFsdWUgaWYgdmFsdWUgJiYgdmFsdWUudG9fcy5sZW5ndGggPiAwCiAgICByZXNjdWUKICAgIGVuZAoKICAgIG1ldGhvZF9uYW1lID0ga2V5LnRvX3MKICAgIGlmIHRlYW0ucmVzcG9uZF90bz8obWV0aG9kX25hbWUpCiAgICAgIHZhbHVlID0gdGVhbS5wdWJsaWNfc2VuZChtZXRob2RfbmFtZSkKICAgICAgcmV0dXJuIHZhbHVlIGlmIHZhbHVlICYmIHZhbHVlLnRvX3MubGVuZ3RoID4gMAogICAgZW5kCiAgZW5kCgogIG5pbAplbmQKCmRlZiBub3JtYWxpemVfdGVhbV9uYW1lKG5hbWUpCiAgbmFtZS50b19zLmRvd25jYXNlLmdzdWIoL1teYS16MC05XSsvLCAnICcpLnN0cmlwCmVuZAoKZGVmIHBvcnRhbF90ZWFtX25hbWUKICB0ZWFtX2lkID0gRU5WWydGQVNUTEFORV9URUFNX0lEJ10udG9fcwogIHRlYW1zID0gU3BhY2VzaGlwOjpQb3J0YWwuY2xpZW50LnRlYW1zCiAgdGVhbXMgPSB0ZWFtcy52YWx1ZXMgaWYgdGVhbXMuaXNfYT8oSGFzaCkKCiAgdGVhbSA9IEFycmF5KHRlYW1zKS5maW5kIGRvIHx0fAogICAgWwogICAgICByZWFkX3RlYW1fZmllbGQodCwgJ3RlYW1JZCcsIDp0ZWFtSWQpLAogICAgICByZWFkX3RlYW1fZmllbGQodCwgJ3RlYW1faWQnLCA6dGVhbV9pZCksCiAgICAgIHJlYWRfdGVhbV9maWVsZCh0LCAnaWQnLCA6aWQpCiAgICBdLmNvbXBhY3QubWFwKCY6dG9fcykuaW5jbHVkZT8odGVhbV9pZCkKICBlbmQKCiAgcmVhZF90ZWFtX2ZpZWxkKHRlYW0sICduYW1lJywgOm5hbWUsICd0ZWFtTmFtZScsIDp0ZWFtTmFtZSwgJ2Rpc3BsYXlOYW1lJywgOmRpc3BsYXlOYW1lKQpyZXNjdWUgPT4gZQogICRzdGRlcnIucHV0cyAiREVCVUc6IENvdWxkIG5vdCByZXNvbHZlIERldmVsb3BlciBQb3J0YWwgdGVhbSBuYW1lOiAje2UubWVzc2FnZX0iCiAgbmlsCmVuZAoKZGVmIHR1bmVzX3RlYW1faWQodGVhbSkKICByZWFkX3RlYW1fZmllbGQoCiAgICB0ZWFtLAogICAgJ3Byb3ZpZGVySWQnLCA6cHJvdmlkZXJJZCwKICAgICdwcm92aWRlcl9pZCcsIDpwcm92aWRlcl9pZCwKICAgICdjb250ZW50UHJvdmlkZXJJZCcsIDpjb250ZW50UHJvdmlkZXJJZCwKICAgICdjb250ZW50X3Byb3ZpZGVyX2lkJywgOmNvbnRlbnRfcHJvdmlkZXJfaWQsCiAgICAndGVhbUlkJywgOnRlYW1JZCwKICAgICd0ZWFtX2lkJywgOnRlYW1faWQsCiAgICAnaWQnLCA6aWQKICApLnRvX3MKZW5kCgpkZWYgdHVuZXNfdGVhbV9uYW1lKHRlYW0pCiAgcmVhZF90ZWFtX2ZpZWxkKAogICAgdGVhbSwKICAgICduYW1lJywgOm5hbWUsCiAgICAnY29udGVudFByb3ZpZGVyTmFtZScsIDpjb250ZW50UHJvdmlkZXJOYW1lLAogICAgJ2NvbnRlbnRfcHJvdmlkZXJfbmFtZScsIDpjb250ZW50X3Byb3ZpZGVyX25hbWUsCiAgICAndGVhbU5hbWUnLCA6dGVhbU5hbWUsCiAgICAnZGlzcGxheU5hbWUnLCA6ZGlzcGxheU5hbWUKICApLnRvX3MKZW5kCgpkZWYgYXZhaWxhYmxlX3R1bmVzX3RlYW1zCiAgdGVhbXMgPSBTcGFjZXNoaXA6OlR1bmVzLmNsaWVudC50ZWFtcwogIHRlYW1zID0gdGVhbXMudmFsdWVzIGlmIHRlYW1zLmlzX2E/KEhhc2gpCiAgQXJyYXkodGVhbXMpCnJlc2N1ZSA9PiBlCiAgJHN0ZGVyci5wdXRzICJERUJVRzogQ291bGQgbm90IGluc3BlY3QgQXBwIFN0b3JlIENvbm5lY3QgdGVhbXM6ICN7ZS5tZXNzYWdlfSIKICBbXQplbmQKCmRlZiBzZWxlY3RfYXBwX3N0b3JlX2Nvbm5lY3RfdGVhbQogIGV4cGxpY2l0X3RlYW1faWQgPSBFTlZbJ0ZBU1RMQU5FX0lUQ19URUFNX0lEJ10gfHwgRU5WWydGQVNUTEFORV9BU0NfVEVBTV9JRCddCiAgaWYgZXhwbGljaXRfdGVhbV9pZCAmJiBleHBsaWNpdF90ZWFtX2lkLnRvX3MubGVuZ3RoID4gMAogICAgU3BhY2VzaGlwOjpUdW5lcy5zZWxlY3RfdGVhbSh0ZWFtX2lkOiBleHBsaWNpdF90ZWFtX2lkKQogICAgcmV0dXJuIGV4cGxpY2l0X3RlYW1faWQKICBlbmQKCiAgZGV2ZWxvcGVyX3RlYW1faWQgPSBFTlZbJ0ZBU1RMQU5FX1RFQU1fSUQnXS50b19zCiAgZGV2ZWxvcGVyX3RlYW1fbmFtZSA9IHBvcnRhbF90ZWFtX25hbWUKICB0ZWFtcyA9IGF2YWlsYWJsZV90dW5lc190ZWFtcwoKICBpZiBkZXZlbG9wZXJfdGVhbV9uYW1lICYmIGRldmVsb3Blcl90ZWFtX25hbWUubGVuZ3RoID4gMAogICAgbm9ybWFsaXplZF9kZXZlbG9wZXJfbmFtZSA9IG5vcm1hbGl6ZV90ZWFtX25hbWUoZGV2ZWxvcGVyX3RlYW1fbmFtZSkKICAgIG1hdGNoZWRfdGVhbSA9IHRlYW1zLmZpbmQgeyB8dGVhbXwgbm9ybWFsaXplX3RlYW1fbmFtZSh0dW5lc190ZWFtX25hbWUodGVhbSkpID09IG5vcm1hbGl6ZWRfZGV2ZWxvcGVyX25hbWUgfQoKICAgIGlmIG1hdGNoZWRfdGVhbQogICAgICBtYXRjaGVkX2lkID0gdHVuZXNfdGVhbV9pZChtYXRjaGVkX3RlYW0pCiAgICAgIG1hdGNoZWRfbmFtZSA9IHR1bmVzX3RlYW1fbmFtZShtYXRjaGVkX3RlYW0pCiAgICAgIFNwYWNlc2hpcDo6VHVuZXMuc2VsZWN0X3RlYW0odGVhbV9pZDogbWF0Y2hlZF9pZCkKICAgICAgJHN0ZGVyci5wdXRzICJERUJVRzogQXV0by1zZWxlY3RlZCBBcHAgU3RvcmUgQ29ubmVjdCB0ZWFtICN7bWF0Y2hlZF9pZH0gKCN7bWF0Y2hlZF9uYW1lfSkgZm9yIERldmVsb3BlciBUZWFtICN7ZGV2ZWxvcGVyX3RlYW1faWR9IgogICAgICByZXR1cm4gbWF0Y2hlZF9pZAogICAgZW5kCiAgZW5kCgogIGlmIHRlYW1zLmxlbmd0aCA9PSAxCiAgICBvbmx5X3RlYW0gPSB0ZWFtcy5maXJzdAogICAgb25seV90ZWFtX2lkID0gdHVuZXNfdGVhbV9pZChvbmx5X3RlYW0pCiAgICBTcGFjZXNoaXA6OlR1bmVzLnNlbGVjdF90ZWFtKHRlYW1faWQ6IG9ubHlfdGVhbV9pZCkKICAgICRzdGRlcnIucHV0cyAiREVCVUc6IEF1dG8tc2VsZWN0ZWQgb25seSBBcHAgU3RvcmUgQ29ubmVjdCB0ZWFtICN7b25seV90ZWFtX2lkfSAoI3t0dW5lc190ZWFtX25hbWUob25seV90ZWFtKX0pIgogICAgcmV0dXJuIG9ubHlfdGVhbV9pZAogIGVuZAoKICAkc3RkZXJyLnB1dHMgIkVSUk9SOiBDb3VsZCBub3QgbWFwIEFwcGxlIERldmVsb3BlciBUZWFtIElEICcje2RldmVsb3Blcl90ZWFtX2lkfScje2RldmVsb3Blcl90ZWFtX25hbWUgPyAiICgje2RldmVsb3Blcl90ZWFtX25hbWV9KSIgOiAnJ30gdG8gQXBwIFN0b3JlIENvbm5lY3QuIgogICRzdGRlcnIucHV0cyAiQXZhaWxhYmxlIEFwcCBTdG9yZSBDb25uZWN0IHRlYW1zOiIKICB0ZWFtcy5lYWNoIGRvIHx0ZWFtfAogICAgJHN0ZGVyci5wdXRzICItICN7dHVuZXNfdGVhbV9pZCh0ZWFtKX0gKCN7dHVuZXNfdGVhbV9uYW1lKHRlYW0pfSkiCiAgZW5kCiAgZXhpdCAxCmVuZAoKZGVmIGxpc3RfdGVhbXMKICBiZWdpbgogICAgU3BhY2VzaGlwOjpQb3J0YWwubG9naW4oRU5WWydGQVNUTEFORV9VU0VSJ10pCiAgICBTcGFjZXNoaXA6OlBvcnRhbC5zZWxlY3RfdGVhbSh0ZWFtX2lkOiBFTlZbJ0ZBU1RMQU5FX1RFQU1fSUQnXSkKCiAgICBkZXZlbG9wZXJfdGVhbV9uYW1lID0gcG9ydGFsX3RlYW1fbmFtZQoKICAgIFNwYWNlc2hpcDo6VHVuZXMubG9naW4oRU5WWydGQVNUTEFORV9VU0VSJ10pCiAgICBub3JtYWxpemVkX2RldmVsb3Blcl9uYW1lID0gbm9ybWFsaXplX3RlYW1fbmFtZShkZXZlbG9wZXJfdGVhbV9uYW1lKQogICAgdGVhbXMgPSBhdmFpbGFibGVfdHVuZXNfdGVhbXMubWFwIGRvIHx0ZWFtfAogICAgICB0ZWFtX25hbWUgPSB0dW5lc190ZWFtX25hbWUodGVhbSkKICAgICAgewogICAgICAgIGlkOiB0dW5lc190ZWFtX2lkKHRlYW0pLAogICAgICAgIG5hbWU6IHRlYW1fbmFtZSwKICAgICAgICByZWNvbW1lbmRlZDogbm9ybWFsaXplZF9kZXZlbG9wZXJfbmFtZS5sZW5ndGggPiAwICYmIG5vcm1hbGl6ZV90ZWFtX25hbWUodGVhbV9uYW1lKSA9PSBub3JtYWxpemVkX2RldmVsb3Blcl9uYW1lCiAgICAgIH0KICAgIGVuZAoKICAgIHB1dHMgIl9fX01BQ0hfSlNPTl9TVEFSVF9fXyIgKyB7CiAgICAgIGRldmVsb3BlclRlYW1JZDogRU5WWydGQVNUTEFORV9URUFNX0lEJ10sCiAgICAgIGRldmVsb3BlclRlYW1OYW1lOiBkZXZlbG9wZXJfdGVhbV9uYW1lLAogICAgICB0ZWFtczogdGVhbXMKICAgIH0udG9fanNvbiArICJfX19NQUNIX0pTT05fRU5EX19fIgogIHJlc2N1ZSA9PiBlCiAgICAkc3RkZXJyLnB1dHMgIkVSUk9SOiAje2UubWVzc2FnZX0iCiAgICBleGl0IDEKICBlbmQKZW5kCgpkZWYgbGlzdF9rZXlzCiAgYmVnaW4KICAgIFNwYWNlc2hpcDo6UG9ydGFsLmxvZ2luKEVOVlsnRkFTVExBTkVfVVNFUiddKQogICAgU3BhY2VzaGlwOjpQb3J0YWwuc2VsZWN0X3RlYW0odGVhbV9pZDogRU5WWydGQVNUTEFORV9URUFNX0lEJ10pCiAgICAKICAgIFNwYWNlc2hpcDo6VHVuZXMubG9naW4oRU5WWydGQVNUTEFORV9VU0VSJ10pCiAgICBzZWxlY3RfYXBwX3N0b3JlX2Nvbm5lY3RfdGVhbQogICAgCiAgICAjIFVzZSBUdW5lcyBjbGllbnQgd2hpY2ggcG9pbnRzIHRvIGFwcHN0b3JlY29ubmVjdC5hcHBsZS5jb20KICAgIGNsaWVudCA9IFNwYWNlc2hpcDo6VHVuZXMuY2xpZW50CiAgICAjIFVzZSByb290LXJlbGF0aXZlIFVSTCB0byByZXBsYWNlIHRoZSBkZWZhdWx0IFR1bmVzIHBhdGggKC9XZWJPYmplY3RzLy4uLikKICAgIHJlc3BvbnNlID0gY2xpZW50LnJlcXVlc3QoOmdldCwgJy9pcmlzL3YxL2FwaUtleXMnKQogICAgCiAgICBpZiByZXNwb25zZS5ib2R5Lm5pbD8gfHwgIXJlc3BvbnNlLmJvZHkuaXNfYT8oSGFzaCkKICAgICAgcmFpc2UgIkFQSSByZXR1cm5lZCBlbXB0eSBvciBpbnZhbGlkIHJlc3BvbnNlIGJvZHkgZm9yIGxpc3Rpbmcga2V5cyIKICAgIGVuZAogICAgCiAgICAkc3RkZXJyLnB1dHMgIkRFQlVHOiBGdWxsIExpc3QgUmVzcG9uc2U6ICN7cmVzcG9uc2UuYm9keS50b19qc29ufSIKICAgIAogICAga2V5cyA9IHJlc3BvbnNlLmJvZHlbJ2RhdGEnXSB8fCBbXQogICAgCiAgICBvdXRwdXQgPSBrZXlzLm1hcCBkbyB8a3wKICAgICAgYXR0ciA9IGtbJ2F0dHJpYnV0ZXMnXSB8fCB7fQogICAgICB7CiAgICAgICAgaWQ6IGtbJ2lkJ10sCiAgICAgICAgbmFtZTogYXR0clsnbmFtZSddLAogICAgICAgIGlzc3VlcklkOiBhdHRyWydpc3N1ZXJJZCddLAogICAgICAgIHJvbGU6IGF0dHJbJ3JvbGVzJ10mLmZpcnN0LAogICAgICAgIHJldm9jYWJsZTogYXR0clsncmV2b2NhYmxlJ10KICAgICAgfQogICAgZW5kCiAgICAKICAgIHB1dHMgIl9fX01BQ0hfSlNPTl9TVEFSVF9fXyIgKyBvdXRwdXQudG9fanNvbiArICJfX19NQUNIX0pTT05fRU5EX19fIgogIHJlc2N1ZSA9PiBlCiAgICAkc3RkZXJyLnB1dHMgIkVSUk9SOiAje2UubWVzc2FnZX0iCiAgICBpZiBkZWZpbmVkPyhyZXNwb25zZSkgJiYgcmVzcG9uc2UgJiYgcmVzcG9uc2UuYm9keQogICAgICAkc3RkZXJyLnB1dHMgIlJlc3BvbnNlIEJvZHk6ICN7cmVzcG9uc2UuYm9keS50b19qc29ufSIKICAgIGVuZAogICAgZXhpdCAxCiAgZW5kCmVuZAoKZGVmIGNyZWF0ZV9rZXkobmFtZSwgcm9sZSA9ICdBRE1JTicpCiAgYmVnaW4KICAgIFNwYWNlc2hpcDo6UG9ydGFsLmxvZ2luKEVOVlsnRkFTVExBTkVfVVNFUiddKQogICAgU3BhY2VzaGlwOjpQb3J0YWwuc2VsZWN0X3RlYW0odGVhbV9pZDogRU5WWydGQVNUTEFORV9URUFNX0lEJ10pCiAgICAKICAgIFNwYWNlc2hpcDo6VHVuZXMubG9naW4oRU5WWydGQVNUTEFORV9VU0VSJ10pCiAgICBzZWxlY3RfYXBwX3N0b3JlX2Nvbm5lY3RfdGVhbQogICAgCiAgICBjbGllbnQgPSBTcGFjZXNoaXA6OlR1bmVzLmNsaWVudAogICAgCiAgICAjIFRydW5jYXRlIG5pY2tuYW1lIHRvIDMwIGNoYXJzIGFzIHBlciBBcHBsZSdzIGxpbWl0CiAgICAjIFdlIGtlZXAgdGhlIG9yaWdpbmFsICduYW1lJyBmb3IgbG9nZ2luZyBidXQgc2VuZCB0cnVuY2F0ZWQgJ25pY2tuYW1lJyB0byBBUEkKICAgIHNhZmVfbmlja25hbWUgPSBuYW1lWzAsIDMwXQogICAgCiAgICBwYXlsb2FkID0gewogICAgICBkYXRhOiB7CiAgICAgICAgdHlwZTogImFwaUtleXMiLAogICAgICAgIGF0dHJpYnV0ZXM6IHsKICAgICAgICAgIG5pY2tuYW1lOiBzYWZlX25pY2tuYW1lLAogICAgICAgICAga2V5VHlwZTogIlBVQkxJQ19BUEkiLAogICAgICAgICAgcm9sZXM6IFtyb2xlXSwKICAgICAgICAgIGFsbEFwcHNWaXNpYmxlOiB0cnVlCiAgICAgICAgfQogICAgICB9CiAgICB9CiAgICAKICAgIHJlc3BvbnNlID0gY2xpZW50LnJlcXVlc3QoOnBvc3QpIGRvIHxyZXF8CiAgICAgIHJlcS51cmwgIi9pcmlzL3YxL2FwaUtleXMiCiAgICAgIHJlcS5ib2R5ID0gcGF5bG9hZC50b19qc29uCiAgICAgIHJlcS5oZWFkZXJzWydDb250ZW50LVR5cGUnXSA9ICdhcHBsaWNhdGlvbi9qc29uJwogICAgICByZXEuaGVhZGVyc1snQWNjZXB0J10gPSAnYXBwbGljYXRpb24vdm5kLmFwaStqc29uLCBhcHBsaWNhdGlvbi9qc29uLCB0ZXh0L2phdmFzY3JpcHQsICovKjsgcT0wLjAxJwogICAgICByZXEuaGVhZGVyc1snWC1SZXF1ZXN0ZWQtV2l0aCddID0gJ1hNTEh0dHBSZXF1ZXN0JwogICAgICByZXEuaGVhZGVyc1snUmVmZXJlciddID0gJ2h0dHBzOi8vYXBwc3RvcmVjb25uZWN0LmFwcGxlLmNvbS9hY2Nlc3MvYXBpJwogICAgICByZXEuaGVhZGVyc1snWC1BcHBsZS1XaWRnZXQtS2V5J10gPSBjbGllbnQud2lkZ2V0X2tleSBpZiBjbGllbnQucmVzcG9uZF90bz8oOndpZGdldF9rZXkpCiAgICBlbmQKICAgIAogICAgIyBERUJVRzogSW5zcGVjdCB0aGUgcmF3IHJlc3BvbnNlIG9iamVjdAogICAgJHN0ZGVyci5wdXRzICJERUJVRzogUmVzcG9uc2UgQ2xhc3M6ICN7cmVzcG9uc2UuY2xhc3N9IgogICAgJHN0ZGVyci5wdXRzICJERUJVRzogUmVzcG9uc2UgSGVhZGVyczogI3tyZXNwb25zZS5oZWFkZXJzfSIKICAgICRzdGRlcnIucHV0cyAiREVCVUc6IFJlc3BvbnNlIEJvZHk6ICN7cmVzcG9uc2UuYm9keS50b19qc29ufSIKICAgIAogICAgaWYgcmVzcG9uc2UuYm9keS5uaWw/IHx8ICFyZXNwb25zZS5ib2R5LmlzX2E/KEhhc2gpIHx8IHJlc3BvbnNlLmJvZHlbJ2RhdGEnXS5uaWw/CiAgICAgIGVycm9yX21zZyA9ICJBUEkgZmFpbGVkIHRvIGNyZWF0ZSBrZXkuIgogICAgICBpZiByZXNwb25zZS5ib2R5ICYmIHJlc3BvbnNlLmJvZHlbJ2Vycm9ycyddCiAgICAgICAgZXJyb3JfbXNnICs9ICIgRXJyb3JzOiAiICsgcmVzcG9uc2UuYm9keVsnZXJyb3JzJ10ubWFwe3xlfCBlWydkZXRhaWwnXX0uam9pbignLCAnKQogICAgICBlbmQKICAgICAgcmFpc2UgZXJyb3JfbXNnCiAgICBlbmQKICAgIAogICAga2V5X2RhdGEgPSByZXNwb25zZS5ib2R5WydkYXRhJ10KICAgIGF0dHIgPSBrZXlfZGF0YVsnYXR0cmlidXRlcyddIHx8IHt9CgogICAgIyBUaGUgLnA4IGNvbnRlbnQgaXMgdXN1YWxseSBpbiAncHJpdmF0ZUtleScgb3IgJ2tleUNvbnRlbnQnIG9uIHRoZSBJTklUSUFMIENSRUFURSByZXNwb25zZQogICAgcDhfY29udGVudCA9IGF0dHJbJ3ByaXZhdGVLZXknXSB8fCBhdHRyWydrZXlDb250ZW50J10KICAgIAogICAgaWYgcDhfY29udGVudC5uaWw/CiAgICAgICRzdGRlcnIucHV0cyAiREVCVUc6IEtleSBjb250ZW50IG1pc3NpbmcgaW4gcmVzcG9uc2UuIEF0dGVtcHRpbmcgcmV0cmlldmFsIHZpYSBkb3dubG9hZC9leHBvcnQgZW5kcG9pbnRzLi4uIiAKICAgICAgCiAgICAgIHBhdGhzX3RvX3RyeSA9IFsKICAgICAgICAiaHR0cHM6Ly9hcHBzdG9yZWNvbm5lY3QuYXBwbGUuY29tL2lyaXMvdjEvYXBpS2V5cy8je2tleV9kYXRhWydpZCddfS9kb3dubG9hZCIsCiAgICAgICAgImh0dHBzOi8vYXBwc3RvcmVjb25uZWN0LmFwcGxlLmNvbS9pcmlzL3YxL2FwaUtleXMvI3trZXlfZGF0YVsnaWQnXX0vZXhwb3J0IgogICAgICBdCiAgICAgIAogICAgICBwYXRoc190b190cnkuZWFjaCBkbyB8cGF0aHwKICAgICAgICBiZWdpbgogICAgICAgICAgJHN0ZGVyci5wdXRzICJERUJVRzogVHJ5aW5nICN7cGF0aH0uLi4iCiAgICAgICAgICBkb3dubG9hZF9yZXNwID0gY2xpZW50LnJlcXVlc3QoOmdldCkgZG8gfHJlcXwKICAgICAgICAgICAgcmVxLnVybCBwYXRoCiAgICAgICAgICAgIHJlcS5oZWFkZXJzWydBY2NlcHQnXSA9ICdhcHBsaWNhdGlvbi92bmQuYXBpK2pzb24sIGFwcGxpY2F0aW9uL2pzb24sIHRleHQvamF2YXNjcmlwdCwgKi8qOyBxPTAuMDEnCiAgICAgICAgICAgIHJlcS5oZWFkZXJzWydYLVJlcXVlc3RlZC1XaXRoJ10gPSAnWE1MSHR0cFJlcXVlc3QnCiAgICAgICAgICAgIHJlcS5oZWFkZXJzWydSZWZlcmVyJ10gPSAnaHR0cHM6Ly9hcHBzdG9yZWNvbm5lY3QuYXBwbGUuY29tL2FjY2Vzcy9hcGknCiAgICAgICAgICBlbmQKICAgICAgICAgICRzdGRlcnIucHV0cyAiREVCVUc6IFJlc3BvbnNlIENsYXNzOiAje2Rvd25sb2FkX3Jlc3AuYm9keS5jbGFzc30iCiAgICAgICAgICAkc3RkZXJyLnB1dHMgIkRFQlVHOiBSZXNwb25zZSBTdGF0dXM6ICN7ZG93bmxvYWRfcmVzcC5zdGF0dXN9IiBpZiBkb3dubG9hZF9yZXNwLnJlc3BvbmRfdG8/KDpzdGF0dXMpCiAgICAgICAgICAKICAgICAgICAgIGlmIGRvd25sb2FkX3Jlc3AuYm9keSAmJiAhZG93bmxvYWRfcmVzcC5ib2R5LnRvX3MuaW5jbHVkZT8oJyJlcnJvcnMiPT4nKQogICAgICAgICAgICAgaWYgZG93bmxvYWRfcmVzcC5ib2R5LmlzX2E/KEhhc2gpCiAgICAgICAgICAgICAgIHA4X2NvbnRlbnQgPSBkb3dubG9hZF9yZXNwLmJvZHlbJ2tleUNvbnRlbnQnXSB8fCBkb3dubG9hZF9yZXNwLmJvZHlbJ2NvbnRlbnQnXSB8fCBkb3dubG9hZF9yZXNwLmJvZHkuZGlnKCdkYXRhJywgJ2F0dHJpYnV0ZXMnLCAncHJpdmF0ZUtleScpCiAgICAgICAgICAgICBlbHNlCiAgICAgICAgICAgICAgIHA4X2NvbnRlbnQgPSBkb3dubG9hZF9yZXNwLmJvZHkKICAgICAgICAgICAgIGVuZAogICAgICAgICAgICAgCiAgICAgICAgICAgICBpZiBwOF9jb250ZW50ICYmIHA4X2NvbnRlbnQudG9fcy5zdGFydF93aXRoPygnLS0tLS1CRUdJTicpCiAgICAgICAgICAgICAgICRzdGRlcnIucHV0cyAiREVCVUc6IFJldHJpZXZhbCB2aWEgI3twYXRofSBzdWNjZXNzZnVsISBDb250ZW50IGxlbmd0aDogI3twOF9jb250ZW50LnRvX3MubGVuZ3RofSIKICAgICAgICAgICAgICAgYnJlYWsKICAgICAgICAgICAgIGVsc2UKICAgICAgICAgICAgICAgJHN0ZGVyci5wdXRzICJERUJVRzogUmVzcG9uc2UgZnJvbSAje3BhdGh9IGRpZCBub3QgY29udGFpbiBhIHZhbGlkIHByaXZhdGUga2V5LiIKICAgICAgICAgICAgICAgcDhfY29udGVudCA9IG5pbAogICAgICAgICAgICAgZW5kCiAgICAgICAgICBlbHNlCiAgICAgICAgICAgICAkc3RkZXJyLnB1dHMgIkRFQlVHOiBSZXNwb25zZSBmcm9tICN7cGF0aH0gZW1wdHkgb3IgY29udGFpbnMgZXJyb3JzLiIKICAgICAgICAgIGVuZAogICAgICAgIHJlc2N1ZSA9PiBlCiAgICAgICAgICAkc3RkZXJyLnB1dHMgIkRFQlVHOiBBdHRlbXB0IGZvciAje3BhdGh9IGZhaWxlZDogI3tlLm1lc3NhZ2V9IgogICAgICAgIGVuZAogICAgICBlbmQKICAgIGVuZAoKICAgICMgRklOQUwgVkFMSURBVElPTjogRW5zdXJlIGl0J3Mgbm90IGEgUnVieSBoYXNoIHN0cmluZyByZXByZXNlbnRhdGlvbiBvciBlcnJvcgogICAgaWYgcDhfY29udGVudC5pc19hPyhIYXNoKSB8fCBwOF9jb250ZW50LnRvX3MuaW5jbHVkZT8oJyJlcnJvcnMiPT4nKSB8fCAhcDhfY29udGVudC50b19zLnN0YXJ0X3dpdGg/KCctLS0tLUJFR0lOJykKICAgICAgJHN0ZGVyci5wdXRzICJERUJVRzogSW52YWxpZCBrZXkgY29udGVudCBkZXRlY3RlZC4iCiAgICAgIHA4X2NvbnRlbnQgPSBuaWwKICAgIGVuZAoKICAgIGlmIHA4X2NvbnRlbnQubmlsPwogICAgICAkc3RkZXJyLnB1dHMgIkRFQlVHOiBGYWlsZWQgdG8gcmV0cmlldmUga2V5IGNvbnRlbnQuIgogICAgZW5kCiAgICAKICAgIHJlc3VsdCA9IHsKICAgICAgaWQ6IGtleV9kYXRhWydpZCddLAogICAgICBuYW1lOiBhdHRyWyduaWNrbmFtZSddIHx8IGF0dHJbJ25hbWUnXSwKICAgICAgaXNzdWVySWQ6IGF0dHJbJ2lzc3VlcklkJ10sCiAgICAgIGtleUNvbnRlbnQ6IHA4X2NvbnRlbnQsCiAgICAgIHJhd19yZXNwb25zZTogcmVzcG9uc2UuYm9keSAjIEluY2x1ZGUgdGhpcyBmb3IgZGVidWdnaW5nIHdoZW4ga2V5Q29udGVudCBpcyBuaWwKICAgIH0KICAgIAogICAgcHV0cyAiX19fTUFDSF9KU09OX1NUQVJUX19fIiArIHJlc3VsdC50b19qc29uICsgIl9fX01BQ0hfSlNPTl9FTkRfX18iCiAgcmVzY3VlID0+IGUKICAgICRzdGRlcnIucHV0cyAiRVJST1I6ICN7ZS5tZXNzYWdlfSIKICAgIGlmIGRlZmluZWQ/KHJlc3BvbnNlKSAmJiByZXNwb25zZSAmJiByZXNwb25zZS5ib2R5CiAgICAgICAkc3RkZXJyLnB1dHMgIlJlc3BvbnNlIEJvZHk6ICN7cmVzcG9uc2UuYm9keS50b19qc29ufSIKICAgIGVuZAogICAgZXhpdCAxCiAgZW5kCmVuZAoKZGVmIGRlbGV0ZV9rZXkoaWQpCiAgYmVnaW4KICAgIFNwYWNlc2hpcDo6UG9ydGFsLmxvZ2luKEVOVlsnRkFTVExBTkVfVVNFUiddKQogICAgU3BhY2VzaGlwOjpQb3J0YWwuc2VsZWN0X3RlYW0odGVhbV9pZDogRU5WWydGQVNUTEFORV9URUFNX0lEJ10pCiAgICAKICAgIFNwYWNlc2hpcDo6VHVuZXMubG9naW4oRU5WWydGQVNUTEFORV9VU0VSJ10pCiAgICBzZWxlY3RfYXBwX3N0b3JlX2Nvbm5lY3RfdGVhbQogICAgCiAgICBjbGllbnQgPSBTcGFjZXNoaXA6OlR1bmVzLmNsaWVudAogICAgY2xpZW50LnJlcXVlc3QoOmRlbGV0ZSwgIi9pcmlzL3YxL2FwaUtleXMvI3tpZH0iKQogICAgcHV0cyAiU1VDQ0VTUyIKICByZXNjdWUgPT4gZQogICAgJHN0ZGVyci5wdXRzICJFUlJPUjogI3tlLm1lc3NhZ2V9IgogICAgZXhpdCAxCiAgZW5kCmVuZAoKY29tbWFuZCA9IEFSR1ZbMF0KaWYgY29tbWFuZCA9PSAnbGlzdCcKICBsaXN0X2tleXMKZWxzaWYgY29tbWFuZCA9PSAndGVhbXMnCiAgbGlzdF90ZWFtcwplbHNpZiBjb21tYW5kID09ICdjcmVhdGUnCiAgY3JlYXRlX2tleShBUkdWWzFdIHx8ICJNYWNoIEFQSSBLZXkgI3tUaW1lLm5vdy50b19pfSIpCmVsc2lmIGNvbW1hbmQgPT0gJ2RlbGV0ZScKICBkZWxldGVfa2V5KEFSR1ZbMV0pCmVuZAo=";function Ve(){let e=$.join(Ge.tmpdir(),m.nameLower);F.existsSync(e)||F.mkdirSync(e,{recursive:!0});let t=$.join(e,"manage_asc_keys.rb");return F.writeFileSync(t,Buffer.from(Gt,"base64").toString("utf-8"),{mode:493}),t}function ke(){return se()}function Fe(e){let t=new Map,n=/-\s+(\d+)\s+\(([^)]+)\)/g,a=/\d+\)\s+"([^"]+)"\s+\((\d+)\)/g,i;for(;(i=n.exec(e))!==null;)t.set(i[1],{id:i[1],name:i[2]});for(;(i=a.exec(e))!==null;)t.set(i[2],{id:i[2],name:i[1]});return Array.from(t.values())}function Ke(e){return ge(e).appStoreConnectTeamId}function Le(e,t,n){return{...ke(),FASTLANE_USER:e,FASTLANE_TEAM_ID:t,...n?{FASTLANE_ITC_TEAM_ID:n,FASTLANE_ASC_TEAM_ID:n}:{}}}function oe(e,t="production",n={}){let a=ge(e,t),i=n.teamId||a.teamId,r=n.appStoreConnectTeamId||a.appStoreConnectTeamId;return{teamId:i,teamName:n.teamName||a.teamName,developerTeamId:n.developerTeamId||a.developerTeamId||i,appStoreConnectTeamId:r,providerId:n.providerId||a.providerId||r,providerName:n.providerName||a.providerName}}function Me(e,t){if(t.id){e.submit||(e.submit={}),e.submit.production||(e.submit.production={}),e.submit.production.ios||(e.submit.production.ios={}),e.submit.production.ios.appStoreConnectTeamId=t.id,e.submit.production.ios.providerId=t.id,t.name&&(e.submit.production.ios.appStoreConnectTeamName=t.name,e.submit.production.ios.providerName=t.name),t.developerTeamName&&(e.submit.production.ios.appleTeamName=t.developerTeamName);try{F.writeFileSync(`./${m.configFileName}`,JSON.stringify(e,null,2))}catch{}}}async function Ft(e,t,n,a){let i=Ie();i.start("Fetching App Store Connect providers...");let r=fe("ruby",[e,"teams"],{env:Le(n,a),stdio:["inherit","pipe","pipe"],encoding:"utf-8"});if(r.status!==0){i.stop("Could not fetch providers");let g=Fe(`${r.stdout||""}
+${r.stderr||""}`);if(g.length>0)return Ne(t,g,"Select the App Store Connect provider for this API key:");N.warn(G.yellow(`Could not list App Store Connect providers: ${r.stderr||"Unknown error"}`));return}let s=(r.stdout||"").match(new RegExp(`${m.jsonStartMarker}(.*)${m.jsonEndMarker}`));if(!s){i.stop("Could not parse providers");return}let l=JSON.parse(s[1]),c=(l.teams||[]).filter(g=>g.id&&g.name);if(i.stop(c.length===1?"Found 1 provider":`Found ${c.length} providers`),c.length===0)return;if(c.length===1){N.success(G.green(`\u2713 Using App Store Connect provider ${c[0].name} (${c[0].id})`));let g={...c[0],developerTeamName:l.developerTeamName};return Me(t,g),g}let f=c.filter(g=>g.recommended),I=c.filter(g=>!g.recommended);return Ne(t,[...f,...I],`Select the App Store Connect provider for Developer Team ${l.developerTeamName||a}:`,l.developerTeamName)}async function Ne(e,t,n,a){let i=await le({message:n,options:t.map(c=>({value:c.id,label:c.name,hint:`${c.id}${c.recommended?" \xB7 recommended":""}`}))});if(Y(i))return L("Operation cancelled"),null;let r=i,l={...t.find(c=>c.id===r)||{id:r,name:r},developerTeamName:a};return Me(e,l),N.success(G.green(`\u2713 Using App Store Connect provider ${l.name} (${l.id})`)),l}var ze=async e=>{let t=Ie(),n=e.platform,a=`./${m.configFileName}`;if(!F.existsSync(a)){N.error(`No ${m.configFileName} found. Run \`${m.nameLower} init\` or \`${m.nameLower} link\` first.`);return}let i=JSON.parse(F.readFileSync(a,"utf-8")),{projectId:r}=i,s=e.profile||"production";if(!r){N.error(`${m.configFileName} is missing projectId.`);return}let l=e.file,c=n==="android"?e.packageName||e.bundleId:e.bundleId||Se(i,s)||"*";if(n==="android"&&!c&&(c=await Et(r,i,s),c===null))return;if(n==="ios"&&!l){let u=await le({message:"Manage App Store Connect API Key:",options:[{value:"magic",label:"\u2728 Create new automatically",hint:"Requires Apple ID + 2FA"},{value:"manual",label:"\u{1F50D} Configure manually",hint:"Provide existing .p8 file"},{value:"delete",label:"\u{1F5D1}\uFE0F  Delete an existing Key"}]});if(Y(u)){L("Operation cancelled");return}if(u==="magic"){await Pt(r,i);return}if(u==="delete"){await xt(r,i);return}}if(!l){let u=n==="ios"?"https://appstoreconnect.apple.com/access/api":"https://console.cloud.google.com/apis/credentials";we(`To submit to the ${n==="ios"?"App Store":"Google Play Store"}, you need a Service Key:
+
+1. Open: ${G.cyan(u)}
+`+(n==="ios"?`2. Generate an "App Store Connect API Key" with ${G.bold("Admin")} role.
+3. Download the ${G.bold(".p8")} file.`:`2. Create a "Service Account", generate a ${G.bold("JSON")} key.
+3. Download the ${G.bold(".json")} file.`),"Guided Setup"),t.start("Scanning for downloaded keys...");let C=_t(n);if(t.stop(C.length>0?`Detected ${C.length} potential key(s)`:"No keys detected automatically"),C.length>0){let p=await le({message:"Found these potential keys. Use one of them?",options:[...C.map(A=>({value:A.path,label:`${$.basename(A.path)} (${A.location})`})),{value:"manual",label:"Enter path manually..."}]});if(Y(p)){L("Operation cancelled");return}p!=="manual"&&(l=p)}if(!l){let p=await j({message:`Paste the path to your ${n==="ios"?".p8":".json"} file:`,validate:A=>F.existsSync(A)?void 0:"File not found"});if(Y(p)){L("Operation cancelled");return}l=p}}let f=e.issuerId,I=e.keyId;if(n==="ios"){if(!I&&l){let u=$.basename(l).match(/AuthKey_(.*)\.p8/);u&&(I=u[1],N.info(`Auto-detected Key ID from filename: ${G.green(I)}`))}if(!f){let u=await j({message:"Enter App Store Connect Issuer ID (Found on the Keys page):",validate:C=>C.length>0?void 0:"Issuer ID is required"});if(Y(u)){L("Operation cancelled");return}f=u}if(!I){let u=await j({message:"Enter App Store Connect Key ID:",validate:C=>C.length>0?void 0:"Key ID is required"});if(Y(u)){L("Operation cancelled");return}I=u}}if(n==="android"&&(!c||c==="*")){let u=await Qe();if(u===null)return;c=u}let g=n==="ios"?oe(i,s):{};await Te(r,l,n,f,I,c,{...g})};async function Et(e,t,n){let a=await Xt(e),i=Bt(t,n);if(i&&!a.includes(i)&&a.unshift(i),a.length>0){let r=await le({message:"Select Android package for this Google Play service key:",options:[...a.map(s=>({value:s,label:s,hint:s===i?"from config":void 0})),{value:"manual",label:"Enter another package name..."}]});if(Y(r))return L("Operation cancelled"),null;if(r==="manual")return Qe();if(r!=="manual")return r}if(i){let r=await Oe({message:`Use Android package from local config (${i})?`,initialValue:!0});if(Y(r))return L("Operation cancelled"),null;if(r)return i}}async function Qe(){let e=await j({message:"Android package name for this Google Play service key:",placeholder:"com.example.app",validate:t=>t.includes(".")?void 0:"Enter a valid package name"});return Y(e)?(L("Operation cancelled"),null):e}async function Xt(e){try{let n=(await W.get(`/credentials/${e}`)).data.credentials||[],a=new Set;for(let i of n)(i.platform==="android"||i.type==="android_keystore"||i.type==="google_service_account")&&i.bundleId&&i.bundleId!=="*"&&a.add(i.bundleId);return Array.from(a).sort()}catch(t){return N.warn(G.yellow(`Could not fetch saved Android package identifiers: ${t.message}`)),[]}}function Bt(e,t){let n=be(e,t);if(n)return n;let a=$.join(process.cwd(),"app.json");if(F.existsSync(a))try{return JSON.parse(F.readFileSync(a,"utf-8")).expo?.android?.package}catch{}let i=$.join(process.cwd(),"app.config.json");if(F.existsSync(i))try{let r=JSON.parse(F.readFileSync(i,"utf-8"));return r.expo?.android?.package||r.android?.package}catch{}}async function Pt(e,t){let n=Ie(),a=t.submit?.production?.ios?.appleId,i=oe(t).teamId,r=Ke(t);if(!a){let c=await j({message:"Apple ID:",placeholder:"your-email@example.com"});if(Y(c))return;a=c}if(!i){let c=await me({appleId:a,config:t,profile:"production",initialTeam:oe(t),promptToPersistConfig:!0});if(!c?.teamId)return;i=c.teamId}let s=await j({message:"Enter a name for the new API Key:",initialValue:`[${m.name}] Project ${e}`});if(Y(s))return;let l=Ve();if(!F.existsSync(l)){N.error(`Magic Error: Helper script not found at ${l}`);return}try{let c=await Ft(l,t,a,i);if(c===null)return;let f;if(c)f=c,r=c.id;else if(!r)return;n.start("Creating App Store Connect API Key...");let I=b=>fe("ruby",[l,"create",s],{env:Le(a,i,b),stdio:["inherit","pipe","pipe"],encoding:"utf-8"}),g=I(r),u=g.stdout||"",C=g.stderr||"";if(g.status!==0){let b=Fe(`${u}
+${C}`);if(b.length>0){n.stop("Select App Store Connect team"),we(`Apple Developer Team IDs look like ${G.bold(i)}.
+App Store Connect API keys use a numeric provider/team ID instead.`,"Team ID mismatch");let D=await Ne(t,b,"Select the App Store Connect provider for this API key:");if(!D)return;f=D,r=D.id,n.start("Creating API Key with selected App Store Connect team..."),g=I(r),u=g.stdout||"",C=g.stderr||""}}if(C&&(C.includes("DEBUG:")||C.includes("ERROR:"))&&C.split(`
+`).forEach(b=>{b.trim()&&N.info(G.dim(`[Ruby] ${b.trim()}`))}),g.status!==0){n.stop("Failed"),N.error(`Magic creation failed: ${C}`);return}let p=u.match(new RegExp(`${m.jsonStartMarker}(.*)${m.jsonEndMarker}`));if(!p){n.stop("Parse Error"),N.error("Could not parse response from Apple Portal.");return}let A=JSON.parse(p[1]),{id:v,issuerId:H,keyContent:h}=A,_=oe(t,"production",{teamId:i,teamName:f?.developerTeamName,developerTeamId:i,appStoreConnectTeamId:r,providerId:r,providerName:f?.name});if(n.stop("Key Created Successfully"),N.success(`\u2713 Created Key ID: ${G.green(v)}`),!H){we(`Your Issuer ID is shown at the top of:
+  ${G.cyan("https://appstoreconnect.apple.com/access/integrations/api")}
+
+It looks like: ${G.dim("xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx")}`,"One More Thing");let b=await j({message:"Enter your App Store Connect Issuer ID:",validate:D=>D.trim().length>0?void 0:"Issuer ID is required"});if(Y(b)){L("Operation cancelled.");return}H=b.trim()}if(h){let b=$.join(Ge.tmpdir(),`AuthKey_${v}.p8`);F.writeFileSync(b,h),await Te(e,b,"ios",H,v,t.ios?.bundleIdentifier||"*",{..._}),F.unlinkSync(b)}else{N.warn(G.yellow("\u26A0\uFE0F  Apple did not return the private key in the response.")),we(`Download the .p8 file manually:
+
+  1. Open: ${G.cyan("https://appstoreconnect.apple.com/access/integrations/api")}
+  2. Find Key ID: ${G.green(v)}
+  3. Click ${G.bold("Download API Key")} (only available once)
+  4. Drag & drop the downloaded .p8 file below`,"Manual Step Required");let b=await j({message:"Path to the downloaded .p8 file (drag & drop here):",validate:D=>F.existsSync(D)?void 0:"File not found"});if(Y(b)){L("Operation cancelled. Credential ID was registered but key content is missing.");return}await Te(e,b,"ios",H,v,t.ios?.bundleIdentifier||"*",{..._})}}catch(c){n.stop("Error"),N.error(`Error: ${c.message}`)}}async function xt(e,t){let n=Ie(),a=t.submit?.production?.ios?.appleId,i=oe(t).teamId,r=Ke(t);if(!a){let l=await j({message:"Apple ID:"});if(Y(l))return;a=l}if(!i){let l=await me({appleId:a,config:t,profile:"production",initialTeam:oe(t),promptToPersistConfig:!0});if(!l?.teamId)return;i=l.teamId}n.start("Fetching existing API Keys...");let s=Ve();if(!F.existsSync(s)){N.error(`Magic Error: Helper script not found at ${s}`);return}try{let l=p=>fe("ruby",[s,"list"],{env:{...ke(),FASTLANE_USER:a,FASTLANE_TEAM_ID:i,...p?{FASTLANE_ITC_TEAM_ID:p,FASTLANE_ASC_TEAM_ID:p}:{}},stdio:["inherit","pipe","pipe"],encoding:"utf-8"}),c=l(r);if(c.status!==0){let p=Fe(`${c.stdout||""}
+${c.stderr||""}`);if(p.length>0){n.stop("Select App Store Connect team");let A=await le({message:"Select the App Store Connect team to list API keys:",options:p.map(v=>({value:v.id,label:v.name,hint:v.id}))});if(Y(A)){L("Operation cancelled");return}r=A,n.start("Fetching existing API Keys..."),c=l(r)}}if(c.status!==0){n.stop("Failed"),N.error(`Listing failed: ${c.stderr}`);return}let f=c.stdout.match(new RegExp(`${m.jsonStartMarker}(.*)${m.jsonEndMarker}`));if(!f){n.stop("Parse Error");return}let I=JSON.parse(f[1]);if(n.stop(`Found ${I.length} keys`),I.length===0){N.info("No API Keys found on this team.");return}let g=await le({message:"Select a key to delete from Apple Developer Portal:",options:[...I.map(p=>({value:p.id,label:`ID: ${p.id} - ${p.name} (${p.role})`})),{value:"cancel",label:"Cancel"}]});if(Y(g)||g==="cancel")return;let u=await Oe({message:`Are you sure you want to delete Key ${g}? This cannot be undone.`});if(!u||Y(u))return;n.start(`Deleting Key ${g}...`);let C=fe("ruby",[Ve(),"delete",g],{env:{...ke(),FASTLANE_USER:a,FASTLANE_TEAM_ID:i,...r?{FASTLANE_ITC_TEAM_ID:r,FASTLANE_ASC_TEAM_ID:r}:{}},stdio:"pipe",encoding:"utf-8"});C.status===0?(n.stop("Deleted"),N.success(`\u2713 Key ${g} has been removed from Apple Portal.`)):(n.stop("Deletion Failed"),N.error(`Error: ${C.stderr}`))}catch(l){n.stop("Error"),N.error(`Error: ${l.message}`)}}async function Te(e,t,n,a,i,r="*",s={}){let l=Ie();l.start(`Uploading Service Credentials for ${n}...`);try{let c=n==="ios"?"asc_api_key":"google_service_account",f=new URL(import.meta.url),I=$.dirname(f.pathname),g=[$.join(I,"isolated-upload.js"),$.join(I,"commands","isolated-upload.js"),$.resolve(I,"../commands/isolated-upload.js"),$.resolve(process.cwd(),`node_modules/.bin/${m.nameLower}-upload`)],u="";for(let p of g)if(F.existsSync(p)){u=p;break}if(!u)throw new Error("Could not locate isolated-upload.js. Ensure the CLI is properly installed.");let C=fe("node",[u,e,t,c,r,"service","undefined","undefined",a||"undefined",i||"undefined","undefined","undefined","undefined",s.teamId||"undefined",s.teamName||"undefined",s.developerTeamId||"undefined",s.appStoreConnectTeamId||"undefined",s.providerId||"undefined",s.providerName||"undefined"],{stdio:"pipe",encoding:"utf-8",env:{...process.env,AT_CLI_ISOLATED:"1"}});if(C.status!==0){let p=C.stderr||C.stdout||"Unknown upload failure";l.stop("Upload Failed"),N.error(G.red(`Upload Failed: ${p}`));return}C.stdout.includes("SUCCESS")?(l.stop("Upload Success"),N.success(G.green(`\u2713 Service Credentials for ${n} uploaded successfully.`))):(l.stop("Upload Summary"),N.warn(G.yellow(`Upload finished but success not confirmed: ${C.stdout}`)))}catch(c){l.stop("Upload Error"),N.error(G.red(`Error: ${c.message}`))}}function _t(e){let t=e==="ios"?".p8":".json",n=[],a=[{path:"./",label:"Project Root"},{path:$.join(Ge.homedir(),"Downloads"),label:"Downloads"}];for(let i of a)if(F.existsSync(i.path))try{let r=F.readdirSync(i.path);for(let s of r)if(s.endsWith(t)){if(e==="android"&&!F.readFileSync($.join(i.path,s),"utf8").includes("service_account")||e==="ios"&&!s.startsWith("AuthKey"))continue;n.push({path:$.join(i.path,s),location:i.label})}}catch{}return n}import ct from"axios";import d from"chalk";import{execSync as O,spawnSync as M}from"child_process";import Xe from"crypto";import y from"fs";import S from"path";import Ce from"os";import Jt from"adm-zip";ct.defaults.proxy=!1;function Be(e,t){if(!y.existsSync(e))return;let n=y.readdirSync(e);for(let a of n){let i=S.join(e,a);if(y.statSync(i).isDirectory()){let s=Be(i,t);if(s)return s}else if(t.test(a))return i}}var ee=e=>String(e||"").trim().toLowerCase().replace(/_/g,"-"),je=e=>String(e||"unknown").trim().replace(/[^a-zA-Z0-9._-]/g,"_")||"unknown",$t=(e,t)=>`ios-certificates/${je(e)}/${je(t)}/`;function Ut(e){return"'"+e.replace(/'/g,"'\\''")+"'"}function qe(...e){let t=e.join(`
+`).split(/\r?\n/).map(n=>n.trim()).filter(Boolean);return t.length>0?t.slice(-8).join(`
+`):void 0}function Ht(e,t,n){let a=M(e,t,{env:n,encoding:"utf-8"});if(!(a.error||a.status!==0))return(a.stdout||a.stderr||"").trim()||void 0}function Ot(e){let t=e?.match(/ruby\s+(\d+)\.(\d+)/);return t?{major:Number(t[1]),minor:Number(t[2])}:null}function Kt(e,t,n){let a=Ot(e);return a?a.major!==t?a.major<t:a.minor<n:!1}function Ee(e){let t=process.env.HOME||Ce.homedir(),n=process.env.FASTLANE_GEM_HOME||S.join(t,".local/share/fastlane/3.4.0"),a=[process.env.FASTLANE_BINARY,"/usr/local/bin/fastlane","/opt/homebrew/bin/fastlane","/usr/local/Cellar/fastlane/2.227.0/libexec/bin/fastlane","/opt/homebrew/Cellar/fastlane/2.227.0/libexec/bin/fastlane",S.join(n,"bin/fastlane"),"fastlane"].filter(Boolean);for(let i of a){if(i.includes("/")&&!y.existsSync(i))continue;let r=M(i,["--version"],{env:e,stdio:"ignore"});if(!r.error&&r.status===0)return{command:i,shellCommand:Ut(i),env:e}}return null}function Lt(e){if(process.env.MACH_SKIP_FASTLANE_INSTALL==="1")return{ok:!1,detail:"Automatic install skipped because MACH_SKIP_FASTLANE_INSTALL=1."};let t=M("gem",["--version"],{env:e,encoding:"utf-8"});if(t.error||t.status!==0)return{ok:!1,detail:qe(t.stdout,t.stderr)||"RubyGems is not available."};let n=Ht("ruby",["-v"],e);if(Kt(n,3,2))return{ok:!1,detail:[n?`Detected Ruby: ${n}`:void 0,"The latest fastlane dependency tree now requires Ruby >= 3.2.","Mach skipped automatic gem install because macOS system Ruby is too old for it."].filter(Boolean).join(`
+`)};let a=process.env.HOME||Ce.homedir(),i=process.env.FASTLANE_GEM_HOME||S.join(a,".local/share/fastlane/3.4.0"),r=S.join(i,"bin");y.mkdirSync(r,{recursive:!0}),o.info(d.dim("fastlane not found. Installing fastlane into the local Mach cache..."));let s=M("gem",["install","fastlane","--no-document","--install-dir",i,"--bindir",r],{env:{...e,GEM_HOME:i,GEM_PATH:[i,e.GEM_PATH].filter(Boolean).join(":")},encoding:"utf-8"});if(s.error||s.status!==0){let l=qe(s.stdout,s.stderr);return o.warn(d.yellow("Automatic fastlane install failed.")),l&&o.warn(d.dim(l)),{ok:!1,detail:[n?`Detected Ruby: ${n}`:void 0,l].filter(Boolean).join(`
+`)||void 0}}return o.success(d.green("\u2713 fastlane installed into the local Mach cache.")),{ok:!0}}function Mt(){return!process.env.CI&&process.stdin.isTTY&&process.stdout.isTTY}function zt(e){let t=M("brew",["--version"],{env:e,encoding:"utf-8"});if(t.error||t.status!==0)return{ok:!1,detail:"Homebrew is not available on PATH."};o.info(d.dim("Installing fastlane with Homebrew..."));let n=M("brew",["install","fastlane"],{env:e,stdio:"inherit"});return n.error||n.status!==0?{ok:!1,detail:"brew install fastlane failed."}:(o.success(d.green("\u2713 fastlane installed with Homebrew.")),{ok:!0})}async function Qt(e){if(!Mt())return!1;o.warn(d.yellow("fastlane is required for iOS certificate/profile sync, but it was not found.")),e&&o.info(d.dim(e));let t=await lt({message:"Install fastlane now with Homebrew?",initialValue:!0});return T(t)?(U("Operation cancelled"),!1):!!t}async function jt(){let e=se(),t=Ee(e);if(t)return t;let n=Lt(e);e=se();let a=Ee(e);if(a)return a;if(await Qt(n.detail)){let i=zt(e);e=se();let r=Ee(e);if(r)return r;throw new Error(["fastlane is required for iOS certificate/profile sync, but it was still not found after Homebrew install.",i.detail?`Homebrew install failed:
+${i.detail}`:void 0,"Try running manually: brew install fastlane","Then run mach credentials again."].filter(Boolean).join(`
+`))}throw new Error(["fastlane is required for iOS certificate/profile sync, but it was not found on PATH.",n.detail?`Automatic install failed:
+${n.detail}`:void 0,"Recommended fix: brew install fastlane","Alternative: install Ruby 3.x, then run: gem install fastlane --no-document","Then run mach credentials again."].filter(Boolean).join(`
+`))}var x=e=>{if(typeof e!="string")return;let t=e.trim();return t.length>0?t:void 0},xe=e=>x(e.password)||x(e.p12Password)||x(e.certificatePassword)||x(e.meta?.password)||x(e.meta?.p12Password)||x(e.meta?.certificatePassword),pt=e=>x(e.keystorePassword)||x(e.storePassword)||x(e.meta?.keystorePassword)||x(e.meta?.storePassword),ut=e=>x(e.keyPassword)||x(e.meta?.keyPassword),qt=e=>x(e.alias)||x(e.meta?.alias),et=e=>e.credentialId||e.id,tt=e=>e.bundleId||e.bundleIdentifier||e.meta?.bundleId||e.meta?.bundleIdentifier,nt=e=>e.distributionType||e.meta?.distributionType,it=e=>!!xe(e)||!!pt(e)||!!ut(e),en=async(e,t,n)=>{if(!["ios_cert","android_keystore"].includes(n.type)||it(n))return n;let a=tt(n),i=nt(n);if(!a||!i)return n;try{let s=(await W.get("/credentials/resolve",{params:{projectId:e,platform:t,bundleId:a,distributionType:i}})).data.credentials||[],l=et(n),c=s.find(f=>{if(f.type!==n.type)return!1;let I=et(f);return l&&I===l?!0:tt(f)===a&&ee(nt(f))===ee(i)&&it(f)});return c?{...n,...c,meta:{...n.meta,...c.meta}}:n}catch{return n}},tn=e=>{let t=ee(e);return t==="store"||t==="app-store"?"PRODUCTION":["adhoc","ad-hoc","internal","staging","stage"].includes(t)?"STAGING":"DEVELOPMENT"},nn=(e,t)=>{let n=xe(e);if(n)return n;let a=tn(e.distributionType);return["IOS_P12_PASSWORD",`${m.envPrefix}P12_PASSWORD`,`IOS_P12_PASSWORD_${a}`,`P12_PASSWORD_${a}`,"MACH_P12_PASSWORD","P12_PASSWORD","CERT_PASSWORD"].map(r=>x(t[r])).find(Boolean)||""},an=(e,t)=>{let n=ee(e.distributionType),a=n==="store"?"PRODUCTION":["internal","adhoc","ad-hoc","staging","stage"].includes(n)?"STAGING":"DEVELOPMENT",i=["PRODUCTION","STORE","INTERNAL","STAGING","DEVELOPMENT","RELEASE","DEBUG"],r=[`KEYSTORE_PASSWORD_${a}`,`KEYSTORE_PASSWORD_${String(e.distributionType||"").toUpperCase()}`,...i.map(g=>`KEYSTORE_PASSWORD_${g}`),"ANDROID_STORE_PASSWORD","ANDROID_KEYSTORE_PASSWORD","ANDROID_KEYSTONE_PASSWORD","KEYSTORE_PASSWORD"],s=[`KEY_PASSWORD_${a}`,`KEY_PASSWORD_${String(e.distributionType||"").toUpperCase()}`,"ANDROID_KEY_PASSWORD","KEY_PASSWORD"],l=[`KEYSTORE_ALIAS_${a}`,`KEYSTORE_ALIAS_${String(e.distributionType||"").toUpperCase()}`,...i.map(g=>`KEYSTORE_ALIAS_${g}`),"ANDROID_KEY_ALIAS","KEYSTORE_ALIAS"],c=pt(e)||xe(e)||r.map(g=>x(t[g])).find(Boolean)||"",f=ut(e)||s.map(g=>x(t[g])).find(Boolean)||c;return{alias:qt(e)||l.map(g=>x(t[g])).find(Boolean)||"",keystorePassword:c,keyPassword:f}},at=(e,t,n)=>{let a=e.includes(".")?e.replace(/\.[^.]+$/i,".zip"):`${e}.zip`,i=S.basename(e),r=new Jt;return r.addLocalFile(e,void 0,i),r.addFile(t,Buffer.from(n.endsWith(`
+`)?n:`${n}
+`,"utf8")),r.writeZip(a),a},gt=e=>{let t=e.toLowerCase();return t==="production"||t==="prod"||t.includes("store")||t.endsWith("-production")||t.endsWith("-prod")},rn=e=>{let t=e.toLowerCase();return t==="staging"||t==="stage"||t.includes("preview")||t.includes("adhoc")||t.includes("ad-hoc")||t.endsWith("-staging")||t.endsWith("-stage")},sn=(e,t)=>{let n=re(e,t)||{},a=ee(n.distribution),i=ee(n.iosExportMethod||n.ios?.exportMethod),r=ee(n.environment);return i==="app-store"||a==="store"?"store":i==="development"||a==="development"?"development":i==="ad-hoc"||i==="adhoc"||a==="ad-hoc"||a==="adhoc"||a==="internal"?"adhoc":r==="production"||r==="store"?"store":r==="development"||r==="dev"?"development":r==="staging"||r==="stage"||r==="preview"?"adhoc":gt(t)?"store":rn(t)?"adhoc":"development"},on=(e,t)=>{let n=re(e,t)||{},a=ee(n.distribution),i=ee(n.environment);return a==="store"||i==="production"||i==="store"||gt(t)?"store":"internal"};function ln(e,t,n){let a=y.readFileSync(n,"utf8"),i=Math.floor(Date.now()/1e3),r=Buffer.from(JSON.stringify({alg:"ES256",kid:e,typ:"JWT"})).toString("base64url"),s=Buffer.from(JSON.stringify({iss:t,iat:i,exp:i+1200,aud:"appstoreconnect-v1"})).toString("base64url"),l=`${r}.${s}`,c=Xe.createSign("SHA256");c.update(l);let f=c.sign({key:a,dsaEncoding:"ieee-p1363"}).toString("base64url");return`${l}.${f}`}async function dn(e,t,n,a){let i=ln(t,n,a),r=(await import("axios")).default;for(let s of e)try{await r.post("https://api.appstoreconnect.apple.com/v1/devices",{data:{type:"devices",attributes:{name:s.name,udid:s.udid,platform:"IOS"}}},{headers:{Authorization:`Bearer ${i}`,"Content-Type":"application/json"}}),o.info(d.dim(`  \u2713 Registered: ${s.name}`))}catch(l){let c=l.response?.data?.errors;c?.some(I=>I.code==="ENTITY_ERROR.ATTRIBUTE.INVALID.DUPLICATE"||I.detail?.toLowerCase().includes("already registered")||I.detail?.toLowerCase().includes("already exists"))?o.info(d.dim(`  Already on Portal: ${s.name}`)):o.warn(d.yellow(`  Could not register ${s.name}: ${c?.[0]?.detail||l.message}`))}}var rt=async e=>{Yt(d.bgCyan.black(m.cliTag("Credentials")));let t=await ne({message:"Select platform:",options:[{value:"ios",label:"iOS"},{value:"android",label:"Android"}]});T(t)&&(U("Operation cancelled"),process.exit(0));let n=await ne({message:"What do you want to do?",options:[{value:"setup",label:"Build Credentials (Certs/Profiles)",hint:"Manage everything needed to build your project"},{value:"download",label:"Download credentials (credentials.json)",hint:"Sync credentials from Dashboard to local project"},{value:"service",label:"App Store Connect API Key (Magic)",hint:"Manage your API Key for automated submission"},{value:"push",label:"Push Notifications (Placeholder)",hint:"Manage your Apple Push Notifications Key"},{value:"back",label:"Go back"},{value:"exit",label:"Exit"}].filter(a=>!(t==="android"&&(a.value==="service"&&(a.label="Google Service Account (JSON)"),a.value==="push")))});if((T(n)||n==="exit")&&(U("Operation cancelled"),process.exit(0)),n==="back")return rt(e);if(n==="setup")await cn({...e,platform:t});else if(n==="download")await An({...e,platform:t});else if(n==="service")await ze({...e,platform:t});else if(n==="push")return dt("Push Notifications management is coming soon!","Coming Soon"),rt(e);Dt(d.green("Done!"))},cn=async e=>{let t=Ae(),n=e.platform,a=e.profile;if(!a){let l=await ne({message:"Select credential type:",options:[{value:"development",label:"Development",hint:"Local testing & simulators"},{value:"staging",label:"Ad Hoc / Staging",hint:"Internal distribution & device testing"},{value:"production",label:"Production / App Store",hint:"App Store & Play Store submission"}]});T(l)&&(U("Operation cancelled"),process.exit(0)),a=l}let i=`./${m.configFileName}`;if(!y.existsSync(i)){o.error(`No ${m.configFileName} found. Run \`${m.nameLower} init\` or \`${m.nameLower} link\` first.`);return}let r=JSON.parse(y.readFileSync(i,"utf-8")),{projectId:s}=r;if(!s){o.error(`${m.configFileName} is missing projectId.`);return}if(e.awsProfile&&o.warn(d.yellow(`Ignoring --aws-profile. Authenticating with ${m.name} Cloud...`)),o.info(d.dim(`Setting up credentials for: ${a}`)),n==="ios")await pn(s,a,e,r);else{let l=on(r,a);await mn(s,a,l,e,r)}};async function pn(e,t,n,a){let i=n.bundleId;if(!i){let c=a.submit?.[t]?.ios?.bundleIdentifier||a.submit?.[t]?.ios?.bundleId||Se(a,t),f=[];try{let g=(await W.get(`/credentials/${e}`)).data.credentials||[];f=[...new Set(g.filter(u=>u.platform==="ios"&&u.bundleId&&u.bundleId!=="*").map(u=>u.bundleId))]}catch{}if(c&&!f.includes(c)&&f.unshift(c),f.length>0){let I=[...f.map(u=>({value:u,label:u,hint:u===c?"from config":void 0})),{value:"__new__",label:"+ Enter a new Bundle ID"}],g=await ne({message:"Which Bundle ID are you setting up credentials for?",options:I});if(T(g)&&(U("Operation cancelled"),process.exit(0)),g==="__new__"){let u=await q({message:"iOS Bundle ID (e.g. com.example.app):",placeholder:"com.example.app",validate:C=>C.includes(".")?void 0:"Please enter a valid Bundle ID"});T(u)&&(U("Operation cancelled"),process.exit(0)),i=u}else i=g}else{let I=await q({message:"iOS Bundle ID (e.g. com.example.app):",placeholder:"com.example.app",validate:g=>g.includes(".")?void 0:"Please enter a valid Bundle ID"});T(I)&&(U("Operation cancelled"),process.exit(0)),i=I}}o.info(d.dim(`Bundle ID: ${i}`));let r=sn(a,t),s=a.submit?.production?.ios?.appleId;s&&o.info(d.dim(`Using Apple ID from config: ${s}`)),await gn(e,i,t,r,r==="store"?"appstore":r==="adhoc"?"adhoc":"development",n,a,s)}async function un(e){let t="MATCH_ENCRYPTION_PASSPHRASE";try{let s=((await W.get(`/projects/${e}/secrets/export?env=development`)).data.secrets||{})[t];if(s&&!s.includes("[Decryption Failed]"))return o.info(d.dim("Using existing encryption passphrase from Dashboard")),o.info(d.cyan(`MATCH_PASSWORD: ${s}`)),s;if(s&&s.includes("[Decryption Failed]")){o.warn(d.yellow("\u26A0\uFE0F  Existing MATCH_PASSWORD could not be decrypted (encryption key changed).")),o.info(d.dim("Generating a fresh passphrase and cleaning old certificates..."));let l=Xe.randomBytes(32).toString("base64");try{await W.post(`/projects/${e}/secrets`,{key:t,value:l,type:"managed",description:"Encryption passphrase for iOS certificates (fastlane match)",visibility:"secret"}),o.success(d.green("\u2713 New encryption passphrase generated and saved"))}catch{}try{await W.post("/credentials/clean-match-storage",{projectId:e}),o.success(d.green("\u2713 Cleaned old certificates from storage"))}catch{}return l}}catch(i){o.info(d.dim(`Could not fetch existing passphrase from Dashboard: ${i.message}`))}let n=await ne({message:"No active encryption passphrase found on Dashboard. What would you like to do?",options:[{value:"generate",label:"Generate a new secure passphrase",hint:"Safe for first-time setup"},{value:"enter",label:"Enter existing passphrase manually",hint:"Required if you already have certs in S3"},{value:"cancel",label:"Cancel",hint:"Quit"}]});if((T(n)||n==="cancel")&&(U("Operation cancelled"),process.exit(0)),n==="enter"){let i=await ve({message:"Enter your MATCH_PASSWORD (encryption passphrase):",validate:s=>s.length>0?void 0:"Passphrase is required"});T(i)&&(U("Operation cancelled"),process.exit(0));let r=i;try{await W.post(`/projects/${e}/secrets`,{key:t,value:r,type:"managed",description:"Encryption passphrase for iOS certificates (fastlane match)"}),o.success(d.green("\u2713 Saved passphrase to Dashboard"))}catch{}return r}let a=Xe.randomBytes(32).toString("base64");try{await W.post(`/projects/${e}/secrets`,{key:t,value:a,type:"managed",description:"Encryption passphrase for iOS certificates (fastlane match)",visibility:"secret"}),o.success(d.green("\u2713 Generated and saved encryption passphrase to Dashboard")),o.info(d.cyan(`MATCH_PASSWORD: ${a}`))}catch(i){o.warn(d.yellow(`Could not save passphrase to Dashboard: ${i.message}`))}return a}async function gn(e,t,n,a,i,r,s,l){let c=Ae(),f=!1,I=A=>{c.start(A),f=!0},g=A=>{f&&(c.stop(A),f=!1)};o.info(d.blue("Configuring iOS certificate management..."));let u,C=ge(s,n),p=C;if(!l){let A=await q({message:"Apple ID (for Apple Developer Portal):",placeholder:"your-email@example.com",validate:v=>v.includes("@")?void 0:"Please enter a valid email"});T(A)&&(U("Operation cancelled"),process.exit(0)),l=A}try{let A=await un(e),v="",H="";try{let Z=await W.post("/credentials/build-server-token",{projectId:e});Z.data.status==="success"&&Z.data.credentials&&(process.env.AWS_ACCESS_KEY_ID=Z.data.credentials.accessKeyId,process.env.AWS_SECRET_ACCESS_KEY=Z.data.credentials.secretAccessKey,Z.data.credentials.sessionToken&&(process.env.AWS_SESSION_TOKEN=Z.data.credentials.sessionToken),H=Z.data.credentials.region||"ap-south-1",v=Z.data.credentials.bucket||m.bucketPrefix,process.env.AWS_REGION=H,delete process.env.AWS_PROFILE)}catch(Z){throw o.error(`Failed to authenticate with ${m.name} Cloud.`),Z}if(!v||!H){o.error(`Failed to resolve S3 configuration from ${m.name} Cloud.`);return}let h=r.teamId||C.teamId||s.submit?.production?.ios?.appleTeamId;if(!h)try{let te=(await W.get(`/projects/${e}/secrets`)).data.secrets?.find(z=>z.key==="APPLE_TEAM_ID");te&&(h=te.value,o.info(d.dim(`Using Team ID from Dashboard: ${h}`)))}catch{}h&&h===s.submit?.production?.ios?.appleTeamId&&o.info(d.dim(`Using Apple Team ID from config: ${h}`));let _=await me({appleId:l,config:s,profile:n,initialTeam:{...C,teamId:h,developerTeamId:C.developerTeamId||h},promptToPersistConfig:!h,saveTeamId:h?void 0:Z=>st(e,Z)});if(!_?.teamId)return;h=_.teamId;let b={...C,..._,teamId:h,developerTeamId:_.developerTeamId||C.developerTeamId||h};p=b;let D=$t(e,h);o.info(d.dim(`Using match storage prefix: ${D}`));let P=await jt(),J={...P.env};process.env.CI||delete J.CI,I(`Preparing ${i} certificate sync...`),g("Starting certificate sync...");let V=`${m.buildPrefix}-${h}.keychain-db`,E=m.keychainPassword;try{let te=`${process.env.HOME||"/Users/"+(process.env.USER||m.nameLower)}/Library/Keychains/${V}`;o.info(d.dim(`Ensuring keychain exists: ${V}`));try{O(`security create-keychain -p ${E} ${V} 2>/dev/null || true`),O(`security unlock-keychain -p ${E} ${V}`),O(`security set-keychain-settings ${V}`);let w=O("security list-keychains -d user").toString();if(!w.includes(V)){o.info(d.dim(`Adding ${V} to search list`));let R=[...w.replace(/"/g,"").split(`
+`).map(X=>X.trim()).filter(X=>X.length>0),te].join(" ");O(`security list-keychains -d user -s ${R}`)}}catch(w){o.warn(d.dim("Keychain setup warning (non-critical): "+w.message))}let z,ce;try{let k=((await W.get(`/credentials/${e}`)).data.credentials||[]).find(R=>R.type==="asc_api_key"&&R.issuerId);if(k){let R=await W.get(`/credentials/${k.credentialId}/download`,{params:{projectId:e,format:"raw"}});if(R.data.downloadUrl){let B=await(await import("axios")).default.get(R.data.downloadUrl,{responseType:"arraybuffer"}),K=S.join(Ce.tmpdir(),`mach-asc-${Date.now()}`);y.mkdirSync(K,{recursive:!0}),u=S.join(K,`AuthKey_${k.keyId}.p8`),y.writeFileSync(u,Buffer.from(B.data)),z=k.keyId,ce=k.issuerId,o.success(d.green("\u2713 ASC API key loaded \u2014 no 2FA required for Portal operations"))}}}catch(w){o.warn(d.dim(`Could not load ASC API key: ${w.message}. Will fall back to Apple ID auth.`))}o.info(d.dim("Generating secure P12 export password..."));let _e=mt();o.success(d.green("\u2713 Secure P12 password generated."));let Q={...J,AWS_REGION:process.env.AWS_REGION||"ap-south-1",AWS_ACCESS_KEY_ID:process.env.AWS_ACCESS_KEY_ID,AWS_SECRET_ACCESS_KEY:process.env.AWS_SECRET_ACCESS_KEY,SSL_CERT_FILE:"/etc/ssl/cert.pem",AWS_CA_BUNDLE:"/etc/ssl/cert.pem",FASTLANE_SSL_CA_CERT:"/etc/ssl/cert.pem",MATCH_PASSWORD:A,FASTLANE_USER:l,FASTLANE_SKIP_UPDATE_CHECK:"1",FASTLANE_TEAM_ID:h,MATCH_KEYCHAIN_NAME:te,MATCH_KEYCHAIN_PASSWORD:E,TERM:process.env.TERM||"xterm-256color",SHELL:process.env.SHELL||"/bin/zsh",MATCH_OUTPUT_PATH:S.join(process.cwd(),"temp_match"),MATCH_STORAGE_MODE:"s3",MATCH_S3_REGION:H,MATCH_S3_BUCKET:v,MATCH_S3_OBJECT_PREFIX:D,MATCH_USERNAME:l,MATCH_APP_IDENTIFIER:t,MATCH_TYPE:i,[`${m.envPrefix}P12_PASSWORD`]:_e,...u&&z&&ce?{APP_STORE_CONNECT_API_KEY_KEY_ID:z,APP_STORE_CONNECT_API_KEY_ISSUER_ID:ce,APP_STORE_CONNECT_API_KEY_KEY_FILEPATH:u,FASTLANE_SKIP_2FA:"1"}:{}};if(r.force){o.warn(d.yellow(`
+\u26A0\uFE0F  Force flag detected: Hard resetting ${i} certificates...`)),o.info(d.dim("Detected decryption failure loop. Clearing remote storage directly to allow fresh generation.")),o.info(d.cyan(`Current MATCH_PASSWORD: ${A}`)),o.info(d.dim(`Cleaning match storage for Team ID: ${h}...`));try{(await W.post("/credentials/clean-match-storage",{projectId:e,teamId:h,storagePrefix:D})).data.status==="success"&&o.success(d.green(`\u2713 Cleared S3 storage for Team ID: ${h}`))}catch(w){o.warn(d.yellow(`S3 cleanup via API failed: ${w.message}`)),o.info(d.dim("Continuing to attempt standard nuke..."))}try{O(`${P.shellCommand} match nuke ${i} --skip_confirmation`,{stdio:"inherit",cwd:process.cwd(),env:Q}),o.success(d.green(`\u2713 Nuked existing ${i} credentials`))}catch{o.warn(d.yellow("Standard nuke failed (likely due to password mismatch).")),o.info(d.dim("Since S3 was cleared manually, proceeding to generation..."))}}if(i==="adhoc"||i==="development")try{o.info(d.blue("Fetching registered devices..."));let k=(await W.get("/devices",h?{params:{teamId:h}}:void 0)).data.devices||[];if(h)try{let R=await W.get("/devices",{params:{teamId:"LEGACY"}}),X=new Map;for(let B of[...k,...R.data.devices||[]])X.set(B.udid,B);k=Array.from(X.values())}catch{}if(k.length===0)o.warn(d.yellow("No registered devices found. Profile will only include devices already on the Apple Developer Portal.")),o.info(d.dim(`Register devices with: ${m.nameLower} device register`));else{let{multiselect:R}=await import("@clack/prompts"),X=await R({message:`Select devices to include in the ${i} profile:`,options:k.map(B=>({value:B.udid,label:`${B.name} (${B.udid.substring(0,12)}...)`,hint:B.model||B.platform})),initialValues:k.map(B=>B.udid)});if(!T(X)&&X.length>0){let B=k.filter(K=>X.includes(K.udid));if(o.info(d.blue(`Registering ${B.length} device(s) on Apple Developer Portal...`)),h&&await Promise.all(B.filter(K=>!K.teamId).map(K=>W.post("/devices",{udid:K.udid,name:K.name,platform:"ios",addedVia:K.addedVia||"cli",teamId:h,teamName:b.teamName}).catch(()=>{}))),u&&z&&ce)await dn(B,z,ce,u);else{o.info(d.dim("You will be prompted for a 2FA code once \u2014 type it and press Enter."));for(let K of B){let ft=K.name.replace(/"/g,'\\"');M(`${P.shellCommand} run register_device name:"${ft}" udid:"${K.udid}"`,{shell:!0,env:Q,stdio:"inherit",cwd:process.cwd()})}}o.info(d.green("\u2713 Device registration complete."))}}}catch(w){o.warn(d.yellow(`Could not fetch registered devices: ${w.message}`)),o.info(d.dim("Continuing without explicit device registration."))}try{let w=M(`${P.shellCommand} match ${i} --app_identifier "${t}" --profile_name "${m.nameLower} ${i} ${t}"`,{shell:!0,cwd:process.cwd(),env:Q,stdio:"inherit",encoding:"utf-8"});if(w.status!==0){o.warn(d.yellow(`
+Certificate sync failed. Attempting to create App ID and retry...`));try{O(`${P.shellCommand} produce --app_identifier "${t}" --app_name "${t}" --skip_itc`,{stdio:"inherit",env:Q}),o.success(d.green("\u2713 App ID created successfully")),o.info(d.blue("Retrying certificate sync...")),w=M(`${P.shellCommand} match ${i} --app_identifier "${t}" --profile_name "${m.nameLower} ${i} ${t}"`,{shell:!0,cwd:process.cwd(),env:Q,stdio:"inherit",encoding:"utf-8"})}catch{}if(w.status!==0)throw new Error("fastlane match failed")}}catch(w){o.warn(d.yellow(`
+Sync failed. This often happens if the encryption passphrase (MATCH_PASSWORD) is incorrect or session expired.`)),o.info(d.cyan(`Failed MATCH_PASSWORD was: ${A}`));let k=await ne({message:"What would you like to do?",options:[{value:"retry_password",label:"Retry with a different MATCH_PASSWORD",hint:"Manually enter the decryption passphrase"},{value:"check_portal",label:"Check Apple Portal (Resolve certificate limits)",hint:"See if you have too many certificates"},{value:"manual",label:"Fallback to manual upload",hint:"Provide .p12 and .mobileprovision files"},{value:"cancel",label:"Cancel",hint:"Go back"}]});if(T(k)||k==="cancel")throw w;if(k==="retry_password"){o.info(d.dim(`
+You are overriding the dashboard passphrase for this session.`));let R=await ve({message:"Enter the correct MATCH_PASSWORD for this project:"});if(R&&!T(R)){A=R,o.info(d.blue("Retrying with provided passphrase...")),o.info(d.cyan(`New MATCH_PASSWORD: ${A}`));let X={...Q,MATCH_PASSWORD:A};if(M(`${P.shellCommand} match ${i}`,{shell:!0,stdio:"inherit",cwd:process.cwd(),env:X}).status===0)await W.post(`/projects/${e}/secrets`,{key:"MATCH_ENCRYPTION_PASSPHRASE",value:A,description:"Encryption passphrase for iOS certificates (fastlane match)",visibility:"secret"}),o.success(d.green("\u2713 Dashboard passphrase updated.")),o.info(d.cyan(`MATCH_PASSWORD: ${A}`));else throw new Error("Sync failed again with provided passphrase.")}else throw w}else if(k==="check_portal")try{let R=await Pe(Q,i,P.shellCommand);if(R.length>0){if(o.info(d.dim(`Found ${R.length} existing ${i} certificates on the portal.`)),await yn(i,Q,e,P.shellCommand,R)&&(o.info(d.blue("Retrying certificate sync...")),M(`${P.shellCommand} match ${i}`,{shell:!0,stdio:"inherit",cwd:process.cwd(),env:Q}).status!==0))throw new Error("Retry failed")}else throw o.error(d.red("No existing certificates found on portal to resolve.")),w}catch(R){throw o.warn(d.dim(`Portal check warning: ${R.message}`)),w}else throw w}o.success(d.green("\u2713 Certificates fetched and synced"));let pe=S.join(process.cwd(),"temp_match"),ue=S.join(pe,`${m.fastlanePrefix}_export.p12`),Ye=Be(pe,/\.mobileprovision$/);try{let k=`${process.env.HOME||"/Users/"+(process.env.USER||m.nameLower)}/Library/Keychains/${V}`;y.existsSync(pe)||y.mkdirSync(pe,{recursive:!0}),o.info(d.dim("Exporting certificate from keychain for dashboard upload..."));let R=O(`security find-identity -v -p codesigning "${k}"`,{encoding:"utf-8"});o.info(d.dim(`Identities in keychain:
+${R.trim()}`)),O(`security export -k "${k}" -t identities -f pkcs12 -o "${ue}" -P ""`,{stdio:"ignore"});try{let X=O(`openssl pkcs12 -in "${ue}" -nokeys -passin pass: -legacy 2>/dev/null || openssl pkcs12 -in "${ue}" -nokeys -passin pass: 2>/dev/null`,{encoding:"utf-8"});if(!X.includes(h))throw new Error(`Exported P12 does not contain identity for team ${h}. Found: ${X.substring(0,200)}`);o.success(d.green(`\u2713 P12 verified \u2014 contains correct team identity (${h})`))}catch(X){throw new Error(`P12 verification failed: ${X.message}`)}}catch{o.warn(d.dim("Could not export certificate from keychain."))}r.teamId&&!h&&await st(e,r.teamId);let De=y.existsSync(ue)?ue:Be(pe,/\.p12$/);if(De&&Ye){let w,k;try{let R=await Pe(Q,i,P.shellCommand);R.length>0&&(w=R[0].expires,k=R[0].id)}catch{o.warn(d.dim("Could not fetch expiration date or ID for dashboard record."))}await de(e,De,"ios_cert",t,a,void 0,w,r.teamId||h,k,_e,void 0,void 0,b.teamId,b.teamName,b.developerTeamId,b.appStoreConnectTeamId,b.providerId,b.providerName),await de(e,Ye,"ios_profile",t,a,void 0,w,r.teamId||h,void 0,void 0,void 0,void 0,b.teamId,b.teamName,b.developerTeamId,b.appStoreConnectTeamId,b.providerId,b.providerName),o.success(d.green("\u2713 Both iOS certificate and provisioning profile uploaded successfully"));try{y.existsSync("./temp_match")&&y.rmSync("./temp_match",{recursive:!0,force:!0})}catch{}}else o.warn(d.yellow("Certificates generated but not found in expected location.")),o.info(d.dim("Falling back to manual upload...")),await ot(e,t,a,p)}catch(Z){g("Certificate fetch failed"),o.error(d.red(`Error: ${Z.message}`)),o.info(d.dim("Falling back to manual upload...")),await ot(e,t,a,p)}}catch(A){g("iOS setup failed"),o.error(d.red(`Error: ${A.message}`))}finally{if(u)try{y.rmSync(S.dirname(u),{recursive:!0,force:!0})}catch{}}}async function st(e,t){try{await W.post(`/projects/${e}/secrets`,{key:"APPLE_TEAM_ID",value:t,description:"Apple Developer Team ID (used for iOS signing)"}),o.success(d.green(`\u2713 Saved Team ID ${t} to Dashboard`))}catch(n){o.warn(d.yellow(`Could not save Team ID to Dashboard: ${n.message}`))}}async function ot(e,t,n,a={}){o.info(d.yellow(`
+Manual Upload Mode`)),o.info("Please provide your certificate and provisioning profile:");let i=await q({message:"Path to .p12 certificate file:",validate:l=>y.existsSync(l)?void 0:"File not found"});T(i)&&(U("Operation cancelled"),process.exit(0));let r=await q({message:"Path to .mobileprovision file:",validate:l=>y.existsSync(l)?void 0:"File not found"});T(r)&&(U("Operation cancelled"),process.exit(0));let s=Ae();s.start(`Uploading to ${m.name} Dashboard...`);try{await de(e,i,"ios_cert",t,n,void 0,void 0,a.teamId,void 0,void 0,void 0,void 0,a.teamId,a.teamName,a.developerTeamId||a.teamId,a.appStoreConnectTeamId,a.providerId,a.providerName),await de(e,r,"ios_profile",t,n,void 0,void 0,a.teamId,void 0,void 0,void 0,void 0,a.teamId,a.teamName,a.developerTeamId||a.teamId,a.appStoreConnectTeamId,a.providerId,a.providerName),s.stop("Upload complete"),o.success(d.green("\u2713 iOS credentials uploaded successfully"))}catch(l){throw s.stop("Upload failed"),l}}async function mn(e,t,n,a,i){let r=Ae();o.step(d.blue("Android Credential Setup"));let s=a.bundleId;if(!s){let g=be(i,t),u=[];try{let p=(await W.get(`/credentials/${e}`)).data.credentials||[];u=[...new Set(p.filter(A=>A.platform==="android"&&A.bundleId&&A.bundleId!=="*").map(A=>A.bundleId))]}catch{}if(g&&!u.includes(g)&&u.unshift(g),u.length>0){let C=[...u.map(A=>({value:A,label:A,hint:A===g?"from config":void 0})),{value:"__new__",label:"+ Enter a new Package Name"}],p=await ne({message:"Which Package Name are you setting up credentials for?",options:C});if(T(p)&&(U("Operation cancelled"),process.exit(0)),p==="__new__"){let A=await q({message:"Android Package Name (e.g. com.example.app):",placeholder:"com.example.app",validate:v=>v.includes(".")?void 0:"Please enter a valid package name"});T(A)&&(U("Operation cancelled"),process.exit(0)),s=A}else s=p}else{let C=await q({message:"Android Package Name (e.g. com.example.app):",placeholder:"com.example.app",validate:p=>p.includes(".")?void 0:"Please enter a valid package name"});T(C)&&(U("Operation cancelled"),process.exit(0)),s=C}}try{let C=((await W.get(`/credentials/${e}`)).data.credentials||[]).find(p=>p.platform==="android"&&p.distributionType===n&&p.bundleId===s);if(C){o.warn(d.yellow(`\u26A0\uFE0F  Existing Android credentials found for ${n}`));let p=await q({message:"What would you like to do? (use/new/cancel)",validate:A=>{let v=A.toLowerCase();if(!(v==="use"||v==="new"||v==="cancel"))return"Please type: use, new, or cancel"}});if(T(p)||p.toLowerCase()==="cancel")return;if(p.toLowerCase()==="use"){o.success(d.green("\u2713 Using existing credentials."));return}await W.delete(`/credentials/${C.credentialId}?projectId=${e}`)}}catch{}let l="./android/app/my-release-key.jks";if(y.existsSync(l)){let g=await lt({message:"Upload existing keystore?"});if(g&&!T(g)){let u=await q({message:"Key alias:",initialValue:"my-key-alias"});if(T(u))return;let C=await ve({message:"Keystore password:"});if(T(C))return;let p=await ve({message:"Key password (leave blank if same as keystore password):"});if(T(p))return;let A=p.trim()||C;await de(e,l,"android_keystore",s,n,u,void 0,void 0,void 0,void 0,C,A),o.success(d.green("\u2713 Keystore uploaded"));return}}o.info(d.blue("Generating new Android keystore..."));let c=a.keyAlias||`${m.nameLower}-${Cn()}`,f=mt(),I=`./${m.nameLower}-${t}.jks`;y.existsSync(I)&&y.unlinkSync(I),r.start("Generating keystore...");try{let g=f.replace(/'/g,"'\\''");O(`keytool -genkeypair -v -keystore "${I}" -alias "${c}" -keyalg RSA -keysize 2048 -validity 10000 -storepass '${g}' -keypass '${g}' -dname "CN=${m.name} Build, OU=Mobile, O=Company, L=City, S=State, C=US"`,{stdio:"inherit"}),r.stop("Keystore generated"),await de(e,I,"android_keystore",s,n,c,void 0,void 0,void 0,void 0,f,f),o.success(d.green("\u2713 Android credentials uploaded successfully")),o.info(d.cyan(`Key Alias: ${c}`))}catch(g){throw r.stop("Generation failed"),new Error(`Keystore generation failed: ${g.message}`)}}var fn=e=>new Promise(t=>setTimeout(t,e));function In(e){return/ECONNRESET|ETIMEDOUT|EAI_AGAIN|ENOTFOUND|ECONNABORTED|socket hang up|network|timeout|temporar/i.test(e)||/API_ERROR:\s*(408|409|425|429|5\d\d)/i.test(e)}async function de(e,t,n,a,i,r,s,l,c,f,I,g,u,C,p,A,v,H){let h=S.basename(t);o.info(d.dim(`Uploading ${h} (Isolated process)...`));let _=new URL(import.meta.url),b=S.dirname(_.pathname),P=[S.join(b,"commands","isolated-upload.js"),e,t,n,a,i,r||"undefined",s||"undefined",l||"undefined",c||"undefined",f||"undefined",I||"undefined",g||"undefined",u||"undefined",C||"undefined",p||"undefined",A||"undefined",v||"undefined",H||"undefined"],J="",V=5;for(let E=1;E<=V;E++){let Z=M("node",P,{stdio:"pipe",encoding:"utf-8",env:{...process.env,AT_CLI_ISOLATED:"1"}});if(Z.status===0&&Z.stdout.includes("SUCCESS")){o.info(d.dim(`\u2713 ${h} uploaded and registered.`));return}if(Z.status===0){o.warn(d.yellow(`Isolated upload finished but success not confirmed: ${Z.stdout}`));return}if(J=(Z.stderr||Z.stdout||Z.error?.message||"Unknown isolated upload failure").trim(),!In(J)||E>=V)throw o.error(d.red(`Isolated Upload Failed: ${J}`)),new Error(J);let z=Math.min(3e4,1500*Math.pow(2,E-1));o.warn(d.yellow(`Upload failed with a transient error. Retrying ${h} in ${Math.round(z/1e3)}s... (${E}/${V})`)),await fn(z)}throw new Error(J||"Unknown isolated upload failure")}async function An(e){let t=Ae(),n=e.platform,a=`./${m.configFileName}`;if(!y.existsSync(a)){o.error(`No ${m.configFileName} found. Run \`${m.nameLower} init\` or \`${m.nameLower} link\` first.`);return}let i=JSON.parse(y.readFileSync(a,"utf-8")),{projectId:r}=i;if(!r){o.error(`${m.configFileName} is missing projectId.`);return}try{t.start("Fetching project secrets...");let l=(await W.get(`/projects/${r}/secrets/export?env=all`)).data.secrets||{};t.stop("Secrets fetched and merged."),t.start("Fetching credentials...");let f=(await W.get(`/credentials/${r}`)).data.credentials||[];t.stop(`Found ${f.length} metadata records.`);let I=f.filter(p=>p.platform===n);if(I.length===0){o.info(`No ${n} credentials found on Dashboard.`);return}let g="./credentials.json",u={};if(y.existsSync(g))try{u=JSON.parse(y.readFileSync(g,"utf-8"))}catch{o.warn("Could not parse existing credentials.json, creating a new one.")}u[n]||(u[n]={});let C=S.join(process.cwd(),"credentials",n);y.existsSync(C)||y.mkdirSync(C,{recursive:!0});for(let p of I){t.start(`Downloading ${p.type} (${p.distributionType})...`);try{let A=await W.get(`/credentials/${p.credentialId}/download`,{params:{projectId:r,format:"raw"}});if(A.data.status==="success"&&A.data.downloadUrl){let v=S.join(process.cwd(),"credentials",n,p.distributionType);y.existsSync(v)||y.mkdirSync(v,{recursive:!0});let H=p.s3Key?.split(".").pop()||(p.type.includes("keystore")?"jks":p.type.includes("cert")?"p12":"mobileprovision"),h=`${p.type}.${H}`,_=S.join(v,h),b=await ct.get(A.data.downloadUrl,{responseType:"arraybuffer"});y.writeFileSync(_,Buffer.from(b.data));let D=S.join("credentials",n,p.distributionType,h),P="",J="",V={alias:"",keystorePassword:"",keyPassword:""};if(n==="ios"&&p.type==="ios_cert"||n==="android"&&p.type==="android_keystore"){let E=await en(r,n,p);if(n==="ios"&&p.type==="ios_cert"&&H.toLowerCase()==="p12"){if(P=nn(E,l),P){let Z=at(_,`${S.basename(_,S.extname(_))}-password.txt`,P);J=S.join("credentials",n,p.distributionType,S.basename(Z))}}else if(n==="android"&&p.type==="android_keystore"&&(V=an(E,l),V.keystorePassword||V.keyPassword)){let Z=[V.alias?`keyAlias=${V.alias}`:void 0,V.keystorePassword?`keystorePassword=${V.keystorePassword}`:void 0,V.keyPassword?`keyPassword=${V.keyPassword}`:void 0].filter(Boolean).join(`
+`),te=at(_,`${S.basename(_,S.extname(_))}-passwords.txt`,Z);J=S.join("credentials",n,p.distributionType,S.basename(te))}}if(n==="android")p.type==="android_keystore"&&(u.android.keystore={keystorePath:D,keystorePassword:V.keystorePassword,keyAlias:V.alias,keyPassword:V.keyPassword},J&&(u.android.keystore.keystoreArchivePath=J));else if(n==="ios"){let E=p.distributionType==="store"?"production":p.distributionType==="adhoc"?"staging":"development";u.ios[E]||(u.ios[E]={}),p.type==="ios_cert"?(u.ios[E].certificatePath=D,u.ios[E].certificatePassword=P,J&&(u.ios[E].certificateArchivePath=J)):p.type==="ios_profile"&&(u.ios[E].provisioningProfilePath=D)}t.stop(`\u2713 ${p.type} (${p.distributionType}) saved${J?" with password archive":""}.`)}}catch(A){let v=A.response?.data?.message||A.message;t.stop(d.dim(`- Skipped ${p.type} (${p.distributionType}): ${v}`))}}y.writeFileSync(g,JSON.stringify(u,null,2)),o.success(d.green("\u2713 Local credentials.json updated.")),dt("Credentials have been synced to your local machine. Ensure credentials.json and credentials/ is added to your .gitignore.","Sync Complete")}catch(s){t.stop(d.red("Sync failed.")),o.error(`Error: ${s.message}`)}}function mt(){let e="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_+=",t="";for(let n=0;n<24;n++)t+=e.charAt(Math.floor(Math.random()*e.length));return t}function Cn(e=8){let t="abcdefghijklmnopqrstuvwxyz0123456789",n="";for(let a=0;a<e;a++)n+=t.charAt(Math.floor(Math.random()*t.length));return n}async function yn(e,t,n,a,i){let r=i||await Pe(t,e,a);if(!r||r.length===0)return!1;let s=await ne({message:"Select a certificate to revoke:",options:[...r.map(l=>({value:`revoke:${l.id}`,label:`Revoke: ${l.name} (${l.expires})`})),{value:"nuke",label:"Revoke All"},{value:"cancel",label:"Cancel"}]});return T(s)||s==="cancel"?!1:s==="nuke"?(O(`${a} match nuke ${e}`,{stdio:"inherit",cwd:process.cwd(),env:t}),!0):typeof s=="string"&&s.startsWith("revoke:")?(await hn(t,s.split(":")[1],a),!0):!1}async function Pe(e,t,n){let a=t==="development"?"development":"distribution",i=`
+lane :${m.fastlanePrefix}_list_certs do
+  require 'spaceship'
+  require 'json'
+  begin
+    Spaceship::Portal.login(ENV['FASTLANE_USER'])
+    Spaceship::Portal.select_team(team_id: ENV['FASTLANE_TEAM_ID'])
+    output = Spaceship::Portal.certificate.all.select { |c|
+      if "${a}" == "development"
+        c.type_display_id.downcase.include?("development")
+      else
+        c.type_display_id.downcase.include?("distribution") || c.type_display_id.downcase.include?("production")
+      end
+    }.map { |c| { id: c.id, name: c.name, expires: c.expires.strftime('%Y-%m-%d'), type: c.type_display_id } }
+    puts "${m.jsonStartMarker}" + output.to_json + "${m.jsonEndMarker}"
+  rescue => e
+    $stderr.puts "ERROR: #{e.message}"
+    exit 1
+  end
+end`,r=S.join(Ce.tmpdir(),`/tmp/${m.nameLower}-list-certs-${Date.now()}`),s=S.join(r,"fastlane"),l=S.join(s,"Fastfile");try{y.existsSync(s)||y.mkdirSync(s,{recursive:!0}),y.writeFileSync(l,i);let f=O(`${n} ${m.fastlanePrefix}_list_certs`,{env:{...e,CI:"1",FASTLANE_FASTFILE:l},cwd:r,stdio:["inherit","pipe","inherit"]}).toString().match(new RegExp(`${m.jsonStartMarker}(.*)${m.jsonEndMarker}`));return f?JSON.parse(f[1]):[]}finally{y.existsSync(r)&&y.rmSync(r,{recursive:!0,force:!0})}}async function hn(e,t,n){let a=`
+lane :${m.fastlanePrefix}_revoke_cert do
+  require 'spaceship'
+  begin
+    Spaceship::Portal.login(ENV['FASTLANE_USER'])
+    Spaceship::Portal.select_team(team_id: ENV['FASTLANE_TEAM_ID'])
+    cert = Spaceship::Portal.certificate.all.find { |c| c.id == "${t}" }
+    cert.revoke! if cert
+  rescue => e
+    $stderr.puts "ERROR: #{e.message}"
+    exit 1
+  end
+end`,i=S.join(Ce.tmpdir(),`/tmp/${m.nameLower}-revoke-cert-${Date.now()}`),r=S.join(i,"fastlane"),s=S.join(r,"Fastfile");try{y.existsSync(r)||y.mkdirSync(r,{recursive:!0}),y.writeFileSync(s,a),O(`${n} ${m.fastlanePrefix}_revoke_cert`,{env:{...e,CI:"1",FASTLANE_FASTFILE:s},cwd:i,stdio:["inherit","pipe","inherit"]})}finally{y.existsSync(i)&&y.rmSync(i,{recursive:!0,force:!0})}}export{wn as a,At as b,vn as c,ge as d,Zn as e,re as f,be as g,Se as h,Rn as i,ze as j,rt as k,cn as l,An as m};

package/dist/{credentials-CT2WW52S.js → credentials-SQ2RHV3K.js}

@@ -1 +1 @@
-import{k as a,l as b,m as c}from"./chunk-XW3V7PJM.js";import"./chunk-S64YFTRR.js";export{a as credentialsMainCommand,b as credentialsSetupCommand,c as downloadCredentialsCommand};
+import{k as a,l as b,m as c}from"./chunk-FLX7VYCU.js";import"./chunk-S64YFTRR.js";export{a as credentialsMainCommand,b as credentialsSetupCommand,c as downloadCredentialsCommand};

package/dist/index.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import{a as fn,b as gr,c as hr,d as Sr,e as $e,f as lt,g as yr,h as br,i as Pt,j as Er,l as Ht}from"./chunk-XW3V7PJM.js";import{a as m,b as pr,c as Pe,d as fr,e as mr,f as vt,g as Je,h as k}from"./chunk-S64YFTRR.js";import{Command as wf,Option as Fe}from"commander";import{configDotenv as _f}from"dotenv";import{intro as we,outro as Ca}from"@clack/prompts";import Ee from"chalk";import{text as Ar,confirm as La,spinner as xa,isCancel as ni,cancel as jt,note as Ma,outro as Ua}from"@clack/prompts";import Gt from"chalk";async function Ir(){try{let e=await Ar({message:"Enter Bucket Name:",placeholder:"e.g. my-app-dev",validate(r){if(r.length===0)return"Bucket name is required"}});ni(e)&&(jt("Operation cancelled."),process.exit(0));let t=await Ar({message:"Enter Region:",initialValue:"ap-south-1"});ni(t)&&(jt("Operation cancelled."),process.exit(0));let n=await La({message:"Do you want to create a CloudFront Distribution for this bucket?",initialValue:!0});ni(n)&&(jt("Operation cancelled."),process.exit(0));let i=xa();i.start("Setting up hosting infrastructure...");try{let r=await k.post("/hosting/setup",{bucketName:e,region:t,createCloudFront:n});if(r.data.status!=="success")throw new Error(r.data.message||"Hosting setup failed");i.stop("Hosting setup complete!");let o=r.data,s=`Bucket Name:      ${Gt.cyan(o.bucketName)}
+import{a as fn,b as gr,c as hr,d as Sr,e as $e,f as lt,g as yr,h as br,i as Pt,j as Er,l as Ht}from"./chunk-FLX7VYCU.js";import{a as m,b as pr,c as Pe,d as fr,e as mr,f as vt,g as Je,h as k}from"./chunk-S64YFTRR.js";import{Command as wf,Option as Fe}from"commander";import{configDotenv as _f}from"dotenv";import{intro as we,outro as Ca}from"@clack/prompts";import Ee from"chalk";import{text as Ar,confirm as La,spinner as xa,isCancel as ni,cancel as jt,note as Ma,outro as Ua}from"@clack/prompts";import Gt from"chalk";async function Ir(){try{let e=await Ar({message:"Enter Bucket Name:",placeholder:"e.g. my-app-dev",validate(r){if(r.length===0)return"Bucket name is required"}});ni(e)&&(jt("Operation cancelled."),process.exit(0));let t=await Ar({message:"Enter Region:",initialValue:"ap-south-1"});ni(t)&&(jt("Operation cancelled."),process.exit(0));let n=await La({message:"Do you want to create a CloudFront Distribution for this bucket?",initialValue:!0});ni(n)&&(jt("Operation cancelled."),process.exit(0));let i=xa();i.start("Setting up hosting infrastructure...");try{let r=await k.post("/hosting/setup",{bucketName:e,region:t,createCloudFront:n});if(r.data.status!=="success")throw new Error(r.data.message||"Hosting setup failed");i.stop("Hosting setup complete!");let o=r.data,s=`Bucket Name:      ${Gt.cyan(o.bucketName)}
 `;s+=`Region:           ${Gt.cyan(o.region)}
 `,s+=`S3 Website URL:   ${Gt.blue(o.s3WebsiteUrl)}`,o.cloudFrontId&&(s+=`
 
@@ -1546,5 +1546,5 @@ Environment Variables:`)),Object.entries(i.env).forEach(([r,o])=>{Ne.info(`  ${r
 Running expo prebuild for deeper analysis...`));try{lf("npx expo prebuild --no-install",{cwd:e,stdio:"pipe"})}catch{return un.warn(Te.yellow("Prebuild failed \u2014 skipping manifest/plist checks.")),o}}else if(!a)return t.json||un.info(Te.dim(`
 Skipping manifest/plist checks \u2014 no android/ios dirs. Use --prebuild to generate them.`)),o;for(let d of r){let u=ya();u.start(Te.dim(`Running ${d.label}...`));try{let c=Date.now(),f=await d.fn(e,t);f.durationMs=Date.now()-c,o.push(f);let p=f.findings.length;u.stop(p>0?Te.yellow(`${d.label} \u2014 ${p} finding(s)`):Te.green(`${d.label} \u2014 clean`))}catch(c){u.stop(Te.red(`${d.label} \u2014 error`)),o.push({category:d.category,label:d.label,findings:[],durationMs:0,error:c.message})}}}return o}import be from"chalk";import{log as he}from"@clack/prompts";var Ut={critical:be.bgRed.white.bold,high:be.red.bold,medium:be.yellow.bold,low:be.blue,info:be.dim},Xn={critical:0,high:1,medium:2,low:3,info:4};function df(e,t){if(!t)return!0;let n=Xn[t];return n===void 0?!0:Xn[e]<=n}function Ia(e,t){let n=0,i={critical:0,high:0,medium:0,low:0,info:0};for(let s of e){let l=s.findings.filter(d=>df(d.severity,t));if(l.length===0&&!s.error)continue;if(he.info(""),he.info(be.bold(`  ${s.label}`)+be.dim(`  ${l.length} finding(s)`)),he.info(be.dim("  "+"\u2500".repeat(60))),s.error){he.error(be.red(`  Error: ${s.error}`));continue}let a=[...l].sort((d,u)=>Xn[d.severity]-Xn[u.severity]);for(let d of a){let u=Ut[d.severity](` ${d.severity.toUpperCase()} `);he.info(`  ${u}  ${be.bold(d.id)}  ${d.title}`),he.info(be.dim(`          ${d.description}`)),d.file&&he.info(be.dim(`          File: ${d.file}${d.line?`:${d.line}`:""}`)),he.info(be.cyan(`          Fix: ${d.recommendation}`)),he.info(""),i[d.severity]++,n++}}he.info(""),he.info(be.bold("  Summary")),he.info(be.dim("  "+"\u2500".repeat(60))),he.info(`  Total: ${be.bold(String(n))} finding(s)`),he.info(`  ${Ut.critical(` ${i.critical} Critical `)}  ${Ut.high(` ${i.high} High `)}  ${Ut.medium(` ${i.medium} Medium `)}  ${Ut.low(` ${i.low} Low `)}  ${Ut.info(` ${i.info} Info `)}`);let r=i.critical>0,o=i.high>0;r||o?(he.info(""),he.error(be.red.bold(`  FAIL \u2014 ${i.critical} critical, ${i.high} high issue(s) found`))):n>0?(he.info(""),he.warn(be.yellow("  PASS (with warnings) \u2014 no critical or high issues"))):(he.info(""),he.success(be.green.bold("  PASS \u2014 no issues found")))}function wa(e,t){let n=e.flatMap(r=>r.findings),i={};for(let r of Object.values(Me))i[r]=n.filter(o=>o.severity===r).length;return{version:"1.0.0",timestamp:new Date().toISOString(),project:t.name||"unknown",projectVersion:t.version||"0.0.0",summary:{total:n.length,...i},passed:i.critical===0&&i.high===0,checks:e.map(r=>({category:r.category,label:r.label,findingCount:r.findings.length,durationMs:r.durationMs,error:r.error||null})),findings:n}}import{log as Se,spinner as uf}from"@clack/prompts";import fe from"chalk";import at from"fs";import pf from"os";import Ft from"path";import{execSync as ff}from"child_process";var _a=16384,mf=1,gf=Buffer.from([127,69,76,70]);async function Ra(e){Se.info(fe.bold.underline("16KB Page Alignment Check")),console.log("");let t=Ft.resolve(e);if(!at.existsSync(t))return Se.error(fe.red(`APK file not found: ${t}`)),!1;if(!t.endsWith(".apk"))return Se.error(fe.red("The provided file is not an APK file.")),!1;let n=uf();n.start("Extracting and analyzing native libraries...");let i=at.mkdtempSync(Ft.join(pf.tmpdir(),"mach-16kb-"));try{try{ff(`unzip -o -q "${t}" "lib/arm64-v8a/*.so" "lib/x86_64/*.so" -d "${i}" 2>/dev/null`,{encoding:"utf-8",maxBuffer:50*1024*1024})}catch{}let r=$a(Ft.join(i,"lib"));if(r.length===0)return n.stop("Analysis complete."),Se.info(fe.yellow("No arm64-v8a or x86_64 native libraries found in the APK.")),Se.info(fe.dim("16KB alignment check only applies to arm64-v8a and x86_64 architectures.")),!0;let o=[];for(let a of r){let d=Ft.relative(i,a),u=Sf(d),c=Ft.basename(a),f=hf(a);f!==null&&o.push({name:c,filePath:d,arch:u,align:f,compatible:f>=_a})}if(n.stop("Analysis complete."),o.length===0)return Se.info(fe.yellow("No valid ELF shared libraries found.")),!0;let s=o.filter(a=>!a.compatible),l=o.filter(a=>a.compatible);if(Se.info(fe.dim(`Checked ${o.length} native librar${o.length===1?"y":"ies"}
 `)),s.length>0){Se.info(fe.red.bold(`Incompatible libraries:
-`));for(let a of s)Se.error(fe.red(`${fe.bold(a.name)} ${fe.dim(`(${a.arch})`)}`)),Se.info(fe.dim(`  PT_LOAD alignment: 2**${Math.log2(a.align)} (${a.align} bytes, needs 2**14 = ${_a})`))}return l.length>0&&(console.log(""),Se.success(fe.green(`${l.length} librar${l.length===1?"y":"ies"} correctly aligned (2**14 or higher).`))),console.log(""),s.length===0?(Se.success(fe.green.bold("ELF Verification Successful. APK is 16KB compatible.")),!0):(Se.error(fe.red.bold(`Found ${s.length} unaligned lib${s.length===1?"":"s"} (arm64-v8a/x86_64 libs need to be aligned).`)),console.log(""),Se.info(fe.yellow("To fix this:")),Se.info(fe.dim("  1. Rebuild with NDK r28+ which defaults to 16KB page alignment")),Se.info(fe.dim("  2. Or set -DANDROID_SUPPORT_FLEXIBLE_PAGE_SIZES=ON in CMake")),Se.info(fe.dim("  3. Update third-party libraries that ship prebuilt .so files")),Se.info(fe.dim("  4. After rebuilding: zipalign -p -f -v 16 input.apk output.apk")),console.log(""),Se.info(fe.dim("Reference: https://developer.android.com/guide/practices/page-sizes")),!1)}catch(r){return n.stop("Analysis failed."),Se.error(fe.red(`Failed to analyze APK: ${r.message}`)),!1}finally{try{at.rmSync(i,{recursive:!0,force:!0})}catch{}}}function hf(e){let t=at.openSync(e,"r");try{let n=Buffer.alloc(64);if(at.readSync(t,n,0,64,0),!n.subarray(0,4).equals(gf))return null;let i=n[4]===2,r=n[5]===1,o=(f,p)=>r?f.readUInt16LE(p):f.readUInt16BE(p),s=(f,p)=>r?f.readUInt32LE(p):f.readUInt32BE(p),l=(f,p)=>Number(r?f.readBigUInt64LE(p):f.readBigUInt64BE(p)),a,d,u;i?(a=l(n,32),d=o(n,54),u=o(n,56)):(a=s(n,28),d=o(n,42),u=o(n,44));let c=null;for(let f=0;f<u;f++){let p=Buffer.alloc(d);if(at.readSync(t,p,0,d,a+f*d),s(p,0)!==mf)continue;let y;i?y=l(p,48):y=s(p,28),y>0&&(c===null||y<c)&&(c=y)}return c??0}catch{return null}finally{at.closeSync(t)}}function $a(e){let t=[];if(!at.existsSync(e))return t;let n=at.readdirSync(e,{withFileTypes:!0});for(let i of n){let r=Ft.join(e,i.name);i.isDirectory()?t.push(...$a(r)):i.name.endsWith(".so")&&t.push(r)}return t}function Sf(e){return e.includes("arm64-v8a")?"arm64-v8a":e.includes("x86_64")?"x86_64":"unknown"}var Oa=async e=>{if(Pe()||(Ue.error(Ye.red(`You are not logged in. Run \`${m.nameLower} login\` first.`)),process.exit(1)),e.apk){await Ef(e);return}let n=process.cwd(),i=qn.join(n,"package.json");pn.existsSync(i)||(Ue.error(Ye.red("No package.json found. Run this command from a project root.")),process.exit(1));let r=JSON.parse(pn.readFileSync(i,"utf-8")),o=!!(r.dependencies?.expo||r.devDependencies?.expo);e.json||(Ue.info(Ye.dim(`Project: ${r.name||"unknown"} v${r.version||"0.0.0"}`)),Ue.info(Ye.dim(`Type: ${o?"Expo":"Bare React Native"}`)),Ue.info(""));let s={json:e.json,fix:e.fix,category:e.category,severity:e.severity,prebuild:e.prebuild},l=await Aa(n,s);e.json?console.log(JSON.stringify(wa(l,r),null,2)):Ia(l,e.severity);let a=l.some(u=>u.findings.some(c=>c.severity==="critical")),d=l.some(u=>u.findings.some(c=>c.severity==="high"));(a||d)&&process.exit(1)},va=["16kb"];async function Ef(e){let t=e.category?.toLowerCase();t&&!va.includes(t)&&(Ue.error(Ye.red(`Unknown APK check category: "${t}"`)),Ue.info(Ye.dim(`Available APK checks: ${va.join(", ")}`)),process.exit(1));let n=await Af(e.apk);n||process.exit(1);let i=!t,r=!1;(i||t==="16kb")&&(await Ra(n)||(r=!0)),r&&process.exit(1)}async function Af(e){if(e.startsWith("build:")){let n=e.slice(6);return await If(n)}if(e.startsWith("http://")||e.startsWith("https://"))return await Da(e);let t=qn.resolve(e);return pn.existsSync(t)?t:(Ue.error(Ye.red(`APK file not found: ${t}`)),null)}async function If(e){let t=Pa();t.start(`Fetching APK from build ${e}...`);try{let n=await k.get(`/build/${e}`);if(n.data.status!=="success")throw new Error(n.data.message);let i=n.data.build;if(!i)throw new Error("Build not found");let r=i.artifacts?.find(o=>o.type?o.type==="apk":o.name?.endsWith(".apk")||o.url?.includes(".apk"));return!r||!r.url?(t.stop("No APK artifact found"),Ue.error(Ye.red("This build does not have an APK artifact.")),Ue.info(Ye.dim("Make sure the build produced an APK (not just an AAB).")),null):(t.stop(`Found build: ${i.buildId||e}`),await Da(r.url))}catch(n){return t.stop("Failed to fetch build"),Ue.error(Ye.red(n.message)),null}}async function Da(e){let t=Pa();t.start("Downloading APK...");try{let n=pn.mkdtempSync(qn.join(yf.tmpdir(),`${m.nameLower}-audit-`)),i=qn.join(n,"app.apk"),r=await bf.get(e,{responseType:"arraybuffer"});pn.writeFileSync(i,r.data);let o=(r.data.length/(1024*1024)).toFixed(1);return t.stop(`Downloaded APK (${o} MB)`),i}catch(n){return t.stop("Download failed"),Ue.error(Ye.red(`Failed to download APK: ${n.message}`)),null}}var Rf=console.log;console.log=()=>{};_f();console.log=Rf;we(Ee.bgCyan.black(m.cliTag("Production Build Orchestrator")));var vf=$f(import.meta.url),Pf=vf("../package.json"),Na=(e,t=[])=>t.concat(e),re=new wf;re.name(m.nameLower).description(`${m.name} CLI: Powerful Cloud Infrastructure Tools`).version(Pf.version).option("-y, --yes","Automatically answer yes to all prompts",!1).option("--quiet","Suppress non-essential output",!1);re.command("agent").description("Manage local device discovery agent for the Install Hub (port 7070)").argument("[action]","start, run, install, status, restart, stop, or uninstall","start").action(async e=>{await Ns(e)});re.command("host").description("Setup AWS S3 static hosting and CloudFront").action(async()=>{we(Ee.bgCyan.black(m.cliTag("Hosting"))),await Ir()});re.command("sitemap").description("Generate sitemap.xml from Expo Router app structure").option("-o, --output <path>","Output path for sitemap.xml","./public/sitemap.xml").action(async e=>{we(Ee.bgCyan.black(m.cliTag("Sitemap Generator"))),await $r(e)});re.command("build").description("Run a build on a cloud provider (AWS Spot Instances)").argument("[platform]","Target platform (android, ios)").option("--platform <os>","Target platform alias (android, ios) [Optional]").option("--repo <url>","Git Repository URL").option("--branch <name>","Git Branch").option("--ami <id>","AMI ID").option("--bucket <name>","S3 Bucket for artifacts").option("--region <region>","AWS Region").option("--aws-profile <name>","AWS Credentials Profile").option("-p, --build-profile <name>","Build Profile (e.g. production, staging)").option("--profile <name>","Build Profile (alias for --build-profile)").option("--dry-run","Generate User Data script without launching").option("--keep-instance","Do not terminate the instance after build").option("--subnet <id>","VPC Subnet ID to launch the instance in").option("--security-group <id>","VPC Security Group ID to use").option("--ssh-host <host>","Remote host for iOS build (SSH)").option("--ssh-user <user>","SSH username for remote host").option("--ssh-key <path>","Path to private SSH key for remote host").option("--ios-scheme <scheme>","iOS Scheme to build").option("--ios-team-id <id>","Apple Development Team ID").option("--ios-configuration <config>","Xcode configuration (Release/Debug)").option("--ios-export-method <method>","Export method (ad-hoc, app-store, development, enterprise)").option("--ios-api-key-id <id>","App Store Connect API Key ID").option("--ios-api-key-issuer <id>","App Store Connect API Key Issuer ID").option("--ios-api-key-path <path>","Path to App Store Connect API Key (.p8) file").option("--simulator","Build for iOS Simulator (no signing required)").addOption(new Fe("--build-id <id>","Internal build ID").hideHelp()).addOption(new Fe("--project-id <id>","Internal project ID").hideHelp()).addOption(new Fe("--fail-only","Internal: mark an existing build failed").hideHelp()).addOption(new Fe("--error <message>","Internal failure message").hideHelp()).option("--local","Run build on local machine").option("--auto-version","Automatically fetch and increment Android versionCode or iOS buildNumber from the store").option("--auto-submit","Submit this build after it completes successfully").option("--submit-track <track>","Google Play track to use with --auto-submit").option("--submit-release-status <status>","Google Play release status to use with --auto-submit").option("--submit-rollout <fraction>","Google Play staged rollout fraction to use with --auto-submit").option("--submit-changes-not-sent-for-review","Commit Google Play changes without automatically sending them for review when using --auto-submit").option("--submit-credential-id <id>","Service credential ID to use with --auto-submit").option("--submit-json-output <path>","Write auto-submit metadata JSON to a file for CI/CD").option("--verbose","Enable verbose logging").option("--json-output <path>","Write build metadata JSON to a file for CI/CD").option("--maestro","Queue a managed Maestro test run after a successful build").option("--maestro-flows <path>","Maestro flow file or directory (default: .maestro)").option("--maestro-device <device>","Managed Maestro device profile").option("--maestro-retries <n>","Retries for the Maestro run","1").option("--maestro-record","Enable screen recording where supported").option("--maestro-use-build-source","Use Maestro flows from the build source snapshot instead of uploading local flows").option("--maestro-env <name>","Forward an environment variable to the managed Maestro runner; repeat or comma-separate names",Na,[]).option("-y, --yes","Automatically answer yes to all prompts",!1).option("--quiet","Suppress non-essential output",!1).action(async(e,t)=>{let n=re.opts();t.yes=t.yes||n.yes,t.quiet=t.quiet||n.quiet,t.platform=e||t.platform,t.buildProfile=t.profile||t.buildProfile,t.quiet||we(Ee.bgCyan.black(m.cliTag("Cloud Build"))),await On(t)});re.command("maestro").description("Run Maestro tests locally or with the managed Mach runner").option("--platform <os>","Target platform (android/ios)").option("-p, --profile <name>","Build profile to resolve when using --latest","production").option("--latest","Use the latest successful build for the platform/profile").option("--build-id <id>","Use a specific Mach build ID").option("--build-url <url>","Use a Mach build URL").option("--artifact-url <url>","Use a direct APK or iOS simulator app artifact URL").option("--local","Run Maestro on a connected local emulator/device instead of the managed runner").option("--maestro-flows <path>","Maestro flow file or directory (default: .maestro)").option("--maestro-device <device>","Managed Maestro device profile").option("--maestro-retries <n>","Retries for the Maestro run","1").option("--maestro-record","Enable screen recording where supported").option("--maestro-use-build-source","Use Maestro flows from the build source snapshot instead of uploading local flows").option("--maestro-env <name>","Forward an environment variable to the managed Maestro runner; repeat or comma-separate names",Na,[]).option("--wait","Wait for managed Maestro completion and exit non-zero on failure").option("--wait-timeout <minutes>","Maximum minutes to wait for managed Maestro completion","60").option("--wait-interval <seconds>","Polling interval while waiting for managed Maestro completion","15").option("--json-output <path>","Write test run metadata JSON to a file for CI/CD").addOption(new Fe("--local-runner","Internal: execute a managed Maestro run on this machine").hideHelp()).addOption(new Fe("--test-run-id <id>","Internal test run ID").hideHelp()).addOption(new Fe("--project-id <id>","Internal project ID").hideHelp()).addOption(new Fe("--runner-token <token>","Internal runner token").hideHelp()).action(async e=>{we(Ee.bgCyan.black(m.cliTag("Maestro Testing"))),await ho(e)});re.command("update").description("Deploy an Over-The-Air (OTA) update to your live channel").option("--branch <name>","Channel or Branch to deploy to (e.g., production)","production").action(async e=>{we(Ee.bgCyan.black(m.cliTag("OTA Update"))),await Ks(e)});re.command("submit").description("Automated Store Submission (App Store / Google Play)").option("--platform <os>","Target platform (ios/android)").option("-p, --profile <name>","Build/submission profile to submit from (e.g. production, preprod)").option("--track <track>","Google Play Track (internal, alpha, beta, production)").option("--release-status <status>","Google Play release status (completed, draft, halted, inProgress)").option("--rollout <fraction>","Google Play staged rollout fraction for inProgress releases (example: 0.1)").option("--changes-not-sent-for-review","Commit Google Play changes without automatically sending them for review").option("--ssh-host <host>","Remote macOS host for iOS submission").option("--ssh-user <user>","SSH username for remote iOS submission").option("--ssh-key <path>","Path to private SSH key for remote iOS submission").option("--credential-id <id>","Service credential ID to use when multiple submission credentials exist").option("--local","Run submission on this machine (internal runner mode for iOS)").addOption(new Fe("--submit-id <id>","Internal submission ID").hideHelp()).addOption(new Fe("--project-id <id>","Internal project ID").hideHelp()).addOption(new Fe("--package-name <name>","Internal Android package name").hideHelp()).addOption(new Fe("--bundle-id <id>","Internal iOS bundle identifier").hideHelp()).option("--json-output <path>","Write submission metadata JSON to a file for CI/CD").option("--latest","Use the latest successful build for submission").option("--build-id <id>","Use a specific build ID for submission").action(async e=>{let t=re.opts();e.quiet=e.quiet||t.quiet,e.yes=e.yes||t.yes,we(Ee.bgCyan.black(m.cliTag("Store Submission"))),await wn(e)});re.command("login").description(`Login to ${m.name} Dashboard`).action(async()=>{we(Ee.bgCyan.black(m.cliTag("Login"))),await xs()});re.command("logout").description(`Logout from ${m.name} on this machine`).action(async()=>{we(Ee.bgCyan.black(m.cliTag("Logout"))),await Ms()});re.command("link").description(`Link local directory to a ${m.name} Project`).action(async()=>{we(Ee.bgCyan.black(m.cliTag("Link Project"))),await Fs()});re.command("me").description("Display currently logged in user details").action(async()=>{await zs()});re.command("init").description(`Create a new ${m.name} Project`).action(async()=>{we(Ee.bgCyan.black(m.cliTag("Init Project"))),await Bs()});re.command("env").description("Manage Environment Variables").argument("<action>","Action to perform: set, list, pull, download, or export").argument("[args...]","Key=Value pairs for set action").option("-e, --environment <name>","Environment to pull/download","development").option("-o, --out <file>","Output file for pull/download",".env.local").option("--overwrite","Overwrite output file if it already exists").action(async(e,t,n)=>{we(Ee.bgCyan.black(m.cliTag("Env Manager"))),await js(e,t,n)});re.command("start").description("Start the development server (Metro)").option("-p, --build-profile <name>","Build profile (e.g. development, staging)","development").option("--tunnel","Use ngrok tunnel").option("--lan","Use LAN IP").option("--localhost","Use localhost").option("-c, --clear","Clear Metro cache").option("--port <number>","Port to listen on").option("--ios","Start on iOS").option("--android","Start on Android").option("--web","Start on Web").action(async e=>{we(Ee.bgCyan.black(m.cliTag("Dev Server"))),await Ys(e)});re.command("config").description("Show resolved configuration for a profile").option("-p, --profile <name>","Build profile to resolve","development").option("--json","Output as JSON").action(async e=>{await Js(e)});re.command("credentials").description("Unified, interactive credential management (iOS/Android)").option("-p, --profile <name>","Build profile (production, staging, development)").option("--force","Force recreate certificates (nuke existing on Apple Portal)",!1).action(async e=>{let{credentialsMainCommand:t}=await import("./credentials-CT2WW52S.js");await t(e)});re.command("credentials:setup").description("Automated credential provisioning (iOS/Android) [Legacy]").requiredOption("--platform <os>","Platform: ios or android").option("--profile <name>","Build profile (production, staging, development)").option("--bundle-id <id>","Bundle ID / Package Name (optional, auto-detected)").option("--team-id <id>","Apple Team ID (iOS only)").option("--key-alias <alias>","Android keystore alias (optional, auto-generated)").option("--aws-profile <name>","AWS Credentials Profile (for S3 storage)").option("--force","Force recreate certificates (nuke existing on Apple Portal)",!1).action(async e=>{we(Ee.bgCyan.black(m.cliTag("Credentials Setup"))),await Ht(e),Ca(Ee.green("Done!"))});re.command("credentials:service").description("Upload Service Credentials (ASC API Key / Google Service JSON) [Legacy]").requiredOption("--platform <os>","Platform: ios or android").option("--file <path>","Path to credential file (.p8 or .json)").option("--issuer-id <id>","ASC API Key Issuer ID (iOS only)").option("--key-id <id>","ASC API Key ID (iOS only)").option("--bundle-id <id>","Bundle identifier / Android package name to attach this service credential to").option("--package-name <name>","Android package name to attach this service credential to").option("-p, --profile <name>","Build profile to resolve package/bundle identifier from config").action(async e=>{we(Ee.bgCyan.black(m.cliTag("Service Credentials"))),await Er(e),Ca(Ee.green("Done!"))});var sr=re.command("device").description("Manage registered iOS test devices");sr.command("register").description("Register a connected iOS device or enter UDID manually").option("--udid <udid>","Device UDID (skip auto-detection)").option("--name <name>","Device name").option("--team-id <id>","Apple Developer Team ID for this device").action(async e=>{await Hn("register",e)});sr.command("list").description("List all registered devices").option("--team-id <id>","Filter by Apple Developer Team ID").action(async e=>{await Hn("list",e)});sr.command("remove").description("Remove a registered device").option("--udid <udid>","Device UDID to remove").option("--team-id <id>","Apple Developer Team ID for this device").action(async e=>{await Hn("remove",e)});re.command("audit").description("Run automated security audit on the project or APK").option("--apk <path>","Path to APK file (runs APK diagnostics like 16KB alignment)").option("--json","Output results as JSON (for CI/CD)").option("--fix","Auto-apply fixes where possible").option("--category <name>","Run only a specific check category (e.g. 16kb, permissions, secrets)").option("--severity <level>","Minimum severity to display (critical, high, medium, low, info)").option("--prebuild","Run expo prebuild for deeper manifest/plist analysis").action(async e=>{we(Ee.bgCyan.black(m.cliTag(e.apk?"APK Audit":"Security Audit"))),await Oa(e)});var Of=new Set(["login","logout","agent"]);re.hook("preAction",(e,t)=>{let n=t.name(),i=t.opts?.()||{};n==="maestro"&&(i.local||i.localRunner)||Of.has(n)||mr()});re.on("command:*",()=>{console.error(`Invalid command: %s
+`));for(let a of s)Se.error(fe.red(`${fe.bold(a.name)} ${fe.dim(`(${a.arch})`)}`)),Se.info(fe.dim(`  PT_LOAD alignment: 2**${Math.log2(a.align)} (${a.align} bytes, needs 2**14 = ${_a})`))}return l.length>0&&(console.log(""),Se.success(fe.green(`${l.length} librar${l.length===1?"y":"ies"} correctly aligned (2**14 or higher).`))),console.log(""),s.length===0?(Se.success(fe.green.bold("ELF Verification Successful. APK is 16KB compatible.")),!0):(Se.error(fe.red.bold(`Found ${s.length} unaligned lib${s.length===1?"":"s"} (arm64-v8a/x86_64 libs need to be aligned).`)),console.log(""),Se.info(fe.yellow("To fix this:")),Se.info(fe.dim("  1. Rebuild with NDK r28+ which defaults to 16KB page alignment")),Se.info(fe.dim("  2. Or set -DANDROID_SUPPORT_FLEXIBLE_PAGE_SIZES=ON in CMake")),Se.info(fe.dim("  3. Update third-party libraries that ship prebuilt .so files")),Se.info(fe.dim("  4. After rebuilding: zipalign -p -f -v 16 input.apk output.apk")),console.log(""),Se.info(fe.dim("Reference: https://developer.android.com/guide/practices/page-sizes")),!1)}catch(r){return n.stop("Analysis failed."),Se.error(fe.red(`Failed to analyze APK: ${r.message}`)),!1}finally{try{at.rmSync(i,{recursive:!0,force:!0})}catch{}}}function hf(e){let t=at.openSync(e,"r");try{let n=Buffer.alloc(64);if(at.readSync(t,n,0,64,0),!n.subarray(0,4).equals(gf))return null;let i=n[4]===2,r=n[5]===1,o=(f,p)=>r?f.readUInt16LE(p):f.readUInt16BE(p),s=(f,p)=>r?f.readUInt32LE(p):f.readUInt32BE(p),l=(f,p)=>Number(r?f.readBigUInt64LE(p):f.readBigUInt64BE(p)),a,d,u;i?(a=l(n,32),d=o(n,54),u=o(n,56)):(a=s(n,28),d=o(n,42),u=o(n,44));let c=null;for(let f=0;f<u;f++){let p=Buffer.alloc(d);if(at.readSync(t,p,0,d,a+f*d),s(p,0)!==mf)continue;let y;i?y=l(p,48):y=s(p,28),y>0&&(c===null||y<c)&&(c=y)}return c??0}catch{return null}finally{at.closeSync(t)}}function $a(e){let t=[];if(!at.existsSync(e))return t;let n=at.readdirSync(e,{withFileTypes:!0});for(let i of n){let r=Ft.join(e,i.name);i.isDirectory()?t.push(...$a(r)):i.name.endsWith(".so")&&t.push(r)}return t}function Sf(e){return e.includes("arm64-v8a")?"arm64-v8a":e.includes("x86_64")?"x86_64":"unknown"}var Oa=async e=>{if(Pe()||(Ue.error(Ye.red(`You are not logged in. Run \`${m.nameLower} login\` first.`)),process.exit(1)),e.apk){await Ef(e);return}let n=process.cwd(),i=qn.join(n,"package.json");pn.existsSync(i)||(Ue.error(Ye.red("No package.json found. Run this command from a project root.")),process.exit(1));let r=JSON.parse(pn.readFileSync(i,"utf-8")),o=!!(r.dependencies?.expo||r.devDependencies?.expo);e.json||(Ue.info(Ye.dim(`Project: ${r.name||"unknown"} v${r.version||"0.0.0"}`)),Ue.info(Ye.dim(`Type: ${o?"Expo":"Bare React Native"}`)),Ue.info(""));let s={json:e.json,fix:e.fix,category:e.category,severity:e.severity,prebuild:e.prebuild},l=await Aa(n,s);e.json?console.log(JSON.stringify(wa(l,r),null,2)):Ia(l,e.severity);let a=l.some(u=>u.findings.some(c=>c.severity==="critical")),d=l.some(u=>u.findings.some(c=>c.severity==="high"));(a||d)&&process.exit(1)},va=["16kb"];async function Ef(e){let t=e.category?.toLowerCase();t&&!va.includes(t)&&(Ue.error(Ye.red(`Unknown APK check category: "${t}"`)),Ue.info(Ye.dim(`Available APK checks: ${va.join(", ")}`)),process.exit(1));let n=await Af(e.apk);n||process.exit(1);let i=!t,r=!1;(i||t==="16kb")&&(await Ra(n)||(r=!0)),r&&process.exit(1)}async function Af(e){if(e.startsWith("build:")){let n=e.slice(6);return await If(n)}if(e.startsWith("http://")||e.startsWith("https://"))return await Da(e);let t=qn.resolve(e);return pn.existsSync(t)?t:(Ue.error(Ye.red(`APK file not found: ${t}`)),null)}async function If(e){let t=Pa();t.start(`Fetching APK from build ${e}...`);try{let n=await k.get(`/build/${e}`);if(n.data.status!=="success")throw new Error(n.data.message);let i=n.data.build;if(!i)throw new Error("Build not found");let r=i.artifacts?.find(o=>o.type?o.type==="apk":o.name?.endsWith(".apk")||o.url?.includes(".apk"));return!r||!r.url?(t.stop("No APK artifact found"),Ue.error(Ye.red("This build does not have an APK artifact.")),Ue.info(Ye.dim("Make sure the build produced an APK (not just an AAB).")),null):(t.stop(`Found build: ${i.buildId||e}`),await Da(r.url))}catch(n){return t.stop("Failed to fetch build"),Ue.error(Ye.red(n.message)),null}}async function Da(e){let t=Pa();t.start("Downloading APK...");try{let n=pn.mkdtempSync(qn.join(yf.tmpdir(),`${m.nameLower}-audit-`)),i=qn.join(n,"app.apk"),r=await bf.get(e,{responseType:"arraybuffer"});pn.writeFileSync(i,r.data);let o=(r.data.length/(1024*1024)).toFixed(1);return t.stop(`Downloaded APK (${o} MB)`),i}catch(n){return t.stop("Download failed"),Ue.error(Ye.red(`Failed to download APK: ${n.message}`)),null}}var Rf=console.log;console.log=()=>{};_f();console.log=Rf;we(Ee.bgCyan.black(m.cliTag("Production Build Orchestrator")));var vf=$f(import.meta.url),Pf=vf("../package.json"),Na=(e,t=[])=>t.concat(e),re=new wf;re.name(m.nameLower).description(`${m.name} CLI: Powerful Cloud Infrastructure Tools`).version(Pf.version).option("-y, --yes","Automatically answer yes to all prompts",!1).option("--quiet","Suppress non-essential output",!1);re.command("agent").description("Manage local device discovery agent for the Install Hub (port 7070)").argument("[action]","start, run, install, status, restart, stop, or uninstall","start").action(async e=>{await Ns(e)});re.command("host").description("Setup AWS S3 static hosting and CloudFront").action(async()=>{we(Ee.bgCyan.black(m.cliTag("Hosting"))),await Ir()});re.command("sitemap").description("Generate sitemap.xml from Expo Router app structure").option("-o, --output <path>","Output path for sitemap.xml","./public/sitemap.xml").action(async e=>{we(Ee.bgCyan.black(m.cliTag("Sitemap Generator"))),await $r(e)});re.command("build").description("Run a build on a cloud provider (AWS Spot Instances)").argument("[platform]","Target platform (android, ios)").option("--platform <os>","Target platform alias (android, ios) [Optional]").option("--repo <url>","Git Repository URL").option("--branch <name>","Git Branch").option("--ami <id>","AMI ID").option("--bucket <name>","S3 Bucket for artifacts").option("--region <region>","AWS Region").option("--aws-profile <name>","AWS Credentials Profile").option("-p, --build-profile <name>","Build Profile (e.g. production, staging)").option("--profile <name>","Build Profile (alias for --build-profile)").option("--dry-run","Generate User Data script without launching").option("--keep-instance","Do not terminate the instance after build").option("--subnet <id>","VPC Subnet ID to launch the instance in").option("--security-group <id>","VPC Security Group ID to use").option("--ssh-host <host>","Remote host for iOS build (SSH)").option("--ssh-user <user>","SSH username for remote host").option("--ssh-key <path>","Path to private SSH key for remote host").option("--ios-scheme <scheme>","iOS Scheme to build").option("--ios-team-id <id>","Apple Development Team ID").option("--ios-configuration <config>","Xcode configuration (Release/Debug)").option("--ios-export-method <method>","Export method (ad-hoc, app-store, development, enterprise)").option("--ios-api-key-id <id>","App Store Connect API Key ID").option("--ios-api-key-issuer <id>","App Store Connect API Key Issuer ID").option("--ios-api-key-path <path>","Path to App Store Connect API Key (.p8) file").option("--simulator","Build for iOS Simulator (no signing required)").addOption(new Fe("--build-id <id>","Internal build ID").hideHelp()).addOption(new Fe("--project-id <id>","Internal project ID").hideHelp()).addOption(new Fe("--fail-only","Internal: mark an existing build failed").hideHelp()).addOption(new Fe("--error <message>","Internal failure message").hideHelp()).option("--local","Run build on local machine").option("--auto-version","Automatically fetch and increment Android versionCode or iOS buildNumber from the store").option("--auto-submit","Submit this build after it completes successfully").option("--submit-track <track>","Google Play track to use with --auto-submit").option("--submit-release-status <status>","Google Play release status to use with --auto-submit").option("--submit-rollout <fraction>","Google Play staged rollout fraction to use with --auto-submit").option("--submit-changes-not-sent-for-review","Commit Google Play changes without automatically sending them for review when using --auto-submit").option("--submit-credential-id <id>","Service credential ID to use with --auto-submit").option("--submit-json-output <path>","Write auto-submit metadata JSON to a file for CI/CD").option("--verbose","Enable verbose logging").option("--json-output <path>","Write build metadata JSON to a file for CI/CD").option("--maestro","Queue a managed Maestro test run after a successful build").option("--maestro-flows <path>","Maestro flow file or directory (default: .maestro)").option("--maestro-device <device>","Managed Maestro device profile").option("--maestro-retries <n>","Retries for the Maestro run","1").option("--maestro-record","Enable screen recording where supported").option("--maestro-use-build-source","Use Maestro flows from the build source snapshot instead of uploading local flows").option("--maestro-env <name>","Forward an environment variable to the managed Maestro runner; repeat or comma-separate names",Na,[]).option("-y, --yes","Automatically answer yes to all prompts",!1).option("--quiet","Suppress non-essential output",!1).action(async(e,t)=>{let n=re.opts();t.yes=t.yes||n.yes,t.quiet=t.quiet||n.quiet,t.platform=e||t.platform,t.buildProfile=t.profile||t.buildProfile,t.quiet||we(Ee.bgCyan.black(m.cliTag("Cloud Build"))),await On(t)});re.command("maestro").description("Run Maestro tests locally or with the managed Mach runner").option("--platform <os>","Target platform (android/ios)").option("-p, --profile <name>","Build profile to resolve when using --latest","production").option("--latest","Use the latest successful build for the platform/profile").option("--build-id <id>","Use a specific Mach build ID").option("--build-url <url>","Use a Mach build URL").option("--artifact-url <url>","Use a direct APK or iOS simulator app artifact URL").option("--local","Run Maestro on a connected local emulator/device instead of the managed runner").option("--maestro-flows <path>","Maestro flow file or directory (default: .maestro)").option("--maestro-device <device>","Managed Maestro device profile").option("--maestro-retries <n>","Retries for the Maestro run","1").option("--maestro-record","Enable screen recording where supported").option("--maestro-use-build-source","Use Maestro flows from the build source snapshot instead of uploading local flows").option("--maestro-env <name>","Forward an environment variable to the managed Maestro runner; repeat or comma-separate names",Na,[]).option("--wait","Wait for managed Maestro completion and exit non-zero on failure").option("--wait-timeout <minutes>","Maximum minutes to wait for managed Maestro completion","60").option("--wait-interval <seconds>","Polling interval while waiting for managed Maestro completion","15").option("--json-output <path>","Write test run metadata JSON to a file for CI/CD").addOption(new Fe("--local-runner","Internal: execute a managed Maestro run on this machine").hideHelp()).addOption(new Fe("--test-run-id <id>","Internal test run ID").hideHelp()).addOption(new Fe("--project-id <id>","Internal project ID").hideHelp()).addOption(new Fe("--runner-token <token>","Internal runner token").hideHelp()).action(async e=>{we(Ee.bgCyan.black(m.cliTag("Maestro Testing"))),await ho(e)});re.command("update").description("Deploy an Over-The-Air (OTA) update to your live channel").option("--branch <name>","Channel or Branch to deploy to (e.g., production)","production").action(async e=>{we(Ee.bgCyan.black(m.cliTag("OTA Update"))),await Ks(e)});re.command("submit").description("Automated Store Submission (App Store / Google Play)").option("--platform <os>","Target platform (ios/android)").option("-p, --profile <name>","Build/submission profile to submit from (e.g. production, preprod)").option("--track <track>","Google Play Track (internal, alpha, beta, production)").option("--release-status <status>","Google Play release status (completed, draft, halted, inProgress)").option("--rollout <fraction>","Google Play staged rollout fraction for inProgress releases (example: 0.1)").option("--changes-not-sent-for-review","Commit Google Play changes without automatically sending them for review").option("--ssh-host <host>","Remote macOS host for iOS submission").option("--ssh-user <user>","SSH username for remote iOS submission").option("--ssh-key <path>","Path to private SSH key for remote iOS submission").option("--credential-id <id>","Service credential ID to use when multiple submission credentials exist").option("--local","Run submission on this machine (internal runner mode for iOS)").addOption(new Fe("--submit-id <id>","Internal submission ID").hideHelp()).addOption(new Fe("--project-id <id>","Internal project ID").hideHelp()).addOption(new Fe("--package-name <name>","Internal Android package name").hideHelp()).addOption(new Fe("--bundle-id <id>","Internal iOS bundle identifier").hideHelp()).option("--json-output <path>","Write submission metadata JSON to a file for CI/CD").option("--latest","Use the latest successful build for submission").option("--build-id <id>","Use a specific build ID for submission").action(async e=>{let t=re.opts();e.quiet=e.quiet||t.quiet,e.yes=e.yes||t.yes,we(Ee.bgCyan.black(m.cliTag("Store Submission"))),await wn(e)});re.command("login").description(`Login to ${m.name} Dashboard`).action(async()=>{we(Ee.bgCyan.black(m.cliTag("Login"))),await xs()});re.command("logout").description(`Logout from ${m.name} on this machine`).action(async()=>{we(Ee.bgCyan.black(m.cliTag("Logout"))),await Ms()});re.command("link").description(`Link local directory to a ${m.name} Project`).action(async()=>{we(Ee.bgCyan.black(m.cliTag("Link Project"))),await Fs()});re.command("me").description("Display currently logged in user details").action(async()=>{await zs()});re.command("init").description(`Create a new ${m.name} Project`).action(async()=>{we(Ee.bgCyan.black(m.cliTag("Init Project"))),await Bs()});re.command("env").description("Manage Environment Variables").argument("<action>","Action to perform: set, list, pull, download, or export").argument("[args...]","Key=Value pairs for set action").option("-e, --environment <name>","Environment to pull/download","development").option("-o, --out <file>","Output file for pull/download",".env.local").option("--overwrite","Overwrite output file if it already exists").action(async(e,t,n)=>{we(Ee.bgCyan.black(m.cliTag("Env Manager"))),await js(e,t,n)});re.command("start").description("Start the development server (Metro)").option("-p, --build-profile <name>","Build profile (e.g. development, staging)","development").option("--tunnel","Use ngrok tunnel").option("--lan","Use LAN IP").option("--localhost","Use localhost").option("-c, --clear","Clear Metro cache").option("--port <number>","Port to listen on").option("--ios","Start on iOS").option("--android","Start on Android").option("--web","Start on Web").action(async e=>{we(Ee.bgCyan.black(m.cliTag("Dev Server"))),await Ys(e)});re.command("config").description("Show resolved configuration for a profile").option("-p, --profile <name>","Build profile to resolve","development").option("--json","Output as JSON").action(async e=>{await Js(e)});re.command("credentials").description("Unified, interactive credential management (iOS/Android)").option("-p, --profile <name>","Build profile (production, staging, development)").option("--force","Force recreate certificates (nuke existing on Apple Portal)",!1).action(async e=>{let{credentialsMainCommand:t}=await import("./credentials-SQ2RHV3K.js");await t(e)});re.command("credentials:setup").description("Automated credential provisioning (iOS/Android) [Legacy]").requiredOption("--platform <os>","Platform: ios or android").option("--profile <name>","Build profile (production, staging, development)").option("--bundle-id <id>","Bundle ID / Package Name (optional, auto-detected)").option("--team-id <id>","Apple Team ID (iOS only)").option("--key-alias <alias>","Android keystore alias (optional, auto-generated)").option("--aws-profile <name>","AWS Credentials Profile (for S3 storage)").option("--force","Force recreate certificates (nuke existing on Apple Portal)",!1).action(async e=>{we(Ee.bgCyan.black(m.cliTag("Credentials Setup"))),await Ht(e),Ca(Ee.green("Done!"))});re.command("credentials:service").description("Upload Service Credentials (ASC API Key / Google Service JSON) [Legacy]").requiredOption("--platform <os>","Platform: ios or android").option("--file <path>","Path to credential file (.p8 or .json)").option("--issuer-id <id>","ASC API Key Issuer ID (iOS only)").option("--key-id <id>","ASC API Key ID (iOS only)").option("--bundle-id <id>","Bundle identifier / Android package name to attach this service credential to").option("--package-name <name>","Android package name to attach this service credential to").option("-p, --profile <name>","Build profile to resolve package/bundle identifier from config").action(async e=>{we(Ee.bgCyan.black(m.cliTag("Service Credentials"))),await Er(e),Ca(Ee.green("Done!"))});var sr=re.command("device").description("Manage registered iOS test devices");sr.command("register").description("Register a connected iOS device or enter UDID manually").option("--udid <udid>","Device UDID (skip auto-detection)").option("--name <name>","Device name").option("--team-id <id>","Apple Developer Team ID for this device").action(async e=>{await Hn("register",e)});sr.command("list").description("List all registered devices").option("--team-id <id>","Filter by Apple Developer Team ID").action(async e=>{await Hn("list",e)});sr.command("remove").description("Remove a registered device").option("--udid <udid>","Device UDID to remove").option("--team-id <id>","Apple Developer Team ID for this device").action(async e=>{await Hn("remove",e)});re.command("audit").description("Run automated security audit on the project or APK").option("--apk <path>","Path to APK file (runs APK diagnostics like 16KB alignment)").option("--json","Output results as JSON (for CI/CD)").option("--fix","Auto-apply fixes where possible").option("--category <name>","Run only a specific check category (e.g. 16kb, permissions, secrets)").option("--severity <level>","Minimum severity to display (critical, high, medium, low, info)").option("--prebuild","Run expo prebuild for deeper manifest/plist analysis").action(async e=>{we(Ee.bgCyan.black(m.cliTag(e.apk?"APK Audit":"Security Audit"))),await Oa(e)});var Of=new Set(["login","logout","agent"]);re.hook("preAction",(e,t)=>{let n=t.name(),i=t.opts?.()||{};n==="maestro"&&(i.local||i.localRunner)||Of.has(n)||mr()});re.on("command:*",()=>{console.error(`Invalid command: %s
 See --help for a list of available commands.`,re.args.join(" ")),process.exit(1)});process.argv.slice(2).length||re.help();re.parse(process.argv);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@radhya/mach",
-  "version": "2.0.14",
+  "version": "2.0.23",
   "description": "Mach CLI: Cloud Build Orchestrator for React Native & Expo",
   "main": "dist/index.js",
   "type": "module",
@@ -34,6 +34,7 @@
   "license": "ISC",
   "dependencies": {
     "@clack/prompts": "^0.11.0",
+    "@expo/apple-utils": "^2.1.22",
     "@types/adm-zip": "^0.5.7",
     "adm-zip": "^0.5.16",
     "axios": "^1.13.2",

package/dist/chunk-XW3V7PJM.js

@@ -1,61 +0,0 @@
-import{a as f,h as R}from"./chunk-S64YFTRR.js";import{log as r,spinner as de,text as z,password as fe,select as q,confirm as dt,isCancel as k,cancel as U,intro as ct,outro as lt,note as Oe}from"@clack/prompts";import{log as V,spinner as oe,text as M,select as te,isCancel as P,cancel as L,note as ue,confirm as Ne}from"@clack/prompts";import N from"chalk";import{spawnSync as re}from"child_process";import G from"fs";import $ from"path";import he from"os";import ce from"fs";var je=["react-native","expo","flutter"],Tt="react-native",ke=e=>{if(typeof e!="string")return;let t=e.trim();return t.length>0?t:void 0},Ve=e=>ke(e)?.toUpperCase()||void 0,le=(...e)=>{for(let t of e){let n=ke(t);if(n)return n}};function qe(e){if(typeof e!="string")return;let t=e.trim().toLowerCase();if(t==="react-native"||t==="react_native"||t==="reactnative")return"react-native";if(t==="expo")return"expo";if(t==="flutter")return"flutter"}function Pt(e){let t=qe(e?.framework);if(t)return t;let n=je.map(a=>`"${a}"`).join(", ");throw e?.framework?new Error(`${f.configFileName} has invalid framework "${e.framework}". Use one of: ${n}.`):new Error(`${f.configFileName} is missing required field "framework". Add one of: ${n}.`)}function se(e,t="production"){let n=e?.ios||{},a=e?.submit?.[t]?.ios||{},i=e?.submit?.production?.ios||{},s=Ve(n.appleTeamId||n.developerTeamId||a.appleTeamId||a.developerTeamId||i.appleTeamId||i.developerTeamId),o=le(n.appStoreConnectTeamId,n.itcTeamId,n.appleConnectTeamId,a.appStoreConnectTeamId,a.itcTeamId,a.appleConnectTeamId,i.appStoreConnectTeamId,i.itcTeamId,i.appleConnectTeamId);return{teamId:s,teamName:le(n.appleTeamName,n.teamName,n.developerTeamName,a.appleTeamName,a.teamName,a.developerTeamName,i.appleTeamName,i.teamName,i.developerTeamName),developerTeamId:Ve(n.developerTeamId||a.developerTeamId||i.developerTeamId||s),appStoreConnectTeamId:o,providerId:le(n.providerId,a.providerId,i.providerId,o),providerName:le(n.providerName,n.appStoreConnectTeamName,a.providerName,a.appStoreConnectTeamName,i.providerName,i.appStoreConnectTeamName)}}function xt(e){if(e){if(!ce.existsSync(e))return null;try{return JSON.parse(ce.readFileSync(e,"utf-8"))}catch{return null}}if(!ce.existsSync(`./${f.configFileName}`))return null;try{return JSON.parse(ce.readFileSync(`./${f.configFileName}`,"utf-8"))}catch{return null}}function ee(e,t,n=new Set){if(n.has(t))throw new Error(`Circular inheritance detected in profile: ${t}`);n.add(t);let a=e.build?.[t];if(!a)return null;let i={...a};if(a.extends){let s=ee(e,a.extends,n);s&&(i={...s,...a,env:{...s.env,...a.env},ios:{...s.ios,...a.ios},android:{...s.android,...a.android}})}if(i.envGroups&&Array.isArray(i.envGroups)){let s={};for(let o of i.envGroups){let c=e.envGroups?.[o];c?Object.assign(s,c):log.warn(`Environment group not found: ${o}`)}i.env={...s,...i.env}}return i}function pe(e,t){let n=t?ee(e,t)||{}:{};if(n.android?.package)return n.android.package;if(n.androidPackage)return n.androidPackage;if(e.android?.package)return e.android.package;if(e.expo?.android?.package)return e.expo.android.package}function ge(e,t){let n=t?ee(e,t)||{}:{};if(n.ios?.bundleIdentifier)return n.ios.bundleIdentifier;if(n.iosBundleIdentifier)return n.iosBundleIdentifier;if(e.ios?.bundleIdentifier)return e.ios.bundleIdentifier;if(e.ios?.bundleId)return e.ios.bundleId;if(e.expo?.ios?.bundleIdentifier)return e.expo.ios.bundleIdentifier}var Yt=(e,t=`${f.envPrefix}`)=>{let n={},a=(i,s)=>{if(i)for(let o in i){let c=i[o],l=`${s}${o.toUpperCase().replace(/[^A-Z0-9]/g,"_")}`;c!==null&&typeof c=="object"&&!Array.isArray(c)?a(c,`${l}_`):n[l]=String(c)}};return a(e,t),n};var et="cmVxdWlyZSAnc3BhY2VzaGlwJwpyZXF1aXJlICdqc29uJwoKZGVmIHJlYWRfdGVhbV9maWVsZCh0ZWFtLCAqa2V5cykKICBrZXlzLmVhY2ggZG8gfGtleXwKICAgIGJlZ2luCiAgICAgIHZhbHVlID0gdGVhbVtrZXldIGlmIHRlYW0ucmVzcG9uZF90bz8oOltdKQogICAgICByZXR1cm4gdmFsdWUgaWYgdmFsdWUgJiYgdmFsdWUudG9fcy5sZW5ndGggPiAwCiAgICByZXNjdWUKICAgIGVuZAoKICAgIG1ldGhvZF9uYW1lID0ga2V5LnRvX3MKICAgIGlmIHRlYW0ucmVzcG9uZF90bz8obWV0aG9kX25hbWUpCiAgICAgIHZhbHVlID0gdGVhbS5wdWJsaWNfc2VuZChtZXRob2RfbmFtZSkKICAgICAgcmV0dXJuIHZhbHVlIGlmIHZhbHVlICYmIHZhbHVlLnRvX3MubGVuZ3RoID4gMAogICAgZW5kCiAgZW5kCgogIG5pbAplbmQKCmRlZiBub3JtYWxpemVfdGVhbV9uYW1lKG5hbWUpCiAgbmFtZS50b19zLmRvd25jYXNlLmdzdWIoL1teYS16MC05XSsvLCAnICcpLnN0cmlwCmVuZAoKZGVmIHBvcnRhbF90ZWFtX25hbWUKICB0ZWFtX2lkID0gRU5WWydGQVNUTEFORV9URUFNX0lEJ10udG9fcwogIHRlYW1zID0gU3BhY2VzaGlwOjpQb3J0YWwuY2xpZW50LnRlYW1zCiAgdGVhbXMgPSB0ZWFtcy52YWx1ZXMgaWYgdGVhbXMuaXNfYT8oSGFzaCkKCiAgdGVhbSA9IEFycmF5KHRlYW1zKS5maW5kIGRvIHx0fAogICAgWwogICAgICByZWFkX3RlYW1fZmllbGQodCwgJ3RlYW1JZCcsIDp0ZWFtSWQpLAogICAgICByZWFkX3RlYW1fZmllbGQodCwgJ3RlYW1faWQnLCA6dGVhbV9pZCksCiAgICAgIHJlYWRfdGVhbV9maWVsZCh0LCAnaWQnLCA6aWQpCiAgICBdLmNvbXBhY3QubWFwKCY6dG9fcykuaW5jbHVkZT8odGVhbV9pZCkKICBlbmQKCiAgcmVhZF90ZWFtX2ZpZWxkKHRlYW0sICduYW1lJywgOm5hbWUsICd0ZWFtTmFtZScsIDp0ZWFtTmFtZSwgJ2Rpc3BsYXlOYW1lJywgOmRpc3BsYXlOYW1lKQpyZXNjdWUgPT4gZQogICRzdGRlcnIucHV0cyAiREVCVUc6IENvdWxkIG5vdCByZXNvbHZlIERldmVsb3BlciBQb3J0YWwgdGVhbSBuYW1lOiAje2UubWVzc2FnZX0iCiAgbmlsCmVuZAoKZGVmIHR1bmVzX3RlYW1faWQodGVhbSkKICByZWFkX3RlYW1fZmllbGQoCiAgICB0ZWFtLAogICAgJ3Byb3ZpZGVySWQnLCA6cHJvdmlkZXJJZCwKICAgICdwcm92aWRlcl9pZCcsIDpwcm92aWRlcl9pZCwKICAgICdjb250ZW50UHJvdmlkZXJJZCcsIDpjb250ZW50UHJvdmlkZXJJZCwKICAgICdjb250ZW50X3Byb3ZpZGVyX2lkJywgOmNvbnRlbnRfcHJvdmlkZXJfaWQsCiAgICAndGVhbUlkJywgOnRlYW1JZCwKICAgICd0ZWFtX2lkJywgOnRlYW1faWQsCiAgICAnaWQnLCA6aWQKICApLnRvX3MKZW5kCgpkZWYgdHVuZXNfdGVhbV9uYW1lKHRlYW0pCiAgcmVhZF90ZWFtX2ZpZWxkKAogICAgdGVhbSwKICAgICduYW1lJywgOm5hbWUsCiAgICAnY29udGVudFByb3ZpZGVyTmFtZScsIDpjb250ZW50UHJvdmlkZXJOYW1lLAogICAgJ2NvbnRlbnRfcHJvdmlkZXJfbmFtZScsIDpjb250ZW50X3Byb3ZpZGVyX25hbWUsCiAgICAndGVhbU5hbWUnLCA6dGVhbU5hbWUsCiAgICAnZGlzcGxheU5hbWUnLCA6ZGlzcGxheU5hbWUKICApLnRvX3MKZW5kCgpkZWYgYXZhaWxhYmxlX3R1bmVzX3RlYW1zCiAgdGVhbXMgPSBTcGFjZXNoaXA6OlR1bmVzLmNsaWVudC50ZWFtcwogIHRlYW1zID0gdGVhbXMudmFsdWVzIGlmIHRlYW1zLmlzX2E/KEhhc2gpCiAgQXJyYXkodGVhbXMpCnJlc2N1ZSA9PiBlCiAgJHN0ZGVyci5wdXRzICJERUJVRzogQ291bGQgbm90IGluc3BlY3QgQXBwIFN0b3JlIENvbm5lY3QgdGVhbXM6ICN7ZS5tZXNzYWdlfSIKICBbXQplbmQKCmRlZiBzZWxlY3RfYXBwX3N0b3JlX2Nvbm5lY3RfdGVhbQogIGV4cGxpY2l0X3RlYW1faWQgPSBFTlZbJ0ZBU1RMQU5FX0lUQ19URUFNX0lEJ10gfHwgRU5WWydGQVNUTEFORV9BU0NfVEVBTV9JRCddCiAgaWYgZXhwbGljaXRfdGVhbV9pZCAmJiBleHBsaWNpdF90ZWFtX2lkLnRvX3MubGVuZ3RoID4gMAogICAgU3BhY2VzaGlwOjpUdW5lcy5zZWxlY3RfdGVhbSh0ZWFtX2lkOiBleHBsaWNpdF90ZWFtX2lkKQogICAgcmV0dXJuIGV4cGxpY2l0X3RlYW1faWQKICBlbmQKCiAgZGV2ZWxvcGVyX3RlYW1faWQgPSBFTlZbJ0ZBU1RMQU5FX1RFQU1fSUQnXS50b19zCiAgZGV2ZWxvcGVyX3RlYW1fbmFtZSA9IHBvcnRhbF90ZWFtX25hbWUKICB0ZWFtcyA9IGF2YWlsYWJsZV90dW5lc190ZWFtcwoKICBpZiBkZXZlbG9wZXJfdGVhbV9uYW1lICYmIGRldmVsb3Blcl90ZWFtX25hbWUubGVuZ3RoID4gMAogICAgbm9ybWFsaXplZF9kZXZlbG9wZXJfbmFtZSA9IG5vcm1hbGl6ZV90ZWFtX25hbWUoZGV2ZWxvcGVyX3RlYW1fbmFtZSkKICAgIG1hdGNoZWRfdGVhbSA9IHRlYW1zLmZpbmQgeyB8dGVhbXwgbm9ybWFsaXplX3RlYW1fbmFtZSh0dW5lc190ZWFtX25hbWUodGVhbSkpID09IG5vcm1hbGl6ZWRfZGV2ZWxvcGVyX25hbWUgfQoKICAgIGlmIG1hdGNoZWRfdGVhbQogICAgICBtYXRjaGVkX2lkID0gdHVuZXNfdGVhbV9pZChtYXRjaGVkX3RlYW0pCiAgICAgIG1hdGNoZWRfbmFtZSA9IHR1bmVzX3RlYW1fbmFtZShtYXRjaGVkX3RlYW0pCiAgICAgIFNwYWNlc2hpcDo6VHVuZXMuc2VsZWN0X3RlYW0odGVhbV9pZDogbWF0Y2hlZF9pZCkKICAgICAgJHN0ZGVyci5wdXRzICJERUJVRzogQXV0by1zZWxlY3RlZCBBcHAgU3RvcmUgQ29ubmVjdCB0ZWFtICN7bWF0Y2hlZF9pZH0gKCN7bWF0Y2hlZF9uYW1lfSkgZm9yIERldmVsb3BlciBUZWFtICN7ZGV2ZWxvcGVyX3RlYW1faWR9IgogICAgICByZXR1cm4gbWF0Y2hlZF9pZAogICAgZW5kCiAgZW5kCgogIGlmIHRlYW1zLmxlbmd0aCA9PSAxCiAgICBvbmx5X3RlYW0gPSB0ZWFtcy5maXJzdAogICAgb25seV90ZWFtX2lkID0gdHVuZXNfdGVhbV9pZChvbmx5X3RlYW0pCiAgICBTcGFjZXNoaXA6OlR1bmVzLnNlbGVjdF90ZWFtKHRlYW1faWQ6IG9ubHlfdGVhbV9pZCkKICAgICRzdGRlcnIucHV0cyAiREVCVUc6IEF1dG8tc2VsZWN0ZWQgb25seSBBcHAgU3RvcmUgQ29ubmVjdCB0ZWFtICN7b25seV90ZWFtX2lkfSAoI3t0dW5lc190ZWFtX25hbWUob25seV90ZWFtKX0pIgogICAgcmV0dXJuIG9ubHlfdGVhbV9pZAogIGVuZAoKICAkc3RkZXJyLnB1dHMgIkVSUk9SOiBDb3VsZCBub3QgbWFwIEFwcGxlIERldmVsb3BlciBUZWFtIElEICcje2RldmVsb3Blcl90ZWFtX2lkfScje2RldmVsb3Blcl90ZWFtX25hbWUgPyAiICgje2RldmVsb3Blcl90ZWFtX25hbWV9KSIgOiAnJ30gdG8gQXBwIFN0b3JlIENvbm5lY3QuIgogICRzdGRlcnIucHV0cyAiQXZhaWxhYmxlIEFwcCBTdG9yZSBDb25uZWN0IHRlYW1zOiIKICB0ZWFtcy5lYWNoIGRvIHx0ZWFtfAogICAgJHN0ZGVyci5wdXRzICItICN7dHVuZXNfdGVhbV9pZCh0ZWFtKX0gKCN7dHVuZXNfdGVhbV9uYW1lKHRlYW0pfSkiCiAgZW5kCiAgZXhpdCAxCmVuZAoKZGVmIGxpc3RfdGVhbXMKICBiZWdpbgogICAgU3BhY2VzaGlwOjpQb3J0YWwubG9naW4oRU5WWydGQVNUTEFORV9VU0VSJ10pCiAgICBTcGFjZXNoaXA6OlBvcnRhbC5zZWxlY3RfdGVhbSh0ZWFtX2lkOiBFTlZbJ0ZBU1RMQU5FX1RFQU1fSUQnXSkKCiAgICBkZXZlbG9wZXJfdGVhbV9uYW1lID0gcG9ydGFsX3RlYW1fbmFtZQoKICAgIFNwYWNlc2hpcDo6VHVuZXMubG9naW4oRU5WWydGQVNUTEFORV9VU0VSJ10pCiAgICBub3JtYWxpemVkX2RldmVsb3Blcl9uYW1lID0gbm9ybWFsaXplX3RlYW1fbmFtZShkZXZlbG9wZXJfdGVhbV9uYW1lKQogICAgdGVhbXMgPSBhdmFpbGFibGVfdHVuZXNfdGVhbXMubWFwIGRvIHx0ZWFtfAogICAgICB0ZWFtX25hbWUgPSB0dW5lc190ZWFtX25hbWUodGVhbSkKICAgICAgewogICAgICAgIGlkOiB0dW5lc190ZWFtX2lkKHRlYW0pLAogICAgICAgIG5hbWU6IHRlYW1fbmFtZSwKICAgICAgICByZWNvbW1lbmRlZDogbm9ybWFsaXplZF9kZXZlbG9wZXJfbmFtZS5sZW5ndGggPiAwICYmIG5vcm1hbGl6ZV90ZWFtX25hbWUodGVhbV9uYW1lKSA9PSBub3JtYWxpemVkX2RldmVsb3Blcl9uYW1lCiAgICAgIH0KICAgIGVuZAoKICAgIHB1dHMgIl9fX01BQ0hfSlNPTl9TVEFSVF9fXyIgKyB7CiAgICAgIGRldmVsb3BlclRlYW1JZDogRU5WWydGQVNUTEFORV9URUFNX0lEJ10sCiAgICAgIGRldmVsb3BlclRlYW1OYW1lOiBkZXZlbG9wZXJfdGVhbV9uYW1lLAogICAgICB0ZWFtczogdGVhbXMKICAgIH0udG9fanNvbiArICJfX19NQUNIX0pTT05fRU5EX19fIgogIHJlc2N1ZSA9PiBlCiAgICAkc3RkZXJyLnB1dHMgIkVSUk9SOiAje2UubWVzc2FnZX0iCiAgICBleGl0IDEKICBlbmQKZW5kCgpkZWYgbGlzdF9rZXlzCiAgYmVnaW4KICAgIFNwYWNlc2hpcDo6UG9ydGFsLmxvZ2luKEVOVlsnRkFTVExBTkVfVVNFUiddKQogICAgU3BhY2VzaGlwOjpQb3J0YWwuc2VsZWN0X3RlYW0odGVhbV9pZDogRU5WWydGQVNUTEFORV9URUFNX0lEJ10pCiAgICAKICAgIFNwYWNlc2hpcDo6VHVuZXMubG9naW4oRU5WWydGQVNUTEFORV9VU0VSJ10pCiAgICBzZWxlY3RfYXBwX3N0b3JlX2Nvbm5lY3RfdGVhbQogICAgCiAgICAjIFVzZSBUdW5lcyBjbGllbnQgd2hpY2ggcG9pbnRzIHRvIGFwcHN0b3JlY29ubmVjdC5hcHBsZS5jb20KICAgIGNsaWVudCA9IFNwYWNlc2hpcDo6VHVuZXMuY2xpZW50CiAgICAjIFVzZSByb290LXJlbGF0aXZlIFVSTCB0byByZXBsYWNlIHRoZSBkZWZhdWx0IFR1bmVzIHBhdGggKC9XZWJPYmplY3RzLy4uLikKICAgIHJlc3BvbnNlID0gY2xpZW50LnJlcXVlc3QoOmdldCwgJy9pcmlzL3YxL2FwaUtleXMnKQogICAgCiAgICBpZiByZXNwb25zZS5ib2R5Lm5pbD8gfHwgIXJlc3BvbnNlLmJvZHkuaXNfYT8oSGFzaCkKICAgICAgcmFpc2UgIkFQSSByZXR1cm5lZCBlbXB0eSBvciBpbnZhbGlkIHJlc3BvbnNlIGJvZHkgZm9yIGxpc3Rpbmcga2V5cyIKICAgIGVuZAogICAgCiAgICAkc3RkZXJyLnB1dHMgIkRFQlVHOiBGdWxsIExpc3QgUmVzcG9uc2U6ICN7cmVzcG9uc2UuYm9keS50b19qc29ufSIKICAgIAogICAga2V5cyA9IHJlc3BvbnNlLmJvZHlbJ2RhdGEnXSB8fCBbXQogICAgCiAgICBvdXRwdXQgPSBrZXlzLm1hcCBkbyB8a3wKICAgICAgYXR0ciA9IGtbJ2F0dHJpYnV0ZXMnXSB8fCB7fQogICAgICB7CiAgICAgICAgaWQ6IGtbJ2lkJ10sCiAgICAgICAgbmFtZTogYXR0clsnbmFtZSddLAogICAgICAgIGlzc3VlcklkOiBhdHRyWydpc3N1ZXJJZCddLAogICAgICAgIHJvbGU6IGF0dHJbJ3JvbGVzJ10mLmZpcnN0LAogICAgICAgIHJldm9jYWJsZTogYXR0clsncmV2b2NhYmxlJ10KICAgICAgfQogICAgZW5kCiAgICAKICAgIHB1dHMgIl9fX01BQ0hfSlNPTl9TVEFSVF9fXyIgKyBvdXRwdXQudG9fanNvbiArICJfX19NQUNIX0pTT05fRU5EX19fIgogIHJlc2N1ZSA9PiBlCiAgICAkc3RkZXJyLnB1dHMgIkVSUk9SOiAje2UubWVzc2FnZX0iCiAgICBpZiBkZWZpbmVkPyhyZXNwb25zZSkgJiYgcmVzcG9uc2UgJiYgcmVzcG9uc2UuYm9keQogICAgICAkc3RkZXJyLnB1dHMgIlJlc3BvbnNlIEJvZHk6ICN7cmVzcG9uc2UuYm9keS50b19qc29ufSIKICAgIGVuZAogICAgZXhpdCAxCiAgZW5kCmVuZAoKZGVmIGNyZWF0ZV9rZXkobmFtZSwgcm9sZSA9ICdBRE1JTicpCiAgYmVnaW4KICAgIFNwYWNlc2hpcDo6UG9ydGFsLmxvZ2luKEVOVlsnRkFTVExBTkVfVVNFUiddKQogICAgU3BhY2VzaGlwOjpQb3J0YWwuc2VsZWN0X3RlYW0odGVhbV9pZDogRU5WWydGQVNUTEFORV9URUFNX0lEJ10pCiAgICAKICAgIFNwYWNlc2hpcDo6VHVuZXMubG9naW4oRU5WWydGQVNUTEFORV9VU0VSJ10pCiAgICBzZWxlY3RfYXBwX3N0b3JlX2Nvbm5lY3RfdGVhbQogICAgCiAgICBjbGllbnQgPSBTcGFjZXNoaXA6OlR1bmVzLmNsaWVudAogICAgCiAgICAjIFRydW5jYXRlIG5pY2tuYW1lIHRvIDMwIGNoYXJzIGFzIHBlciBBcHBsZSdzIGxpbWl0CiAgICAjIFdlIGtlZXAgdGhlIG9yaWdpbmFsICduYW1lJyBmb3IgbG9nZ2luZyBidXQgc2VuZCB0cnVuY2F0ZWQgJ25pY2tuYW1lJyB0byBBUEkKICAgIHNhZmVfbmlja25hbWUgPSBuYW1lWzAsIDMwXQogICAgCiAgICBwYXlsb2FkID0gewogICAgICBkYXRhOiB7CiAgICAgICAgdHlwZTogImFwaUtleXMiLAogICAgICAgIGF0dHJpYnV0ZXM6IHsKICAgICAgICAgIG5pY2tuYW1lOiBzYWZlX25pY2tuYW1lLAogICAgICAgICAga2V5VHlwZTogIlBVQkxJQ19BUEkiLAogICAgICAgICAgcm9sZXM6IFtyb2xlXSwKICAgICAgICAgIGFsbEFwcHNWaXNpYmxlOiB0cnVlCiAgICAgICAgfQogICAgICB9CiAgICB9CiAgICAKICAgIHJlc3BvbnNlID0gY2xpZW50LnJlcXVlc3QoOnBvc3QpIGRvIHxyZXF8CiAgICAgIHJlcS51cmwgIi9pcmlzL3YxL2FwaUtleXMiCiAgICAgIHJlcS5ib2R5ID0gcGF5bG9hZC50b19qc29uCiAgICAgIHJlcS5oZWFkZXJzWydDb250ZW50LVR5cGUnXSA9ICdhcHBsaWNhdGlvbi9qc29uJwogICAgICByZXEuaGVhZGVyc1snQWNjZXB0J10gPSAnYXBwbGljYXRpb24vdm5kLmFwaStqc29uLCBhcHBsaWNhdGlvbi9qc29uLCB0ZXh0L2phdmFzY3JpcHQsICovKjsgcT0wLjAxJwogICAgICByZXEuaGVhZGVyc1snWC1SZXF1ZXN0ZWQtV2l0aCddID0gJ1hNTEh0dHBSZXF1ZXN0JwogICAgICByZXEuaGVhZGVyc1snUmVmZXJlciddID0gJ2h0dHBzOi8vYXBwc3RvcmVjb25uZWN0LmFwcGxlLmNvbS9hY2Nlc3MvYXBpJwogICAgICByZXEuaGVhZGVyc1snWC1BcHBsZS1XaWRnZXQtS2V5J10gPSBjbGllbnQud2lkZ2V0X2tleSBpZiBjbGllbnQucmVzcG9uZF90bz8oOndpZGdldF9rZXkpCiAgICBlbmQKICAgIAogICAgIyBERUJVRzogSW5zcGVjdCB0aGUgcmF3IHJlc3BvbnNlIG9iamVjdAogICAgJHN0ZGVyci5wdXRzICJERUJVRzogUmVzcG9uc2UgQ2xhc3M6ICN7cmVzcG9uc2UuY2xhc3N9IgogICAgJHN0ZGVyci5wdXRzICJERUJVRzogUmVzcG9uc2UgSGVhZGVyczogI3tyZXNwb25zZS5oZWFkZXJzfSIKICAgICRzdGRlcnIucHV0cyAiREVCVUc6IFJlc3BvbnNlIEJvZHk6ICN7cmVzcG9uc2UuYm9keS50b19qc29ufSIKICAgIAogICAgaWYgcmVzcG9uc2UuYm9keS5uaWw/IHx8ICFyZXNwb25zZS5ib2R5LmlzX2E/KEhhc2gpIHx8IHJlc3BvbnNlLmJvZHlbJ2RhdGEnXS5uaWw/CiAgICAgIGVycm9yX21zZyA9ICJBUEkgZmFpbGVkIHRvIGNyZWF0ZSBrZXkuIgogICAgICBpZiByZXNwb25zZS5ib2R5ICYmIHJlc3BvbnNlLmJvZHlbJ2Vycm9ycyddCiAgICAgICAgZXJyb3JfbXNnICs9ICIgRXJyb3JzOiAiICsgcmVzcG9uc2UuYm9keVsnZXJyb3JzJ10ubWFwe3xlfCBlWydkZXRhaWwnXX0uam9pbignLCAnKQogICAgICBlbmQKICAgICAgcmFpc2UgZXJyb3JfbXNnCiAgICBlbmQKICAgIAogICAga2V5X2RhdGEgPSByZXNwb25zZS5ib2R5WydkYXRhJ10KICAgIGF0dHIgPSBrZXlfZGF0YVsnYXR0cmlidXRlcyddIHx8IHt9CgogICAgIyBUaGUgLnA4IGNvbnRlbnQgaXMgdXN1YWxseSBpbiAncHJpdmF0ZUtleScgb3IgJ2tleUNvbnRlbnQnIG9uIHRoZSBJTklUSUFMIENSRUFURSByZXNwb25zZQogICAgcDhfY29udGVudCA9IGF0dHJbJ3ByaXZhdGVLZXknXSB8fCBhdHRyWydrZXlDb250ZW50J10KICAgIAogICAgaWYgcDhfY29udGVudC5uaWw/CiAgICAgICRzdGRlcnIucHV0cyAiREVCVUc6IEtleSBjb250ZW50IG1pc3NpbmcgaW4gcmVzcG9uc2UuIEF0dGVtcHRpbmcgcmV0cmlldmFsIHZpYSBkb3dubG9hZC9leHBvcnQgZW5kcG9pbnRzLi4uIiAKICAgICAgCiAgICAgIHBhdGhzX3RvX3RyeSA9IFsKICAgICAgICAiaHR0cHM6Ly9hcHBzdG9yZWNvbm5lY3QuYXBwbGUuY29tL2lyaXMvdjEvYXBpS2V5cy8je2tleV9kYXRhWydpZCddfS9kb3dubG9hZCIsCiAgICAgICAgImh0dHBzOi8vYXBwc3RvcmVjb25uZWN0LmFwcGxlLmNvbS9pcmlzL3YxL2FwaUtleXMvI3trZXlfZGF0YVsnaWQnXX0vZXhwb3J0IgogICAgICBdCiAgICAgIAogICAgICBwYXRoc190b190cnkuZWFjaCBkbyB8cGF0aHwKICAgICAgICBiZWdpbgogICAgICAgICAgJHN0ZGVyci5wdXRzICJERUJVRzogVHJ5aW5nICN7cGF0aH0uLi4iCiAgICAgICAgICBkb3dubG9hZF9yZXNwID0gY2xpZW50LnJlcXVlc3QoOmdldCkgZG8gfHJlcXwKICAgICAgICAgICAgcmVxLnVybCBwYXRoCiAgICAgICAgICAgIHJlcS5oZWFkZXJzWydBY2NlcHQnXSA9ICdhcHBsaWNhdGlvbi92bmQuYXBpK2pzb24sIGFwcGxpY2F0aW9uL2pzb24sIHRleHQvamF2YXNjcmlwdCwgKi8qOyBxPTAuMDEnCiAgICAgICAgICAgIHJlcS5oZWFkZXJzWydYLVJlcXVlc3RlZC1XaXRoJ10gPSAnWE1MSHR0cFJlcXVlc3QnCiAgICAgICAgICAgIHJlcS5oZWFkZXJzWydSZWZlcmVyJ10gPSAnaHR0cHM6Ly9hcHBzdG9yZWNvbm5lY3QuYXBwbGUuY29tL2FjY2Vzcy9hcGknCiAgICAgICAgICBlbmQKICAgICAgICAgICRzdGRlcnIucHV0cyAiREVCVUc6IFJlc3BvbnNlIENsYXNzOiAje2Rvd25sb2FkX3Jlc3AuYm9keS5jbGFzc30iCiAgICAgICAgICAkc3RkZXJyLnB1dHMgIkRFQlVHOiBSZXNwb25zZSBTdGF0dXM6ICN7ZG93bmxvYWRfcmVzcC5zdGF0dXN9IiBpZiBkb3dubG9hZF9yZXNwLnJlc3BvbmRfdG8/KDpzdGF0dXMpCiAgICAgICAgICAKICAgICAgICAgIGlmIGRvd25sb2FkX3Jlc3AuYm9keSAmJiAhZG93bmxvYWRfcmVzcC5ib2R5LnRvX3MuaW5jbHVkZT8oJyJlcnJvcnMiPT4nKQogICAgICAgICAgICAgaWYgZG93bmxvYWRfcmVzcC5ib2R5LmlzX2E/KEhhc2gpCiAgICAgICAgICAgICAgIHA4X2NvbnRlbnQgPSBkb3dubG9hZF9yZXNwLmJvZHlbJ2tleUNvbnRlbnQnXSB8fCBkb3dubG9hZF9yZXNwLmJvZHlbJ2NvbnRlbnQnXSB8fCBkb3dubG9hZF9yZXNwLmJvZHkuZGlnKCdkYXRhJywgJ2F0dHJpYnV0ZXMnLCAncHJpdmF0ZUtleScpCiAgICAgICAgICAgICBlbHNlCiAgICAgICAgICAgICAgIHA4X2NvbnRlbnQgPSBkb3dubG9hZF9yZXNwLmJvZHkKICAgICAgICAgICAgIGVuZAogICAgICAgICAgICAgCiAgICAgICAgICAgICBpZiBwOF9jb250ZW50ICYmIHA4X2NvbnRlbnQudG9fcy5zdGFydF93aXRoPygnLS0tLS1CRUdJTicpCiAgICAgICAgICAgICAgICRzdGRlcnIucHV0cyAiREVCVUc6IFJldHJpZXZhbCB2aWEgI3twYXRofSBzdWNjZXNzZnVsISBDb250ZW50IGxlbmd0aDogI3twOF9jb250ZW50LnRvX3MubGVuZ3RofSIKICAgICAgICAgICAgICAgYnJlYWsKICAgICAgICAgICAgIGVsc2UKICAgICAgICAgICAgICAgJHN0ZGVyci5wdXRzICJERUJVRzogUmVzcG9uc2UgZnJvbSAje3BhdGh9IGRpZCBub3QgY29udGFpbiBhIHZhbGlkIHByaXZhdGUga2V5LiIKICAgICAgICAgICAgICAgcDhfY29udGVudCA9IG5pbAogICAgICAgICAgICAgZW5kCiAgICAgICAgICBlbHNlCiAgICAgICAgICAgICAkc3RkZXJyLnB1dHMgIkRFQlVHOiBSZXNwb25zZSBmcm9tICN7cGF0aH0gZW1wdHkgb3IgY29udGFpbnMgZXJyb3JzLiIKICAgICAgICAgIGVuZAogICAgICAgIHJlc2N1ZSA9PiBlCiAgICAgICAgICAkc3RkZXJyLnB1dHMgIkRFQlVHOiBBdHRlbXB0IGZvciAje3BhdGh9IGZhaWxlZDogI3tlLm1lc3NhZ2V9IgogICAgICAgIGVuZAogICAgICBlbmQKICAgIGVuZAoKICAgICMgRklOQUwgVkFMSURBVElPTjogRW5zdXJlIGl0J3Mgbm90IGEgUnVieSBoYXNoIHN0cmluZyByZXByZXNlbnRhdGlvbiBvciBlcnJvcgogICAgaWYgcDhfY29udGVudC5pc19hPyhIYXNoKSB8fCBwOF9jb250ZW50LnRvX3MuaW5jbHVkZT8oJyJlcnJvcnMiPT4nKSB8fCAhcDhfY29udGVudC50b19zLnN0YXJ0X3dpdGg/KCctLS0tLUJFR0lOJykKICAgICAgJHN0ZGVyci5wdXRzICJERUJVRzogSW52YWxpZCBrZXkgY29udGVudCBkZXRlY3RlZC4iCiAgICAgIHA4X2NvbnRlbnQgPSBuaWwKICAgIGVuZAoKICAgIGlmIHA4X2NvbnRlbnQubmlsPwogICAgICAkc3RkZXJyLnB1dHMgIkRFQlVHOiBGYWlsZWQgdG8gcmV0cmlldmUga2V5IGNvbnRlbnQuIgogICAgZW5kCiAgICAKICAgIHJlc3VsdCA9IHsKICAgICAgaWQ6IGtleV9kYXRhWydpZCddLAogICAgICBuYW1lOiBhdHRyWyduaWNrbmFtZSddIHx8IGF0dHJbJ25hbWUnXSwKICAgICAgaXNzdWVySWQ6IGF0dHJbJ2lzc3VlcklkJ10sCiAgICAgIGtleUNvbnRlbnQ6IHA4X2NvbnRlbnQsCiAgICAgIHJhd19yZXNwb25zZTogcmVzcG9uc2UuYm9keSAjIEluY2x1ZGUgdGhpcyBmb3IgZGVidWdnaW5nIHdoZW4ga2V5Q29udGVudCBpcyBuaWwKICAgIH0KICAgIAogICAgcHV0cyAiX19fTUFDSF9KU09OX1NUQVJUX19fIiArIHJlc3VsdC50b19qc29uICsgIl9fX01BQ0hfSlNPTl9FTkRfX18iCiAgcmVzY3VlID0+IGUKICAgICRzdGRlcnIucHV0cyAiRVJST1I6ICN7ZS5tZXNzYWdlfSIKICAgIGlmIGRlZmluZWQ/KHJlc3BvbnNlKSAmJiByZXNwb25zZSAmJiByZXNwb25zZS5ib2R5CiAgICAgICAkc3RkZXJyLnB1dHMgIlJlc3BvbnNlIEJvZHk6ICN7cmVzcG9uc2UuYm9keS50b19qc29ufSIKICAgIGVuZAogICAgZXhpdCAxCiAgZW5kCmVuZAoKZGVmIGRlbGV0ZV9rZXkoaWQpCiAgYmVnaW4KICAgIFNwYWNlc2hpcDo6UG9ydGFsLmxvZ2luKEVOVlsnRkFTVExBTkVfVVNFUiddKQogICAgU3BhY2VzaGlwOjpQb3J0YWwuc2VsZWN0X3RlYW0odGVhbV9pZDogRU5WWydGQVNUTEFORV9URUFNX0lEJ10pCiAgICAKICAgIFNwYWNlc2hpcDo6VHVuZXMubG9naW4oRU5WWydGQVNUTEFORV9VU0VSJ10pCiAgICBzZWxlY3RfYXBwX3N0b3JlX2Nvbm5lY3RfdGVhbQogICAgCiAgICBjbGllbnQgPSBTcGFjZXNoaXA6OlR1bmVzLmNsaWVudAogICAgY2xpZW50LnJlcXVlc3QoOmRlbGV0ZSwgIi9pcmlzL3YxL2FwaUtleXMvI3tpZH0iKQogICAgcHV0cyAiU1VDQ0VTUyIKICByZXNjdWUgPT4gZQogICAgJHN0ZGVyci5wdXRzICJFUlJPUjogI3tlLm1lc3NhZ2V9IgogICAgZXhpdCAxCiAgZW5kCmVuZAoKY29tbWFuZCA9IEFSR1ZbMF0KaWYgY29tbWFuZCA9PSAnbGlzdCcKICBsaXN0X2tleXMKZWxzaWYgY29tbWFuZCA9PSAndGVhbXMnCiAgbGlzdF90ZWFtcwplbHNpZiBjb21tYW5kID09ICdjcmVhdGUnCiAgY3JlYXRlX2tleShBUkdWWzFdIHx8ICJNYWNoIEFQSSBLZXkgI3tUaW1lLm5vdy50b19pfSIpCmVsc2lmIGNvbW1hbmQgPT0gJ2RlbGV0ZScKICBkZWxldGVfa2V5KEFSR1ZbMV0pCmVuZAo=";function Ie(){let e=$.join(he.tmpdir(),f.nameLower);G.existsSync(e)||G.mkdirSync(e,{recursive:!0});let t=$.join(e,"manage_asc_keys.rb");return G.writeFileSync(t,Buffer.from(et,"base64").toString("utf-8"),{mode:493}),t}function Ae(){return{...process.env,PATH:`/usr/local/opt/ruby/bin:/usr/local/Cellar/fastlane/2.227.0/libexec/bin:${process.env.HOME}/.local/share/fastlane/3.4.0/bin:${process.env.PATH}`,GEM_HOME:process.env.FASTLANE_GEM_HOME||`${process.env.HOME}/.local/share/fastlane/3.4.0`,GEM_PATH:(process.env.FASTLANE_GEM_HOME||`${process.env.HOME}/.local/share/fastlane/3.4.0`)+":/usr/local/Cellar/fastlane/2.227.0/libexec",FASTLANE_INSTALLED_VIA_HOMEBREW:"true",CI:"1"}}function be(e){let t=new Map,n=/-\s+(\d+)\s+\(([^)]+)\)/g,a=/\d+\)\s+"([^"]+)"\s+\((\d+)\)/g,i;for(;(i=n.exec(e))!==null;)t.set(i[1],{id:i[1],name:i[2]});for(;(i=a.exec(e))!==null;)t.set(i[2],{id:i[2],name:i[1]});return Array.from(t.values())}function Ge(e){return se(e).appStoreConnectTeamId}function Fe(e,t,n){return{...Ae(),FASTLANE_USER:e,FASTLANE_TEAM_ID:t,...n?{FASTLANE_ITC_TEAM_ID:n,FASTLANE_ASC_TEAM_ID:n}:{}}}function me(e,t="production",n={}){let a=se(e,t),i=n.teamId||a.teamId,s=n.appStoreConnectTeamId||a.appStoreConnectTeamId;return{teamId:i,teamName:n.teamName||a.teamName,developerTeamId:n.developerTeamId||a.developerTeamId||i,appStoreConnectTeamId:s,providerId:n.providerId||a.providerId||s,providerName:n.providerName||a.providerName}}function Xe(e,t){if(t.id){e.submit||(e.submit={}),e.submit.production||(e.submit.production={}),e.submit.production.ios||(e.submit.production.ios={}),e.submit.production.ios.appStoreConnectTeamId=t.id,e.submit.production.ios.providerId=t.id,t.name&&(e.submit.production.ios.appStoreConnectTeamName=t.name,e.submit.production.ios.providerName=t.name),t.developerTeamName&&(e.submit.production.ios.appleTeamName=t.developerTeamName);try{G.writeFileSync(`./${f.configFileName}`,JSON.stringify(e,null,2))}catch{}}}async function tt(e,t,n,a){let i=oe();i.start("Fetching App Store Connect providers...");let s=re("ruby",[e,"teams"],{env:Fe(n,a),stdio:["inherit","pipe","pipe"],encoding:"utf-8"});if(s.status!==0){i.stop("Could not fetch providers");let u=be(`${s.stdout||""}
-${s.stderr||""}`);if(u.length>0)return Ce(t,u,"Select the App Store Connect provider for this API key:");V.warn(N.yellow(`Could not list App Store Connect providers: ${s.stderr||"Unknown error"}`));return}let o=(s.stdout||"").match(new RegExp(`${f.jsonStartMarker}(.*)${f.jsonEndMarker}`));if(!o){i.stop("Could not parse providers");return}let c=JSON.parse(o[1]),l=(c.teams||[]).filter(u=>u.id&&u.name);if(i.stop(l.length===1?"Found 1 provider":`Found ${l.length} providers`),l.length===0)return;if(l.length===1){V.success(N.green(`\u2713 Using App Store Connect provider ${l[0].name} (${l[0].id})`));let u={...l[0],developerTeamName:c.developerTeamName};return Xe(t,u),u}let A=l.filter(u=>u.recommended),C=l.filter(u=>!u.recommended);return Ce(t,[...A,...C],`Select the App Store Connect provider for Developer Team ${c.developerTeamName||a}:`,c.developerTeamName)}async function Ce(e,t,n,a){let i=await te({message:n,options:t.map(l=>({value:l.id,label:l.name,hint:`${l.id}${l.recommended?" \xB7 recommended":""}`}))});if(P(i))return L("Operation cancelled"),null;let s=i,c={...t.find(l=>l.id===s)||{id:s,name:s},developerTeamName:a};return Xe(e,c),V.success(N.green(`\u2713 Using App Store Connect provider ${c.name} (${c.id})`)),c}var Ee=async e=>{let t=oe(),n=e.platform,a=`./${f.configFileName}`;if(!G.existsSync(a)){V.error(`No ${f.configFileName} found. Run \`${f.nameLower} init\` or \`${f.nameLower} link\` first.`);return}let i=JSON.parse(G.readFileSync(a,"utf-8")),{projectId:s}=i,o=e.profile||"production";if(!s){V.error(`${f.configFileName} is missing projectId.`);return}let c=e.file,l=n==="android"?e.packageName||e.bundleId:e.bundleId||ge(i,o)||"*";if(n==="android"&&!l&&(l=await nt(s,i,o),l===null))return;if(n==="ios"&&!c){let p=await te({message:"Manage App Store Connect API Key:",options:[{value:"magic",label:"\u2728 Create new automatically",hint:"Requires Apple ID + 2FA"},{value:"manual",label:"\u{1F50D} Configure manually",hint:"Provide existing .p8 file"},{value:"delete",label:"\u{1F5D1}\uFE0F  Delete an existing Key"}]});if(P(p)){L("Operation cancelled");return}if(p==="magic"){await st(s,i);return}if(p==="delete"){await rt(s,i);return}}if(!c){let p=n==="ios"?"https://appstoreconnect.apple.com/access/api":"https://console.cloud.google.com/apis/credentials";ue(`To submit to the ${n==="ios"?"App Store":"Google Play Store"}, you need a Service Key:
-
-1. Open: ${N.cyan(p)}
-`+(n==="ios"?`2. Generate an "App Store Connect API Key" with ${N.bold("Admin")} role.
-3. Download the ${N.bold(".p8")} file.`:`2. Create a "Service Account", generate a ${N.bold("JSON")} key.
-3. Download the ${N.bold(".json")} file.`),"Guided Setup"),t.start("Scanning for downloaded keys...");let I=ot(n);if(t.stop(I.length>0?`Detected ${I.length} potential key(s)`:"No keys detected automatically"),I.length>0){let g=await te({message:"Found these potential keys. Use one of them?",options:[...I.map(m=>({value:m.path,label:`${$.basename(m.path)} (${m.location})`})),{value:"manual",label:"Enter path manually..."}]});if(P(g)){L("Operation cancelled");return}g!=="manual"&&(c=g)}if(!c){let g=await M({message:`Paste the path to your ${n==="ios"?".p8":".json"} file:`,validate:m=>G.existsSync(m)?void 0:"File not found"});if(P(g)){L("Operation cancelled");return}c=g}}let A=e.issuerId,C=e.keyId;if(n==="ios"){if(!C&&c){let p=$.basename(c).match(/AuthKey_(.*)\.p8/);p&&(C=p[1],V.info(`Auto-detected Key ID from filename: ${N.green(C)}`))}if(!A){let p=await M({message:"Enter App Store Connect Issuer ID (Found on the Keys page):",validate:I=>I.length>0?void 0:"Issuer ID is required"});if(P(p)){L("Operation cancelled");return}A=p}if(!C){let p=await M({message:"Enter App Store Connect Key ID:",validate:I=>I.length>0?void 0:"Key ID is required"});if(P(p)){L("Operation cancelled");return}C=p}}if(n==="android"&&(!l||l==="*")){let p=await Be();if(p===null)return;l=p}let u=n==="ios"?me(i,o):{};await ye(s,c,n,A,C,l,{...u})};async function nt(e,t,n){let a=await it(e),i=at(t,n);if(i&&!a.includes(i)&&a.unshift(i),a.length>0){let s=await te({message:"Select Android package for this Google Play service key:",options:[...a.map(o=>({value:o,label:o,hint:o===i?"from config":void 0})),{value:"manual",label:"Enter another package name..."}]});if(P(s))return L("Operation cancelled"),null;if(s==="manual")return Be();if(s!=="manual")return s}if(i){let s=await Ne({message:`Use Android package from local config (${i})?`,initialValue:!0});if(P(s))return L("Operation cancelled"),null;if(s)return i}}async function Be(){let e=await M({message:"Android package name for this Google Play service key:",placeholder:"com.example.app",validate:t=>t.includes(".")?void 0:"Enter a valid package name"});return P(e)?(L("Operation cancelled"),null):e}async function it(e){try{let n=(await R.get(`/credentials/${e}`)).data.credentials||[],a=new Set;for(let i of n)(i.platform==="android"||i.type==="android_keystore"||i.type==="google_service_account")&&i.bundleId&&i.bundleId!=="*"&&a.add(i.bundleId);return Array.from(a).sort()}catch(t){return V.warn(N.yellow(`Could not fetch saved Android package identifiers: ${t.message}`)),[]}}function at(e,t){let n=pe(e,t);if(n)return n;let a=$.join(process.cwd(),"app.json");if(G.existsSync(a))try{return JSON.parse(G.readFileSync(a,"utf-8")).expo?.android?.package}catch{}let i=$.join(process.cwd(),"app.config.json");if(G.existsSync(i))try{let s=JSON.parse(G.readFileSync(i,"utf-8"));return s.expo?.android?.package||s.android?.package}catch{}}async function st(e,t){let n=oe(),a=t.submit?.production?.ios?.appleId,i=me(t).teamId,s=Ge(t);if(!a){let l=await M({message:"Apple ID:",placeholder:"your-email@example.com"});if(P(l))return;a=l}if(!i){let l=await M({message:"Apple Team ID:",placeholder:"e.g. 4523G95823"});if(P(l))return;i=l,t.submit||(t.submit={production:{ios:{}}}),t.submit.production||(t.submit.production={ios:{}}),t.submit.production.ios||(t.submit.production.ios={}),t.submit.production.ios.appleTeamId=i,G.writeFileSync(`./${f.configFileName}`,JSON.stringify(t,null,2))}let o=await M({message:"Enter a name for the new API Key:",initialValue:`[${f.name}] Project ${e}`});if(P(o))return;let c=Ie();if(!G.existsSync(c)){V.error(`Magic Error: Helper script not found at ${c}`);return}try{let l=await tt(c,t,a,i);if(l===null)return;let A;if(l)A=l,s=l.id;else if(!s)return;n.start("Creating App Store Connect API Key...");let C=y=>re("ruby",[c,"create",o],{env:Fe(a,i,y),stdio:["inherit","pipe","pipe"],encoding:"utf-8"}),u=C(s),p=u.stdout||"",I=u.stderr||"";if(u.status!==0){let y=be(`${p}
-${I}`);if(y.length>0){n.stop("Select App Store Connect team"),ue(`Apple Developer Team IDs look like ${N.bold(i)}.
-App Store Connect API keys use a numeric provider/team ID instead.`,"Team ID mismatch");let F=await Ce(t,y,"Select the App Store Connect provider for this API key:");if(!F)return;A=F,s=F.id,n.start("Creating API Key with selected App Store Connect team..."),u=C(s),p=u.stdout||"",I=u.stderr||""}}if(I&&(I.includes("DEBUG:")||I.includes("ERROR:"))&&I.split(`
-`).forEach(y=>{y.trim()&&V.info(N.dim(`[Ruby] ${y.trim()}`))}),u.status!==0){n.stop("Failed"),V.error(`Magic creation failed: ${I}`);return}let g=p.match(new RegExp(`${f.jsonStartMarker}(.*)${f.jsonEndMarker}`));if(!g){n.stop("Parse Error"),V.error("Could not parse response from Apple Portal.");return}let m=JSON.parse(g[1]),{id:b,issuerId:D,keyContent:x}=m,_=me(t,"production",{teamId:i,teamName:A?.developerTeamName,developerTeamId:i,appStoreConnectTeamId:s,providerId:s,providerName:A?.name});if(n.stop("Key Created Successfully"),V.success(`\u2713 Created Key ID: ${N.green(b)}`),!D){ue(`Your Issuer ID is shown at the top of:
-  ${N.cyan("https://appstoreconnect.apple.com/access/integrations/api")}
-
-It looks like: ${N.dim("xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx")}`,"One More Thing");let y=await M({message:"Enter your App Store Connect Issuer ID:",validate:F=>F.trim().length>0?void 0:"Issuer ID is required"});if(P(y)){L("Operation cancelled.");return}D=y.trim()}if(x){let y=$.join(he.tmpdir(),`AuthKey_${b}.p8`);G.writeFileSync(y,x),await ye(e,y,"ios",D,b,t.ios?.bundleIdentifier||"*",{..._}),G.unlinkSync(y)}else{V.warn(N.yellow("\u26A0\uFE0F  Apple did not return the private key in the response.")),ue(`Download the .p8 file manually:
-
-  1. Open: ${N.cyan("https://appstoreconnect.apple.com/access/integrations/api")}
-  2. Find Key ID: ${N.green(b)}
-  3. Click ${N.bold("Download API Key")} (only available once)
-  4. Drag & drop the downloaded .p8 file below`,"Manual Step Required");let y=await M({message:"Path to the downloaded .p8 file (drag & drop here):",validate:F=>G.existsSync(F)?void 0:"File not found"});if(P(y)){L("Operation cancelled. Credential ID was registered but key content is missing.");return}await ye(e,y,"ios",D,b,t.ios?.bundleIdentifier||"*",{..._})}}catch(l){n.stop("Error"),V.error(`Error: ${l.message}`)}}async function rt(e,t){let n=oe(),a=t.submit?.production?.ios?.appleId,i=me(t).teamId,s=Ge(t);if(!a){let c=await M({message:"Apple ID:"});if(P(c))return;a=c}if(!i){let c=await M({message:"Apple Team ID:"});if(P(c))return;i=c,t.submit||(t.submit={production:{ios:{}}}),t.submit.production||(t.submit.production={ios:{}}),t.submit.production.ios||(t.submit.production.ios={}),t.submit.production.ios.appleTeamId=i,G.writeFileSync(`./${f.configFileName}`,JSON.stringify(t,null,2))}n.start("Fetching existing API Keys...");let o=Ie();if(!G.existsSync(o)){V.error(`Magic Error: Helper script not found at ${o}`);return}try{let c=g=>re("ruby",[o,"list"],{env:{...Ae(),FASTLANE_USER:a,FASTLANE_TEAM_ID:i,...g?{FASTLANE_ITC_TEAM_ID:g,FASTLANE_ASC_TEAM_ID:g}:{}},stdio:["inherit","pipe","pipe"],encoding:"utf-8"}),l=c(s);if(l.status!==0){let g=be(`${l.stdout||""}
-${l.stderr||""}`);if(g.length>0){n.stop("Select App Store Connect team");let m=await te({message:"Select the App Store Connect team to list API keys:",options:g.map(b=>({value:b.id,label:b.name,hint:b.id}))});if(P(m)){L("Operation cancelled");return}s=m,n.start("Fetching existing API Keys..."),l=c(s)}}if(l.status!==0){n.stop("Failed"),V.error(`Listing failed: ${l.stderr}`);return}let A=l.stdout.match(new RegExp(`${f.jsonStartMarker}(.*)${f.jsonEndMarker}`));if(!A){n.stop("Parse Error");return}let C=JSON.parse(A[1]);if(n.stop(`Found ${C.length} keys`),C.length===0){V.info("No API Keys found on this team.");return}let u=await te({message:"Select a key to delete from Apple Developer Portal:",options:[...C.map(g=>({value:g.id,label:`ID: ${g.id} - ${g.name} (${g.role})`})),{value:"cancel",label:"Cancel"}]});if(P(u)||u==="cancel")return;let p=await Ne({message:`Are you sure you want to delete Key ${u}? This cannot be undone.`});if(!p||P(p))return;n.start(`Deleting Key ${u}...`);let I=re("ruby",[Ie(),"delete",u],{env:{...Ae(),FASTLANE_USER:a,FASTLANE_TEAM_ID:i,...s?{FASTLANE_ITC_TEAM_ID:s,FASTLANE_ASC_TEAM_ID:s}:{}},stdio:"pipe",encoding:"utf-8"});I.status===0?(n.stop("Deleted"),V.success(`\u2713 Key ${u} has been removed from Apple Portal.`)):(n.stop("Deletion Failed"),V.error(`Error: ${I.stderr}`))}catch(c){n.stop("Error"),V.error(`Error: ${c.message}`)}}async function ye(e,t,n,a,i,s="*",o={}){let c=oe();c.start(`Uploading Service Credentials for ${n}...`);try{let l=n==="ios"?"asc_api_key":"google_service_account",A=new URL(import.meta.url),C=$.dirname(A.pathname),u=[$.join(C,"isolated-upload.js"),$.join(C,"commands","isolated-upload.js"),$.resolve(C,"../commands/isolated-upload.js"),$.resolve(process.cwd(),`node_modules/.bin/${f.nameLower}-upload`)],p="";for(let g of u)if(G.existsSync(g)){p=g;break}if(!p)throw new Error("Could not locate isolated-upload.js. Ensure the CLI is properly installed.");let I=re("node",[p,e,t,l,s,"service","undefined","undefined",a||"undefined",i||"undefined","undefined","undefined","undefined",o.teamId||"undefined",o.teamName||"undefined",o.developerTeamId||"undefined",o.appStoreConnectTeamId||"undefined",o.providerId||"undefined",o.providerName||"undefined"],{stdio:"pipe",encoding:"utf-8",env:{...process.env,AT_CLI_ISOLATED:"1"}});if(I.status!==0){let g=I.stderr||I.stdout||"Unknown upload failure";c.stop("Upload Failed"),V.error(N.red(`Upload Failed: ${g}`));return}I.stdout.includes("SUCCESS")?(c.stop("Upload Success"),V.success(N.green(`\u2713 Service Credentials for ${n} uploaded successfully.`))):(c.stop("Upload Summary"),V.warn(N.yellow(`Upload finished but success not confirmed: ${I.stdout}`)))}catch(l){c.stop("Upload Error"),V.error(N.red(`Error: ${l.message}`))}}function ot(e){let t=e==="ios"?".p8":".json",n=[],a=[{path:"./",label:"Project Root"},{path:$.join(he.homedir(),"Downloads"),label:"Downloads"}];for(let i of a)if(G.existsSync(i.path))try{let s=G.readdirSync(i.path);for(let o of s)if(o.endsWith(t)){if(e==="android"&&!G.readFileSync($.join(i.path,o),"utf8").includes("service_account")||e==="ios"&&!o.startsWith("AuthKey"))continue;n.push({path:$.join(i.path,o),location:i.label})}}catch{}return n}import De from"axios";import d from"chalk";import{execSync as O,spawnSync as ne}from"child_process";import Se from"crypto";import h from"fs";import Z from"path";import ve from"os";import pt from"adm-zip";De.defaults.proxy=!1;function we(e,t){if(!h.existsSync(e))return;let n=h.readdirSync(e);for(let a of n){let i=Z.join(e,a);if(h.statSync(i).isDirectory()){let o=we(i,t);if(o)return o}else if(t.test(a))return i}}var Q=e=>String(e||"").trim().toLowerCase().replace(/_/g,"-"),Te=e=>String(e||"unknown").trim().replace(/[^a-zA-Z0-9._-]/g,"_")||"unknown",gt=(e,t)=>`ios-certificates/${Te(e)}/${Te(t)}/`,Y=e=>{if(typeof e!="string")return;let t=e.trim();return t.length>0?t:void 0},Re=e=>Y(e.password)||Y(e.p12Password)||Y(e.certificatePassword)||Y(e.meta?.password)||Y(e.meta?.p12Password)||Y(e.meta?.certificatePassword),Ke=e=>Y(e.keystorePassword)||Y(e.storePassword)||Y(e.meta?.keystorePassword)||Y(e.meta?.storePassword),Le=e=>Y(e.keyPassword)||Y(e.meta?.keyPassword),ut=e=>Y(e.alias)||Y(e.meta?.alias),Pe=e=>e.credentialId||e.id,xe=e=>e.bundleId||e.bundleIdentifier||e.meta?.bundleId||e.meta?.bundleIdentifier,Ye=e=>e.distributionType||e.meta?.distributionType,Je=e=>!!Re(e)||!!Ke(e)||!!Le(e),mt=async(e,t,n)=>{if(!["ios_cert","android_keystore"].includes(n.type)||Je(n))return n;let a=xe(n),i=Ye(n);if(!a||!i)return n;try{let o=(await R.get("/credentials/resolve",{params:{projectId:e,platform:t,bundleId:a,distributionType:i}})).data.credentials||[],c=Pe(n),l=o.find(A=>{if(A.type!==n.type)return!1;let C=Pe(A);return c&&C===c?!0:xe(A)===a&&Q(Ye(A))===Q(i)&&Je(A)});return l?{...n,...l,meta:{...n.meta,...l.meta}}:n}catch{return n}},ft=e=>{let t=Q(e);return t==="store"||t==="app-store"?"PRODUCTION":["adhoc","ad-hoc","internal","staging","stage"].includes(t)?"STAGING":"DEVELOPMENT"},It=(e,t)=>{let n=Re(e);if(n)return n;let a=ft(e.distributionType);return["IOS_P12_PASSWORD",`${f.envPrefix}P12_PASSWORD`,`IOS_P12_PASSWORD_${a}`,`P12_PASSWORD_${a}`,"MACH_P12_PASSWORD","P12_PASSWORD","CERT_PASSWORD"].map(s=>Y(t[s])).find(Boolean)||""},At=(e,t)=>{let n=Q(e.distributionType),a=n==="store"?"PRODUCTION":["internal","adhoc","ad-hoc","staging","stage"].includes(n)?"STAGING":"DEVELOPMENT",i=["PRODUCTION","STORE","INTERNAL","STAGING","DEVELOPMENT","RELEASE","DEBUG"],s=[`KEYSTORE_PASSWORD_${a}`,`KEYSTORE_PASSWORD_${String(e.distributionType||"").toUpperCase()}`,...i.map(u=>`KEYSTORE_PASSWORD_${u}`),"ANDROID_STORE_PASSWORD","ANDROID_KEYSTORE_PASSWORD","ANDROID_KEYSTONE_PASSWORD","KEYSTORE_PASSWORD"],o=[`KEY_PASSWORD_${a}`,`KEY_PASSWORD_${String(e.distributionType||"").toUpperCase()}`,"ANDROID_KEY_PASSWORD","KEY_PASSWORD"],c=[`KEYSTORE_ALIAS_${a}`,`KEYSTORE_ALIAS_${String(e.distributionType||"").toUpperCase()}`,...i.map(u=>`KEYSTORE_ALIAS_${u}`),"ANDROID_KEY_ALIAS","KEYSTORE_ALIAS"],l=Ke(e)||Re(e)||s.map(u=>Y(t[u])).find(Boolean)||"",A=Le(e)||o.map(u=>Y(t[u])).find(Boolean)||l;return{alias:ut(e)||c.map(u=>Y(t[u])).find(Boolean)||"",keystorePassword:l,keyPassword:A}},_e=(e,t,n)=>{let a=e.includes(".")?e.replace(/\.[^.]+$/i,".zip"):`${e}.zip`,i=Z.basename(e),s=new pt;return s.addLocalFile(e,void 0,i),s.addFile(t,Buffer.from(n.endsWith(`
-`)?n:`${n}
-`,"utf8")),s.writeZip(a),a},Me=e=>{let t=e.toLowerCase();return t==="production"||t==="prod"||t.includes("store")||t.endsWith("-production")||t.endsWith("-prod")},Ct=e=>{let t=e.toLowerCase();return t==="staging"||t==="stage"||t.includes("preview")||t.includes("adhoc")||t.includes("ad-hoc")||t.endsWith("-staging")||t.endsWith("-stage")},yt=(e,t)=>{let n=ee(e,t)||{},a=Q(n.distribution),i=Q(n.iosExportMethod||n.ios?.exportMethod),s=Q(n.environment);return i==="app-store"||a==="store"?"store":i==="development"||a==="development"?"development":i==="ad-hoc"||i==="adhoc"||a==="ad-hoc"||a==="adhoc"||a==="internal"?"adhoc":s==="production"||s==="store"?"store":s==="development"||s==="dev"?"development":s==="staging"||s==="stage"||s==="preview"?"adhoc":Me(t)?"store":Ct(t)?"adhoc":"development"},ht=(e,t)=>{let n=ee(e,t)||{},a=Q(n.distribution),i=Q(n.environment);return a==="store"||i==="production"||i==="store"||Me(t)?"store":"internal"};function bt(e,t,n){let a=h.readFileSync(n,"utf8"),i=Math.floor(Date.now()/1e3),s=Buffer.from(JSON.stringify({alg:"ES256",kid:e,typ:"JWT"})).toString("base64url"),o=Buffer.from(JSON.stringify({iss:t,iat:i,exp:i+1200,aud:"appstoreconnect-v1"})).toString("base64url"),c=`${s}.${o}`,l=Se.createSign("SHA256");l.update(c);let A=l.sign({key:a,dsaEncoding:"ieee-p1363"}).toString("base64url");return`${c}.${A}`}async function St(e,t,n,a){let i=bt(t,n,a),s=(await import("axios")).default;for(let o of e)try{await s.post("https://api.appstoreconnect.apple.com/v1/devices",{data:{type:"devices",attributes:{name:o.name,udid:o.udid,platform:"IOS"}}},{headers:{Authorization:`Bearer ${i}`,"Content-Type":"application/json"}}),r.info(d.dim(`  \u2713 Registered: ${o.name}`))}catch(c){let l=c.response?.data?.errors;l?.some(C=>C.code==="ENTITY_ERROR.ATTRIBUTE.INVALID.DUPLICATE"||C.detail?.toLowerCase().includes("already registered")||C.detail?.toLowerCase().includes("already exists"))?r.info(d.dim(`  Already on Portal: ${o.name}`)):r.warn(d.yellow(`  Could not register ${o.name}: ${l?.[0]?.detail||c.message}`))}}var $e=async e=>{ct(d.bgCyan.black(f.cliTag("Credentials")));let t=await q({message:"Select platform:",options:[{value:"ios",label:"iOS"},{value:"android",label:"Android"}]});k(t)&&(U("Operation cancelled"),process.exit(0));let n=await q({message:"What do you want to do?",options:[{value:"setup",label:"Build Credentials (Certs/Profiles)",hint:"Manage everything needed to build your project"},{value:"download",label:"Download credentials (credentials.json)",hint:"Sync credentials from Dashboard to local project"},{value:"service",label:"App Store Connect API Key (Magic)",hint:"Manage your API Key for automated submission"},{value:"push",label:"Push Notifications (Placeholder)",hint:"Manage your Apple Push Notifications Key"},{value:"back",label:"Go back"},{value:"exit",label:"Exit"}].filter(a=>!(t==="android"&&(a.value==="service"&&(a.label="Google Service Account (JSON)"),a.value==="push")))});if((k(n)||n==="exit")&&(U("Operation cancelled"),process.exit(0)),n==="back")return $e(e);if(n==="setup")await wt({...e,platform:t});else if(n==="download")await Nt({...e,platform:t});else if(n==="service")await Ee({...e,platform:t});else if(n==="push")return Oe("Push Notifications management is coming soon!","Coming Soon"),$e(e);lt(d.green("Done!"))},wt=async e=>{let t=de(),n=e.platform,a=e.profile;if(!a){let c=await q({message:"Select credential type:",options:[{value:"development",label:"Development",hint:"Local testing & simulators"},{value:"staging",label:"Ad Hoc / Staging",hint:"Internal distribution & device testing"},{value:"production",label:"Production / App Store",hint:"App Store & Play Store submission"}]});k(c)&&(U("Operation cancelled"),process.exit(0)),a=c}let i=`./${f.configFileName}`;if(!h.existsSync(i)){r.error(`No ${f.configFileName} found. Run \`${f.nameLower} init\` or \`${f.nameLower} link\` first.`);return}let s=JSON.parse(h.readFileSync(i,"utf-8")),{projectId:o}=s;if(!o){r.error(`${f.configFileName} is missing projectId.`);return}if(e.awsProfile&&r.warn(d.yellow(`Ignoring --aws-profile. Authenticating with ${f.name} Cloud...`)),r.info(d.dim(`Setting up credentials for: ${a}`)),n==="ios")await Zt(o,a,e,s);else{let c=ht(s,a);await Wt(o,a,c,e,s)}};async function Zt(e,t,n,a){let i=n.bundleId;if(!i){let l=a.submit?.[t]?.ios?.bundleIdentifier||a.submit?.[t]?.ios?.bundleId||ge(a,t),A=[];try{let u=(await R.get(`/credentials/${e}`)).data.credentials||[];A=[...new Set(u.filter(p=>p.platform==="ios"&&p.bundleId&&p.bundleId!=="*").map(p=>p.bundleId))]}catch{}if(l&&!A.includes(l)&&A.unshift(l),A.length>0){let C=[...A.map(p=>({value:p,label:p,hint:p===l?"from config":void 0})),{value:"__new__",label:"+ Enter a new Bundle ID"}],u=await q({message:"Which Bundle ID are you setting up credentials for?",options:C});if(k(u)&&(U("Operation cancelled"),process.exit(0)),u==="__new__"){let p=await z({message:"iOS Bundle ID (e.g. com.example.app):",placeholder:"com.example.app",validate:I=>I.includes(".")?void 0:"Please enter a valid Bundle ID"});k(p)&&(U("Operation cancelled"),process.exit(0)),i=p}else i=u}else{let C=await z({message:"iOS Bundle ID (e.g. com.example.app):",placeholder:"com.example.app",validate:u=>u.includes(".")?void 0:"Please enter a valid Bundle ID"});k(C)&&(U("Operation cancelled"),process.exit(0)),i=C}}r.info(d.dim(`Bundle ID: ${i}`));let s=yt(a,t),o=a.submit?.production?.ios?.appleId;o&&r.info(d.dim(`Using Apple ID from config: ${o}`)),await Rt(e,i,t,s,s==="store"?"appstore":s==="adhoc"?"adhoc":"development",n,a,o)}async function vt(e){let t="MATCH_ENCRYPTION_PASSPHRASE";try{let o=((await R.get(`/projects/${e}/secrets/export?env=development`)).data.secrets||{})[t];if(o&&!o.includes("[Decryption Failed]"))return r.info(d.dim("Using existing encryption passphrase from Dashboard")),r.info(d.cyan(`MATCH_PASSWORD: ${o}`)),o;if(o&&o.includes("[Decryption Failed]")){r.warn(d.yellow("\u26A0\uFE0F  Existing MATCH_PASSWORD could not be decrypted (encryption key changed).")),r.info(d.dim("Generating a fresh passphrase and cleaning old certificates..."));let c=Se.randomBytes(32).toString("base64");try{await R.post(`/projects/${e}/secrets`,{key:t,value:c,type:"managed",description:"Encryption passphrase for iOS certificates (fastlane match)",visibility:"secret"}),r.success(d.green("\u2713 New encryption passphrase generated and saved"))}catch{}try{await R.post("/credentials/clean-match-storage",{projectId:e}),r.success(d.green("\u2713 Cleaned old certificates from storage"))}catch{}return c}}catch(i){r.info(d.dim(`Could not fetch existing passphrase from Dashboard: ${i.message}`))}let n=await q({message:"No active encryption passphrase found on Dashboard. What would you like to do?",options:[{value:"generate",label:"Generate a new secure passphrase",hint:"Safe for first-time setup"},{value:"enter",label:"Enter existing passphrase manually",hint:"Required if you already have certs in S3"},{value:"cancel",label:"Cancel",hint:"Quit"}]});if((k(n)||n==="cancel")&&(U("Operation cancelled"),process.exit(0)),n==="enter"){let i=await fe({message:"Enter your MATCH_PASSWORD (encryption passphrase):",validate:o=>o.length>0?void 0:"Passphrase is required"});k(i)&&(U("Operation cancelled"),process.exit(0));let s=i;try{await R.post(`/projects/${e}/secrets`,{key:t,value:s,type:"managed",description:"Encryption passphrase for iOS certificates (fastlane match)"}),r.success(d.green("\u2713 Saved passphrase to Dashboard"))}catch{}return s}let a=Se.randomBytes(32).toString("base64");try{await R.post(`/projects/${e}/secrets`,{key:t,value:a,type:"managed",description:"Encryption passphrase for iOS certificates (fastlane match)",visibility:"secret"}),r.success(d.green("\u2713 Generated and saved encryption passphrase to Dashboard")),r.info(d.cyan(`MATCH_PASSWORD: ${a}`))}catch(i){r.warn(d.yellow(`Could not save passphrase to Dashboard: ${i.message}`))}return a}async function Rt(e,t,n,a,i,s,o,c){let l=de();r.info(d.blue("Configuring iOS certificate management..."));let A,C=se(o,n),u=C;if(!c){let p=await z({message:"Apple ID (for Apple Developer Portal):",placeholder:"your-email@example.com",validate:I=>I.includes("@")?void 0:"Please enter a valid email"});k(p)&&(U("Operation cancelled"),process.exit(0)),c=p}l.start(`Fetching ${i} certificates...`);try{let p=await vt(e),I="",g="";try{let y=await R.post("/credentials/build-server-token",{projectId:e});y.data.status==="success"&&y.data.credentials&&(process.env.AWS_ACCESS_KEY_ID=y.data.credentials.accessKeyId,process.env.AWS_SECRET_ACCESS_KEY=y.data.credentials.secretAccessKey,y.data.credentials.sessionToken&&(process.env.AWS_SESSION_TOKEN=y.data.credentials.sessionToken),g=y.data.credentials.region||"ap-south-1",I=y.data.credentials.bucket||f.bucketPrefix,process.env.AWS_REGION=g,delete process.env.AWS_PROFILE)}catch(y){throw r.error(`Failed to authenticate with ${f.name} Cloud.`),y}if(!I||!g){r.error(`Failed to resolve S3 configuration from ${f.name} Cloud.`);return}let m=s.teamId||C.teamId||o.submit?.production?.ios?.appleTeamId;if(!m)try{let F=(await R.get(`/projects/${e}/secrets`)).data.secrets?.find(H=>H.key==="APPLE_TEAM_ID");F&&(m=F.value,r.info(d.dim(`Using Team ID from Dashboard: ${m}`)))}catch{}if(m&&m===o.submit?.production?.ios?.appleTeamId&&r.info(d.dim(`Using Apple Team ID from config: ${m}`)),!m){r.warn(d.yellow(`
-Apple Team ID is required to fetch certificates.`)),r.info(d.dim("You can find this at: https://developer.apple.com/account \u2192 Membership Details"));let y=await z({message:"Enter your 10-character Apple Team ID:",placeholder:"e.g. SA56KTS33U",validate:F=>F.length===10?void 0:"Team ID must be exactly 10 characters"});k(y)&&(U("Operation cancelled"),process.exit(0)),m=y,await Ue(e,m)}let b={...C,teamId:m,developerTeamId:C.developerTeamId||m};u=b;let D=gt(e,m);r.info(d.dim(`Using match storage prefix: ${D}`)),l.stop("Starting certificate sync...");let x=`${f.buildPrefix}-${m}.keychain-db`,_=f.keychainPassword;try{let F=`${process.env.HOME||"/Users/"+(process.env.USER||f.nameLower)}/Library/Keychains/${x}`;r.info(d.dim(`Ensuring keychain exists: ${x}`));try{O(`security create-keychain -p ${_} ${x} 2>/dev/null || true`),O(`security unlock-keychain -p ${_} ${x}`),O(`security set-keychain-settings ${x}`);let S=O("security list-keychains -d user").toString();if(!S.includes(x)){r.info(d.dim(`Adding ${x} to search list`));let w=[...S.replace(/"/g,"").split(`
-`).map(B=>B.trim()).filter(B=>B.length>0),F].join(" ");O(`security list-keychains -d user -s ${w}`)}}catch(S){r.warn(d.dim("Keychain setup warning (non-critical): "+S.message))}let H,X;try{let W=((await R.get(`/credentials/${e}`)).data.credentials||[]).find(w=>w.type==="asc_api_key"&&w.issuerId);if(W){let w=await R.get(`/credentials/${W.credentialId}/download`,{params:{projectId:e,format:"raw"}});if(w.data.downloadUrl){let T=await(await import("axios")).default.get(w.data.downloadUrl,{responseType:"arraybuffer"}),K=Z.join(ve.tmpdir(),`mach-asc-${Date.now()}`);h.mkdirSync(K,{recursive:!0}),A=Z.join(K,`AuthKey_${W.keyId}.p8`),h.writeFileSync(A,Buffer.from(T.data)),H=W.keyId,X=W.issuerId,r.success(d.green("\u2713 ASC API key loaded \u2014 no 2FA required for Portal operations"))}}}catch(S){r.warn(d.dim(`Could not load ASC API key: ${S.message}. Will fall back to Apple ID auth.`))}r.info(d.dim("Generating secure P12 export password..."));let E=ze();r.success(d.green("\u2713 Secure P12 password generated."));let v={...process.env,AWS_REGION:process.env.AWS_REGION||"ap-south-1",AWS_ACCESS_KEY_ID:process.env.AWS_ACCESS_KEY_ID,AWS_SECRET_ACCESS_KEY:process.env.AWS_SECRET_ACCESS_KEY,SSL_CERT_FILE:"/etc/ssl/cert.pem",AWS_CA_BUNDLE:"/etc/ssl/cert.pem",FASTLANE_SSL_CA_CERT:"/etc/ssl/cert.pem",MATCH_PASSWORD:p,FASTLANE_USER:c,FASTLANE_SKIP_UPDATE_CHECK:"1",FASTLANE_TEAM_ID:m,MATCH_KEYCHAIN_NAME:F,MATCH_KEYCHAIN_PASSWORD:_,TERM:process.env.TERM||"xterm-256color",SHELL:process.env.SHELL||"/bin/zsh",MATCH_OUTPUT_PATH:Z.join(process.cwd(),"temp_match"),MATCH_STORAGE_MODE:"s3",MATCH_S3_REGION:g,MATCH_S3_BUCKET:I,MATCH_S3_OBJECT_PREFIX:D,MATCH_USERNAME:c,MATCH_APP_IDENTIFIER:t,MATCH_TYPE:i,[`${f.envPrefix}P12_PASSWORD`]:E,...A&&H&&X?{APP_STORE_CONNECT_API_KEY_KEY_ID:H,APP_STORE_CONNECT_API_KEY_ISSUER_ID:X,APP_STORE_CONNECT_API_KEY_KEY_FILEPATH:A,FASTLANE_SKIP_2FA:"1"}:{}};if(s.force){r.warn(d.yellow(`
-\u26A0\uFE0F  Force flag detected: Hard resetting ${i} certificates...`)),r.info(d.dim("Detected decryption failure loop. Clearing remote storage directly to allow fresh generation.")),r.info(d.cyan(`Current MATCH_PASSWORD: ${p}`)),r.info(d.dim(`Cleaning match storage for Team ID: ${m}...`));try{(await R.post("/credentials/clean-match-storage",{projectId:e,teamId:m,storagePrefix:D})).data.status==="success"&&r.success(d.green(`\u2713 Cleared S3 storage for Team ID: ${m}`))}catch(S){r.warn(d.yellow(`S3 cleanup via API failed: ${S.message}`)),r.info(d.dim("Continuing to attempt standard nuke..."))}try{O(`fastlane match nuke ${i} --skip_confirmation`,{stdio:"inherit",cwd:process.cwd(),env:v}),r.success(d.green(`\u2713 Nuked existing ${i} credentials`))}catch{r.warn(d.yellow("Standard nuke failed (likely due to password mismatch).")),r.info(d.dim("Since S3 was cleared manually, proceeding to generation..."))}}if(i==="adhoc"||i==="development")try{r.info(d.blue("Fetching registered devices..."));let W=(await R.get("/devices",m?{params:{teamId:m}}:void 0)).data.devices||[];if(m)try{let w=await R.get("/devices",{params:{teamId:"LEGACY"}}),B=new Map;for(let T of[...W,...w.data.devices||[]])B.set(T.udid,T);W=Array.from(B.values())}catch{}if(W.length===0)r.warn(d.yellow("No registered devices found. Profile will only include devices already on the Apple Developer Portal.")),r.info(d.dim(`Register devices with: ${f.nameLower} device register`));else{let{multiselect:w}=await import("@clack/prompts"),B=await w({message:`Select devices to include in the ${i} profile:`,options:W.map(T=>({value:T.udid,label:`${T.name} (${T.udid.substring(0,12)}...)`,hint:T.model||T.platform})),initialValues:W.map(T=>T.udid)});if(!k(B)&&B.length>0){let T=W.filter(K=>B.includes(K.udid));if(r.info(d.blue(`Registering ${T.length} device(s) on Apple Developer Portal...`)),m&&await Promise.all(T.filter(K=>!K.teamId).map(K=>R.post("/devices",{udid:K.udid,name:K.name,platform:"ios",addedVia:K.addedVia||"cli",teamId:m,teamName:b.teamName}).catch(()=>{}))),A&&H&&X)await St(T,H,X,A);else{r.info(d.dim("You will be prompted for a 2FA code once \u2014 type it and press Enter."));for(let K of T){let Qe=K.name.replace(/"/g,'\\"');ne(`fastlane run register_device name:"${Qe}" udid:"${K.udid}"`,{shell:!0,env:v,stdio:"inherit",cwd:process.cwd()})}}r.info(d.green("\u2713 Device registration complete."))}}}catch(S){r.warn(d.yellow(`Could not fetch registered devices: ${S.message}`)),r.info(d.dim("Continuing without explicit device registration."))}try{let S=ne(`fastlane match ${i} --app_identifier "${t}" --profile_name "${f.nameLower} ${i} ${t}"`,{shell:!0,cwd:process.cwd(),env:v,stdio:"inherit",encoding:"utf-8"});if(S.status!==0){r.warn(d.yellow(`
-Certificate sync failed. Attempting to create App ID and retry...`));try{O(`fastlane produce --app_identifier "${t}" --app_name "${t}" --skip_itc`,{stdio:"inherit",env:v}),r.success(d.green("\u2713 App ID created successfully")),r.info(d.blue("Retrying certificate sync...")),S=ne(`fastlane match ${i} --app_identifier "${t}" --profile_name "${f.nameLower} ${i} ${t}"`,{shell:!0,cwd:process.cwd(),env:v,stdio:"inherit",encoding:"utf-8"})}catch{}if(S.status!==0)throw new Error("fastlane match failed")}}catch(S){r.warn(d.yellow(`
-Sync failed. This often happens if the encryption passphrase (MATCH_PASSWORD) is incorrect or session expired.`)),r.info(d.cyan(`Failed MATCH_PASSWORD was: ${p}`));let W=await q({message:"What would you like to do?",options:[{value:"retry_password",label:"Retry with a different MATCH_PASSWORD",hint:"Manually enter the decryption passphrase"},{value:"check_portal",label:"Check Apple Portal (Resolve certificate limits)",hint:"See if you have too many certificates"},{value:"manual",label:"Fallback to manual upload",hint:"Provide .p12 and .mobileprovision files"},{value:"cancel",label:"Cancel",hint:"Go back"}]});if(k(W)||W==="cancel")throw S;if(W==="retry_password"){r.info(d.dim(`
-You are overriding the dashboard passphrase for this session.`));let w=await fe({message:"Enter the correct MATCH_PASSWORD for this project:"});if(w&&!k(w)){p=w,r.info(d.blue("Retrying with provided passphrase...")),r.info(d.cyan(`New MATCH_PASSWORD: ${p}`));let B={...v,MATCH_PASSWORD:p};if(ne(`fastlane match ${i}`,{shell:!0,stdio:"inherit",cwd:process.cwd(),env:B}).status===0)await R.post(`/projects/${e}/secrets`,{key:"MATCH_ENCRYPTION_PASSPHRASE",value:p,description:"Encryption passphrase for iOS certificates (fastlane match)",visibility:"secret"}),r.success(d.green("\u2713 Dashboard passphrase updated.")),r.info(d.cyan(`MATCH_PASSWORD: ${p}`));else throw new Error("Sync failed again with provided passphrase.")}else throw S}else if(W==="check_portal")try{let w=await Ze(v,i);if(w.length>0){if(r.info(d.dim(`Found ${w.length} existing ${i} certificates on the portal.`)),await Ft(i,v,e,w)&&(r.info(d.blue("Retrying certificate sync...")),ne(`fastlane match ${i}`,{shell:!0,stdio:"inherit",cwd:process.cwd(),env:v}).status!==0))throw new Error("Retry failed")}else throw r.error(d.red("No existing certificates found on portal to resolve.")),S}catch(w){throw r.warn(d.dim(`Portal check warning: ${w.message}`)),S}else throw S}r.success(d.green("\u2713 Certificates fetched and synced"));let J=Z.join(process.cwd(),"temp_match"),j=Z.join(J,`${f.fastlanePrefix}_export.p12`),ae=we(J,/\.mobileprovision$/);try{let W=`${process.env.HOME||"/Users/"+(process.env.USER||f.nameLower)}/Library/Keychains/${x}`;h.existsSync(J)||h.mkdirSync(J,{recursive:!0}),r.info(d.dim("Exporting certificate from keychain for dashboard upload..."));let w=O(`security find-identity -v -p codesigning "${W}"`,{encoding:"utf-8"});r.info(d.dim(`Identities in keychain:
-${w.trim()}`)),O(`security export -k "${W}" -t identities -f pkcs12 -o "${j}" -P ""`,{stdio:"ignore"});try{let B=O(`openssl pkcs12 -in "${j}" -nokeys -passin pass: -legacy 2>/dev/null || openssl pkcs12 -in "${j}" -nokeys -passin pass: 2>/dev/null`,{encoding:"utf-8"});if(!B.includes(m))throw new Error(`Exported P12 does not contain identity for team ${m}. Found: ${B.substring(0,200)}`);r.success(d.green(`\u2713 P12 verified \u2014 contains correct team identity (${m})`))}catch(B){throw new Error(`P12 verification failed: ${B.message}`)}}catch{r.warn(d.dim("Could not export certificate from keychain."))}s.teamId&&!m&&await Ue(e,s.teamId);let We=h.existsSync(j)?j:we(J,/\.p12$/);if(We&&ae){let S,W;try{let w=await Ze(v,i);w.length>0&&(S=w[0].expires,W=w[0].id)}catch{r.warn(d.dim("Could not fetch expiration date or ID for dashboard record."))}await ie(e,We,"ios_cert",t,a,void 0,S,s.teamId||m,W,E,void 0,void 0,b.teamId,b.teamName,b.developerTeamId,b.appStoreConnectTeamId,b.providerId,b.providerName),await ie(e,ae,"ios_profile",t,a,void 0,S,s.teamId||m,void 0,void 0,void 0,void 0,b.teamId,b.teamName,b.developerTeamId,b.appStoreConnectTeamId,b.providerId,b.providerName),r.success(d.green("\u2713 Both iOS certificate and provisioning profile uploaded successfully"));try{h.existsSync("./temp_match")&&h.rmSync("./temp_match",{recursive:!0,force:!0})}catch{}}else r.warn(d.yellow("Certificates generated but not found in expected location.")),r.info(d.dim("Falling back to manual upload...")),await He(e,t,a,u)}catch(y){l.stop("Certificate fetch failed"),r.error(d.red(`Error: ${y.message}`)),r.info(d.dim("Falling back to manual upload...")),await He(e,t,a,u)}}catch(p){l.stop("iOS setup failed"),r.error(d.red(`Error: ${p.message}`))}finally{if(A)try{h.rmSync(Z.dirname(A),{recursive:!0,force:!0})}catch{}}}async function Ue(e,t){try{await R.post(`/projects/${e}/secrets`,{key:"APPLE_TEAM_ID",value:t,description:"Apple Developer Team ID (used for iOS signing)"}),r.success(d.green(`\u2713 Saved Team ID ${t} to Dashboard`))}catch(n){r.warn(d.yellow(`Could not save Team ID to Dashboard: ${n.message}`))}}async function He(e,t,n,a={}){r.info(d.yellow(`
-Manual Upload Mode`)),r.info("Please provide your certificate and provisioning profile:");let i=await z({message:"Path to .p12 certificate file:",validate:c=>h.existsSync(c)?void 0:"File not found"});k(i)&&(U("Operation cancelled"),process.exit(0));let s=await z({message:"Path to .mobileprovision file:",validate:c=>h.existsSync(c)?void 0:"File not found"});k(s)&&(U("Operation cancelled"),process.exit(0));let o=de();o.start(`Uploading to ${f.name} Dashboard...`);try{await ie(e,i,"ios_cert",t,n,void 0,void 0,a.teamId,void 0,void 0,void 0,void 0,a.teamId,a.teamName,a.developerTeamId||a.teamId,a.appStoreConnectTeamId,a.providerId,a.providerName),await ie(e,s,"ios_profile",t,n,void 0,void 0,a.teamId,void 0,void 0,void 0,void 0,a.teamId,a.teamName,a.developerTeamId||a.teamId,a.appStoreConnectTeamId,a.providerId,a.providerName),o.stop("Upload complete"),r.success(d.green("\u2713 iOS credentials uploaded successfully"))}catch(c){throw o.stop("Upload failed"),c}}async function Wt(e,t,n,a,i){let s=de();r.step(d.blue("Android Credential Setup"));let o=a.bundleId;if(!o){let u=pe(i,t),p=[];try{let g=(await R.get(`/credentials/${e}`)).data.credentials||[];p=[...new Set(g.filter(m=>m.platform==="android"&&m.bundleId&&m.bundleId!=="*").map(m=>m.bundleId))]}catch{}if(u&&!p.includes(u)&&p.unshift(u),p.length>0){let I=[...p.map(m=>({value:m,label:m,hint:m===u?"from config":void 0})),{value:"__new__",label:"+ Enter a new Package Name"}],g=await q({message:"Which Package Name are you setting up credentials for?",options:I});if(k(g)&&(U("Operation cancelled"),process.exit(0)),g==="__new__"){let m=await z({message:"Android Package Name (e.g. com.example.app):",placeholder:"com.example.app",validate:b=>b.includes(".")?void 0:"Please enter a valid package name"});k(m)&&(U("Operation cancelled"),process.exit(0)),o=m}else o=g}else{let I=await z({message:"Android Package Name (e.g. com.example.app):",placeholder:"com.example.app",validate:g=>g.includes(".")?void 0:"Please enter a valid package name"});k(I)&&(U("Operation cancelled"),process.exit(0)),o=I}}try{let I=((await R.get(`/credentials/${e}`)).data.credentials||[]).find(g=>g.platform==="android"&&g.distributionType===n&&g.bundleId===o);if(I){r.warn(d.yellow(`\u26A0\uFE0F  Existing Android credentials found for ${n}`));let g=await z({message:"What would you like to do? (use/new/cancel)",validate:m=>{let b=m.toLowerCase();if(!(b==="use"||b==="new"||b==="cancel"))return"Please type: use, new, or cancel"}});if(k(g)||g.toLowerCase()==="cancel")return;if(g.toLowerCase()==="use"){r.success(d.green("\u2713 Using existing credentials."));return}await R.delete(`/credentials/${I.credentialId}?projectId=${e}`)}}catch{}let c="./android/app/my-release-key.jks";if(h.existsSync(c)){let u=await dt({message:"Upload existing keystore?"});if(u&&!k(u)){let p=await z({message:"Key alias:",initialValue:"my-key-alias"});if(k(p))return;let I=await fe({message:"Keystore password:"});if(k(I))return;let g=await fe({message:"Key password (leave blank if same as keystore password):"});if(k(g))return;let m=g.trim()||I;await ie(e,c,"android_keystore",o,n,p,void 0,void 0,void 0,void 0,I,m),r.success(d.green("\u2713 Keystore uploaded"));return}}r.info(d.blue("Generating new Android keystore..."));let l=a.keyAlias||`${f.nameLower}-${Gt()}`,A=ze(),C=`./${f.nameLower}-${t}.jks`;h.existsSync(C)&&h.unlinkSync(C),s.start("Generating keystore...");try{let u=A.replace(/'/g,"'\\''");O(`keytool -genkeypair -v -keystore "${C}" -alias "${l}" -keyalg RSA -keysize 2048 -validity 10000 -storepass '${u}' -keypass '${u}' -dname "CN=${f.name} Build, OU=Mobile, O=Company, L=City, S=State, C=US"`,{stdio:"inherit"}),s.stop("Keystore generated"),await ie(e,C,"android_keystore",o,n,l,void 0,void 0,void 0,void 0,A,A),r.success(d.green("\u2713 Android credentials uploaded successfully")),r.info(d.cyan(`Key Alias: ${l}`))}catch(u){throw s.stop("Generation failed"),new Error(`Keystore generation failed: ${u.message}`)}}var Vt=e=>new Promise(t=>setTimeout(t,e));function kt(e){return/ECONNRESET|ETIMEDOUT|EAI_AGAIN|ENOTFOUND|ECONNABORTED|socket hang up|network|timeout|temporar/i.test(e)||/API_ERROR:\s*(408|409|425|429|5\d\d)/i.test(e)}async function ie(e,t,n,a,i,s,o,c,l,A,C,u,p,I,g,m,b,D){let x=Z.basename(t);r.info(d.dim(`Uploading ${x} (Isolated process)...`));let _=new URL(import.meta.url),y=Z.dirname(_.pathname),H=[Z.join(y,"commands","isolated-upload.js"),e,t,n,a,i,s||"undefined",o||"undefined",c||"undefined",l||"undefined",A||"undefined",C||"undefined",u||"undefined",p||"undefined",I||"undefined",g||"undefined",m||"undefined",b||"undefined",D||"undefined"],X="",E=5;for(let v=1;v<=E;v++){let J=ne("node",H,{stdio:"pipe",encoding:"utf-8",env:{...process.env,AT_CLI_ISOLATED:"1"}});if(J.status===0&&J.stdout.includes("SUCCESS")){r.info(d.dim(`\u2713 ${x} uploaded and registered.`));return}if(J.status===0){r.warn(d.yellow(`Isolated upload finished but success not confirmed: ${J.stdout}`));return}if(X=(J.stderr||J.stdout||J.error?.message||"Unknown isolated upload failure").trim(),!kt(X)||v>=E)throw r.error(d.red(`Isolated Upload Failed: ${X}`)),new Error(X);let ae=Math.min(3e4,1500*Math.pow(2,v-1));r.warn(d.yellow(`Upload failed with a transient error. Retrying ${x} in ${Math.round(ae/1e3)}s... (${v}/${E})`)),await Vt(ae)}throw new Error(X||"Unknown isolated upload failure")}async function Nt(e){let t=de(),n=e.platform,a=`./${f.configFileName}`;if(!h.existsSync(a)){r.error(`No ${f.configFileName} found. Run \`${f.nameLower} init\` or \`${f.nameLower} link\` first.`);return}let i=JSON.parse(h.readFileSync(a,"utf-8")),{projectId:s}=i;if(!s){r.error(`${f.configFileName} is missing projectId.`);return}try{t.start("Fetching project secrets...");let c=(await R.get(`/projects/${s}/secrets/export?env=all`)).data.secrets||{};t.stop("Secrets fetched and merged."),t.start("Fetching credentials...");let A=(await R.get(`/credentials/${s}`)).data.credentials||[];t.stop(`Found ${A.length} metadata records.`);let C=A.filter(g=>g.platform===n);if(C.length===0){r.info(`No ${n} credentials found on Dashboard.`);return}let u="./credentials.json",p={};if(h.existsSync(u))try{p=JSON.parse(h.readFileSync(u,"utf-8"))}catch{r.warn("Could not parse existing credentials.json, creating a new one.")}p[n]||(p[n]={});let I=Z.join(process.cwd(),"credentials",n);h.existsSync(I)||h.mkdirSync(I,{recursive:!0});for(let g of C){t.start(`Downloading ${g.type} (${g.distributionType})...`);try{let m=await R.get(`/credentials/${g.credentialId}/download`,{params:{projectId:s,format:"raw"}});if(m.data.status==="success"&&m.data.downloadUrl){let b=Z.join(process.cwd(),"credentials",n,g.distributionType);h.existsSync(b)||h.mkdirSync(b,{recursive:!0});let D=g.s3Key?.split(".").pop()||(g.type.includes("keystore")?"jks":g.type.includes("cert")?"p12":"mobileprovision"),x=`${g.type}.${D}`,_=Z.join(b,x),y=await De.get(m.data.downloadUrl,{responseType:"arraybuffer"});h.writeFileSync(_,Buffer.from(y.data));let F=Z.join("credentials",n,g.distributionType,x),H="",X="",E={alias:"",keystorePassword:"",keyPassword:""};if(n==="ios"&&g.type==="ios_cert"||n==="android"&&g.type==="android_keystore"){let v=await mt(s,n,g);if(n==="ios"&&g.type==="ios_cert"&&D.toLowerCase()==="p12"){if(H=It(v,c),H){let J=_e(_,`${Z.basename(_,Z.extname(_))}-password.txt`,H);X=Z.join("credentials",n,g.distributionType,Z.basename(J))}}else if(n==="android"&&g.type==="android_keystore"&&(E=At(v,c),E.keystorePassword||E.keyPassword)){let J=[E.alias?`keyAlias=${E.alias}`:void 0,E.keystorePassword?`keystorePassword=${E.keystorePassword}`:void 0,E.keyPassword?`keyPassword=${E.keyPassword}`:void 0].filter(Boolean).join(`
-`),j=_e(_,`${Z.basename(_,Z.extname(_))}-passwords.txt`,J);X=Z.join("credentials",n,g.distributionType,Z.basename(j))}}if(n==="android")g.type==="android_keystore"&&(p.android.keystore={keystorePath:F,keystorePassword:E.keystorePassword,keyAlias:E.alias,keyPassword:E.keyPassword},X&&(p.android.keystore.keystoreArchivePath=X));else if(n==="ios"){let v=g.distributionType==="store"?"production":g.distributionType==="adhoc"?"staging":"development";p.ios[v]||(p.ios[v]={}),g.type==="ios_cert"?(p.ios[v].certificatePath=F,p.ios[v].certificatePassword=H,X&&(p.ios[v].certificateArchivePath=X)):g.type==="ios_profile"&&(p.ios[v].provisioningProfilePath=F)}t.stop(`\u2713 ${g.type} (${g.distributionType}) saved${X?" with password archive":""}.`)}}catch(m){let b=m.response?.data?.message||m.message;t.stop(d.dim(`- Skipped ${g.type} (${g.distributionType}): ${b}`))}}h.writeFileSync(u,JSON.stringify(p,null,2)),r.success(d.green("\u2713 Local credentials.json updated.")),Oe("Credentials have been synced to your local machine. Ensure credentials.json and credentials/ is added to your .gitignore.","Sync Complete")}catch(o){t.stop(d.red("Sync failed.")),r.error(`Error: ${o.message}`)}}function ze(){let e="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_+=",t="";for(let n=0;n<24;n++)t+=e.charAt(Math.floor(Math.random()*e.length));return t}function Gt(e=8){let t="abcdefghijklmnopqrstuvwxyz0123456789",n="";for(let a=0;a<e;a++)n+=t.charAt(Math.floor(Math.random()*t.length));return n}async function Ft(e,t,n,a){let i=a||await Ze(t,e);if(!i||i.length===0)return!1;let s=await q({message:"Select a certificate to revoke:",options:[...i.map(o=>({value:`revoke:${o.id}`,label:`Revoke: ${o.name} (${o.expires})`})),{value:"nuke",label:"Revoke All"},{value:"cancel",label:"Cancel"}]});return k(s)||s==="cancel"?!1:s==="nuke"?(O(`fastlane match nuke ${e}`,{stdio:"inherit",cwd:process.cwd(),env:t}),!0):typeof s=="string"&&s.startsWith("revoke:")?(await Xt(t,s.split(":")[1]),!0):!1}async function Ze(e,t){let n=t==="development"?"development":"distribution",a=`
-lane :${f.fastlanePrefix}_list_certs do
-  require 'spaceship'
-  require 'json'
-  begin
-    Spaceship::Portal.login(ENV['FASTLANE_USER'])
-    Spaceship::Portal.select_team(team_id: ENV['FASTLANE_TEAM_ID'])
-    output = Spaceship::Portal.certificate.all.select { |c|
-      if "${n}" == "development"
-        c.type_display_id.downcase.include?("development")
-      else
-        c.type_display_id.downcase.include?("distribution") || c.type_display_id.downcase.include?("production")
-      end
-    }.map { |c| { id: c.id, name: c.name, expires: c.expires.strftime('%Y-%m-%d'), type: c.type_display_id } }
-    puts "${f.jsonStartMarker}" + output.to_json + "${f.jsonEndMarker}"
-  rescue => e
-    $stderr.puts "ERROR: #{e.message}"
-    exit 1
-  end
-end`,i=Z.join(ve.tmpdir(),`/tmp/${f.nameLower}-list-certs-${Date.now()}`),s=Z.join(i,"fastlane"),o=Z.join(s,"Fastfile");try{h.existsSync(s)||h.mkdirSync(s,{recursive:!0}),h.writeFileSync(o,a);let l=O(`fastlane ${f.fastlanePrefix}_list_certs`,{env:{...e,CI:"1",FASTLANE_FASTFILE:o},cwd:i,stdio:["inherit","pipe","inherit"]}).toString().match(new RegExp(`${f.jsonStartMarker}(.*)${f.jsonEndMarker}`));return l?JSON.parse(l[1]):[]}finally{h.existsSync(i)&&h.rmSync(i,{recursive:!0,force:!0})}}async function Xt(e,t){let n=`
-lane :${f.fastlanePrefix}_revoke_cert do
-  require 'spaceship'
-  begin
-    Spaceship::Portal.login(ENV['FASTLANE_USER'])
-    Spaceship::Portal.select_team(team_id: ENV['FASTLANE_TEAM_ID'])
-    cert = Spaceship::Portal.certificate.all.find { |c| c.id == "${t}" }
-    cert.revoke! if cert
-  rescue => e
-    $stderr.puts "ERROR: #{e.message}"
-    exit 1
-  end
-end`,a=Z.join(ve.tmpdir(),`/tmp/${f.nameLower}-revoke-cert-${Date.now()}`),i=Z.join(a,"fastlane"),s=Z.join(i,"Fastfile");try{h.existsSync(i)||h.mkdirSync(i,{recursive:!0}),h.writeFileSync(s,n),O(`fastlane ${f.fastlanePrefix}_revoke_cert`,{env:{...e,CI:"1",FASTLANE_FASTFILE:s},cwd:a,stdio:["inherit","pipe","inherit"]})}finally{h.existsSync(a)&&h.rmSync(a,{recursive:!0,force:!0})}}export{Tt as a,qe as b,Pt as c,se as d,xt as e,ee as f,pe as g,ge as h,Yt as i,Ee as j,$e as k,wt as l,Nt as m};