npm - @radhya/mach - Versions diffs - 2.1.2 → 2.1.4 - Mend

@radhya/mach 2.1.2 → 2.1.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (10) hide show

package/README.md +30 -7
package/dist/chunk-LLUM6GHI.js +400 -0
package/dist/{credentials-SOUQOL2C.js → credentials-MVI46MHG.js} +1 -1
package/dist/index.js +379 -463
package/docs/frameworks/expo.md +4 -0
package/docs/frameworks/react-native.md +4 -0
package/docs/push.md +54 -11
package/expo-plugin/index.js +30 -8
package/package.json +1 -1
package/dist/chunk-DX4FCPCX.js +0 -69

package/docs/frameworks/expo.md CHANGED Viewed

@@ -114,6 +114,10 @@ For iOS store builds, set:
 }
 ```
+`"auto"` makes Mach allocate the next scoped Dashboard counter value. You can instead provide an explicit Android positive integer or an iOS value such as `"68"` or `"1.2.3"`; Mach then uses that exact value without incrementing.
+Mach applies the resolved value after Expo prebuild, so `app.json` or `app.config.*` cannot silently replace it. The Expo `version` field remains the public marketing version. Mach verifies the packaged IPA/AAB/APK native version before reporting a successful build.
 This updates native build numbers only. Apple also requires the marketing version to increase when a released version train is closed. In Expo projects, that is usually `expo.version` in `app.json` or `app.config.*`.
 ## Common Commands

package/docs/frameworks/react-native.md CHANGED Viewed

@@ -90,6 +90,8 @@ Mach uses the existing native iOS project. If multiple schemes exist, set the sc
 For store builds, upload iOS signing credentials and App Store Connect credentials from the Dashboard or CLI.
+`ios.buildNumber: "auto"` allocates the next scoped Dashboard value. An explicit value is used exactly as configured. Mach applies the resolved value to the app and extension targets, then verifies the final IPA before upload.
 ## Android Notes
 Mach runs Gradle from `android/gradlew` when present. Production builds default to `bundleRelease`; internal builds default to `assembleRelease`; development-client style builds default to `assembleDebug`.
@@ -107,6 +109,8 @@ Set package and version code at the root:
 For Google Play submission, upload a Google Play service account credential for the exact package id. Mach-managed versionCode assignment uses the Dashboard counter and does not require a Google Play service key.
+An explicit `android.versionCode` is used without incrementing the Dashboard counter. The `"auto"` value enables atomic counter allocation. Mach injects the resolved value at the Gradle variant level (including Groovy or Kotlin DSL projects) and verifies the packaged APK/AAB before upload.
 ## Development Builds
 Bare React Native does not use Expo development-client behavior. If a profile contains `developmentClient`, Mach ignores Expo-only dev-client environment handling unless `framework` is `expo`.

package/docs/push.md CHANGED Viewed

@@ -22,8 +22,13 @@ The command writes public SDK values to a generated file. It creates a separate
 application-owned callback file for foreground notifications, notification
 taps, registration, permission changes, and errors. Running setup again
 refreshes generated configuration but never overwrites those callbacks.
+The generated SDK file also omits default values; production uses the hosted
+MACH API unless you configure a custom API URL or non-production environment.
+`mach.config.json` only records that push is enabled; the mobile SDK registers
+with the top-level project ID, and Mach resolves the project's single active
+push app on the server.
 If an administrator deleted the server-side push app, running setup again
-detects the stale local key and safely creates or links a replacement.
+safely creates or links a replacement for the project.
 Expo setup also installs and wires `@radhya/mach/expo-plugin`. The plugin adds
 the APNs entitlement, Android notification permission, Firebase config path,
@@ -36,18 +41,56 @@ push app without installing or wiring a mobile SDK.
 ## Provider credentials
 ```bash
-mach push credentials apns \
-  --file AuthKey_ABC123DEFG.p8 \
-  --team-id ABC123DEFG \
-  --key-id ABC123DEFG \
-  --environment development
-mach push credentials fcm \
-  --file firebase-service-account.json \
-  --environment production
+mach credentials
 ```
-Provider credentials are encrypted and never returned by the API.
+Choose Push Notifications from the credentials menu. On iOS, Mach can generate
+one APNs auth key with Apple or upload an existing `.p8`. On Android, upload the
+Firebase service-account JSON once for the selected Android package. FCM uses
+that package-wide credential for development, preview, and production. APNs
+can be saved for all environments or only one environment. If Apple reports
+the APNs key limit, Mach can list existing APNs keys, revoke one after
+confirmation, and retry creation.
+Provider secrets are encrypted and never returned by the API. The Dashboard
+shows the same records in **Credentials → Service credentials** for the
+selected bundle identifier or package name.
+### Generate the Firebase service-account JSON
+1. Open the [Firebase Console](https://console.firebase.google.com/) and select
+   the project used by the Android app.
+2. Open **Project settings → General → Your apps** and confirm the exact Android
+   package matches the package linked to MACH. If the app already has
+   `google-services.json`, compare its `project_info.project_id` with the
+   Firebase Project ID. Do not give that client configuration file to MACH.
+3. Open **Project settings → Cloud Messaging** and confirm **Firebase Cloud
+   Messaging API (V1)** is enabled.
+4. Open **Project settings → Service accounts → Firebase Admin SDK**, choose
+   **Generate new private key**, then confirm **Generate key**.
+5. Run `mach credentials`, select **Android → Push Notifications**, and choose
+   the downloaded JSON. Mach stores one FCM credential for the selected Android
+   package; there is no environment selection.
+The service-account JSON must contain `type: "service_account"`, `project_id`,
+`private_key_id`, `private_key`, `client_email`, and `token_uri`. It is not
+Android's `google-services.json`. Never commit or share this server credential.
+Common blockers:
+- If **Generate new private key** is unavailable, ask a project administrator
+  for Service Account Key Admin (`roles/iam.serviceAccountKeyAdmin`). An
+  organization policy can also prohibit JSON key creation.
+- For an FCM 403, confirm FCM API (V1) is enabled and the service account has
+  Firebase Cloud Messaging API Admin
+  (`roles/firebasecloudmessaging.admin`).
+- A newly generated key can require about one minute before it works.
+- A Sender ID mismatch means the credential and device token belong to
+  different Firebase projects; correct the app configuration and register a
+  fresh token.
+See Firebase's
+[Admin SDK key guide](https://firebase.google.com/docs/admin/setup#initialize_the_sdk_in_non-google_environments)
+and [FCM error reference](https://firebase.google.com/docs/cloud-messaging/error-codes).
 ## Send

package/expo-plugin/index.js CHANGED Viewed

@@ -49,6 +49,32 @@ const readMachConfig = config => {
   return JSON.parse(fs.readFileSync(configPath, 'utf-8'))
 }
+const projectRootForConfig = config => config && config._internal && config._internal.projectRoot
+  ? config._internal.projectRoot
+  : process.cwd()
+const defaultGoogleServicesFile = projectRoot => [
+  'google-services.json',
+  'android/app/google-services.json',
+].find(candidate => fs.existsSync(path.join(projectRoot, candidate)))
+const publicPushConfig = push => {
+  const value = {
+    projectId: push.projectId,
+  }
+  if (push.appId && push.publishableKey) {
+    value.appId = push.appId
+    value.publishableKey = push.publishableKey
+  }
+  if (push.apiUrl && push.apiUrl !== 'https://mach-api.securejs.in') {
+    value.apiUrl = push.apiUrl
+  }
+  if (push.environment && push.environment !== 'production') {
+    value.environment = push.environment
+  }
+  return value
+}
 const resolveBuildProfile = (machConfig, name, seen = new Set()) => {
   const profiles = machConfig.build || {}
   const profile = profiles[name]
@@ -115,14 +141,16 @@ const resolveOta = config => {
 const resolvePush = config => {
   const machConfig = readMachConfig(config)
   const push = machConfig.push || {}
+  const projectRoot = projectRootForConfig(config)
   return {
     ...push,
-    enabled: push.enabled !== false && Boolean(push.appId && push.publishableKey),
+    enabled: push.enabled === true || Boolean(push.appId && push.publishableKey),
     projectId: machConfig.projectId,
     apiUrl: first(process.env.MACH_PUSH_API_URL, push.apiUrl) || 'https://mach-api.securejs.in',
     environment: nonEmpty(push.environment) || 'production',
     iosEnvironment: nonEmpty(push.iosEnvironment) ||
       (push.environment === 'development' ? 'development' : 'production'),
+    googleServicesFile: first(push.googleServicesFile, defaultGoogleServicesFile(projectRoot)),
   }
 }
@@ -166,13 +194,7 @@ module.exports = function withMachDeepLinks(config) {
   if (push.enabled) {
     config.extra.mach = {
       ...(config.extra.mach || {}),
-      push: {
-        projectId: push.projectId,
-        appId: push.appId,
-        publishableKey: push.publishableKey,
-        apiUrl: push.apiUrl,
-        environment: push.environment,
-      },
+      push: publicPushConfig(push),
     }
     config.ios = config.ios || {}
     config.ios.entitlements = {

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@radhya/mach",
-  "version": "2.1.2",
+  "version": "2.1.4",
   "description": "Mach CLI: Cloud Build Orchestrator for React Native & Expo",
   "main": "dist/index.js",
   "type": "module",

package/dist/chunk-DX4FCPCX.js DELETED Viewed

@@ -1,69 +0,0 @@
-import{a as m,h as V}from"./chunk-S64YFTRR.js";import{log as o,spinner as Ae,text as q,password as ve,select as ne,confirm as dt,isCancel as T,cancel as H,intro as Jt,outro as Ut,note as ct}from"@clack/prompts";import{log as N,spinner as Ie,text as Q,select as le,isCancel as Y,cancel as L,note as we,confirm as Ke}from"@clack/prompts";import F from"chalk";import{spawnSync as fe}from"child_process";import E from"fs";import U from"path";import Ge from"os";import ye from"fs";import{log as At}from"@clack/prompts";var Ct=["react-native","expo","flutter"],Wn="react-native",He=e=>{if(typeof e!="string")return;let t=e.trim();return t.length>0?t:void 0},Ue=e=>He(e)?.toUpperCase()||void 0,he=(...e)=>{for(let t of e){let n=He(t);if(n)return n}};function yt(e){if(typeof e!="string")return;let t=e.trim().toLowerCase();if(t==="react-native"||t==="react_native"||t==="reactnative")return"react-native";if(t==="expo")return"expo";if(t==="flutter")return"flutter"}function Vn(e){let t=yt(e?.framework);if(t)return t;let n=Ct.map(a=>`"${a}"`).join(", ");throw e?.framework?new Error(`${m.configFileName} has invalid framework "${e.framework}". Use one of: ${n}.`):new Error(`${m.configFileName} is missing required field "framework". Add one of: ${n}.`)}function ge(e,t="production"){let n=e?.ios||{},a=e?.submit?.[t]?.ios||{},i=e?.submit?.production?.ios||{},r=Ue(n.appleTeamId||n.developerTeamId||a.appleTeamId||a.developerTeamId||i.appleTeamId||i.developerTeamId),s=he(n.appStoreConnectTeamId,n.itcTeamId,n.appleConnectTeamId,a.appStoreConnectTeamId,a.itcTeamId,a.appleConnectTeamId,i.appStoreConnectTeamId,i.itcTeamId,i.appleConnectTeamId);return{teamId:r,teamName:he(n.appleTeamName,n.teamName,n.developerTeamName,a.appleTeamName,a.teamName,a.developerTeamName,i.appleTeamName,i.teamName,i.developerTeamName),developerTeamId:Ue(n.developerTeamId||a.developerTeamId||i.developerTeamId||r),appStoreConnectTeamId:s,providerId:he(n.providerId,a.providerId,i.providerId,s),providerName:he(n.providerName,n.appStoreConnectTeamName,a.providerName,a.appStoreConnectTeamName,i.providerName,i.appStoreConnectTeamName)}}function kn(e){if(e){if(!ye.existsSync(e))return null;try{return JSON.parse(ye.readFileSync(e,"utf-8"))}catch{return null}}if(!ye.existsSync(`./${m.configFileName}`))return null;try{return JSON.parse(ye.readFileSync(`./${m.configFileName}`,"utf-8"))}catch{return null}}function re(e,t,n=new Set){if(n.has(t))throw new Error(`Circular inheritance detected in profile: ${t}`);n.add(t);let a=e.build?.[t];if(!a)return null;let i={...a};if(a.extends){let r=re(e,a.extends,n);r&&(i={...r,...a,env:{...r.env,...a.env},ios:{...r.ios,...a.ios},android:{...r.android,...a.android}})}if(i.envGroups&&Array.isArray(i.envGroups)){let r={};for(let s of i.envGroups){let l=e.envGroups?.[s];l?Object.assign(r,l):At.warn(`Environment group not found: ${s}`)}i.env={...r,...i.env}}return i}function be(e,t){let n=t?re(e,t)||{}:{};if(n.android?.package)return n.android.package;if(n.androidPackage)return n.androidPackage;if(e.android?.package)return e.android.package;if(e.expo?.android?.package)return e.expo.android.package}function Se(e,t){let n=t?re(e,t)||{}:{};if(n.ios?.bundleIdentifier)return n.ios.bundleIdentifier;if(n.iosBundleIdentifier)return n.iosBundleIdentifier;if(e.ios?.bundleIdentifier)return e.ios.bundleIdentifier;if(e.ios?.bundleId)return e.ios.bundleId;if(e.expo?.ios?.bundleIdentifier)return e.expo.ios.bundleIdentifier}var Nn=(e,t=`${m.envPrefix}`)=>{let n={},a=(i,r)=>{if(i)for(let s in i){let l=i[s],c=`${r}${s.toUpperCase().replace(/[^A-Z0-9]/g,"_")}`;l!==null&&typeof l=="object"&&!Array.isArray(l)?a(l,`${c}_`):n[c]=String(l)}};return a(e,t),n};import{cancel as We,confirm as ht,isCancel as Ve,log as ie,select as bt,text as St}from"@clack/prompts";import ae from"chalk";import wt from"fs";import{createRequire as vt}from"module";import Zt from"os";import $e from"path";var Rt=vt(import.meta.url),Re=null;function Wt(){return Re||(Re=Rt("@expo/apple-utils")),Re}function se(){let e=process.env.HOME||Zt.homedir(),t=process.env.FASTLANE_GEM_HOME||$e.join(e,".local/share/fastlane/3.4.0");return{...process.env,PATH:[process.env.FASTLANE_BIN_DIR,"/usr/local/opt/ruby/bin","/opt/homebrew/opt/ruby/bin","/usr/local/bin","/opt/homebrew/bin","/usr/local/Cellar/fastlane/2.227.0/libexec/bin","/opt/homebrew/Cellar/fastlane/2.227.0/libexec/bin",$e.join(t,"bin"),process.env.PATH].filter(Boolean).join(":"),GEM_HOME:t,GEM_PATH:[t,"/usr/local/Cellar/fastlane/2.227.0/libexec","/opt/homebrew/Cellar/fastlane/2.227.0/libexec",process.env.GEM_PATH].filter(Boolean).join(":"),FASTLANE_INSTALLED_VIA_HOMEBREW:"true",FASTLANE_SKIP_UPDATE_CHECK:"1",FASTLANE_HIDE_CHANGELOG:"1",LANG:process.env.LANG||"en_US.UTF-8",LC_ALL:process.env.LC_ALL||"en_US.UTF-8",CI:"1"}}function Vt(e,t="production"){return e.submit||(e.submit={}),e.submit[t]||(e.submit[t]={}),e.submit[t].ios||(e.submit[t].ios={}),e.submit[t].ios}function kt(e,t,n="production"){if(!e||!t.id)return;let a=Vt(e,n);a.appleTeamId=t.id;try{wt.writeFileSync(`./${m.configFileName}`,JSON.stringify(e,null,2))}catch{}}function Nt(e){let t=String(e?.teamId||e?.id||"").trim().toUpperCase();return t?{id:t,name:String(e?.name||"").trim()||void 0,type:String(e?.type||"").trim()||void 0}:null}async function Tt(e){try{let{Auth:t,Teams:n}=Wt(),a=await t.loginAsync({username:e},{autoResolveProvider:!0}),i=String(a?.context?.teamId||"").trim().toUpperCase(),r=await n.getTeamsAsync(),s=new Map;for(let f of r||[]){let I=Nt(f);I&&s.set(I.id,I)}let l=Array.from(s.values()),c=i?l.find(f=>f.id===i)||{id:i}:void 0;return{teams:l,selectedTeam:c}}catch(t){let n=t instanceof Error?t.message:String(t||"");return ie.warn(ae.yellow(`Apple Developer team lookup failed${n?`: ${n}`:""}`)),{teams:[]}}}async function Oe(){ie.warn(ae.yellow(`
-Apple Team ID is required to fetch certificates.`)),ie.info(ae.dim("You can find this at: https://developer.apple.com/account -> Membership Details"));let e=await St({message:"Enter your 10-character Apple Team ID:",placeholder:"e.g. SA56KTS33U",validate:t=>/^[A-Z0-9]{10}$/i.test(t.trim())?void 0:"Team ID must be exactly 10 letters/numbers"});return Ve(e)?(We("Operation cancelled"),null):{id:e.trim().toUpperCase()}}function Ft(e){let t=[e.id,e.type].filter(Boolean);return t.length>0?t.join(" \xB7 "):void 0}async function Gt(e,t){if(!e.config)return!1;if(e.persistConfig)return!0;if(!e.promptToPersistConfig)return!1;let n=e.profile||"production",a=await ht({message:`Save Apple Team ID ${t} to ${m.configFileName} for "${n}" profile?`,initialValue:n==="production"});return Ve(a)?(We("Operation cancelled"),null):a}async function me(e){let t=e.initialTeam?.teamId?.trim().toUpperCase();if(t){let f=e.initialTeam?.developerTeamId?.trim().toUpperCase();return{...e.initialTeam,teamId:t,developerTeamId:f||t}}ie.info(ae.blue("Fetching Apple Developer teams..."));let{teams:n,selectedTeam:a}=await Tt(e.appleId),i;if(a)i=a,ie.success(ae.green(`\u2713 Using Apple Developer team ${i.name||i.id} (${i.id})`));else if(n.length===1)i=n[0],ie.success(ae.green(`\u2713 Using Apple Developer team ${i.name||i.id} (${i.id})`));else if(n.length>1){let f=await bt({message:"Select Apple Developer team:",options:[...n.map(I=>({value:I.id,label:I.name||I.id,hint:Ft(I)})),{value:"__manual__",label:"Enter Team ID manually",hint:"Use if your team is not listed"}]});if(Ve(f))return We("Operation cancelled"),null;i=f==="__manual__"?await Oe():n.find(I=>I.id===f)||{id:f}}else ie.warn(ae.yellow("Could not list Apple Developer teams automatically.")),i=await Oe();if(!i)return null;let r=i.id.trim().toUpperCase(),s=i.name?.trim(),l={...e.initialTeam,teamId:r,teamName:s||e.initialTeam?.teamName,developerTeamId:r},c=await Gt(e,r);return c===null?null:(c&&kt(e.config,{...i,id:r,name:s},e.profile),e.saveTeamId&&await e.saveTeamId(r,s),l)}var Et="cmVxdWlyZSAnc3BhY2VzaGlwJwpyZXF1aXJlICdqc29uJwoKZGVmIHJlYWRfdGVhbV9maWVsZCh0ZWFtLCAqa2V5cykKICBrZXlzLmVhY2ggZG8gfGtleXwKICAgIGJlZ2luCiAgICAgIHZhbHVlID0gdGVhbVtrZXldIGlmIHRlYW0ucmVzcG9uZF90bz8oOltdKQogICAgICByZXR1cm4gdmFsdWUgaWYgdmFsdWUgJiYgdmFsdWUudG9fcy5sZW5ndGggPiAwCiAgICByZXNjdWUKICAgIGVuZAoKICAgIG1ldGhvZF9uYW1lID0ga2V5LnRvX3MKICAgIGlmIHRlYW0ucmVzcG9uZF90bz8obWV0aG9kX25hbWUpCiAgICAgIHZhbHVlID0gdGVhbS5wdWJsaWNfc2VuZChtZXRob2RfbmFtZSkKICAgICAgcmV0dXJuIHZhbHVlIGlmIHZhbHVlICYmIHZhbHVlLnRvX3MubGVuZ3RoID4gMAogICAgZW5kCiAgZW5kCgogIG5pbAplbmQKCmRlZiBub3JtYWxpemVfdGVhbV9uYW1lKG5hbWUpCiAgbmFtZS50b19zLmRvd25jYXNlLmdzdWIoL1teYS16MC05XSsvLCAnICcpLnN0cmlwCmVuZAoKZGVmIHBvcnRhbF90ZWFtX25hbWUKICB0ZWFtX2lkID0gRU5WWydGQVNUTEFORV9URUFNX0lEJ10udG9fcwogIHRlYW1zID0gU3BhY2VzaGlwOjpQb3J0YWwuY2xpZW50LnRlYW1zCiAgdGVhbXMgPSB0ZWFtcy52YWx1ZXMgaWYgdGVhbXMuaXNfYT8oSGFzaCkKCiAgdGVhbSA9IEFycmF5KHRlYW1zKS5maW5kIGRvIHx0fAogICAgWwogICAgICByZWFkX3RlYW1fZmllbGQodCwgJ3RlYW1JZCcsIDp0ZWFtSWQpLAogICAgICByZWFkX3RlYW1fZmllbGQodCwgJ3RlYW1faWQnLCA6dGVhbV9pZCksCiAgICAgIHJlYWRfdGVhbV9maWVsZCh0LCAnaWQnLCA6aWQpCiAgICBdLmNvbXBhY3QubWFwKCY6dG9fcykuaW5jbHVkZT8odGVhbV9pZCkKICBlbmQKCiAgcmVhZF90ZWFtX2ZpZWxkKHRlYW0sICduYW1lJywgOm5hbWUsICd0ZWFtTmFtZScsIDp0ZWFtTmFtZSwgJ2Rpc3BsYXlOYW1lJywgOmRpc3BsYXlOYW1lKQpyZXNjdWUgPT4gZQogICRzdGRlcnIucHV0cyAiREVCVUc6IENvdWxkIG5vdCByZXNvbHZlIERldmVsb3BlciBQb3J0YWwgdGVhbSBuYW1lOiAje2UubWVzc2FnZX0iCiAgbmlsCmVuZAoKZGVmIHR1bmVzX3RlYW1faWQodGVhbSkKICByZWFkX3RlYW1fZmllbGQoCiAgICB0ZWFtLAogICAgJ3Byb3ZpZGVySWQnLCA6cHJvdmlkZXJJZCwKICAgICdwcm92aWRlcl9pZCcsIDpwcm92aWRlcl9pZCwKICAgICdjb250ZW50UHJvdmlkZXJJZCcsIDpjb250ZW50UHJvdmlkZXJJZCwKICAgICdjb250ZW50X3Byb3ZpZGVyX2lkJywgOmNvbnRlbnRfcHJvdmlkZXJfaWQsCiAgICAndGVhbUlkJywgOnRlYW1JZCwKICAgICd0ZWFtX2lkJywgOnRlYW1faWQsCiAgICAnaWQnLCA6aWQKICApLnRvX3MKZW5kCgpkZWYgdHVuZXNfdGVhbV9uYW1lKHRlYW0pCiAgcmVhZF90ZWFtX2ZpZWxkKAogICAgdGVhbSwKICAgICduYW1lJywgOm5hbWUsCiAgICAnY29udGVudFByb3ZpZGVyTmFtZScsIDpjb250ZW50UHJvdmlkZXJOYW1lLAogICAgJ2NvbnRlbnRfcHJvdmlkZXJfbmFtZScsIDpjb250ZW50X3Byb3ZpZGVyX25hbWUsCiAgICAndGVhbU5hbWUnLCA6dGVhbU5hbWUsCiAgICAnZGlzcGxheU5hbWUnLCA6ZGlzcGxheU5hbWUKICApLnRvX3MKZW5kCgpkZWYgYXZhaWxhYmxlX3R1bmVzX3RlYW1zCiAgdGVhbXMgPSBTcGFjZXNoaXA6OlR1bmVzLmNsaWVudC50ZWFtcwogIHRlYW1zID0gdGVhbXMudmFsdWVzIGlmIHRlYW1zLmlzX2E/KEhhc2gpCiAgQXJyYXkodGVhbXMpCnJlc2N1ZSA9PiBlCiAgJHN0ZGVyci5wdXRzICJERUJVRzogQ291bGQgbm90IGluc3BlY3QgQXBwIFN0b3JlIENvbm5lY3QgdGVhbXM6ICN7ZS5tZXNzYWdlfSIKICBbXQplbmQKCmRlZiBzZWxlY3RfYXBwX3N0b3JlX2Nvbm5lY3RfdGVhbQogIGV4cGxpY2l0X3RlYW1faWQgPSBFTlZbJ0ZBU1RMQU5FX0lUQ19URUFNX0lEJ10gfHwgRU5WWydGQVNUTEFORV9BU0NfVEVBTV9JRCddCiAgaWYgZXhwbGljaXRfdGVhbV9pZCAmJiBleHBsaWNpdF90ZWFtX2lkLnRvX3MubGVuZ3RoID4gMAogICAgU3BhY2VzaGlwOjpUdW5lcy5zZWxlY3RfdGVhbSh0ZWFtX2lkOiBleHBsaWNpdF90ZWFtX2lkKQogICAgcmV0dXJuIGV4cGxpY2l0X3RlYW1faWQKICBlbmQKCiAgZGV2ZWxvcGVyX3RlYW1faWQgPSBFTlZbJ0ZBU1RMQU5FX1RFQU1fSUQnXS50b19zCiAgZGV2ZWxvcGVyX3RlYW1fbmFtZSA9IHBvcnRhbF90ZWFtX25hbWUKICB0ZWFtcyA9IGF2YWlsYWJsZV90dW5lc190ZWFtcwoKICBpZiBkZXZlbG9wZXJfdGVhbV9uYW1lICYmIGRldmVsb3Blcl90ZWFtX25hbWUubGVuZ3RoID4gMAogICAgbm9ybWFsaXplZF9kZXZlbG9wZXJfbmFtZSA9IG5vcm1hbGl6ZV90ZWFtX25hbWUoZGV2ZWxvcGVyX3RlYW1fbmFtZSkKICAgIG1hdGNoZWRfdGVhbSA9IHRlYW1zLmZpbmQgeyB8dGVhbXwgbm9ybWFsaXplX3RlYW1fbmFtZSh0dW5lc190ZWFtX25hbWUodGVhbSkpID09IG5vcm1hbGl6ZWRfZGV2ZWxvcGVyX25hbWUgfQoKICAgIGlmIG1hdGNoZWRfdGVhbQogICAgICBtYXRjaGVkX2lkID0gdHVuZXNfdGVhbV9pZChtYXRjaGVkX3RlYW0pCiAgICAgIG1hdGNoZWRfbmFtZSA9IHR1bmVzX3RlYW1fbmFtZShtYXRjaGVkX3RlYW0pCiAgICAgIFNwYWNlc2hpcDo6VHVuZXMuc2VsZWN0X3RlYW0odGVhbV9pZDogbWF0Y2hlZF9pZCkKICAgICAgJHN0ZGVyci5wdXRzICJERUJVRzogQXV0by1zZWxlY3RlZCBBcHAgU3RvcmUgQ29ubmVjdCB0ZWFtICN7bWF0Y2hlZF9pZH0gKCN7bWF0Y2hlZF9uYW1lfSkgZm9yIERldmVsb3BlciBUZWFtICN7ZGV2ZWxvcGVyX3RlYW1faWR9IgogICAgICByZXR1cm4gbWF0Y2hlZF9pZAogICAgZW5kCiAgZW5kCgogIGlmIHRlYW1zLmxlbmd0aCA9PSAxCiAgICBvbmx5X3RlYW0gPSB0ZWFtcy5maXJzdAogICAgb25seV90ZWFtX2lkID0gdHVuZXNfdGVhbV9pZChvbmx5X3RlYW0pCiAgICBTcGFjZXNoaXA6OlR1bmVzLnNlbGVjdF90ZWFtKHRlYW1faWQ6IG9ubHlfdGVhbV9pZCkKICAgICRzdGRlcnIucHV0cyAiREVCVUc6IEF1dG8tc2VsZWN0ZWQgb25seSBBcHAgU3RvcmUgQ29ubmVjdCB0ZWFtICN7b25seV90ZWFtX2lkfSAoI3t0dW5lc190ZWFtX25hbWUob25seV90ZWFtKX0pIgogICAgcmV0dXJuIG9ubHlfdGVhbV9pZAogIGVuZAoKICAkc3RkZXJyLnB1dHMgIkVSUk9SOiBDb3VsZCBub3QgbWFwIEFwcGxlIERldmVsb3BlciBUZWFtIElEICcje2RldmVsb3Blcl90ZWFtX2lkfScje2RldmVsb3Blcl90ZWFtX25hbWUgPyAiICgje2RldmVsb3Blcl90ZWFtX25hbWV9KSIgOiAnJ30gdG8gQXBwIFN0b3JlIENvbm5lY3QuIgogICRzdGRlcnIucHV0cyAiQXZhaWxhYmxlIEFwcCBTdG9yZSBDb25uZWN0IHRlYW1zOiIKICB0ZWFtcy5lYWNoIGRvIHx0ZWFtfAogICAgJHN0ZGVyci5wdXRzICItICN7dHVuZXNfdGVhbV9pZCh0ZWFtKX0gKCN7dHVuZXNfdGVhbV9uYW1lKHRlYW0pfSkiCiAgZW5kCiAgZXhpdCAxCmVuZAoKZGVmIGxpc3RfdGVhbXMKICBiZWdpbgogICAgU3BhY2VzaGlwOjpQb3J0YWwubG9naW4oRU5WWydGQVNUTEFORV9VU0VSJ10pCiAgICBTcGFjZXNoaXA6OlBvcnRhbC5zZWxlY3RfdGVhbSh0ZWFtX2lkOiBFTlZbJ0ZBU1RMQU5FX1RFQU1fSUQnXSkKCiAgICBkZXZlbG9wZXJfdGVhbV9uYW1lID0gcG9ydGFsX3RlYW1fbmFtZQoKICAgIFNwYWNlc2hpcDo6VHVuZXMubG9naW4oRU5WWydGQVNUTEFORV9VU0VSJ10pCiAgICBub3JtYWxpemVkX2RldmVsb3Blcl9uYW1lID0gbm9ybWFsaXplX3RlYW1fbmFtZShkZXZlbG9wZXJfdGVhbV9uYW1lKQogICAgdGVhbXMgPSBhdmFpbGFibGVfdHVuZXNfdGVhbXMubWFwIGRvIHx0ZWFtfAogICAgICB0ZWFtX25hbWUgPSB0dW5lc190ZWFtX25hbWUodGVhbSkKICAgICAgewogICAgICAgIGlkOiB0dW5lc190ZWFtX2lkKHRlYW0pLAogICAgICAgIG5hbWU6IHRlYW1fbmFtZSwKICAgICAgICByZWNvbW1lbmRlZDogbm9ybWFsaXplZF9kZXZlbG9wZXJfbmFtZS5sZW5ndGggPiAwICYmIG5vcm1hbGl6ZV90ZWFtX25hbWUodGVhbV9uYW1lKSA9PSBub3JtYWxpemVkX2RldmVsb3Blcl9uYW1lCiAgICAgIH0KICAgIGVuZAoKICAgIHB1dHMgIl9fX01BQ0hfSlNPTl9TVEFSVF9fXyIgKyB7CiAgICAgIGRldmVsb3BlclRlYW1JZDogRU5WWydGQVNUTEFORV9URUFNX0lEJ10sCiAgICAgIGRldmVsb3BlclRlYW1OYW1lOiBkZXZlbG9wZXJfdGVhbV9uYW1lLAogICAgICB0ZWFtczogdGVhbXMKICAgIH0udG9fanNvbiArICJfX19NQUNIX0pTT05fRU5EX19fIgogIHJlc2N1ZSA9PiBlCiAgICAkc3RkZXJyLnB1dHMgIkVSUk9SOiAje2UubWVzc2FnZX0iCiAgICBleGl0IDEKICBlbmQKZW5kCgpkZWYgbGlzdF9rZXlzCiAgYmVnaW4KICAgIFNwYWNlc2hpcDo6UG9ydGFsLmxvZ2luKEVOVlsnRkFTVExBTkVfVVNFUiddKQogICAgU3BhY2VzaGlwOjpQb3J0YWwuc2VsZWN0X3RlYW0odGVhbV9pZDogRU5WWydGQVNUTEFORV9URUFNX0lEJ10pCiAgICAKICAgIFNwYWNlc2hpcDo6VHVuZXMubG9naW4oRU5WWydGQVNUTEFORV9VU0VSJ10pCiAgICBzZWxlY3RfYXBwX3N0b3JlX2Nvbm5lY3RfdGVhbQogICAgCiAgICAjIFVzZSBUdW5lcyBjbGllbnQgd2hpY2ggcG9pbnRzIHRvIGFwcHN0b3JlY29ubmVjdC5hcHBsZS5jb20KICAgIGNsaWVudCA9IFNwYWNlc2hpcDo6VHVuZXMuY2xpZW50CiAgICAjIFVzZSByb290LXJlbGF0aXZlIFVSTCB0byByZXBsYWNlIHRoZSBkZWZhdWx0IFR1bmVzIHBhdGggKC9XZWJPYmplY3RzLy4uLikKICAgIHJlc3BvbnNlID0gY2xpZW50LnJlcXVlc3QoOmdldCwgJy9pcmlzL3YxL2FwaUtleXMnKQogICAgCiAgICBpZiByZXNwb25zZS5ib2R5Lm5pbD8gfHwgIXJlc3BvbnNlLmJvZHkuaXNfYT8oSGFzaCkKICAgICAgcmFpc2UgIkFQSSByZXR1cm5lZCBlbXB0eSBvciBpbnZhbGlkIHJlc3BvbnNlIGJvZHkgZm9yIGxpc3Rpbmcga2V5cyIKICAgIGVuZAogICAgCiAgICAkc3RkZXJyLnB1dHMgIkRFQlVHOiBGdWxsIExpc3QgUmVzcG9uc2U6ICN7cmVzcG9uc2UuYm9keS50b19qc29ufSIKICAgIAogICAga2V5cyA9IHJlc3BvbnNlLmJvZHlbJ2RhdGEnXSB8fCBbXQogICAgCiAgICBvdXRwdXQgPSBrZXlzLm1hcCBkbyB8a3wKICAgICAgYXR0ciA9IGtbJ2F0dHJpYnV0ZXMnXSB8fCB7fQogICAgICB7CiAgICAgICAgaWQ6IGtbJ2lkJ10sCiAgICAgICAgbmFtZTogYXR0clsnbmFtZSddLAogICAgICAgIGlzc3VlcklkOiBhdHRyWydpc3N1ZXJJZCddLAogICAgICAgIHJvbGU6IGF0dHJbJ3JvbGVzJ10mLmZpcnN0LAogICAgICAgIHJldm9jYWJsZTogYXR0clsncmV2b2NhYmxlJ10KICAgICAgfQogICAgZW5kCiAgICAKICAgIHB1dHMgIl9fX01BQ0hfSlNPTl9TVEFSVF9fXyIgKyBvdXRwdXQudG9fanNvbiArICJfX19NQUNIX0pTT05fRU5EX19fIgogIHJlc2N1ZSA9PiBlCiAgICAkc3RkZXJyLnB1dHMgIkVSUk9SOiAje2UubWVzc2FnZX0iCiAgICBpZiBkZWZpbmVkPyhyZXNwb25zZSkgJiYgcmVzcG9uc2UgJiYgcmVzcG9uc2UuYm9keQogICAgICAkc3RkZXJyLnB1dHMgIlJlc3BvbnNlIEJvZHk6ICN7cmVzcG9uc2UuYm9keS50b19qc29ufSIKICAgIGVuZAogICAgZXhpdCAxCiAgZW5kCmVuZAoKZGVmIGNyZWF0ZV9rZXkobmFtZSwgcm9sZSA9ICdBRE1JTicpCiAgYmVnaW4KICAgIFNwYWNlc2hpcDo6UG9ydGFsLmxvZ2luKEVOVlsnRkFTVExBTkVfVVNFUiddKQogICAgU3BhY2VzaGlwOjpQb3J0YWwuc2VsZWN0X3RlYW0odGVhbV9pZDogRU5WWydGQVNUTEFORV9URUFNX0lEJ10pCiAgICAKICAgIFNwYWNlc2hpcDo6VHVuZXMubG9naW4oRU5WWydGQVNUTEFORV9VU0VSJ10pCiAgICBzZWxlY3RfYXBwX3N0b3JlX2Nvbm5lY3RfdGVhbQogICAgCiAgICBjbGllbnQgPSBTcGFjZXNoaXA6OlR1bmVzLmNsaWVudAogICAgCiAgICAjIFRydW5jYXRlIG5pY2tuYW1lIHRvIDMwIGNoYXJzIGFzIHBlciBBcHBsZSdzIGxpbWl0CiAgICAjIFdlIGtlZXAgdGhlIG9yaWdpbmFsICduYW1lJyBmb3IgbG9nZ2luZyBidXQgc2VuZCB0cnVuY2F0ZWQgJ25pY2tuYW1lJyB0byBBUEkKICAgIHNhZmVfbmlja25hbWUgPSBuYW1lWzAsIDMwXQogICAgCiAgICBwYXlsb2FkID0gewogICAgICBkYXRhOiB7CiAgICAgICAgdHlwZTogImFwaUtleXMiLAogICAgICAgIGF0dHJpYnV0ZXM6IHsKICAgICAgICAgIG5pY2tuYW1lOiBzYWZlX25pY2tuYW1lLAogICAgICAgICAga2V5VHlwZTogIlBVQkxJQ19BUEkiLAogICAgICAgICAgcm9sZXM6IFtyb2xlXSwKICAgICAgICAgIGFsbEFwcHNWaXNpYmxlOiB0cnVlCiAgICAgICAgfQogICAgICB9CiAgICB9CiAgICAKICAgIHJlc3BvbnNlID0gY2xpZW50LnJlcXVlc3QoOnBvc3QpIGRvIHxyZXF8CiAgICAgIHJlcS51cmwgIi9pcmlzL3YxL2FwaUtleXMiCiAgICAgIHJlcS5ib2R5ID0gcGF5bG9hZC50b19qc29uCiAgICAgIHJlcS5oZWFkZXJzWydDb250ZW50LVR5cGUnXSA9ICdhcHBsaWNhdGlvbi9qc29uJwogICAgICByZXEuaGVhZGVyc1snQWNjZXB0J10gPSAnYXBwbGljYXRpb24vdm5kLmFwaStqc29uLCBhcHBsaWNhdGlvbi9qc29uLCB0ZXh0L2phdmFzY3JpcHQsICovKjsgcT0wLjAxJwogICAgICByZXEuaGVhZGVyc1snWC1SZXF1ZXN0ZWQtV2l0aCddID0gJ1hNTEh0dHBSZXF1ZXN0JwogICAgICByZXEuaGVhZGVyc1snUmVmZXJlciddID0gJ2h0dHBzOi8vYXBwc3RvcmVjb25uZWN0LmFwcGxlLmNvbS9hY2Nlc3MvYXBpJwogICAgICByZXEuaGVhZGVyc1snWC1BcHBsZS1XaWRnZXQtS2V5J10gPSBjbGllbnQud2lkZ2V0X2tleSBpZiBjbGllbnQucmVzcG9uZF90bz8oOndpZGdldF9rZXkpCiAgICBlbmQKICAgIAogICAgIyBERUJVRzogSW5zcGVjdCB0aGUgcmF3IHJlc3BvbnNlIG9iamVjdAogICAgJHN0ZGVyci5wdXRzICJERUJVRzogUmVzcG9uc2UgQ2xhc3M6ICN7cmVzcG9uc2UuY2xhc3N9IgogICAgJHN0ZGVyci5wdXRzICJERUJVRzogUmVzcG9uc2UgSGVhZGVyczogI3tyZXNwb25zZS5oZWFkZXJzfSIKICAgICRzdGRlcnIucHV0cyAiREVCVUc6IFJlc3BvbnNlIEJvZHk6ICN7cmVzcG9uc2UuYm9keS50b19qc29ufSIKICAgIAogICAgaWYgcmVzcG9uc2UuYm9keS5uaWw/IHx8ICFyZXNwb25zZS5ib2R5LmlzX2E/KEhhc2gpIHx8IHJlc3BvbnNlLmJvZHlbJ2RhdGEnXS5uaWw/CiAgICAgIGVycm9yX21zZyA9ICJBUEkgZmFpbGVkIHRvIGNyZWF0ZSBrZXkuIgogICAgICBpZiByZXNwb25zZS5ib2R5ICYmIHJlc3BvbnNlLmJvZHlbJ2Vycm9ycyddCiAgICAgICAgZXJyb3JfbXNnICs9ICIgRXJyb3JzOiAiICsgcmVzcG9uc2UuYm9keVsnZXJyb3JzJ10ubWFwe3xlfCBlWydkZXRhaWwnXX0uam9pbignLCAnKQogICAgICBlbmQKICAgICAgcmFpc2UgZXJyb3JfbXNnCiAgICBlbmQKICAgIAogICAga2V5X2RhdGEgPSByZXNwb25zZS5ib2R5WydkYXRhJ10KICAgIGF0dHIgPSBrZXlfZGF0YVsnYXR0cmlidXRlcyddIHx8IHt9CgogICAgIyBUaGUgLnA4IGNvbnRlbnQgaXMgdXN1YWxseSBpbiAncHJpdmF0ZUtleScgb3IgJ2tleUNvbnRlbnQnIG9uIHRoZSBJTklUSUFMIENSRUFURSByZXNwb25zZQogICAgcDhfY29udGVudCA9IGF0dHJbJ3ByaXZhdGVLZXknXSB8fCBhdHRyWydrZXlDb250ZW50J10KICAgIAogICAgaWYgcDhfY29udGVudC5uaWw/CiAgICAgICRzdGRlcnIucHV0cyAiREVCVUc6IEtleSBjb250ZW50IG1pc3NpbmcgaW4gcmVzcG9uc2UuIEF0dGVtcHRpbmcgcmV0cmlldmFsIHZpYSBkb3dubG9hZC9leHBvcnQgZW5kcG9pbnRzLi4uIiAKICAgICAgCiAgICAgIHBhdGhzX3RvX3RyeSA9IFsKICAgICAgICAiaHR0cHM6Ly9hcHBzdG9yZWNvbm5lY3QuYXBwbGUuY29tL2lyaXMvdjEvYXBpS2V5cy8je2tleV9kYXRhWydpZCddfS9kb3dubG9hZCIsCiAgICAgICAgImh0dHBzOi8vYXBwc3RvcmVjb25uZWN0LmFwcGxlLmNvbS9pcmlzL3YxL2FwaUtleXMvI3trZXlfZGF0YVsnaWQnXX0vZXhwb3J0IgogICAgICBdCiAgICAgIAogICAgICBwYXRoc190b190cnkuZWFjaCBkbyB8cGF0aHwKICAgICAgICBiZWdpbgogICAgICAgICAgJHN0ZGVyci5wdXRzICJERUJVRzogVHJ5aW5nICN7cGF0aH0uLi4iCiAgICAgICAgICBkb3dubG9hZF9yZXNwID0gY2xpZW50LnJlcXVlc3QoOmdldCkgZG8gfHJlcXwKICAgICAgICAgICAgcmVxLnVybCBwYXRoCiAgICAgICAgICAgIHJlcS5oZWFkZXJzWydBY2NlcHQnXSA9ICdhcHBsaWNhdGlvbi92bmQuYXBpK2pzb24sIGFwcGxpY2F0aW9uL2pzb24sIHRleHQvamF2YXNjcmlwdCwgKi8qOyBxPTAuMDEnCiAgICAgICAgICAgIHJlcS5oZWFkZXJzWydYLVJlcXVlc3RlZC1XaXRoJ10gPSAnWE1MSHR0cFJlcXVlc3QnCiAgICAgICAgICAgIHJlcS5oZWFkZXJzWydSZWZlcmVyJ10gPSAnaHR0cHM6Ly9hcHBzdG9yZWNvbm5lY3QuYXBwbGUuY29tL2FjY2Vzcy9hcGknCiAgICAgICAgICBlbmQKICAgICAgICAgICRzdGRlcnIucHV0cyAiREVCVUc6IFJlc3BvbnNlIENsYXNzOiAje2Rvd25sb2FkX3Jlc3AuYm9keS5jbGFzc30iCiAgICAgICAgICAkc3RkZXJyLnB1dHMgIkRFQlVHOiBSZXNwb25zZSBTdGF0dXM6ICN7ZG93bmxvYWRfcmVzcC5zdGF0dXN9IiBpZiBkb3dubG9hZF9yZXNwLnJlc3BvbmRfdG8/KDpzdGF0dXMpCiAgICAgICAgICAKICAgICAgICAgIGlmIGRvd25sb2FkX3Jlc3AuYm9keSAmJiAhZG93bmxvYWRfcmVzcC5ib2R5LnRvX3MuaW5jbHVkZT8oJyJlcnJvcnMiPT4nKQogICAgICAgICAgICAgaWYgZG93bmxvYWRfcmVzcC5ib2R5LmlzX2E/KEhhc2gpCiAgICAgICAgICAgICAgIHA4X2NvbnRlbnQgPSBkb3dubG9hZF9yZXNwLmJvZHlbJ2tleUNvbnRlbnQnXSB8fCBkb3dubG9hZF9yZXNwLmJvZHlbJ2NvbnRlbnQnXSB8fCBkb3dubG9hZF9yZXNwLmJvZHkuZGlnKCdkYXRhJywgJ2F0dHJpYnV0ZXMnLCAncHJpdmF0ZUtleScpCiAgICAgICAgICAgICBlbHNlCiAgICAgICAgICAgICAgIHA4X2NvbnRlbnQgPSBkb3dubG9hZF9yZXNwLmJvZHkKICAgICAgICAgICAgIGVuZAogICAgICAgICAgICAgCiAgICAgICAgICAgICBpZiBwOF9jb250ZW50ICYmIHA4X2NvbnRlbnQudG9fcy5zdGFydF93aXRoPygnLS0tLS1CRUdJTicpCiAgICAgICAgICAgICAgICRzdGRlcnIucHV0cyAiREVCVUc6IFJldHJpZXZhbCB2aWEgI3twYXRofSBzdWNjZXNzZnVsISBDb250ZW50IGxlbmd0aDogI3twOF9jb250ZW50LnRvX3MubGVuZ3RofSIKICAgICAgICAgICAgICAgYnJlYWsKICAgICAgICAgICAgIGVsc2UKICAgICAgICAgICAgICAgJHN0ZGVyci5wdXRzICJERUJVRzogUmVzcG9uc2UgZnJvbSAje3BhdGh9IGRpZCBub3QgY29udGFpbiBhIHZhbGlkIHByaXZhdGUga2V5LiIKICAgICAgICAgICAgICAgcDhfY29udGVudCA9IG5pbAogICAgICAgICAgICAgZW5kCiAgICAgICAgICBlbHNlCiAgICAgICAgICAgICAkc3RkZXJyLnB1dHMgIkRFQlVHOiBSZXNwb25zZSBmcm9tICN7cGF0aH0gZW1wdHkgb3IgY29udGFpbnMgZXJyb3JzLiIKICAgICAgICAgIGVuZAogICAgICAgIHJlc2N1ZSA9PiBlCiAgICAgICAgICAkc3RkZXJyLnB1dHMgIkRFQlVHOiBBdHRlbXB0IGZvciAje3BhdGh9IGZhaWxlZDogI3tlLm1lc3NhZ2V9IgogICAgICAgIGVuZAogICAgICBlbmQKICAgIGVuZAoKICAgICMgRklOQUwgVkFMSURBVElPTjogRW5zdXJlIGl0J3Mgbm90IGEgUnVieSBoYXNoIHN0cmluZyByZXByZXNlbnRhdGlvbiBvciBlcnJvcgogICAgaWYgcDhfY29udGVudC5pc19hPyhIYXNoKSB8fCBwOF9jb250ZW50LnRvX3MuaW5jbHVkZT8oJyJlcnJvcnMiPT4nKSB8fCAhcDhfY29udGVudC50b19zLnN0YXJ0X3dpdGg/KCctLS0tLUJFR0lOJykKICAgICAgJHN0ZGVyci5wdXRzICJERUJVRzogSW52YWxpZCBrZXkgY29udGVudCBkZXRlY3RlZC4iCiAgICAgIHA4X2NvbnRlbnQgPSBuaWwKICAgIGVuZAoKICAgIGlmIHA4X2NvbnRlbnQubmlsPwogICAgICAkc3RkZXJyLnB1dHMgIkRFQlVHOiBGYWlsZWQgdG8gcmV0cmlldmUga2V5IGNvbnRlbnQuIgogICAgZW5kCiAgICAKICAgIHJlc3VsdCA9IHsKICAgICAgaWQ6IGtleV9kYXRhWydpZCddLAogICAgICBuYW1lOiBhdHRyWyduaWNrbmFtZSddIHx8IGF0dHJbJ25hbWUnXSwKICAgICAgaXNzdWVySWQ6IGF0dHJbJ2lzc3VlcklkJ10sCiAgICAgIGtleUNvbnRlbnQ6IHA4X2NvbnRlbnQsCiAgICAgIHJhd19yZXNwb25zZTogcmVzcG9uc2UuYm9keSAjIEluY2x1ZGUgdGhpcyBmb3IgZGVidWdnaW5nIHdoZW4ga2V5Q29udGVudCBpcyBuaWwKICAgIH0KICAgIAogICAgcHV0cyAiX19fTUFDSF9KU09OX1NUQVJUX19fIiArIHJlc3VsdC50b19qc29uICsgIl9fX01BQ0hfSlNPTl9FTkRfX18iCiAgcmVzY3VlID0+IGUKICAgICRzdGRlcnIucHV0cyAiRVJST1I6ICN7ZS5tZXNzYWdlfSIKICAgIGlmIGRlZmluZWQ/KHJlc3BvbnNlKSAmJiByZXNwb25zZSAmJiByZXNwb25zZS5ib2R5CiAgICAgICAkc3RkZXJyLnB1dHMgIlJlc3BvbnNlIEJvZHk6ICN7cmVzcG9uc2UuYm9keS50b19qc29ufSIKICAgIGVuZAogICAgZXhpdCAxCiAgZW5kCmVuZAoKZGVmIGRlbGV0ZV9rZXkoaWQpCiAgYmVnaW4KICAgIFNwYWNlc2hpcDo6UG9ydGFsLmxvZ2luKEVOVlsnRkFTVExBTkVfVVNFUiddKQogICAgU3BhY2VzaGlwOjpQb3J0YWwuc2VsZWN0X3RlYW0odGVhbV9pZDogRU5WWydGQVNUTEFORV9URUFNX0lEJ10pCiAgICAKICAgIFNwYWNlc2hpcDo6VHVuZXMubG9naW4oRU5WWydGQVNUTEFORV9VU0VSJ10pCiAgICBzZWxlY3RfYXBwX3N0b3JlX2Nvbm5lY3RfdGVhbQogICAgCiAgICBjbGllbnQgPSBTcGFjZXNoaXA6OlR1bmVzLmNsaWVudAogICAgY2xpZW50LnJlcXVlc3QoOmRlbGV0ZSwgIi9pcmlzL3YxL2FwaUtleXMvI3tpZH0iKQogICAgcHV0cyAiU1VDQ0VTUyIKICByZXNjdWUgPT4gZQogICAgJHN0ZGVyci5wdXRzICJFUlJPUjogI3tlLm1lc3NhZ2V9IgogICAgZXhpdCAxCiAgZW5kCmVuZAoKY29tbWFuZCA9IEFSR1ZbMF0KaWYgY29tbWFuZCA9PSAnbGlzdCcKICBsaXN0X2tleXMKZWxzaWYgY29tbWFuZCA9PSAndGVhbXMnCiAgbGlzdF90ZWFtcwplbHNpZiBjb21tYW5kID09ICdjcmVhdGUnCiAgY3JlYXRlX2tleShBUkdWWzFdIHx8ICJNYWNoIEFQSSBLZXkgI3tUaW1lLm5vdy50b19pfSIpCmVsc2lmIGNvbW1hbmQgPT0gJ2RlbGV0ZScKICBkZWxldGVfa2V5KEFSR1ZbMV0pCmVuZAo=";function ke(){let e=U.join(Ge.tmpdir(),m.nameLower);E.existsSync(e)||E.mkdirSync(e,{recursive:!0});let t=U.join(e,"manage_asc_keys.rb");return E.writeFileSync(t,Buffer.from(Et,"base64").toString("utf-8"),{mode:493}),t}function Ne(){return se()}function Ee(e){let t=new Map,n=/-\s+(\d+)\s+\(([^)]+)\)/g,a=/\d+\)\s+"([^"]+)"\s+\((\d+)\)/g,i;for(;(i=n.exec(e))!==null;)t.set(i[1],{id:i[1],name:i[2]});for(;(i=a.exec(e))!==null;)t.set(i[2],{id:i[2],name:i[1]});return Array.from(t.values())}function Le(e){return ge(e).appStoreConnectTeamId}function Me(e,t,n){return{...Ne(),FASTLANE_USER:e,FASTLANE_TEAM_ID:t,...n?{FASTLANE_ITC_TEAM_ID:n,FASTLANE_ASC_TEAM_ID:n}:{}}}function oe(e,t="production",n={}){let a=ge(e,t),i=n.teamId||a.teamId,r=n.appStoreConnectTeamId||a.appStoreConnectTeamId;return{teamId:i,teamName:n.teamName||a.teamName,developerTeamId:n.developerTeamId||a.developerTeamId||i,appStoreConnectTeamId:r,providerId:n.providerId||a.providerId||r,providerName:n.providerName||a.providerName}}function ze(e,t){if(t.id){e.submit||(e.submit={}),e.submit.production||(e.submit.production={}),e.submit.production.ios||(e.submit.production.ios={}),e.submit.production.ios.appStoreConnectTeamId=t.id,e.submit.production.ios.providerId=t.id,t.name&&(e.submit.production.ios.appStoreConnectTeamName=t.name,e.submit.production.ios.providerName=t.name),t.developerTeamName&&(e.submit.production.ios.appleTeamName=t.developerTeamName);try{E.writeFileSync(`./${m.configFileName}`,JSON.stringify(e,null,2))}catch{}}}async function Xt(e,t,n,a){let i=Ie();i.start("Fetching App Store Connect providers...");let r=fe("ruby",[e,"teams"],{env:Me(n,a),stdio:["inherit","pipe","pipe"],encoding:"utf-8"});if(r.status!==0){i.stop("Could not fetch providers");let g=Ee(`${r.stdout||""}
-${r.stderr||""}`);if(g.length>0)return Te(t,g,"Select the App Store Connect provider for this API key:");N.warn(F.yellow(`Could not list App Store Connect providers: ${r.stderr||"Unknown error"}`));return}let s=(r.stdout||"").match(new RegExp(`${m.jsonStartMarker}(.*)${m.jsonEndMarker}`));if(!s){i.stop("Could not parse providers");return}let l=JSON.parse(s[1]),c=(l.teams||[]).filter(g=>g.id&&g.name);if(i.stop(c.length===1?"Found 1 provider":`Found ${c.length} providers`),c.length===0)return;if(c.length===1){N.success(F.green(`\u2713 Using App Store Connect provider ${c[0].name} (${c[0].id})`));let g={...c[0],developerTeamName:l.developerTeamName};return ze(t,g),g}let f=c.filter(g=>g.recommended),I=c.filter(g=>!g.recommended);return Te(t,[...f,...I],`Select the App Store Connect provider for Developer Team ${l.developerTeamName||a}:`,l.developerTeamName)}async function Te(e,t,n,a){let i=await le({message:n,options:t.map(c=>({value:c.id,label:c.name,hint:`${c.id}${c.recommended?" \xB7 recommended":""}`}))});if(Y(i))return L("Operation cancelled"),null;let r=i,l={...t.find(c=>c.id===r)||{id:r,name:r},developerTeamName:a};return ze(e,l),N.success(F.green(`\u2713 Using App Store Connect provider ${l.name} (${l.id})`)),l}var je=async e=>{let t=Ie(),n=e.platform,a=`./${m.configFileName}`;if(!E.existsSync(a)){N.error(`No ${m.configFileName} found. Run \`${m.nameLower} init\` or \`${m.nameLower} link\` first.`);return}let i=JSON.parse(E.readFileSync(a,"utf-8")),{projectId:r}=i,s=e.profile||"production";if(!r){N.error(`${m.configFileName} is missing projectId.`);return}let l=e.file,c=n==="android"?e.packageName||e.bundleId:e.bundleId||Se(i,s)||"*";if(n==="android"&&!c&&(c=await Bt(r,i,s),c===null))return;if(n==="ios"&&!l){let u=await le({message:"Manage App Store Connect API Key:",options:[{value:"magic",label:"\u2728 Create new automatically",hint:"Requires Apple ID + 2FA"},{value:"manual",label:"\u{1F50D} Configure manually",hint:"Provide existing .p8 file"},{value:"delete",label:"\u{1F5D1}\uFE0F  Delete an existing Key"}]});if(Y(u)){L("Operation cancelled");return}if(u==="magic"){await _t(r,i);return}if(u==="delete"){await Yt(r,i);return}}if(!l){let u=n==="ios"?"https://appstoreconnect.apple.com/access/api":"https://console.cloud.google.com/apis/credentials";we(`To submit to the ${n==="ios"?"App Store":"Google Play Store"}, you need a Service Key:
-1. Open: ${F.cyan(u)}
-`+(n==="ios"?`2. Generate an "App Store Connect API Key" with ${F.bold("Admin")} role.
-3. Download the ${F.bold(".p8")} file.`:`2. Create a "Service Account", generate a ${F.bold("JSON")} key.
-3. Download the ${F.bold(".json")} file.`),"Guided Setup"),t.start("Scanning for downloaded keys...");let C=Dt(n);if(t.stop(C.length>0?`Detected ${C.length} potential key(s)`:"No keys detected automatically"),C.length>0){let p=await le({message:"Found these potential keys. Use one of them?",options:[...C.map(A=>({value:A.path,label:`${U.basename(A.path)} (${A.location})`})),{value:"manual",label:"Enter path manually..."}]});if(Y(p)){L("Operation cancelled");return}p!=="manual"&&(l=p)}if(!l){let p=await Q({message:`Paste the path to your ${n==="ios"?".p8":".json"} file:`,validate:A=>E.existsSync(A)?void 0:"File not found"});if(Y(p)){L("Operation cancelled");return}l=p}}let f=e.issuerId,I=e.keyId;if(n==="ios"){if(!I&&l){let u=U.basename(l).match(/AuthKey_(.*)\.p8/);u&&(I=u[1],N.info(`Auto-detected Key ID from filename: ${F.green(I)}`))}if(!f){let u=await Q({message:"Enter App Store Connect Issuer ID (Found on the Keys page):",validate:C=>C.length>0?void 0:"Issuer ID is required"});if(Y(u)){L("Operation cancelled");return}f=u}if(!I){let u=await Q({message:"Enter App Store Connect Key ID:",validate:C=>C.length>0?void 0:"Key ID is required"});if(Y(u)){L("Operation cancelled");return}I=u}}if(n==="android"&&(!c||c==="*")){let u=await Qe();if(u===null)return;c=u}let g=n==="ios"?oe(i,s):{};await Fe(r,l,n,f,I,c,{...g})};async function Bt(e,t,n){let a=await Pt(e),i=xt(t,n);if(i&&!a.includes(i)&&a.unshift(i),a.length>0){let r=await le({message:"Select Android package for this Google Play service key:",options:[...a.map(s=>({value:s,label:s,hint:s===i?"from config":void 0})),{value:"manual",label:"Enter another package name..."}]});if(Y(r))return L("Operation cancelled"),null;if(r==="manual")return Qe();if(r!=="manual")return r}if(i){let r=await Ke({message:`Use Android package from local config (${i})?`,initialValue:!0});if(Y(r))return L("Operation cancelled"),null;if(r)return i}}async function Qe(){let e=await Q({message:"Android package name for this Google Play service key:",placeholder:"com.example.app",validate:t=>t.includes(".")?void 0:"Enter a valid package name"});return Y(e)?(L("Operation cancelled"),null):e}async function Pt(e){try{let n=(await V.get(`/credentials/${e}`)).data.credentials||[],a=new Set;for(let i of n)(i.platform==="android"||i.type==="android_keystore"||i.type==="google_service_account")&&i.bundleId&&i.bundleId!=="*"&&a.add(i.bundleId);return Array.from(a).sort()}catch(t){return N.warn(F.yellow(`Could not fetch saved Android package identifiers: ${t.message}`)),[]}}function xt(e,t){let n=be(e,t);if(n)return n;let a=U.join(process.cwd(),"app.json");if(E.existsSync(a))try{return JSON.parse(E.readFileSync(a,"utf-8")).expo?.android?.package}catch{}let i=U.join(process.cwd(),"app.config.json");if(E.existsSync(i))try{let r=JSON.parse(E.readFileSync(i,"utf-8"));return r.expo?.android?.package||r.android?.package}catch{}}async function _t(e,t){let n=Ie(),a=t.submit?.production?.ios?.appleId,i=oe(t).teamId,r=Le(t);if(!a){let c=await Q({message:"Apple ID:",placeholder:"your-email@example.com"});if(Y(c))return;a=c}if(!i){let c=await me({appleId:a,config:t,profile:"production",initialTeam:oe(t),promptToPersistConfig:!0});if(!c?.teamId)return;i=c.teamId}let s=await Q({message:"Enter a name for the new API Key:",initialValue:`[${m.name}] Project ${e}`});if(Y(s))return;let l=ke();if(!E.existsSync(l)){N.error(`Magic Error: Helper script not found at ${l}`);return}try{let c=await Xt(l,t,a,i);if(c===null)return;let f;if(c)f=c,r=c.id;else if(!r)return;n.start("Creating App Store Connect API Key...");let I=b=>fe("ruby",[l,"create",s],{env:Me(a,i,b),stdio:["inherit","pipe","pipe"],encoding:"utf-8"}),g=I(r),u=g.stdout||"",C=g.stderr||"";if(g.status!==0){let b=Ee(`${u}
-${C}`);if(b.length>0){n.stop("Select App Store Connect team"),we(`Apple Developer Team IDs look like ${F.bold(i)}.
-App Store Connect API keys use a numeric provider/team ID instead.`,"Team ID mismatch");let D=await Te(t,b,"Select the App Store Connect provider for this API key:");if(!D)return;f=D,r=D.id,n.start("Creating API Key with selected App Store Connect team..."),g=I(r),u=g.stdout||"",C=g.stderr||""}}if(C&&(C.includes("DEBUG:")||C.includes("ERROR:"))&&C.split(`
-`).forEach(b=>{b.trim()&&N.info(F.dim(`[Ruby] ${b.trim()}`))}),g.status!==0){n.stop("Failed"),N.error(`Magic creation failed: ${C}`);return}let p=u.match(new RegExp(`${m.jsonStartMarker}(.*)${m.jsonEndMarker}`));if(!p){n.stop("Parse Error"),N.error("Could not parse response from Apple Portal.");return}let A=JSON.parse(p[1]),{id:v,issuerId:$,keyContent:h}=A,x=oe(t,"production",{teamId:i,teamName:f?.developerTeamName,developerTeamId:i,appStoreConnectTeamId:r,providerId:r,providerName:f?.name});if(n.stop("Key Created Successfully"),N.success(`\u2713 Created Key ID: ${F.green(v)}`),!$){we(`Your Issuer ID is shown at the top of:
-  ${F.cyan("https://appstoreconnect.apple.com/access/integrations/api")}
-It looks like: ${F.dim("xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx")}`,"One More Thing");let b=await Q({message:"Enter your App Store Connect Issuer ID:",validate:D=>D.trim().length>0?void 0:"Issuer ID is required"});if(Y(b)){L("Operation cancelled.");return}$=b.trim()}if(h){let b=U.join(Ge.tmpdir(),`AuthKey_${v}.p8`);E.writeFileSync(b,h),await Fe(e,b,"ios",$,v,t.ios?.bundleIdentifier||"*",{...x}),E.unlinkSync(b)}else{N.warn(F.yellow("\u26A0\uFE0F  Apple did not return the private key in the response.")),we(`Download the .p8 file manually:
-  1. Open: ${F.cyan("https://appstoreconnect.apple.com/access/integrations/api")}
-  2. Find Key ID: ${F.green(v)}
-  3. Click ${F.bold("Download API Key")} (only available once)
-  4. Drag & drop the downloaded .p8 file below`,"Manual Step Required");let b=await Q({message:"Path to the downloaded .p8 file (drag & drop here):",validate:D=>E.existsSync(D)?void 0:"File not found"});if(Y(b)){L("Operation cancelled. Credential ID was registered but key content is missing.");return}await Fe(e,b,"ios",$,v,t.ios?.bundleIdentifier||"*",{...x})}}catch(c){n.stop("Error"),N.error(`Error: ${c.message}`)}}async function Yt(e,t){let n=Ie(),a=t.submit?.production?.ios?.appleId,i=oe(t).teamId,r=Le(t);if(!a){let l=await Q({message:"Apple ID:"});if(Y(l))return;a=l}if(!i){let l=await me({appleId:a,config:t,profile:"production",initialTeam:oe(t),promptToPersistConfig:!0});if(!l?.teamId)return;i=l.teamId}n.start("Fetching existing API Keys...");let s=ke();if(!E.existsSync(s)){N.error(`Magic Error: Helper script not found at ${s}`);return}try{let l=p=>fe("ruby",[s,"list"],{env:{...Ne(),FASTLANE_USER:a,FASTLANE_TEAM_ID:i,...p?{FASTLANE_ITC_TEAM_ID:p,FASTLANE_ASC_TEAM_ID:p}:{}},stdio:["inherit","pipe","pipe"],encoding:"utf-8"}),c=l(r);if(c.status!==0){let p=Ee(`${c.stdout||""}
-${c.stderr||""}`);if(p.length>0){n.stop("Select App Store Connect team");let A=await le({message:"Select the App Store Connect team to list API keys:",options:p.map(v=>({value:v.id,label:v.name,hint:v.id}))});if(Y(A)){L("Operation cancelled");return}r=A,n.start("Fetching existing API Keys..."),c=l(r)}}if(c.status!==0){n.stop("Failed"),N.error(`Listing failed: ${c.stderr}`);return}let f=c.stdout.match(new RegExp(`${m.jsonStartMarker}(.*)${m.jsonEndMarker}`));if(!f){n.stop("Parse Error");return}let I=JSON.parse(f[1]);if(n.stop(`Found ${I.length} keys`),I.length===0){N.info("No API Keys found on this team.");return}let g=await le({message:"Select a key to delete from Apple Developer Portal:",options:[...I.map(p=>({value:p.id,label:`ID: ${p.id} - ${p.name} (${p.role})`})),{value:"cancel",label:"Cancel"}]});if(Y(g)||g==="cancel")return;let u=await Ke({message:`Are you sure you want to delete Key ${g}? This cannot be undone.`});if(!u||Y(u))return;n.start(`Deleting Key ${g}...`);let C=fe("ruby",[ke(),"delete",g],{env:{...Ne(),FASTLANE_USER:a,FASTLANE_TEAM_ID:i,...r?{FASTLANE_ITC_TEAM_ID:r,FASTLANE_ASC_TEAM_ID:r}:{}},stdio:"pipe",encoding:"utf-8"});C.status===0?(n.stop("Deleted"),N.success(`\u2713 Key ${g} has been removed from Apple Portal.`)):(n.stop("Deletion Failed"),N.error(`Error: ${C.stderr}`))}catch(l){n.stop("Error"),N.error(`Error: ${l.message}`)}}async function Fe(e,t,n,a,i,r="*",s={}){let l=Ie();l.start(`Uploading Service Credentials for ${n}...`);try{let c=n==="ios"?"asc_api_key":"google_service_account",f=new URL(import.meta.url),I=U.dirname(f.pathname),g=[U.join(I,"isolated-upload.js"),U.join(I,"commands","isolated-upload.js"),U.resolve(I,"../commands/isolated-upload.js"),U.resolve(process.cwd(),`node_modules/.bin/${m.nameLower}-upload`)],u="";for(let p of g)if(E.existsSync(p)){u=p;break}if(!u)throw new Error("Could not locate isolated-upload.js. Ensure the CLI is properly installed.");let C=fe("node",[u,e,t,c,r,"service","undefined","undefined",a||"undefined",i||"undefined","undefined","undefined","undefined",s.teamId||"undefined",s.teamName||"undefined",s.developerTeamId||"undefined",s.appStoreConnectTeamId||"undefined",s.providerId||"undefined",s.providerName||"undefined"],{stdio:"pipe",encoding:"utf-8",env:{...process.env,AT_CLI_ISOLATED:"1"}});if(C.status!==0){let p=C.stderr||C.stdout||"Unknown upload failure";l.stop("Upload Failed"),N.error(F.red(`Upload Failed: ${p}`));return}C.stdout.includes("SUCCESS")?(l.stop("Upload Success"),N.success(F.green(`\u2713 Service Credentials for ${n} uploaded successfully.`))):(l.stop("Upload Summary"),N.warn(F.yellow(`Upload finished but success not confirmed: ${C.stdout}`)))}catch(c){l.stop("Upload Error"),N.error(F.red(`Error: ${c.message}`))}}function Dt(e){let t=e==="ios"?".p8":".json",n=[],a=[{path:"./",label:"Project Root"},{path:U.join(Ge.homedir(),"Downloads"),label:"Downloads"}];for(let i of a)if(E.existsSync(i.path))try{let r=E.readdirSync(i.path);for(let s of r)if(s.endsWith(t)){if(e==="android"&&!E.readFileSync(U.join(i.path,s),"utf8").includes("service_account")||e==="ios"&&!s.startsWith("AuthKey"))continue;n.push({path:U.join(i.path,s),location:i.label})}}catch{}return n}import pt from"axios";import d from"chalk";import{execSync as O,spawnSync as M}from"child_process";import Be from"crypto";import y from"fs";import w from"path";import Ce from"os";import Ht from"adm-zip";pt.defaults.proxy=!1;function Pe(e,t){if(!y.existsSync(e))return;let n=y.readdirSync(e);for(let a of n){let i=w.join(e,a);if(y.statSync(i).isDirectory()){let s=Pe(i,t);if(s)return s}else if(t.test(a))return i}}var ee=e=>String(e||"").trim().toLowerCase().replace(/_/g,"-"),qe=e=>String(e||"unknown").trim().replace(/[^a-zA-Z0-9._-]/g,"_")||"unknown",$t=(e,t)=>`ios-certificates/${qe(e)}/${qe(t)}/`;function Ot(e){return"'"+e.replace(/'/g,"'\\''")+"'"}function et(...e){let t=e.join(`
-`).split(/\r?\n/).map(n=>n.trim()).filter(Boolean);return t.length>0?t.slice(-8).join(`
-`):void 0}function Kt(e,t,n){let a=M(e,t,{env:n,encoding:"utf-8"});if(!(a.error||a.status!==0))return(a.stdout||a.stderr||"").trim()||void 0}function Lt(e,t,n,a,i=!1){let r=[`${e} match ${t}`];return n&&r.push(`--app_identifier "${n}"`),a&&r.push(`--profile_name "${a}"`),i&&(t==="adhoc"||t==="development")&&r.push("--force_for_new_devices"),r.join(" ")}function Mt(e){let t=e?.match(/ruby\s+(\d+)\.(\d+)/);return t?{major:Number(t[1]),minor:Number(t[2])}:null}function zt(e,t,n){let a=Mt(e);return a?a.major!==t?a.major<t:a.minor<n:!1}function Xe(e){let t=process.env.HOME||Ce.homedir(),n=process.env.FASTLANE_GEM_HOME||w.join(t,".local/share/fastlane/3.4.0"),a=[process.env.FASTLANE_BINARY,"/usr/local/bin/fastlane","/opt/homebrew/bin/fastlane","/usr/local/Cellar/fastlane/2.227.0/libexec/bin/fastlane","/opt/homebrew/Cellar/fastlane/2.227.0/libexec/bin/fastlane",w.join(n,"bin/fastlane"),"fastlane"].filter(Boolean);for(let i of a){if(i.includes("/")&&!y.existsSync(i))continue;let r=M(i,["--version"],{env:e,stdio:"ignore"});if(!r.error&&r.status===0)return{command:i,shellCommand:Ot(i),env:e}}return null}function jt(e){if(process.env.MACH_SKIP_FASTLANE_INSTALL==="1")return{ok:!1,detail:"Automatic install skipped because MACH_SKIP_FASTLANE_INSTALL=1."};let t=M("gem",["--version"],{env:e,encoding:"utf-8"});if(t.error||t.status!==0)return{ok:!1,detail:et(t.stdout,t.stderr)||"RubyGems is not available."};let n=Kt("ruby",["-v"],e);if(zt(n,3,2))return{ok:!1,detail:[n?`Detected Ruby: ${n}`:void 0,"The latest fastlane dependency tree now requires Ruby >= 3.2.","Mach skipped automatic gem install because macOS system Ruby is too old for it."].filter(Boolean).join(`
-`)};let a=process.env.HOME||Ce.homedir(),i=process.env.FASTLANE_GEM_HOME||w.join(a,".local/share/fastlane/3.4.0"),r=w.join(i,"bin");y.mkdirSync(r,{recursive:!0}),o.info(d.dim("fastlane not found. Installing fastlane into the local Mach cache..."));let s=M("gem",["install","fastlane","--no-document","--install-dir",i,"--bindir",r],{env:{...e,GEM_HOME:i,GEM_PATH:[i,e.GEM_PATH].filter(Boolean).join(":")},encoding:"utf-8"});if(s.error||s.status!==0){let l=et(s.stdout,s.stderr);return o.warn(d.yellow("Automatic fastlane install failed.")),l&&o.warn(d.dim(l)),{ok:!1,detail:[n?`Detected Ruby: ${n}`:void 0,l].filter(Boolean).join(`
-`)||void 0}}return o.success(d.green("\u2713 fastlane installed into the local Mach cache.")),{ok:!0}}function Qt(){return!process.env.CI&&process.stdin.isTTY&&process.stdout.isTTY}function qt(e){let t=M("brew",["--version"],{env:e,encoding:"utf-8"});if(t.error||t.status!==0)return{ok:!1,detail:"Homebrew is not available on PATH."};o.info(d.dim("Installing fastlane with Homebrew..."));let n=M("brew",["install","fastlane"],{env:e,stdio:"inherit"});return n.error||n.status!==0?{ok:!1,detail:"brew install fastlane failed."}:(o.success(d.green("\u2713 fastlane installed with Homebrew.")),{ok:!0})}async function en(e){if(!Qt())return!1;o.warn(d.yellow("fastlane is required for iOS certificate/profile sync, but it was not found.")),e&&o.info(d.dim(e));let t=await dt({message:"Install fastlane now with Homebrew?",initialValue:!0});return T(t)?(H("Operation cancelled"),!1):!!t}async function tn(){let e=se(),t=Xe(e);if(t)return t;let n=jt(e);e=se();let a=Xe(e);if(a)return a;if(await en(n.detail)){let i=qt(e);e=se();let r=Xe(e);if(r)return r;throw new Error(["fastlane is required for iOS certificate/profile sync, but it was still not found after Homebrew install.",i.detail?`Homebrew install failed:
-${i.detail}`:void 0,"Try running manually: brew install fastlane","Then run mach credentials again."].filter(Boolean).join(`
-`))}throw new Error(["fastlane is required for iOS certificate/profile sync, but it was not found on PATH.",n.detail?`Automatic install failed:
-${n.detail}`:void 0,"Recommended fix: brew install fastlane","Alternative: install Ruby 3.x, then run: gem install fastlane --no-document","Then run mach credentials again."].filter(Boolean).join(`
-`))}var P=e=>{if(typeof e!="string")return;let t=e.trim();return t.length>0?t:void 0},_e=e=>P(e.password)||P(e.p12Password)||P(e.certificatePassword)||P(e.meta?.password)||P(e.meta?.p12Password)||P(e.meta?.certificatePassword),ut=e=>P(e.keystorePassword)||P(e.storePassword)||P(e.meta?.keystorePassword)||P(e.meta?.storePassword),gt=e=>P(e.keyPassword)||P(e.meta?.keyPassword),nn=e=>P(e.alias)||P(e.meta?.alias),tt=e=>e.credentialId||e.id,nt=e=>e.bundleId||e.bundleIdentifier||e.meta?.bundleId||e.meta?.bundleIdentifier,it=e=>e.distributionType||e.meta?.distributionType,at=e=>!!_e(e)||!!ut(e)||!!gt(e),an=async(e,t,n)=>{if(!["ios_cert","android_keystore"].includes(n.type)||at(n))return n;let a=nt(n),i=it(n);if(!a||!i)return n;try{let s=(await V.get("/credentials/resolve",{params:{projectId:e,platform:t,bundleId:a,distributionType:i}})).data.credentials||[],l=tt(n),c=s.find(f=>{if(f.type!==n.type)return!1;let I=tt(f);return l&&I===l?!0:nt(f)===a&&ee(it(f))===ee(i)&&at(f)});return c?{...n,...c,meta:{...n.meta,...c.meta}}:n}catch{return n}},rn=e=>{let t=ee(e);return t==="store"||t==="app-store"?"PRODUCTION":["adhoc","ad-hoc","internal","staging","stage"].includes(t)?"STAGING":"DEVELOPMENT"},sn=(e,t)=>{let n=_e(e);if(n)return n;let a=rn(e.distributionType);return["IOS_P12_PASSWORD",`${m.envPrefix}P12_PASSWORD`,`IOS_P12_PASSWORD_${a}`,`P12_PASSWORD_${a}`,"MACH_P12_PASSWORD","P12_PASSWORD","CERT_PASSWORD"].map(r=>P(t[r])).find(Boolean)||""},on=(e,t)=>{let n=ee(e.distributionType),a=n==="store"?"PRODUCTION":["internal","adhoc","ad-hoc","staging","stage"].includes(n)?"STAGING":"DEVELOPMENT",i=["PRODUCTION","STORE","INTERNAL","STAGING","DEVELOPMENT","RELEASE","DEBUG"],r=[`KEYSTORE_PASSWORD_${a}`,`KEYSTORE_PASSWORD_${String(e.distributionType||"").toUpperCase()}`,...i.map(g=>`KEYSTORE_PASSWORD_${g}`),"ANDROID_STORE_PASSWORD","ANDROID_KEYSTORE_PASSWORD","ANDROID_KEYSTONE_PASSWORD","KEYSTORE_PASSWORD"],s=[`KEY_PASSWORD_${a}`,`KEY_PASSWORD_${String(e.distributionType||"").toUpperCase()}`,"ANDROID_KEY_PASSWORD","KEY_PASSWORD"],l=[`KEYSTORE_ALIAS_${a}`,`KEYSTORE_ALIAS_${String(e.distributionType||"").toUpperCase()}`,...i.map(g=>`KEYSTORE_ALIAS_${g}`),"ANDROID_KEY_ALIAS","KEYSTORE_ALIAS"],c=ut(e)||_e(e)||r.map(g=>P(t[g])).find(Boolean)||"",f=gt(e)||s.map(g=>P(t[g])).find(Boolean)||c;return{alias:nn(e)||l.map(g=>P(t[g])).find(Boolean)||"",keystorePassword:c,keyPassword:f}},rt=(e,t,n)=>{let a=e.includes(".")?e.replace(/\.[^.]+$/i,".zip"):`${e}.zip`,i=w.basename(e),r=new Ht;return r.addLocalFile(e,void 0,i),r.addFile(t,Buffer.from(n.endsWith(`
-`)?n:`${n}
-`,"utf8")),r.writeZip(a),a},mt=e=>{let t=e.toLowerCase();return t==="production"||t==="prod"||t.includes("store")||t.endsWith("-production")||t.endsWith("-prod")},ln=e=>{let t=e.toLowerCase();return t==="staging"||t==="stage"||t.includes("preview")||t.includes("adhoc")||t.includes("ad-hoc")||t.endsWith("-staging")||t.endsWith("-stage")},dn=(e,t)=>{let n=re(e,t)||{},a=ee(n.distribution),i=ee(n.iosExportMethod||n.ios?.exportMethod),r=ee(n.environment);return i==="app-store"||a==="store"?"store":i==="development"||a==="development"?"development":i==="ad-hoc"||i==="adhoc"||a==="ad-hoc"||a==="adhoc"||a==="internal"?"adhoc":r==="production"||r==="store"?"store":r==="development"||r==="dev"?"development":r==="staging"||r==="stage"||r==="preview"?"adhoc":mt(t)?"store":ln(t)?"adhoc":"development"},cn=(e,t)=>{let n=re(e,t)||{},a=ee(n.distribution),i=ee(n.environment);return a==="store"||i==="production"||i==="store"||mt(t)?"store":"internal"};function pn(e,t,n){let a=y.readFileSync(n,"utf8"),i=Math.floor(Date.now()/1e3),r=Buffer.from(JSON.stringify({alg:"ES256",kid:e,typ:"JWT"})).toString("base64url"),s=Buffer.from(JSON.stringify({iss:t,iat:i,exp:i+1200,aud:"appstoreconnect-v1"})).toString("base64url"),l=`${r}.${s}`,c=Be.createSign("SHA256");c.update(l);let f=c.sign({key:a,dsaEncoding:"ieee-p1363"}).toString("base64url");return`${l}.${f}`}async function un(e,t,n,a){let i=pn(t,n,a),r=(await import("axios")).default;for(let s of e)try{await r.post("https://api.appstoreconnect.apple.com/v1/devices",{data:{type:"devices",attributes:{name:s.name,udid:s.udid,platform:"IOS"}}},{headers:{Authorization:`Bearer ${i}`,"Content-Type":"application/json"}}),o.info(d.dim(`  \u2713 Registered: ${s.name}`))}catch(l){let c=l.response?.data?.errors;c?.some(I=>I.code==="ENTITY_ERROR.ATTRIBUTE.INVALID.DUPLICATE"||I.detail?.toLowerCase().includes("already registered")||I.detail?.toLowerCase().includes("already exists"))?o.info(d.dim(`  Already on Portal: ${s.name}`)):o.warn(d.yellow(`  Could not register ${s.name}: ${c?.[0]?.detail||l.message}`))}}var st=async e=>{Jt(d.bgCyan.black(m.cliTag("Credentials")));let t=await ne({message:"Select platform:",options:[{value:"ios",label:"iOS"},{value:"android",label:"Android"}]});T(t)&&(H("Operation cancelled"),process.exit(0));let n=await ne({message:"What do you want to do?",options:[{value:"setup",label:"Build Credentials (Certs/Profiles)",hint:"Manage everything needed to build your project"},{value:"download",label:"Download credentials (credentials.json)",hint:"Sync credentials from Dashboard to local project"},{value:"service",label:"App Store Connect API Key (Magic)",hint:"Manage your API Key for automated submission"},{value:"push",label:"Push Notifications (Placeholder)",hint:"Manage your Apple Push Notifications Key"},{value:"back",label:"Go back"},{value:"exit",label:"Exit"}].filter(a=>!(t==="android"&&(a.value==="service"&&(a.label="Google Service Account (JSON)"),a.value==="push")))});if((T(n)||n==="exit")&&(H("Operation cancelled"),process.exit(0)),n==="back")return st(e);if(n==="setup")await gn({...e,platform:t});else if(n==="download")await hn({...e,platform:t});else if(n==="service")await je({...e,platform:t});else if(n==="push")return ct("Push Notifications management is coming soon!","Coming Soon"),st(e);Ut(d.green("Done!"))},gn=async e=>{let t=Ae(),n=e.platform,a=e.profile;if(!a){let l=await ne({message:"Select credential type:",options:[{value:"development",label:"Development",hint:"Local testing & simulators"},{value:"staging",label:"Ad Hoc / Staging",hint:"Internal distribution & device testing"},{value:"production",label:"Production / App Store",hint:"App Store & Play Store submission"}]});T(l)&&(H("Operation cancelled"),process.exit(0)),a=l}let i=`./${m.configFileName}`;if(!y.existsSync(i)){o.error(`No ${m.configFileName} found. Run \`${m.nameLower} init\` or \`${m.nameLower} link\` first.`);return}let r=JSON.parse(y.readFileSync(i,"utf-8")),{projectId:s}=r;if(!s){o.error(`${m.configFileName} is missing projectId.`);return}if(e.awsProfile&&o.warn(d.yellow(`Ignoring --aws-profile. Authenticating with ${m.name} Cloud...`)),o.info(d.dim(`Setting up credentials for: ${a}`)),n==="ios")await mn(s,a,e,r);else{let l=cn(r,a);await An(s,a,l,e,r)}};async function mn(e,t,n,a){let i=n.bundleId;if(!i){let c=a.submit?.[t]?.ios?.bundleIdentifier||a.submit?.[t]?.ios?.bundleId||Se(a,t),f=[];try{let g=(await V.get(`/credentials/${e}`)).data.credentials||[];f=[...new Set(g.filter(u=>u.platform==="ios"&&u.bundleId&&u.bundleId!=="*").map(u=>u.bundleId))]}catch{}if(c&&!f.includes(c)&&f.unshift(c),f.length>0){let I=[...f.map(u=>({value:u,label:u,hint:u===c?"from config":void 0})),{value:"__new__",label:"+ Enter a new Bundle ID"}],g=await ne({message:"Which Bundle ID are you setting up credentials for?",options:I});if(T(g)&&(H("Operation cancelled"),process.exit(0)),g==="__new__"){let u=await q({message:"iOS Bundle ID (e.g. com.example.app):",placeholder:"com.example.app",validate:C=>C.includes(".")?void 0:"Please enter a valid Bundle ID"});T(u)&&(H("Operation cancelled"),process.exit(0)),i=u}else i=g}else{let I=await q({message:"iOS Bundle ID (e.g. com.example.app):",placeholder:"com.example.app",validate:g=>g.includes(".")?void 0:"Please enter a valid Bundle ID"});T(I)&&(H("Operation cancelled"),process.exit(0)),i=I}}o.info(d.dim(`Bundle ID: ${i}`));let r=dn(a,t),s=a.submit?.production?.ios?.appleId;s&&o.info(d.dim(`Using Apple ID from config: ${s}`)),await In(e,i,t,r,r==="store"?"appstore":r==="adhoc"?"adhoc":"development",n,a,s)}async function fn(e){let t="MATCH_ENCRYPTION_PASSPHRASE";try{let s=((await V.get(`/projects/${e}/secrets/export?env=development`)).data.secrets||{})[t];if(s&&!s.includes("[Decryption Failed]"))return o.info(d.dim("Using existing encryption passphrase from Dashboard")),o.info(d.cyan(`MATCH_PASSWORD: ${s}`)),s;if(s&&s.includes("[Decryption Failed]")){o.warn(d.yellow("\u26A0\uFE0F  Existing MATCH_PASSWORD could not be decrypted (encryption key changed).")),o.info(d.dim("Generating a fresh passphrase and cleaning old certificates..."));let l=Be.randomBytes(32).toString("base64");try{await V.post(`/projects/${e}/secrets`,{key:t,value:l,type:"managed",description:"Encryption passphrase for iOS certificates (fastlane match)",visibility:"secret"}),o.success(d.green("\u2713 New encryption passphrase generated and saved"))}catch{}try{await V.post("/credentials/clean-match-storage",{projectId:e}),o.success(d.green("\u2713 Cleaned old certificates from storage"))}catch{}return l}}catch(i){o.info(d.dim(`Could not fetch existing passphrase from Dashboard: ${i.message}`))}let n=await ne({message:"No active encryption passphrase found on Dashboard. What would you like to do?",options:[{value:"generate",label:"Generate a new secure passphrase",hint:"Safe for first-time setup"},{value:"enter",label:"Enter existing passphrase manually",hint:"Required if you already have certs in S3"},{value:"cancel",label:"Cancel",hint:"Quit"}]});if((T(n)||n==="cancel")&&(H("Operation cancelled"),process.exit(0)),n==="enter"){let i=await ve({message:"Enter your MATCH_PASSWORD (encryption passphrase):",validate:s=>s.length>0?void 0:"Passphrase is required"});T(i)&&(H("Operation cancelled"),process.exit(0));let r=i;try{await V.post(`/projects/${e}/secrets`,{key:t,value:r,type:"managed",description:"Encryption passphrase for iOS certificates (fastlane match)"}),o.success(d.green("\u2713 Saved passphrase to Dashboard"))}catch{}return r}let a=Be.randomBytes(32).toString("base64");try{await V.post(`/projects/${e}/secrets`,{key:t,value:a,type:"managed",description:"Encryption passphrase for iOS certificates (fastlane match)",visibility:"secret"}),o.success(d.green("\u2713 Generated and saved encryption passphrase to Dashboard")),o.info(d.cyan(`MATCH_PASSWORD: ${a}`))}catch(i){o.warn(d.yellow(`Could not save passphrase to Dashboard: ${i.message}`))}return a}async function In(e,t,n,a,i,r,s,l){let c=Ae(),f=!1,I=A=>{c.start(A),f=!0},g=A=>{f&&(c.stop(A),f=!1)};o.info(d.blue("Configuring iOS certificate management..."));let u,C=ge(s,n),p=C;if(!l){let A=await q({message:"Apple ID (for Apple Developer Portal):",placeholder:"your-email@example.com",validate:v=>v.includes("@")?void 0:"Please enter a valid email"});T(A)&&(H("Operation cancelled"),process.exit(0)),l=A}try{let A=await fn(e),v="",$="";try{let Z=await V.post("/credentials/build-server-token",{projectId:e});Z.data.status==="success"&&Z.data.credentials&&(process.env.AWS_ACCESS_KEY_ID=Z.data.credentials.accessKeyId,process.env.AWS_SECRET_ACCESS_KEY=Z.data.credentials.secretAccessKey,Z.data.credentials.sessionToken&&(process.env.AWS_SESSION_TOKEN=Z.data.credentials.sessionToken),$=Z.data.credentials.region||"ap-south-1",v=Z.data.credentials.bucket||m.bucketPrefix,process.env.AWS_REGION=$,delete process.env.AWS_PROFILE)}catch(Z){throw o.error(`Failed to authenticate with ${m.name} Cloud.`),Z}if(!v||!$){o.error(`Failed to resolve S3 configuration from ${m.name} Cloud.`);return}let h=r.teamId||C.teamId||s.submit?.production?.ios?.appleTeamId;if(!h)try{let te=(await V.get(`/projects/${e}/secrets`)).data.secrets?.find(z=>z.key==="APPLE_TEAM_ID");te&&(h=te.value,o.info(d.dim(`Using Team ID from Dashboard: ${h}`)))}catch{}h&&h===s.submit?.production?.ios?.appleTeamId&&o.info(d.dim(`Using Apple Team ID from config: ${h}`));let x=await me({appleId:l,config:s,profile:n,initialTeam:{...C,teamId:h,developerTeamId:C.developerTeamId||h},promptToPersistConfig:!h,saveTeamId:h?void 0:Z=>ot(e,Z)});if(!x?.teamId)return;h=x.teamId;let b={...C,...x,teamId:h,developerTeamId:x.developerTeamId||C.developerTeamId||h};p=b;let D=$t(e,h);o.info(d.dim(`Using match storage prefix: ${D}`));let _=await tn(),J={..._.env};process.env.CI||delete J.CI,I(`Preparing ${i} certificate sync...`),g("Starting certificate sync...");let k=`${m.buildPrefix}-${h}.keychain-db`,X=m.keychainPassword;try{let te=`${process.env.HOME||"/Users/"+(process.env.USER||m.nameLower)}/Library/Keychains/${k}`;o.info(d.dim(`Ensuring keychain exists: ${k}`));try{O(`security create-keychain -p ${X} ${k} 2>/dev/null || true`),O(`security unlock-keychain -p ${X} ${k}`),O(`security set-keychain-settings ${k}`);let R=O("security list-keychains -d user").toString();if(!R.includes(k)){o.info(d.dim(`Adding ${k} to search list`));let S=[...R.replace(/"/g,"").split(`
-`).map(G=>G.trim()).filter(G=>G.length>0),te].join(" ");O(`security list-keychains -d user -s ${S}`)}}catch(R){o.warn(d.dim("Keychain setup warning (non-critical): "+R.message))}let z,ce;try{let W=((await V.get(`/credentials/${e}`)).data.credentials||[]).find(S=>S.type==="asc_api_key"&&S.issuerId);if(W){let S=await V.get(`/credentials/${W.credentialId}/download`,{params:{projectId:e,format:"raw"}});if(S.data.downloadUrl){let B=await(await import("axios")).default.get(S.data.downloadUrl,{responseType:"arraybuffer"}),K=w.join(Ce.tmpdir(),`mach-asc-${Date.now()}`);y.mkdirSync(K,{recursive:!0}),u=w.join(K,`AuthKey_${W.keyId}.p8`),y.writeFileSync(u,Buffer.from(B.data)),z=W.keyId,ce=W.issuerId,o.success(d.green("\u2713 ASC API key loaded \u2014 no 2FA required for Portal operations"))}}}catch(R){o.warn(d.dim(`Could not load ASC API key: ${R.message}. Will fall back to Apple ID auth.`))}o.info(d.dim("Generating secure P12 export password..."));let Ye=ft();o.success(d.green("\u2713 Secure P12 password generated."));let j={...J,AWS_REGION:process.env.AWS_REGION||"ap-south-1",AWS_ACCESS_KEY_ID:process.env.AWS_ACCESS_KEY_ID,AWS_SECRET_ACCESS_KEY:process.env.AWS_SECRET_ACCESS_KEY,SSL_CERT_FILE:"/etc/ssl/cert.pem",AWS_CA_BUNDLE:"/etc/ssl/cert.pem",FASTLANE_SSL_CA_CERT:"/etc/ssl/cert.pem",MATCH_PASSWORD:A,FASTLANE_USER:l,FASTLANE_SKIP_UPDATE_CHECK:"1",FASTLANE_TEAM_ID:h,MATCH_KEYCHAIN_NAME:te,MATCH_KEYCHAIN_PASSWORD:X,TERM:process.env.TERM||"xterm-256color",SHELL:process.env.SHELL||"/bin/zsh",MATCH_OUTPUT_PATH:w.join(process.cwd(),"temp_match"),MATCH_STORAGE_MODE:"s3",MATCH_S3_REGION:$,MATCH_S3_BUCKET:v,MATCH_S3_OBJECT_PREFIX:D,MATCH_USERNAME:l,MATCH_APP_IDENTIFIER:t,MATCH_TYPE:i,[`${m.envPrefix}P12_PASSWORD`]:Ye,...u&&z&&ce?{APP_STORE_CONNECT_API_KEY_KEY_ID:z,APP_STORE_CONNECT_API_KEY_ISSUER_ID:ce,APP_STORE_CONNECT_API_KEY_KEY_FILEPATH:u,FASTLANE_SKIP_2FA:"1"}:{}};if(r.force){o.warn(d.yellow(`
-\u26A0\uFE0F  Force flag detected: Hard resetting ${i} certificates...`)),o.info(d.dim("Detected decryption failure loop. Clearing remote storage directly to allow fresh generation.")),o.info(d.cyan(`Current MATCH_PASSWORD: ${A}`)),o.info(d.dim(`Cleaning match storage for Team ID: ${h}...`));try{(await V.post("/credentials/clean-match-storage",{projectId:e,teamId:h,storagePrefix:D})).data.status==="success"&&o.success(d.green(`\u2713 Cleared S3 storage for Team ID: ${h}`))}catch(R){o.warn(d.yellow(`S3 cleanup via API failed: ${R.message}`)),o.info(d.dim("Continuing to attempt standard nuke..."))}try{O(`${_.shellCommand} match nuke ${i} --skip_confirmation`,{stdio:"inherit",cwd:process.cwd(),env:j}),o.success(d.green(`\u2713 Nuked existing ${i} credentials`))}catch{o.warn(d.yellow("Standard nuke failed (likely due to password mismatch).")),o.info(d.dim("Since S3 was cleared manually, proceeding to generation..."))}}let Ze=i==="adhoc"||i==="development";if(i==="adhoc"||i==="development")try{o.info(d.blue("Fetching registered devices..."));let W=(await V.get("/devices",h?{params:{teamId:h}}:void 0)).data.devices||[];if(h)try{let S=await V.get("/devices",{params:{teamId:"LEGACY"}}),G=new Map;for(let B of[...W,...S.data.devices||[]])G.set(B.udid,B);W=Array.from(G.values())}catch{}if(W.length===0)o.warn(d.yellow("No registered devices found. Profile will only include devices already on the Apple Developer Portal.")),o.info(d.dim(`Register devices with: ${m.nameLower} device register`));else{let{multiselect:S}=await import("@clack/prompts"),G=await S({message:`Select devices to include in the ${i} profile:`,options:W.map(B=>({value:B.udid,label:`${B.name} (${B.udid.substring(0,12)}...)`,hint:B.model||B.platform})),initialValues:W.map(B=>B.udid)});if(!T(G)&&G.length>0){let B=W.filter(K=>G.includes(K.udid));if(o.info(d.blue(`Registering ${B.length} device(s) on Apple Developer Portal...`)),h&&await Promise.all(B.filter(K=>!K.teamId).map(K=>V.post("/devices",{udid:K.udid,name:K.name,platform:"ios",addedVia:K.addedVia||"cli",teamId:h,teamName:b.teamName}).catch(()=>{}))),u&&z&&ce)await un(B,z,ce,u);else{o.info(d.dim("You will be prompted for a 2FA code once \u2014 type it and press Enter."));for(let K of B){let It=K.name.replace(/"/g,'\\"');M(`${_.shellCommand} run register_device name:"${It}" udid:"${K.udid}"`,{shell:!0,env:j,stdio:"inherit",cwd:process.cwd()})}}o.info(d.green("\u2713 Device registration complete.")),Ze=!0}}}catch(R){o.warn(d.yellow(`Could not fetch registered devices: ${R.message}`)),o.info(d.dim("Continuing without explicit device registration."))}try{let R=`${m.nameLower} ${i} ${t}`,W=Lt(_.shellCommand,i,t,R,Ze);Ze&&o.info(d.dim(`Refreshing ${i} provisioning profile when device list changes (--force_for_new_devices).`));let S=M(W,{shell:!0,cwd:process.cwd(),env:j,stdio:"inherit",encoding:"utf-8"});if(S.status!==0){o.warn(d.yellow(`
-Certificate sync failed. Attempting to create App ID and retry...`));try{O(`${_.shellCommand} produce --app_identifier "${t}" --app_name "${t}" --skip_itc`,{stdio:"inherit",env:j}),o.success(d.green("\u2713 App ID created successfully")),o.info(d.blue("Retrying certificate sync...")),S=M(W,{shell:!0,cwd:process.cwd(),env:j,stdio:"inherit",encoding:"utf-8"})}catch{}if(S.status!==0)throw new Error("fastlane match failed")}}catch(R){o.warn(d.yellow(`
-Sync failed. This often happens if the encryption passphrase (MATCH_PASSWORD) is incorrect or session expired.`)),o.info(d.cyan(`Failed MATCH_PASSWORD was: ${A}`));let W=await ne({message:"What would you like to do?",options:[{value:"retry_password",label:"Retry with a different MATCH_PASSWORD",hint:"Manually enter the decryption passphrase"},{value:"check_portal",label:"Check Apple Portal (Resolve certificate limits)",hint:"See if you have too many certificates"},{value:"manual",label:"Fallback to manual upload",hint:"Provide .p12 and .mobileprovision files"},{value:"cancel",label:"Cancel",hint:"Go back"}]});if(T(W)||W==="cancel")throw R;if(W==="retry_password"){o.info(d.dim(`
-You are overriding the dashboard passphrase for this session.`));let S=await ve({message:"Enter the correct MATCH_PASSWORD for this project:"});if(S&&!T(S)){A=S,o.info(d.blue("Retrying with provided passphrase...")),o.info(d.cyan(`New MATCH_PASSWORD: ${A}`));let G={...j,MATCH_PASSWORD:A};if(M(`${_.shellCommand} match ${i}`,{shell:!0,stdio:"inherit",cwd:process.cwd(),env:G}).status===0)await V.post(`/projects/${e}/secrets`,{key:"MATCH_ENCRYPTION_PASSPHRASE",value:A,description:"Encryption passphrase for iOS certificates (fastlane match)",visibility:"secret"}),o.success(d.green("\u2713 Dashboard passphrase updated.")),o.info(d.cyan(`MATCH_PASSWORD: ${A}`));else throw new Error("Sync failed again with provided passphrase.")}else throw R}else if(W==="check_portal")try{let S=await xe(j,i,_.shellCommand);if(S.length>0){if(o.info(d.dim(`Found ${S.length} existing ${i} certificates on the portal.`)),await Sn(i,j,e,_.shellCommand,S)&&(o.info(d.blue("Retrying certificate sync...")),M(`${_.shellCommand} match ${i}`,{shell:!0,stdio:"inherit",cwd:process.cwd(),env:j}).status!==0))throw new Error("Retry failed")}else throw o.error(d.red("No existing certificates found on portal to resolve.")),R}catch(S){throw o.warn(d.dim(`Portal check warning: ${S.message}`)),R}else throw R}o.success(d.green("\u2713 Certificates fetched and synced"));let pe=w.join(process.cwd(),"temp_match"),ue=w.join(pe,`${m.fastlanePrefix}_export.p12`),De=Pe(pe,/\.mobileprovision$/);try{let W=`${process.env.HOME||"/Users/"+(process.env.USER||m.nameLower)}/Library/Keychains/${k}`;y.existsSync(pe)||y.mkdirSync(pe,{recursive:!0}),o.info(d.dim("Exporting certificate from keychain for dashboard upload..."));let S=O(`security find-identity -v -p codesigning "${W}"`,{encoding:"utf-8"});o.info(d.dim(`Identities in keychain:
-${S.trim()}`)),O(`security export -k "${W}" -t identities -f pkcs12 -o "${ue}" -P ""`,{stdio:"ignore"});try{let G=O(`openssl pkcs12 -in "${ue}" -nokeys -passin pass: -legacy 2>/dev/null || openssl pkcs12 -in "${ue}" -nokeys -passin pass: 2>/dev/null`,{encoding:"utf-8"});if(!G.includes(h))throw new Error(`Exported P12 does not contain identity for team ${h}. Found: ${G.substring(0,200)}`);o.success(d.green(`\u2713 P12 verified \u2014 contains correct team identity (${h})`))}catch(G){throw new Error(`P12 verification failed: ${G.message}`)}}catch{o.warn(d.dim("Could not export certificate from keychain."))}r.teamId&&!h&&await ot(e,r.teamId);let Je=y.existsSync(ue)?ue:Pe(pe,/\.p12$/);if(Je&&De){let R,W;try{let S=await xe(j,i,_.shellCommand);S.length>0&&(R=S[0].expires,W=S[0].id)}catch{o.warn(d.dim("Could not fetch expiration date or ID for dashboard record."))}await de(e,Je,"ios_cert",t,a,void 0,R,r.teamId||h,W,Ye,void 0,void 0,b.teamId,b.teamName,b.developerTeamId,b.appStoreConnectTeamId,b.providerId,b.providerName),await de(e,De,"ios_profile",t,a,void 0,R,r.teamId||h,void 0,void 0,void 0,void 0,b.teamId,b.teamName,b.developerTeamId,b.appStoreConnectTeamId,b.providerId,b.providerName),o.success(d.green("\u2713 Both iOS certificate and provisioning profile uploaded successfully"));try{y.existsSync("./temp_match")&&y.rmSync("./temp_match",{recursive:!0,force:!0})}catch{}}else o.warn(d.yellow("Certificates generated but not found in expected location.")),o.info(d.dim("Falling back to manual upload...")),await lt(e,t,a,p)}catch(Z){g("Certificate fetch failed"),o.error(d.red(`Error: ${Z.message}`)),o.info(d.dim("Falling back to manual upload...")),await lt(e,t,a,p)}}catch(A){g("iOS setup failed"),o.error(d.red(`Error: ${A.message}`))}finally{if(u)try{y.rmSync(w.dirname(u),{recursive:!0,force:!0})}catch{}}}async function ot(e,t){try{await V.post(`/projects/${e}/secrets`,{key:"APPLE_TEAM_ID",value:t,description:"Apple Developer Team ID (used for iOS signing)"}),o.success(d.green(`\u2713 Saved Team ID ${t} to Dashboard`))}catch(n){o.warn(d.yellow(`Could not save Team ID to Dashboard: ${n.message}`))}}async function lt(e,t,n,a={}){o.info(d.yellow(`
-Manual Upload Mode`)),o.info("Please provide your certificate and provisioning profile:");let i=await q({message:"Path to .p12 certificate file:",validate:l=>y.existsSync(l)?void 0:"File not found"});T(i)&&(H("Operation cancelled"),process.exit(0));let r=await q({message:"Path to .mobileprovision file:",validate:l=>y.existsSync(l)?void 0:"File not found"});T(r)&&(H("Operation cancelled"),process.exit(0));let s=Ae();s.start(`Uploading to ${m.name} Dashboard...`);try{await de(e,i,"ios_cert",t,n,void 0,void 0,a.teamId,void 0,void 0,void 0,void 0,a.teamId,a.teamName,a.developerTeamId||a.teamId,a.appStoreConnectTeamId,a.providerId,a.providerName),await de(e,r,"ios_profile",t,n,void 0,void 0,a.teamId,void 0,void 0,void 0,void 0,a.teamId,a.teamName,a.developerTeamId||a.teamId,a.appStoreConnectTeamId,a.providerId,a.providerName),s.stop("Upload complete"),o.success(d.green("\u2713 iOS credentials uploaded successfully"))}catch(l){throw s.stop("Upload failed"),l}}async function An(e,t,n,a,i){let r=Ae();o.step(d.blue("Android Credential Setup"));let s=a.bundleId;if(!s){let g=be(i,t),u=[];try{let p=(await V.get(`/credentials/${e}`)).data.credentials||[];u=[...new Set(p.filter(A=>A.platform==="android"&&A.bundleId&&A.bundleId!=="*").map(A=>A.bundleId))]}catch{}if(g&&!u.includes(g)&&u.unshift(g),u.length>0){let C=[...u.map(A=>({value:A,label:A,hint:A===g?"from config":void 0})),{value:"__new__",label:"+ Enter a new Package Name"}],p=await ne({message:"Which Package Name are you setting up credentials for?",options:C});if(T(p)&&(H("Operation cancelled"),process.exit(0)),p==="__new__"){let A=await q({message:"Android Package Name (e.g. com.example.app):",placeholder:"com.example.app",validate:v=>v.includes(".")?void 0:"Please enter a valid package name"});T(A)&&(H("Operation cancelled"),process.exit(0)),s=A}else s=p}else{let C=await q({message:"Android Package Name (e.g. com.example.app):",placeholder:"com.example.app",validate:p=>p.includes(".")?void 0:"Please enter a valid package name"});T(C)&&(H("Operation cancelled"),process.exit(0)),s=C}}try{let C=((await V.get(`/credentials/${e}`)).data.credentials||[]).find(p=>p.platform==="android"&&p.distributionType===n&&p.bundleId===s);if(C){o.warn(d.yellow(`\u26A0\uFE0F  Existing Android credentials found for ${n}`));let p=await q({message:"What would you like to do? (use/new/cancel)",validate:A=>{let v=A.toLowerCase();if(!(v==="use"||v==="new"||v==="cancel"))return"Please type: use, new, or cancel"}});if(T(p)||p.toLowerCase()==="cancel")return;if(p.toLowerCase()==="use"){o.success(d.green("\u2713 Using existing credentials."));return}await V.delete(`/credentials/${C.credentialId}?projectId=${e}`)}}catch{}let l="./android/app/my-release-key.jks";if(y.existsSync(l)){let g=await dt({message:"Upload existing keystore?"});if(g&&!T(g)){let u=await q({message:"Key alias:",initialValue:"my-key-alias"});if(T(u))return;let C=await ve({message:"Keystore password:"});if(T(C))return;let p=await ve({message:"Key password (leave blank if same as keystore password):"});if(T(p))return;let A=p.trim()||C;await de(e,l,"android_keystore",s,n,u,void 0,void 0,void 0,void 0,C,A),o.success(d.green("\u2713 Keystore uploaded"));return}}o.info(d.blue("Generating new Android keystore..."));let c=a.keyAlias||`${m.nameLower}-${bn()}`,f=ft(),I=`./${m.nameLower}-${t}.jks`;y.existsSync(I)&&y.unlinkSync(I),r.start("Generating keystore...");try{let g=f.replace(/'/g,"'\\''");O(`keytool -genkeypair -v -keystore "${I}" -alias "${c}" -keyalg RSA -keysize 2048 -validity 10000 -storepass '${g}' -keypass '${g}' -dname "CN=${m.name} Build, OU=Mobile, O=Company, L=City, S=State, C=US"`,{stdio:"inherit"}),r.stop("Keystore generated"),await de(e,I,"android_keystore",s,n,c,void 0,void 0,void 0,void 0,f,f),o.success(d.green("\u2713 Android credentials uploaded successfully")),o.info(d.cyan(`Key Alias: ${c}`))}catch(g){throw r.stop("Generation failed"),new Error(`Keystore generation failed: ${g.message}`)}}var Cn=e=>new Promise(t=>setTimeout(t,e));function yn(e){return/ECONNRESET|ETIMEDOUT|EAI_AGAIN|ENOTFOUND|ECONNABORTED|socket hang up|network|timeout|temporar/i.test(e)||/API_ERROR:\s*(408|409|425|429|5\d\d)/i.test(e)}async function de(e,t,n,a,i,r,s,l,c,f,I,g,u,C,p,A,v,$){let h=w.basename(t);o.info(d.dim(`Uploading ${h} (Isolated process)...`));let x=new URL(import.meta.url),b=w.dirname(x.pathname),_=[w.join(b,"commands","isolated-upload.js"),e,t,n,a,i,r||"undefined",s||"undefined",l||"undefined",c||"undefined",f||"undefined",I||"undefined",g||"undefined",u||"undefined",C||"undefined",p||"undefined",A||"undefined",v||"undefined",$||"undefined"],J="",k=5;for(let X=1;X<=k;X++){let Z=M("node",_,{stdio:"pipe",encoding:"utf-8",env:{...process.env,AT_CLI_ISOLATED:"1"}});if(Z.status===0&&Z.stdout.includes("SUCCESS")){o.info(d.dim(`\u2713 ${h} uploaded and registered.`));return}if(Z.status===0){o.warn(d.yellow(`Isolated upload finished but success not confirmed: ${Z.stdout}`));return}if(J=(Z.stderr||Z.stdout||Z.error?.message||"Unknown isolated upload failure").trim(),!yn(J)||X>=k)throw o.error(d.red(`Isolated Upload Failed: ${J}`)),new Error(J);let z=Math.min(3e4,1500*Math.pow(2,X-1));o.warn(d.yellow(`Upload failed with a transient error. Retrying ${h} in ${Math.round(z/1e3)}s... (${X}/${k})`)),await Cn(z)}throw new Error(J||"Unknown isolated upload failure")}async function hn(e){let t=Ae(),n=e.platform,a=`./${m.configFileName}`;if(!y.existsSync(a)){o.error(`No ${m.configFileName} found. Run \`${m.nameLower} init\` or \`${m.nameLower} link\` first.`);return}let i=JSON.parse(y.readFileSync(a,"utf-8")),{projectId:r}=i;if(!r){o.error(`${m.configFileName} is missing projectId.`);return}try{t.start("Fetching project secrets...");let l=(await V.get(`/projects/${r}/secrets/export?env=all`)).data.secrets||{};t.stop("Secrets fetched and merged."),t.start("Fetching credentials...");let f=(await V.get(`/credentials/${r}`)).data.credentials||[];t.stop(`Found ${f.length} metadata records.`);let I=f.filter(p=>p.platform===n);if(I.length===0){o.info(`No ${n} credentials found on Dashboard.`);return}let g="./credentials.json",u={};if(y.existsSync(g))try{u=JSON.parse(y.readFileSync(g,"utf-8"))}catch{o.warn("Could not parse existing credentials.json, creating a new one.")}u[n]||(u[n]={});let C=w.join(process.cwd(),"credentials",n);y.existsSync(C)||y.mkdirSync(C,{recursive:!0});for(let p of I){t.start(`Downloading ${p.type} (${p.distributionType})...`);try{let A=await V.get(`/credentials/${p.credentialId}/download`,{params:{projectId:r,format:"raw"}});if(A.data.status==="success"&&A.data.downloadUrl){let v=w.join(process.cwd(),"credentials",n,p.distributionType);y.existsSync(v)||y.mkdirSync(v,{recursive:!0});let $=p.s3Key?.split(".").pop()||(p.type.includes("keystore")?"jks":p.type.includes("cert")?"p12":"mobileprovision"),h=`${p.type}.${$}`,x=w.join(v,h),b=await pt.get(A.data.downloadUrl,{responseType:"arraybuffer"});y.writeFileSync(x,Buffer.from(b.data));let D=w.join("credentials",n,p.distributionType,h),_="",J="",k={alias:"",keystorePassword:"",keyPassword:""};if(n==="ios"&&p.type==="ios_cert"||n==="android"&&p.type==="android_keystore"){let X=await an(r,n,p);if(n==="ios"&&p.type==="ios_cert"&&$.toLowerCase()==="p12"){if(_=sn(X,l),_){let Z=rt(x,`${w.basename(x,w.extname(x))}-password.txt`,_);J=w.join("credentials",n,p.distributionType,w.basename(Z))}}else if(n==="android"&&p.type==="android_keystore"&&(k=on(X,l),k.keystorePassword||k.keyPassword)){let Z=[k.alias?`keyAlias=${k.alias}`:void 0,k.keystorePassword?`keystorePassword=${k.keystorePassword}`:void 0,k.keyPassword?`keyPassword=${k.keyPassword}`:void 0].filter(Boolean).join(`
-`),te=rt(x,`${w.basename(x,w.extname(x))}-passwords.txt`,Z);J=w.join("credentials",n,p.distributionType,w.basename(te))}}if(n==="android")p.type==="android_keystore"&&(u.android.keystore={keystorePath:D,keystorePassword:k.keystorePassword,keyAlias:k.alias,keyPassword:k.keyPassword},J&&(u.android.keystore.keystoreArchivePath=J));else if(n==="ios"){let X=p.distributionType==="store"?"production":p.distributionType==="adhoc"?"staging":"development";u.ios[X]||(u.ios[X]={}),p.type==="ios_cert"?(u.ios[X].certificatePath=D,u.ios[X].certificatePassword=_,J&&(u.ios[X].certificateArchivePath=J)):p.type==="ios_profile"&&(u.ios[X].provisioningProfilePath=D)}t.stop(`\u2713 ${p.type} (${p.distributionType}) saved${J?" with password archive":""}.`)}}catch(A){let v=A.response?.data?.message||A.message;t.stop(d.dim(`- Skipped ${p.type} (${p.distributionType}): ${v}`))}}y.writeFileSync(g,JSON.stringify(u,null,2)),o.success(d.green("\u2713 Local credentials.json updated.")),ct("Credentials have been synced to your local machine. Ensure credentials.json and credentials/ is added to your .gitignore.","Sync Complete")}catch(s){t.stop(d.red("Sync failed.")),o.error(`Error: ${s.message}`)}}function ft(){let e="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_+=",t="";for(let n=0;n<24;n++)t+=e.charAt(Math.floor(Math.random()*e.length));return t}function bn(e=8){let t="abcdefghijklmnopqrstuvwxyz0123456789",n="";for(let a=0;a<e;a++)n+=t.charAt(Math.floor(Math.random()*t.length));return n}async function Sn(e,t,n,a,i){let r=i||await xe(t,e,a);if(!r||r.length===0)return!1;let s=await ne({message:"Select a certificate to revoke:",options:[...r.map(l=>({value:`revoke:${l.id}`,label:`Revoke: ${l.name} (${l.expires})`})),{value:"nuke",label:"Revoke All"},{value:"cancel",label:"Cancel"}]});return T(s)||s==="cancel"?!1:s==="nuke"?(O(`${a} match nuke ${e}`,{stdio:"inherit",cwd:process.cwd(),env:t}),!0):typeof s=="string"&&s.startsWith("revoke:")?(await wn(t,s.split(":")[1],a),!0):!1}async function xe(e,t,n){let a=t==="development"?"development":"distribution",i=`
-lane :${m.fastlanePrefix}_list_certs do
-  require 'spaceship'
-  require 'json'
-  begin
-    Spaceship::Portal.login(ENV['FASTLANE_USER'])
-    Spaceship::Portal.select_team(team_id: ENV['FASTLANE_TEAM_ID'])
-    output = Spaceship::Portal.certificate.all.select { |c|
-      if "${a}" == "development"
-        c.type_display_id.downcase.include?("development")
-      else
-        c.type_display_id.downcase.include?("distribution") || c.type_display_id.downcase.include?("production")
-      end
-    }.map { |c| { id: c.id, name: c.name, expires: c.expires.strftime('%Y-%m-%d'), type: c.type_display_id } }
-    puts "${m.jsonStartMarker}" + output.to_json + "${m.jsonEndMarker}"
-  rescue => e
-    $stderr.puts "ERROR: #{e.message}"
-    exit 1
-  end
-end`,r=w.join(Ce.tmpdir(),`/tmp/${m.nameLower}-list-certs-${Date.now()}`),s=w.join(r,"fastlane"),l=w.join(s,"Fastfile");try{y.existsSync(s)||y.mkdirSync(s,{recursive:!0}),y.writeFileSync(l,i);let f=O(`${n} ${m.fastlanePrefix}_list_certs`,{env:{...e,CI:"1",FASTLANE_FASTFILE:l},cwd:r,stdio:["inherit","pipe","inherit"]}).toString().match(new RegExp(`${m.jsonStartMarker}(.*)${m.jsonEndMarker}`));return f?JSON.parse(f[1]):[]}finally{y.existsSync(r)&&y.rmSync(r,{recursive:!0,force:!0})}}async function wn(e,t,n){let a=`
-lane :${m.fastlanePrefix}_revoke_cert do
-  require 'spaceship'
-  begin
-    Spaceship::Portal.login(ENV['FASTLANE_USER'])
-    Spaceship::Portal.select_team(team_id: ENV['FASTLANE_TEAM_ID'])
-    cert = Spaceship::Portal.certificate.all.find { |c| c.id == "${t}" }
-    cert.revoke! if cert
-  rescue => e
-    $stderr.puts "ERROR: #{e.message}"
-    exit 1
-  end
-end`,i=w.join(Ce.tmpdir(),`/tmp/${m.nameLower}-revoke-cert-${Date.now()}`),r=w.join(i,"fastlane"),s=w.join(r,"Fastfile");try{y.existsSync(r)||y.mkdirSync(r,{recursive:!0}),y.writeFileSync(s,a),O(`${n} ${m.fastlanePrefix}_revoke_cert`,{env:{...e,CI:"1",FASTLANE_FASTFILE:s},cwd:i,stdio:["inherit","pipe","inherit"]})}finally{y.existsSync(i)&&y.rmSync(i,{recursive:!0,force:!0})}}export{Wn as a,yt as b,Vn as c,ge as d,kn as e,re as f,be as g,Se as h,Nn as i,je as j,st as k,gn as l,hn as m};