@radhya/mach 2.2.5 → 2.3.2

package/dist/index.js

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
-import{A as we,B as Fn,C as Bn,D as _t,E as $o,F as et,G as Ro,H as Oo,I as Vi,J as Po,K as Do,M as Vt,a as ft,b as Ao,c as yo,d as Fi,e as So,f as bo,g as kn,h as Nn,i as xn,j as Bi,k as Hi,l as Ln,m as Mn,n as Eo,o as Io,p as _o,q as ji,r as Gt,s as wo,t as Gi,u as It,v as Un,w as Re,x as vo,y as mt,z as ce}from"./chunk-5YQ3HOF2.js";import{a as m,b as go,c as ye,d as ho,e as Et,f as Qe,g as je,h as $}from"./chunk-LO6DP2SE.js";import{Command as ug,Option as Ne}from"commander";import{configDotenv as pg}from"dotenv";import{intro as X,outro as fd}from"@clack/prompts";import q from"chalk";import{text as Co,confirm as yd,spinner as Sd,isCancel as zi,cancel as zt,note as bd,outro as Ed}from"@clack/prompts";import Kt from"chalk";async function To(){try{let e=await Co({message:"Enter Bucket Name:",placeholder:"e.g. my-app-dev",validate(r){if(r.length===0)return"Bucket name is required"}});zi(e)&&(zt("Operation cancelled."),process.exit(0));let t=await Co({message:"Enter Region:",initialValue:"ap-south-1"});zi(t)&&(zt("Operation cancelled."),process.exit(0));let n=await yd({message:"Do you want to create a CloudFront Distribution for this bucket?",initialValue:!0});zi(n)&&(zt("Operation cancelled."),process.exit(0));let i=Sd();i.start("Setting up hosting infrastructure...");try{let r=await $.post("/hosting/setup",{bucketName:e,region:t,createCloudFront:n});if(r.data.status!=="success")throw new Error(r.data.message||"Hosting setup failed");i.stop("Hosting setup complete!");let o=r.data,s=`Bucket Name:      ${Kt.cyan(o.bucketName)}
-`;s+=`Region:           ${Kt.cyan(o.region)}
-`,s+=`S3 Website URL:   ${Kt.blue(o.s3WebsiteUrl)}`,o.cloudFrontId&&(s+=`
+import{A as _t,B as Bn,C as ve,D as $o,E as gt,F as le,G as _e,H as Hn,I as jn,J as $t,K as wo,L as et,M as vo,N as Ro,O as Hi,P as Oo,Q as Po,S as qt,a as mt,b as po,c as fo,d as Li,e as mo,f as go,g as xn,h as Ln,i as Mn,j as Mi,k as Ui,l as Un,m as Fn,n as ho,o as Ao,p as yo,q as Fi,r as Kt,s as So,t as bo,u as Io,v as Wt,w as Yt,x as Eo,y as _o,z as Bi}from"./chunk-GICET2HT.js";import{a as m,b as co,c as ye,d as uo,e as Et,f as Qe,g as je,h as $}from"./chunk-LO6DP2SE.js";import{Command as eg,Option as Ne}from"commander";import{configDotenv as tg}from"dotenv";import{intro as X,outro as ld}from"@clack/prompts";import Y from"chalk";import{text as Do,confirm as fd,spinner as md,isCancel as ji,cancel as Jt,note as gd,outro as hd}from"@clack/prompts";import Xt from"chalk";async function Co(){try{let e=await Do({message:"Enter Bucket Name:",placeholder:"e.g. my-app-dev",validate(r){if(r.length===0)return"Bucket name is required"}});ji(e)&&(Jt("Operation cancelled."),process.exit(0));let t=await Do({message:"Enter Region:",initialValue:"ap-south-1"});ji(t)&&(Jt("Operation cancelled."),process.exit(0));let n=await fd({message:"Do you want to create a CloudFront Distribution for this bucket?",initialValue:!0});ji(n)&&(Jt("Operation cancelled."),process.exit(0));let i=md();i.start("Setting up hosting infrastructure...");try{let r=await $.post("/hosting/setup",{bucketName:e,region:t,createCloudFront:n});if(r.data.status!=="success")throw new Error(r.data.message||"Hosting setup failed");i.stop("Hosting setup complete!");let o=r.data,s=`Bucket Name:      ${Xt.cyan(o.bucketName)}
+`;s+=`Region:           ${Xt.cyan(o.region)}
+`,s+=`S3 Website URL:   ${Xt.blue(o.s3WebsiteUrl)}`,o.cloudFrontId&&(s+=`
 
-CloudFront ID:    ${Kt.cyan(o.cloudFrontId)}`,s+=`
-CloudFront URL:   ${Kt.blue(o.cloudFrontUrl)}`),bd(s,"Setup Complete!"),Ed("You are all set!")}catch(r){i.stop("Setup failed"),zt(`Error: ${r.response?.data?.message||r.message}`)}}catch(e){zt(`An unexpected error occurred: ${e.message}`)}}import{readdir as Id,writeFile as _d,access as wd,mkdir as vd}from"fs/promises";import{join as ko}from"path";import{spinner as $d,text as No,isCancel as xo,cancel as Ki,note as Rd,outro as Od}from"@clack/prompts";import Pd from"chalk";async function Dd(){let e=["./app","./src/app"];for(let t of e)try{return await wd(t),t}catch{}return null}async function Lo(e){try{let n=await Dd()||"./app",i=await No({message:"Enter path to your app directory:",placeholder:n,initialValue:n,validate(c){if(c.length===0)return"Path is required"}});xo(i)&&(Ki("Operation cancelled."),process.exit(0));let r=await No({message:"Enter your website base URL:",placeholder:"https://example.com",validate(c){if(c.length===0)return"Base URL is required";if(!c.startsWith("http"))return"URL must start with http:// or https://"}});xo(r)&&(Ki("Operation cancelled."),process.exit(0));let o=$d();o.start("Scanning app directory for routes...");let s=await Mo(i);o.stop(`Found ${s.length} routes`);let a=Cd(s,r),l=e.output||"./public/sitemap.xml";o.start(`Writing sitemap to ${l}...`);let d=l.substring(0,l.lastIndexOf("/"));if(d)try{await vd(d,{recursive:!0})}catch{}await _d(l,a,"utf-8"),o.stop("Sitemap generated successfully!"),Rd(`Routes included:
+CloudFront ID:    ${Xt.cyan(o.cloudFrontId)}`,s+=`
+CloudFront URL:   ${Xt.blue(o.cloudFrontUrl)}`),gd(s,"Setup Complete!"),hd("You are all set!")}catch(r){i.stop("Setup failed"),Jt(`Error: ${r.response?.data?.message||r.message}`)}}catch(e){Jt(`An unexpected error occurred: ${e.message}`)}}import{readdir as Ad,writeFile as yd,access as Sd,mkdir as bd}from"fs/promises";import{join as To}from"path";import{spinner as Id,text as No,isCancel as ko,cancel as Gi,note as Ed,outro as _d}from"@clack/prompts";import $d from"chalk";async function wd(){let e=["./app","./src/app"];for(let t of e)try{return await Sd(t),t}catch{}return null}async function xo(e){try{let n=await wd()||"./app",i=await No({message:"Enter path to your app directory:",placeholder:n,initialValue:n,validate(c){if(c.length===0)return"Path is required"}});ko(i)&&(Gi("Operation cancelled."),process.exit(0));let r=await No({message:"Enter your website base URL:",placeholder:"https://example.com",validate(c){if(c.length===0)return"Base URL is required";if(!c.startsWith("http"))return"URL must start with http:// or https://"}});ko(r)&&(Gi("Operation cancelled."),process.exit(0));let o=Id();o.start("Scanning app directory for routes...");let s=await Lo(i);o.stop(`Found ${s.length} routes`);let a=vd(s,r),l=e.output||"./public/sitemap.xml";o.start(`Writing sitemap to ${l}...`);let d=l.substring(0,l.lastIndexOf("/"));if(d)try{await bd(d,{recursive:!0})}catch{}await yd(l,a,"utf-8"),o.stop("Sitemap generated successfully!"),Ed(`Routes included:
 ${s.map(c=>`  \u2022 ${c.path}`).join(`
-`)}`,"Sitemap Summary"),Od(`Sitemap saved to ${Pd.cyan(l)}`)}catch(t){Ki(`An error occurred: ${t.message}`)}}async function Mo(e,t=""){let n=[];try{let i=await Id(e,{withFileTypes:!0});for(let r of i){let o=ko(e,r.name);if(!(r.name.startsWith("_")||r.name.startsWith("."))){if(r.isDirectory()){let s=await Mo(o,ko(t,r.name));n.push(...s)}else if(r.isFile()){if(r.name==="index.tsx"||r.name==="index.ts"||r.name==="index.jsx"||r.name==="index.js"){let s=t===""?"/":`/${t}`;n.push({path:s,file:o})}else if(r.name.match(/\.(tsx|ts|jsx|js)$/)&&!r.name.includes("_layout")&&!r.name.includes("+")){let s=r.name.replace(/\.(tsx|ts|jsx|js)$/,""),a=`/${t}/${s}`.replace(/\/+/g,"/");n.push({path:a,file:o})}}}}}catch(i){throw new Error(`Failed to scan directory ${e}: ${i.message}`)}return n}function Cd(e,t){let n=new Date().toISOString().split("T")[0];return`<?xml version="1.0" encoding="UTF-8"?>
+`)}`,"Sitemap Summary"),_d(`Sitemap saved to ${$d.cyan(l)}`)}catch(t){Gi(`An error occurred: ${t.message}`)}}async function Lo(e,t=""){let n=[];try{let i=await Ad(e,{withFileTypes:!0});for(let r of i){let o=To(e,r.name);if(!(r.name.startsWith("_")||r.name.startsWith("."))){if(r.isDirectory()){let s=await Lo(o,To(t,r.name));n.push(...s)}else if(r.isFile()){if(r.name==="index.tsx"||r.name==="index.ts"||r.name==="index.jsx"||r.name==="index.js"){let s=t===""?"/":`/${t}`;n.push({path:s,file:o})}else if(r.name.match(/\.(tsx|ts|jsx|js)$/)&&!r.name.includes("_layout")&&!r.name.includes("+")){let s=r.name.replace(/\.(tsx|ts|jsx|js)$/,""),a=`/${t}/${s}`.replace(/\/+/g,"/");n.push({path:a,file:o})}}}}}catch(i){throw new Error(`Failed to scan directory ${e}: ${i.message}`)}return n}function vd(e,t){let n=new Date().toISOString().split("T")[0];return`<?xml version="1.0" encoding="UTF-8"?>
 <urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
 ${e.map(r=>{let o=r.path;return o=o.replace(/\/\([^)]+\)/g,""),o=o.replace(/\/\[.*?\]/g,"/:id"),o=o.replace(/\/+/g,"/"),o===""&&(o="/"),`  <url>
     <loc>${t}${o}</loc>
@@ -15,7 +15,7 @@ ${e.map(r=>{let o=r.path;return o=o.replace(/\/\([^)]+\)/g,""),o=o.replace(/\/\[
     <priority>0.8</priority>
   </url>`}).join(`
 `)}
-</urlset>`}import{randomUUID as Nu}from"crypto";import be from"path";import Jn from"axios";import xu from"os";import{spinner as _r,select as Us,confirm as Fs,isCancel as Xn,cancel as Bs,log as S}from"@clack/prompts";import I from"chalk";import re from"fs";import{execSync as Hs}from"child_process";import js from"adm-zip";import{spinner as Td,log as Hn}from"@clack/prompts";import Fo from"chalk";import Bo from"fs";import Ho from"path";var Uo=`#!/bin/bash
+</urlset>`}import{randomUUID as _u}from"crypto";import ge from"path";import Jn from"axios";import $u from"os";import{spinner as yr,select as ks,confirm as xs,isCancel as Xn,cancel as Ls,log as E}from"@clack/prompts";import _ from"chalk";import te from"fs";import{execSync as Ms}from"child_process";import Us from"adm-zip";import{spinner as Rd,log as Gn}from"@clack/prompts";import Uo from"chalk";import Fo from"fs";import Bo from"path";var Mo=`#!/bin/bash
 # --- Mach Cloud Build Script (Android) ---
 # All S3 operations use presigned URLs via curl \u2014 zero AWS credentials on instance.
 BUILD_ID="{{BUILD_ID}}"
@@ -722,16 +722,16 @@ for pid in "\${cache_pids[@]}"; do wait "$pid" || true; done
 echo "Build orchestrator finished. Auto-terminating instance in 5 seconds..."
 sleep 5
 sudo shutdown -h now
-`;var jn=e=>e.replace(/\\/g,"\\\\").replace(/"/g,'\\"').replace(/\$/g,"\\$").replace(/`/g,"\\`"),Wi=e=>["1","true","yes","on"].includes(String(e||"").trim().toLowerCase()),kd=e=>/(^|[-_])(maestro|e2e|test|emulator)([-_]|$)/i.test(e),Nd=(e,t,n)=>{let i=n.MACH_ANDROID_RELEASE_ABIS||n.MACH_ANDROID_ABIS||n.MACH_PROFILE_ANDROID_RELEASE_ABIS||n.MACH_PROFILE_ANDROID_ABIS||n.MACH_PROFILE_ANDROID_ARCHITECTURES||n.MACH_PROFILE_ANDROID_REACT_NATIVE_ARCHITECTURES;return i||(!!e.maestro||kd(t)||Wi(n.MACH_PROFILE_ANDROID_EMULATOR)||Wi(n.MACH_ANDROID_INCLUDE_EMULATOR_ABIS)||Wi(n.MACH_PROFILE_ANDROID_INCLUDE_EMULATOR_ABIS)?"armeabi-v7a,arm64-v8a,x86_64":"armeabi-v7a,arm64-v8a")},jo=async(e,t,n={},i,r)=>{let o=Td(),s=kn(e.framework),a=e.buildProfile||"production",l=a==="production",d=e.apk===!0,c=e.developmentClient?"assembleDebug":l?"bundleRelease":"assembleRelease",u=e.buildCommand||(d?"assembleRelease":c),f=e.nodeVersion?[`echo "[NODE] Switching to Node ${e.nodeVersion}..."`,`CURRENT_MAJOR=$(node -e "process.stdout.write(process.version.split('.')[0].replace('v',''))" 2>/dev/null || echo "0")`,`if [ "$CURRENT_MAJOR" != "${e.nodeVersion}" ]; then`,`  curl -fsSL https://deb.nodesource.com/setup_${e.nodeVersion}.x | bash - 2>&1`,"  apt-get install -y nodejs 2>&1",'  echo "[NODE] Installed Node $(node -v)"',"else",'  echo "[NODE] Already on Node $(node -v) \u2014 no switch needed"',"fi"].join(`
-`):"",p;if(r){let w=Ho.isAbsolute(r)?r:Ho.resolve(process.cwd(),r);Bo.existsSync(w)?(p=Bo.readFileSync(w,"utf-8"),Hn.info(Fo.magenta(`\u2713 Loaded preBuild hook: ${r}`))):Hn.warn(`preBuild script not found at ${w} \u2014 skipping`)}let g=Nd(e,a,n),h={...Nn(n,a,e),MACH_ANDROID_RELEASE_ABIS:g},A=xn(h),y=Uo.replace(/\{\{BUILD_ID\}\}/g,t).replace(/\{\{BUILD_COMMAND\}\}/g,u).replace("{{NODE_VERSION_SETUP}}",f).replace("{{ENV_VARS}}",`
-export MACH_APP_NAME="${jn(h.MACH_APP_NAME)}"
-export MACH_BUILD_PROFILE="${jn(a)}"
-export MACH_ANDROID_RELEASE_ABIS="${jn(g)}"
-export MACH_ENV_FINGERPRINT="${A}"
+`;var Vn=e=>e.replace(/\\/g,"\\\\").replace(/"/g,'\\"').replace(/\$/g,"\\$").replace(/`/g,"\\`"),Vi=e=>["1","true","yes","on"].includes(String(e||"").trim().toLowerCase()),Od=e=>/(^|[-_])(maestro|e2e|test|emulator)([-_]|$)/i.test(e),Pd=(e,t,n)=>{let i=n.MACH_ANDROID_RELEASE_ABIS||n.MACH_ANDROID_ABIS||n.MACH_PROFILE_ANDROID_RELEASE_ABIS||n.MACH_PROFILE_ANDROID_ABIS||n.MACH_PROFILE_ANDROID_ARCHITECTURES||n.MACH_PROFILE_ANDROID_REACT_NATIVE_ARCHITECTURES;return i||(!!e.maestro||Od(t)||Vi(n.MACH_PROFILE_ANDROID_EMULATOR)||Vi(n.MACH_ANDROID_INCLUDE_EMULATOR_ABIS)||Vi(n.MACH_PROFILE_ANDROID_INCLUDE_EMULATOR_ABIS)?"armeabi-v7a,arm64-v8a,x86_64":"armeabi-v7a,arm64-v8a")},Ho=async(e,t,n={},i,r)=>{let o=Rd(),s=xn(e.framework),a=e.buildProfile||"production",l=a==="production",d=e.apk===!0,c=e.developmentClient?"assembleDebug":l?"bundleRelease":"assembleRelease",u=e.buildCommand||(d?"assembleRelease":c),f=e.nodeVersion?[`echo "[NODE] Switching to Node ${e.nodeVersion}..."`,`CURRENT_MAJOR=$(node -e "process.stdout.write(process.version.split('.')[0].replace('v',''))" 2>/dev/null || echo "0")`,`if [ "$CURRENT_MAJOR" != "${e.nodeVersion}" ]; then`,`  curl -fsSL https://deb.nodesource.com/setup_${e.nodeVersion}.x | bash - 2>&1`,"  apt-get install -y nodejs 2>&1",'  echo "[NODE] Installed Node $(node -v)"',"else",'  echo "[NODE] Already on Node $(node -v) \u2014 no switch needed"',"fi"].join(`
+`):"",p;if(r){let b=Bo.isAbsolute(r)?r:Bo.resolve(process.cwd(),r);Fo.existsSync(b)?(p=Fo.readFileSync(b,"utf-8"),Gn.info(Uo.magenta(`\u2713 Loaded preBuild hook: ${r}`))):Gn.warn(`preBuild script not found at ${b} \u2014 skipping`)}let h=Pd(e,a,n),g={...Ln(n,a,e),MACH_ANDROID_RELEASE_ABIS:h},y=Mn(g),S=Mo.replace(/\{\{BUILD_ID\}\}/g,t).replace(/\{\{BUILD_COMMAND\}\}/g,u).replace("{{NODE_VERSION_SETUP}}",f).replace("{{ENV_VARS}}",`
+export MACH_APP_NAME="${Vn(g.MACH_APP_NAME)}"
+export MACH_BUILD_PROFILE="${Vn(a)}"
+export MACH_ANDROID_RELEASE_ABIS="${Vn(h)}"
+export MACH_ENV_FINGERPRINT="${y}"
 ${s.remoteEnvSetupScript().trim()}
 {{ENV_VARS}}
-export MACH_APP_DIRECTORY="${jn(e.appDirectory||".")}"
-    `).replace("{{FRAMEWORK_ANDROID_VERSION_CODE}}",s.androidRemoteVersionCodeScript().trim()).replace("{{FRAMEWORK_ANDROID_PREBUILD}}",s.androidRemotePrebuildScript().trim()).replace("{{FRAMEWORK_ANDROID_GRADLE_PROPERTIES}}",s.androidRemoteGradlePropertiesScript().trim()).replace("{{FRAMEWORK_ANDROID_RELEASE_GRADLE_PROPERTIES}}",s.androidRemoteReleaseGradlePropertiesScript().trim());if(e.dryRun){Hn.info("User Data Script (dry run):"),console.log(y);return}o.start("Requesting cloud build instance...");try{let w=await $.post("/builds/launch-android",{projectId:i,buildId:t,platform:e.platform,buildProfile:e.buildProfile,buildCommand:u,instanceType:e.instanceType,ami:e.ami,keepInstance:e.keepInstance,region:e.region,subnet:e.subnet,securityGroup:e.securityGroup,projectSecrets:n,dryRun:e.dryRun,userDataScript:y,preBuildScriptContent:p});if(w.data.status!=="success")throw new Error(w.data.message||"Failed to launch build instance");let M=w.data.instanceId;return o.stop("Build Started"),Hn.success(Fo.green(`Build initiated on cloud instance (${M}).`)),{instanceId:M}}catch(w){o.stop("Android Build Failed");let M=w.response?.data?.message||w.message;throw new Error(`Failed to launch Android build: ${M}`)}};import{spinner as xd,log as gt}from"@clack/prompts";import We from"chalk";import Ld from"fs";import{execSync as Wt}from"child_process";var Go=`#!/bin/bash
+export MACH_APP_DIRECTORY="${Vn(e.appDirectory||".")}"
+    `).replace("{{FRAMEWORK_ANDROID_VERSION_CODE}}",s.androidRemoteVersionCodeScript().trim()).replace("{{FRAMEWORK_ANDROID_PREBUILD}}",s.androidRemotePrebuildScript().trim()).replace("{{FRAMEWORK_ANDROID_GRADLE_PROPERTIES}}",s.androidRemoteGradlePropertiesScript().trim()).replace("{{FRAMEWORK_ANDROID_RELEASE_GRADLE_PROPERTIES}}",s.androidRemoteReleaseGradlePropertiesScript().trim());if(e.dryRun){Gn.info("User Data Script (dry run):"),console.log(S);return}o.start("Requesting cloud build instance...");try{let b=await $.post("/builds/launch-android",{projectId:i,buildId:t,platform:e.platform,buildProfile:e.buildProfile,buildCommand:u,instanceType:e.instanceType,ami:e.ami,keepInstance:e.keepInstance,region:e.region,subnet:e.subnet,securityGroup:e.securityGroup,projectSecrets:n,dryRun:e.dryRun,userDataScript:S,preBuildScriptContent:p});if(b.data.status!=="success")throw new Error(b.data.message||"Failed to launch build instance");let C=b.data.instanceId;return o.stop("Build Started"),Gn.success(Uo.green(`Build initiated on cloud instance (${C}).`)),{instanceId:C}}catch(b){o.stop("Android Build Failed");let C=b.response?.data?.message||b.message;throw new Error(`Failed to launch Android build: ${C}`)}};import{spinner as Dd,log as ht}from"@clack/prompts";import Ke from"chalk";import Cd from"fs";import{execSync as Zt}from"child_process";var jo=`#!/bin/bash
 # --- Mach Cloud Build Script (iOS) ---
 # All S3 operations use presigned URLs via curl \u2014 zero AWS credentials on Mac.
 
@@ -1104,10 +1104,21 @@ security unlock-keychain -p "\${TEMP_KEYCHAIN_PASSWORD}" "\${TEMP_KEYCHAIN_PATH}
 # Define directory variables for cleanup
 CERT_DIR="/tmp/mach-certs-\${BUILD_ID}"
 PROV_TEMP="/tmp/mach-prov-\${BUILD_ID}"
-
-
-# Update trap to include keychain cleanup
-trap "security delete-keychain '\${TEMP_KEYCHAIN_PATH}' 2>/dev/null || true; rm -rf '$CERT_DIR' '$PROV_TEMP' 2>/dev/null || true; kill $UPLOADER_PID 2>/dev/null || true" EXIT
+SIGNING_MANIFEST="/tmp/mach-signing-manifest-\${BUILD_ID}.json"
+SIGNING_PROFILE_XML="\${SIGNING_MANIFEST}.xml"
+
+cleanup_mach_signing() {
+  if [ -d "$MACH_APP_ROOT/ios" ]; then
+    while IFS= read -r -d '' BACKUP; do
+      ORIGINAL="\${BACKUP%.mach-signing-backup}"
+      mv "$BACKUP" "$ORIGINAL" 2>/dev/null || true
+    done < <(find "$MACH_APP_ROOT/ios" -name "project.pbxproj.mach-signing-backup" -print0 2>/dev/null)
+  fi
+  security delete-keychain "\${TEMP_KEYCHAIN_PATH}" 2>/dev/null || true
+  rm -rf "$CERT_DIR" "$PROV_TEMP" "$SIGNING_MANIFEST" "$SIGNING_PROFILE_XML" 2>/dev/null || true
+  kill $UPLOADER_PID 2>/dev/null || true
+}
+trap cleanup_mach_signing EXIT
 
 
 # Download certificates via presigned URLs (injected by CLI)
@@ -1117,15 +1128,102 @@ mkdir -p "$PROV_TEMP"
 
 {{CREDENTIAL_DOWNLOADS}}
 
-# Flatten and install provisioning profiles
+# The managed CLI normally injects credentials directly. Presigned credential
+# downloads remain supported for older API/CLI combinations.
+if [ -n "\${IOS_DIST_P12:-}" ] && ! find "$CERT_DIR" -name "*.p12" -print -quit | grep -q .; then
+  node - "$CERT_DIR/managed.p12" <<'NODE'
+const fs = require('fs');
+fs.writeFileSync(process.argv[2], Buffer.from(process.env.IOS_DIST_P12, 'base64'), { mode: 0o600 });
+NODE
+fi
+
+MULTI_TARGET_SIGNING=false
 mkdir -p "$HOME/Library/MobileDevice/Provisioning Profiles"
-find "$PROV_TEMP" -name "*.mobileprovision" -exec cp {} "$HOME/Library/MobileDevice/Provisioning Profiles/" \\;
+if [ -n "\${IOS_PROVISIONING_PROFILES:-}" ]; then
+  node - "$PROV_TEMP" "$SIGNING_MANIFEST" "$HOME/Library/MobileDevice/Provisioning Profiles" <<'NODE'
+const fs = require('fs');
+const path = require('path');
+const { execFileSync } = require('child_process');
+
+const [temporaryDirectory, manifestPath, installDirectory] = process.argv.slice(2);
+const payload = JSON.parse(process.env.IOS_PROVISIONING_PROFILES);
+if (payload.version !== 1 || !Array.isArray(payload.profiles) || payload.profiles.length < 2) {
+  process.exit(0);
+}
+
+const readString = (plist, key) => {
+  return plist.match(new RegExp('<key>' + key + '<\\\\/key>\\\\s*<string>([^<]+)<\\\\/string>'))?.[1]?.trim();
+};
+const installed = payload.profiles.map((profile, index) => {
+  const temporaryPath = path.join(temporaryDirectory, 'managed-' + index + '.mobileprovision');
+  fs.writeFileSync(temporaryPath, Buffer.from(profile.profileBase64, 'base64'), { mode: 0o600 });
+  const plist = execFileSync('security', ['cms', '-D', '-i', temporaryPath], { encoding: 'utf8' });
+  const uuid = readString(plist, 'UUID');
+  if (!uuid) throw new Error('Provisioning profile for ' + profile.bundleIdentifier + ' has no UUID');
+  const applicationIdentifier = readString(plist, 'application-identifier') || '';
+  const separator = applicationIdentifier.indexOf('.');
+  const profileBundleIdentifier = separator >= 0
+    ? applicationIdentifier.slice(separator + 1)
+    : applicationIdentifier;
+  const profileMatches =
+    profileBundleIdentifier === profile.bundleIdentifier ||
+    profileBundleIdentifier === '*' ||
+    (profileBundleIdentifier.endsWith('.*') &&
+      profile.bundleIdentifier.startsWith(profileBundleIdentifier.slice(0, -1)));
+  if (!profileMatches) {
+    throw new Error('Provisioning profile does not match ' + profile.bundleIdentifier);
+  }
+  fs.copyFileSync(temporaryPath, path.join(installDirectory, uuid + '.mobileprovision'));
+  return {
+    targetName: profile.targetName,
+    bundleIdentifier: profile.bundleIdentifier,
+    isMainApplication: profile.isMainApplication === true,
+    uuid,
+    name: readString(plist, 'Name') || uuid,
+  };
+});
+fs.writeFileSync(manifestPath, JSON.stringify(installed), { mode: 0o600 });
+const escapeXml = (value) => String(value)
+  .replace(/&/g, '&amp;')
+  .replace(/</g, '&lt;')
+  .replace(/>/g, '&gt;')
+  .replace(/"/g, '&quot;')
+  .replace(/'/g, '&apos;');
+const xml = ['<key>provisioningProfiles</key>', '    <dict>'];
+for (const profile of installed) {
+  xml.push('        <key>' + escapeXml(profile.bundleIdentifier) + '</key>');
+  xml.push('        <string>' + escapeXml(profile.uuid) + '</string>');
+}
+xml.push('    </dict>');
+fs.writeFileSync(manifestPath + '.xml', xml.join('\\n'), { mode: 0o600 });
+NODE
+  if [ -s "$SIGNING_MANIFEST" ]; then
+    MULTI_TARGET_SIGNING=true
+  fi
+fi
+
+if [ "$MULTI_TARGET_SIGNING" != "true" ]; then
+  if [ -n "\${IOS_PROVISIONING_PROFILE:-}" ] && ! find "$PROV_TEMP" -name "*.mobileprovision" -print -quit | grep -q .; then
+    node - "$PROV_TEMP/managed.mobileprovision" <<'NODE'
+const fs = require('fs');
+fs.writeFileSync(process.argv[2], Buffer.from(process.env.IOS_PROVISIONING_PROFILE, 'base64'), { mode: 0o600 });
+NODE
+  fi
+  find "$PROV_TEMP" -name "*.mobileprovision" -exec cp {} "$HOME/Library/MobileDevice/Provisioning Profiles/" \\;
+fi
 
 # Extract profile metadata for later use in ExportOptions.plist
 PROFILE_UUID=""
 PROFILE_NAME=""
 PROFILE_BUNDLE_ID=""
-PROFILE_FILE=$(find "$HOME/Library/MobileDevice/Provisioning Profiles/" -name "*.mobileprovision" | head -n 1 || true)
+if [ "$MULTI_TARGET_SIGNING" == "true" ]; then
+  PROFILE_UUID=$(node -e 'const p=require(process.argv[1]); const m=p.find(x=>x.isMainApplication)||p[0]; process.stdout.write(m.uuid)' "$SIGNING_MANIFEST")
+  PROFILE_NAME="$PROFILE_UUID"
+  PROFILE_BUNDLE_ID=$(node -e 'const p=require(process.argv[1]); const m=p.find(x=>x.isMainApplication)||p[0]; process.stdout.write(m.bundleIdentifier)' "$SIGNING_MANIFEST")
+  PROFILE_COUNT=$(node -e 'process.stdout.write(String(require(process.argv[1]).length))' "$SIGNING_MANIFEST")
+  echo "Installed $PROFILE_COUNT target-specific provisioning profiles."
+else
+  PROFILE_FILE=$(find "$PROV_TEMP" -name "*.mobileprovision" | head -n 1 || true)
 if [ ! -z "$PROFILE_FILE" ]; then
   PROFILE_PLIST=$(security cms -D -i "$PROFILE_FILE" 2>/dev/null || true)
   PROFILE_UUID=$(echo "$PROFILE_PLIST" | grep -A1 "<key>UUID</key>" | grep "<string>" | sed 's/.*<string>\\(.*\\)<\\/string>.*/\\1/' | tr -d '[:space:]')
@@ -1134,10 +1232,12 @@ if [ ! -z "$PROFILE_FILE" ]; then
   PROFILE_BUNDLE_ID=$(echo "$APP_ID_FULL" | sed 's/^[A-Z0-9]*\\.//')
   echo "Profile: $PROFILE_NAME | UUID: $PROFILE_UUID | BundleID: $PROFILE_BUNDLE_ID"
 fi
+fi
 
 # Find and import all certificates into temporary keychain
 find "$CERT_DIR" -name "*.p12" | while read p12_file; do
   echo "Importing: $(basename "$p12_file")"
+  security import "$p12_file" -k "\${TEMP_KEYCHAIN_PATH}" -P "\${IOS_P12_PASSWORD:-}" -A -T /usr/bin/codesign -T /usr/bin/security || \\
   security import "$p12_file" -k "\${TEMP_KEYCHAIN_PATH}" -P "" -A -T /usr/bin/codesign -T /usr/bin/security || \\
   security import "$p12_file" -k "\${TEMP_KEYCHAIN_PATH}" -P "mach" -A -T /usr/bin/codesign -T /usr/bin/security || \\
   security import "$p12_file" -k "\${TEMP_KEYCHAIN_PATH}" -P "\${CERT_PASSWORD:-}" -A -T /usr/bin/codesign -T /usr/bin/security || \\
@@ -1168,7 +1268,7 @@ clear_js_transform_caches
 configure_xcode_node_binary
 # MACH-owned native versions use the canonical Xcode path below so version
 # injection and signed-artifact verification cannot be bypassed by a custom lane.
-if { [ -f "Fastfile" ] || [ -d "fastlane" ]; } && [ -z "$IOS_BUILD_NUMBER" ]; then
+if { [ -f "Fastfile" ] || [ -d "fastlane" ]; } && [ -z "$IOS_BUILD_NUMBER" ] && [ "$MULTI_TARGET_SIGNING" != "true" ]; then
   bundle exec fastlane ios build
 elif [ -d "ios" ]; then
   cd ios
@@ -1188,6 +1288,115 @@ elif [ -d "ios" ]; then
 
   IS_SIMULATOR="{{IS_SIMULATOR}}"
 
+  prepare_xcodeproj_ruby() {
+    local fastlane_prefix=""
+    local ruby_prefix=""
+    local fastlane_gem_paths=""
+
+    if command -v brew >/dev/null 2>&1; then
+      fastlane_prefix="$(brew --prefix fastlane 2>/dev/null || true)"
+      ruby_prefix="$(brew --prefix ruby 2>/dev/null || true)"
+    fi
+
+    if [ -n "$ruby_prefix" ] && [ -d "$ruby_prefix/bin" ]; then
+      export PATH="$ruby_prefix/bin:$PATH"
+    elif [ -d "/opt/homebrew/opt/ruby/bin" ]; then
+      export PATH="/opt/homebrew/opt/ruby/bin:$PATH"
+    elif [ -d "/usr/local/opt/ruby/bin" ]; then
+      export PATH="/usr/local/opt/ruby/bin:$PATH"
+    fi
+
+    if [ -n "$fastlane_prefix" ] && [ -d "$fastlane_prefix/libexec" ]; then
+      fastlane_gem_paths="$fastlane_prefix/libexec"
+    fi
+    for candidate in       /opt/homebrew/Cellar/fastlane/*/libexec       /usr/local/Cellar/fastlane/*/libexec       "$HOME"/.local/share/fastlane/*; do
+      if [ -d "$candidate" ]; then
+        if [ -n "$fastlane_gem_paths" ]; then
+          fastlane_gem_paths="$fastlane_gem_paths:$candidate"
+        else
+          fastlane_gem_paths="$candidate"
+        fi
+      fi
+    done
+    if [ -n "\${FASTLANE_GEM_HOME:-}" ] && [ -d "$FASTLANE_GEM_HOME" ]; then
+      fastlane_gem_paths="$FASTLANE_GEM_HOME\${fastlane_gem_paths:+:$fastlane_gem_paths}"
+    fi
+    if [ -n "$fastlane_gem_paths" ]; then
+      export GEM_PATH="$fastlane_gem_paths\${GEM_PATH:+:$GEM_PATH}"
+    fi
+
+    if ruby -e "require 'xcodeproj'; print Xcodeproj::VERSION" >/dev/null 2>&1; then
+      XCODEPROJ_RUBY=(ruby)
+      return 0
+    fi
+    if command -v bundle >/dev/null 2>&1 &&       bundle exec ruby -e "require 'xcodeproj'; print Xcodeproj::VERSION" >/dev/null 2>&1; then
+      XCODEPROJ_RUBY=(bundle exec ruby)
+      return 0
+    fi
+
+    echo "Mach could not load the Ruby xcodeproj library required for multi-target iOS signing." >&2
+    echo "Install Fastlane with Homebrew (brew install fastlane), then retry the build." >&2
+    return 1
+  }
+
+  apply_multi_target_signing() {
+    if [ "$MULTI_TARGET_SIGNING" != "true" ]; then
+      return 0
+    fi
+    prepare_xcodeproj_ruby
+    "\${XCODEPROJ_RUBY[@]}" - "$SIGNING_MANIFEST" "$TEAM_ID" <<'RUBY'
+require 'json'
+require 'xcodeproj'
+require 'fileutils'
+
+profiles = JSON.parse(File.read(ARGV.fetch(0)))
+team_id = ARGV[1]
+matched = {}
+project_paths = Dir.glob('**/*.xcodeproj').reject do |project_path|
+  project_path.split('/').include?('Pods') || project_path.split('/').include?('build')
+end
+
+project_paths.each do |project_path|
+  project_file = File.join(project_path, 'project.pbxproj')
+  backup_file = project_file + '.mach-signing-backup'
+  FileUtils.cp(project_file, backup_file) unless File.exist?(backup_file)
+  project = Xcodeproj::Project.open(project_path)
+  changed = false
+
+  project.targets.each do |target|
+    profile = profiles.find do |candidate|
+      target.build_configurations.any? do |configuration|
+        configuration.build_settings['PRODUCT_BUNDLE_IDENTIFIER'].to_s == candidate['bundleIdentifier']
+      end
+    end
+    profile ||= profiles.find do |candidate|
+      candidate['targetName'].to_s.length > 0 && target.name == candidate['targetName']
+    end
+    next unless profile
+
+    target.build_configurations.each do |configuration|
+      configuration.build_settings['CODE_SIGN_STYLE'] = 'Manual'
+      configuration.build_settings['PROVISIONING_PROFILE'] = profile['uuid']
+      configuration.build_settings['PROVISIONING_PROFILE_SPECIFIER'] = profile['uuid']
+      configuration.build_settings['DEVELOPMENT_TEAM'] = team_id if team_id.to_s.length > 0
+    end
+    matched[profile['bundleIdentifier']] = target.name
+    changed = true
+  end
+  project.save if changed
+end
+
+missing = profiles.reject { |profile| matched.key?(profile['bundleIdentifier']) }
+unless missing.empty?
+  abort 'Could not match provisioning profiles to Xcode targets: ' + missing.map { |profile|
+    (profile['targetName'] || 'unknown target') + ' (' + profile['bundleIdentifier'] + ')'
+  }.join(', ')
+end
+
+matched.each { |bundle_id, target_name| puts 'Signed target: ' + target_name + ' (' + bundle_id + ')' }
+RUBY
+  }
+
   if [ "$IS_SIMULATOR" == "true" ]; then
     SDK="iphonesimulator"
     EXTRA_ARGS="COMPILER_INDEX_STORE_ENABLE=NO CODE_SIGNING_ALLOWED=NO CODE_SIGNING_REQUIRED=NO ONLY_ACTIVE_ARCH=NO EXCLUDED_ARCHS= SUPPORTED_PLATFORMS=iphonesimulator"
@@ -1323,6 +1532,10 @@ NODE
     echo "$BUILD_INFO" | grep -Ei "\\bplatform\\b" | head -n 1 | sed 's/^/Simulator executable /'
   }
 
+  if [ "$IS_SIMULATOR" != "true" ]; then
+    apply_multi_target_signing
+  fi
+
   if [ ! -z "$WORKSPACE" ]; then
     if [ -z "$USER_SCHEME" ]; then
       # Try to find scheme matching workspace name
@@ -1350,8 +1563,10 @@ NODE
     else
       ARCHIVE_SIGN_ARGS=("CODE_SIGN_STYLE=Manual")
       [ -n "$TEAM_ID" ] && ARCHIVE_SIGN_ARGS+=("DEVELOPMENT_TEAM=$TEAM_ID")
-      [ -n "$PROFILE_UUID" ] && ARCHIVE_SIGN_ARGS+=("PROVISIONING_PROFILE=$PROFILE_UUID")
-      [ -n "$PROFILE_NAME" ] && ARCHIVE_SIGN_ARGS+=("PROVISIONING_PROFILE_SPECIFIER=$PROFILE_NAME")
+      if [ "$MULTI_TARGET_SIGNING" != "true" ]; then
+        [ -n "$PROFILE_UUID" ] && ARCHIVE_SIGN_ARGS+=("PROVISIONING_PROFILE=$PROFILE_UUID")
+        [ -n "$PROFILE_NAME" ] && ARCHIVE_SIGN_ARGS+=("PROVISIONING_PROFILE_SPECIFIER=$PROFILE_NAME")
+      fi
       xcodebuild archive -workspace "$WORKSPACE" -scheme "$SCHEME" -archivePath "../build.xcarchive" -configuration "$USER_CONFIG" -sdk "$SDK" -derivedDataPath "$DERIVED_DATA_PATH" "\${IOS_VERSION_ARGS[@]}" \${AUTH_PARAMS:+-allowProvisioningUpdates $AUTH_PARAMS} "\${ARCHIVE_SIGN_ARGS[@]}" -parallelizeTargets -allowConcurrentBuilds || exit 1
     fi
   elif [ ! -z "$PROJECT" ]; then
@@ -1380,8 +1595,10 @@ NODE
     else
       ARCHIVE_SIGN_ARGS=("CODE_SIGN_STYLE=Manual")
       [ -n "$TEAM_ID" ] && ARCHIVE_SIGN_ARGS+=("DEVELOPMENT_TEAM=$TEAM_ID")
-      [ -n "$PROFILE_UUID" ] && ARCHIVE_SIGN_ARGS+=("PROVISIONING_PROFILE=$PROFILE_UUID")
-      [ -n "$PROFILE_NAME" ] && ARCHIVE_SIGN_ARGS+=("PROVISIONING_PROFILE_SPECIFIER=$PROFILE_NAME")
+      if [ "$MULTI_TARGET_SIGNING" != "true" ]; then
+        [ -n "$PROFILE_UUID" ] && ARCHIVE_SIGN_ARGS+=("PROVISIONING_PROFILE=$PROFILE_UUID")
+        [ -n "$PROFILE_NAME" ] && ARCHIVE_SIGN_ARGS+=("PROVISIONING_PROFILE_SPECIFIER=$PROFILE_NAME")
+      fi
       xcodebuild archive -project "$PROJECT" -scheme "$SCHEME" -archivePath "../build.xcarchive" -configuration "$USER_CONFIG" -sdk "$SDK" -derivedDataPath "$DERIVED_DATA_PATH" "\${IOS_VERSION_ARGS[@]}" \${AUTH_PARAMS:+-allowProvisioningUpdates $AUTH_PARAMS} "\${ARCHIVE_SIGN_ARGS[@]}" -parallelizeTargets -allowConcurrentBuilds || exit 1
     fi
   else
@@ -1441,7 +1658,9 @@ if [ "$IS_SIMULATOR" == "true" ]; then
 
     # Build provisioningProfiles dict \u2014 only if we successfully extracted profile info
     PROV_PROFILES_XML=""
-    if [ ! -z "$PROFILE_BUNDLE_ID" ] && [ ! -z "$PROFILE_NAME" ]; then
+    if [ "$MULTI_TARGET_SIGNING" == "true" ]; then
+      PROV_PROFILES_XML=$(cat "$SIGNING_PROFILE_XML")
+    elif [ ! -z "$PROFILE_BUNDLE_ID" ] && [ ! -z "$PROFILE_NAME" ]; then
       PROV_PROFILES_XML="<key>provisioningProfiles</key>
     <dict>
         <key>$PROFILE_BUNDLE_ID</key>
@@ -1527,62 +1746,64 @@ touch done
 if [ ! -z "$PRESIGNED_DONE_MARKER" ]; then
   curl -X PUT -T done "$PRESIGNED_DONE_MARKER" --silent
 fi
-`;var Vo=e=>e.replace(/\\/g,"\\\\").replace(/"/g,'\\"').replace(/\$/g,"\\$").replace(/`/g,"\\`"),zo=async(e,t,n={},i)=>{let r=xd(),o=kn(e.framework);e.sshHost||(e.sshHost="localhost",gt.message(We.yellow("No SSH host provided, defaulting to localhost."))),r.start(`Connecting to remote Mac at ${We.cyan(e.sshHost)}...`);let s=e.sshUser||process.env.USER||"ubuntu",a=e.sshKey,l=`${s}@${e.sshHost}`,d=`ssh ${a?`-i ${a}`:""} -o StrictHostKeyChecking=no ${l}`,c=`scp ${a?`-i ${a}`:""} -o StrictHostKeyChecking=no`;try{let u=s==="ubuntu"?"/home/ubuntu":`/Users/${s}`,f=(n.PROJECT_ID||"default_project").replace(/[^a-zA-Z0-9-_]/g,"_"),p=`${u}/${m.remoteWorkspacesDir}/${f}`;r.message(`Preparing stable workspace: ${p}...`),Wt(`${d} "mkdir -p ${p}"`,{stdio:"inherit"}),r.message("Transferring source code...");let g=`/tmp/${m.nameLower}-source-${t}.zip`;Wt(`${c} ${g} ${l}:${p}/source.zip`,{stdio:"inherit"});let h=e.iosApiKeyPath?`${p}/api_key.p8`:"",A="";e.iosApiKeyPath&&(r.message("Uploading App Store Connect API key..."),Wt(`${c} ${e.iosApiKeyPath} ${l}:${h}`),e.iosApiKeyId&&e.iosApiKeyIssuer&&(A=`-authenticationKeyID ${e.iosApiKeyId} -authenticationKeyIssuerID ${e.iosApiKeyIssuer} -authenticationKeyPath ${h}`));let y={};if(i)try{let E=await $.post(`/builds/${i}/${t}/build-urls`,{platform:"ios"});E.data.status==="success"&&(y=E.data.urls)}catch(E){gt.warn(We.yellow(`Could not fetch build URLs: ${E.message}`))}let w="";if(y.credentials&&y.credentials.length>0)for(let E of y.credentials)E.type==="p12"?w+=`curl -sf -o "$CERT_DIR/${E.name}" "${E.downloadUrl}" || true
-`:E.type==="mobileprovision"&&(w+=`curl -sf -o "$PROV_TEMP/${E.name}" "${E.downloadUrl}" || true
-`);r.message("Generating macOS build script...");let M=process.env.CODEARTIFACT_AUTH_TOKEN?`export CODEARTIFACT_AUTH_TOKEN="${process.env.CODEARTIFACT_AUTH_TOKEN}"
-`:"";if(n)for(let[E,_]of Object.entries(n)){let P=_.replace(/"/g,'\\"').replace(/\$/g,"\\$").replace(/`/g,"\\`");M+=`export ${E}="${P}"
-`}let v=e.buildProfile||"production",H=Nn(n,v,e),W=xn(H);gt.info(We.dim(`iOS remote build config: simulator=${String(!!e.simulator)}, configuration=${e.iosConfiguration||"Release"}, scheme=${e.iosScheme||"auto"}`));let Z=[M,y.logUpload?`export PRESIGNED_LOG_UPLOAD="${y.logUpload}"`:"",y.doneMarker?`export PRESIGNED_DONE_MARKER="${y.doneMarker}"`:"",y.cacheDerivedDataDownload?`export PRESIGNED_CACHE_DD_DOWNLOAD="${y.cacheDerivedDataDownload}"`:"",y.cacheDerivedDataUpload?`export PRESIGNED_CACHE_DD_UPLOAD="${y.cacheDerivedDataUpload}"`:"",y.cacheNodeModulesDownload?`export PRESIGNED_CACHE_NODE_DOWNLOAD="${y.cacheNodeModulesDownload}"`:"",y.cacheNodeModulesUpload?`export PRESIGNED_CACHE_NODE_UPLOAD="${y.cacheNodeModulesUpload}"`:"",y.cachePodsDownload?`export PRESIGNED_CACHE_PODS_DOWNLOAD="${y.cachePodsDownload}"`:"",y.cachePodsUpload?`export PRESIGNED_CACHE_PODS_UPLOAD="${y.cachePodsUpload}"`:"",y.artifactIpaUpload?`export PRESIGNED_ARTIFACT_IPA_UPLOAD="${y.artifactIpaUpload}"`:"",y.artifactAppZipUpload?`export PRESIGNED_ARTIFACT_APP_ZIP_UPLOAD="${y.artifactAppZipUpload}"`:"",`export BUILD_ID="${t}"`,`export MACH_BUILD_PROFILE="${Vo(v)}"`,`export MACH_APP_NAME="${Vo(H.MACH_APP_NAME)}"`,`export MACH_ENV_FINGERPRINT="${W}"`,o.remoteEnvSetupScript().trim(),`export ${m.envPrefix}PROJECT_ID="${f}"`,n.MATCH_ENCRYPTION_PASSPHRASE?`export MATCH_PASSWORD="${n.MATCH_ENCRYPTION_PASSPHRASE}"`:"",n.APPLE_TEAM_ID?`export FASTLANE_TEAM_ID="${n.APPLE_TEAM_ID}"`:"",`export MATCH_KEYCHAIN_NAME="${m.credentialsKeychain}"`,`export MATCH_KEYCHAIN_PASSWORD="${m.keychainPassword}"`].filter(Boolean).join(`
-`),_e=e.nodeVersion?[`echo "[NODE] Switching to Node ${e.nodeVersion}..."`,'export NVM_DIR="$HOME/.nvm"','[ -s "$NVM_DIR/nvm.sh" ] && . "$NVM_DIR/nvm.sh" --no-use',`nvm install ${e.nodeVersion} 2>/dev/null || true`,`nvm use ${e.nodeVersion} --silent`,`export PATH="$NVM_DIR/versions/node/$(nvm version ${e.nodeVersion})/bin:$PATH"`,'echo "[NODE] Now using: $(node -v) at $(which node)"'].join(`
-`):"",oe=Go,R={"{{REMOTE_DIR}}":p,"{{APP_DIRECTORY}}":e.appDirectory||".","{{ENV_VARS}}":Z,"{{CREDENTIAL_DOWNLOADS}}":w,"{{IOS_SCHEME}}":e.iosScheme||"","{{IOS_CONFIG}}":e.iosConfiguration||"Release","{{TEAM_ID}}":e.iosTeamId||"","{{AUTH_PARAMS}}":A,"{{IS_SIMULATOR}}":e.simulator?"true":"false","{{BUILD_ID}}":t,"{{EXPORT_METHOD}}":e.iosExportMethod||"ad-hoc","{{NODE_VERSION_SETUP}}":_e,"{{FRAMEWORK_PREBUILD}}":o.iosRemotePrebuildScript().trim()};Object.entries(R).forEach(([E,_])=>{oe=oe.split(E).join(_)});let L=`/tmp/${m.nameLower}-mac-build-${t}.sh`;if(Ld.writeFileSync(L,oe),Wt(`${c} ${L} ${l}:${p}/build.sh`),r.stop("Remote script uploaded."),gt.info(We.cyan("Executing remote build. This might take a while...")),Wt(`${d} "bash ${p}/build.sh"`,{stdio:"inherit"}),r.stop("Remote build finished!"),i){r.start("Fetching artifact links...");try{let _=(await $.get(`/builds/${i}/${t}/artifacts`)).data.artifacts||[],P=e.simulator===!0;if(_.length===0&&!P)throw r.stop("Build Failed!"),new Error("Build completed but no artifacts were generated. Check build logs for errors.");if(r.stop("Build Successful!"),_.length>0){gt.success("Build Artifacts Ready:");for(let b of _)console.log(`
-${We.yellow(b.name)}:
-${We.cyan(b.downloadUrl)}`);console.log(`
-${We.dim("Note: Links are valid for 7 days.")}`)}else P&&gt.warn("Simulator build completed. No artifacts uploaded.")}catch(E){r.stop("Could not fetch artifacts"),gt.warn(We.yellow(`Artifact listing failed: ${E.message}`))}}}catch(u){throw r.stop("iOS Build Failed"),u}};import Yi from"fs";import Vn from"path";import{spawnSync as Md}from"child_process";var he=e=>{if(typeof e!="string")return;let t=e.trim();return t.length>0?t:void 0},Ko=e=>e==null?void 0:he(String(e)),Yo=e=>{if(!Yi.existsSync(e))return null;try{return JSON.parse(Yi.readFileSync(e,"utf-8"))}catch{return null}},Ud=e=>{let t=e.trim();if(!t)return null;try{return JSON.parse(t)}catch{let n=t.indexOf("{"),i=t.lastIndexOf("}");if(n<0||i<=n)return null;try{return JSON.parse(t.slice(n,i+1))}catch{return null}}};function Wo(e=process.cwd()){let t=Yo(Vn.join(e,"package.json"))||{};return he(t.version)}function Fd(e=process.cwd()){let t=Yo(Vn.join(e,"package.json"))||{},n={...t.dependencies||{},...t.devDependencies||{}};if(n.expo)return"expo";if(n["react-native"])return"react-native"}function qo(e=process.cwd(),t={}){let n=process.platform==="win32"?Vn.join(e,"node_modules",".bin","expo.cmd"):Vn.join(e,"node_modules",".bin","expo"),i=Yi.existsSync(n),s=Md(i?n:"npx",i?["config","--type","public","--json"]:["--no-install","expo","config","--type","public","--json"],{cwd:e,encoding:"utf-8",stdio:["ignore","pipe","pipe"],env:{...process.env,EXPO_NO_TELEMETRY:"1",...t}});return s.error||s.status!==0?null:Ud(s.stdout||"")}var Jo=e=>{let t=he(e);if(!(!t||t==="manual"))return t},Gn=(e,t,n,i={})=>{let r=he(e);if(r)return r;if(!e||typeof e!="object")return;let o=he(e.policy);if(o==="appVersion")return he(t.version);if(o==="sdkVersion")return he(t.sdkVersion);if(o==="nativeVersion"){let s=he(t.version);if(!s||!n)return;let a=n==="ios"?Ko(i.iosBuildNumber)||Ko(t.ios?.buildNumber):i.androidVersionCode!==void 0?String(i.androidVersionCode).trim():t.android?.versionCode!==void 0?String(t.android.versionCode).trim():void 0;return!a||a.toLowerCase()==="auto"?s:a?`${s}(${a})`:s}};function Bd(e,t,n={},i){let r=t?Gn(e[t]?.runtimeVersion,e,t,n):void 0;if(r)return r;let o=Gn(e.runtimeVersion,e,t,n);return o||(i?Gn({policy:i},e,t,n):void 0)}function Hd(e,t){if(!(!e||typeof e!="object"))return he(t?e[t]?.runtimeVersion:void 0)||he(e.runtimeVersion)}function Yt(e,t){let n=qo(e,{MACH_OTA_RUNTIME_VERSION:t.runtimeVersion,MACH_OTA_CHANNEL:t.channel,MACH_OTA_URL:t.url});return n?{runtimeVersion:Hd(n,t.platform),channel:he(n.updates?.requestHeaders?.["expo-channel-name"]),url:he(n.updates?.url),expoConfig:n}:null}function jd(e,t,n={}){let i=he(n.runtimeVersion)||he(e.ota?.runtimeVersion);if(i)return i;let r={iosBuildNumber:n.iosBuildNumber,androidVersionCode:n.androidVersionCode},o=Jo(e.ota?.runtimeVersionPolicy);if(o){let s=Gn({policy:o},t,n.platform,r);if(s)return s}return Bd(t,n.platform,r)}function qt(e,t={}){let n=t.cwd||process.cwd(),i=he(t.runtimeVersion)||he(e.ota?.runtimeVersion);if(i)return i;let r=Jo(e.ota?.runtimeVersionPolicy),o={iosBuildNumber:t.iosBuildNumber,androidVersionCode:t.androidVersionCode};if((t.framework||e.framework||Fd(n))==="expo"){let a=qo(n),l=a?jd(e,a,{platform:t.platform,iosBuildNumber:o.iosBuildNumber,androidVersionCode:o.androidVersionCode}):void 0;if(l)return l}return Wo(n)||"1.0.0"}import O from"fs";import vt from"os";import N from"path";import{spawn as rs,spawnSync as Ge}from"child_process";import{randomUUID as Gd}from"crypto";import{pipeline as Vd}from"stream/promises";import{isCancel as Zi,log as D,select as os,spinner as Xt,text as zd}from"@clack/prompts";import Jt from"axios";import C from"chalk";import zn from"adm-zip";var Kd={android:"pixel_6",ios:"iphone_17_pro"};function Qi(e){return Kd[e]}async function ss(e){if(e.localRunner){let n=await Xd(e);process.exitCode=n?n.exitCode:1;return}if(e.local){let n=await Zd(e);n&&(process.exitCode=n.exitCode);return}let t=await ir(e);if(t&&(D.success(C.green(`Maestro run ${t.status||"queued"}: ${t.testRunId}`)),t.launchDeferredReason&&D.warn(C.yellow(t.launchDeferredReason)),t.dashboardUrl&&D.info(C.dim("View test run: ")+C.white.underline(t.dashboardUrl)),e.wait)){let n=await Qd(e,t);n&&(process.exitCode=n.status==="passed"?0:1)}}var Wd=new Set(["passed","failed","cancelled","interrupted"]),Xo=Number(process.env.MACH_FLOW_UPLOAD_MAX_ATTEMPTS||4),Yd=Number(process.env.MACH_FLOW_UPLOAD_TIMEOUT_MS||12e4),as=process.env.MACH_MAESTRO_FAST_FAIL_RETRY==="1";function nr(e){let t=Array.isArray(e)?e:e?[e]:[];return[...new Set(t.flatMap(n=>String(n||"").split(",")).map(n=>n.trim()).filter(Boolean))]}function qd(e){let t=nr(e);if(t.length===0)return;let n={};for(let i of t){let r=process.env[i];r!==void 0&&(n[i]=r)}return Object.keys(n).length>0?n:void 0}function Jd(e){let t={};for(let[i,r]of Object.entries(process.env))i.startsWith("MAESTRO_TEST_")&&r!==void 0&&(t[i]=r);let n=nr(e);for(let i of n){let r=process.env[i];r!==void 0&&(t[i]=r)}return t}async function Xd(e){let t=e.projectId,n=e.testRunId,i=e.runnerToken||process.env.MACH_RUNNER_TOKEN||process.env.MACH_TOKEN,r=(process.env.MACH_API_URL||Qe).replace(/\/$/,""),o=O.mkdtempSync(N.join(vt.tmpdir(),"mach-maestro-runner-")),s=N.join(o,"mach-maestro-output"),a=N.join(o,"runner.log");if(O.mkdirSync(s,{recursive:!0}),!t||!n||!i)return D.error(C.red("--local-runner requires --project-id, --test-run-id, and a runner token.")),{status:"failed",exitCode:1,attempts:0,flows:".maestro",platform:e.platform};let l=null,d=null,c=null,u,f,p=h=>{O.appendFileSync(a,`${h}${h.endsWith(`
+`;var Go=e=>e.replace(/\\/g,"\\\\").replace(/"/g,'\\"').replace(/\$/g,"\\$").replace(/`/g,"\\`"),Vo=async(e,t,n={},i)=>{let r=Dd(),o=xn(e.framework);e.sshHost||(e.sshHost="localhost",ht.message(Ke.yellow("No SSH host provided, defaulting to localhost."))),r.start(`Connecting to remote Mac at ${Ke.cyan(e.sshHost)}...`);let s=e.sshUser||process.env.USER||"ubuntu",a=e.sshKey,l=`${s}@${e.sshHost}`,d=`ssh ${a?`-i ${a}`:""} -o StrictHostKeyChecking=no ${l}`,c=`scp ${a?`-i ${a}`:""} -o StrictHostKeyChecking=no`;try{let u=s==="ubuntu"?"/home/ubuntu":`/Users/${s}`,f=(n.PROJECT_ID||"default_project").replace(/[^a-zA-Z0-9-_]/g,"_"),p=`${u}/${m.remoteWorkspacesDir}/${f}`;r.message(`Preparing stable workspace: ${p}...`),Zt(`${d} "mkdir -p ${p}"`,{stdio:"inherit"}),r.message("Transferring source code...");let h=`/tmp/${m.nameLower}-source-${t}.zip`;Zt(`${c} ${h} ${l}:${p}/source.zip`,{stdio:"inherit"});let g=e.iosApiKeyPath?`${p}/api_key.p8`:"",y="";e.iosApiKeyPath&&(r.message("Uploading App Store Connect API key..."),Zt(`${c} ${e.iosApiKeyPath} ${l}:${g}`),e.iosApiKeyId&&e.iosApiKeyIssuer&&(y=`-authenticationKeyID ${e.iosApiKeyId} -authenticationKeyIssuerID ${e.iosApiKeyIssuer} -authenticationKeyPath ${g}`));let S={};if(i)try{let A=await $.post(`/builds/${i}/${t}/build-urls`,{platform:"ios"});A.data.status==="success"&&(S=A.data.urls)}catch(A){ht.warn(Ke.yellow(`Could not fetch build URLs: ${A.message}`))}let b="";if(S.credentials&&S.credentials.length>0)for(let A of S.credentials)A.type==="p12"?b+=`curl -sf -o "$CERT_DIR/${A.name}" "${A.downloadUrl}" || true
+`:A.type==="mobileprovision"&&(b+=`curl -sf -o "$PROV_TEMP/${A.name}" "${A.downloadUrl}" || true
+`);r.message("Generating macOS build script...");let C=process.env.CODEARTIFACT_AUTH_TOKEN?`export CODEARTIFACT_AUTH_TOKEN="${process.env.CODEARTIFACT_AUTH_TOKEN}"
+`:"";if(n)for(let[A,O]of Object.entries(n)){let w=O.replace(/"/g,'\\"').replace(/\$/g,"\\$").replace(/`/g,"\\`");C+=`export ${A}="${w}"
+`}let I=e.buildProfile||"production",j=Ln(n,I,e),Z=Mn(j);ht.info(Ke.dim(`iOS remote build config: simulator=${String(!!e.simulator)}, configuration=${e.iosConfiguration||"Release"}, scheme=${e.iosScheme||"auto"}`));let z=[C,S.logUpload?`export PRESIGNED_LOG_UPLOAD="${S.logUpload}"`:"",S.doneMarker?`export PRESIGNED_DONE_MARKER="${S.doneMarker}"`:"",S.cacheDerivedDataDownload?`export PRESIGNED_CACHE_DD_DOWNLOAD="${S.cacheDerivedDataDownload}"`:"",S.cacheDerivedDataUpload?`export PRESIGNED_CACHE_DD_UPLOAD="${S.cacheDerivedDataUpload}"`:"",S.cacheNodeModulesDownload?`export PRESIGNED_CACHE_NODE_DOWNLOAD="${S.cacheNodeModulesDownload}"`:"",S.cacheNodeModulesUpload?`export PRESIGNED_CACHE_NODE_UPLOAD="${S.cacheNodeModulesUpload}"`:"",S.cachePodsDownload?`export PRESIGNED_CACHE_PODS_DOWNLOAD="${S.cachePodsDownload}"`:"",S.cachePodsUpload?`export PRESIGNED_CACHE_PODS_UPLOAD="${S.cachePodsUpload}"`:"",S.artifactIpaUpload?`export PRESIGNED_ARTIFACT_IPA_UPLOAD="${S.artifactIpaUpload}"`:"",S.artifactAppZipUpload?`export PRESIGNED_ARTIFACT_APP_ZIP_UPLOAD="${S.artifactAppZipUpload}"`:"",`export BUILD_ID="${t}"`,`export MACH_BUILD_PROFILE="${Go(I)}"`,`export MACH_APP_NAME="${Go(j.MACH_APP_NAME)}"`,`export MACH_ENV_FINGERPRINT="${Z}"`,o.remoteEnvSetupScript().trim(),`export ${m.envPrefix}PROJECT_ID="${f}"`,n.MATCH_ENCRYPTION_PASSPHRASE?`export MATCH_PASSWORD="${n.MATCH_ENCRYPTION_PASSPHRASE}"`:"",n.APPLE_TEAM_ID?`export FASTLANE_TEAM_ID="${n.APPLE_TEAM_ID}"`:"",`export MATCH_KEYCHAIN_NAME="${m.credentialsKeychain}"`,`export MATCH_KEYCHAIN_PASSWORD="${m.keychainPassword}"`].filter(Boolean).join(`
+`),fe=e.nodeVersion?[`echo "[NODE] Switching to Node ${e.nodeVersion}..."`,'export NVM_DIR="$HOME/.nvm"','[ -s "$NVM_DIR/nvm.sh" ] && . "$NVM_DIR/nvm.sh" --no-use',`nvm install ${e.nodeVersion} 2>/dev/null || true`,`nvm use ${e.nodeVersion} --silent`,`export PATH="$NVM_DIR/versions/node/$(nvm version ${e.nodeVersion})/bin:$PATH"`,'echo "[NODE] Now using: $(node -v) at $(which node)"'].join(`
+`):"",re=jo,ke={"{{REMOTE_DIR}}":p,"{{APP_DIRECTORY}}":e.appDirectory||".","{{ENV_VARS}}":z,"{{CREDENTIAL_DOWNLOADS}}":b,"{{IOS_SCHEME}}":e.iosScheme||"","{{IOS_CONFIG}}":e.iosConfiguration||"Release","{{TEAM_ID}}":e.iosTeamId||"","{{AUTH_PARAMS}}":y,"{{IS_SIMULATOR}}":e.simulator?"true":"false","{{BUILD_ID}}":t,"{{EXPORT_METHOD}}":e.iosExportMethod||"ad-hoc","{{NODE_VERSION_SETUP}}":fe,"{{FRAMEWORK_PREBUILD}}":o.iosRemotePrebuildScript().trim()};Object.entries(ke).forEach(([A,O])=>{re=re.split(A).join(O)});let Ae=`/tmp/${m.nameLower}-mac-build-${t}.sh`;if(Cd.writeFileSync(Ae,re),Zt(`${c} ${Ae} ${l}:${p}/build.sh`),r.stop("Remote script uploaded."),ht.info(Ke.cyan("Executing remote build. This might take a while...")),Zt(`${d} "bash ${p}/build.sh"`,{stdio:"inherit"}),r.stop("Remote build finished!"),i){r.start("Fetching artifact links...");try{let O=(await $.get(`/builds/${i}/${t}/artifacts`)).data.artifacts||[],w=e.simulator===!0;if(O.length===0&&!w)throw r.stop("Build Failed!"),new Error("Build completed but no artifacts were generated. Check build logs for errors.");if(r.stop("Build Successful!"),O.length>0){ht.success("Build Artifacts Ready:");for(let v of O)console.log(`
+${Ke.yellow(v.name)}:
+${Ke.cyan(v.downloadUrl)}`);console.log(`
+${Ke.dim("Note: Links are valid for 7 days.")}`)}else w&&ht.warn("Simulator build completed. No artifacts uploaded.")}catch(A){r.stop("Could not fetch artifacts"),ht.warn(Ke.yellow(`Artifact listing failed: ${A.message}`))}}}catch(u){throw r.stop("iOS Build Failed"),u}};import P from"fs";import vt from"os";import k from"path";import{spawn as Qo,spawnSync as Ge}from"child_process";import{randomUUID as Td}from"crypto";import{pipeline as Nd}from"stream/promises";import{isCancel as Yi,log as D,select as es,spinner as en,text as kd}from"@clack/prompts";import Qt from"axios";import T from"chalk";import zn from"adm-zip";var xd={android:"pixel_6",ios:"iphone_17_pro"};function zo(e){return xd[e]}async function ts(e){if(e.localRunner){let n=await Bd(e);process.exitCode=n?n.exitCode:1;return}if(e.local){let n=await Hd(e);n&&(process.exitCode=n.exitCode);return}let t=await Zi(e);if(t&&(D.success(T.green(`Maestro run ${t.status||"queued"}: ${t.testRunId}`)),t.launchDeferredReason&&D.warn(T.yellow(t.launchDeferredReason)),t.dashboardUrl&&D.info(T.dim("View test run: ")+T.white.underline(t.dashboardUrl)),e.wait)){let n=await jd(e,t);n&&(process.exitCode=n.status==="passed"?0:1)}}async function ns(e){let t=String(e.platform||"").trim().toLowerCase();if(t&&t!=="android"&&t!=="ios"){D.error(T.red("--platform must be android or ios.")),process.exitCode=1;return}try{let n=await $.get("/tests/maestro/devices",{...t?{params:{platform:t}}:{}}),i=Array.isArray(n.data?.devices)?n.data.devices:[];if(e.json){console.log(JSON.stringify({devices:i},null,2));return}if(i.length===0){D.warn(T.yellow("No managed Maestro devices are currently available."));return}console.log(`
+Available managed Maestro devices:`);for(let r of i){let o=[r.platform==="ios"?"iOS":"Android",r.osVersion,r.isDefault?"default":""].filter(Boolean).join(" \xB7 ");console.log(`  ${r.id.padEnd(20)} ${r.label}${o?` (${o})`:""}`)}console.log(`
+Use a profile with: mach maestro --maestro-device <id> ...`)}catch(n){let i=n.response?.data?.message||n.message||"Unknown error";D.error(T.red(`Could not list Maestro devices: ${i}`)),process.exitCode=1}}var Ld=new Set(["passed","failed","cancelled","interrupted"]),Ko=Number(process.env.MACH_FLOW_UPLOAD_MAX_ATTEMPTS||4),Md=Number(process.env.MACH_FLOW_UPLOAD_TIMEOUT_MS||12e4),is=process.env.MACH_MAESTRO_FAST_FAIL_RETRY==="1";function Xi(e){let t=Array.isArray(e)?e:e?[e]:[];return[...new Set(t.flatMap(n=>String(n||"").split(",")).map(n=>n.trim()).filter(Boolean))]}function Ud(e){let t=Xi(e);if(t.length===0)return;let n={};for(let i of t){let r=process.env[i];r!==void 0&&(n[i]=r)}return Object.keys(n).length>0?n:void 0}function Fd(e){let t={};for(let[i,r]of Object.entries(process.env))i.startsWith("MAESTRO_TEST_")&&r!==void 0&&(t[i]=r);let n=Xi(e);for(let i of n){let r=process.env[i];r!==void 0&&(t[i]=r)}return t}async function Bd(e){let t=e.projectId,n=e.testRunId,i=e.runnerToken||process.env.MACH_RUNNER_TOKEN||process.env.MACH_TOKEN,r=(process.env.MACH_API_URL||Qe).replace(/\/$/,""),o=P.mkdtempSync(k.join(vt.tmpdir(),"mach-maestro-runner-")),s=k.join(o,"mach-maestro-output"),a=k.join(o,"runner.log");if(P.mkdirSync(s,{recursive:!0}),!t||!n||!i)return D.error(T.red("--local-runner requires --project-id, --test-run-id, and a runner token.")),{status:"failed",exitCode:1,attempts:0,flows:".maestro",platform:e.platform};let l=null,d=null,c=null,u,f,p=g=>{P.appendFileSync(a,`${g}${g.endsWith(`
 `)?"":`
-`}`)},g=async(h,A)=>{try{await Jt.post(`${r}/internal/tests/${encodeURIComponent(n)}/runner`,{projectId:t,runnerToken:i,status:h,error:A,logPreview:ac(a),device:f,junitUrl:l?.urls?.junitDownloadUrl,logsUrl:l?.urls?.logsDownloadUrl,artifactsUrl:l?.urls?.artifactsDownloadUrl})}catch(y){p(`[WARN] Could not post runner update: ${y.message||y}`)}};try{p(`Mach Maestro local runner starting for ${n}`);let h=await Jt.post(`${r}/internal/tests/${encodeURIComponent(n)}/runner-payload`,{projectId:t,runnerToken:i});if(h.data?.status!=="success"||!h.data?.payload)throw new Error(h.data?.message||"Runner payload was not returned.");l=h.data.payload;let A=Object.keys(l.env||{});p(`Using Maestro env vars: ${A.length>0?A.join(", "):"none"}`);let y={...process.env,...l.env||{}},w=lc(l.env);w.length>0&&p(`Passing Maestro env vars to test command: ${A.sort().join(", ")}`),await g("running");let M=l.platform==="android"?"app.apk":"app.zip",v=N.join(o,M),H=N.join(o,"source.zip"),W=N.join(o,"source");O.mkdirSync(W,{recursive:!0}),p("Downloading app artifact..."),await er(l.artifactUrl,v),p(`Downloaded app artifact: ${M} (${Qo(O.statSync(v).size)})`),p("Downloading Maestro source..."),await er(l.urls.sourceUrl,H),p(`Downloaded Maestro source: source.zip (${Qo(O.statSync(H).size)})`),new zn(H).extractAllTo(W,!0);let Z=dc(W,l.flowPath||".maestro");if(!O.existsSync(Z))throw new Error(`Maestro flow path not found: ${l.flowPath||".maestro"}`);if(p(`Resolved Maestro flow path: ${N.relative(W,Z)||"."}`),l.platform==="ios"){let _=await gc(l.device||Qi("ios"),a);u=_.udid,f=_.name,await g("running");let P=hc(v,o),b=fs(P,a);p(`Resolved iOS app bundle: ${P}`),p(`Resolved iOS bundle id: ${b||"unknown"}`),yc(P,a,_.udid),tr("xcrun",["simctl","install",_.udid,P],a),b&&(c={platform:l.platform,appId:b,deviceId:_.udid}),b&&Ye("xcrun",["simctl","get_app_container",_.udid,b,"app"],a),qi(s,a,"ios-before-maestro.png",_.udid),l.record&&(d=Ac(s,a,_.udid))}else{let _=Ec(v,a),P=bc(l.device,a);u=P||void 0,f=l.device||Qi("android");let b=P?["-s",P]:[];p(`Resolved Android application id: ${_||"unknown"}`),tr("adb",[...b,"install","-r",v],a),_&&(c={platform:l.platform,appId:_,deviceId:P||void 0})}let oe=Math.max(0,Math.min(10,Number(l.retries??1)))+1,R=N.join(s,"report.xml"),L=fc(a);if(!L)throw new Error("Maestro CLI not found on this runner. Install Maestro or set MAESTRO_BIN to the full maestro path.");let E=1;for(let _=1;_<=oe;_+=1){p(`Running Maestro attempt ${_}/${oe}...`);let P=[...u?["--device",u]:[],"test","--platform",l.platform,...w,Z,"--format","junit","--output",R,"--test-output-dir",s];if(as&&_<oe?E=(await ps(L,P,{logPath:a,env:y,fastFailOnFlowFailure:!0})).exitCode:E=Ye(L,P,a,void 0,y),E===0)break}return l.platform==="ios"&&qi(s,a,"ios-after-maestro.png",u),await es(d,a),d=null,await is(l.urls,o,s,a),E===0?(await g("passed"),D.success(C.green(`Managed Maestro run passed: ${n}`)),{status:"passed",exitCode:0,attempts:oe,flows:l.flowPath,platform:l.platform}):(await g("failed",`Maestro exited with code ${E}`),D.error(C.red(`Managed Maestro run failed with exit code ${E}`)),{status:"failed",exitCode:E,attempts:oe,flows:l.flowPath,platform:l.platform})}catch(h){let A=h.message||String(h);return p(`MACH_MAESTRO_RUN_FAILED: ${A}`),l?.platform==="ios"&&qi(s,a,"ios-after-failure.png",u),await es(d,a),l?.urls&&await is(l.urls,o,s,a),await g("failed",A),D.error(C.red(`Managed Maestro runner failed: ${A}`)),{status:"failed",exitCode:1,attempts:0,flows:l?.flowPath||".maestro",platform:l?.platform||e.platform}}finally{Sc(c,a)}}async function Zd(e){let t=e.maestroFlows||".maestro",n=ds(e.maestroRetries);if(n===null)return null;let i=N.resolve(t);if(!O.existsSync(i))return D.error(C.red(`Maestro flows not found: ${t}`)),{status:"failed",exitCode:1,attempts:0,flows:t,platform:e.platform};let r=await rc(e);if(r?.url){if(!await sc(r))return{status:"failed",exitCode:1,attempts:0,flows:t,platform:r.platform||e.platform}}else if(e.buildId||e.buildUrl||e.artifactUrl||e.latest)return{status:"failed",exitCode:1,attempts:0,flows:t,platform:e.platform};e.maestroRecord&&D.warn(C.yellow("--maestro-record is managed-runner only and is ignored in --local mode."));let o=r?.platform||e.platform,s=["test"];o&&s.push("--platform",o),e.maestroDevice&&s.push("--device",String(e.maestroDevice));let a=Jd(e.maestroEnv),l=Object.keys(a);if(l.length>0){D.info(C.dim(`Passing Maestro env vars to local run: ${l.join(", ")}`));for(let[p,g]of Object.entries(a))s.push("-e",`${p}=${g}`)}s.push(t);let d=n+1,c=1;for(let p=1;p<=d;p+=1){if(D.info(C.dim(`Running local Maestro attempt ${p}/${d}...`)),as&&p<d){let g=await ps("maestro",s,{cwd:process.cwd(),env:process.env,echoOutput:!0,fastFailOnFlowFailure:!0});if(g.error){let h=g.error.message||"Failed to run Maestro";D.error(C.red(`Local Maestro failed to start: ${h}`)),D.info(C.dim("Install Maestro locally, then retry: https://maestro.mobile.dev/getting-started/installing-maestro")),c=1;break}c=g.exitCode}else{let g=Ge("maestro",s,{cwd:process.cwd(),stdio:"inherit",env:process.env});if(g.error){let h=g.error.message||"Failed to run Maestro";D.error(C.red(`Local Maestro failed to start: ${h}`)),D.info(C.dim("Install Maestro locally, then retry: https://maestro.mobile.dev/getting-started/installing-maestro")),c=1;break}c=typeof g.status=="number"?g.status:1}if(c===0)break}let u=c===0?"passed":"failed",f={status:u,exitCode:c,attempts:d,flows:t,platform:o};return Oc(e,f),u==="passed"?D.success(C.green("Local Maestro run passed")):D.error(C.red(`Local Maestro run failed with exit code ${c}`)),f}async function ir(e){let t=ce(`./${m.configFileName}`),n=e.projectId||t?.projectId,i=String(e.profile||e.buildProfile||"production").toLowerCase();if(!n)return D.error(`No projectId found. Run \`${m.nameLower} link\` first or pass an internal project id.`),null;let r=e.platform;if(!r&&e.latest){let f=await os({message:"Select platform for the latest build:",options:[{value:"android",label:"Android"},{value:"ios",label:"iOS"}]});if(Zi(f))return null;r=f}let o=await ic(e);if(!o)return null;if(o.kind==="latest"&&!r)return D.error("Pass --platform when using --latest."),null;if(o.kind==="artifact-url"&&!r)return D.error("Pass --platform when using --artifact-url."),null;let s=ds(e.maestroRetries);if(s===null)return null;let a=nr(e.maestroEnv),l=qd(e.maestroEnv);!e.quiet&&a.length>0&&D.info(C.dim(`Forwarding Maestro env vars by name: ${a.join(", ")}`));let d=await ec(e,n);if(d===null)return null;let c=Xt();e.quiet||c.start("Queuing Maestro run...");let u=e.maestroDevice||(r?Qi(r):void 0);try{let f=await $.post("/tests/maestro",{projectId:n,platform:r,profile:i,latest:o.kind==="latest",buildId:o.kind==="build-id"?o.value:e.buildId,buildUrl:o.kind==="build-url"?o.value:e.buildUrl,artifactUrl:o.kind==="artifact-url"?o.value:e.artifactUrl,flowSourceKey:d,flows:e.maestroFlows||".maestro",...u?{device:u}:{},retries:s,record:!!e.maestroRecord,...a.length>0?{envNames:a}:{},...l?{env:l}:{}});if(f.data.status!=="success")throw new Error(f.data.message||"Failed to queue Maestro run");let p=f.data.testRun,g={testRunId:p.testRunId,status:p.status,projectId:n,buildId:p.buildId,platform:p.platform,dashboardUrl:p.dashboardUrl||`${je}/tests/${p.testRunId}`,launchDeferredReason:p.launchDeferredReason};return gs(e,g),e.quiet||c.stop("Maestro run queued"),g}catch(f){e.quiet||c.stop("Could not queue Maestro run");let p=f.response?.data?.message||f.message||"Unknown error";return D.error(C.red(`Maestro queue failed: ${p}`)),null}}async function Qd(e,t){let n=Zo(e.waitTimeout,60,"--wait-timeout"),i=Zo(e.waitInterval,15,"--wait-interval");if(n===null||i===null)return null;let r=n*60*1e3,o=Math.max(5,i)*1e3,s=Date.now(),a=t.status||"queued";for(D.info(C.dim(`Waiting for Maestro run ${t.testRunId} to finish...`));Date.now()-s<=r;){let l=await nc(t.projectId,t.testRunId);if(!l)return null;if(l.status&&l.status!==a&&(a=l.status,D.info(C.dim(`Maestro status: ${a}`))),Wd.has(String(l.status)))return gs(e,l),l.status==="passed"?D.success(C.green(`Maestro run passed: ${l.testRunId}`)):(D.error(C.red(`Maestro run ${l.status}: ${l.testRunId}`)),l.error&&D.error(C.red(String(l.error)))),l;await rr(o)}return D.error(C.red(`Timed out waiting for Maestro run ${t.testRunId} after ${n} minute(s).`)),{...t,status:"timeout"}}async function ec(e,t){if(e.maestroUseBuildSource)return;let n=e.maestroFlows||".maestro",i=N.resolve(n);if(!O.existsSync(i))return e.maestroFlows?(D.error(C.red(`Maestro flows not found: ${n}`)),null):void 0;let r=N.relative(process.cwd(),i);if(!r||r.startsWith("..")||N.isAbsolute(r))return D.error(C.red("Managed Maestro flow uploads must be inside the current project directory.")),null;let o=Xt();e.quiet||o.start(`Uploading Maestro flows from ${r}...`);try{let s=await $.post("/tests/maestro/source-upload-url",{projectId:t,uploadId:Gd()});if(s.data.status!=="success"||!s.data.uploadUrl||!s.data.key)throw new Error(s.data.message||"Failed to get Maestro flow upload URL");let a=new zn;if(O.statSync(i).isDirectory())a.addLocalFolder(i,r);else{let c=N.dirname(r);a.addLocalFile(i,c==="."?void 0:c,N.basename(r))}let d=a.toBuffer();return await tc(s.data.uploadUrl,d,"application/zip","Maestro flow upload",c=>{e.quiet||o.message(c)}),e.quiet||o.stop("Maestro flows uploaded"),s.data.key}catch(s){e.quiet||o.stop("Could not upload Maestro flows");let a=s.response?.data?.message||s.message||"Unknown error";return D.error(C.red(`Maestro flow upload failed: ${a}`)),null}}function ls(e){let t=e.response?.status,n=e.code||"",i=e.message||"";return t&&![408,409,425,429].includes(t)&&t<500?!1:/ECONNRESET|ETIMEDOUT|EAI_AGAIN|ENOTFOUND|ECONNABORTED|socket hang up|network|timeout/i.test(`${n} ${i}`)||!t}async function tc(e,t,n,i,r){let o;for(let s=1;s<=Xo;s+=1)try{await Jt.put(e,t,{headers:{"Content-Type":n},maxBodyLength:1/0,maxContentLength:1/0,timeout:Yd});return}catch(a){if(o=a,!ls(a)||s>=Xo)break;let l=Math.min(2e4,2e3*s),d=a.code||a.response?.status||a.message||"network error";r?.(`${i} attempt ${s} failed (${d}), retrying...`),await rr(l)}throw o}async function nc(e,t){try{let n=await $.get(`/tests/${encodeURIComponent(t)}`,{params:{projectId:e}});if(n.data.status!=="success")throw new Error(n.data.message||"Failed to fetch Maestro run");let i=n.data.testRun;return{testRunId:i.testRunId,status:i.status,projectId:e,buildId:i.buildId,platform:i.platform,dashboardUrl:i.dashboardUrl||`${je}/tests/${i.testRunId}`,launchDeferredReason:i.launchDeferredReason,...i.error?{error:i.error}:{}}}catch(n){let i=n.response?.data?.message||n.message||"Unknown error";return D.error(C.red(`Could not fetch Maestro run status: ${i}`)),null}}async function ic(e){if(e.buildId)return{kind:"build-id",value:e.buildId};if(e.buildUrl)return{kind:"build-url",value:e.buildUrl};if(e.artifactUrl)return{kind:"artifact-url",value:e.artifactUrl};if(e.latest)return{kind:"latest"};let t=await os({message:"Select app artifact source for Maestro:",options:[{value:"latest",label:"Latest successful build"},{value:"build-id",label:"Build ID"},{value:"build-url",label:`${m.name} build URL`},{value:"artifact-url",label:"Direct artifact URL"}]});if(Zi(t))return null;if(t==="latest")return{kind:"latest"};let n=await zd({message:t==="build-id"?"Enter build ID:":t==="build-url"?`Enter ${m.name} build URL:`:"Enter artifact URL:",validate:i=>{let r=String(i||"").trim();if(!r)return"Value is required";if((t==="build-url"||t==="artifact-url")&&!r.startsWith("http"))return"Must be a URL"}});return Zi(n)?null:{kind:t,value:String(n).trim()}}function Zo(e,t,n){if(e==null||e==="")return t;let i=Number(e);return!Number.isFinite(i)||i<=0?(D.error(`${n} must be a positive number.`),null):i}function rr(e){return new Promise(t=>setTimeout(t,e))}function ds(e){if(e==null||e==="")return 1;let t=Number(e);return!Number.isInteger(t)||t<0||t>10?(D.error("--maestro-retries must be an integer between 0 and 10."),null):t}async function rc(e){if(e.artifactUrl)return{url:e.artifactUrl,platform:e.platform||sr(e.artifactUrl),name:ms(e.artifactUrl)};let t=e.buildId||Rc(e.buildUrl);return t?cs(t,e.platform):e.latest?oc(e):null}async function cs(e,t){let n=Xt();n.start(`Resolving build ${e}...`);try{let i=await $.get(`/public/builds/${encodeURIComponent(e)}`);if(i.data.status!=="success")throw new Error(i.data.message||"Build lookup failed");let r=t||i.data.build?.platform,o=$c(i.data.artifacts||[],r);if(!o?.downloadUrl)throw new Error("No installable APK or simulator app artifact found for this build.");return n.stop("Build artifact resolved"),{url:o.downloadUrl,platform:r||sr(o.name||o.downloadUrl),name:o.name}}catch(i){n.stop("Could not resolve build artifact");let r=i.response?.data?.message||i.message||"Unknown error";return D.error(C.red(`Local Maestro artifact lookup failed: ${r}`)),null}}async function oc(e){let t=ce(`./${m.configFileName}`),n=e.projectId||t?.projectId,i=String(e.profile||e.buildProfile||"production").toLowerCase();if(!n)return D.error(`No projectId found. Run \`${m.nameLower} link\` first or pass --build-id/--artifact-url.`),null;if(!e.platform)return D.error("Pass --platform when using --latest with --local."),null;let r=Xt();r.start("Resolving latest build...");try{let o=await $.get(`/builds/${n}`,{params:{limit:100}}),a=(Array.isArray(o.data.builds)?o.data.builds:[]).find(l=>l.status==="success"&&l.platform===e.platform&&String(l.buildProfile||l.buildType||"production").toLowerCase()===i);if(!a?.buildId)throw new Error(`No successful ${e.platform} build found for profile ${i}.`);return r.stop(`Latest build resolved: ${a.buildId}`),cs(a.buildId,e.platform)}catch(o){r.stop("Could not resolve latest build");let s=o.response?.data?.message||o.message||"Unknown error";return D.error(C.red(`Latest build lookup failed: ${s}`)),null}}async function sc(e){let t=e.platform||sr(e.url);if(!t)return D.error(C.red("Could not infer platform for local install. Pass --platform android or --platform ios.")),!1;let n=O.mkdtempSync(N.join(vt.tmpdir(),"mach-maestro-")),i=e.name||ms(e.url)||(t==="android"?"app.apk":"app.zip"),r=N.join(n,i),o=Xt();o.start(`Downloading ${i}...`);try{await er(e.url,r),o.stop("Artifact downloaded")}catch(s){return o.stop("Artifact download failed"),D.error(C.red(s.message||"Failed to download artifact")),!1}return t==="android"?wc(r):vc(r,n)}async function er(e,t){let n=await Jt.get(e,{responseType:"stream"});await Vd(n.data,O.createWriteStream(t))}function ac(e,t=12e3){try{return O.readFileSync(e,"utf-8").slice(-t)}catch{return""}}function Qo(e){if(!Number.isFinite(e)||e<0)return"unknown size";if(e<1024)return`${e} B`;let t=["KB","MB","GB"],n=e/1024,i=t[0];for(let r=1;n>=1024&&r<t.length;r+=1)n/=1024,i=t[r];return`${n.toFixed(n>=10?1:2)} ${i}`}function lc(e){return Object.entries(e||{}).filter(([t,n])=>!!t&&n!==void 0).sort(([t],[n])=>t.localeCompare(n)).flatMap(([t,n])=>["-e",`${t}=${n}`])}function dc(e,t){let n=N.resolve(e,t||".maestro"),i=N.relative(e,n);if(i.startsWith("..")||N.isAbsolute(i))throw new Error("Maestro flow path must stay inside the build source.");return n}function us(e,t){let n=[e];for(let i=0;i<t.length;i+=1){let r=t[i],o=t[i-1];(o==="-e"||o==="--env")&&/^[A-Za-z_][A-Za-z0-9_]*=/.test(r)?n.push(`${r.slice(0,r.indexOf("="))}=<redacted>`):n.push(r)}return n.join(" ")}function cc(e){return/\[Failed\]\s+/.test(e)}function uc(e){if(!e.killed){try{e.kill("SIGTERM")}catch{}setTimeout(()=>{try{e.kill("SIGKILL")}catch{}},5e3).unref()}}function ps(e,t,n={}){let{cwd:i,env:r=process.env,logPath:o,echoOutput:s=!1,fastFailOnFlowFailure:a=!1}=n;return o&&O.appendFileSync(o,`
-$ ${us(e,t)}
-`),new Promise(l=>{let d=!1,c=!1,u="",f=h=>{c||(c=!0,l(h))},p=rs(e,t,{cwd:i,env:r,stdio:["ignore","pipe","pipe"]}),g=h=>{u+=h;let A=u.split(/\r?\n/);u=A.pop()||"";for(let y of A)if(a&&cc(y)&&!d){d=!0;let w="Mach fast-fail: detected failed Maestro flow; stopping this attempt early to retry...";o&&O.appendFileSync(o,`
-${w}
-`),s&&process.stderr.write(`${w}
-`),uc(p)}};p.stdout?.on("data",h=>{let A=h.toString();o&&O.appendFileSync(o,A),s&&process.stdout.write(A),g(A)}),p.stderr?.on("data",h=>{let A=h.toString();o&&O.appendFileSync(o,A),s&&process.stderr.write(A),g(A)}),p.on("error",h=>{o&&O.appendFileSync(o,`${h.message}
-`),f({exitCode:1,fastFailed:d,error:h})}),p.on("close",(h,A)=>{d&&o&&O.appendFileSync(o,`Maestro attempt stopped after first failed flow${A?` (${A})`:""}.
-`),f({exitCode:typeof h=="number"?h:1,fastFailed:d})})})}function Ye(e,t,n,i,r=process.env){O.appendFileSync(n,`
-$ ${us(e,t)}
-`);let o=Ge(e,t,{cwd:i,encoding:"utf-8",env:r});return o.stdout&&O.appendFileSync(n,o.stdout),o.stderr&&O.appendFileSync(n,o.stderr),o.error?(O.appendFileSync(n,`${o.error.message}
-`),1):typeof o.status=="number"?o.status:1}function tr(e,t,n,i){let r=Ye(e,t,n,i);if(r!==0)throw new Error(`${e} ${t.join(" ")} failed with exit code ${r}`)}function pc(e){try{return O.accessSync(e,O.constants.X_OK),!0}catch{return!1}}function fc(e){let t=[process.env.MAESTRO_BIN,N.join(vt.homedir(),".maestro","bin","maestro"),"/opt/homebrew/bin/maestro","/usr/local/bin/maestro"].filter(Boolean),n=Ge("/usr/bin/env",["which","maestro"],{encoding:"utf-8",env:process.env}),i=n.status===0?String(n.stdout||"").split(`
-`)[0]?.trim():"";i&&t.unshift(i);for(let r of t)if(r&&pc(r))return e&&O.appendFileSync(e,`Using Maestro CLI at ${r}
-`),r;return e&&O.appendFileSync(e,`Maestro CLI not found. Checked: ${t.join(", ")}
-`),null}function mc(e){let t=String(e||"").trim();return t?t.replace(/_/g," ").replace(/\bios\b/gi,"").replace(/\biphone\b/i,"iPhone").replace(/\bpro\b/gi,"Pro").replace(/\bmax\b/gi,"Max").replace(/\s+/g," ").trim():"iPhone 17 Pro"}async function gc(e,t){let n=mc(e),i=Ge("xcrun",["simctl","list","devices","--json"],{encoding:"utf-8"});if(i.status!==0||!i.stdout)throw new Error("Could not list iOS simulators.");let r=JSON.parse(i.stdout),o=Object.values(r.devices||{}).flatMap(l=>Array.isArray(l)?l:[]).filter(l=>l?.isAvailable),s=n.toLowerCase(),a=o.find(l=>l.udid===e)||o.find(l=>l.name===n)||o.find(l=>String(l.name||"").toLowerCase().includes(s));if(!a?.udid)throw new Error(`No available iOS Simulator found for ${n}.`);return a.state==="Booted"?O.appendFileSync(t,`Using already booted iOS Simulator ${a.name} (${a.udid}).
-`):(O.appendFileSync(t,`Booting iOS Simulator ${a.name} (${a.udid})...
-`),Ye("xcrun",["simctl","boot",a.udid],t)!==0&&O.appendFileSync(t,`simctl boot returned non-zero; continuing to bootstatus in case it was already booting.
-`),tr("xcrun",["simctl","bootstatus",a.udid,"-b"],t)),{name:String(a.name||n),udid:a.udid}}function hc(e,t){if(e.endsWith(".ipa"))throw new Error("iOS Maestro runs need a simulator .app.zip artifact, not an App Store .ipa.");if(e.endsWith(".zip")){let n=N.join(t,"ios-app");O.mkdirSync(n,{recursive:!0}),new zn(e).extractAllTo(n,!0);let i=or(n);if(!i)throw new Error("Could not find a .app bundle inside the iOS artifact zip.");return i}if(e.endsWith(".app"))return e;throw new Error("iOS Maestro runs need a .app bundle or .app.zip artifact.")}function fs(e,t){let n=N.join(e,"Info.plist");if(!O.existsSync(n))return O.appendFileSync(t,`Could not find Info.plist in ${e}; skipping uninstall.
-`),null;let i=Ge("/usr/bin/plutil",["-extract","CFBundleIdentifier","raw","-o","-",n],{encoding:"utf-8",env:process.env}),r=String(i.stdout||"").trim();return i.status!==0||!r?(O.appendFileSync(t,`Could not read CFBundleIdentifier from Info.plist; skipping uninstall.
-`),null):r}function qi(e,t,n,i){let r=N.join(e,n);Ye("xcrun",["simctl","io",i||"booted","screenshot",r],t)!==0&&O.appendFileSync(t,`[WARN] Could not capture iOS simulator screenshot: ${n}
-`)}function Ac(e,t,n){let i=N.join(e,"ios-simulator-recording.mp4");O.appendFileSync(t,`Starting iOS simulator recording: ${i}
-`);let r=rs("xcrun",["simctl","io",n||"booted","recordVideo",i],{stdio:["ignore","pipe","pipe"],env:process.env});return r.stdout?.on("data",o=>{O.appendFileSync(t,o)}),r.stderr?.on("data",o=>{O.appendFileSync(t,o)}),r.on("error",o=>{O.appendFileSync(t,`[WARN] Could not start iOS simulator recording: ${o.message}
-`)}),r}async function es(e,t){e&&await new Promise(n=>{let i=!1,r=()=>{i||(i=!0,n())};e.once("exit",r),e.once("close",r),e.killed||(O.appendFileSync(t,`Stopping iOS simulator recording...
-`),e.kill("SIGINT")),setTimeout(()=>{!i&&!e.killed&&(O.appendFileSync(t,`[WARN] iOS simulator recording did not stop after SIGINT; sending SIGKILL.
-`),e.kill("SIGKILL")),r()},5e3).unref?.()})}function yc(e,t,n){let i=fs(e,t);if(!i)return;O.appendFileSync(t,`Uninstalling existing iOS app data for ${i} if present...
-`),Ye("xcrun",["simctl","uninstall",n||"booted",i],t)!==0&&O.appendFileSync(t,`No existing app install removed for ${i}; continuing.
-`)}function Sc(e,t){if(!e?.appId)return;if(O.appendFileSync(t,`Cleaning up installed app after Maestro run...
-`),e.platform==="ios"){let r=Ye("xcrun",["simctl","uninstall",e.deviceId||"booted",e.appId],t);r===0?O.appendFileSync(t,`Uninstalled iOS app ${e.appId} after Maestro run.
-`):O.appendFileSync(t,`Warning: failed to uninstall iOS app ${e.appId} after Maestro run: xcrun simctl uninstall exited with code ${r}
-`);return}let n=e.deviceId?["-s",e.deviceId]:[],i=Ye("adb",[...n,"uninstall",e.appId],t);i===0?O.appendFileSync(t,`Uninstalled Android app ${e.appId} after Maestro run.
-`):O.appendFileSync(t,`Warning: failed to uninstall Android app ${e.appId} after Maestro run: adb uninstall exited with code ${i}
-`)}function bc(e,t){let n=Ge("adb",["devices"],{encoding:"utf-8",env:process.env});if(n.status!==0||n.error)return O.appendFileSync(t,`[WARN] Could not list Android devices before install; using adb default target.
+`}`)},h=async(g,y)=>{try{await Qt.post(`${r}/internal/tests/${encodeURIComponent(n)}/runner`,{projectId:t,runnerToken:i,status:g,error:y,logPreview:Jd(a),device:f,junitUrl:l?.urls?.junitDownloadUrl,logsUrl:l?.urls?.logsDownloadUrl,artifactsUrl:l?.urls?.artifactsDownloadUrl})}catch(S){p(`[WARN] Could not post runner update: ${S.message||S}`)}};try{p(`Mach Maestro local runner starting for ${n}`);let g=await Qt.post(`${r}/internal/tests/${encodeURIComponent(n)}/runner-payload`,{projectId:t,runnerToken:i});if(g.data?.status!=="success"||!g.data?.payload)throw new Error(g.data?.message||"Runner payload was not returned.");l=g.data.payload;let y=Object.keys(l.env||{});p(`Using Maestro env vars: ${y.length>0?y.join(", "):"none"}`);let S={...process.env,...l.env||{}},b=Xd(l.env);b.length>0&&p(`Passing Maestro env vars to test command: ${y.sort().join(", ")}`),await h("running");let C=l.platform==="android"?"app.apk":"app.zip",I=k.join(o,C),j=k.join(o,"source.zip"),Z=k.join(o,"source");P.mkdirSync(Z,{recursive:!0}),p("Downloading app artifact..."),await qi(l.artifactUrl,I),p(`Downloaded app artifact: ${C} (${Yo(P.statSync(I).size)})`),p("Downloading Maestro source..."),await qi(l.urls.sourceUrl,j),p(`Downloaded Maestro source: source.zip (${Yo(P.statSync(j).size)})`),new zn(j).extractAllTo(Z,!0);let z=Zd(Z,l.flowPath||".maestro");if(!P.existsSync(z))throw new Error(`Maestro flow path not found: ${l.flowPath||".maestro"}`);if(p(`Resolved Maestro flow path: ${k.relative(Z,z)||"."}`),l.platform==="ios"){let O=await rc(l.device||zo("ios"),a);u=O.udid,f=O.name,await h("running");let w=oc(I,o),v=ds(w,a);p(`Resolved iOS app bundle: ${w}`),p(`Resolved iOS bundle id: ${v||"unknown"}`),ac(w,a,O.udid),Ji("xcrun",["simctl","install",O.udid,w],a),v&&(c={platform:l.platform,appId:v,deviceId:O.udid}),v&&We("xcrun",["simctl","get_app_container",O.udid,v,"app"],a),zi(s,a,"ios-before-maestro.png",O.udid),l.record&&(d=sc(s,a,O.udid))}else{let O=cc(I,a),w=dc(l.device,a);u=w||void 0,f=l.device||zo("android");let v=w?["-s",w]:[];p(`Resolved Android application id: ${O||"unknown"}`),Ji("adb",[...v,"install","-r",I],a),O&&(c={platform:l.platform,appId:O,deviceId:w||void 0})}let re=Math.max(0,Math.min(10,Number(l.retries??1)))+1,ke=k.join(s,"report.xml"),Ae=nc(a);if(!Ae)throw new Error("Maestro CLI not found on this runner. Install Maestro or set MAESTRO_BIN to the full maestro path.");let A=1;for(let O=1;O<=re;O+=1){p(`Running Maestro attempt ${O}/${re}...`);let w=[...u?["--device",u]:[],"test","--platform",l.platform,...b,z,"--format","junit","--output",ke,"--test-output-dir",s];if(is&&O<re?A=(await ls(Ae,w,{logPath:a,env:S,fastFailOnFlowFailure:!0})).exitCode:A=We(Ae,w,a,void 0,S),A===0)break}return l.platform==="ios"&&zi(s,a,"ios-after-maestro.png",u),await qo(d,a),d=null,await Zo(l.urls,o,s,a),A===0?(await h("passed"),D.success(T.green(`Managed Maestro run passed: ${n}`)),{status:"passed",exitCode:0,attempts:re,flows:l.flowPath,platform:l.platform}):(await h("failed",`Maestro exited with code ${A}`),D.error(T.red(`Managed Maestro run failed with exit code ${A}`)),{status:"failed",exitCode:A,attempts:re,flows:l.flowPath,platform:l.platform})}catch(g){let y=g.message||String(g);return p(`MACH_MAESTRO_RUN_FAILED: ${y}`),l?.platform==="ios"&&zi(s,a,"ios-after-failure.png",u),await qo(d,a),l?.urls&&await Zo(l.urls,o,s,a),await h("failed",y),D.error(T.red(`Managed Maestro runner failed: ${y}`)),{status:"failed",exitCode:1,attempts:0,flows:l?.flowPath||".maestro",platform:l?.platform||e.platform}}finally{lc(c,a)}}async function Hd(e){let t=e.maestroFlows||".maestro",n=os(e.maestroRetries);if(n===null)return null;let i=k.resolve(t);if(!P.existsSync(i))return D.error(T.red(`Maestro flows not found: ${t}`)),{status:"failed",exitCode:1,attempts:0,flows:t,platform:e.platform};let r=await Wd(e);if(r?.url){if(!await qd(r))return{status:"failed",exitCode:1,attempts:0,flows:t,platform:r.platform||e.platform}}else if(e.buildId||e.buildUrl||e.artifactUrl||e.latest)return{status:"failed",exitCode:1,attempts:0,flows:t,platform:e.platform};e.maestroRecord&&D.warn(T.yellow("--maestro-record is managed-runner only and is ignored in --local mode."));let o=r?.platform||e.platform,s=["test"];o&&s.push("--platform",o),e.maestroDevice&&s.push("--device",String(e.maestroDevice));let a=Fd(e.maestroEnv),l=Object.keys(a);if(l.length>0){D.info(T.dim(`Passing Maestro env vars to local run: ${l.join(", ")}`));for(let[p,h]of Object.entries(a))s.push("-e",`${p}=${h}`)}s.push(t);let d=n+1,c=1;for(let p=1;p<=d;p+=1){if(D.info(T.dim(`Running local Maestro attempt ${p}/${d}...`)),is&&p<d){let h=await ls("maestro",s,{cwd:process.cwd(),env:process.env,echoOutput:!0,fastFailOnFlowFailure:!0});if(h.error){let g=h.error.message||"Failed to run Maestro";D.error(T.red(`Local Maestro failed to start: ${g}`)),D.info(T.dim("Install Maestro locally, then retry: https://maestro.mobile.dev/getting-started/installing-maestro")),c=1;break}c=h.exitCode}else{let h=Ge("maestro",s,{cwd:process.cwd(),stdio:"inherit",env:process.env});if(h.error){let g=h.error.message||"Failed to run Maestro";D.error(T.red(`Local Maestro failed to start: ${g}`)),D.info(T.dim("Install Maestro locally, then retry: https://maestro.mobile.dev/getting-started/installing-maestro")),c=1;break}c=typeof h.status=="number"?h.status:1}if(c===0)break}let u=c===0?"passed":"failed",f={status:u,exitCode:c,attempts:d,flows:t,platform:o};return Ac(e,f),u==="passed"?D.success(T.green("Local Maestro run passed")):D.error(T.red(`Local Maestro run failed with exit code ${c}`)),f}async function Zi(e){let t=le(`./${m.configFileName}`),n=e.projectId||t?.projectId,i=String(e.profile||e.buildProfile||"production").toLowerCase();if(!n)return D.error(`No projectId found. Run \`${m.nameLower} link\` first or pass an internal project id.`),null;let r=e.platform;if(!r&&e.latest){let f=await es({message:"Select platform for the latest build:",options:[{value:"android",label:"Android"},{value:"ios",label:"iOS"}]});if(Yi(f))return null;r=f}let o=await Kd(e);if(!o)return null;if(o.kind==="latest"&&!r)return D.error("Pass --platform when using --latest."),null;if(o.kind==="artifact-url"&&!r)return D.error("Pass --platform when using --artifact-url."),null;let s=os(e.maestroRetries);if(s===null)return null;let a=Xi(e.maestroEnv),l=Ud(e.maestroEnv);!e.quiet&&a.length>0&&D.info(T.dim(`Forwarding Maestro env vars by name: ${a.join(", ")}`));let d=await Gd(e,n);if(d===null)return null;let c=en();e.quiet||c.start("Queuing Maestro run...");let u=String(e.maestroDevice||"").trim()||void 0;try{let f=await $.post("/tests/maestro",{projectId:n,platform:r,profile:i,latest:o.kind==="latest",buildId:o.kind==="build-id"?o.value:e.buildId,buildUrl:o.kind==="build-url"?o.value:e.buildUrl,artifactUrl:o.kind==="artifact-url"?o.value:e.artifactUrl,flowSourceKey:d,flows:e.maestroFlows||".maestro",...u?{device:u}:{},retries:s,record:!!e.maestroRecord,...a.length>0?{envNames:a}:{},...l?{env:l}:{}});if(f.data.status!=="success")throw new Error(f.data.message||"Failed to queue Maestro run");let p=f.data.testRun,h={testRunId:p.testRunId,status:p.status,projectId:n,buildId:p.buildId,platform:p.platform,dashboardUrl:p.dashboardUrl||`${je}/tests/${p.testRunId}`,launchDeferredReason:p.launchDeferredReason};return us(e,h),e.quiet||c.stop("Maestro run queued"),h}catch(f){e.quiet||c.stop("Could not queue Maestro run");let p=f.response?.data?.message||f.message||"Unknown error";return D.error(T.red(`Maestro queue failed: ${p}`)),null}}async function jd(e,t){let n=Wo(e.waitTimeout,60,"--wait-timeout"),i=Wo(e.waitInterval,15,"--wait-interval");if(n===null||i===null)return null;let r=n*60*1e3,o=Math.max(5,i)*1e3,s=Date.now(),a=t.status||"queued";for(D.info(T.dim(`Waiting for Maestro run ${t.testRunId} to finish...`));Date.now()-s<=r;){let l=await zd(t.projectId,t.testRunId);if(!l)return null;if(l.status&&l.status!==a&&(a=l.status,D.info(T.dim(`Maestro status: ${a}`))),Ld.has(String(l.status)))return us(e,l),l.status==="passed"?D.success(T.green(`Maestro run passed: ${l.testRunId}`)):(D.error(T.red(`Maestro run ${l.status}: ${l.testRunId}`)),l.error&&D.error(T.red(String(l.error)))),l;await Qi(o)}return D.error(T.red(`Timed out waiting for Maestro run ${t.testRunId} after ${n} minute(s).`)),{...t,status:"timeout"}}async function Gd(e,t){if(e.maestroUseBuildSource)return;let n=e.maestroFlows||".maestro",i=k.resolve(n);if(!P.existsSync(i))return e.maestroFlows?(D.error(T.red(`Maestro flows not found: ${n}`)),null):void 0;let r=k.relative(process.cwd(),i);if(!r||r.startsWith("..")||k.isAbsolute(r))return D.error(T.red("Managed Maestro flow uploads must be inside the current project directory.")),null;let o=en();e.quiet||o.start(`Uploading Maestro flows from ${r}...`);try{let s=await $.post("/tests/maestro/source-upload-url",{projectId:t,uploadId:Td()});if(s.data.status!=="success"||!s.data.uploadUrl||!s.data.key)throw new Error(s.data.message||"Failed to get Maestro flow upload URL");let a=new zn;if(P.statSync(i).isDirectory())a.addLocalFolder(i,r);else{let c=k.dirname(r);a.addLocalFile(i,c==="."?void 0:c,k.basename(r))}let d=a.toBuffer();return await Vd(s.data.uploadUrl,d,"application/zip","Maestro flow upload",c=>{e.quiet||o.message(c)}),e.quiet||o.stop("Maestro flows uploaded"),s.data.key}catch(s){e.quiet||o.stop("Could not upload Maestro flows");let a=s.response?.data?.message||s.message||"Unknown error";return D.error(T.red(`Maestro flow upload failed: ${a}`)),null}}function rs(e){let t=e.response?.status,n=e.code||"",i=e.message||"";return t&&![408,409,425,429].includes(t)&&t<500?!1:/ECONNRESET|ETIMEDOUT|EAI_AGAIN|ENOTFOUND|ECONNABORTED|socket hang up|network|timeout/i.test(`${n} ${i}`)||!t}async function Vd(e,t,n,i,r){let o;for(let s=1;s<=Ko;s+=1)try{await Qt.put(e,t,{headers:{"Content-Type":n},maxBodyLength:1/0,maxContentLength:1/0,timeout:Md});return}catch(a){if(o=a,!rs(a)||s>=Ko)break;let l=Math.min(2e4,2e3*s),d=a.code||a.response?.status||a.message||"network error";r?.(`${i} attempt ${s} failed (${d}), retrying...`),await Qi(l)}throw o}async function zd(e,t){try{let n=await $.get(`/tests/${encodeURIComponent(t)}`,{params:{projectId:e}});if(n.data.status!=="success")throw new Error(n.data.message||"Failed to fetch Maestro run");let i=n.data.testRun;return{testRunId:i.testRunId,status:i.status,projectId:e,buildId:i.buildId,platform:i.platform,dashboardUrl:i.dashboardUrl||`${je}/tests/${i.testRunId}`,launchDeferredReason:i.launchDeferredReason,...i.error?{error:i.error}:{}}}catch(n){let i=n.response?.data?.message||n.message||"Unknown error";return D.error(T.red(`Could not fetch Maestro run status: ${i}`)),null}}async function Kd(e){if(e.buildId)return{kind:"build-id",value:e.buildId};if(e.buildUrl)return{kind:"build-url",value:e.buildUrl};if(e.artifactUrl)return{kind:"artifact-url",value:e.artifactUrl};if(e.latest)return{kind:"latest"};let t=await es({message:"Select app artifact source for Maestro:",options:[{value:"latest",label:"Latest successful build"},{value:"build-id",label:"Build ID"},{value:"build-url",label:`${m.name} build URL`},{value:"artifact-url",label:"Direct artifact URL"}]});if(Yi(t))return null;if(t==="latest")return{kind:"latest"};let n=await kd({message:t==="build-id"?"Enter build ID:":t==="build-url"?`Enter ${m.name} build URL:`:"Enter artifact URL:",validate:i=>{let r=String(i||"").trim();if(!r)return"Value is required";if((t==="build-url"||t==="artifact-url")&&!r.startsWith("http"))return"Must be a URL"}});return Yi(n)?null:{kind:t,value:String(n).trim()}}function Wo(e,t,n){if(e==null||e==="")return t;let i=Number(e);return!Number.isFinite(i)||i<=0?(D.error(`${n} must be a positive number.`),null):i}function Qi(e){return new Promise(t=>setTimeout(t,e))}function os(e){if(e==null||e==="")return 1;let t=Number(e);return!Number.isInteger(t)||t<0||t>10?(D.error("--maestro-retries must be an integer between 0 and 10."),null):t}async function Wd(e){if(e.artifactUrl)return{url:e.artifactUrl,platform:e.platform||tr(e.artifactUrl),name:cs(e.artifactUrl)};let t=e.buildId||hc(e.buildUrl);return t?ss(t,e.platform):e.latest?Yd(e):null}async function ss(e,t){let n=en();n.start(`Resolving build ${e}...`);try{let i=await $.get(`/public/builds/${encodeURIComponent(e)}`);if(i.data.status!=="success")throw new Error(i.data.message||"Build lookup failed");let r=t||i.data.build?.platform,o=gc(i.data.artifacts||[],r);if(!o?.downloadUrl)throw new Error("No installable APK or simulator app artifact found for this build.");return n.stop("Build artifact resolved"),{url:o.downloadUrl,platform:r||tr(o.name||o.downloadUrl),name:o.name}}catch(i){n.stop("Could not resolve build artifact");let r=i.response?.data?.message||i.message||"Unknown error";return D.error(T.red(`Local Maestro artifact lookup failed: ${r}`)),null}}async function Yd(e){let t=le(`./${m.configFileName}`),n=e.projectId||t?.projectId,i=String(e.profile||e.buildProfile||"production").toLowerCase();if(!n)return D.error(`No projectId found. Run \`${m.nameLower} link\` first or pass --build-id/--artifact-url.`),null;if(!e.platform)return D.error("Pass --platform when using --latest with --local."),null;let r=en();r.start("Resolving latest build...");try{let o=await $.get(`/builds/${n}`,{params:{limit:100}}),a=(Array.isArray(o.data.builds)?o.data.builds:[]).find(l=>l.status==="success"&&l.platform===e.platform&&String(l.buildProfile||l.buildType||"production").toLowerCase()===i);if(!a?.buildId)throw new Error(`No successful ${e.platform} build found for profile ${i}.`);return r.stop(`Latest build resolved: ${a.buildId}`),ss(a.buildId,e.platform)}catch(o){r.stop("Could not resolve latest build");let s=o.response?.data?.message||o.message||"Unknown error";return D.error(T.red(`Latest build lookup failed: ${s}`)),null}}async function qd(e){let t=e.platform||tr(e.url);if(!t)return D.error(T.red("Could not infer platform for local install. Pass --platform android or --platform ios.")),!1;let n=P.mkdtempSync(k.join(vt.tmpdir(),"mach-maestro-")),i=e.name||cs(e.url)||(t==="android"?"app.apk":"app.zip"),r=k.join(n,i),o=en();o.start(`Downloading ${i}...`);try{await qi(e.url,r),o.stop("Artifact downloaded")}catch(s){return o.stop("Artifact download failed"),D.error(T.red(s.message||"Failed to download artifact")),!1}return t==="android"?fc(r):mc(r,n)}async function qi(e,t){let n=await Qt.get(e,{responseType:"stream"});await Nd(n.data,P.createWriteStream(t))}function Jd(e,t=12e3){try{return P.readFileSync(e,"utf-8").slice(-t)}catch{return""}}function Yo(e){if(!Number.isFinite(e)||e<0)return"unknown size";if(e<1024)return`${e} B`;let t=["KB","MB","GB"],n=e/1024,i=t[0];for(let r=1;n>=1024&&r<t.length;r+=1)n/=1024,i=t[r];return`${n.toFixed(n>=10?1:2)} ${i}`}function Xd(e){return Object.entries(e||{}).filter(([t,n])=>!!t&&n!==void 0).sort(([t],[n])=>t.localeCompare(n)).flatMap(([t,n])=>["-e",`${t}=${n}`])}function Zd(e,t){let n=k.resolve(e,t||".maestro"),i=k.relative(e,n);if(i.startsWith("..")||k.isAbsolute(i))throw new Error("Maestro flow path must stay inside the build source.");return n}function as(e,t){let n=[e];for(let i=0;i<t.length;i+=1){let r=t[i],o=t[i-1];(o==="-e"||o==="--env")&&/^[A-Za-z_][A-Za-z0-9_]*=/.test(r)?n.push(`${r.slice(0,r.indexOf("="))}=<redacted>`):n.push(r)}return n.join(" ")}function Qd(e){return/\[Failed\]\s+/.test(e)}function ec(e){if(!e.killed){try{e.kill("SIGTERM")}catch{}setTimeout(()=>{try{e.kill("SIGKILL")}catch{}},5e3).unref()}}function ls(e,t,n={}){let{cwd:i,env:r=process.env,logPath:o,echoOutput:s=!1,fastFailOnFlowFailure:a=!1}=n;return o&&P.appendFileSync(o,`
+$ ${as(e,t)}
+`),new Promise(l=>{let d=!1,c=!1,u="",f=g=>{c||(c=!0,l(g))},p=Qo(e,t,{cwd:i,env:r,stdio:["ignore","pipe","pipe"]}),h=g=>{u+=g;let y=u.split(/\r?\n/);u=y.pop()||"";for(let S of y)if(a&&Qd(S)&&!d){d=!0;let b="Mach fast-fail: detected failed Maestro flow; stopping this attempt early to retry...";o&&P.appendFileSync(o,`
+${b}
+`),s&&process.stderr.write(`${b}
+`),ec(p)}};p.stdout?.on("data",g=>{let y=g.toString();o&&P.appendFileSync(o,y),s&&process.stdout.write(y),h(y)}),p.stderr?.on("data",g=>{let y=g.toString();o&&P.appendFileSync(o,y),s&&process.stderr.write(y),h(y)}),p.on("error",g=>{o&&P.appendFileSync(o,`${g.message}
+`),f({exitCode:1,fastFailed:d,error:g})}),p.on("close",(g,y)=>{d&&o&&P.appendFileSync(o,`Maestro attempt stopped after first failed flow${y?` (${y})`:""}.
+`),f({exitCode:typeof g=="number"?g:1,fastFailed:d})})})}function We(e,t,n,i,r=process.env){P.appendFileSync(n,`
+$ ${as(e,t)}
+`);let o=Ge(e,t,{cwd:i,encoding:"utf-8",env:r});return o.stdout&&P.appendFileSync(n,o.stdout),o.stderr&&P.appendFileSync(n,o.stderr),o.error?(P.appendFileSync(n,`${o.error.message}
+`),1):typeof o.status=="number"?o.status:1}function Ji(e,t,n,i){let r=We(e,t,n,i);if(r!==0)throw new Error(`${e} ${t.join(" ")} failed with exit code ${r}`)}function tc(e){try{return P.accessSync(e,P.constants.X_OK),!0}catch{return!1}}function nc(e){let t=[process.env.MAESTRO_BIN,k.join(vt.homedir(),".maestro","bin","maestro"),"/opt/homebrew/bin/maestro","/usr/local/bin/maestro"].filter(Boolean),n=Ge("/usr/bin/env",["which","maestro"],{encoding:"utf-8",env:process.env}),i=n.status===0?String(n.stdout||"").split(`
+`)[0]?.trim():"";i&&t.unshift(i);for(let r of t)if(r&&tc(r))return e&&P.appendFileSync(e,`Using Maestro CLI at ${r}
+`),r;return e&&P.appendFileSync(e,`Maestro CLI not found. Checked: ${t.join(", ")}
+`),null}function ic(e){let t=String(e||"").trim();return t?t.replace(/_/g," ").replace(/\bios\b/gi,"").replace(/\biphone\b/i,"iPhone").replace(/\bpro\b/gi,"Pro").replace(/\bmax\b/gi,"Max").replace(/\s+/g," ").trim():"iPhone 17 Pro"}async function rc(e,t){let n=ic(e),i=Ge("xcrun",["simctl","list","devices","--json"],{encoding:"utf-8"});if(i.status!==0||!i.stdout)throw new Error("Could not list iOS simulators.");let r=JSON.parse(i.stdout),o=Object.values(r.devices||{}).flatMap(l=>Array.isArray(l)?l:[]).filter(l=>l?.isAvailable),s=n.toLowerCase(),a=o.find(l=>l.udid===e)||o.find(l=>l.name===n)||o.find(l=>String(l.name||"").toLowerCase().includes(s));if(!a?.udid)throw new Error(`No available iOS Simulator found for ${n}.`);return a.state==="Booted"?P.appendFileSync(t,`Using already booted iOS Simulator ${a.name} (${a.udid}).
+`):(P.appendFileSync(t,`Booting iOS Simulator ${a.name} (${a.udid})...
+`),We("xcrun",["simctl","boot",a.udid],t)!==0&&P.appendFileSync(t,`simctl boot returned non-zero; continuing to bootstatus in case it was already booting.
+`),Ji("xcrun",["simctl","bootstatus",a.udid,"-b"],t)),{name:String(a.name||n),udid:a.udid}}function oc(e,t){if(e.endsWith(".ipa"))throw new Error("iOS Maestro runs need a simulator .app.zip artifact, not an App Store .ipa.");if(e.endsWith(".zip")){let n=k.join(t,"ios-app");P.mkdirSync(n,{recursive:!0}),new zn(e).extractAllTo(n,!0);let i=er(n);if(!i)throw new Error("Could not find a .app bundle inside the iOS artifact zip.");return i}if(e.endsWith(".app"))return e;throw new Error("iOS Maestro runs need a .app bundle or .app.zip artifact.")}function ds(e,t){let n=k.join(e,"Info.plist");if(!P.existsSync(n))return P.appendFileSync(t,`Could not find Info.plist in ${e}; skipping uninstall.
+`),null;let i=Ge("/usr/bin/plutil",["-extract","CFBundleIdentifier","raw","-o","-",n],{encoding:"utf-8",env:process.env}),r=String(i.stdout||"").trim();return i.status!==0||!r?(P.appendFileSync(t,`Could not read CFBundleIdentifier from Info.plist; skipping uninstall.
+`),null):r}function zi(e,t,n,i){let r=k.join(e,n);We("xcrun",["simctl","io",i||"booted","screenshot",r],t)!==0&&P.appendFileSync(t,`[WARN] Could not capture iOS simulator screenshot: ${n}
+`)}function sc(e,t,n){let i=k.join(e,"ios-simulator-recording.mp4");P.appendFileSync(t,`Starting iOS simulator recording: ${i}
+`);let r=Qo("xcrun",["simctl","io",n||"booted","recordVideo",i],{stdio:["ignore","pipe","pipe"],env:process.env});return r.stdout?.on("data",o=>{P.appendFileSync(t,o)}),r.stderr?.on("data",o=>{P.appendFileSync(t,o)}),r.on("error",o=>{P.appendFileSync(t,`[WARN] Could not start iOS simulator recording: ${o.message}
+`)}),r}async function qo(e,t){e&&await new Promise(n=>{let i=!1,r=()=>{i||(i=!0,n())};e.once("exit",r),e.once("close",r),e.killed||(P.appendFileSync(t,`Stopping iOS simulator recording...
+`),e.kill("SIGINT")),setTimeout(()=>{!i&&!e.killed&&(P.appendFileSync(t,`[WARN] iOS simulator recording did not stop after SIGINT; sending SIGKILL.
+`),e.kill("SIGKILL")),r()},5e3).unref?.()})}function ac(e,t,n){let i=ds(e,t);if(!i)return;P.appendFileSync(t,`Uninstalling existing iOS app data for ${i} if present...
+`),We("xcrun",["simctl","uninstall",n||"booted",i],t)!==0&&P.appendFileSync(t,`No existing app install removed for ${i}; continuing.
+`)}function lc(e,t){if(!e?.appId)return;if(P.appendFileSync(t,`Cleaning up installed app after Maestro run...
+`),e.platform==="ios"){let r=We("xcrun",["simctl","uninstall",e.deviceId||"booted",e.appId],t);r===0?P.appendFileSync(t,`Uninstalled iOS app ${e.appId} after Maestro run.
+`):P.appendFileSync(t,`Warning: failed to uninstall iOS app ${e.appId} after Maestro run: xcrun simctl uninstall exited with code ${r}
+`);return}let n=e.deviceId?["-s",e.deviceId]:[],i=We("adb",[...n,"uninstall",e.appId],t);i===0?P.appendFileSync(t,`Uninstalled Android app ${e.appId} after Maestro run.
+`):P.appendFileSync(t,`Warning: failed to uninstall Android app ${e.appId} after Maestro run: adb uninstall exited with code ${i}
+`)}function dc(e,t){let n=Ge("adb",["devices"],{encoding:"utf-8",env:process.env});if(n.status!==0||n.error)return P.appendFileSync(t,`[WARN] Could not list Android devices before install; using adb default target.
 `),null;let i=String(n.stdout||"").split(`
-`).map(r=>r.trim().split(/\s+/)).filter(r=>r.length>=2&&r[1]==="device").map(r=>r[0]).filter(Boolean);return e&&i.includes(e)?(O.appendFileSync(t,`Using Android device ${e} for install and cleanup.
-`),e):i.length===1?(O.appendFileSync(t,`Using Android device ${i[0]} for install and cleanup.
-`),i[0]):(i.length>1&&O.appendFileSync(t,`[WARN] Multiple Android devices are connected; using adb default target for install and cleanup.
-`),null)}function Ec(e,t){let i=(Ji("aapt",["dump","badging",e])||Ji("aapt2",["dump","badging",e]))?.match(/package:\s+name='([^']+)'/);if(i?.[1])return i[1];let o=Ji("apkanalyzer",["manifest","application-id",e])?.split(/\s+/).find(Boolean);return o||(O.appendFileSync(t,`[WARN] Could not determine Android application id from APK; post-run uninstall will be skipped.
-`),null)}function Ji(e,t){for(let n of Ic(e)){let i=Ge(n,t,{encoding:"utf-8",env:process.env,maxBuffer:10485760});if(i.status===0&&i.stdout)return String(i.stdout).trim()}return null}function Ic(e){let t=process.platform==="win32"&&!e.endsWith(".exe")?`${e}.exe`:e,n=[];if(e==="aapt"||e==="aapt2")for(let r of ts()){let o=N.join(r,"build-tools");for(let s of ns(o))n.push(N.join(o,s,t))}if(e==="apkanalyzer")for(let r of ts()){n.push(N.join(r,"cmdline-tools","latest","bin",t));let o=N.join(r,"cmdline-tools");for(let s of ns(o))n.push(N.join(o,s,"bin",t));n.push(N.join(r,"tools","bin",t))}let i=_c(e);return i&&n.unshift(i),n.push(t),[...new Set(n)]}function ts(){let e=[process.env.ANDROID_HOME,process.env.ANDROID_SDK_ROOT];return process.platform==="darwin"?e.push(N.join(vt.homedir(),"Library","Android","sdk")):process.platform==="linux"&&e.push(N.join(vt.homedir(),"Android","Sdk"),N.join(vt.homedir(),"Android","sdk"),"/opt/android-sdk","/usr/lib/android-sdk"),[...new Set(e.filter(t=>!!t))]}function ns(e){try{return O.readdirSync(e,{withFileTypes:!0}).filter(t=>t.isDirectory()).map(t=>t.name).sort((t,n)=>n.localeCompare(t,void 0,{numeric:!0}))}catch{return[]}}function _c(e){let t=process.platform==="win32"?"where":"/usr/bin/env",n=process.platform==="win32"?[e]:["which",e],i=Ge(t,n,{encoding:"utf-8",env:process.env});return i.status!==0||!i.stdout?null:String(i.stdout).split(`
-`)[0]?.trim()||null}async function Xi(e,t,n){if(!O.existsSync(e))return;let i=O.readFileSync(e),r;for(let o=1;o<=3;o+=1)try{await Jt.put(t,i,{headers:{"Content-Type":n,"Content-Length":String(i.length)},maxBodyLength:1/0,maxContentLength:1/0,timeout:12e4});return}catch(s){if(r=s,!ls(s)||o>=3)break;await rr(2e3*o)}throw r}async function is(e,t,n,i){let r=N.join(n,"report.xml"),o=N.join(t,"artifacts.tar.gz");try{await Xi(r,e.junitUploadUrl,"application/xml")}catch(s){O.appendFileSync(i,`[WARN] Failed to upload JUnit report: ${s.message||s}
-`)}try{await Xi(i,e.logUploadUrl,"text/plain")}catch(s){O.appendFileSync(i,`[WARN] Failed to upload runner log: ${s.message||s}
-`)}try{Ye("tar",["-czf",o,"-C",t,N.basename(n)],i),await Xi(o,e.artifactsUploadUrl,"application/gzip")}catch(s){O.appendFileSync(i,`[WARN] Failed to upload Maestro artifacts: ${s.message||s}
-`)}}function wc(e){if(!e.endsWith(".apk"))return D.error(C.red("Local Android Maestro runs need an APK artifact.")),!1;D.info(C.dim("Installing APK on local Android device/emulator..."));let t=Ge("adb",["install","-r",e],{stdio:"inherit",env:process.env});return t.error?(D.error(C.red(`adb failed to start: ${t.error.message}`)),!1):t.status!==0?(D.error(C.red(`adb install failed with exit code ${t.status??1}`)),!1):!0}function vc(e,t){if(e.endsWith(".ipa"))return D.error(C.red("Local iOS Maestro runs need an iOS Simulator .app.zip artifact, not an App Store .ipa.")),!1;let n=e;if(e.endsWith(".zip")){let r=N.join(t,"ios-app");O.mkdirSync(r,{recursive:!0}),new zn(e).extractAllTo(r,!0);let o=or(r);if(!o)return D.error(C.red("Could not find a .app bundle inside the downloaded zip.")),!1;n=o}if(!n.endsWith(".app"))return D.error(C.red("Local iOS Maestro runs need an iOS Simulator .app bundle or .app.zip artifact.")),!1;D.info(C.dim("Installing app on booted iOS Simulator..."));let i=Ge("xcrun",["simctl","install","booted",n],{stdio:"inherit",env:process.env});return i.error?(D.error(C.red(`xcrun failed to start: ${i.error.message}`)),!1):i.status!==0?(D.error(C.red(`iOS Simulator install failed with exit code ${i.status??1}`)),!1):!0}function or(e){let t=O.readdirSync(e,{withFileTypes:!0});for(let n of t){let i=N.join(e,n.name);if(n.isDirectory()&&n.name.endsWith(".app"))return i;if(n.isDirectory()){let r=or(i);if(r)return r}}return null}function $c(e,t){let n=String(t||"").toLowerCase();return n==="android"?e.find(i=>wt(i,".apk")):n==="ios"?e.find(i=>wt(i,".app.zip"))||e.find(i=>wt(i,".zip")):e.find(i=>wt(i,".apk"))||e.find(i=>wt(i,".app.zip"))||e.find(i=>wt(i,".zip"))}function wt(e,t){return String(e?.name||e?.downloadUrl||e?.url||"").toLowerCase().endsWith(t)}function sr(e){let t=String(e||"").toLowerCase();if(t.includes(".apk"))return"android";if(t.includes(".app.zip")||t.endsWith(".app")||t.includes(".ipa"))return"ios"}function ms(e){if(e)try{return N.basename(new URL(e).pathname)||void 0}catch{return N.basename(e)||void 0}}function Rc(e){return e?e.match(/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/i)?.[0]:void 0}function gs(e,t){if(!e.jsonOutput)return;let n=N.resolve(e.jsonOutput),i={...t,updatedAt:new Date().toISOString()};try{let r=N.dirname(n);r&&r!=="."&&O.mkdirSync(r,{recursive:!0}),O.writeFileSync(n,JSON.stringify(i,null,2))}catch(r){D.warn(C.yellow(`Could not write Maestro metadata JSON: ${r.message}`))}}function Oc(e,t){if(!e.jsonOutput)return;let n=N.resolve(e.jsonOutput),i={mode:"local",...t,updatedAt:new Date().toISOString()};try{let r=N.dirname(n);r&&r!=="."&&O.mkdirSync(r,{recursive:!0}),O.writeFileSync(n,JSON.stringify(i,null,2))}catch(r){D.warn(C.yellow(`Could not write Maestro metadata JSON: ${r.message}`))}}import{spinner as it,text as en,select as pr,isCancel as tt,cancel as fr,log as vs}from"@clack/prompts";import V from"chalk";import Y from"fs";import ge from"path";import{spawn as kc,spawnSync as ht}from"child_process";import $s from"axios";import yt from"os";import hr from"crypto";import Pc from"crypto";import $t from"axios";import hs from"fs";var Qt=6e4,Dc=12e4,ar=4,Zt=e=>encodeURIComponent(e),Cc=e=>new Promise(t=>setTimeout(t,e));async function Rt(e,t){let n;for(let i=1;i<=ar;i++)try{return await t()}catch(r){if(n=r,i>=ar||!Tc(r))throw r;let o=Number(r.response?.headers?.["retry-after"]),s=Number.isFinite(o)&&o>0?o*1e3:Math.min(2e3*i*i,15e3);console.log(`[Google Play] ${e} failed (attempt ${i}/${ar}); retrying in ${Math.round(s/1e3)}s...`),await Cc(s)}throw n}function Tc(e){let t=e.response?.status;return t?t===408||t===409||t===425||t===429||t>=500:!0}async function ys(e){let{packageName:t,serviceAccount:n,aabPath:i,track:r,releaseStatus:o,userFraction:s,changesNotSentForReview:a}=e,l;try{let c={Authorization:`Bearer ${await As(n)}`,Connection:"close"},u=Zt(t);if(l=(await Rt("create edit",()=>$t.post(`https://androidpublisher.googleapis.com/androidpublisher/v3/applications/${u}/edits`,{},{headers:c,timeout:Qt}))).data.id,!l)throw new Error("Google Play edit insert succeeded but did not return an edit id.");let p=Zt(l),g=hs.statSync(i),h=await Rt("upload AAB",()=>$t.post(`https://androidpublisher.googleapis.com/upload/androidpublisher/v3/applications/${u}/edits/${p}/bundles`,hs.createReadStream(i),{headers:{...c,"Content-Type":"application/octet-stream","Content-Length":g.size},maxBodyLength:1/0,maxContentLength:1/0,params:{uploadType:"media"},timeout:Dc})),A=Number(h.data.versionCode);if(!A)throw new Error("Google Play upload succeeded but did not return a versionCode.");let y={versionCodes:[String(A)],status:o};return(o==="inProgress"||o==="halted")&&typeof s=="number"&&(y.userFraction=s),await Rt("update track",()=>$t.put(`https://androidpublisher.googleapis.com/androidpublisher/v3/applications/${u}/edits/${p}/tracks/${Zt(r)}`,{releases:[y]},{headers:c,timeout:Qt})),await Rt("commit edit",()=>$t.post(`https://androidpublisher.googleapis.com/androidpublisher/v3/applications/${u}/edits/${p}:commit`,{},{headers:c,params:a?{changesNotSentForReview:!0}:void 0,timeout:Qt})),{editId:l,versionCode:A,track:r,releaseStatus:o,userFraction:s}}catch(d){if(l)try{let u=await As(n);await Rt("delete edit",()=>$t.delete(`https://androidpublisher.googleapis.com/androidpublisher/v3/applications/${Zt(t)}/edits/${Zt(l)}`,{headers:{Authorization:`Bearer ${u}`,Connection:"close"},timeout:Qt}))}catch{}let c=d.response?.data?.error?.message||d.message;throw new Error(`Google Play API Error: ${c}`)}}async function As(e){let t=Math.floor(Date.now()/1e3),n=t+3600,i={alg:"RS256",typ:"JWT"},r={iss:e.client_email,sub:e.client_email,aud:"https://oauth2.googleapis.com/token",iat:t,exp:n,scope:"https://www.googleapis.com/auth/androidpublisher"},o=Buffer.from(JSON.stringify(i)).toString("base64url"),s=Buffer.from(JSON.stringify(r)).toString("base64url"),a=`${o}.${s}`,l=Pc.createSign("RSA-SHA256");l.update(a);let d=l.sign(e.private_key,"base64url"),c=`${a}.${d}`;return(await Rt("OAuth token exchange",()=>$t.post("https://oauth2.googleapis.com/token",{grant_type:"urn:ietf:params:oauth:grant-type:jwt-bearer",assertion:c},{headers:{Connection:"close"},timeout:Qt}))).data.access_token}var Nc=5e3,xc=12,Rs=100,lr=24,Ss=8e3,Lc={completed:"completed",draft:"draft",halted:"halted",inprogress:"inProgress","in-progress":"inProgress"},Mc=e=>e?.type==="google_service_account",Wn=e=>e?.bundleId||e?.packageName||e?.meta?.packageName||e?.meta?.bundleId,Os=e=>e.submitArgs||process.argv.slice(3).join(" ");async function Yn(e){let t=it(),n=ye(),i=Uc(e);if(!i){process.exitCode=1;return}let r=e.projectId||i.projectId,o=e.profile||e.buildProfile||"production";if(!r){ee(`${m.configFileName} is missing projectId. Pass --project-id in runner mode.`),process.exitCode=1;return}i.projectId=r,ae(V.dim(`Submit for project: ${i.name||r} | Profile: ${o}`));let s=e.platform;if(!s){let E=await pr({message:"Select platform to submit:",options:[{value:"ios",label:"iOS (App Store Connect / TestFlight)"},{value:"android",label:"Android (Google Play Console)"}]});if(tt(E)){fr("Operation cancelled");return}s=E}if(s=String(s).toLowerCase(),s!=="ios"&&s!=="android"){ee(`Platform ${s} is not supported. Use 'ios' or 'android'.`),process.exitCode=1;return}let a=s==="ios"&&!e.local&&e.sshHost?eu(i,o,e):null;if(s==="ios"&&!e.local&&!a){await Fc(i,o,e);return}let l=e.submitId,d=!!(e.local&&l),c=l||null,u=async(E,_={})=>{c&&await Gc(r,c,{status:E,..._})},f=s==="android"?e.packageName||e.androidPackage||Xc(i,o):void 0,p=s==="ios"?e.bundleId||e.iosBundleIdentifier||Qc(i,o):void 0,g,h,A,y=!1;try{s==="android"&&(g=e.track||i.submit?.[o]?.android?.track||i.submit?.production?.android?.track||"internal",h=tu(i,o,e.releaseStatus),A=iu(i,o,e.rollout),y=ru(i,o,e.changesNotSentForReview),ou(h,A))}catch(E){ee(E.message),process.exitCode=1;return}if(s==="android"&&!d&&(c=await Bc(i,r,s,o,e,{packageName:f,track:g,releaseStatus:h,rollout:A,changesNotSentForReview:y}),!c)){ee("Could not create submission tracking record. Submission was not started."),process.exitCode=1;return}await u("running",{platform:s,profile:o,packageName:f,track:g,releaseStatus:h,rollout:A,startTime:Date.now(),...d?zc():{}});let w=null,M=null;try{M=await su(r,s,e,n?.token),w=M?.filePath||null}catch(E){await u("failed",{error:`Failed to resolve submission artifact: ${E.message}`,endTime:Date.now()}),ee(`Failed to resolve submission artifact: ${E.message}`),process.exitCode=1;return}if(!w){let E=lu(s,e);await u("failed",{error:E,endTime:Date.now()}),ee(E),process.exitCode=1;return}await u("running",{buildId:M?.buildId,artifactName:M?.artifactName,artifactSource:M?.source}),ae(`Using artifact: ${V.green(ge.basename(w))} `),t.start("Fetching submission credentials from Dashboard...");let v;try{let _=(await $.get(`/credentials/${r}`)).data.credentials||[];if(s==="android"&&!f){t.stop("Package name missing"),ee("Could not resolve Android package name. Set android.package in mach.config.json/app.json."),await u("failed",{error:"Could not resolve Android package name.",endTime:Date.now()}),process.exitCode=1;return}let P=_.filter(Mc),b=s==="ios"?_.filter(G=>G.type==="asc_api_key"):Zc(P,f);if(b.length===0){if(t.stop("Credentials missing"),ee(s==="android"?`No Google Play service credential found for package ${f}.`:`No Service Credentials found for ${s}.`),s==="android"){let G=P.map(Wn).filter(Boolean).join(", ");G&&ae(`Found Google Play service credential(s) for: ${G}`),ae(`Use '${m.nameLower} credentials:service --platform android --package-name ${f}' or upload it under that package in the Dashboard.`)}else ae(`Use '${m.nameLower} credentials:service --platform ${s}' or use the Dashboard to upload them.`);await u("failed",{error:`No submission credentials found for ${s}.`,endTime:Date.now()}),process.exitCode=1;return}if(v=Wc(b,e.credentialId),!v&&s==="ios"&&p&&(v=Yc(b,p)),v||b.length===1)v=v||b[0],t.stop(`Using: ${v.name}`),s==="android"&&Wn(v)==="*"&&ae(V.yellow(`Using legacy wildcard Google Play credential for ${f}. Upload a package-scoped credential when possible.`));else{if(t.stop("Multiple credentials found"),qc()){let x=b.map(j=>`${j.name||"credential"} (${j.credentialId||j.id||"no-id"})`).join(", ");ee(`Multiple ${s==="ios"?"App Store Connect":"Google Play"} credentials found. Use --credential-id in CI. Available: ${x}`),await u("failed",{error:"Multiple submission credentials found; --credential-id is required in CI.",endTime:Date.now()}),process.exitCode=1;return}let G=await pr({message:`Choose a ${s==="ios"?"App Store Connect":"Google Play"} credential:`,options:b.map(x=>({value:x.credentialId,label:x.name,hint:`${x.keyId?`ID: ${x.keyId}`:""} ${x.issuerId?`(Issuer: ${x.issuerId.substring(0,8)}...)`:""}`}))});if(tt(G)){fr("Submission cancelled"),await u("failed",{error:"Submission cancelled while selecting credential.",endTime:Date.now()}),process.exitCode=1;return}v=b.find(x=>x.credentialId===G),ae(`Using selected: ${V.green(v.name)}`)}}catch(E){t.stop("Failed to fetch credentials"),ee(`API Error: ${E.message} `),await u("failed",{error:`Failed to fetch credentials: ${E.message}`,endTime:Date.now()}),process.exitCode=1;return}let H=Y.mkdtempSync(ge.join(yt.tmpdir(),`${m.nameLower}-submit-`)),W=v.keyId||v.meta?.keyId,Z=v.issuerId||v.meta?.issuerId,_e=v.type==="asc_api_key"?`AuthKey_${W}.p8`:"service-account.json",oe=ge.join(H,_e);t.start("Downloading secure key...");try{let E=await $.get(`/credentials/${v.credentialId}/download`,{params:{projectId:r,format:"raw"}});if(E.data.status!=="success"||!E.data.downloadUrl)throw new Error("Failed to get secure download URL");let _=await $s.get(E.data.downloadUrl,{responseType:"arraybuffer"});Y.writeFileSync(oe,Buffer.from(_.data)),t.stop("Key downloaded to secure temp storage")}catch(E){t.stop("Download failed"),ee(`Failed to download key: ${E.message}`);try{Y.rmSync(H,{recursive:!0,force:!0})}catch{}await u("failed",{error:`Failed to download credential key: ${E.message}`,endTime:Date.now()}),process.exitCode=1;return}ae(V.blue(`Initiating ${s==="ios"?"TestFlight":"Google Play"} submission...`));let R=!1,L;try{if(s==="ios"){if(!W){let _=await en({message:"Enter App Store Connect Key ID (e.g. 2X948D...):",validate:P=>P.length>0?void 0:"Key ID is required"});if(tt(_)){await u("failed",{error:"Submission cancelled while entering ASC Key ID.",endTime:Date.now()}),process.exitCode=1;return}W=_}if(!Z||Z==="undefined"){let _=await en({message:"Enter App Store Connect Issuer ID (Found on ASC Keys page):",validate:P=>P.length>0?void 0:"Issuer ID is required"});if(tt(_)){await u("failed",{error:"Submission cancelled while entering ASC Issuer ID.",endTime:Date.now()}),process.exitCode=1;return}Z=_}ae(`Using ASC Key ID: ${W}`),ae(`Using ASC Issuer ID: ${Z}`);let E=a?await cu(w,oe,Z,W,p,a):await du(w,oe,Z,W,p);gr(`${s==="ios"?"App Store":"Google Play"} submission successful!`),R=!0}else L=await gu(w,oe,g||"internal",f,h||"completed",A,y,o),gr("Google Play submission successful!"),R=!0}catch(E){ee(`Submission failed: ${E.message}`),await u("failed",{error:E.message,endTime:Date.now()}),nt(e,{status:"failed",projectId:r,submitId:c,platform:s,profile:o,buildId:M?.buildId||e.buildId,artifactName:M?.artifactName,error:E.message,dashboardUrl:c?At(c,r):void 0}),process.exitCode=1}finally{R&&(await u("success",{endTime:Date.now(),versionCode:L?.versionCode,track:g,releaseStatus:h}),nt(e,{status:"success",projectId:r,submitId:c,platform:s,profile:o,buildId:M?.buildId||e.buildId,artifactName:M?.artifactName,versionCode:L?.versionCode,track:g,releaseStatus:h,dashboardUrl:c?At(c,r):void 0})),Du(H),w&&w.includes(`${m.nameLower}-artifact-`)}}function Uc(e){let t=`./${m.configFileName}`;if(Y.existsSync(t))try{return JSON.parse(Y.readFileSync(t,"utf-8"))}catch(n){return ee(`Failed to read ${m.configFileName}: ${n.message}`),null}return e.projectId?{projectId:e.projectId}:(ee(`No ${m.configFileName} found. Run \`${m.nameLower} init\` or \`${m.nameLower} link\` first.`),null)}async function Fc(e,t,n){let i=n.projectId||e.projectId;if(!i){ee(`${m.configFileName} is missing projectId.`),process.exitCode=1;return}let r=n.submitId||hr.randomUUID(),o=!!n.latest||!n.buildId,s=Hc({...n,latest:o,profile:t,projectId:i,submitId:r}),a={projectId:i,submitId:r,platform:"ios",profile:t,latest:o,buildId:n.buildId,credentialId:n.credentialId,status:"pending",source:"cli",submitArgs:Os(n),runnerArgs:s,runnerCommand:[m.nameLower,"submit",...s].map(Jc).join(" "),appName:e.name,startTime:Date.now()},l=it();l.start("Queuing iOS submit on macOS runner...");try{let d=await $.post("/submissions",a),c=d.data?.submission||d.data?.submit||{},u=d.data?.dashboardUrl||At(r,i);l.stop("iOS submit queued"),ae(`Submission ID: ${V.cyan(r)}`),ae(`Dashboard: ${V.blue.underline(u)}`),nt(n,{status:"pending",projectId:i,submitId:r,platform:"ios",profile:t,latest:o,buildId:n.buildId,dashboardUrl:u}),await jc(i,r,n)}catch(d){l.stop("Could not queue iOS submit"),ee(Kc(d)),process.exitCode=1}}async function Bc(e,t,n,i,r,o={}){let s=r.submitId||hr.randomUUID(),a=!!r.latest||!r.buildId,l={projectId:t,submitId:s,platform:n,profile:i,latest:a,buildId:r.buildId,credentialId:r.credentialId,status:"running",source:"cli-direct",submitArgs:Os(r),appName:e.name,startTime:Date.now(),...o};try{let d=await $.post("/submissions",l),c=d.data?.submission||d.data?.submit||{},u=d.data?.dashboardUrl||c.dashboardUrl||At(s,t);return ae(`Submission ID: ${V.cyan(s)}`),ae(`Dashboard: ${V.blue.underline(u)}`),nt(r,{status:"running",projectId:t,submitId:s,platform:n,profile:i,latest:a,buildId:r.buildId,dashboardUrl:u}),s}catch(d){let c=d.response?.data?.message||d.response?.data?.error||d.message;return ae(V.yellow(`Could not create submission tracking record: ${c}`)),null}}function Hc(e){let t=["--local","--submit-id",e.submitId,"--project-id",e.projectId,"--platform","ios","--profile",e.profile||"production"];return e.buildId?t.push("--build-id",e.buildId):t.push("--latest"),e.credentialId&&t.push("--credential-id",e.credentialId),e.bundleId&&t.push("--bundle-id",e.bundleId),e.packageName&&t.push("--package-name",e.packageName),e.quiet&&t.push("--quiet"),e.jsonOutput&&t.push("--json-output",e.jsonOutput),t.filter(n=>n!=null&&n!=="")}async function jc(e,t,n){let i=it(),r=0,o=0;for(n.quiet||i.start("Waiting for iOS submit runner...");;)try{let s=await $.get(`/submissions/${e}/${t}`),a=s.data?.submission||s.data?.submit||s.data,l=String(a?.status||"pending").toLowerCase();r=0;let d=Array.isArray(a?.logs)?a.logs:[];for(let c=o;c<d.length;c++){let u=d[c];u&&console.log(V.dim(String(u)))}if(o=d.length,["success","completed","succeeded"].includes(l)){n.quiet||i.stop("iOS submit completed"),gr("App Store submission successful!"),nt(n,{status:"success",projectId:e,submitId:t,platform:"ios",profile:a?.profile||n.profile||"production",buildId:a?.buildId||n.buildId,artifactName:a?.artifactName,dashboardUrl:a?.dashboardUrl||At(t,e)});return}if(["failed","error","cancelled","canceled"].includes(l)){n.quiet||i.stop("iOS submit failed");let c=a?.error||a?.message||"Unknown iOS submit failure.";ee(c),nt(n,{status:"failed",projectId:e,submitId:t,platform:"ios",profile:a?.profile||n.profile||"production",buildId:a?.buildId||n.buildId,artifactName:a?.artifactName,error:c,dashboardUrl:a?.dashboardUrl||At(t,e)}),process.exitCode=1;return}n.quiet||i.message(`iOS submit ${l}...`),await mr(Nc)}catch(s){if(r++,r>=xc){n.quiet||i.stop("Lost connection to iOS submit status"),ee(`Could not fetch iOS submit status after ${r} attempts: ${s.message}`),process.exitCode=1;return}await mr(Math.min(2e3*r,15e3))}}async function Gc(e,t,n){let i;for(let r=1;r<=3;r++)try{await $.patch(`/submissions/${e}/${t}`,n);return}catch(o){if(i=o,r>=3||!Vc(o))break;await mr(1e3*r)}vs.warn(V.dim(`Could not report submission status: ${i?.message||i}`))}function Vc(e){let t=e.response?.status;return!t||t===408||t===409||t===425||t===429||t>=500}function zc(){let e={gitlabJobId:process.env.CI_JOB_ID,gitlabJobUrl:process.env.CI_JOB_URL,gitlabPipelineId:process.env.CI_PIPELINE_ID,gitlabProjectId:process.env.CI_PROJECT_ID,gitlabProjectPath:process.env.CI_PROJECT_PATH};return Object.fromEntries(Object.entries(e).filter(([,t])=>!!t))}function Kc(e){let t=e.response?.status,n=e.response?.data?.message||e.response?.data?.error;return t===404||t===405?["Managed iOS submit is not enabled on this Mach API yet.","Deploy the API/dashboard submission orchestration endpoint, then retry the same command.","Expected API: POST /submissions and GET/PATCH /submissions/:projectId/:submitId."].join(`
-`):n||e.message||String(e)}function At(e,t){if(!e)return je;let n=t?`?projectId=${encodeURIComponent(t)}`:"";return`${je}/submissions/${e}${n}`}function nt(e,t){if(!e.jsonOutput)return;let n=ge.resolve(e.jsonOutput),i={...t,url:t.url||t.dashboardUrl||At(t.submitId,t.projectId),updatedAt:new Date().toISOString()};try{let r=ge.dirname(n);r&&r!=="."&&Y.mkdirSync(r,{recursive:!0}),Y.writeFileSync(n,JSON.stringify(i,null,2))}catch(r){vs.warn(V.yellow(`Could not write submission metadata JSON: ${r.message}`))}}function Wc(e,t){return t&&e.find(n=>n.credentialId===t||n.id===t||n.keyId===t||n.meta?.keyId===t)||null}function Yc(e,t){let n=e.filter(i=>[i.bundleId,i.bundleIdentifier,i.appIdentifier,i.meta?.bundleId,i.meta?.bundleIdentifier,i.meta?.appIdentifier].filter(Boolean).map(String).includes(t));return n.length===1?n[0]:null}function qc(){return process.env.CI==="true"||process.env.CI==="1"||!process.stdin.isTTY}function mr(e){return new Promise(t=>setTimeout(t,e))}function Jc(e){return/^[a-zA-Z0-9_./:=@-]+$/.test(e)?e:`'${e.replace(/'/g,"'\\''")}'`}function Xc(e,t){if(e.submit?.[t]?.android?.package)return e.submit[t].android.package;let n=Fn(e,t);if(n)return n;let i=ge.join(process.cwd(),"app.json");if(Y.existsSync(i))try{return JSON.parse(Y.readFileSync(i,"utf-8")).expo?.android?.package}catch{}let r=ge.join(process.cwd(),"app.config.json");if(Y.existsSync(r))try{let o=JSON.parse(Y.readFileSync(r,"utf-8"));return o.expo?.android?.package||o.android?.package}catch{}}function Zc(e,t){let n=e.filter(o=>Wn(o)===t);if(n.length>0)return n;let i=e.filter(o=>{let s=Wn(o);return!s||s==="*"});return e.length>0&&e.length===i.length?i:[]}function Qc(e,t){return e.submit?.[t]?.ios?.bundleIdentifier?e.submit[t].ios.bundleIdentifier:e.submit?.[t]?.ios?.bundleId?e.submit[t].ios.bundleId:Bn(e,t)}function eu(e,t,n){let i=e.submit?.[t]?.ios||{},r=e.submit?.production?.ios||{},o=n.sshHost||i.sshHost||r.sshHost||process.env.MACH_IOS_SUBMIT_SSH_HOST;return o?{sshHost:o,sshUser:n.sshUser||i.sshUser||r.sshUser||process.env.MACH_IOS_SUBMIT_SSH_USER||process.env.USER||"ubuntu",sshKey:n.sshKey||i.sshKey||r.sshKey||process.env.MACH_IOS_SUBMIT_SSH_KEY}:null}function tu(e,t,n){let i=n||e.submit?.[t]?.android?.releaseStatus||e.submit?.production?.android?.releaseStatus||"completed";return nu(i)}function nu(e){let t=Lc[String(e).trim().toLowerCase()];if(!t)throw new Error(`Invalid Android release status "${e}". Use completed, draft, halted, or inProgress.`);return t}function iu(e,t,n){let i=n??e.submit?.[t]?.android?.rollout??e.submit?.[t]?.android?.userFraction??e.submit?.[t]?.android?.rolloutFraction??e.submit?.production?.android?.rollout??e.submit?.production?.android?.userFraction??e.submit?.production?.android?.rolloutFraction;if(i==null||i==="")return;let r=Number(i);if(!Number.isFinite(r)||r<=0||r>=1)throw new Error(`Invalid Android rollout fraction "${i}". Use a number greater than 0 and less than 1, for example 0.1.`);return r}function ru(e,t,n){let i=n??e.submit?.[t]?.android?.changesNotSentForReview??e.submit?.[t]?.android?.changes_not_sent_for_review??e.submit?.production?.android?.changesNotSentForReview??e.submit?.production?.android?.changes_not_sent_for_review??!1;return i===!0||i==="true"||i==="1"}function ou(e,t){if(e==="inProgress"&&t===void 0)throw new Error("Google Play staged rollout requires --rollout <fraction> when --release-status inProgress is used.");if(e!=="inProgress"&&e!=="halted"&&t!==void 0)throw new Error("Android rollout fraction can only be used with --release-status inProgress or halted.")}async function su(e,t,n,i){let r=n.buildId?"id":n.latest?"latest":null;if(!r){let s=await pr({message:"Select artifact source:",options:[{value:"latest",label:`Latest Production Build (${m.name})`},{value:"id",label:`Input Build ID (${m.name})`},{value:"url",label:"Remote URL"},{value:"local",label:"Local File Path"}]});if(tt(s))return fr("Operation cancelled"),null;r=s}if(r==="local"){let s=await en({message:"Enter path to artifact (.ipa/.aab):",validate:a=>{if(!Y.existsSync(a))return"File not found";if(t==="ios"&&!a.endsWith(".ipa"))return"Must be an .ipa file";if(t==="android"&&!a.endsWith(".aab"))return"Must be an .aab file"}});return tt(s)?null:{filePath:s,source:"local"}}let o=it();if(r==="latest"){let s=n.profile||n.buildProfile;o.start(`Fetching latest${s?` ${s}`:""} build...`);try{let a=await $.get(`/builds/${e}`,{params:{limit:50}});if(a.data.status!=="success")throw new Error(a.data.message);let l=a.data.builds||[],d=s?.toLowerCase(),c=v=>v.platform?.toLowerCase()===t.toLowerCase()&&v.status?.toLowerCase()==="success",u=v=>d?[v.buildProfile,v.profile,v.profileName,v.buildType].filter(Boolean).some(H=>String(H).toLowerCase()===d):!0,f=l.filter(v=>c(v)&&u(v)),p=f.find(v=>v.buildType?.toLowerCase()==="store"||v.distribution?.toLowerCase()==="store")||f[0],g=l.some(v=>v.platform?.toLowerCase()===t.toLowerCase()&&v.status?.toLowerCase()==="success");if(!p)return o.stop("No suitable build found"),ee(s&&g?`No successful ${t} builds found for profile "${s}".`:"No successful builds found for this platform."),null;o.stop(`Found build: ${p.buildId}`);let h=p.artifacts||[];if(h.length===0||h.every(v=>!(v.url||v.downloadUrl)))try{let v=await $.get(`/builds/${e}/${p.buildId}/artifacts`);v.data.status==="success"&&v.data.artifacts?.length>0?(h=v.data.artifacts.map(H=>({...H,url:H.url||H.downloadUrl})),console.log(V.cyan(`  [RECOVERY] Fetched ${h.length} artifact(s) with download URLs.`))):console.log(V.yellow("  [RECOVERY] /artifacts endpoint returned 0 artifacts."))}catch(v){console.log(V.red(`  [RECOVERY] /artifacts fetch failed: ${v.message}`))}let y=t==="ios",w=h.find(v=>{let H=(v.type||"").toLowerCase(),W=(v.name||"").toLowerCase();if(console.log(V.dim(`    - Checking: ${v.name} (Type: ${v.type}, HasLink: ${!!(v.url||v.downloadUrl)})`)),H)return H===(y?"ipa":"aab");let Z=y?".ipa":".aab",_e=(v.url||v.downloadUrl||"").toLowerCase();return W.endsWith(Z)||_e.includes(Z)});if(!w||!(w.url||w.downloadUrl))return ee("Build found but artifact URL is missing."),null;let M=w.url||w.downloadUrl;return{filePath:await dr(M,y?"ios":"android"),buildId:p.buildId,artifactName:w.name,source:"latest"}}catch(a){return o.stop("Fetch failed"),ee(`API Error: ${a.message}`),null}}if(r==="id"){let s=n.buildId||await en({message:"Enter Build ID:",validate:l=>l.length<5?"Invalid ID":void 0});if(tt(s))return null;let a=String(s);o.start("Fetching build...");try{let l=null;try{let p=await $.get(`/builds/${e}/${a}`);p.data.status==="success"&&(l=p.data.build)}catch(p){p.response?.status!==404&&console.log(V.dim(`  [RECOVERY] Project build lookup skipped: ${p.message}`))}if(!l){let p=await $.get(`/build/${a}`);if(p.data.status!=="success")throw new Error(p.data.message);l=p.data.build}if(!l)throw new Error(`Build ${a} was not found.`);let d=t==="ios",c=Kn(l.artifacts);au(c)||(c=await Es(e,a,c));let u=bs(c,t);if(u||(c=await Es(e,a,c),u=bs(c,t)),!u)throw new Error(`No ${d?".ipa":".aab"} artifact found for build ${a}. The build exists, but its artifact list does not contain a downloadable submission artifact.`);let f=u.url||u.downloadUrl;if(!f)throw new Error(`Artifact ${u.name||"(unnamed)"} for build ${a} has no download URL. Retry after the build artifact upload is visible in the Installation Hub.`);return o.stop(`Found build: ${l.buildId||a}`),{filePath:await dr(f,d?"ios":"android"),buildId:l.buildId||a,artifactName:u.name,source:"id"}}catch(l){throw o.stop("Fetch failed"),l}}if(r==="url"){let s=await en({message:"Enter Artifact URL:",validate:a=>a.startsWith("http")?void 0:"Must be a valid URL"});return tt(s)?null:{filePath:await dr(s,t),source:"url"}}return null}function Kn(e){return(e||[]).map(t=>({...t,url:t.url||t.downloadUrl}))}function au(e){return e.some(t=>!!(t.url||t.downloadUrl))}function bs(e,t){let n=t==="ios",i=n?"ipa":"aab",r=n?".ipa":".aab";return e.find(o=>{let s=String(o.type||"").toLowerCase(),a=String(o.name||"").toLowerCase(),l=String(o.url||o.downloadUrl||"").toLowerCase();return s?s===i:a.endsWith(r)||l.includes(r)})||null}function lu(e,t){let n=e==="ios"?".ipa":".aab";if(t.buildId)return`No downloadable ${n} artifact found for build ${t.buildId}. Check that the build finished artifact upload before submitting.`;if(t.latest){let i=t.profile||t.buildProfile;return`No latest successful ${e}${i?` ${i}`:""} build has a downloadable ${n} artifact.`}return`No downloadable ${n} artifact was selected for submission.`}async function Es(e,t,n){try{let i=await $.get(`/builds/${e}/${t}/artifacts`);if(i.data.status==="success"&&i.data.artifacts?.length>0){let r=Kn(i.data.artifacts);return console.log(V.cyan(`  [RECOVERY] Fetched ${r.length} artifact(s) with download URLs.`)),r}}catch(i){console.log(V.dim(`  [RECOVERY] Project artifact lookup skipped: ${i.message}`))}try{let i=await $.get(`/public/builds/${t}`);if(i.data.status==="success"&&i.data.artifacts?.length>0){let r=Kn(i.data.artifacts);return console.log(V.cyan(`  [RECOVERY] Fetched ${r.length} public artifact(s) with download URLs.`)),r}}catch(i){console.log(V.dim(`  [RECOVERY] Public artifact lookup skipped: ${i.message}`))}return Kn(n)}async function dr(e,t,n=3){let i=it();i.start("Downloading artifact...");let r=Y.mkdtempSync(ge.join(yt.tmpdir(),`${m.nameLower}-artifact-`)),o=`app.${t==="ios"?"ipa":"aab"}`,s=ge.join(r,o);for(let a=1;a<=n;a++)try{a>1&&(i.message(`Downloading artifact (Retry ${a}/${n})...`),await new Promise(c=>setTimeout(c,2e3*a)));let l=Y.createWriteStream(s),d=await $s({url:e,method:"GET",responseType:"stream",timeout:6e4});return await new Promise((c,u)=>{d.data.pipe(l);let f=!1;d.data.on("error",p=>{f||(f=!0,l.close(),u(p))}),l.on("finish",()=>{f||c()}),l.on("error",p=>{f||(f=!0,u(p))})}),i.stop("Download complete"),s}catch(l){if(a===n)throw i.stop("Download failed"),l}throw new Error("Download failed after retries")}async function du(e,t,n,i,r){let o=it();if(r&&ae(`Bundle ID: ${V.green(r)}`),!n||!i)throw ee(`Missing credentials: issuerId=${n}, keyId=${i}. Check your Dashboard.`),new Error("Missing ASC API Key Metadata (IssuerID or KeyID)");let s=Ps(t,n,i),a=Au();return o.start("Uploading to TestFlight (pilot)..."),new Promise((l,d)=>{let c=Su(),u=kc(a.command,["pilot","upload","--ipa",e,"--api_key_path",s,"--skip_submission","true","--skip_waiting_for_build_processing","true"],{stdio:["ignore","pipe","pipe"],env:a.env});u.stdout?.on("data",f=>c.append(f,process.stdout)),u.stderr?.on("data",f=>c.append(f,process.stderr)),u.on("close",f=>{if(c.flush(),f!==0){o.stop("Pilot failed");try{Y.unlinkSync(s)}catch{}d(bu(f,c.lines()))}else{o.stop("IPA uploaded to TestFlight");try{Y.unlinkSync(s)}catch{}l({})}}),u.on("error",f=>{c.flush();try{Y.unlinkSync(s)}catch{}o.stop("Pilot execution error");let p=Ou(f);p.logs=c.lines(),d(p)})})}async function cu(e,t,n,i,r,o){let s=it();if(r&&ae(`Bundle ID: ${V.green(r)}`),!n||!i)throw ee(`Missing credentials: issuerId=${n}, keyId=${i}. Check your Dashboard.`),new Error("Missing ASC API Key Metadata (IssuerID or KeyID)");let a=Ps(t,n,i),l=`${o.sshUser}@${o.sshHost}`,d=uu(o),c=pu(o),u="",f="";try{if(s.start(`Preparing remote iOS submit runner (${l})...`),u=fu("ssh",[...d,"mktemp -d /tmp/mach-submit.XXXXXX"]).trim(),!u)throw new Error("Remote runner did not return a temp directory.");s.stop(`Remote runner ready: ${l}`),s.start("Uploading IPA and App Store Connect key to remote runner..."),cr("scp",[...c,e,`${l}:${u}/app.ipa`],"IPA upload to remote runner"),cr("scp",[...c,a,`${l}:${u}/api_key.json`],"ASC key upload to remote runner"),f=ge.join(yt.tmpdir(),`${m.nameLower}-ios-submit-${Date.now()}.sh`),Y.writeFileSync(f,mu(u)),cr("scp",[...c,f,`${l}:${u}/submit.sh`],"submit script upload to remote runner"),s.stop("Remote submit inputs uploaded"),s.start("Uploading to TestFlight on remote runner...");let p=`chmod +x ${tn(`${u}/submit.sh`)} && bash ${tn(`${u}/submit.sh`)}`,g=ht("ssh",[...d,p],{stdio:"inherit"});if(g.error)throw Ar("ssh",g.error);if(g.status!==0)throw new Error(`Remote iOS submit failed with exit code ${g.status}.`);return s.stop("IPA uploaded to TestFlight"),{apiKeyJsonPath:null}}catch(p){throw s.stop("Remote iOS submit failed"),p}finally{try{Y.unlinkSync(a)}catch{}if(f)try{Y.unlinkSync(f)}catch{}if(u)try{ht("ssh",[...d,`rm -rf ${tn(u)}`],{stdio:"ignore"})}catch{}}}function Ps(e,t,n){let i=Y.readFileSync(e,"utf8"),r;try{r=hr.createPrivateKey(i).export({type:"pkcs8",format:"pem"})}catch{ae("Key normalization failed, falling back to manual re-wrapping..."),r=`-----BEGIN PRIVATE KEY-----
+`).map(r=>r.trim().split(/\s+/)).filter(r=>r.length>=2&&r[1]==="device").map(r=>r[0]).filter(Boolean);return e&&i.includes(e)?(P.appendFileSync(t,`Using Android device ${e} for install and cleanup.
+`),e):i.length===1?(P.appendFileSync(t,`Using Android device ${i[0]} for install and cleanup.
+`),i[0]):(i.length>1&&P.appendFileSync(t,`[WARN] Multiple Android devices are connected; using adb default target for install and cleanup.
+`),null)}function cc(e,t){let i=(Ki("aapt",["dump","badging",e])||Ki("aapt2",["dump","badging",e]))?.match(/package:\s+name='([^']+)'/);if(i?.[1])return i[1];let o=Ki("apkanalyzer",["manifest","application-id",e])?.split(/\s+/).find(Boolean);return o||(P.appendFileSync(t,`[WARN] Could not determine Android application id from APK; post-run uninstall will be skipped.
+`),null)}function Ki(e,t){for(let n of uc(e)){let i=Ge(n,t,{encoding:"utf-8",env:process.env,maxBuffer:10485760});if(i.status===0&&i.stdout)return String(i.stdout).trim()}return null}function uc(e){let t=process.platform==="win32"&&!e.endsWith(".exe")?`${e}.exe`:e,n=[];if(e==="aapt"||e==="aapt2")for(let r of Jo()){let o=k.join(r,"build-tools");for(let s of Xo(o))n.push(k.join(o,s,t))}if(e==="apkanalyzer")for(let r of Jo()){n.push(k.join(r,"cmdline-tools","latest","bin",t));let o=k.join(r,"cmdline-tools");for(let s of Xo(o))n.push(k.join(o,s,"bin",t));n.push(k.join(r,"tools","bin",t))}let i=pc(e);return i&&n.unshift(i),n.push(t),[...new Set(n)]}function Jo(){let e=[process.env.ANDROID_HOME,process.env.ANDROID_SDK_ROOT];return process.platform==="darwin"?e.push(k.join(vt.homedir(),"Library","Android","sdk")):process.platform==="linux"&&e.push(k.join(vt.homedir(),"Android","Sdk"),k.join(vt.homedir(),"Android","sdk"),"/opt/android-sdk","/usr/lib/android-sdk"),[...new Set(e.filter(t=>!!t))]}function Xo(e){try{return P.readdirSync(e,{withFileTypes:!0}).filter(t=>t.isDirectory()).map(t=>t.name).sort((t,n)=>n.localeCompare(t,void 0,{numeric:!0}))}catch{return[]}}function pc(e){let t=process.platform==="win32"?"where":"/usr/bin/env",n=process.platform==="win32"?[e]:["which",e],i=Ge(t,n,{encoding:"utf-8",env:process.env});return i.status!==0||!i.stdout?null:String(i.stdout).split(`
+`)[0]?.trim()||null}async function Wi(e,t,n){if(!P.existsSync(e))return;let i=P.readFileSync(e),r;for(let o=1;o<=3;o+=1)try{await Qt.put(t,i,{headers:{"Content-Type":n,"Content-Length":String(i.length)},maxBodyLength:1/0,maxContentLength:1/0,timeout:12e4});return}catch(s){if(r=s,!rs(s)||o>=3)break;await Qi(2e3*o)}throw r}async function Zo(e,t,n,i){let r=k.join(n,"report.xml"),o=k.join(t,"artifacts.tar.gz");try{await Wi(r,e.junitUploadUrl,"application/xml")}catch(s){P.appendFileSync(i,`[WARN] Failed to upload JUnit report: ${s.message||s}
+`)}try{await Wi(i,e.logUploadUrl,"text/plain")}catch(s){P.appendFileSync(i,`[WARN] Failed to upload runner log: ${s.message||s}
+`)}try{We("tar",["-czf",o,"-C",t,k.basename(n)],i),await Wi(o,e.artifactsUploadUrl,"application/gzip")}catch(s){P.appendFileSync(i,`[WARN] Failed to upload Maestro artifacts: ${s.message||s}
+`)}}function fc(e){if(!e.endsWith(".apk"))return D.error(T.red("Local Android Maestro runs need an APK artifact.")),!1;D.info(T.dim("Installing APK on local Android device/emulator..."));let t=Ge("adb",["install","-r",e],{stdio:"inherit",env:process.env});return t.error?(D.error(T.red(`adb failed to start: ${t.error.message}`)),!1):t.status!==0?(D.error(T.red(`adb install failed with exit code ${t.status??1}`)),!1):!0}function mc(e,t){if(e.endsWith(".ipa"))return D.error(T.red("Local iOS Maestro runs need an iOS Simulator .app.zip artifact, not an App Store .ipa.")),!1;let n=e;if(e.endsWith(".zip")){let r=k.join(t,"ios-app");P.mkdirSync(r,{recursive:!0}),new zn(e).extractAllTo(r,!0);let o=er(r);if(!o)return D.error(T.red("Could not find a .app bundle inside the downloaded zip.")),!1;n=o}if(!n.endsWith(".app"))return D.error(T.red("Local iOS Maestro runs need an iOS Simulator .app bundle or .app.zip artifact.")),!1;D.info(T.dim("Installing app on booted iOS Simulator..."));let i=Ge("xcrun",["simctl","install","booted",n],{stdio:"inherit",env:process.env});return i.error?(D.error(T.red(`xcrun failed to start: ${i.error.message}`)),!1):i.status!==0?(D.error(T.red(`iOS Simulator install failed with exit code ${i.status??1}`)),!1):!0}function er(e){let t=P.readdirSync(e,{withFileTypes:!0});for(let n of t){let i=k.join(e,n.name);if(n.isDirectory()&&n.name.endsWith(".app"))return i;if(n.isDirectory()){let r=er(i);if(r)return r}}return null}function gc(e,t){let n=String(t||"").toLowerCase();return n==="android"?e.find(i=>wt(i,".apk")):n==="ios"?e.find(i=>wt(i,".app.zip"))||e.find(i=>wt(i,".zip")):e.find(i=>wt(i,".apk"))||e.find(i=>wt(i,".app.zip"))||e.find(i=>wt(i,".zip"))}function wt(e,t){return String(e?.name||e?.downloadUrl||e?.url||"").toLowerCase().endsWith(t)}function tr(e){let t=String(e||"").toLowerCase();if(t.includes(".apk"))return"android";if(t.includes(".app.zip")||t.endsWith(".app")||t.includes(".ipa"))return"ios"}function cs(e){if(e)try{return k.basename(new URL(e).pathname)||void 0}catch{return k.basename(e)||void 0}}function hc(e){return e?e.match(/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/i)?.[0]:void 0}function us(e,t){if(!e.jsonOutput)return;let n=k.resolve(e.jsonOutput),i={...t,updatedAt:new Date().toISOString()};try{let r=k.dirname(n);r&&r!=="."&&P.mkdirSync(r,{recursive:!0}),P.writeFileSync(n,JSON.stringify(i,null,2))}catch(r){D.warn(T.yellow(`Could not write Maestro metadata JSON: ${r.message}`))}}function Ac(e,t){if(!e.jsonOutput)return;let n=k.resolve(e.jsonOutput),i={mode:"local",...t,updatedAt:new Date().toISOString()};try{let r=k.dirname(n);r&&r!=="."&&P.mkdirSync(r,{recursive:!0}),P.writeFileSync(n,JSON.stringify(i,null,2))}catch(r){D.warn(T.yellow(`Could not write Maestro metadata JSON: ${r.message}`))}}import{spinner as it,text as rn,select as ar,isCancel as tt,cancel as lr,log as Is}from"@clack/prompts";import G from"chalk";import W from"fs";import pe from"path";import{spawn as Ec,spawnSync as At}from"child_process";import Es from"axios";import St from"os";import ur from"crypto";import yc from"crypto";import Rt from"axios";import ps from"fs";var nn=6e4,Sc=12e4,nr=4,tn=e=>encodeURIComponent(e),bc=e=>new Promise(t=>setTimeout(t,e));async function Ot(e,t){let n;for(let i=1;i<=nr;i++)try{return await t()}catch(r){if(n=r,i>=nr||!Ic(r))throw r;let o=Number(r.response?.headers?.["retry-after"]),s=Number.isFinite(o)&&o>0?o*1e3:Math.min(2e3*i*i,15e3);console.log(`[Google Play] ${e} failed (attempt ${i}/${nr}); retrying in ${Math.round(s/1e3)}s...`),await bc(s)}throw n}function Ic(e){let t=e.response?.status;return t?t===408||t===409||t===425||t===429||t>=500:!0}async function ms(e){let{packageName:t,serviceAccount:n,aabPath:i,track:r,releaseStatus:o,userFraction:s,changesNotSentForReview:a}=e,l;try{let c={Authorization:`Bearer ${await fs(n)}`,Connection:"close"},u=tn(t);if(l=(await Ot("create edit",()=>Rt.post(`https://androidpublisher.googleapis.com/androidpublisher/v3/applications/${u}/edits`,{},{headers:c,timeout:nn}))).data.id,!l)throw new Error("Google Play edit insert succeeded but did not return an edit id.");let p=tn(l),h=ps.statSync(i),g=await Ot("upload AAB",()=>Rt.post(`https://androidpublisher.googleapis.com/upload/androidpublisher/v3/applications/${u}/edits/${p}/bundles`,ps.createReadStream(i),{headers:{...c,"Content-Type":"application/octet-stream","Content-Length":h.size},maxBodyLength:1/0,maxContentLength:1/0,params:{uploadType:"media"},timeout:Sc})),y=Number(g.data.versionCode);if(!y)throw new Error("Google Play upload succeeded but did not return a versionCode.");let S={versionCodes:[String(y)],status:o};return(o==="inProgress"||o==="halted")&&typeof s=="number"&&(S.userFraction=s),await Ot("update track",()=>Rt.put(`https://androidpublisher.googleapis.com/androidpublisher/v3/applications/${u}/edits/${p}/tracks/${tn(r)}`,{releases:[S]},{headers:c,timeout:nn})),await Ot("commit edit",()=>Rt.post(`https://androidpublisher.googleapis.com/androidpublisher/v3/applications/${u}/edits/${p}:commit`,{},{headers:c,params:a?{changesNotSentForReview:!0}:void 0,timeout:nn})),{editId:l,versionCode:y,track:r,releaseStatus:o,userFraction:s}}catch(d){if(l)try{let u=await fs(n);await Ot("delete edit",()=>Rt.delete(`https://androidpublisher.googleapis.com/androidpublisher/v3/applications/${tn(t)}/edits/${tn(l)}`,{headers:{Authorization:`Bearer ${u}`,Connection:"close"},timeout:nn}))}catch{}let c=d.response?.data?.error?.message||d.message;throw new Error(`Google Play API Error: ${c}`)}}async function fs(e){let t=Math.floor(Date.now()/1e3),n=t+3600,i={alg:"RS256",typ:"JWT"},r={iss:e.client_email,sub:e.client_email,aud:"https://oauth2.googleapis.com/token",iat:t,exp:n,scope:"https://www.googleapis.com/auth/androidpublisher"},o=Buffer.from(JSON.stringify(i)).toString("base64url"),s=Buffer.from(JSON.stringify(r)).toString("base64url"),a=`${o}.${s}`,l=yc.createSign("RSA-SHA256");l.update(a);let d=l.sign(e.private_key,"base64url"),c=`${a}.${d}`;return(await Ot("OAuth token exchange",()=>Rt.post("https://oauth2.googleapis.com/token",{grant_type:"urn:ietf:params:oauth:grant-type:jwt-bearer",assertion:c},{headers:{Connection:"close"},timeout:nn}))).data.access_token}var _c=5e3,$c=12,_s=100,ir=24,gs=8e3,wc={completed:"completed",draft:"draft",halted:"halted",inprogress:"inProgress","in-progress":"inProgress"},vc=e=>e?.type==="google_service_account",Wn=e=>e?.bundleId||e?.packageName||e?.meta?.packageName||e?.meta?.bundleId,$s=e=>e.submitArgs||process.argv.slice(3).join(" ");async function Yn(e){let t=it(),n=ye(),i=Rc(e);if(!i){process.exitCode=1;return}let r=e.projectId||i.projectId,o=e.profile||e.buildProfile||"production";if(!r){Q(`${m.configFileName} is missing projectId. Pass --project-id in runner mode.`),process.exitCode=1;return}i.projectId=r,oe(G.dim(`Submit for project: ${i.name||r} | Profile: ${o}`));let s=e.platform;if(!s){let A=await ar({message:"Select platform to submit:",options:[{value:"ios",label:"iOS (App Store Connect / TestFlight)"},{value:"android",label:"Android (Google Play Console)"}]});if(tt(A)){lr("Operation cancelled");return}s=A}if(s=String(s).toLowerCase(),s!=="ios"&&s!=="android"){Q(`Platform ${s} is not supported. Use 'ios' or 'android'.`),process.exitCode=1;return}let a=s==="ios"&&!e.local&&e.sshHost?Gc(i,o,e):null;if(s==="ios"&&!e.local&&!a){await Oc(i,o,e);return}let l=e.submitId,d=!!(e.local&&l),c=l||null,u=async(A,O={})=>{c&&await Tc(r,c,{status:A,...O})},f=s==="android"?e.packageName||e.androidPackage||Bc(i,o):void 0,p=s==="ios"?e.bundleId||e.iosBundleIdentifier||jc(i,o):void 0,h,g,y,S=!1;try{s==="android"&&(h=e.track||i.submit?.[o]?.android?.track||i.submit?.production?.android?.track||"internal",g=Vc(i,o,e.releaseStatus),y=Kc(i,o,e.rollout),S=Wc(i,o,e.changesNotSentForReview),Yc(g,y))}catch(A){Q(A.message),process.exitCode=1;return}if(s==="android"&&!d&&(c=await Pc(i,r,s,o,e,{packageName:f,track:h,releaseStatus:g,rollout:y,changesNotSentForReview:S}),!c)){Q("Could not create submission tracking record. Submission was not started."),process.exitCode=1;return}await u("running",{platform:s,profile:o,packageName:f,track:h,releaseStatus:g,rollout:y,startTime:Date.now(),...d?kc():{}});let b=null,C=null;try{C=await qc(r,s,e,n?.token),b=C?.filePath||null}catch(A){await u("failed",{error:`Failed to resolve submission artifact: ${A.message}`,endTime:Date.now()}),Q(`Failed to resolve submission artifact: ${A.message}`),process.exitCode=1;return}if(!b){let A=Xc(s,e);await u("failed",{error:A,endTime:Date.now()}),Q(A),process.exitCode=1;return}await u("running",{buildId:C?.buildId,artifactName:C?.artifactName,artifactSource:C?.source}),oe(`Using artifact: ${G.green(pe.basename(b))} `),t.start("Fetching submission credentials from Dashboard...");let I;try{let O=(await $.get(`/credentials/${r}`)).data.credentials||[];if(s==="android"&&!f){t.stop("Package name missing"),Q("Could not resolve Android package name. Set android.package in mach.config.json/app.json."),await u("failed",{error:"Could not resolve Android package name.",endTime:Date.now()}),process.exitCode=1;return}let w=O.filter(vc),v=s==="ios"?O.filter(x=>x.type==="asc_api_key"):Hc(w,f);if(v.length===0){if(t.stop("Credentials missing"),Q(s==="android"?`No Google Play service credential found for package ${f}.`:`No Service Credentials found for ${s}.`),s==="android"){let x=w.map(Wn).filter(Boolean).join(", ");x&&oe(`Found Google Play service credential(s) for: ${x}`),oe(`Use '${m.nameLower} credentials:service --platform android --package-name ${f}' or upload it under that package in the Dashboard.`)}else oe(`Use '${m.nameLower} credentials:service --platform ${s}' or use the Dashboard to upload them.`);await u("failed",{error:`No submission credentials found for ${s}.`,endTime:Date.now()}),process.exitCode=1;return}if(I=Lc(v,e.credentialId),!I&&s==="ios"&&p&&(I=Mc(v,p)),I||v.length===1)I=I||v[0],t.stop(`Using: ${I.name}`),s==="android"&&Wn(I)==="*"&&oe(G.yellow(`Using legacy wildcard Google Play credential for ${f}. Upload a package-scoped credential when possible.`));else{if(t.stop("Multiple credentials found"),Uc()){let R=v.map(L=>`${L.name||"credential"} (${L.credentialId||L.id||"no-id"})`).join(", ");Q(`Multiple ${s==="ios"?"App Store Connect":"Google Play"} credentials found. Use --credential-id in CI. Available: ${R}`),await u("failed",{error:"Multiple submission credentials found; --credential-id is required in CI.",endTime:Date.now()}),process.exitCode=1;return}let x=await ar({message:`Choose a ${s==="ios"?"App Store Connect":"Google Play"} credential:`,options:v.map(R=>({value:R.credentialId,label:R.name,hint:`${R.keyId?`ID: ${R.keyId}`:""} ${R.issuerId?`(Issuer: ${R.issuerId.substring(0,8)}...)`:""}`}))});if(tt(x)){lr("Submission cancelled"),await u("failed",{error:"Submission cancelled while selecting credential.",endTime:Date.now()}),process.exitCode=1;return}I=v.find(R=>R.credentialId===x),oe(`Using selected: ${G.green(I.name)}`)}}catch(A){t.stop("Failed to fetch credentials"),Q(`API Error: ${A.message} `),await u("failed",{error:`Failed to fetch credentials: ${A.message}`,endTime:Date.now()}),process.exitCode=1;return}let j=W.mkdtempSync(pe.join(St.tmpdir(),`${m.nameLower}-submit-`)),Z=I.keyId||I.meta?.keyId,z=I.issuerId||I.meta?.issuerId,fe=I.type==="asc_api_key"?`AuthKey_${Z}.p8`:"service-account.json",re=pe.join(j,fe);t.start("Downloading secure key...");try{let A=await $.get(`/credentials/${I.credentialId}/download`,{params:{projectId:r,format:"raw"}});if(A.data.status!=="success"||!A.data.downloadUrl)throw new Error("Failed to get secure download URL");let O=await Es.get(A.data.downloadUrl,{responseType:"arraybuffer"});W.writeFileSync(re,Buffer.from(O.data)),t.stop("Key downloaded to secure temp storage")}catch(A){t.stop("Download failed"),Q(`Failed to download key: ${A.message}`);try{W.rmSync(j,{recursive:!0,force:!0})}catch{}await u("failed",{error:`Failed to download credential key: ${A.message}`,endTime:Date.now()}),process.exitCode=1;return}oe(G.blue(`Initiating ${s==="ios"?"TestFlight":"Google Play"} submission...`));let ke=!1,Ae;try{if(s==="ios"){if(!Z){let O=await rn({message:"Enter App Store Connect Key ID (e.g. 2X948D...):",validate:w=>w.length>0?void 0:"Key ID is required"});if(tt(O)){await u("failed",{error:"Submission cancelled while entering ASC Key ID.",endTime:Date.now()}),process.exitCode=1;return}Z=O}if(!z||z==="undefined"){let O=await rn({message:"Enter App Store Connect Issuer ID (Found on ASC Keys page):",validate:w=>w.length>0?void 0:"Issuer ID is required"});if(tt(O)){await u("failed",{error:"Submission cancelled while entering ASC Issuer ID.",endTime:Date.now()}),process.exitCode=1;return}z=O}oe(`Using ASC Key ID: ${Z}`),oe(`Using ASC Issuer ID: ${z}`);let A=a?await Qc(b,re,z,Z,p,a):await Zc(b,re,z,Z,p);cr(`${s==="ios"?"App Store":"Google Play"} submission successful!`),ke=!0}else Ae=await ru(b,re,h||"internal",f,g||"completed",y,S,o),cr("Google Play submission successful!"),ke=!0}catch(A){Q(`Submission failed: ${A.message}`),await u("failed",{error:A.message,endTime:Date.now()}),nt(e,{status:"failed",projectId:r,submitId:c,platform:s,profile:o,buildId:C?.buildId||e.buildId,artifactName:C?.artifactName,error:A.message,dashboardUrl:c?yt(c,r):void 0}),process.exitCode=1}finally{ke&&(await u("success",{endTime:Date.now(),versionCode:Ae?.versionCode,track:h,releaseStatus:g}),nt(e,{status:"success",projectId:r,submitId:c,platform:s,profile:o,buildId:C?.buildId||e.buildId,artifactName:C?.artifactName,versionCode:Ae?.versionCode,track:h,releaseStatus:g,dashboardUrl:c?yt(c,r):void 0})),Su(j),b&&b.includes(`${m.nameLower}-artifact-`)}}function Rc(e){let t=`./${m.configFileName}`;if(W.existsSync(t))try{return JSON.parse(W.readFileSync(t,"utf-8"))}catch(n){return Q(`Failed to read ${m.configFileName}: ${n.message}`),null}return e.projectId?{projectId:e.projectId}:(Q(`No ${m.configFileName} found. Run \`${m.nameLower} init\` or \`${m.nameLower} link\` first.`),null)}async function Oc(e,t,n){let i=n.projectId||e.projectId;if(!i){Q(`${m.configFileName} is missing projectId.`),process.exitCode=1;return}let r=n.submitId||ur.randomUUID(),o=!!n.latest||!n.buildId,s=Dc({...n,latest:o,profile:t,projectId:i,submitId:r}),a={projectId:i,submitId:r,platform:"ios",profile:t,latest:o,buildId:n.buildId,credentialId:n.credentialId,status:"pending",source:"cli",submitArgs:$s(n),runnerArgs:s,runnerCommand:[m.nameLower,"submit",...s].map(Fc).join(" "),appName:e.name,startTime:Date.now()},l=it();l.start("Queuing iOS submit on macOS runner...");try{let d=await $.post("/submissions",a),c=d.data?.submission||d.data?.submit||{},u=d.data?.dashboardUrl||yt(r,i);l.stop("iOS submit queued"),oe(`Submission ID: ${G.cyan(r)}`),oe(`Dashboard: ${G.blue.underline(u)}`),nt(n,{status:"pending",projectId:i,submitId:r,platform:"ios",profile:t,latest:o,buildId:n.buildId,dashboardUrl:u}),await Cc(i,r,n)}catch(d){l.stop("Could not queue iOS submit"),Q(xc(d)),process.exitCode=1}}async function Pc(e,t,n,i,r,o={}){let s=r.submitId||ur.randomUUID(),a=!!r.latest||!r.buildId,l={projectId:t,submitId:s,platform:n,profile:i,latest:a,buildId:r.buildId,credentialId:r.credentialId,status:"running",source:"cli-direct",submitArgs:$s(r),appName:e.name,startTime:Date.now(),...o};try{let d=await $.post("/submissions",l),c=d.data?.submission||d.data?.submit||{},u=d.data?.dashboardUrl||c.dashboardUrl||yt(s,t);return oe(`Submission ID: ${G.cyan(s)}`),oe(`Dashboard: ${G.blue.underline(u)}`),nt(r,{status:"running",projectId:t,submitId:s,platform:n,profile:i,latest:a,buildId:r.buildId,dashboardUrl:u}),s}catch(d){let c=d.response?.data?.message||d.response?.data?.error||d.message;return oe(G.yellow(`Could not create submission tracking record: ${c}`)),null}}function Dc(e){let t=["--local","--submit-id",e.submitId,"--project-id",e.projectId,"--platform","ios","--profile",e.profile||"production"];return e.buildId?t.push("--build-id",e.buildId):t.push("--latest"),e.credentialId&&t.push("--credential-id",e.credentialId),e.bundleId&&t.push("--bundle-id",e.bundleId),e.packageName&&t.push("--package-name",e.packageName),e.quiet&&t.push("--quiet"),e.jsonOutput&&t.push("--json-output",e.jsonOutput),t.filter(n=>n!=null&&n!=="")}async function Cc(e,t,n){let i=it(),r=0,o=0;for(n.quiet||i.start("Waiting for iOS submit runner...");;)try{let s=await $.get(`/submissions/${e}/${t}`),a=s.data?.submission||s.data?.submit||s.data,l=String(a?.status||"pending").toLowerCase();r=0;let d=Array.isArray(a?.logs)?a.logs:[];for(let c=o;c<d.length;c++){let u=d[c];u&&console.log(G.dim(String(u)))}if(o=d.length,["success","completed","succeeded"].includes(l)){n.quiet||i.stop("iOS submit completed"),cr("App Store submission successful!"),nt(n,{status:"success",projectId:e,submitId:t,platform:"ios",profile:a?.profile||n.profile||"production",buildId:a?.buildId||n.buildId,artifactName:a?.artifactName,dashboardUrl:a?.dashboardUrl||yt(t,e)});return}if(["failed","error","cancelled","canceled"].includes(l)){n.quiet||i.stop("iOS submit failed");let c=a?.error||a?.message||"Unknown iOS submit failure.";Q(c),nt(n,{status:"failed",projectId:e,submitId:t,platform:"ios",profile:a?.profile||n.profile||"production",buildId:a?.buildId||n.buildId,artifactName:a?.artifactName,error:c,dashboardUrl:a?.dashboardUrl||yt(t,e)}),process.exitCode=1;return}n.quiet||i.message(`iOS submit ${l}...`),await dr(_c)}catch(s){if(r++,r>=$c){n.quiet||i.stop("Lost connection to iOS submit status"),Q(`Could not fetch iOS submit status after ${r} attempts: ${s.message}`),process.exitCode=1;return}await dr(Math.min(2e3*r,15e3))}}async function Tc(e,t,n){let i;for(let r=1;r<=3;r++)try{await $.patch(`/submissions/${e}/${t}`,n);return}catch(o){if(i=o,r>=3||!Nc(o))break;await dr(1e3*r)}Is.warn(G.dim(`Could not report submission status: ${i?.message||i}`))}function Nc(e){let t=e.response?.status;return!t||t===408||t===409||t===425||t===429||t>=500}function kc(){let e={gitlabJobId:process.env.CI_JOB_ID,gitlabJobUrl:process.env.CI_JOB_URL,gitlabPipelineId:process.env.CI_PIPELINE_ID,gitlabProjectId:process.env.CI_PROJECT_ID,gitlabProjectPath:process.env.CI_PROJECT_PATH};return Object.fromEntries(Object.entries(e).filter(([,t])=>!!t))}function xc(e){let t=e.response?.status,n=e.response?.data?.message||e.response?.data?.error;return t===404||t===405?["Managed iOS submit is not enabled on this Mach API yet.","Deploy the API/dashboard submission orchestration endpoint, then retry the same command.","Expected API: POST /submissions and GET/PATCH /submissions/:projectId/:submitId."].join(`
+`):n||e.message||String(e)}function yt(e,t){if(!e)return je;let n=t?`?projectId=${encodeURIComponent(t)}`:"";return`${je}/submissions/${e}${n}`}function nt(e,t){if(!e.jsonOutput)return;let n=pe.resolve(e.jsonOutput),i={...t,url:t.url||t.dashboardUrl||yt(t.submitId,t.projectId),updatedAt:new Date().toISOString()};try{let r=pe.dirname(n);r&&r!=="."&&W.mkdirSync(r,{recursive:!0}),W.writeFileSync(n,JSON.stringify(i,null,2))}catch(r){Is.warn(G.yellow(`Could not write submission metadata JSON: ${r.message}`))}}function Lc(e,t){return t&&e.find(n=>n.credentialId===t||n.id===t||n.keyId===t||n.meta?.keyId===t)||null}function Mc(e,t){let n=e.filter(i=>[i.bundleId,i.bundleIdentifier,i.appIdentifier,i.meta?.bundleId,i.meta?.bundleIdentifier,i.meta?.appIdentifier].filter(Boolean).map(String).includes(t));return n.length===1?n[0]:null}function Uc(){return process.env.CI==="true"||process.env.CI==="1"||!process.stdin.isTTY}function dr(e){return new Promise(t=>setTimeout(t,e))}function Fc(e){return/^[a-zA-Z0-9_./:=@-]+$/.test(e)?e:`'${e.replace(/'/g,"'\\''")}'`}function Bc(e,t){if(e.submit?.[t]?.android?.package)return e.submit[t].android.package;let n=Hn(e,t);if(n)return n;let i=pe.join(process.cwd(),"app.json");if(W.existsSync(i))try{return JSON.parse(W.readFileSync(i,"utf-8")).expo?.android?.package}catch{}let r=pe.join(process.cwd(),"app.config.json");if(W.existsSync(r))try{let o=JSON.parse(W.readFileSync(r,"utf-8"));return o.expo?.android?.package||o.android?.package}catch{}}function Hc(e,t){let n=e.filter(o=>Wn(o)===t);if(n.length>0)return n;let i=e.filter(o=>{let s=Wn(o);return!s||s==="*"});return e.length>0&&e.length===i.length?i:[]}function jc(e,t){return e.submit?.[t]?.ios?.bundleIdentifier?e.submit[t].ios.bundleIdentifier:e.submit?.[t]?.ios?.bundleId?e.submit[t].ios.bundleId:jn(e,t)}function Gc(e,t,n){let i=e.submit?.[t]?.ios||{},r=e.submit?.production?.ios||{},o=n.sshHost||i.sshHost||r.sshHost||process.env.MACH_IOS_SUBMIT_SSH_HOST;return o?{sshHost:o,sshUser:n.sshUser||i.sshUser||r.sshUser||process.env.MACH_IOS_SUBMIT_SSH_USER||process.env.USER||"ubuntu",sshKey:n.sshKey||i.sshKey||r.sshKey||process.env.MACH_IOS_SUBMIT_SSH_KEY}:null}function Vc(e,t,n){let i=n||e.submit?.[t]?.android?.releaseStatus||e.submit?.production?.android?.releaseStatus||"completed";return zc(i)}function zc(e){let t=wc[String(e).trim().toLowerCase()];if(!t)throw new Error(`Invalid Android release status "${e}". Use completed, draft, halted, or inProgress.`);return t}function Kc(e,t,n){let i=n??e.submit?.[t]?.android?.rollout??e.submit?.[t]?.android?.userFraction??e.submit?.[t]?.android?.rolloutFraction??e.submit?.production?.android?.rollout??e.submit?.production?.android?.userFraction??e.submit?.production?.android?.rolloutFraction;if(i==null||i==="")return;let r=Number(i);if(!Number.isFinite(r)||r<=0||r>=1)throw new Error(`Invalid Android rollout fraction "${i}". Use a number greater than 0 and less than 1, for example 0.1.`);return r}function Wc(e,t,n){let i=n??e.submit?.[t]?.android?.changesNotSentForReview??e.submit?.[t]?.android?.changes_not_sent_for_review??e.submit?.production?.android?.changesNotSentForReview??e.submit?.production?.android?.changes_not_sent_for_review??!1;return i===!0||i==="true"||i==="1"}function Yc(e,t){if(e==="inProgress"&&t===void 0)throw new Error("Google Play staged rollout requires --rollout <fraction> when --release-status inProgress is used.");if(e!=="inProgress"&&e!=="halted"&&t!==void 0)throw new Error("Android rollout fraction can only be used with --release-status inProgress or halted.")}async function qc(e,t,n,i){let r=n.buildId?"id":n.latest?"latest":null;if(!r){let s=await ar({message:"Select artifact source:",options:[{value:"latest",label:`Latest Production Build (${m.name})`},{value:"id",label:`Input Build ID (${m.name})`},{value:"url",label:"Remote URL"},{value:"local",label:"Local File Path"}]});if(tt(s))return lr("Operation cancelled"),null;r=s}if(r==="local"){let s=await rn({message:"Enter path to artifact (.ipa/.aab):",validate:a=>{if(!W.existsSync(a))return"File not found";if(t==="ios"&&!a.endsWith(".ipa"))return"Must be an .ipa file";if(t==="android"&&!a.endsWith(".aab"))return"Must be an .aab file"}});return tt(s)?null:{filePath:s,source:"local"}}let o=it();if(r==="latest"){let s=n.profile||n.buildProfile;o.start(`Fetching latest${s?` ${s}`:""} build...`);try{let a=await $.get(`/builds/${e}`,{params:{limit:50}});if(a.data.status!=="success")throw new Error(a.data.message);let l=a.data.builds||[],d=s?.toLowerCase(),c=I=>I.platform?.toLowerCase()===t.toLowerCase()&&I.status?.toLowerCase()==="success",u=I=>d?[I.buildProfile,I.profile,I.profileName,I.buildType].filter(Boolean).some(j=>String(j).toLowerCase()===d):!0,f=l.filter(I=>c(I)&&u(I)),p=f.find(I=>I.buildType?.toLowerCase()==="store"||I.distribution?.toLowerCase()==="store")||f[0],h=l.some(I=>I.platform?.toLowerCase()===t.toLowerCase()&&I.status?.toLowerCase()==="success");if(!p)return o.stop("No suitable build found"),Q(s&&h?`No successful ${t} builds found for profile "${s}".`:"No successful builds found for this platform."),null;o.stop(`Found build: ${p.buildId}`);let g=p.artifacts||[];if(g.length===0||g.every(I=>!(I.url||I.downloadUrl)))try{let I=await $.get(`/builds/${e}/${p.buildId}/artifacts`);I.data.status==="success"&&I.data.artifacts?.length>0?(g=I.data.artifacts.map(j=>({...j,url:j.url||j.downloadUrl})),console.log(G.cyan(`  [RECOVERY] Fetched ${g.length} artifact(s) with download URLs.`))):console.log(G.yellow("  [RECOVERY] /artifacts endpoint returned 0 artifacts."))}catch(I){console.log(G.red(`  [RECOVERY] /artifacts fetch failed: ${I.message}`))}let S=t==="ios",b=g.find(I=>{let j=(I.type||"").toLowerCase(),Z=(I.name||"").toLowerCase();if(console.log(G.dim(`    - Checking: ${I.name} (Type: ${I.type}, HasLink: ${!!(I.url||I.downloadUrl)})`)),j)return j===(S?"ipa":"aab");let z=S?".ipa":".aab",fe=(I.url||I.downloadUrl||"").toLowerCase();return Z.endsWith(z)||fe.includes(z)});if(!b||!(b.url||b.downloadUrl))return Q("Build found but artifact URL is missing."),null;let C=b.url||b.downloadUrl;return{filePath:await rr(C,S?"ios":"android"),buildId:p.buildId,artifactName:b.name,source:"latest"}}catch(a){return o.stop("Fetch failed"),Q(`API Error: ${a.message}`),null}}if(r==="id"){let s=n.buildId||await rn({message:"Enter Build ID:",validate:l=>l.length<5?"Invalid ID":void 0});if(tt(s))return null;let a=String(s);o.start("Fetching build...");try{let l=null;try{let p=await $.get(`/builds/${e}/${a}`);p.data.status==="success"&&(l=p.data.build)}catch(p){p.response?.status!==404&&console.log(G.dim(`  [RECOVERY] Project build lookup skipped: ${p.message}`))}if(!l){let p=await $.get(`/build/${a}`);if(p.data.status!=="success")throw new Error(p.data.message);l=p.data.build}if(!l)throw new Error(`Build ${a} was not found.`);let d=t==="ios",c=Kn(l.artifacts);Jc(c)||(c=await As(e,a,c));let u=hs(c,t);if(u||(c=await As(e,a,c),u=hs(c,t)),!u)throw new Error(`No ${d?".ipa":".aab"} artifact found for build ${a}. The build exists, but its artifact list does not contain a downloadable submission artifact.`);let f=u.url||u.downloadUrl;if(!f)throw new Error(`Artifact ${u.name||"(unnamed)"} for build ${a} has no download URL. Retry after the build artifact upload is visible in the Installation Hub.`);return o.stop(`Found build: ${l.buildId||a}`),{filePath:await rr(f,d?"ios":"android"),buildId:l.buildId||a,artifactName:u.name,source:"id"}}catch(l){throw o.stop("Fetch failed"),l}}if(r==="url"){let s=await rn({message:"Enter Artifact URL:",validate:a=>a.startsWith("http")?void 0:"Must be a valid URL"});return tt(s)?null:{filePath:await rr(s,t),source:"url"}}return null}function Kn(e){return(e||[]).map(t=>({...t,url:t.url||t.downloadUrl}))}function Jc(e){return e.some(t=>!!(t.url||t.downloadUrl))}function hs(e,t){let n=t==="ios",i=n?"ipa":"aab",r=n?".ipa":".aab";return e.find(o=>{let s=String(o.type||"").toLowerCase(),a=String(o.name||"").toLowerCase(),l=String(o.url||o.downloadUrl||"").toLowerCase();return s?s===i:a.endsWith(r)||l.includes(r)})||null}function Xc(e,t){let n=e==="ios"?".ipa":".aab";if(t.buildId)return`No downloadable ${n} artifact found for build ${t.buildId}. Check that the build finished artifact upload before submitting.`;if(t.latest){let i=t.profile||t.buildProfile;return`No latest successful ${e}${i?` ${i}`:""} build has a downloadable ${n} artifact.`}return`No downloadable ${n} artifact was selected for submission.`}async function As(e,t,n){try{let i=await $.get(`/builds/${e}/${t}/artifacts`);if(i.data.status==="success"&&i.data.artifacts?.length>0){let r=Kn(i.data.artifacts);return console.log(G.cyan(`  [RECOVERY] Fetched ${r.length} artifact(s) with download URLs.`)),r}}catch(i){console.log(G.dim(`  [RECOVERY] Project artifact lookup skipped: ${i.message}`))}try{let i=await $.get(`/public/builds/${t}`);if(i.data.status==="success"&&i.data.artifacts?.length>0){let r=Kn(i.data.artifacts);return console.log(G.cyan(`  [RECOVERY] Fetched ${r.length} public artifact(s) with download URLs.`)),r}}catch(i){console.log(G.dim(`  [RECOVERY] Public artifact lookup skipped: ${i.message}`))}return Kn(n)}async function rr(e,t,n=3){let i=it();i.start("Downloading artifact...");let r=W.mkdtempSync(pe.join(St.tmpdir(),`${m.nameLower}-artifact-`)),o=`app.${t==="ios"?"ipa":"aab"}`,s=pe.join(r,o);for(let a=1;a<=n;a++)try{a>1&&(i.message(`Downloading artifact (Retry ${a}/${n})...`),await new Promise(c=>setTimeout(c,2e3*a)));let l=W.createWriteStream(s),d=await Es({url:e,method:"GET",responseType:"stream",timeout:6e4});return await new Promise((c,u)=>{d.data.pipe(l);let f=!1;d.data.on("error",p=>{f||(f=!0,l.close(),u(p))}),l.on("finish",()=>{f||c()}),l.on("error",p=>{f||(f=!0,u(p))})}),i.stop("Download complete"),s}catch(l){if(a===n)throw i.stop("Download failed"),l}throw new Error("Download failed after retries")}async function Zc(e,t,n,i,r){let o=it();if(r&&oe(`Bundle ID: ${G.green(r)}`),!n||!i)throw Q(`Missing credentials: issuerId=${n}, keyId=${i}. Check your Dashboard.`),new Error("Missing ASC API Key Metadata (IssuerID or KeyID)");let s=ws(t,n,i),a=su();return o.start("Uploading to TestFlight (pilot)..."),new Promise((l,d)=>{let c=lu(),u=Ec(a.command,["pilot","upload","--ipa",e,"--api_key_path",s,"--skip_submission","true","--skip_waiting_for_build_processing","true"],{stdio:["ignore","pipe","pipe"],env:a.env});u.stdout?.on("data",f=>c.append(f,process.stdout)),u.stderr?.on("data",f=>c.append(f,process.stderr)),u.on("close",f=>{if(c.flush(),f!==0){o.stop("Pilot failed");try{W.unlinkSync(s)}catch{}d(du(f,c.lines()))}else{o.stop("IPA uploaded to TestFlight");try{W.unlinkSync(s)}catch{}l({})}}),u.on("error",f=>{c.flush();try{W.unlinkSync(s)}catch{}o.stop("Pilot execution error");let p=Au(f);p.logs=c.lines(),d(p)})})}async function Qc(e,t,n,i,r,o){let s=it();if(r&&oe(`Bundle ID: ${G.green(r)}`),!n||!i)throw Q(`Missing credentials: issuerId=${n}, keyId=${i}. Check your Dashboard.`),new Error("Missing ASC API Key Metadata (IssuerID or KeyID)");let a=ws(t,n,i),l=`${o.sshUser}@${o.sshHost}`,d=eu(o),c=tu(o),u="",f="";try{if(s.start(`Preparing remote iOS submit runner (${l})...`),u=nu("ssh",[...d,"mktemp -d /tmp/mach-submit.XXXXXX"]).trim(),!u)throw new Error("Remote runner did not return a temp directory.");s.stop(`Remote runner ready: ${l}`),s.start("Uploading IPA and App Store Connect key to remote runner..."),or("scp",[...c,e,`${l}:${u}/app.ipa`],"IPA upload to remote runner"),or("scp",[...c,a,`${l}:${u}/api_key.json`],"ASC key upload to remote runner"),f=pe.join(St.tmpdir(),`${m.nameLower}-ios-submit-${Date.now()}.sh`),W.writeFileSync(f,iu(u)),or("scp",[...c,f,`${l}:${u}/submit.sh`],"submit script upload to remote runner"),s.stop("Remote submit inputs uploaded"),s.start("Uploading to TestFlight on remote runner...");let p=`chmod +x ${on(`${u}/submit.sh`)} && bash ${on(`${u}/submit.sh`)}`,h=At("ssh",[...d,p],{stdio:"inherit"});if(h.error)throw pr("ssh",h.error);if(h.status!==0)throw new Error(`Remote iOS submit failed with exit code ${h.status}.`);return s.stop("IPA uploaded to TestFlight"),{apiKeyJsonPath:null}}catch(p){throw s.stop("Remote iOS submit failed"),p}finally{try{W.unlinkSync(a)}catch{}if(f)try{W.unlinkSync(f)}catch{}if(u)try{At("ssh",[...d,`rm -rf ${on(u)}`],{stdio:"ignore"})}catch{}}}function ws(e,t,n){let i=W.readFileSync(e,"utf8"),r;try{r=ur.createPrivateKey(i).export({type:"pkcs8",format:"pem"})}catch{oe("Key normalization failed, falling back to manual re-wrapping..."),r=`-----BEGIN PRIVATE KEY-----
 ${(i.replace(/-----BEGIN[^-]*-----/g,"").replace(/-----END[^-]*-----/g,"").replace(/\s+/g,"").match(/.{1,64}/g)||[]).join(`
 `)}
------END PRIVATE KEY-----`}let o=ge.join(yt.tmpdir(),`api_key_${n}_${Date.now()}.json`),s={key_id:n,issuer_id:t,key:r,in_house:!1};return Y.writeFileSync(o,JSON.stringify(s,null,2)),o}function uu(e){let t=["-o","StrictHostKeyChecking=no","-o","ServerAliveInterval=30"];return e.sshKey&&t.push("-i",e.sshKey),t.push(`${e.sshUser}@${e.sshHost}`),t}function pu(e){let t=["-o","StrictHostKeyChecking=no","-o","ServerAliveInterval=30"];return e.sshKey&&t.push("-i",e.sshKey),t}function fu(e,t){let n=ht(e,t,{encoding:"utf-8",stdio:["ignore","pipe","inherit"]});if(n.error)throw Ar(e,n.error);if(n.status!==0)throw new Error(`${e} failed with exit code ${n.status}.`);return n.stdout||""}function cr(e,t,n){let i=ht(e,t,{stdio:"inherit"});if(i.error)throw Ar(e,i.error);if(i.status!==0)throw new Error(`${n} failed with exit code ${i.status}.`)}function Ar(e,t){return t?.code==="ENOENT"?new Error(`${e} was not found on this machine. Install OpenSSH client tools or run iOS submit directly on the macOS runner.`):t}function tn(e){return`'${e.replace(/'/g,"'\\''")}'`}function mu(e){let t=tn(`${e}/app.ipa`),n=tn(`${e}/api_key.json`);return`#!/bin/bash
+-----END PRIVATE KEY-----`}let o=pe.join(St.tmpdir(),`api_key_${n}_${Date.now()}.json`),s={key_id:n,issuer_id:t,key:r,in_house:!1};return W.writeFileSync(o,JSON.stringify(s,null,2)),o}function eu(e){let t=["-o","StrictHostKeyChecking=no","-o","ServerAliveInterval=30"];return e.sshKey&&t.push("-i",e.sshKey),t.push(`${e.sshUser}@${e.sshHost}`),t}function tu(e){let t=["-o","StrictHostKeyChecking=no","-o","ServerAliveInterval=30"];return e.sshKey&&t.push("-i",e.sshKey),t}function nu(e,t){let n=At(e,t,{encoding:"utf-8",stdio:["ignore","pipe","inherit"]});if(n.error)throw pr(e,n.error);if(n.status!==0)throw new Error(`${e} failed with exit code ${n.status}.`);return n.stdout||""}function or(e,t,n){let i=At(e,t,{stdio:"inherit"});if(i.error)throw pr(e,i.error);if(i.status!==0)throw new Error(`${n} failed with exit code ${i.status}.`)}function pr(e,t){return t?.code==="ENOENT"?new Error(`${e} was not found on this machine. Install OpenSSH client tools or run iOS submit directly on the macOS runner.`):t}function on(e){return`'${e.replace(/'/g,"'\\''")}'`}function iu(e){let t=on(`${e}/app.ipa`),n=on(`${e}/api_key.json`);return`#!/bin/bash
 set -euo pipefail
 
 export PATH="/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin:$HOME/.local/share/fastlane/3.4.0/bin:$PATH"
@@ -1610,40 +1831,42 @@ fastlane pilot upload \\
   --api_key_path ${n} \\
   --skip_submission true \\
   --skip_waiting_for_build_processing true
-`}async function gu(e,t,n="internal",i,r="completed",o,s=!1,a="production"){let l=it();if(!i||i==="*")throw new Error("Android package name is required for Google Play submission.");let d=o!==void 0?` (${o} rollout)`:"";l.start(`Uploading to Google Play ${n} track with ${r} release status${d}...`);try{let c=JSON.parse(Y.readFileSync(t,"utf-8"));hu(c);let u=await ys({packageName:i,serviceAccount:c,aabPath:e,track:n,releaseStatus:r,userFraction:o,changesNotSentForReview:s});return l.stop(`AAB uploaded to ${n} track (versionCode ${u.versionCode})`),u}catch(c){throw l.stop("Google Play upload failed"),new Error(Pu(c,n,i,a))}}function hu(e){if(!e?.client_email||!e?.private_key)throw new Error("Invalid Google service account JSON: missing client_email or private_key.")}function ur(){let e=process.env.HOME||yt.homedir(),t=process.env.FASTLANE_GEM_HOME||ge.join(e,".local/share/fastlane/3.4.0"),n=[process.env.FASTLANE_BIN_DIR,"/usr/local/opt/ruby/bin","/opt/homebrew/opt/ruby/bin","/usr/local/bin","/opt/homebrew/bin","/usr/local/Cellar/fastlane/2.227.0/libexec/bin",ge.join(t,"bin"),process.env.PATH].filter(Boolean).join(":");return{...process.env,PATH:n,GEM_HOME:t,GEM_PATH:[t,"/usr/local/Cellar/fastlane/2.227.0/libexec",process.env.GEM_PATH].filter(Boolean).join(":"),FASTLANE_INSTALLED_VIA_HOMEBREW:"true",FASTLANE_SKIP_UPDATE_CHECK:"1",FASTLANE_HIDE_CHANGELOG:"1",LANG:process.env.LANG||"en_US.UTF-8",LC_ALL:process.env.LC_ALL||"en_US.UTF-8",CI:process.env.CI||"1"}}function Au(){let e=ur(),t=Is(e);if(t)return t;if(process.env.MACH_SKIP_FASTLANE_INSTALL!=="1"){yu(e);let n=Is(ur());if(n)return n}return{command:"fastlane",env:ur()}}function Is(e){let t=process.env.HOME||yt.homedir(),n=[process.env.FASTLANE_BINARY,"/usr/local/bin/fastlane","/opt/homebrew/bin/fastlane","/usr/local/Cellar/fastlane/2.227.0/libexec/bin/fastlane",ge.join(process.env.FASTLANE_GEM_HOME||ge.join(t,".local/share/fastlane/3.4.0"),"bin/fastlane"),"fastlane"].filter(Boolean);for(let i of n){if(i.includes("/")&&!Y.existsSync(i))continue;if(!ht(i,["--version"],{env:e,stdio:"ignore"}).error)return{command:i,env:e}}return null}function yu(e){let t=ht("gem",["--version"],{env:e,stdio:"ignore"});if(t.error||t.status!==0)return;let n=process.env.HOME||yt.homedir(),i=process.env.FASTLANE_GEM_HOME||ge.join(n,".local/share/fastlane/3.4.0"),r=ge.join(i,"bin");Y.mkdirSync(r,{recursive:!0}),ae(V.dim("fastlane not found. Installing fastlane into the local Mach runner cache..."));let o=ht("gem",["install","fastlane","-NV","--install-dir",i,"--bindir",r],{env:{...e,GEM_HOME:i,GEM_PATH:[i,e.GEM_PATH].filter(Boolean).join(":")},stdio:"inherit"});(o.error||o.status!==0)&&ae(V.yellow("Automatic fastlane install failed; Mach will try PATH resolution once more."))}function Su(e=Rs){let t=[],n="",i=r=>{let o=Cs(r);if(o)for(t.push(o);t.length>e;)t.shift()};return{append(r,o){let s=Buffer.isBuffer(r)?r.toString("utf8"):String(r);o.write(s),n+=s;let a=n.split(/\r?\n/);n=a.pop()||"";for(let l of a)i(l)},flush(){n.trim()&&i(n),n=""},lines(){return t.slice()}}}function bu(e,t){let n=new Error(Eu(e,t));return n.logs=Ds(t),n.exitCode=e,n}function Eu(e,t){let n=`fastlane pilot failed with exit code ${e??"unknown"}.`,i=Iu(t);return i.length===0?n:`${n}
+`}async function ru(e,t,n="internal",i,r="completed",o,s=!1,a="production"){let l=it();if(!i||i==="*")throw new Error("Android package name is required for Google Play submission.");let d=o!==void 0?` (${o} rollout)`:"";l.start(`Uploading to Google Play ${n} track with ${r} release status${d}...`);try{let c=JSON.parse(W.readFileSync(t,"utf-8"));ou(c);let u=await ms({packageName:i,serviceAccount:c,aabPath:e,track:n,releaseStatus:r,userFraction:o,changesNotSentForReview:s});return l.stop(`AAB uploaded to ${n} track (versionCode ${u.versionCode})`),u}catch(c){throw l.stop("Google Play upload failed"),new Error(yu(c,n,i,a))}}function ou(e){if(!e?.client_email||!e?.private_key)throw new Error("Invalid Google service account JSON: missing client_email or private_key.")}function sr(){let e=process.env.HOME||St.homedir(),t=process.env.FASTLANE_GEM_HOME||pe.join(e,".local/share/fastlane/3.4.0"),n=[process.env.FASTLANE_BIN_DIR,"/usr/local/opt/ruby/bin","/opt/homebrew/opt/ruby/bin","/usr/local/bin","/opt/homebrew/bin","/usr/local/Cellar/fastlane/2.227.0/libexec/bin",pe.join(t,"bin"),process.env.PATH].filter(Boolean).join(":");return{...process.env,PATH:n,GEM_HOME:t,GEM_PATH:[t,"/usr/local/Cellar/fastlane/2.227.0/libexec",process.env.GEM_PATH].filter(Boolean).join(":"),FASTLANE_INSTALLED_VIA_HOMEBREW:"true",FASTLANE_SKIP_UPDATE_CHECK:"1",FASTLANE_HIDE_CHANGELOG:"1",LANG:process.env.LANG||"en_US.UTF-8",LC_ALL:process.env.LC_ALL||"en_US.UTF-8",CI:process.env.CI||"1"}}function su(){let e=sr(),t=ys(e);if(t)return t;if(process.env.MACH_SKIP_FASTLANE_INSTALL!=="1"){au(e);let n=ys(sr());if(n)return n}return{command:"fastlane",env:sr()}}function ys(e){let t=process.env.HOME||St.homedir(),n=[process.env.FASTLANE_BINARY,"/usr/local/bin/fastlane","/opt/homebrew/bin/fastlane","/usr/local/Cellar/fastlane/2.227.0/libexec/bin/fastlane",pe.join(process.env.FASTLANE_GEM_HOME||pe.join(t,".local/share/fastlane/3.4.0"),"bin/fastlane"),"fastlane"].filter(Boolean);for(let i of n){if(i.includes("/")&&!W.existsSync(i))continue;if(!At(i,["--version"],{env:e,stdio:"ignore"}).error)return{command:i,env:e}}return null}function au(e){let t=At("gem",["--version"],{env:e,stdio:"ignore"});if(t.error||t.status!==0)return;let n=process.env.HOME||St.homedir(),i=process.env.FASTLANE_GEM_HOME||pe.join(n,".local/share/fastlane/3.4.0"),r=pe.join(i,"bin");W.mkdirSync(r,{recursive:!0}),oe(G.dim("fastlane not found. Installing fastlane into the local Mach runner cache..."));let o=At("gem",["install","fastlane","-NV","--install-dir",i,"--bindir",r],{env:{...e,GEM_HOME:i,GEM_PATH:[i,e.GEM_PATH].filter(Boolean).join(":")},stdio:"inherit"});(o.error||o.status!==0)&&oe(G.yellow("Automatic fastlane install failed; Mach will try PATH resolution once more."))}function lu(e=_s){let t=[],n="",i=r=>{let o=Rs(r);if(o)for(t.push(o);t.length>e;)t.shift()};return{append(r,o){let s=Buffer.isBuffer(r)?r.toString("utf8"):String(r);o.write(s),n+=s;let a=n.split(/\r?\n/);n=a.pop()||"";for(let l of a)i(l)},flush(){n.trim()&&i(n),n=""},lines(){return t.slice()}}}function du(e,t){let n=new Error(cu(e,t));return n.logs=vs(t),n.exitCode=e,n}function cu(e,t){let n=`fastlane pilot failed with exit code ${e??"unknown"}.`,i=uu(t);return i.length===0?n:`${n}
 
 Fastlane output:
 ${i.join(`
-`)}`}function Iu(e){let t=Ds(e);if(t.length===0)return[];let n=_s(t.filter(wu)),i=_u(t);if(i)return[i,...ws(n,lr-1,Ss)];let r=n.length>0?n:t.slice(-lr);return ws(_s(r),lr,Ss)}function _u(e){let t=e.join(`
-`),n=t.match(/CFBundleShortVersionString\s*\[([^\]]+)\]/i)?.[1]||t.match(/train version ['"]([^'"]+)['"]/i)?.[1];if(/Invalid Pre-Release Train/i.test(t)||/CFBundleShortVersionString[\s\S]*must contain a higher version/i.test(t))return[`App Store Connect rejected CFBundleShortVersionString${n?` ${n}`:""}: this App Store version train is closed or not higher than the approved version.`,'ios.buildNumber="auto" only changes CFBundleVersion; bump the marketing version (Expo app.json "expo.version" / iOS MARKETING_VERSION), rebuild, then submit the new build.'].join(" ");if(!/bundle version must be higher than the previously uploaded version/i.test(t))return null;let i=t.match(/previous(?:ly)?BundleVersion\s*:\s*([0-9.]+)/i)?.[1]||t.match(/previously uploaded version:\s*[‘'"]?([0-9.]+)/i)?.[1];return`App Store Connect rejected CFBundleVersion: the bundle version must be higher than the previously uploaded version.${i?` Previous uploaded build: ${i}.`:""}`}function wu(e){return/\[!\]|ERROR ITMS-\d+|ITMS-\d+|ENTITY_ERROR|previousBundleVersion|CFBundleVersion|Application Loader Error Output|Transporter Error|Transporter transfer failed|Asset validation failed|Validation failed|Error Domain=|The request could not be completed|No suitable application records|Could not|authentication|unauthori[sz]ed|invalid|failed|exception/i.test(e)}function _s(e){let t=new Set,n=[];for(let i of e){let r=i.trim();!r||t.has(r)||(t.add(r),n.push(i))}return n}function ws(e,t,n){let i=[],r=0;for(let o=e.length-1;o>=0&&i.length<t;o--){let s=e[o],a=r+s.length+1;if(a>n&&i.length>0)break;i.unshift(s.length>n?`${s.slice(0,n-18)}... [truncated]`:s),r=a}return i}function Ds(e){if(!Array.isArray(e))return[];let t=[];for(let n of e){let i=String(n).split(/\r?\n/);for(let r of i){let o=Cs(r);o&&t.push(o)}}return t.slice(-Rs)}function Cs(e){return $u(vu(e).trimEnd()).trim()}function vu(e){return e.replace(/[\u001b\u009b][[\]()#;?]*(?:(?:(?:[a-zA-Z\d]*(?:;[a-zA-Z\d]*)*)?\u0007)|(?:(?:\d{1,4}(?:;\d{0,4})*)?[\dA-PR-TZcf-nq-uy=><~]))/g,"")}function $u(e){let t=e.replace(/-----BEGIN [^-]+-----[\s\S]*?-----END [^-]+-----/g,"[REDACTED_PRIVATE_KEY]").replace(/(authorization:\s*bearer\s+)[A-Za-z0-9._-]+/ig,"$1[REDACTED]").replace(/((?:password|token|secret|private[_-]?key)\s*[:=]\s*)("[^"]+"|'[^']+'|[^\s,]+)/ig,"$1[REDACTED]");for(let[n,i]of Object.entries(process.env))!i||i.length<8||/(TOKEN|SECRET|PASSWORD|PASS|PRIVATE|CREDENTIAL)/i.test(n)&&(t=t.replace(new RegExp(Ru(i),"g"),"[REDACTED]"));return t}function Ru(e){return e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}function Ou(e){return e?.code!=="ENOENT"?e:new Error(["fastlane was not found on PATH.","Mach submit uses Fastlane for iOS TestFlight/App Store uploads.","Run iOS submit on a macOS runner with Fastlane, or expose it via FASTLANE_BINARY / FASTLANE_BIN_DIR.","Example: gem install fastlane -NV"].join(`
-`))}function Pu(e,t,n,i="production"){let r=e?.message||String(e);if(/changesNotSentForReview/i.test(r))return["Google Play rejected the commit because this change may need explicit review handling.",`Package: ${n||"unknown"} | Track: ${t}`,`Retry with: ${m.nameLower} submit --latest --platform android --profile ${i} --track ${t} --changes-not-sent-for-review`,"Then send the change for review from Google Play Console if required."].join(`
+`)}`}function uu(e){let t=vs(e);if(t.length===0)return[];let n=Ss(t.filter(fu)),i=pu(t);if(i)return[i,...bs(n,ir-1,gs)];let r=n.length>0?n:t.slice(-ir);return bs(Ss(r),ir,gs)}function pu(e){let t=e.join(`
+`),n=t.match(/CFBundleShortVersionString\s*\[([^\]]+)\]/i)?.[1]||t.match(/train version ['"]([^'"]+)['"]/i)?.[1];if(/Invalid Pre-Release Train/i.test(t)||/CFBundleShortVersionString[\s\S]*must contain a higher version/i.test(t))return[`App Store Connect rejected CFBundleShortVersionString${n?` ${n}`:""}: this App Store version train is closed or not higher than the approved version.`,'ios.buildNumber="auto" only changes CFBundleVersion; bump the marketing version (Expo app.json "expo.version" / iOS MARKETING_VERSION), rebuild, then submit the new build.'].join(" ");if(!/bundle version must be higher than the previously uploaded version/i.test(t))return null;let i=t.match(/previous(?:ly)?BundleVersion\s*:\s*([0-9.]+)/i)?.[1]||t.match(/previously uploaded version:\s*[‘'"]?([0-9.]+)/i)?.[1];return`App Store Connect rejected CFBundleVersion: the bundle version must be higher than the previously uploaded version.${i?` Previous uploaded build: ${i}.`:""}`}function fu(e){return/\[!\]|ERROR ITMS-\d+|ITMS-\d+|ENTITY_ERROR|previousBundleVersion|CFBundleVersion|Application Loader Error Output|Transporter Error|Transporter transfer failed|Asset validation failed|Validation failed|Error Domain=|The request could not be completed|No suitable application records|Could not|authentication|unauthori[sz]ed|invalid|failed|exception/i.test(e)}function Ss(e){let t=new Set,n=[];for(let i of e){let r=i.trim();!r||t.has(r)||(t.add(r),n.push(i))}return n}function bs(e,t,n){let i=[],r=0;for(let o=e.length-1;o>=0&&i.length<t;o--){let s=e[o],a=r+s.length+1;if(a>n&&i.length>0)break;i.unshift(s.length>n?`${s.slice(0,n-18)}... [truncated]`:s),r=a}return i}function vs(e){if(!Array.isArray(e))return[];let t=[];for(let n of e){let i=String(n).split(/\r?\n/);for(let r of i){let o=Rs(r);o&&t.push(o)}}return t.slice(-_s)}function Rs(e){return gu(mu(e).trimEnd()).trim()}function mu(e){return e.replace(/[\u001b\u009b][[\]()#;?]*(?:(?:(?:[a-zA-Z\d]*(?:;[a-zA-Z\d]*)*)?\u0007)|(?:(?:\d{1,4}(?:;\d{0,4})*)?[\dA-PR-TZcf-nq-uy=><~]))/g,"")}function gu(e){let t=e.replace(/-----BEGIN [^-]+-----[\s\S]*?-----END [^-]+-----/g,"[REDACTED_PRIVATE_KEY]").replace(/(authorization:\s*bearer\s+)[A-Za-z0-9._-]+/ig,"$1[REDACTED]").replace(/((?:password|token|secret|private[_-]?key)\s*[:=]\s*)("[^"]+"|'[^']+'|[^\s,]+)/ig,"$1[REDACTED]");for(let[n,i]of Object.entries(process.env))!i||i.length<8||/(TOKEN|SECRET|PASSWORD|PASS|PRIVATE|CREDENTIAL)/i.test(n)&&(t=t.replace(new RegExp(hu(i),"g"),"[REDACTED]"));return t}function hu(e){return e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}function Au(e){return e?.code!=="ENOENT"?e:new Error(["fastlane was not found on PATH.","Mach submit uses Fastlane for iOS TestFlight/App Store uploads.","Run iOS submit on a macOS runner with Fastlane, or expose it via FASTLANE_BINARY / FASTLANE_BIN_DIR.","Example: gem install fastlane -NV"].join(`
+`))}function yu(e,t,n,i="production"){let r=e?.message||String(e);if(/changesNotSentForReview/i.test(r))return["Google Play rejected the commit because this change may need explicit review handling.",`Package: ${n||"unknown"} | Track: ${t}`,`Retry with: ${m.nameLower} submit --latest --platform android --profile ${i} --track ${t} --changes-not-sent-for-review`,"Then send the change for review from Google Play Console if required."].join(`
 `);if(/caller does not have permission|permission denied|insufficient permissions|not authorized/i.test(r))return["Google Play rejected the service account permissions.",`Package: ${n||"unknown"} | Track: ${t}`,"Grant this service account access to the app in Play Console with release permissions, then retry."].join(`
 `);if(/package.*not found|application.*not found|no application was found/i.test(r))return["Google Play could not find this package for the selected service account.",`Package: ${n||"unknown"} | Track: ${t}`,"Check android.package / submit.<profile>.android.package and make sure the app exists in this Play Console account."].join(`
 `);if(/only releases with status draft|draft app/i.test(r))return["Google Play requires a draft release for this app state.",`Package: ${n||"unknown"} | Track: ${t}`,`Retry with: ${m.nameLower} submit --latest --platform android --profile ${i} --track ${t} --release-status draft`].join(`
 `);if(r.includes("does not allow any existing users to upgrade"))return["Google Play rejected this release because the uploaded AAB is not an upgrade for existing users.",`Package: ${n||"unknown"} | Track: ${t}`,"Build a new Android artifact with a higher versionCode, then submit that build.",`Recommended: ${m.nameLower} build --platform android --profile ${i} --auto-version`,`Then: ${m.nameLower} submit --latest --platform android --profile ${i} --track ${t}`].join(`
 `);if(/version code \d+ has already been used/i.test(r))return[r.match(/version code \d+ has already been used[^\n]*/i)?.[0]||"Version code has already been used.",`Package: ${n||"unknown"} | Track: ${t}`,"Build a new Android artifact with a higher versionCode, then submit that build.",`Recommended: ${m.nameLower} build --platform android --profile ${i} --auto-version`].join(`
-`);let o=r.match(/Google Api Error:[^\n]+/)||r.match(/Google Play API Error:[^\n]+/);return o?o[0]:r||"Google Play submission failed"}function Du(e){try{Y.existsSync(e)&&Y.rmSync(e,{recursive:!0,force:!0})}catch{}}function ee(e){console.log(V.red(`\u274C ${e}`))}function ae(e){console.log(V.gray(`\u2022 ${e}`))}function gr(e){console.log(V.green(`\u2713 ${e}`))}import yr from"fs";import Ot from"path";var Cu=new Set([".gradle",".idea",".mach-cache",".expo",".turbo","build","builds","coverage","dist",".mach_cli","mach_cli"]),Ts=new Set([".git",".gradle",".cxx",".expo","DerivedData","node_modules","Pods"]),ks=e=>e.split(Ot.sep).filter(Boolean).join("/"),Ns=(e,t)=>e===t||e.startsWith(`${t}/`),xs=(e,t)=>e==="."?t:`${e}/${t}`,Tu=(e,t,n)=>{let i=xs(t,n==="ios"?"android":"ios");if(Ns(e,i))return i;let r=e.split("/"),o=r.find(s=>Ts.has(s));return o||(r[0]===".yarn"&&r[1]==="cache"?".yarn/cache":r[0]||e)},ku=(e,t,n=".")=>{let i=ks(e);if(!i)return!1;let r=ji(n),o=i.split("/"),s=o[0];if(o.some(d=>Ts.has(d))||s===".yarn"&&o[1]==="cache"||Cu.has(s))return!0;let a=xs(r,t==="ios"?"android":"ios");if(Ns(i,a))return!0;let l=o.findIndex(d=>d==="android"||d==="ios");return!!(l>=0&&o.slice(l+1).includes("build"))},Ls=(e,t,n,i=".")=>{let r=0,o=new Set,s=ji(i),a=(l,d)=>{let c=ks(d);if(ku(c,n,s)){o.add(Tu(c,s,n));return}let u=yr.lstatSync(l);if(!u.isSymbolicLink()){if(u.isDirectory()){for(let f of yr.readdirSync(l))a(Ot.join(l,f),Ot.join(d,f));return}if(u.isFile()){let f=Ot.dirname(c);e.addLocalFile(l,f==="."?void 0:f,Ot.basename(c)),r+=1}}};for(let l of yr.readdirSync(t))a(Ot.join(t,l),l);return{files:r,skipped:Array.from(o).sort()}};function Ms(e){return String(e||"").replace(/\\\/Users\\\/[^\\/\s"'`]+/g,"\\/Users\\/[REDACTED]").replace(/\/Users\/[^/\\\s"'`]+/g,"/Users/[REDACTED]")}var Sr=8,Lu=6,Gs=Number(process.env.MACH_ARTIFACT_UPLOAD_MAX_ATTEMPTS||2),br=Number(process.env.MACH_ARTIFACT_UPLOAD_TIMEOUT_MS||12e4),Er="ap-south-1",Mu=`${m.envPrefix}S3_DEBUG`,Uu=()=>["1","true","yes","on"].includes(String(process.env[Mu]||"").trim().toLowerCase()),wr=(e,t)=>{if(Uu()&&t)try{let n=new URL(t);S.info(I.dim(`[S3_DEBUG] ${e} host=${n.hostname} expectedRegion=${Er}`)),n.hostname.includes(Er)||S.warn(I.yellow(`[S3_DEBUG] ${e} host ${n.hostname} does not include ${Er}`))}catch(n){S.warn(I.yellow(`[S3_DEBUG] Could not parse ${e} presigned URL host: ${n.message}`))}},Fu=[{value:"production",label:"production",hint:"Store / release build"},{value:"staging",label:"staging",hint:"Internal testing build"},{value:"development",label:"development",hint:"Development build"}],ta=e=>new Promise(t=>setTimeout(t,e)),Bu=e=>!e.yes&&!e.failOnly&&!e.buildId&&process.stdin.isTTY&&process.stdout.isTTY,Hu=e=>{if(!e||typeof e!="object")return;let t=[e.distribution?`distribution: ${e.distribution}`:void 0,e.environment?`env: ${e.environment}`:void 0,e.developmentClient?"development client":void 0,e.simulator?"simulator":void 0].filter(Boolean);return t.length>0?t.join(", "):void 0},ju=()=>{let e=ce(`./${m.configFileName}`),t=e?.build&&typeof e.build=="object"?e.build:{},n=Object.keys(t);return n.length===0?Fu:n.map(i=>({value:i,label:i,hint:Hu(t[i])}))},Gu=async e=>{let t=Bu(e);if(!e.platform&&t){let n=await Us({message:"Select platform",options:[{value:"android",label:"Android"},{value:"ios",label:"iOS"}]});Xn(n)&&(Bs("Build cancelled."),process.exit(0)),e.platform=n}if(!e.buildProfile&&t){let n=ju(),i=await Us({message:"Select build profile",options:n,initialValue:n.find(r=>r.value==="production")?.value||n[0]?.value});Xn(i)&&(Bs("Build cancelled."),process.exit(0)),e.buildProfile=i}e.buildProfile||(e.buildProfile="production")},Vs=e=>{if(e===!0||e===!1)return e;if(e===1||e==="1")return!0;if(e===0||e==="0")return!1;if(typeof e!="string")return;let t=e.trim().toLowerCase();if(["true","yes","on"].includes(t))return!0;if(["false","no","off"].includes(t))return!1},na=(e,t)=>{if(e)for(let n of t){let i=n.replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),r=e.match(new RegExp(`(?:^|\\s)${i}(?:=|\\s+)([^\\s]+)`));if(r?.[1])return r[1].replace(/^["']|["']$/g,"")}},Vu=(e,t)=>!!e&&t.some(n=>new RegExp(`(?:^|\\s)${n.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}(?:\\s|$)`).test(e)),zu=e=>{let n=na(e,["--platform"])||e?.split(/\s+/).find(i=>i==="ios"||i==="android");return n==="ios"||n==="android"?n:void 0},Ku=async e=>{if(!e.projectId||!e.buildId)return;let t=!!e.local;try{let n=await $.get(`/builds/${e.projectId}/${e.buildId}`),i=n.data?.build||n.data;if(!i||typeof i!="object"){if(t)throw new Error("MACH API returned an empty build record.");return}let r=typeof i.buildArgs=="string"?i.buildArgs:void 0;if(Eo(e,i),!e.platform){let o=i.platform||zu(r);(o==="ios"||o==="android")&&(e.platform=o)}if(e.buildProfile||(e.buildProfile=i.buildProfile||i.profile||i.profileName||na(r,["--profile","--build-profile","-p"])),e.simulator===void 0){let o=Vs(i.simulator??i.isSimulator);o!==void 0?e.simulator=o:Vu(r,["--simulator"])&&(e.simulator=!0)}if(e.developmentClient===void 0){let o=Vs(i.developmentClient??i.devClient);o!==void 0&&(e.developmentClient=o)}}catch(n){if(t){let i=n.response?.data?.message||n.message||"unknown error";throw new Error(`Could not load the canonical MACH build record for runner ${e.buildId}: ${i}. The runner stopped to avoid allocating or packaging a different native version.`)}S.warn(I.yellow(`Could not load saved build options for runner: ${n.message}`))}},Wu=e=>{if(!Number.isFinite(e)||e<=0)return"0 B";let t=["B","KB","MB","GB"],n=Math.min(Math.floor(Math.log(e)/Math.log(1024)),t.length-1);return`${(e/Math.pow(1024,n)).toFixed(n===0?0:1)} ${t[n]}`},Yu=e=>{let t=e.response?.status,n=e.code||"",i=e.message||"";return t?t===408||t===409||t===425||t===429||t>=500||/ECONNRESET|ETIMEDOUT|EAI_AGAIN|ENOTFOUND|ECONNABORTED|socket hang up|network|timeout/i.test(`${n} ${i}`):!0},rn=async(e,t,n=Lu)=>{let i;for(let r=1;r<=n;r++)try{return await t()}catch(o){if(i=o,!Yu(o)||r>=n)break;let s=Math.min(6e4,2e3*Math.pow(2,r-1)),a=o.response?.status||o.code||o.message||"network error";S.warn(I.yellow(`${e} failed transiently (${a}). Retrying in ${Math.round(s/1e3)}s... (${r}/${n})`)),await ta(s)}throw i},qu=async(e,t,n)=>{let i=be.basename(e),r=re.statSync(e).size,o=Math.round(br/1e3);wr(`ARTIFACT_UPLOAD ${i}`,t);try{await rn(`Upload artifact ${i}`,async()=>{let s=new AbortController,a=re.createReadStream(e),l=setTimeout(()=>{a.destroy(new Error(`Artifact upload timed out after ${o}s`)),s.abort()},br);try{await Jn.put(t,a,{headers:{"Content-Type":n,"Content-Length":r,Connection:"close"},maxBodyLength:1/0,maxContentLength:1/0,timeout:br,timeoutErrorMessage:`Artifact upload timed out after ${o}s`,signal:s.signal})}finally{clearTimeout(l)}},Gs)}catch(s){throw new Error(`${i} (${Wu(r)}) failed after ${Gs} upload attempt(s): ${s.message||s}`)}return r},Ju=e=>{let t=e.response?.status;return t?t===408||t===429||t>=500:!0},sn=e=>e.credentialId||e.id,Xu=async(e,t)=>{let n=sn(e);if(!n)return e.downloadUrl;let i=await $.get(`/credentials/${n}/download`,{params:{projectId:t,format:"raw"}});return i.data?.status==="success"&&i.data?.downloadUrl?i.data.downloadUrl:e.downloadUrl},Zu=async(e,t)=>{let n=e.downloadUrl;for(let i=1;i<=Sr;i++)try{if((!n||i>1)&&(n=await Xu(e,t)),!n)throw new Error(`Credential ${e.name||sn(e)||"unknown"} has no download URL.`);let r=await Jn.get(n,{responseType:"arraybuffer",timeout:6e4,maxContentLength:1/0,maxBodyLength:1/0,headers:{Connection:"close"}});return Buffer.from(r.data).toString("base64")}catch(r){if(i>=Sr||!Ju(r))throw r;let o=Math.min(1500*i*i,15e3);S.warn(I.dim(`  - Temporary network error downloading ${e.name}. Retrying... (${i}/${Sr})`)),await ta(o)}throw new Error(`Failed to download credential ${e.name||sn(e)||"unknown"}.`)},Qu=(e,t)=>t?.ios?.buildNumber??t?.iosBuildNumber??e?.ios?.buildNumber??e?.expo?.ios?.buildNumber,ep=(e,t)=>t?.android?.versionCode??t?.androidVersionCode??e?.android?.versionCode??e?.expo?.android?.versionCode,zs=(e,t,n,i)=>e==="ios"?t.iosBundleIdentifier||n?.ios?.bundleIdentifier||n?.expo?.ios?.bundleIdentifier||i:t.androidPackage||n?.android?.package||n?.expo?.android?.package||n?.name||i,Ks=async(e,t,n)=>{let i=await $.post(`/projects/${e}/next-build-number`,{platform:t,scope:n});if(i.data.status!=="success"||!i.data.buildNumber)throw new Error(i.data.message||"Dashboard did not return a build number.");return String(i.data.buildNumber)},nn=e=>{let t={};return e.platform==="ios"&&e.resolvedBuildNumber&&(t.buildNumber=e.resolvedBuildNumber),e.platform==="android"&&e.resolvedVersionCode&&(t.versionCode=e.resolvedVersionCode),t},ia=(e,t,n=[])=>{if(!re.existsSync(e))return n;let i;try{i=re.readdirSync(e,{withFileTypes:!0})}catch{return n}for(let r of i){if(r.name==="Pods"||r.name==="build"||r.name==="DerivedData")continue;let o=be.join(e,r.name);r.isDirectory()?ia(o,t,n):r.name===t&&n.push(o)}return n},tp=(e,t,n)=>{let i=`${n} ${t.environment||""}`.toLowerCase(),r=e.toLowerCase(),o=0;return(i.includes("development")||i.includes("dev"))&&/(^|[.-])dev(elopment)?($|[.-])/.test(r)&&(o+=20),(i.includes("staging")||i.includes("stage"))&&/(^|[.-])stag(e|ing)?($|[.-])/.test(r)&&(o+=20),(i.includes("production")||i.includes("prod"))&&(/(^|[.-])(dev|development|stag|stage|staging)($|[.-])/.test(r)||(o+=20)),o},np=(e,t)=>{let n=Gt(process.cwd(),e.appDirectory),i=be.join(n.appRoot,"ios"),r=re.existsSync(i)?i:n.appRoot,o=ia(r,"project.pbxproj"),s=[];for(let a of o)try{let d=re.readFileSync(a,"utf8").matchAll(/PRODUCT_BUNDLE_IDENTIFIER\s*=\s*"?([^";\s]+)"?;/g);for(let c of d){let u=c[1]?.trim();u&&!u.includes("$")&&!u.startsWith("com.apple.")&&!s.includes(u)&&s.push(u)}}catch{}if(s.length!==0)return s.length===1?s[0]:s.map(a=>({bundleId:a,score:tp(a,e,t)})).sort((a,l)=>l.score-a.score)[0]?.bundleId},qn=e=>String(e||"").trim().toLowerCase().replace(/_/g,"-"),Zn=(e,t)=>{let n=qn(e);return t==="ios"&&(n==="internal"||n==="ad-hoc")?"adhoc":t==="android"&&["internal","adhoc","ad-hoc","development","dev","staging","stage"].includes(n)?"internal":n},Ws=(e,t,n)=>{let i=Zn(e.distributionType||e.meta?.distributionType,n);return i?i===Zn(t,n):!0},Ys=(e,t,n)=>{let i=Zn(e.distributionType||e.meta?.distributionType,n),r=Zn(t,n);return i?i===r?3:n==="android"&&r!=="store"&&i!=="store"?2:0:1},ip=e=>{let t=e.toLowerCase();return t==="development"||t==="dev"||t.startsWith("development-")||t.startsWith("dev-")||t.endsWith("-development")||t.endsWith("-dev")},rp=e=>{let t=e.toLowerCase();return t.includes("staging")||t.includes("stage")||t.includes("preview")||t.includes("adhoc")||t.includes("ad-hoc")},op=(e,t)=>{let n=qn(e.distribution),i=qn(e.iosExportMethod),r=qn(e.environment);return e.platform!=="ios"?n==="store"?"store":"internal":e.developmentClient||e.simulator?"development":i==="app-store"||n==="store"?"store":i==="development"||n==="development"?"development":i==="ad-hoc"||i==="adhoc"||n==="ad-hoc"||n==="adhoc"||n==="internal"?"adhoc":r==="production"||r==="store"?"store":r==="development"||r==="dev"?"development":r==="staging"||r==="stage"||r==="preview"?"adhoc":t.toLowerCase()==="production"||t.toLowerCase().includes("store")?"store":ip(t)?"development":(rp(t),"adhoc")},ra=e=>e.bundleId||e.bundleIdentifier||e.packageName||e.meta?.bundleId||e.meta?.bundleIdentifier||e.meta?.packageName,qs=(e,t)=>{if(!t)return!0;let n=ra(e);return!n||n==="*"||n===t},Js=(e,t)=>{let n=ra(e);return!t||!n?0:n===t?2:n==="*"?1:-1},oa=e=>{try{let t=Buffer.from(e,"base64").toString("utf8"),n=t.match(/<key>application-identifier<\/key>\s*<string>([^<]+)<\/string>/)?.[1]?.trim();if(!n)return;let i=t.match(/<key>TeamIdentifier<\/key>\s*<array>\s*<string>([^<]+)<\/string>/)?.[1]?.trim();if(i&&n.startsWith(`${i}.`))return n.slice(i.length+1);let r=n.indexOf(".");return r>=0?n.slice(r+1):n}catch{return}},sp=(e,t)=>{if(e===t||e==="*")return!0;if(e.endsWith(".*")){let n=e.slice(0,-2);return t.startsWith(`${n}.`)}return!1},ap=(e,t)=>{if(!t)return!0;let n=oa(e);if(n)return sp(n,t);try{return Buffer.from(e,"base64").toString("latin1").includes(t)}catch{return!0}},Qn=async e=>{if(e.failOnly){(!e.projectId||!e.buildId)&&(S.error(I.red("--project-id and --build-id are required with --fail-only.")),process.exit(1));let d=e.error||"Build runner failed before it could report a final status.";try{await $.patch(`/builds/${e.projectId}/${e.buildId}`,{status:"failed",error:d,endTime:Date.now()}),S.info(I.yellow(`Marked build ${e.buildId} as failed.`));return}catch(c){S.error(I.red(`Could not mark build failed: ${c.message}`)),process.exit(1)}}await Ku(e),await Gu(e),e.platform!=="android"&&e.platform!=="ios"&&(S.error(`Platform ${e.platform} is not supported. Use 'android' or 'ios'.`),process.exit(1)),e.autoSubmit&&e.platform==="ios"&&e.simulator&&(S.error(I.red("--auto-submit cannot be used with --simulator because simulator builds are not App Store artifacts.")),process.exit(1)),e.autoSubmit&&e.dryRun&&S.warn(I.yellow("--auto-submit is ignored during --dry-run."));let t=_r(),n=e.buildId||Nu(),i=e.projectId,r=Date.now(),o=!!i,s=!0,a=async d=>{if(i)try{await $.patch(`/builds/${i}/${n}`,{status:"failed",error:d,endTime:Date.now()})}catch{}};if(e.local&&e.buildId&&i&&await rn("Mark isolated runner as building",()=>$.patch(`/builds/${i}/${n}`,{status:"building",runnerStartedAt:Date.now()})),e.local&&e.buildId){e.quiet||t.start(`Preparing isolated workspace for build: ${e.buildId}`);try{let d=await $.get(`/builds/${i}/${e.buildId}/source-url`);if(d.data.status!=="success")throw new Error("Failed to get source download URL from API");wr("SOURCE_DOWNLOAD",d.data.downloadUrl);let c=await Jn.get(d.data.downloadUrl,{responseType:"stream"}),u=(i||e.projectId||"default").replace(/[^a-zA-Z0-9-_]/g,"_"),f=be.join(xu.homedir(),m.workspacesDir,u);re.mkdirSync(f,{recursive:!0});let p=new Set(["node_modules",`.${m.nameLower}-cache-meta`]),g=new Set(["Pods"]);if(re.existsSync(f)){let M=re.readdirSync(f);for(let v of M){if(p.has(v))continue;if(v==="ios"){let W=be.join(f,"ios");try{let Z=re.readdirSync(W);for(let _e of Z)if(!g.has(_e))try{re.rmSync(be.join(W,_e),{recursive:!0,force:!0})}catch{}}catch{}continue}let H=be.join(f,v);try{re.rmSync(H,{recursive:!0,force:!0})}catch{}}}let h=be.join(f,"source.zip"),A=c.data,y=re.createWriteStream(h);await new Promise((M,v)=>{A.pipe(y),A.on("error",H=>v(H)),y.on("finish",()=>M())}),new js(h).extractAllTo(f,!0);try{re.unlinkSync(h)}catch{}process.chdir(f),S.info(I.green(`\u2713 Persistent workspace ready: ${f}`)),S.info(I.dim(`  \u{1F4E6} Cached dirs preserved: node_modules=${re.existsSync(be.join(f,"node_modules"))?"\u2705":"\u274C"}, Pods=${re.existsSync(be.join(f,"ios","Pods"))?"\u2705":"\u274C"}`)),t.stop()}catch(d){t.stop(`Failed to prepare isolated workspace: ${d.message}`),i&&await a(`Setup Error: ${d.message}`),process.exit(1)}}try{let d=e.repo;if(!d)try{d=Hs("git config --get remote.origin.url").toString().trim()}catch{S.warn("Could not detect git repository URL.")}!d&&e.dryRun,d||(d="https://github.com/placeholder/repo.git"),S.info(`Build ID: ${I.cyan(n)}`);let c={},u={},f=null,p=ce(`./${m.configFileName}`);if(p||(S.error(I.red(`${m.configFileName} not found. Run \`${m.nameLower} init\` or \`${m.nameLower} link\` first.`)),process.exit(1)),p){f=p;let R=vo(p);e.framework=R,i=p.projectId;let L=e.local&&e.buildId?process.env.MACH_APP_DIRECTORY:void 0,E=Gt(process.cwd(),L||p.appDirectory,{requireAppDirectory:!0});e.appDirectory=E.appDirectory,L&&process.env.MACH_DEBUG&&S.info(I.dim(`Runner app directory: ${e.appDirectory}`)),wo(E,R,e.platform);let _=e.buildProfile||"production",P=we(p,_);!P&&e.buildProfile&&(S.error(`Build profile '${_}' not found in ${m.configFileName}`),process.exit(1));let b=P||{};process.env.MACH_DEBUG&&S.info(I.dim(`Framework: ${R} | Build profile: ${_} | Platform: ${e.platform} | Distribution: ${b.distribution||"store"} | Environment: ${b.environment||_}`)),b.env&&(u=b.env,S.info(I.blue(`Use Build Profile: ${_}`)));let G=e.platform,x=b[G]||{},j=["developmentClient","simulator","distribution","buildCommand","apk","iosScheme","preBuild","postBuild","scheme","environment","androidPackage","iosBundleIdentifier","name","iosDeploymentTarget","iosApiKeyId","iosApiKeyIssuer","iosApiKeyPath","iosTeamId","iosConfiguration","iosExportMethod","branch","repo","instanceType","ami","bucket","region","nodeVersion"];e.name=p.name,e.appName=p.name,e.androidPackage=p.android?.package,e.iosBundleIdentifier=p.ios?.bundleIdentifier,e.iosScheme=p.ios?.iosScheme,!e.nodeVersion&&p.nodeVersion&&(e.nodeVersion=p.nodeVersion);let me=Q=>Q==="androidPackage"?x.androidPackage??x.package??b.androidPackage??b.android?.package:Q==="iosBundleIdentifier"?x.iosBundleIdentifier??x.bundleIdentifier??b.iosBundleIdentifier??b.ios?.bundleIdentifier:x[Q]!==void 0?x[Q]:b[Q];for(let Q of j){let se=me(Q),Ke=Q==="androidPackage"||Q==="iosBundleIdentifier";se!==void 0&&(e[Q]===void 0||Ke)&&(e[Q]=se)}if(e.platform==="ios"&&!(x.iosBundleIdentifier??x.bundleIdentifier??b.iosBundleIdentifier??b.ios?.bundleIdentifier)){let se=np(e,_);se&&se!==e.iosBundleIdentifier&&(S.warn(I.yellow(`Detected native iOS bundle identifier ${se}; using it for credential lookup. Set build.${_}.ios.bundleIdentifier to make this explicit.`)),e.iosBundleIdentifier=se)}e.branch=e.branch||"main",e.iosConfiguration=e.iosConfiguration||(e.developmentClient?"Debug":"Release"),e.sshUser=e.sshUser||process.env.USER||"ubuntu",e.simulator===void 0&&(e.simulator=!1),e.local===void 0&&(e.local=!1),e.verbose===void 0&&(e.verbose=!1),S.info(I.dim(`Resolved build config: framework=${R}, appDirectory=${e.appDirectory}, profile=${_}, platform=${e.platform}, simulator=${e.platform==="ios"?String(!!e.simulator):"n/a"}, developmentClient=${String(!!e.developmentClient)}, distribution=${e.distribution||b.distribution||"store"}, iosConfiguration=${e.platform==="ios"?e.iosConfiguration||"Release":"n/a"}`));let jt=Q=>{if(!Q)return Q;if(Q.startsWith("scripts.")){let se=Q.split(".")[1],Ke=p.scripts?.[se];if(Ke)return Ke;S.warn(`Script reference not found: ${Q}`)}return Q};e.buildCommand=jt(e.buildCommand),e.preBuild=jt(e.preBuild),e.postBuild=jt(e.postBuild),!e.scheme&&p.scheme&&(e.scheme=p.scheme);let k={..._t(p,m.envPrefix),..._t(b,`${m.envPrefix}PROFILE_`)};c={...c,...u,...k},process.env.IOS_P12_PASSWORD&&!c.IOS_P12_PASSWORD&&(c.IOS_P12_PASSWORD=process.env.IOS_P12_PASSWORD),process.env.MATCH_PASSWORD&&!c.MATCH_PASSWORD&&(c.MATCH_PASSWORD=process.env.MATCH_PASSWORD),e.platform==="ios"&&(!e.iosTeamId&&b.ios?.appleTeamId&&(e.iosTeamId=b.ios.appleTeamId),!e.iosTeamId&&p.submit?.[_]?.ios?.appleTeamId&&(e.iosTeamId=p.submit[_].ios.appleTeamId),!e.iosTeamId&&p.submit?.production?.ios?.appleTeamId&&(S.warn(I.yellow(`Check: Using 'production' Team ID for '${_}' build.`)),e.iosTeamId=p.submit.production.ios.appleTeamId),e.iosTeamId?S.info(I.magenta(`\u2713 Injected iOS Team ID from config: ${e.iosTeamId}`)):e.simulator||S.warn(I.yellow("\u26A0\uFE0F No iOS Team ID found. Device or archive signing may fail unless managed iOS credentials provide the team automatically.")))}let g="unknown";try{g=Hs("git rev-parse --abbrev-ref HEAD").toString().trim()}catch{S.warn("Failed to detect git branch.")}let h="1.0.0";try{re.existsSync("./package.json")&&(h=JSON.parse(re.readFileSync("./package.json","utf-8")).version||"1.0.0")}catch{}let A=e.buildProfile||"production",y=qt(p,{framework:e.framework,platform:e.platform}),w="Internal";e.developmentClient?w="DevelopmentClient":A.toLowerCase().includes("store")||A.toLowerCase()==="production"?w="Store":A.toLowerCase().includes("preview")||A.toLowerCase().includes("staging")?w="Staging":(A.toLowerCase().includes("development")||A.toLowerCase().includes("dev"))&&(w="Development");let M=e.platform==="ios"?"iOS":"Android",v=e.platform==="ios"&&e.simulator?" (Simulator)":"",H=`${M}${v} v${h} (${w})`;if(on(e,{status:"created",projectId:i,buildId:n,platform:e.platform,profile:A,branch:g,version:h,runtimeVersion:y,...nn(e),buildType:w,developmentClient:!!e.developmentClient,summary:H}),i){try{let R=e.buildProfile||"production",L=e.environment||R;S.info(I.blue(`Fetching managed secrets for profile: ${R} (environment: ${L})...`));let _=(await $.get(`/projects/${i}/secrets/export?env=${L}`)).data;_.status==="success"&&_.secrets&&(c={...c,..._.secrets},Object.keys(_.secrets).length>0&&S.info(I.magenta(`\u2713 Injected ${Object.keys(_.secrets).length} secrets from Dashboard.`)))}catch(R){S.warn(`Failed to load managed secrets from Dashboard: ${R.message}`)}if(e.platform==="ios"){let R=e.buildProfile||"production",L=we(p,R)||{},E=Qu(p,L),_=Bi(E),P=e.distribution!==void 0?e.distribution==="store":w==="Store",b=E===void 0&&P,G=e.autoVersion||_||b,x=Hi(e.resolvedBuildNumber,E,G,!e.simulator);if(x.kind==="persisted"){let j=Ln(e,c,x.value,"saved MACH build record");S.info(I.green(`\u2713 Reusing assigned iOS buildNumber ${j}`))}else if(x.kind==="explicit"){let j=Ln(e,c,x.value,`${m.configFileName} (${R})`);S.info(I.green(`\u2713 Using configured iOS buildNumber ${j}`))}else if(x.kind==="auto"){t.start("Assigning iOS buildNumber from Mach counter...");try{let j=zs("ios",e,p,R),me=await Ks(i,"ios",j);Ln(e,c,me,"MACH version counter"),t.stop(`\u2713 Assigned iOS buildNumber ${I.green(me)} (${j})`)}catch(j){throw t.stop("iOS buildNumber assignment failed"),new Error(`Auto-versioning failed: ${j.response?.data?.message||j.message}`)}}}if(e.platform==="android"){let R=e.buildProfile||"production",L=we(p,R)||{},E=ep(p,L),_=Bi(E),P=e.distribution!==void 0?e.distribution==="store":w==="Store",b=E===void 0&&P,G=e.autoVersion||_||b,x=Hi(e.resolvedVersionCode,E,G);if(x.kind==="persisted"){let j=Mn(e,c,x.value,"saved MACH build record");S.info(I.green(`\u2713 Reusing assigned Android versionCode ${j}`))}else if(x.kind==="explicit"){let j=Mn(e,c,x.value,`${m.configFileName} (${R})`);S.info(I.green(`\u2713 Using configured Android versionCode ${j}`))}else if(x.kind==="auto"){t.start("Assigning Android versionCode from Mach counter...");try{let j=zs("android",e,p,R),me=await Ks(i,"android",j);Mn(e,c,me,"MACH version counter"),t.stop(`\u2713 Assigned Android versionCode ${I.green(me)} (${j})`)}catch(j){throw t.stop("Android versionCode assignment failed"),new Error(`Auto-versioning failed: ${j.response?.data?.message||j.message}`)}}}if(e.platform==="ios"&&e.simulator)S.info(I.dim("Skipping managed iOS signing credentials for simulator build."));else try{S.info(I.blue("Fetching managed credentials..."));let R=op(e,A),L=e.platform==="ios"?e.iosBundleIdentifier:e.androidPackage,E=e.platform==="ios"?"bundle":"package";S.info(I.dim(`  Credential target: ${E} ${L||"not set"} (${R})`));let _=await $.get("/credentials/resolve",{params:{projectId:i,platform:e.platform,bundleId:L,distributionType:R,teamId:e.platform==="ios"?e.iosTeamId:void 0}});if(_.data.status==="success"&&_.data.credentials){let P=_.data.credentials;S.info(I.magenta(`\u2713 Found ${P.length} relevant credentials.`));let b=P.filter(k=>e.platform==="ios"&&k.type==="ios_profile"?Ws(k,R,e.platform)?qs(k,L):!1:e.platform==="android"&&k.type==="android_keystore"?qs(k,L):!!Ws(k,R,e.platform)).sort((k,Q)=>{let se=Js(Q,L)*10+Ys(Q,R,e.platform)-(Js(k,L)*10+Ys(k,R,e.platform));return se!==0?se:(Q.createdAt||0)-(k.createdAt||0)});S.info(I.dim(`  Filtered to ${b.length} credentials for distributionType: ${R}`));let G=!1,x=!1,j=!1,me=[];for(let k of b)if(!(k.type==="ios_cert"&&G||k.type==="ios_profile"&&x||k.type==="android_keystore"&&j)&&["ios_cert","ios_profile","android_keystore"].includes(k.type)&&(k.downloadUrl||sn(k)))try{let se=await Zu(k,i);if(k.type==="ios_cert"&&!G)c.IOS_DIST_P12=se,k.password?(c.IOS_P12_PASSWORD=k.password,S.info(I.dim(`  - Injected ${k.name} as IOS_DIST_P12 with password from credential record`))):S.info(I.dim(`  - Injected ${k.name} as IOS_DIST_P12`)),G=!0;else if(k.type==="ios_profile"&&!x){if(!ap(se,L)){let Ke=oa(se)||"unknown";throw new Error(`Provisioning profile ${k.name||sn(k)||"unknown"} is for a different bundle ID. Expected ${L}, found ${Ke}. Upload a ${R} profile for ${L}.`)}c.IOS_PROVISIONING_PROFILE=se,S.info(I.dim(`  - Injected ${k.name} as IOS_PROVISIONING_PROFILE`)),x=!0}else if(k.type==="android_keystore"&&!j){c.ANDROID_KEYSTORE_BASE64=se;let Ke=k.keystorePassword||k.password,po=k.keyPassword||k.keystorePassword||k.password,fo=k.alias||k.meta?.alias;if(Ke)c.ANDROID_STORE_PASSWORD=Ke,S.info(I.dim("  - Injected keystore password from credential record"));else{let Mi=["ANDROID_STORE_PASSWORD",...[R==="store"?"PRODUCTION":R==="internal"||R==="adhoc"?"STAGING":"DEVELOPMENT",R.toUpperCase(),"PRODUCTION","STORE","INTERNAL","STAGING","RELEASE","DEBUG"].map(Ui=>`KEYSTORE_PASSWORD_${Ui}`),"KEYSTORE_PASSWORD"].find(Ui=>!!c[Ui]);Mi&&c[Mi]&&(c.ANDROID_STORE_PASSWORD=c[Mi])}if(po?(c.ANDROID_KEY_PASSWORD=po,S.info(I.dim("  - Injected key password from credential record"))):c.ANDROID_KEY_PASSWORD=c.ANDROID_STORE_PASSWORD||"",fo)c.ANDROID_KEY_ALIAS=fo;else{let Li=["ANDROID_KEY_ALIAS","KEYSTORE_ALIAS"].find(mo=>!!c[mo]);Li&&(c.ANDROID_KEY_ALIAS=c[Li])}S.info(I.dim(`  - Injected ${k.name} as ANDROID_KEYSTORE_BASE64`)),j=!0}}catch(se){me.push(`${k.name||k.type}: ${se.message}`)}let jt=e.platform==="ios"?e.simulator||G&&x:j||!b.some(k=>k.type==="android_keystore");if(me.length>0&&!jt)throw new Error(`Credential setup failed:
-${me.map(k=>`- ${k}`).join(`
-`)}`);me.length>0&&S.warn(I.dim(`  Skipped ${me.length} stale or unusable credential(s).`))}if(y=qt(p,{framework:e.framework,platform:e.platform,iosBuildNumber:e.resolvedBuildNumber||c.BUILD_NUMBER,androidVersionCode:e.resolvedVersionCode||c.ANDROID_VERSION_CODE}),p.ota?.enabled){if(p.ota.engine==="mach-react-native")throw new Error("This project still uses the unfinished mach-react-native OTA engine. Run `mach ota setup` to migrate to expo-updates before building.");if(!p.ota.url)throw new Error("OTA is enabled but ota.url is missing. Run `mach ota setup` before building.");let P=p.ota.channel||"production";if(e.framework==="expo"){let b=Yt(process.cwd(),{platform:e.platform,runtimeVersion:y,channel:P,url:p.ota.url}),G=[b?.runtimeVersion!==y?`runtime ${b?.runtimeVersion||"missing"} (expected ${y})`:void 0,b?.channel!==P?`channel ${b?.channel||"missing"} (expected ${P})`:void 0,b?.url!==p.ota.url?`URL ${b?.url||"missing"} (expected ${p.ota.url})`:void 0].filter(Boolean);if(G.length>0)throw new Error(`Expo OTA configuration mismatch: ${G.join("; ")}. Run \`${m.nameLower} ota setup\` to update the local Expo plugin before building.`)}c.MACH_OTA_RUNTIME_VERSION=y,c.MACH_OTA_CHANNEL=P,c.MACH_OTA_URL=p.ota.url}if(e.platform==="ios"&&!e.simulator){let P=!!c.IOS_DIST_P12,b=!!c.IOS_PROVISIONING_PROFILE;if(!P||!b){let G=[...P?[]:["Distribution Certificate"],...b?[]:["Provisioning Profile"]].join(" and ");if(e.local&&e.buildId)throw new Error(`Missing iOS credentials: ${G}. Expected ${R} credentials for ${L||"the selected bundle ID"}. Run \`${m.nameLower} credentials --platform ios --profile ${A}\` and select ${L||"the correct bundle ID"}.`);S.error(I.red(`Missing iOS credentials: ${G}`)),e.quiet&&process.exit(1);let x=e.yes||await Fs({message:"Would you like to generate these credentials now?",initialValue:!0});if(x&&!Xn(x))return await Vt({platform:"ios",profile:A}),e.quiet||S.info(I.green("\u2713 Credentials setup complete! Restarting build phase...")),Qn(e);e.quiet||S.info(I.yellow(`Run \`${m.nameLower} credentials\` to set up signing credentials manually.`)),process.exit(1)}}if(e.platform==="android"&&!e.developmentClient&&(e.distribution==="internal"||e.distribution==="store")&&!(!!c.ANDROID_KEYSTORE_BASE64||!!c.ANDROID_KEYSTORE)){S.error(I.red("Missing Android credentials: Signing Keystore")),e.quiet&&process.exit(1);let b=e.yes||await Fs({message:"Would you like to automatically create and upload an Android Keystore for this profile now?",initialValue:!0});if(b&&!Xn(b))return await Vt({platform:"android",profile:A}),e.quiet||S.info(I.green("\u2713 Android Keystore setup complete! Restarting build phase...")),Qn(e);e.quiet||S.info(I.yellow(`Run \`${m.nameLower} credentials --platform android\` to set up a signing keystore manually.`)),process.exit(1)}}catch(R){(String(R.message||"").startsWith("Credential download failed")||String(R.message||"").startsWith("Credential setup failed")||String(R.message||"").startsWith("Missing iOS credentials")||String(R.message||"").startsWith("Auto-versioning failed"))&&(S.error(I.red(R.message)),process.exit(1)),e.platform==="ios"&&e.local&&e.buildId&&(S.error(I.red(`Failed to resolve iOS credentials: ${R.message}`)),process.exit(1)),S.warn(`Failed to resolve credentials: ${R.message}`)}}let W=!!(e.local&&e.buildId),Z=!!(e.local||e.sshHost),_e=!Z&&!W;if(W){S.info(I.magenta("\u{1F3D7}\uFE0F Runner Mode: Executing isolated build task..."));let R=await Gi({...e,interactive:!1},n,c,i,{branch:g,version:h,runtimeVersion:y,summary:H,buildType:w});await oe(R),s=!1,process.exit(0)}async function oe(R){let L=async E=>{if(i)try{await rn("Report failed build status",()=>$.patch(`/builds/${i}/${n}`,{status:"failed",error:E,endTime:Date.now()}),3)}catch(_){S.warn(I.yellow(`Could not report failed build status: ${_.message}`))}};if(i&&R.length>0){let E=_r(),_=[];e.quiet||E.start("Uploading artifacts to Dashboard...");try{for(let P of R){let b=be.basename(P),G=re.statSync(P).size,x=be.extname(b).toLowerCase(),j="application/octet-stream",me=await rn(`Create artifact upload URL for ${b}`,()=>$.post(`/builds/${i}/${n}/artifact-upload-url`,{fileName:b,fileType:j}));if(me.data.status!=="success")throw new Error(`Failed to get upload URL for ${b}`);await qu(P,me.data.uploadUrl,j),_.push({name:b,url:me.data.downloadUrl,size:G,type:x.substring(1)})}e.quiet||E.stop("Artifacts uploaded.")}catch(P){e.quiet||E.stop("Failed to upload artifacts.");let b=`Artifact upload failed: ${P.message}`;throw S.error(I.red(b)),await L(b),new Error(b)}if(i&&_.length>0)try{S.info(I.cyan(`
-\u{1F517} Download Links:`));for(let P of _)S.info(I.dim(`  - ${P.name}: `)+I.blue.underline(P.url));await rn("Finalize build in dashboard",()=>$.patch(`/builds/${i}/${n}`,{status:"success",artifacts:_,endTime:Date.now(),runtimeVersion:y,...nn(e)})),on(e,{status:"success",projectId:i,buildId:n,platform:e.platform,profile:A,branch:g,version:h,runtimeVersion:y,...nn(e),buildType:w,developmentClient:!!e.developmentClient,summary:H,artifacts:_}),S.success(I.green(`
-\u2713 Build completed and reported to dashboard.`)),e.maestro&&!W&&await Xs(i,n,e,A),e.autoSubmit&&!W&&await Ir(i,n,e,A)}catch(P){let b=`Build artifact uploaded but dashboard finalization failed: ${P.message}`;throw S.error(I.red(`
-${b}`)),await L(b),new Error(b)}}else if(i){let E="Build completed but produced no uploadable artifacts.";throw S.error(I.red(E)),await L(E),new Error(E)}}if(Z){if(S.info(I.cyan(`\u{1F680} Direct Build Mode: Executing on ${e.sshHost||"local"}...`)),i&&!o){let R=process.argv.slice(3).join(" ");await $.post("/builds",{projectId:i,buildId:n,platform:e.platform,status:"building",branch:g,version:h,runtimeVersion:y,...nn(e),summary:H,startTime:r,buildType:w,buildProfile:A,buildArgs:R,framework:e.framework,appDirectory:e.appDirectory,simulator:!!e.simulator,developmentClient:!!e.developmentClient,...Zs(e,n,A,f)}),Qs(e)}if(e.sshHost&&e.platform==="ios")await zo(e,n,c,i),s=!1,e.autoSubmit&&await Ir(i,n,e,A);else{let R=await Gi({...e,interactive:!!e.local},n,c,i,{branch:g,version:h,runtimeVersion:y,summary:H,buildType:w});await oe(R),s=!1}return}if(_e&&(S.info(I.blue("\u{1F6F0}\uFE0F Cloud Initiator Mode: Preparing orchestration...")),!e.dryRun)){e.quiet||t.start("Zipping and uploading local source...");let R=await $.post("/builds/source-upload-url",{projectId:i,buildId:n});if(R.data.status!=="success")throw t.stop("Failed to get upload URL."),new Error("Failed to get source upload URL from API");wr("SOURCE_UPLOAD",R.data.uploadUrl);let L=new js,E=Ls(L,process.cwd(),e.platform,e.appDirectory),_=L.toBuffer();if(!e.quiet){let b=E.skipped.length>0?` Skipped: ${E.skipped.join(", ")}.`:"";t.message(`Prepared source (${E.files} files).${b}`)}e.quiet||t.message(`Uploading source (${(_.length/1024/1024).toFixed(1)} MB)...`);let P=!1;for(let b=1;b<=3;b++)try{await Jn.put(R.data.uploadUrl,_,{headers:{"Content-Type":"application/zip"},maxBodyLength:1/0,maxContentLength:1/0,timeout:12e4}),P=!0;break}catch(G){if(b<3)t.message(`Upload attempt ${b} failed (${G.code||G.message}), retrying...`),await new Promise(x=>setTimeout(x,2e3*b));else throw G}if(e.quiet||t.stop("Source uploaded"),i){let b=process.argv.slice(3).join(" ");s=e.platform==="android",await $.post("/builds",{projectId:i,buildId:n,platform:e.platform,status:"pending",branch:g,version:h,runtimeVersion:y,...nn(e),summary:H,startTime:r,buildType:w,buildProfile:A,buildArgs:b,framework:e.framework,appDirectory:e.appDirectory,simulator:!!e.simulator,developmentClient:!!e.developmentClient,...Zs(e,n,A,f)}),s=e.platform==="android",S.info(I.green("\u2713 Cloud build registered.")),Qs(e)}e.platform==="android"&&(await jo(e,n,c,i,e.preBuild),s=!1),e.quiet||S.info(I.cyan("\u{1F4E1} Connecting to build stream...")),await cp(i,n,e),e.maestro&&await Xs(i,n,e,A),e.autoSubmit&&await Ir(i,n,e,A);return}}catch(d){let c=d.message||"Build failed";d.response?.data?.message?c=d.response.data.message:d.message.includes("status code 402")?c="Insufficient wallet balance. Please add credits in the Dashboard.":d.message.includes("status code 403")&&(c="Monthly build quota exceeded. Upgrade your plan in the Dashboard."),i&&s&&await a(c),S.error(I.red(`\u2717 Build failed: ${c}`)),process.exit(1)}};async function Xs(e,t,n,i){S.info(I.cyan(`
-\u{1F3BC} Queuing managed Maestro test...`)),await ir({projectId:e,buildId:t,platform:n.platform,profile:i,maestroFlows:n.maestroFlows,maestroDevice:n.maestroDevice,maestroRetries:n.maestroRetries,maestroRecord:n.maestroRecord,maestroUseBuildSource:n.maestroUseBuildSource,maestroEnv:n.maestroEnv,quiet:n.quiet})}async function Ir(e,t,n,i){if(!e){S.error(I.red("Auto-submit requires a linked Mach project. Run `mach link` or pass --project-id.")),process.exitCode=1;return}S.info(I.cyan(`
-Auto-submit: submitting the successful build...`));try{let r=await lp(e,t);if(r?.autoSubmit){let o=r.submissionId?`${je}/submissions/${r.submissionId}?projectId=${encodeURIComponent(e)}`:void 0,s=String(r.status||"").toLowerCase(),a=String(r.autoSubmitStatus||"").toLowerCase(),l=r.submissionId||["success","completed","succeeded"].includes(s)||["starting","submitted","failed","skipped"].includes(a);if(r.submissionId?(S.info(I.green(`Auto-submit is already queued by Mach backend: ${r.submissionId}`)),S.info(I.dim(`Dashboard: ${o}`))):r.autoSubmitStatus==="failed"?S.warn(I.yellow(`Backend auto-submit failed: ${r.autoSubmitError||"Unknown error"}`)):l&&S.info(I.green("Auto-submit is registered with Mach backend; skipping local duplicate submit.")),l){nt(n,{status:r.autoSubmitStatus||"pending",projectId:e,submitId:r.submissionId,platform:n.platform,profile:i,buildId:t,dashboardUrl:o});return}}await Yn({platform:n.platform,profile:i,buildProfile:i,buildId:t,projectId:e,yes:n.yes,quiet:n.quiet,track:n.submitTrack,releaseStatus:n.submitReleaseStatus,rollout:n.submitRollout,changesNotSentForReview:n.submitChangesNotSentForReview,credentialId:n.submitCredentialId,packageName:n.androidPackage,jsonOutput:n.submitJsonOutput,submitArgs:sa(n,t,i)})}catch(r){S.error(I.red(`Auto-submit failed: ${r.message||r}`)),process.exitCode=1}}function sa(e,t,n){let i=["--platform",e.platform,"--profile",n,"--build-id",t];return e.submitTrack&&i.push("--track",String(e.submitTrack)),e.submitReleaseStatus&&i.push("--release-status",String(e.submitReleaseStatus)),e.submitRollout!==void 0&&i.push("--rollout",String(e.submitRollout)),e.submitChangesNotSentForReview&&i.push("--changes-not-sent-for-review"),e.submitCredentialId&&i.push("--credential-id",e.submitCredentialId),e.platform==="android"&&e.androidPackage&&i.push("--package-name",e.androidPackage),e.platform==="ios"&&e.iosBundleIdentifier&&i.push("--bundle-id",e.iosBundleIdentifier),e.submitJsonOutput&&i.push("--json-output",e.submitJsonOutput),i.join(" ")}async function lp(e,t){try{let i=(await $.get(`/builds/${e}/${t}`)).data?.build;if(i?.autoSubmit)return i}catch(n){S.warn(I.dim(`Could not check backend auto-submit status: ${n.message}`))}return null}function aa(e){for(let t of Object.keys(e))e[t]===void 0&&delete e[t];return e}function dp(e,t,n){let i=n?.submit?.[t]?.android||{},r=n?.submit?.production?.android||{},o=e.submitTrack||i.track||r.track,s=e.submitReleaseStatus||i.releaseStatus||r.releaseStatus,a=e.submitRollout??i.rollout??i.userFraction??i.rolloutFraction??r.rollout??r.userFraction??r.rolloutFraction,l=e.submitChangesNotSentForReview??i.changesNotSentForReview??i.changes_not_sent_for_review??r.changesNotSentForReview??r.changes_not_sent_for_review;return aa({track:o,releaseStatus:s,rollout:a,changesNotSentForReview:l===void 0?!1:l===!0||l==="true"||l==="1"})}function Zs(e,t,n,i){if(!e.autoSubmit||e.dryRun)return{};let r=e.platform==="android"?dp(e,n,i):{};return{autoSubmit:!0,autoSubmitStatus:"pending",autoSubmitOptions:aa({platform:e.platform,profile:n,buildId:t,latest:!1,...r,credentialId:e.submitCredentialId,packageName:e.platform==="android"?e.androidPackage:void 0,bundleId:e.platform==="ios"?e.iosBundleIdentifier:void 0,submitArgs:sa(e,t,n)})}}function Qs(e){!e.autoSubmit||e.dryRun||e.quiet||(S.info(I.green("\u2713 Auto-submit has been registered with the build.")),S.info(I.dim("  You can close this terminal; submission will start after build success.")))}function ea(e){return`${je}/build/${e}`}function on(e,t){if(!e.jsonOutput)return;let n=be.resolve(e.jsonOutput),i={...t,url:t.url||ea(t.buildId),dashboardUrl:t.dashboardUrl||ea(t.buildId),updatedAt:new Date().toISOString()};try{let r=be.dirname(n);r&&r!=="."&&re.mkdirSync(r,{recursive:!0}),re.writeFileSync(n,JSON.stringify(i,null,2))}catch(r){S.warn(I.yellow(`Could not write build metadata JSON: ${r.message}`))}}async function cp(e,t,n){let r=_r(),o="pending",s=0,a=0;for(n.quiet||r.start("Connecting to build stream...");;){try{let d=(await $.get(`/builds/${e}/${t}`)).data.build;if(d){o=d.status;let c=String(d.pipelineLaunchState||"").toLowerCase(),u=Number(d.pipelineLaunchClaimedAt),f=Number(d.pipelineLaunchDispatchStartedAt),p=c==="claimed"&&Number.isFinite(u)&&u>0&&Date.now()-u>=3e5,g=c==="dispatching"&&Number.isFinite(f)&&f>0&&Date.now()-f>=3e5;if(["","created","pending","queued"].includes(String(o||"").toLowerCase())&&(c==="retryable_failed"||c==="ambiguous"||p||g)){let A=g||c==="ambiguous"?"ambiguous":"retryable_failed",y=d.pipelineLaunchError||(A==="ambiguous"?"The iOS runner launch outcome is unknown. MACH blocked automatic relaunch to avoid a duplicate pipeline.":p?"The iOS runner was never dispatched before its launch lease expired. Retry this build.":"The iOS runner could not be launched. Retry this build.");n.quiet||r.stop("Build runner launch failed."),on(n,{status:"failed",projectId:e,buildId:t,platform:n.platform,profile:d.buildProfile,buildType:d.buildType,developmentClient:!!d.developmentClient,version:d.version,runtimeVersion:d.runtimeVersion,buildNumber:d.buildNumber,versionCode:d.versionCode,summary:d.summary,pipelineLaunchState:A,error:y,artifacts:d.artifacts||[]}),S.error(I.red(`
-\u2717 Build runner launch failed: ${y}`)),process.exit(1)}if(o==="building")n.quiet||r.message("Build in progress...");else if(o==="failed"||o==="error"||o==="cancelled"||o==="canceled"){let A=o==="cancelled"||o==="canceled";n.quiet||r.stop(A?"Build cancelled.":"Build failed.");let y=d.error||(A?"Build was cancelled.":"Unknown error");on(n,{status:o,projectId:e,buildId:t,platform:n.platform,profile:d.buildProfile,buildType:d.buildType,developmentClient:!!d.developmentClient,version:d.version,runtimeVersion:d.runtimeVersion,buildNumber:d.buildNumber,versionCode:d.versionCode,summary:d.summary,error:y,artifacts:d.artifacts||[]}),S.error(I.red(`
-\u2717 ${A?"Build cancelled":"Build failed"}: ${y}`)),process.exit(1)}else if(o==="completed"||o==="success"){n.quiet||r.stop("Build successful!"),on(n,{status:o,projectId:e,buildId:t,platform:n.platform,profile:d.buildProfile,buildType:d.buildType,developmentClient:!!d.developmentClient,version:d.version,runtimeVersion:d.runtimeVersion,buildNumber:d.buildNumber,versionCode:d.versionCode,summary:d.summary,artifacts:d.artifacts||[]}),S.success(I.green(`
-\u2713 Build completed successfully!`));try{n.quiet||(S.info(I.magenta(`
-\u{1F4F1} Installation Hub:`)),S.info(I.dim("  - View & Install Build: ")+I.white.underline(`${je}/build/${t}`)))}catch{}return}else if(o!=="pending"){n.quiet||r.stop(`Build status: ${o}`);return}}try{let c=await $.get(`/builds/${e}/${t}/logs`),u=typeof c.data=="string"?Ms(c.data):c.data;if(u&&typeof u=="string"&&!n.quiet){let f=u.split(`
-`);if(f.length>s){for(let p=s;p<f.length;p++)f[p].trim()&&console.log(I.dim(`  ${f[p]}`));s=f.length}}}catch{}a=0}catch{a++,a>10&&(r.stop("Connection lost."),S.error(I.red(`
-\u2717 Lost connection to Dashboard API.`)),process.exit(1))}await new Promise(l=>setTimeout(l,3e3))}}import*as oi from"http";import*as ma from"net";import{execFile as up,execFileSync as st,execSync as ni,spawn as la}from"child_process";import ne from"chalk";import{log as B}from"@clack/prompts";import pp from"axios";import J from"fs";import xe from"os";import F from"path";var qe=7070,ln=`http://127.0.0.1:${qe}`,Dt="com.radhya.mach.agent",Pt="Mach Agent",Ct=`${Dt}.service`,fp=5e3,mp=3e3,ei=null,ti=null,Le=()=>F.join(xe.homedir(),m.configDir),ga=()=>F.join(xe.homedir(),"Library","LaunchAgents"),ii=()=>F.join(ga(),`${Dt}.plist`),ha=()=>F.join(xe.homedir(),".config","systemd","user"),$r=()=>F.join(ha(),Ct),Rr=()=>F.join(Le(),"agent.cmd");function Or(){return`gui/${process.getuid?.()||Number(ni("id -u").toString().trim())}`}function Aa(e){return e.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;").replace(/'/g,"&apos;")}function an(e){return`<string>${Aa(e)}</string>`}function Pr(){let e=process.argv[1]?J.realpathSync(process.argv[1]):"";if(!e||!J.existsSync(e))throw new Error("Could not resolve the current Mach CLI entrypoint.");return[process.execPath,e,"agent","run"]}function Dr(){let e=ya(),t=process.platform==="win32"?[process.env.SystemRoot?F.join(process.env.SystemRoot,"System32"):void 0,process.env.SystemRoot]:["/opt/homebrew/bin","/usr/local/bin","/usr/bin","/bin","/usr/sbin","/sbin"],n={HOME:xe.homedir(),PATH:[process.env.PATH,...e.flatMap(i=>[F.join(i,"platform-tools"),F.join(i,"emulator"),F.join(i,"cmdline-tools","latest","bin"),F.join(i,"tools","bin")]),...t].filter(Boolean).join(F.delimiter)};for(let i of["ANDROID_HOME","ANDROID_SDK_ROOT","JAVA_HOME","SHELL"])process.env[i]&&(n[i]=process.env[i]);return n}function ya(){let e=[process.env.ANDROID_HOME,process.env.ANDROID_SDK_ROOT];if(process.platform==="darwin")e.push(F.join(xe.homedir(),"Library","Android","sdk"));else if(process.platform==="linux")e.push(F.join(xe.homedir(),"Android","Sdk"),F.join(xe.homedir(),"Android","sdk"),"/opt/android-sdk","/usr/lib/android-sdk");else if(process.platform==="win32"){let t=process.env.LOCALAPPDATA,n=process.env.USERPROFILE||xe.homedir();e.push(t?F.join(t,"Android","Sdk"):void 0,F.join(n,"AppData","Local","Android","Sdk"))}return Array.from(new Set(e.filter(t=>!!t)))}function gp(e){return process.platform==="win32"&&!e.toLowerCase().endsWith(".exe")?`${e}.exe`:e}function Sa(e,t){let n=gp(e);for(let i of ya()){let r=F.join(i,t,n);if(J.existsSync(r))return r}return n}function ba(){return Sa("adb","platform-tools")}function Ea(){return Sa("emulator","emulator")}function vr(e){return`"${e.replace(/\\/g,"\\\\").replace(/"/g,'\\"').replace(/%/g,"%%")}"`}function hp(){if(process.platform!=="linux")throw new Error("Linux service install requires Linux.");J.mkdirSync(Le(),{recursive:!0}),J.mkdirSync(ha(),{recursive:!0});let e=Pr(),t=Dr(),n=Object.entries(t).map(([r,o])=>`Environment=${vr(`${r}=${o}`)}`).join(`
+`);let o=r.match(/Google Api Error:[^\n]+/)||r.match(/Google Play API Error:[^\n]+/);return o?o[0]:r||"Google Play submission failed"}function Su(e){try{W.existsSync(e)&&W.rmSync(e,{recursive:!0,force:!0})}catch{}}function Q(e){console.log(G.red(`\u274C ${e}`))}function oe(e){console.log(G.gray(`\u2022 ${e}`))}function cr(e){console.log(G.green(`\u2713 ${e}`))}import fr from"fs";import Pt from"path";var bu=new Set([".gradle",".idea",".mach-cache",".expo",".turbo","build","builds","coverage","dist",".mach_cli","mach_cli"]),Os=new Set([".git",".gradle",".cxx",".expo","DerivedData","node_modules","Pods"]),Ps=e=>e.split(Pt.sep).filter(Boolean).join("/"),Ds=(e,t)=>e===t||e.startsWith(`${t}/`),Cs=(e,t)=>e==="."?t:`${e}/${t}`,Iu=(e,t,n)=>{let i=Cs(t,n==="ios"?"android":"ios");if(Ds(e,i))return i;let r=e.split("/"),o=r.find(s=>Os.has(s));return o||(r[0]===".yarn"&&r[1]==="cache"?".yarn/cache":r[0]||e)},Eu=(e,t,n=".")=>{let i=Ps(e);if(!i)return!1;let r=Fi(n),o=i.split("/"),s=o[0];if(o.some(d=>Os.has(d))||s===".yarn"&&o[1]==="cache"||bu.has(s))return!0;let a=Cs(r,t==="ios"?"android":"ios");if(Ds(i,a))return!0;let l=o.findIndex(d=>d==="android"||d==="ios");return!!(l>=0&&o.slice(l+1).includes("build"))},Ts=(e,t,n,i=".")=>{let r=0,o=new Set,s=Fi(i),a=(l,d)=>{let c=Ps(d);if(Eu(c,n,s)){o.add(Iu(c,s,n));return}let u=fr.lstatSync(l);if(!u.isSymbolicLink()){if(u.isDirectory()){for(let f of fr.readdirSync(l))a(Pt.join(l,f),Pt.join(d,f));return}if(u.isFile()){let f=Pt.dirname(c);e.addLocalFile(l,f==="."?void 0:f,Pt.basename(c)),r+=1}}};for(let l of fr.readdirSync(t))a(Pt.join(t,l),l);return{files:r,skipped:Array.from(o).sort()}};function Ns(e){return String(e||"").replace(/\\\/Users\\\/[^\\/\s"'`]+/g,"\\/Users\\/[REDACTED]").replace(/\/Users\/[^/\\\s"'`]+/g,"/Users/[REDACTED]")}var mr=8,wu=6,Fs=Number(process.env.MACH_ARTIFACT_UPLOAD_MAX_ATTEMPTS||2),gr=Number(process.env.MACH_ARTIFACT_UPLOAD_TIMEOUT_MS||12e4),hr="ap-south-1",vu=`${m.envPrefix}S3_DEBUG`,Ru=()=>["1","true","yes","on"].includes(String(process.env[vu]||"").trim().toLowerCase()),Sr=(e,t)=>{if(Ru()&&t)try{let n=new URL(t);E.info(_.dim(`[S3_DEBUG] ${e} host=${n.hostname} expectedRegion=${hr}`)),n.hostname.includes(hr)||E.warn(_.yellow(`[S3_DEBUG] ${e} host ${n.hostname} does not include ${hr}`))}catch(n){E.warn(_.yellow(`[S3_DEBUG] Could not parse ${e} presigned URL host: ${n.message}`))}},Ou=[{value:"production",label:"production",hint:"Store / release build"},{value:"staging",label:"staging",hint:"Internal testing build"},{value:"development",label:"development",hint:"Development build"}],qs=e=>new Promise(t=>setTimeout(t,e)),Pu=e=>!e.yes&&!e.failOnly&&!e.buildId&&process.stdin.isTTY&&process.stdout.isTTY,Du=e=>{if(!e||typeof e!="object")return;let t=[e.distribution?`distribution: ${e.distribution}`:void 0,e.environment?`env: ${e.environment}`:void 0,e.developmentClient?"development client":void 0,e.simulator?"simulator":void 0].filter(Boolean);return t.length>0?t.join(", "):void 0},Cu=()=>{let e=le(`./${m.configFileName}`),t=e?.build&&typeof e.build=="object"?e.build:{},n=Object.keys(t);return n.length===0?Ou:n.map(i=>({value:i,label:i,hint:Du(t[i])}))},Tu=async e=>{let t=Pu(e);if(!e.platform&&t){let n=await ks({message:"Select platform",options:[{value:"android",label:"Android"},{value:"ios",label:"iOS"}]});Xn(n)&&(Ls("Build cancelled."),process.exit(0)),e.platform=n}if(!e.buildProfile&&t){let n=Cu(),i=await ks({message:"Select build profile",options:n,initialValue:n.find(r=>r.value==="production")?.value||n[0]?.value});Xn(i)&&(Ls("Build cancelled."),process.exit(0)),e.buildProfile=i}e.buildProfile||(e.buildProfile="production")},Bs=e=>{if(e===!0||e===!1)return e;if(e===1||e==="1")return!0;if(e===0||e==="0")return!1;if(typeof e!="string")return;let t=e.trim().toLowerCase();if(["true","yes","on"].includes(t))return!0;if(["false","no","off"].includes(t))return!1},Js=(e,t)=>{if(e)for(let n of t){let i=n.replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),r=e.match(new RegExp(`(?:^|\\s)${i}(?:=|\\s+)([^\\s]+)`));if(r?.[1])return r[1].replace(/^["']|["']$/g,"")}},Nu=(e,t)=>!!e&&t.some(n=>new RegExp(`(?:^|\\s)${n.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}(?:\\s|$)`).test(e)),ku=e=>{let n=Js(e,["--platform"])||e?.split(/\s+/).find(i=>i==="ios"||i==="android");return n==="ios"||n==="android"?n:void 0},xu=async e=>{if(!e.projectId||!e.buildId)return;let t=!!e.local;try{let n=await $.get(`/builds/${e.projectId}/${e.buildId}`),i=n.data?.build||n.data;if(!i||typeof i!="object"){if(t)throw new Error("MACH API returned an empty build record.");return}let r=typeof i.buildArgs=="string"?i.buildArgs:void 0;if(ho(e,i),!e.platform){let o=i.platform||ku(r);(o==="ios"||o==="android")&&(e.platform=o)}if(e.buildProfile||(e.buildProfile=i.buildProfile||i.profile||i.profileName||Js(r,["--profile","--build-profile","-p"])),e.simulator===void 0){let o=Bs(i.simulator??i.isSimulator);o!==void 0?e.simulator=o:Nu(r,["--simulator"])&&(e.simulator=!0)}if(e.developmentClient===void 0){let o=Bs(i.developmentClient??i.devClient);o!==void 0&&(e.developmentClient=o)}}catch(n){if(t){let i=n.response?.data?.message||n.message||"unknown error";throw new Error(`Could not load the canonical MACH build record for runner ${e.buildId}: ${i}. The runner stopped to avoid allocating or packaging a different native version.`)}E.warn(_.yellow(`Could not load saved build options for runner: ${n.message}`))}},Lu=e=>{if(!Number.isFinite(e)||e<=0)return"0 B";let t=["B","KB","MB","GB"],n=Math.min(Math.floor(Math.log(e)/Math.log(1024)),t.length-1);return`${(e/Math.pow(1024,n)).toFixed(n===0?0:1)} ${t[n]}`},Mu=e=>{let t=e.response?.status,n=e.code||"",i=e.message||"";return t?t===408||t===409||t===425||t===429||t>=500||/ECONNRESET|ETIMEDOUT|EAI_AGAIN|ENOTFOUND|ECONNABORTED|socket hang up|network|timeout/i.test(`${n} ${i}`):!0},an=async(e,t,n=wu)=>{let i;for(let r=1;r<=n;r++)try{return await t()}catch(o){if(i=o,!Mu(o)||r>=n)break;let s=Math.min(6e4,2e3*Math.pow(2,r-1)),a=o.response?.status||o.code||o.message||"network error";E.warn(_.yellow(`${e} failed transiently (${a}). Retrying in ${Math.round(s/1e3)}s... (${r}/${n})`)),await qs(s)}throw i},Uu=async(e,t,n)=>{let i=ge.basename(e),r=te.statSync(e).size,o=Math.round(gr/1e3);Sr(`ARTIFACT_UPLOAD ${i}`,t);try{await an(`Upload artifact ${i}`,async()=>{let s=new AbortController,a=te.createReadStream(e),l=setTimeout(()=>{a.destroy(new Error(`Artifact upload timed out after ${o}s`)),s.abort()},gr);try{await Jn.put(t,a,{headers:{"Content-Type":n,"Content-Length":r,Connection:"close"},maxBodyLength:1/0,maxContentLength:1/0,timeout:gr,timeoutErrorMessage:`Artifact upload timed out after ${o}s`,signal:s.signal})}finally{clearTimeout(l)}},Fs)}catch(s){throw new Error(`${i} (${Lu(r)}) failed after ${Fs} upload attempt(s): ${s.message||s}`)}return r},Fu=e=>{let t=e.response?.status;return t?t===408||t===429||t>=500:!0},Ye=e=>e.credentialId||e.id,Bu=async(e,t)=>{let n=Ye(e);if(!n)return e.downloadUrl;let i=await $.get(`/credentials/${n}/download`,{params:{projectId:t,format:"raw"}});return i.data?.status==="success"&&i.data?.downloadUrl?i.data.downloadUrl:e.downloadUrl},br=async(e,t)=>{let n=e.downloadUrl;for(let i=1;i<=mr;i++)try{if((!n||i>1)&&(n=await Bu(e,t)),!n)throw new Error(`Credential ${e.name||Ye(e)||"unknown"} has no download URL.`);let r=await Jn.get(n,{responseType:"arraybuffer",timeout:6e4,maxContentLength:1/0,maxBodyLength:1/0,headers:{Connection:"close"}});return Buffer.from(r.data).toString("base64")}catch(r){if(i>=mr||!Fu(r))throw r;let o=Math.min(1500*i*i,15e3);E.warn(_.dim(`  - Temporary network error downloading ${e.name}. Retrying... (${i}/${mr})`)),await qs(o)}throw new Error(`Failed to download credential ${e.name||Ye(e)||"unknown"}.`)},Hu=(e,t)=>t?.ios?.buildNumber??t?.iosBuildNumber??e?.ios?.buildNumber??e?.expo?.ios?.buildNumber,ju=(e,t)=>t?.android?.versionCode??t?.androidVersionCode??e?.android?.versionCode??e?.expo?.android?.versionCode,Hs=(e,t,n,i)=>e==="ios"?t.iosBundleIdentifier||n?.ios?.bundleIdentifier||n?.expo?.ios?.bundleIdentifier||i:t.androidPackage||n?.android?.package||n?.expo?.android?.package||n?.name||i,js=async(e,t,n)=>{let i=await $.post(`/projects/${e}/next-build-number`,{platform:t,scope:n});if(i.data.status!=="success"||!i.data.buildNumber)throw new Error(i.data.message||"Dashboard did not return a build number.");return String(i.data.buildNumber)},sn=e=>{let t={};return e.platform==="ios"&&e.resolvedBuildNumber&&(t.buildNumber=e.resolvedBuildNumber),e.platform==="android"&&e.resolvedVersionCode&&(t.versionCode=e.resolvedVersionCode),t},Xs=(e,t,n=[])=>{if(!te.existsSync(e))return n;let i;try{i=te.readdirSync(e,{withFileTypes:!0})}catch{return n}for(let r of i){if(r.name==="Pods"||r.name==="build"||r.name==="DerivedData")continue;let o=ge.join(e,r.name);r.isDirectory()?Xs(o,t,n):r.name===t&&n.push(o)}return n},Gu=(e,t,n)=>{let i=`${n} ${t.environment||""}`.toLowerCase(),r=e.toLowerCase(),o=0;return(i.includes("development")||i.includes("dev"))&&/(^|[.-])dev(elopment)?($|[.-])/.test(r)&&(o+=20),(i.includes("staging")||i.includes("stage"))&&/(^|[.-])stag(e|ing)?($|[.-])/.test(r)&&(o+=20),(i.includes("production")||i.includes("prod"))&&(/(^|[.-])(dev|development|stag|stage|staging)($|[.-])/.test(r)||(o+=20)),o},Vu=(e,t)=>{let n=Kt(process.cwd(),e.appDirectory),i=ge.join(n.appRoot,"ios"),r=te.existsSync(i)?i:n.appRoot,o=Xs(r,"project.pbxproj"),s=[];for(let a of o)try{let d=te.readFileSync(a,"utf8").matchAll(/PRODUCT_BUNDLE_IDENTIFIER\s*=\s*"?([^";\s]+)"?;/g);for(let c of d){let u=c[1]?.trim();u&&!u.includes("$")&&!u.startsWith("com.apple.")&&!s.includes(u)&&s.push(u)}}catch{}if(s.length!==0)return s.length===1?s[0]:s.map(a=>({bundleId:a,score:Gu(a,e,t)})).sort((a,l)=>l.score-a.score)[0]?.bundleId},qn=e=>String(e||"").trim().toLowerCase().replace(/_/g,"-"),Zn=(e,t)=>{let n=qn(e);return t==="ios"&&(n==="internal"||n==="ad-hoc")?"adhoc":t==="android"&&["internal","adhoc","ad-hoc","development","dev","staging","stage"].includes(n)?"internal":n},Ir=(e,t,n)=>{let i=Zn(e.distributionType||e.meta?.distributionType,n);return i?i===Zn(t,n):!0},Gs=(e,t,n)=>{let i=Zn(e.distributionType||e.meta?.distributionType,n),r=Zn(t,n);return i?i===r?3:n==="android"&&r!=="store"&&i!=="store"?2:0:1},zu=e=>{let t=e.toLowerCase();return t==="development"||t==="dev"||t.startsWith("development-")||t.startsWith("dev-")||t.endsWith("-development")||t.endsWith("-dev")},Ku=e=>{let t=e.toLowerCase();return t.includes("staging")||t.includes("stage")||t.includes("preview")||t.includes("adhoc")||t.includes("ad-hoc")},Wu=(e,t)=>{let n=qn(e.distribution),i=qn(e.iosExportMethod),r=qn(e.environment);return e.platform!=="ios"?n==="store"?"store":"internal":e.developmentClient||e.simulator?"development":i==="app-store"||n==="store"?"store":i==="development"||n==="development"?"development":i==="ad-hoc"||i==="adhoc"||n==="ad-hoc"||n==="adhoc"||n==="internal"?"adhoc":r==="production"||r==="store"?"store":r==="development"||r==="dev"?"development":r==="staging"||r==="stage"||r==="preview"?"adhoc":t.toLowerCase()==="production"||t.toLowerCase().includes("store")?"store":zu(t)?"development":(Ku(t),"adhoc")},Zs=e=>e.bundleId||e.bundleIdentifier||e.packageName||e.meta?.bundleId||e.meta?.bundleIdentifier||e.meta?.packageName,Qs=(e,t)=>{if(!t)return!0;let n=Zs(e);return!n||n==="*"||n===t},Vs=(e,t)=>{let n=Zs(e);return!t||!n?0:n===t?2:n==="*"?1:-1},ea=e=>{try{let t=Buffer.from(e,"base64").toString("utf8"),n=t.match(/<key>application-identifier<\/key>\s*<string>([^<]+)<\/string>/)?.[1]?.trim();if(!n)return;let i=t.match(/<key>TeamIdentifier<\/key>\s*<array>\s*<string>([^<]+)<\/string>/)?.[1]?.trim();if(i&&n.startsWith(`${i}.`))return n.slice(i.length+1);let r=n.indexOf(".");return r>=0?n.slice(r+1):n}catch{return}},Yu=(e,t)=>{if(e===t||e==="*")return!0;if(e.endsWith(".*")){let n=e.slice(0,-2);return t.startsWith(`${n}.`)}return!1},qu=(e,t)=>{if(!t)return!0;let n=ea(e);if(n)return Yu(n,t);try{return Buffer.from(e,"base64").toString("latin1").includes(t)}catch{return!0}},Er=(e,t,n,i)=>[...e].sort((r,o)=>{let s=Vs(o,t)*10+Gs(o,n,i)-(Vs(r,t)*10+Gs(r,n,i));return s!==0?s:(o.createdAt||0)-(r.createdAt||0)}),Ju=async e=>{let{projectId:t,signingTargets:n,distributionType:i,teamId:r,projectSecrets:o}=e,s=new Map,a=[];for(let p of n){E.info(_.dim(`  Credential target: bundle ${p.bundleIdentifier} (${i})`));let h=await $.get("/credentials/resolve",{params:{projectId:t,platform:"ios",bundleId:p.bundleIdentifier,distributionType:i,teamId:r}}),g=h.data.status==="success"&&Array.isArray(h.data.credentials)?h.data.credentials:[];s.set(p.bundleIdentifier,g),a.push(...g)}let l=[],d=[],c=[];for(let p of n){let h=Er((s.get(p.bundleIdentifier)||[]).filter(y=>y.type==="ios_profile"&&Ir(y,i,"ios")&&Qs(y,p.bundleIdentifier)),p.bundleIdentifier,i,"ios"),g;for(let y of h)if(!(!y.downloadUrl&&!Ye(y)))try{let S=await br(y,t);if(!qu(S,p.bundleIdentifier)){let b=ea(S)||"unknown";throw new Error(`expected ${p.bundleIdentifier}, found ${b}`)}g=S,E.info(_.dim(`  - Resolved ${y.name||"provisioning profile"} for ${p.bundleIdentifier}`));break}catch(S){l.push(`${y.name||Ye(y)||p.bundleIdentifier}: ${S.message}`)}if(!g){c.push(p.bundleIdentifier);continue}d.push({...p,profileBase64:g})}let u=new Set,f=Er(a.filter(p=>{if(p.type!=="ios_cert"||!Ir(p,i,"ios"))return!1;let h=Ye(p)||`${p.name||"certificate"}:${p.createdAt||""}`;return u.has(h)?!1:(u.add(h),!0)}),n[0]?.bundleIdentifier,i,"ios");for(let p of f)if(!(!p.downloadUrl&&!Ye(p)))try{o.IOS_DIST_P12=await br(p,t),p.password&&(o.IOS_P12_PASSWORD=p.password),E.info(_.dim(`  - Reusing ${p.name||"Apple Distribution certificate"} for all iOS targets`));break}catch(h){l.push(`${p.name||Ye(p)||"iOS certificate"}: ${h.message}`)}if(d.length>0){let p=d.find(h=>h.isMainApplication)||d[0];o.IOS_PROVISIONING_PROFILE=p.profileBase64,n.length>1&&d.length===n.length&&(o.IOS_PROVISIONING_PROFILES=_o(d))}return{missingProfileBundleIds:c,failures:l}},Qn=async e=>{if(e.failOnly){(!e.projectId||!e.buildId)&&(E.error(_.red("--project-id and --build-id are required with --fail-only.")),process.exit(1));let d=e.error||"Build runner failed before it could report a final status.";try{await $.patch(`/builds/${e.projectId}/${e.buildId}`,{status:"failed",error:d,endTime:Date.now()}),E.info(_.yellow(`Marked build ${e.buildId} as failed.`));return}catch(c){E.error(_.red(`Could not mark build failed: ${c.message}`)),process.exit(1)}}await xu(e),await Tu(e),e.platform!=="android"&&e.platform!=="ios"&&(E.error(`Platform ${e.platform} is not supported. Use 'android' or 'ios'.`),process.exit(1)),e.autoSubmit&&e.platform==="ios"&&e.simulator&&(E.error(_.red("--auto-submit cannot be used with --simulator because simulator builds are not App Store artifacts.")),process.exit(1)),e.autoSubmit&&e.dryRun&&E.warn(_.yellow("--auto-submit is ignored during --dry-run."));let t=yr(),n=e.buildId||_u(),i=e.projectId,r=Date.now(),o=!!i,s=!0,a=async d=>{if(i)try{await $.patch(`/builds/${i}/${n}`,{status:"failed",error:d,endTime:Date.now()})}catch{}};if(e.local&&e.buildId&&i&&await an("Mark isolated runner as building",()=>$.patch(`/builds/${i}/${n}`,{status:"building",runnerStartedAt:Date.now()})),e.local&&e.buildId){e.quiet||t.start(`Preparing isolated workspace for build: ${e.buildId}`);try{let d=await $.get(`/builds/${i}/${e.buildId}/source-url`);if(d.data.status!=="success")throw new Error("Failed to get source download URL from API");Sr("SOURCE_DOWNLOAD",d.data.downloadUrl);let c=await Jn.get(d.data.downloadUrl,{responseType:"stream"}),u=(i||e.projectId||"default").replace(/[^a-zA-Z0-9-_]/g,"_"),f=ge.join($u.homedir(),m.workspacesDir,u);te.mkdirSync(f,{recursive:!0});let p=new Set(["node_modules",`.${m.nameLower}-cache-meta`]),h=new Set(["Pods"]);if(te.existsSync(f)){let C=te.readdirSync(f);for(let I of C){if(p.has(I))continue;if(I==="ios"){let Z=ge.join(f,"ios");try{let z=te.readdirSync(Z);for(let fe of z)if(!h.has(fe))try{te.rmSync(ge.join(Z,fe),{recursive:!0,force:!0})}catch{}}catch{}continue}let j=ge.join(f,I);try{te.rmSync(j,{recursive:!0,force:!0})}catch{}}}let g=ge.join(f,"source.zip"),y=c.data,S=te.createWriteStream(g);await new Promise((C,I)=>{y.pipe(S),y.on("error",j=>I(j)),S.on("finish",()=>C())}),new Us(g).extractAllTo(f,!0);try{te.unlinkSync(g)}catch{}process.chdir(f),E.info(_.green(`\u2713 Persistent workspace ready: ${f}`)),E.info(_.dim(`  \u{1F4E6} Cached dirs preserved: node_modules=${te.existsSync(ge.join(f,"node_modules"))?"\u2705":"\u274C"}, Pods=${te.existsSync(ge.join(f,"ios","Pods"))?"\u2705":"\u274C"}`)),t.stop()}catch(d){t.stop(`Failed to prepare isolated workspace: ${d.message}`),i&&await a(`Setup Error: ${d.message}`),process.exit(1)}}try{let d=e.repo;if(!d)try{d=Ms("git config --get remote.origin.url").toString().trim()}catch{E.warn("Could not detect git repository URL.")}!d&&e.dryRun,d||(d="https://github.com/placeholder/repo.git"),E.info(`Build ID: ${_.cyan(n)}`);let c={},u={},f=null,p=[],h=[],g=le(`./${m.configFileName}`);if(g||(E.error(_.red(`${m.configFileName} not found. Run \`${m.nameLower} init\` or \`${m.nameLower} link\` first.`)),process.exit(1)),g){f=g;let A=$o(g);e.framework=A,i=g.projectId;let O=e.local&&e.buildId?process.env.MACH_APP_DIRECTORY:void 0,w=Kt(process.cwd(),O||g.appDirectory,{requireAppDirectory:!0});e.appDirectory=w.appDirectory,O&&process.env.MACH_DEBUG&&E.info(_.dim(`Runner app directory: ${e.appDirectory}`)),So(w,A,e.platform);let v=e.buildProfile||"production",x=_e(g,v);!x&&e.buildProfile&&(E.error(`Build profile '${v}' not found in ${m.configFileName}`),process.exit(1));let R=x||{};process.env.MACH_DEBUG&&E.info(_.dim(`Framework: ${A} | Build profile: ${v} | Platform: ${e.platform} | Distribution: ${R.distribution||"store"} | Environment: ${R.environment||v}`)),R.env&&(u=R.env,E.info(_.blue(`Use Build Profile: ${v}`)));let L=e.platform,B=R[L]||{},H=["developmentClient","simulator","distribution","buildCommand","apk","iosScheme","preBuild","postBuild","scheme","environment","androidPackage","iosBundleIdentifier","name","iosDeploymentTarget","iosApiKeyId","iosApiKeyIssuer","iosApiKeyPath","iosTeamId","iosConfiguration","iosExportMethod","branch","repo","instanceType","ami","bucket","region","nodeVersion"];e.name=g.name,e.appName=g.name,e.androidPackage=g.android?.package,e.iosBundleIdentifier=g.ios?.bundleIdentifier,e.iosScheme=g.ios?.iosScheme,!e.nodeVersion&&g.nodeVersion&&(e.nodeVersion=g.nodeVersion);let me=q=>q==="androidPackage"?B.androidPackage??B.package??R.androidPackage??R.android?.package:q==="iosBundleIdentifier"?B.iosBundleIdentifier??B.bundleIdentifier??R.iosBundleIdentifier??R.ios?.bundleIdentifier:B[q]!==void 0?B[q]:R[q];for(let q of H){let Ee=me(q),kn=q==="androidPackage"||q==="iosBundleIdentifier";Ee!==void 0&&(e[q]===void 0||kn)&&(e[q]=Ee)}if(e.platform==="ios"&&!(B.iosBundleIdentifier??B.bundleIdentifier??R.iosBundleIdentifier??R.ios?.bundleIdentifier)){let Ee=Vu(e,v);Ee&&Ee!==e.iosBundleIdentifier&&(E.warn(_.yellow(`Detected native iOS bundle identifier ${Ee}; using it for credential lookup. Set build.${v}.ios.bundleIdentifier to make this explicit.`)),e.iosBundleIdentifier=Ee)}e.branch=e.branch||"main",e.iosConfiguration=e.iosConfiguration||(e.developmentClient?"Debug":"Release"),e.sshUser=e.sshUser||process.env.USER||"ubuntu",e.simulator===void 0&&(e.simulator=!1),e.local===void 0&&(e.local=!1),e.verbose===void 0&&(e.verbose=!1),E.info(_.dim(`Resolved build config: framework=${A}, appDirectory=${e.appDirectory}, profile=${v}, platform=${e.platform}, simulator=${e.platform==="ios"?String(!!e.simulator):"n/a"}, developmentClient=${String(!!e.developmentClient)}, distribution=${e.distribution||R.distribution||"store"}, iosConfiguration=${e.platform==="ios"?e.iosConfiguration||"Release":"n/a"}`));let ft=q=>{if(!q)return q;if(q.startsWith("scripts.")){let Ee=q.split(".")[1],kn=g.scripts?.[Ee];if(kn)return kn;E.warn(`Script reference not found: ${q}`)}return q};if(e.buildCommand=ft(e.buildCommand),e.preBuild=ft(e.preBuild),e.postBuild=ft(e.postBuild),!e.scheme&&g.scheme&&(e.scheme=g.scheme),e.platform==="ios"&&!e.simulator&&e.iosBundleIdentifier&&(p=Eo({config:g,resolvedProfile:R,framework:A,appRoot:w.appRoot,mainBundleIdentifier:e.iosBundleIdentifier,mainTargetName:e.iosScheme||e.scheme||g.scheme}),p.length>1)){E.info(_.magenta(`\u2713 Detected ${p.length} signed iOS targets:`));for(let q of p)E.info(_.dim(`  - ${q.targetName||(q.isMainApplication?"main application":"extension")}: ${q.bundleIdentifier}`))}let Nn={...$t(g,m.envPrefix),...$t(R,`${m.envPrefix}PROFILE_`)};c={...c,...u,...Nn},process.env.IOS_P12_PASSWORD&&!c.IOS_P12_PASSWORD&&(c.IOS_P12_PASSWORD=process.env.IOS_P12_PASSWORD),process.env.MATCH_PASSWORD&&!c.MATCH_PASSWORD&&(c.MATCH_PASSWORD=process.env.MATCH_PASSWORD),e.platform==="ios"&&(!e.iosTeamId&&R.ios?.appleTeamId&&(e.iosTeamId=R.ios.appleTeamId),!e.iosTeamId&&g.submit?.[v]?.ios?.appleTeamId&&(e.iosTeamId=g.submit[v].ios.appleTeamId),!e.iosTeamId&&g.submit?.production?.ios?.appleTeamId&&(E.warn(_.yellow(`Check: Using 'production' Team ID for '${v}' build.`)),e.iosTeamId=g.submit.production.ios.appleTeamId),e.iosTeamId?E.info(_.magenta(`\u2713 Injected iOS Team ID from config: ${e.iosTeamId}`)):e.simulator||E.warn(_.yellow("\u26A0\uFE0F No iOS Team ID found. Device or archive signing may fail unless managed iOS credentials provide the team automatically.")))}let y="unknown";try{y=Ms("git rev-parse --abbrev-ref HEAD").toString().trim()}catch{E.warn("Failed to detect git branch.")}let S="1.0.0";try{te.existsSync("./package.json")&&(S=JSON.parse(te.readFileSync("./package.json","utf-8")).version||"1.0.0")}catch{}let b=e.buildProfile||"production",C=Yt(g,{framework:e.framework,platform:e.platform}),I="Internal";e.developmentClient?I="DevelopmentClient":b.toLowerCase().includes("store")||b.toLowerCase()==="production"?I="Store":b.toLowerCase().includes("preview")||b.toLowerCase().includes("staging")?I="Staging":(b.toLowerCase().includes("development")||b.toLowerCase().includes("dev"))&&(I="Development");let j=e.platform==="ios"?"iOS":"Android",Z=e.platform==="ios"&&e.simulator?" (Simulator)":"",z=`${j}${Z} v${S} (${I})`;if(ln(e,{status:"created",projectId:i,buildId:n,platform:e.platform,profile:b,branch:y,version:S,runtimeVersion:C,...sn(e),buildType:I,developmentClient:!!e.developmentClient,summary:z}),i){try{let A=e.buildProfile||"production",O=e.environment||A;E.info(_.blue(`Fetching managed secrets for profile: ${A} (environment: ${O})...`));let v=(await $.get(`/projects/${i}/secrets/export?env=${O}`)).data;v.status==="success"&&v.secrets&&(c={...c,...v.secrets},Object.keys(v.secrets).length>0&&E.info(_.magenta(`\u2713 Injected ${Object.keys(v.secrets).length} secrets from Dashboard.`)))}catch(A){E.warn(`Failed to load managed secrets from Dashboard: ${A.message}`)}if(e.platform==="ios"){let A=e.buildProfile||"production",O=_e(g,A)||{},w=Hu(g,O),v=Mi(w),x=e.distribution!==void 0?e.distribution==="store":I==="Store",R=w===void 0&&x,L=e.autoVersion||v||R,B=Ui(e.resolvedBuildNumber,w,L,!e.simulator);if(B.kind==="persisted"){let H=Un(e,c,B.value,"saved MACH build record");E.info(_.green(`\u2713 Reusing assigned iOS buildNumber ${H}`))}else if(B.kind==="explicit"){let H=Un(e,c,B.value,`${m.configFileName} (${A})`);E.info(_.green(`\u2713 Using configured iOS buildNumber ${H}`))}else if(B.kind==="auto"){t.start("Assigning iOS buildNumber from Mach counter...");try{let H=Hs("ios",e,g,A),me=await js(i,"ios",H);Un(e,c,me,"MACH version counter"),t.stop(`\u2713 Assigned iOS buildNumber ${_.green(me)} (${H})`)}catch(H){throw t.stop("iOS buildNumber assignment failed"),new Error(`Auto-versioning failed: ${H.response?.data?.message||H.message}`)}}}if(e.platform==="android"){let A=e.buildProfile||"production",O=_e(g,A)||{},w=ju(g,O),v=Mi(w),x=e.distribution!==void 0?e.distribution==="store":I==="Store",R=w===void 0&&x,L=e.autoVersion||v||R,B=Ui(e.resolvedVersionCode,w,L);if(B.kind==="persisted"){let H=Fn(e,c,B.value,"saved MACH build record");E.info(_.green(`\u2713 Reusing assigned Android versionCode ${H}`))}else if(B.kind==="explicit"){let H=Fn(e,c,B.value,`${m.configFileName} (${A})`);E.info(_.green(`\u2713 Using configured Android versionCode ${H}`))}else if(B.kind==="auto"){t.start("Assigning Android versionCode from Mach counter...");try{let H=Hs("android",e,g,A),me=await js(i,"android",H);Fn(e,c,me,"MACH version counter"),t.stop(`\u2713 Assigned Android versionCode ${_.green(me)} (${H})`)}catch(H){throw t.stop("Android versionCode assignment failed"),new Error(`Auto-versioning failed: ${H.response?.data?.message||H.message}`)}}}if(e.platform==="ios"&&e.simulator)E.info(_.dim("Skipping managed iOS signing credentials for simulator build."));else try{E.info(_.blue("Fetching managed credentials..."));let A=Wu(e,b),O=e.platform==="ios"?e.iosBundleIdentifier:e.androidPackage;if(e.platform==="ios"){let w=p.length>0?p:[{targetName:e.iosScheme||e.scheme,bundleIdentifier:e.iosBundleIdentifier,isMainApplication:!0}],v=await Ju({projectId:i,signingTargets:w,distributionType:A,teamId:e.iosTeamId,projectSecrets:c});if(h=v.missingProfileBundleIds,v.failures.length>0&&(!c.IOS_DIST_P12||h.length>0))throw new Error(`Credential setup failed:
+${v.failures.map(x=>`- ${x}`).join(`
+`)}`);v.failures.length>0&&E.warn(_.dim(`  Skipped ${v.failures.length} stale or unusable credential(s).`))}else{E.info(_.dim(`  Credential target: package ${O||"not set"} (${A})`));let w=await $.get("/credentials/resolve",{params:{projectId:i,platform:e.platform,bundleId:O,distributionType:A}}),v=w.data.status==="success"&&Array.isArray(w.data.credentials)?w.data.credentials:[],x=Er(v.filter(L=>L.type==="android_keystore"&&Qs(L,O)&&Ir(L,A,e.platform)),O,A,e.platform),R=[];for(let L of x)if(!(c.ANDROID_KEYSTORE_BASE64||!L.downloadUrl&&!Ye(L)))try{c.ANDROID_KEYSTORE_BASE64=await br(L,i);let B=L.keystorePassword||L.password,H=L.keyPassword||L.keystorePassword||L.password,me=L.alias||L.meta?.alias;if(B&&(c.ANDROID_STORE_PASSWORD=B),H&&(c.ANDROID_KEY_PASSWORD=H),me&&(c.ANDROID_KEY_ALIAS=me),!c.ANDROID_STORE_PASSWORD){let q=["ANDROID_STORE_PASSWORD",...[A==="store"?"PRODUCTION":"STAGING",A.toUpperCase(),"PRODUCTION","STORE","INTERNAL","STAGING","RELEASE","DEBUG"].map(Ee=>`KEYSTORE_PASSWORD_${Ee}`),"KEYSTORE_PASSWORD"].find(Ee=>!!c[Ee]);q&&(c.ANDROID_STORE_PASSWORD=c[q])}if(c.ANDROID_KEY_PASSWORD||(c.ANDROID_KEY_PASSWORD=c.ANDROID_STORE_PASSWORD||""),!c.ANDROID_KEY_ALIAS){let ft=["ANDROID_KEY_ALIAS","KEYSTORE_ALIAS"].find(Nn=>!!c[Nn]);ft&&(c.ANDROID_KEY_ALIAS=c[ft])}E.info(_.dim(`  - Injected ${L.name} as ANDROID_KEYSTORE_BASE64`))}catch(B){R.push(`${L.name||L.type}: ${B.message}`)}if(R.length>0&&!c.ANDROID_KEYSTORE_BASE64)throw new Error(`Credential setup failed:
+${R.map(L=>`- ${L}`).join(`
+`)}`)}if(C=Yt(g,{framework:e.framework,platform:e.platform,iosBuildNumber:e.resolvedBuildNumber||c.BUILD_NUMBER,androidVersionCode:e.resolvedVersionCode||c.ANDROID_VERSION_CODE}),g.ota?.enabled){if(g.ota.engine==="mach-react-native")throw new Error("This project still uses the unfinished mach-react-native OTA engine. Run `mach ota setup` to migrate to expo-updates before building.");if(!g.ota.url)throw new Error("OTA is enabled but ota.url is missing. Run `mach ota setup` before building.");let w=bo(g,u);if(e.framework==="expo"){let v=Wt(process.cwd(),{platform:e.platform,runtimeVersion:C,channel:w,url:g.ota.url}),x=Io(v,{runtimeVersion:C,channel:w,url:g.ota.url});if(x.length>0){let R=te.existsSync(ge.join(process.cwd(),"node_modules",".bin","expo")),L=te.existsSync(ge.join(process.cwd(),"node_modules","@radhya","mach","expo-plugin","index.js"));if(R&&L)throw new Error(`Expo OTA configuration mismatch: ${x.join("; ")}. Run \`${m.nameLower} ota setup\` to update the local Expo plugin before building.`);E.info(_.dim("Deferring Expo OTA validation until dependencies are installed on the build runner."))}}c.MACH_OTA_RUNTIME_VERSION=C,c.MACH_OTA_CHANNEL=w,c.MACH_OTA_URL=g.ota.url}if(e.platform==="ios"&&!e.simulator){let w=!!c.IOS_DIST_P12,v=!!c.IOS_PROVISIONING_PROFILE,x=p.length>1,R=x?!!c.IOS_PROVISIONING_PROFILES&&h.length===0:v;if(!w||!R){let L=h.length>0?`Provisioning Profiles for ${h.join(", ")}`:"Provisioning Profile",B=[...w?[]:["Distribution Certificate"],...R?[]:[L]].join(" and ");if(e.local&&e.buildId)throw new Error(`Missing iOS credentials: ${B}. Expected ${A} credentials for ${O||"the selected bundle ID"}. Run \`${m.nameLower} credentials --platform ios --profile ${b}\` and select ${O||"the correct bundle ID"}.`);if(E.error(_.red(`Missing iOS credentials: ${B}`)),h.length>0)for(let me of h)E.info(_.yellow(`Run \`${m.nameLower} credentials --platform ios --profile ${b}\` and select ${me}.`));e.quiet&&process.exit(1),x&&!R&&process.exit(1);let H=e.yes||await xs({message:"Would you like to generate these credentials now?",initialValue:!0});if(H&&!Xn(H))return await qt({platform:"ios",profile:b}),e.quiet||E.info(_.green("\u2713 Credentials setup complete! Restarting build phase...")),Qn(e);e.quiet||E.info(_.yellow(`Run \`${m.nameLower} credentials\` to set up signing credentials manually.`)),process.exit(1)}}if(e.platform==="android"&&!e.developmentClient&&(e.distribution==="internal"||e.distribution==="store")&&!(!!c.ANDROID_KEYSTORE_BASE64||!!c.ANDROID_KEYSTORE)){E.error(_.red("Missing Android credentials: Signing Keystore")),e.quiet&&process.exit(1);let v=e.yes||await xs({message:"Would you like to automatically create and upload an Android Keystore for this profile now?",initialValue:!0});if(v&&!Xn(v))return await qt({platform:"android",profile:b}),e.quiet||E.info(_.green("\u2713 Android Keystore setup complete! Restarting build phase...")),Qn(e);e.quiet||E.info(_.yellow(`Run \`${m.nameLower} credentials --platform android\` to set up a signing keystore manually.`)),process.exit(1)}}catch(A){(String(A.message||"").startsWith("Credential download failed")||String(A.message||"").startsWith("Credential setup failed")||String(A.message||"").startsWith("Missing iOS credentials")||String(A.message||"").startsWith("Auto-versioning failed"))&&(E.error(_.red(A.message)),process.exit(1)),e.platform==="ios"&&e.local&&e.buildId&&(E.error(_.red(`Failed to resolve iOS credentials: ${A.message}`)),process.exit(1)),E.warn(`Failed to resolve credentials: ${A.message}`)}}let fe=!!(e.local&&e.buildId),re=!!(e.local||e.sshHost),ke=!re&&!fe;if(fe){E.info(_.magenta("\u{1F3D7}\uFE0F Runner Mode: Executing isolated build task..."));let A=await Bi({...e,interactive:!1},n,c,i,{branch:y,version:S,runtimeVersion:C,summary:z,buildType:I});await Ae(A),s=!1,process.exit(0)}async function Ae(A){let O=async w=>{if(i)try{await an("Report failed build status",()=>$.patch(`/builds/${i}/${n}`,{status:"failed",error:w,endTime:Date.now()}),3)}catch(v){E.warn(_.yellow(`Could not report failed build status: ${v.message}`))}};if(i&&A.length>0){let w=yr(),v=[];e.quiet||w.start("Uploading artifacts to Dashboard...");try{for(let x of A){let R=ge.basename(x),L=te.statSync(x).size,B=ge.extname(R).toLowerCase(),H="application/octet-stream",me=await an(`Create artifact upload URL for ${R}`,()=>$.post(`/builds/${i}/${n}/artifact-upload-url`,{fileName:R,fileType:H}));if(me.data.status!=="success")throw new Error(`Failed to get upload URL for ${R}`);await Uu(x,me.data.uploadUrl,H),v.push({name:R,url:me.data.downloadUrl,size:L,type:B.substring(1)})}e.quiet||w.stop("Artifacts uploaded.")}catch(x){e.quiet||w.stop("Failed to upload artifacts.");let R=`Artifact upload failed: ${x.message}`;throw E.error(_.red(R)),await O(R),new Error(R)}if(i&&v.length>0)try{E.info(_.cyan(`
+\u{1F517} Download Links:`));for(let x of v)E.info(_.dim(`  - ${x.name}: `)+_.blue.underline(x.url));await an("Finalize build in dashboard",()=>$.patch(`/builds/${i}/${n}`,{status:"success",artifacts:v,endTime:Date.now(),runtimeVersion:C,...sn(e)})),ln(e,{status:"success",projectId:i,buildId:n,platform:e.platform,profile:b,branch:y,version:S,runtimeVersion:C,...sn(e),buildType:I,developmentClient:!!e.developmentClient,summary:z,artifacts:v}),E.success(_.green(`
+\u2713 Build completed and reported to dashboard.`)),e.maestro&&!fe&&await zs(i,n,e,b),e.autoSubmit&&!fe&&await Ar(i,n,e,b)}catch(x){let R=`Build artifact uploaded but dashboard finalization failed: ${x.message}`;throw E.error(_.red(`
+${R}`)),await O(R),new Error(R)}}else if(i){let w="Build completed but produced no uploadable artifacts.";throw E.error(_.red(w)),await O(w),new Error(w)}}if(re){if(E.info(_.cyan(`\u{1F680} Direct Build Mode: Executing on ${e.sshHost||"local"}...`)),i&&!o){let A=process.argv.slice(3).join(" ");await $.post("/builds",{projectId:i,buildId:n,platform:e.platform,status:"building",branch:y,version:S,runtimeVersion:C,...sn(e),summary:z,startTime:r,buildType:I,buildProfile:b,buildArgs:A,framework:e.framework,appDirectory:e.appDirectory,simulator:!!e.simulator,developmentClient:!!e.developmentClient,...Ks(e,n,b,f)}),Ws(e)}if(e.sshHost&&e.platform==="ios")await Vo(e,n,c,i),s=!1,e.autoSubmit&&await Ar(i,n,e,b);else{let A=await Bi({...e,interactive:!!e.local},n,c,i,{branch:y,version:S,runtimeVersion:C,summary:z,buildType:I});await Ae(A),s=!1}return}if(ke&&(E.info(_.blue("\u{1F6F0}\uFE0F Cloud Initiator Mode: Preparing orchestration...")),!e.dryRun)){e.quiet||t.start("Zipping and uploading local source...");let A=await $.post("/builds/source-upload-url",{projectId:i,buildId:n});if(A.data.status!=="success")throw t.stop("Failed to get upload URL."),new Error("Failed to get source upload URL from API");Sr("SOURCE_UPLOAD",A.data.uploadUrl);let O=new Us,w=Ts(O,process.cwd(),e.platform,e.appDirectory),v=O.toBuffer();if(!e.quiet){let R=w.skipped.length>0?` Skipped: ${w.skipped.join(", ")}.`:"";t.message(`Prepared source (${w.files} files).${R}`)}e.quiet||t.message(`Uploading source (${(v.length/1024/1024).toFixed(1)} MB)...`);let x=!1;for(let R=1;R<=3;R++)try{await Jn.put(A.data.uploadUrl,v,{headers:{"Content-Type":"application/zip"},maxBodyLength:1/0,maxContentLength:1/0,timeout:12e4}),x=!0;break}catch(L){if(R<3)t.message(`Upload attempt ${R} failed (${L.code||L.message}), retrying...`),await new Promise(B=>setTimeout(B,2e3*R));else throw L}if(e.quiet||t.stop("Source uploaded"),i){let R=process.argv.slice(3).join(" ");s=e.platform==="android",await $.post("/builds",{projectId:i,buildId:n,platform:e.platform,status:"pending",branch:y,version:S,runtimeVersion:C,...sn(e),summary:z,startTime:r,buildType:I,buildProfile:b,buildArgs:R,framework:e.framework,appDirectory:e.appDirectory,simulator:!!e.simulator,developmentClient:!!e.developmentClient,...Ks(e,n,b,f)}),s=e.platform==="android",E.info(_.green("\u2713 Cloud build registered.")),Ws(e)}e.platform==="android"&&(await Ho(e,n,c,i,e.preBuild),s=!1),e.quiet||E.info(_.cyan("\u{1F4E1} Connecting to build stream...")),await Qu(i,n,e),e.maestro&&await zs(i,n,e,b),e.autoSubmit&&await Ar(i,n,e,b);return}}catch(d){let c=d.message||"Build failed";d.response?.data?.message?c=d.response.data.message:d.message.includes("status code 402")?c="Insufficient wallet balance. Please add credits in the Dashboard.":d.message.includes("status code 403")&&(c="Monthly build quota exceeded. Upgrade your plan in the Dashboard."),i&&s&&await a(c),E.error(_.red(`\u2717 Build failed: ${c}`)),process.exit(1)}};async function zs(e,t,n,i){E.info(_.cyan(`
+\u{1F3BC} Queuing managed Maestro test...`)),await Zi({projectId:e,buildId:t,platform:n.platform,profile:i,maestroFlows:n.maestroFlows,maestroDevice:n.maestroDevice,maestroRetries:n.maestroRetries,maestroRecord:n.maestroRecord,maestroUseBuildSource:n.maestroUseBuildSource,maestroEnv:n.maestroEnv,quiet:n.quiet})}async function Ar(e,t,n,i){if(!e){E.error(_.red("Auto-submit requires a linked Mach project. Run `mach link` or pass --project-id.")),process.exitCode=1;return}E.info(_.cyan(`
+Auto-submit: submitting the successful build...`));try{let r=await Xu(e,t);if(r?.autoSubmit){let o=r.submissionId?`${je}/submissions/${r.submissionId}?projectId=${encodeURIComponent(e)}`:void 0,s=String(r.status||"").toLowerCase(),a=String(r.autoSubmitStatus||"").toLowerCase(),l=r.submissionId||["success","completed","succeeded"].includes(s)||["starting","submitted","failed","skipped"].includes(a);if(r.submissionId?(E.info(_.green(`Auto-submit is already queued by Mach backend: ${r.submissionId}`)),E.info(_.dim(`Dashboard: ${o}`))):r.autoSubmitStatus==="failed"?E.warn(_.yellow(`Backend auto-submit failed: ${r.autoSubmitError||"Unknown error"}`)):l&&E.info(_.green("Auto-submit is registered with Mach backend; skipping local duplicate submit.")),l){nt(n,{status:r.autoSubmitStatus||"pending",projectId:e,submitId:r.submissionId,platform:n.platform,profile:i,buildId:t,dashboardUrl:o});return}}await Yn({platform:n.platform,profile:i,buildProfile:i,buildId:t,projectId:e,yes:n.yes,quiet:n.quiet,track:n.submitTrack,releaseStatus:n.submitReleaseStatus,rollout:n.submitRollout,changesNotSentForReview:n.submitChangesNotSentForReview,credentialId:n.submitCredentialId,packageName:n.androidPackage,jsonOutput:n.submitJsonOutput,submitArgs:ta(n,t,i)})}catch(r){E.error(_.red(`Auto-submit failed: ${r.message||r}`)),process.exitCode=1}}function ta(e,t,n){let i=["--platform",e.platform,"--profile",n,"--build-id",t];return e.submitTrack&&i.push("--track",String(e.submitTrack)),e.submitReleaseStatus&&i.push("--release-status",String(e.submitReleaseStatus)),e.submitRollout!==void 0&&i.push("--rollout",String(e.submitRollout)),e.submitChangesNotSentForReview&&i.push("--changes-not-sent-for-review"),e.submitCredentialId&&i.push("--credential-id",e.submitCredentialId),e.platform==="android"&&e.androidPackage&&i.push("--package-name",e.androidPackage),e.platform==="ios"&&e.iosBundleIdentifier&&i.push("--bundle-id",e.iosBundleIdentifier),e.submitJsonOutput&&i.push("--json-output",e.submitJsonOutput),i.join(" ")}async function Xu(e,t){try{let i=(await $.get(`/builds/${e}/${t}`)).data?.build;if(i?.autoSubmit)return i}catch(n){E.warn(_.dim(`Could not check backend auto-submit status: ${n.message}`))}return null}function na(e){for(let t of Object.keys(e))e[t]===void 0&&delete e[t];return e}function Zu(e,t,n){let i=n?.submit?.[t]?.android||{},r=n?.submit?.production?.android||{},o=e.submitTrack||i.track||r.track,s=e.submitReleaseStatus||i.releaseStatus||r.releaseStatus,a=e.submitRollout??i.rollout??i.userFraction??i.rolloutFraction??r.rollout??r.userFraction??r.rolloutFraction,l=e.submitChangesNotSentForReview??i.changesNotSentForReview??i.changes_not_sent_for_review??r.changesNotSentForReview??r.changes_not_sent_for_review;return na({track:o,releaseStatus:s,rollout:a,changesNotSentForReview:l===void 0?!1:l===!0||l==="true"||l==="1"})}function Ks(e,t,n,i){if(!e.autoSubmit||e.dryRun)return{};let r=e.platform==="android"?Zu(e,n,i):{};return{autoSubmit:!0,autoSubmitStatus:"pending",autoSubmitOptions:na({platform:e.platform,profile:n,buildId:t,latest:!1,...r,credentialId:e.submitCredentialId,packageName:e.platform==="android"?e.androidPackage:void 0,bundleId:e.platform==="ios"?e.iosBundleIdentifier:void 0,submitArgs:ta(e,t,n)})}}function Ws(e){!e.autoSubmit||e.dryRun||e.quiet||(E.info(_.green("\u2713 Auto-submit has been registered with the build.")),E.info(_.dim("  You can close this terminal; submission will start after build success.")))}function Ys(e){return`${je}/build/${e}`}function ln(e,t){if(!e.jsonOutput)return;let n=ge.resolve(e.jsonOutput),i={...t,url:t.url||Ys(t.buildId),dashboardUrl:t.dashboardUrl||Ys(t.buildId),updatedAt:new Date().toISOString()};try{let r=ge.dirname(n);r&&r!=="."&&te.mkdirSync(r,{recursive:!0}),te.writeFileSync(n,JSON.stringify(i,null,2))}catch(r){E.warn(_.yellow(`Could not write build metadata JSON: ${r.message}`))}}async function Qu(e,t,n){let r=yr(),o="pending",s=0,a=0;for(n.quiet||r.start("Connecting to build stream...");;){try{let d=(await $.get(`/builds/${e}/${t}`)).data.build;if(d){o=d.status;let c=String(d.pipelineLaunchState||"").toLowerCase(),u=Number(d.pipelineLaunchClaimedAt),f=Number(d.pipelineLaunchDispatchStartedAt),p=c==="claimed"&&Number.isFinite(u)&&u>0&&Date.now()-u>=3e5,h=c==="dispatching"&&Number.isFinite(f)&&f>0&&Date.now()-f>=3e5;if(["","created","pending","queued"].includes(String(o||"").toLowerCase())&&(c==="retryable_failed"||c==="ambiguous"||p||h)){let y=h||c==="ambiguous"?"ambiguous":"retryable_failed",S=d.pipelineLaunchError||(y==="ambiguous"?"The iOS runner launch outcome is unknown. MACH blocked automatic relaunch to avoid a duplicate pipeline.":p?"The iOS runner was never dispatched before its launch lease expired. Retry this build.":"The iOS runner could not be launched. Retry this build.");n.quiet||r.stop("Build runner launch failed."),ln(n,{status:"failed",projectId:e,buildId:t,platform:n.platform,profile:d.buildProfile,buildType:d.buildType,developmentClient:!!d.developmentClient,version:d.version,runtimeVersion:d.runtimeVersion,buildNumber:d.buildNumber,versionCode:d.versionCode,summary:d.summary,pipelineLaunchState:y,error:S,artifacts:d.artifacts||[]}),E.error(_.red(`
+\u2717 Build runner launch failed: ${S}`)),process.exit(1)}if(o==="building")n.quiet||r.message("Build in progress...");else if(o==="failed"||o==="error"||o==="cancelled"||o==="canceled"){let y=o==="cancelled"||o==="canceled";n.quiet||r.stop(y?"Build cancelled.":"Build failed.");let S=d.error||(y?"Build was cancelled.":"Unknown error");ln(n,{status:o,projectId:e,buildId:t,platform:n.platform,profile:d.buildProfile,buildType:d.buildType,developmentClient:!!d.developmentClient,version:d.version,runtimeVersion:d.runtimeVersion,buildNumber:d.buildNumber,versionCode:d.versionCode,summary:d.summary,error:S,artifacts:d.artifacts||[]}),E.error(_.red(`
+\u2717 ${y?"Build cancelled":"Build failed"}: ${S}`)),process.exit(1)}else if(o==="completed"||o==="success"){n.quiet||r.stop("Build successful!"),ln(n,{status:o,projectId:e,buildId:t,platform:n.platform,profile:d.buildProfile,buildType:d.buildType,developmentClient:!!d.developmentClient,version:d.version,runtimeVersion:d.runtimeVersion,buildNumber:d.buildNumber,versionCode:d.versionCode,summary:d.summary,artifacts:d.artifacts||[]}),E.success(_.green(`
+\u2713 Build completed successfully!`));try{n.quiet||(E.info(_.magenta(`
+\u{1F4F1} Installation Hub:`)),E.info(_.dim("  - View & Install Build: ")+_.white.underline(`${je}/build/${t}`)))}catch{}return}else if(o!=="pending"){n.quiet||r.stop(`Build status: ${o}`);return}}try{let c=await $.get(`/builds/${e}/${t}/logs`),u=typeof c.data=="string"?Ns(c.data):c.data;if(u&&typeof u=="string"&&!n.quiet){let f=u.split(`
+`);if(f.length>s){for(let p=s;p<f.length;p++)f[p].trim()&&console.log(_.dim(`  ${f[p]}`));s=f.length}}}catch{}a=0}catch{a++,a>10&&(r.stop("Connection lost."),E.error(_.red(`
+\u2717 Lost connection to Dashboard API.`)),process.exit(1))}await new Promise(l=>setTimeout(l,3e3))}}import*as oi from"http";import*as da from"net";import{execFile as ep,execFileSync as st,execSync as ni,spawn as ia}from"child_process";import ne from"chalk";import{log as F}from"@clack/prompts";import tp from"axios";import J from"fs";import xe from"os";import U from"path";var qe=7070,cn=`http://127.0.0.1:${qe}`,Ct="com.radhya.mach.agent",Dt="Mach Agent",Tt=`${Ct}.service`,np=5e3,ip=3e3,ei=null,ti=null,Le=()=>U.join(xe.homedir(),m.configDir),ca=()=>U.join(xe.homedir(),"Library","LaunchAgents"),ii=()=>U.join(ca(),`${Ct}.plist`),ua=()=>U.join(xe.homedir(),".config","systemd","user"),$r=()=>U.join(ua(),Tt),wr=()=>U.join(Le(),"agent.cmd");function vr(){return`gui/${process.getuid?.()||Number(ni("id -u").toString().trim())}`}function pa(e){return e.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;").replace(/'/g,"&apos;")}function dn(e){return`<string>${pa(e)}</string>`}function Rr(){let e=process.argv[1]?J.realpathSync(process.argv[1]):"";if(!e||!J.existsSync(e))throw new Error("Could not resolve the current Mach CLI entrypoint.");return[process.execPath,e,"agent","run"]}function Or(){let e=fa(),t=process.platform==="win32"?[process.env.SystemRoot?U.join(process.env.SystemRoot,"System32"):void 0,process.env.SystemRoot]:["/opt/homebrew/bin","/usr/local/bin","/usr/bin","/bin","/usr/sbin","/sbin"],n={HOME:xe.homedir(),PATH:[process.env.PATH,...e.flatMap(i=>[U.join(i,"platform-tools"),U.join(i,"emulator"),U.join(i,"cmdline-tools","latest","bin"),U.join(i,"tools","bin")]),...t].filter(Boolean).join(U.delimiter)};for(let i of["ANDROID_HOME","ANDROID_SDK_ROOT","JAVA_HOME","SHELL"])process.env[i]&&(n[i]=process.env[i]);return n}function fa(){let e=[process.env.ANDROID_HOME,process.env.ANDROID_SDK_ROOT];if(process.platform==="darwin")e.push(U.join(xe.homedir(),"Library","Android","sdk"));else if(process.platform==="linux")e.push(U.join(xe.homedir(),"Android","Sdk"),U.join(xe.homedir(),"Android","sdk"),"/opt/android-sdk","/usr/lib/android-sdk");else if(process.platform==="win32"){let t=process.env.LOCALAPPDATA,n=process.env.USERPROFILE||xe.homedir();e.push(t?U.join(t,"Android","Sdk"):void 0,U.join(n,"AppData","Local","Android","Sdk"))}return Array.from(new Set(e.filter(t=>!!t)))}function rp(e){return process.platform==="win32"&&!e.toLowerCase().endsWith(".exe")?`${e}.exe`:e}function ma(e,t){let n=rp(e);for(let i of fa()){let r=U.join(i,t,n);if(J.existsSync(r))return r}return n}function ga(){return ma("adb","platform-tools")}function ha(){return ma("emulator","emulator")}function _r(e){return`"${e.replace(/\\/g,"\\\\").replace(/"/g,'\\"').replace(/%/g,"%%")}"`}function op(){if(process.platform!=="linux")throw new Error("Linux service install requires Linux.");J.mkdirSync(Le(),{recursive:!0}),J.mkdirSync(ua(),{recursive:!0});let e=Rr(),t=Or(),n=Object.entries(t).map(([r,o])=>`Environment=${_r(`${r}=${o}`)}`).join(`
 `),i=`[Unit]
 Description=Mach local device agent
 After=default.target
 
 [Service]
 Type=simple
-ExecStart=${e.map(vr).join(" ")}
-WorkingDirectory=${vr(xe.homedir())}
+ExecStart=${e.map(_r).join(" ")}
+WorkingDirectory=${_r(xe.homedir())}
 ${n}
 Restart=on-failure
 RestartSec=5
@@ -1652,20 +1875,20 @@ StandardError=append:%h/${m.configDir}/agent.error.log
 
 [Install]
 WantedBy=default.target
-`;return J.writeFileSync($r(),i),$r()}function ot(e,t={}){try{return st("systemctl",["--user",...e],{stdio:t.ignoreError?"ignore":"pipe"}),!0}catch(n){if(t.ignoreError)return!1;throw n}}function Ap(){if(process.platform!=="win32")throw new Error("Windows agent script requires Windows.");J.mkdirSync(Le(),{recursive:!0});let e=Dr(),[t,n,...i]=Pr(),r=F.join(Le(),"agent.log"),o=F.join(Le(),"agent.error.log"),s=Object.entries(e).map(([d,c])=>`set "${d}=${c}"`).join(`\r
+`;return J.writeFileSync($r(),i),$r()}function ot(e,t={}){try{return st("systemctl",["--user",...e],{stdio:t.ignoreError?"ignore":"pipe"}),!0}catch(n){if(t.ignoreError)return!1;throw n}}function sp(){if(process.platform!=="win32")throw new Error("Windows agent script requires Windows.");J.mkdirSync(Le(),{recursive:!0});let e=Or(),[t,n,...i]=Rr(),r=U.join(Le(),"agent.log"),o=U.join(Le(),"agent.error.log"),s=Object.entries(e).map(([d,c])=>`set "${d}=${c}"`).join(`\r
 `),a=i.map(d=>`"${d.replace(/"/g,'\\"')}"`).join(" "),l=`@echo off\r
 ${s}\r
 cd /d "${xe.homedir()}"\r
 "${t}" "${n}" ${a} >> "${r}" 2>> "${o}"\r
-`;return J.writeFileSync(Rr(),l),Rr()}function dn(e,t={}){try{return st("schtasks.exe",e,{stdio:t.ignoreError?"ignore":"pipe"}),!0}catch(n){if(t.ignoreError)return!1;throw n}}function yp(){if(process.platform!=="darwin")throw new Error("Background agent install currently supports macOS only.");J.mkdirSync(Le(),{recursive:!0}),J.mkdirSync(ga(),{recursive:!0});let e=Pr(),t=Dr(),n=F.join(Le(),"agent.log"),i=F.join(Le(),"agent.error.log"),r=Object.entries(t).map(([a,l])=>`      <key>${Aa(a)}</key>
-      ${an(l)}`).join(`
-`),o=e.map(a=>`      ${an(a)}`).join(`
+`;return J.writeFileSync(wr(),l),wr()}function un(e,t={}){try{return st("schtasks.exe",e,{stdio:t.ignoreError?"ignore":"pipe"}),!0}catch(n){if(t.ignoreError)return!1;throw n}}function ap(){if(process.platform!=="darwin")throw new Error("Background agent install currently supports macOS only.");J.mkdirSync(Le(),{recursive:!0}),J.mkdirSync(ca(),{recursive:!0});let e=Rr(),t=Or(),n=U.join(Le(),"agent.log"),i=U.join(Le(),"agent.error.log"),r=Object.entries(t).map(([a,l])=>`      <key>${pa(a)}</key>
+      ${dn(l)}`).join(`
+`),o=e.map(a=>`      ${dn(a)}`).join(`
 `),s=`<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
   <key>Label</key>
-  ${an(Dt)}
+  ${dn(Ct)}
   <key>ProgramArguments</key>
   <array>
 ${o}
@@ -1677,26 +1900,26 @@ ${r}
   <key>RunAtLoad</key>
   <true/>
   <key>StandardOutPath</key>
-  ${an(n)}
+  ${dn(n)}
   <key>StandardErrorPath</key>
-  ${an(i)}
+  ${dn(i)}
 </dict>
 </plist>
-`;return J.writeFileSync(ii(),s),ii()}function rt(e,t={}){try{return st("launchctl",e,{stdio:t.ignoreError?"ignore":"pipe"}),!0}catch(n){if(t.ignoreError)return!1;throw n}}function Sp(e){return new Promise(t=>setTimeout(t,e))}function ri(e,t,n=fp){return new Promise((i,r)=>{up(e,t,{timeout:n,maxBuffer:10*1024*1024,windowsHide:!0},(o,s,a)=>{if(o){let l=a?.toString().trim();r(new Error(l||o.message));return}i(s?.toString()||"")})})}async function Ia(){if(typeof fetch=="function"){let e=new AbortController,t=setTimeout(()=>e.abort(),3e3);try{return(await fetch(`${ln}/health`,{signal:e.signal})).ok}catch{return!1}finally{clearTimeout(t)}}return new Promise(e=>{let t=!1,n=r=>{t||(t=!0,e(r))},i=oi.get(`${ln}/health`,r=>{r.resume(),n(r.statusCode===200)});i.setTimeout(3e3,()=>{i.destroy(),n(!1)}),i.on("error",()=>n(!1))})}async function bp(e=8e3){let t=Date.now()+e;for(;Date.now()<t;){if(await Ia())return!0;await Sp(250)}return!1}async function _a(){return new Promise(e=>{let t=!1,n=ma.createConnection({host:"127.0.0.1",port:qe}),i=r=>{t||(t=!0,n.destroy(),e(r))};n.setTimeout(1e3),n.once("connect",()=>i(!0)),n.once("timeout",()=>i(!1)),n.once("error",()=>i(!1))})}async function Cr(){if(await bp()){B.success(ne.green("Mach agent installed and started."));return}if(await _a()){B.warn(`Mach agent service is installed, but port ${qe} is held by a process that is not answering /health.`),B.info(ne.dim(`Run \`${m.nameLower} agent stop\`, close any foreground \`${m.nameLower} agent\` terminal, then run \`${m.nameLower} agent install\` again.`));return}B.warn(`Mach agent service is installed, but it did not start listening on ${ln}.`)}async function Ep(){let e=yp(),t=Or();rt(["bootout",t,e],{ignoreError:!0}),rt(["bootstrap",t,e],{ignoreError:!0})||rt(["load","-w",e]),rt(["enable",`${t}/${Dt}`],{ignoreError:!0}),rt(["kickstart","-k",`${t}/${Dt}`],{ignoreError:!0}),await Cr(),B.info(ne.dim(`It will start automatically when you log in. Plist: ${e}`)),B.info(ne.dim(`Logs: ${F.join(Le(),"agent.log")}`))}async function wa(){let e=ii(),t=Or();rt(["bootout",t,e],{ignoreError:!0})||rt(["unload","-w",e],{ignoreError:!0})?B.success(ne.green("Mach agent service stopped.")):B.warn("Mach agent service was not loaded.")}async function Ip(){await wa();let e=ii();J.existsSync(e)&&J.unlinkSync(e),B.success(ne.green("Mach agent service uninstalled."))}async function _p(){let e=hp();ot(["daemon-reload"]),ot(["enable","--now",Ct]),await Cr(),B.info(ne.dim(`It will start automatically when you log in. Service: ${e}`)),B.info(ne.dim(`Logs: ${F.join(Le(),"agent.log")}`))}async function wp(){ot(["stop",Ct],{ignoreError:!0})?B.success(ne.green("Mach agent service stopped.")):B.warn("Mach agent service was not running.")}async function vp(){ot(["disable","--now",Ct],{ignoreError:!0}),ot(["daemon-reload"],{ignoreError:!0});let e=$r();J.existsSync(e)&&J.unlinkSync(e),ot(["daemon-reload"],{ignoreError:!0}),B.success(ne.green("Mach agent service uninstalled."))}async function $p(){let e=Ap();dn(["/Create","/TN",Pt,"/SC","ONLOGON","/TR",`"${e}"`,"/RL","LIMITED","/F"]),dn(["/Run","/TN",Pt],{ignoreError:!0}),await Cr(),B.info(ne.dim(`It will start automatically when you log in. Task: ${Pt}`)),B.info(ne.dim(`Logs: ${F.join(Le(),"agent.log")}`))}async function va(){dn(["/End","/TN",Pt],{ignoreError:!0})?B.success(ne.green("Mach agent task stopped.")):B.warn("Mach agent task was not running.")}async function Rp(){await va(),dn(["/Delete","/TN",Pt,"/F"],{ignoreError:!0});let e=Rr();J.existsSync(e)&&J.unlinkSync(e),B.success(ne.green("Mach agent task uninstalled."))}async function da(){if(process.platform==="darwin")return Ep();if(process.platform==="linux")return _p();if(process.platform==="win32")return $p();throw new Error(`Background agent install is not supported on ${process.platform}.`)}async function ca(){if(process.platform==="darwin")return wa();if(process.platform==="linux")return wp();if(process.platform==="win32")return va();B.warn(`Background agent service control is not supported on ${process.platform}.`)}async function Op(){if(process.platform==="darwin")return Ip();if(process.platform==="linux")return vp();if(process.platform==="win32")return Rp();B.warn(`Background agent uninstall is not supported on ${process.platform}.`)}async function Pp(){let e=await Ia(),t=e?!0:await _a();if(e?B.success(ne.green(`Mach agent is online at ${ln}`)):t?B.warn(`Mach agent port is open, but /health did not respond. Run \`${m.nameLower} agent restart\` if the dashboard still shows offline.`):B.warn(`Mach agent is not responding at ${ln}`),process.platform==="darwin"){let n=rt(["print",`${Or()}/${Dt}`],{ignoreError:!0});B.info(ne.dim(`Login service: ${n?"installed/loaded":"not loaded"}`))}else if(process.platform==="linux"){let n=ot(["is-enabled",Ct],{ignoreError:!0}),i=ot(["is-active",Ct],{ignoreError:!0});B.info(ne.dim(`Login service: ${n?"enabled":"not enabled"} / ${i?"active":"inactive"}`))}else if(process.platform==="win32"){let n=dn(["/Query","/TN",Pt],{ignoreError:!0});B.info(ne.dim(`Login task: ${n?"installed":"not installed"}`))}}async function Dp(){let e=[];try{(await ri(ba(),["devices","-l"])).split(`
-`).forEach(n=>{if(n.includes("List of devices")||!n.trim())return;let i=n.split(/\s+/);if(i.length<2||i[1]!=="device")return;let r=i[0],o=n.match(/model:([^\s]+)/);e.push({id:r,platform:"android",type:r.startsWith("emulator-")?"emulator":"physical",name:o?o[1].replace(/_/g," "):r,status:"online",details:n.trim()})})}catch{}try{let n=(await ri(Ea(),["-list-avds"])).split(`
-`).filter(r=>!!r.trim()),i=e.some(r=>r.platform==="android"&&r.id.startsWith("emulator-"));n.forEach(r=>{i||e.push({id:r,platform:"android",type:"emulator",name:r.replace(/_/g," "),status:"offline",details:`Android Virtual Device: ${r}`})})}catch{}return e}async function $a(){if(process.platform!=="darwin")return[];try{let e=await ri("/usr/bin/xcrun",["simctl","list","devices","--json"]),t=JSON.parse(e),n=[];return Object.entries(t.devices||{}).forEach(([i,r])=>{r.forEach(o=>{o.isAvailable&&n.push({id:o.udid,platform:"ios",type:"simulator",name:o.name,status:o.state?.toLowerCase()==="booted"?"online":"offline",runtime:i,details:`${o.name} (${i})`})})}),n}catch{return[]}}async function Cp(){if(process.platform!=="darwin")return[];try{let e=await ri("/usr/bin/xcrun",["devicectl","list","devices","--json-output","-"]);return(JSON.parse(e).result?.devices||[]).filter(n=>{let i=n.connectionProperties?.transportType;return i==="wired"||i==="localNetwork"}).map(n=>{let i=n.connectionProperties?.transportType,r=n.deviceProperties?.name||"iPhone";return{id:n.identifier,platform:"ios",type:"physical",name:r,status:"online",details:`${r} (${n.model?.name||n.hardwareModel||""}) - ${i}`}})}catch{return[]}}async function Tp(e){let t=await $a(),n=t.find(r=>r.id===e);if(n)return n;let i=t.filter(r=>r.status==="online");return i.length===1?i[0]:null}async function kp(){let[e,t,n]=await Promise.all([Dp(),$a(),Cp()]);return[...e,...t,...n]}async function Np(){let e=Date.now();return ei&&e-ei.updatedAt<mp?ei.targets:(ti||(ti=kp().then(t=>(ei={targets:t,updatedAt:Date.now()},t)).finally(()=>{ti=null})),ti)}async function ua(e){let t=[];for await(let n of e)t.push(Buffer.isBuffer(n)?n:Buffer.from(n));return t.length===0?{}:JSON.parse(Buffer.concat(t).toString("utf-8"))}async function xp(e,t){let n=await pp({method:"GET",url:e,responseType:"stream",timeout:12e4}),i=J.createWriteStream(t);n.data.pipe(i),await new Promise((r,o)=>{i.on("finish",r),i.on("error",o)})}function pa(e,t){let n=e?.stderr?.toString?.().trim();if(n)return n;let i=e?.stdout?.toString?.().trim();return i||e?.message||t}function Lp(e,t){return st("/usr/libexec/PlistBuddy",["-c",`Print :${t}`,e],{encoding:"utf-8"}).trim()}function Mp(e){let t=F.join(e,"Info.plist");if(!J.existsSync(t))throw new Error(`Could not validate iOS app executable: ${t} not found.`);let n=Lp(t,"CFBundleExecutable"),i=F.join(e,n);if(!J.existsSync(i))throw new Error(`Could not validate iOS app executable: ${i} not found.`);return i}function Up(){return process.arch==="arm64"?"arm64":"x86_64"}function Fp(e){return J.existsSync(e)?J.readdirSync(e).map(t=>F.join(e,t)).filter(t=>t.endsWith(".app")&&J.statSync(t).isDirectory()):[]}function fa(e,t){let n=Fp(e);if(n.length===1)return n[0];if(n.length>1)throw new Error(`Multiple .app bundles found in ${t}: ${n.map(i=>F.basename(i)).join(", ")}. Mach cannot safely choose which app to install.`);return""}function Bp(e){let t=Mp(e),n=Up(),i="",r="";try{i=st("lipo",["-info",t],{encoding:"utf-8"}).trim()}catch(o){throw new Error(`Could not inspect iOS simulator app architecture for ${F.basename(e)}: ${o.message}`)}if(!new RegExp(`\\b${n}\\b`).test(i))throw new Error(`This iOS simulator artifact cannot be installed because ${F.basename(e)} does not include the ${n} simulator architecture. lipo output: ${i}. Rebuild the app with the latest Mach CLI and make sure the profile is a simulator build.`);try{r=st("/usr/bin/xcrun",["vtool","-show-build",t],{encoding:"utf-8"}).trim()}catch(o){throw new Error(`Could not inspect iOS simulator app platform for ${F.basename(e)}: ${o.message}`)}if(!/\bplatform\s+IOSSIMULATOR\b/i.test(r))throw new Error(`This iOS simulator artifact cannot be installed because ${F.basename(e)} was built for the wrong Apple platform. A simulator artifact must contain platform IOSSIMULATOR. vtool output: ${r}. Rebuild the app with the latest Mach CLI.`)}async function Hp(e,t,n){let i=n||(t.toLowerCase().includes(".apk")?"android":"ios"),r=t.toLowerCase().includes(".ipa"),o=J.mkdtempSync(F.join(xe.tmpdir(),`${qe}-install-`)),s=F.join(o,i==="android"?"install.apk":r?"install.ipa":"install.zip");try{if(await xp(t,s),i==="android"){st(ba(),["-s",e,"install","-r",s],{stdio:"pipe"});return}if(process.platform!=="darwin")throw new Error("iOS local install requires macOS.");ni(`unzip -o ${JSON.stringify(s)} -d ${JSON.stringify(o)}`,{stdio:"pipe"});let a=F.join(o,"Payload"),l=J.existsSync(a),d=r||l,c="";if(d?c=fa(a,"Payload"):c=fa(o,"the simulator artifact"),!c)throw new Error(`No .app bundle found inside the ${r?"IPA":"archive"}.`);let u=d?null:await Tp(e);if(u){try{Bp(c),st("/usr/bin/xcrun",["simctl","install",u.id,c],{stdio:"pipe"})}catch(f){throw new Error(pa(f,"iOS Simulator install failed."))}return}if(!d)throw new Error("Selected iOS Simulator was not found. Refresh Install Hub devices or boot one simulator and try again.");try{ni(`/usr/bin/xcrun devicectl device install app --device ${JSON.stringify(e)} ${JSON.stringify(c)}`,{stdio:"pipe"})}catch(f){throw new Error(pa(f,"iOS device install failed."))}}finally{J.rmSync(o,{recursive:!0,force:!0})}}function jp(e,t){if(!e)throw new Error("Device id is required.");if(t==="ios"){if(process.platform!=="darwin")throw new Error("iOS Simulator launch requires macOS.");return ni(`/usr/bin/xcrun simctl boot ${JSON.stringify(e)}`,{stdio:"pipe"}),la("open",["-a","Simulator"],{detached:!0,stdio:"ignore"}).unref(),"Simulator booting..."}if(t==="android")return la(Ea(),["-avd",e],{detached:!0,stdio:"ignore",windowsHide:!0}).unref(),"Emulator booting in background...";throw new Error("Invalid platform.")}async function Gp(){process.platform!=="darwin"&&B.warn("Running on non-macOS \u2014 iOS discovery unavailable, Android only.");let e=oi.createServer((i,r)=>{if(r.setHeader("Access-Control-Allow-Origin","*"),r.setHeader("Access-Control-Allow-Methods","GET, POST, OPTIONS"),r.setHeader("Access-Control-Allow-Headers","Content-Type, Authorization"),i.method==="OPTIONS"){r.writeHead(204),r.end();return}let o=new URL(i.url||"/",`http://localhost:${qe}`);if(i.method==="GET"&&o.pathname==="/local/devices"){Np().then(s=>{r.writeHead(200,{"Content-Type":"application/json"}),r.end(JSON.stringify({status:"success",targets:s}))}).catch(s=>{r.writeHead(500,{"Content-Type":"application/json"}),r.end(JSON.stringify({status:"error",message:s.message}))});return}if(i.method==="GET"&&o.pathname==="/health"){r.writeHead(200,{"Content-Type":"application/json"}),r.end(JSON.stringify({status:"success",service:"mach-agent",port:qe,platform:process.platform}));return}if(i.method==="POST"&&o.pathname==="/install-local"){t(i,r);return}if(i.method==="POST"&&o.pathname==="/local/boot"){n(i,r);return}r.writeHead(404),r.end()}),t=async(i,r)=>{try{let{deviceId:o,artifactUrl:s,platform:a}=await ua(i);if(!o||!s){r.writeHead(400,{"Content-Type":"application/json"}),r.end(JSON.stringify({status:"error",message:"deviceId and artifactUrl are required"}));return}await Hp(o,s,a),r.writeHead(200,{"Content-Type":"application/json"}),r.end(JSON.stringify({status:"success",message:`Installed on ${o}`}))}catch(o){r.writeHead(500,{"Content-Type":"application/json"}),r.end(JSON.stringify({status:"error",message:o.message||"Local install failed"}))}},n=async(i,r)=>{try{let{id:o,platform:s}=await ua(i),a=jp(o,s);r.writeHead(200,{"Content-Type":"application/json"}),r.end(JSON.stringify({status:"success",message:a}))}catch(o){r.writeHead(500,{"Content-Type":"application/json"}),r.end(JSON.stringify({status:"error",message:o.message||"Local device launch failed"}))}};e.listen(qe,"127.0.0.1",()=>{B.success(ne.green(`Local device agent running on http://localhost:${qe}`)),B.info(ne.dim("Keep this running while using the Install Hub on the dashboard.")),B.info(ne.dim("Press Ctrl+C to stop."))}),e.on("error",i=>{i.code==="EADDRINUSE"?B.error(`Port ${qe} is already in use \u2014 agent may already be running.`):B.error(`Agent error: ${i.message}`),process.exit(1)}),await new Promise(()=>{})}async function Ra(e="start"){let t=String(e||"start").toLowerCase();if(t==="start"||t==="run"){await Gp();return}if(t==="install"){await da();return}if(t==="status"){await Pp();return}if(t==="stop"){await ca();return}if(t==="uninstall"){await Op();return}if(t==="restart"){await ca(),await da();return}B.error(`Unknown agent action: ${e}`),B.info(ne.dim(`Use: ${m.nameLower} agent start | install | status | restart | stop | uninstall`)),process.exit(1)}import{text as zp,password as Kp,spinner as Wp,isCancel as Da}from"@clack/prompts";import xr from"chalk";import cn from"fs";import Oa from"path";import Vp from"os";var Tr=Oa.join(Vp.homedir(),m.configDir),kr=Oa.join(Tr,"config.json");function Nr(){if(!cn.existsSync(kr))return{};try{return JSON.parse(cn.readFileSync(kr,"utf-8"))}catch{return{}}}function Pa(e){cn.existsSync(Tr)||cn.mkdirSync(Tr,{recursive:!0});let n={...Nr(),...e};cn.writeFileSync(kr,JSON.stringify(n,null,2))}async function Ca(){let e=Nr(),t=await zp({message:"Enter your email:",placeholder:"user@example.com",initialValue:e.lastLoginEmail,validate(r){if(r.length===0)return"Email is required!"}});if(Da(t))return;let n=await Kp({message:"Enter your password:",validate(r){if(r.length===0)return"Password is required!"}});if(Da(n))return;let i=Wp();i.start("Authenticating...");try{let o=await(await fetch(`${Qe}/login`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({username:t,password:n})})).json();o.status==="success"&&o.user.token?(go({id:o.user.id,email:t,token:o.user.token,refreshToken:o.user.refreshToken}),Pa({lastLoginEmail:t}),i.stop(xr.green("Login successful!"))):i.stop(xr.red("Login failed: "+(o.message||"Unknown error")))}catch(r){i.stop(xr.red("Network error: "+r.message))}}import{log as si,outro as Yp}from"@clack/prompts";import un from"chalk";async function Ta(){let e=ho(),t=`${m.envPrefix}TOKEN`;e?si.success(un.green(`Logged out. Removed saved credentials from ~/${m.configDir}/credentials.json.`)):si.warn(un.yellow(`No saved ${m.name} credentials found.`)),process.env[t]&&(si.warn(un.yellow(`${t} is still set in this shell. Commands will continue to authenticate with that token until you unset it.`)),si.info(un.dim(`Run: unset ${t}`))),Yp(un.blue("---"))}import{outro as qp,select as Jp,spinner as Xp,isCancel as Zp}from"@clack/prompts";import ai from"chalk";import Lr from"fs";import Qp from"path";var ka=e=>e==="1234567890"||e==="ABC123DEFG"||e==="XXXXXXXXXX"?"":typeof e=="string"?e:"",ef=()=>process.versions.node.split(".")[0]||"24";async function Na(){if(!ye()){console.log(ai.red(`You are not logged in. Run \`${m.nameLower} login\` first.`));return}let t=Xp();t.start("Fetching projects...");try{let{data:n}=await $.get("/projects");if(t.stop("Projects loaded."),n.status!=="success"||!n.projects||n.projects.length===0){console.log(ai.yellow(`No projects found. Run \`${m.nameLower} init\` to create one.`));return}let i=n.projects.map(g=>({value:g.projectId,label:`${g.name} (${g.slug})`})),r=await Jp({message:"Select a project to link:",options:i});if(Zp(r))return;let o=Qp.join(process.cwd(),m.configFileName),s={};if(Lr.existsSync(o))try{s=JSON.parse(Lr.readFileSync(o,"utf-8"))}catch{}let a=n.projects.find(g=>g.projectId===r),l=s.android?.package||It("android"),d=s.ios?.bundleIdentifier||It("ios"),c=s.android||{},u=s.submit?.production?.android||{},f=s.submit?.production?.ios||{},p={projectId:r,framework:Re(s.framework)||Un,...s.appDirectory?{appDirectory:s.appDirectory}:{},name:a?.name,slug:a?.slug,nodeVersion:s.nodeVersion||ef(),scheme:a?.slug?.toLowerCase()||"app",android:{...c,package:l||"",versionCode:c.versionCode||"auto"},ios:{bundleIdentifier:d||"",buildNumber:s.ios?.buildNumber||"auto"},build:{development:{environment:"development",distribution:"development"},staging:{environment:"staging",distribution:"internal"},production:{environment:"production",distribution:"store"}},submit:{production:{android:{...u,track:u.track||"internal",releaseStatus:u.releaseStatus||"completed"},ios:{ascAppId:ka(f.ascAppId),appleTeamId:ka(f.appleTeamId)}}}};Lr.writeFileSync(o,JSON.stringify(p,null,2)),qp(ai.green(`Linked to project ${p.name} (${p.slug})`))}catch(n){t.stop(ai.red("Error fetching projects: "+n.message))}}import{outro as tf,text as pn,select as nf,spinner as rf,isCancel as Tt}from"@clack/prompts";import fn from"chalk";import of from"fs";import sf from"path";import{randomUUID as af}from"crypto";var lf=()=>process.versions.node.split(".")[0]||"24";async function xa(){if(!ye()){console.log(fn.red(`You are not logged in. Run \`${m.nameLower} login\` first.`));return}let t=await pn({message:"Project Name:",placeholder:"My Awesome App",validate(c){if(c.length===0)return"Name is required!"}});if(Tt(t))return;let n=await pn({message:"Project Slug (URL friendly):",placeholder:"my-awesome-app",validate(c){if(c.length===0)return"Slug is required!";if(!/^[a-z0-9-]+$/.test(c))return"Slug must be lowercase alphanumeric with dashes."}});if(Tt(n))return;let i=Io(process.cwd()),r=await pn({message:"App Directory (relative to this project root):",initialValue:i||void 0,placeholder:".",validate(c){if(c.length===0)return"App directory is required!";try{Gt(process.cwd(),c,{requireAppDirectory:!0})}catch(u){return u.message}}});if(Tt(r))return;let o=_o(process.cwd(),r),s=await nf({message:"Platform:",options:[{value:"android",label:"Android"},{value:"ios",label:"iOS"},{value:"web",label:"Web"},{value:"all",label:"All Platforms"}]});if(Tt(s))return;let a="";if(s==="android"||s==="all"){let c=It("android",r);if(a=await pn({message:"Android Package Name:",initialValue:c||"",placeholder:"com.example.app",validate(u){if(u.length===0)return"Package name is required for Android!"}}),Tt(a))return}let l="";if(s==="ios"||s==="all"){let c=It("ios",r);if(l=await pn({message:"iOS Bundle Identifier:",initialValue:c||"",placeholder:"com.example.app",validate(u){if(u.length===0)return"Bundle ID is required for iOS!"}}),Tt(l))return}let d=rf();d.start("Creating project...");try{let c=af(),f={projectId:c,name:t,slug:n,storageType:"managed",platforms:s==="all"?["android","ios","web"]:[s]},{data:p}=await $.post("/projects",f);if(p.status==="success"){d.stop(fn.green("Project created successfully!"));let g=sf.join(process.cwd(),m.configFileName);of.writeFileSync(g,JSON.stringify({projectId:c,framework:o,appDirectory:r,name:t,slug:n,nodeVersion:lf(),...a?{android:{package:a,versionCode:"auto"}}:{},...l?{ios:{bundleIdentifier:l,buildNumber:"auto"}}:{},build:{development:{environment:"development",distribution:"development"},staging:{environment:"staging",distribution:"internal"},production:{environment:"production",distribution:"store"}},submit:{production:{android:{track:"internal",releaseStatus:"completed"},ios:{ascAppId:"",appleTeamId:""}}}},null,2)),tf(fn.green(`Initialized project ${t} and linked locally!`))}else d.stop(fn.red("creation failed: "+p.message))}catch(c){d.stop(fn.red("Network error: "+c.message))}}import{spinner as Mr,log as Ee}from"@clack/prompts";import mn from"chalk";import li from"fs";import La from"path";function Ur(e,t,n,i){let r=e?.response?.status,o=e?.response?.data?.message||e?.response?.data?.error,s=i?` ${i}`:"";return r===401?`Not logged in or token expired while trying to ${n}${s}. Run \`${m.nameLower} login\` and try again.`:r===403?[`Permission denied while trying to ${n}${s}.`,o?`API says: ${o}.`:void 0,`Current Mach account/token does not have access to project ${t}.`,`Run \`${m.nameLower} login\` with the correct account, or ask a project owner to grant access.`].filter(Boolean).join(" "):r===404?[`Project or environment endpoint was not found while trying to ${n}${s}.`,`Project ID: ${t}.`,o?`API says: ${o}.`:void 0].filter(Boolean).join(" "):r?`Failed to ${n}${s}: ${o||`API returned HTTP ${r}`}`:`Network error while trying to ${n}${s}: ${e?.message||"Unknown error"}`}function df(e){let t=String(e??"");return t===""?'""':/^[A-Za-z0-9_./:@%+-]+$/.test(t)?t:JSON.stringify(t)}function cf(e,t){return`${[`# Generated by ${m.nameLower} env pull --environment ${t}`,"# Do not commit this file.","",...Object.keys(e).sort((i,r)=>i.localeCompare(r)).map(i=>`${i}=${df(e[i])}`)].join(`
+`;return J.writeFileSync(ii(),s),ii()}function rt(e,t={}){try{return st("launchctl",e,{stdio:t.ignoreError?"ignore":"pipe"}),!0}catch(n){if(t.ignoreError)return!1;throw n}}function lp(e){return new Promise(t=>setTimeout(t,e))}function ri(e,t,n=np){return new Promise((i,r)=>{ep(e,t,{timeout:n,maxBuffer:10*1024*1024,windowsHide:!0},(o,s,a)=>{if(o){let l=a?.toString().trim();r(new Error(l||o.message));return}i(s?.toString()||"")})})}async function Aa(){if(typeof fetch=="function"){let e=new AbortController,t=setTimeout(()=>e.abort(),3e3);try{return(await fetch(`${cn}/health`,{signal:e.signal})).ok}catch{return!1}finally{clearTimeout(t)}}return new Promise(e=>{let t=!1,n=r=>{t||(t=!0,e(r))},i=oi.get(`${cn}/health`,r=>{r.resume(),n(r.statusCode===200)});i.setTimeout(3e3,()=>{i.destroy(),n(!1)}),i.on("error",()=>n(!1))})}async function dp(e=8e3){let t=Date.now()+e;for(;Date.now()<t;){if(await Aa())return!0;await lp(250)}return!1}async function ya(){return new Promise(e=>{let t=!1,n=da.createConnection({host:"127.0.0.1",port:qe}),i=r=>{t||(t=!0,n.destroy(),e(r))};n.setTimeout(1e3),n.once("connect",()=>i(!0)),n.once("timeout",()=>i(!1)),n.once("error",()=>i(!1))})}async function Pr(){if(await dp()){F.success(ne.green("Mach agent installed and started."));return}if(await ya()){F.warn(`Mach agent service is installed, but port ${qe} is held by a process that is not answering /health.`),F.info(ne.dim(`Run \`${m.nameLower} agent stop\`, close any foreground \`${m.nameLower} agent\` terminal, then run \`${m.nameLower} agent install\` again.`));return}F.warn(`Mach agent service is installed, but it did not start listening on ${cn}.`)}async function cp(){let e=ap(),t=vr();rt(["bootout",t,e],{ignoreError:!0}),rt(["bootstrap",t,e],{ignoreError:!0})||rt(["load","-w",e]),rt(["enable",`${t}/${Ct}`],{ignoreError:!0}),rt(["kickstart","-k",`${t}/${Ct}`],{ignoreError:!0}),await Pr(),F.info(ne.dim(`It will start automatically when you log in. Plist: ${e}`)),F.info(ne.dim(`Logs: ${U.join(Le(),"agent.log")}`))}async function Sa(){let e=ii(),t=vr();rt(["bootout",t,e],{ignoreError:!0})||rt(["unload","-w",e],{ignoreError:!0})?F.success(ne.green("Mach agent service stopped.")):F.warn("Mach agent service was not loaded.")}async function up(){await Sa();let e=ii();J.existsSync(e)&&J.unlinkSync(e),F.success(ne.green("Mach agent service uninstalled."))}async function pp(){let e=op();ot(["daemon-reload"]),ot(["enable","--now",Tt]),await Pr(),F.info(ne.dim(`It will start automatically when you log in. Service: ${e}`)),F.info(ne.dim(`Logs: ${U.join(Le(),"agent.log")}`))}async function fp(){ot(["stop",Tt],{ignoreError:!0})?F.success(ne.green("Mach agent service stopped.")):F.warn("Mach agent service was not running.")}async function mp(){ot(["disable","--now",Tt],{ignoreError:!0}),ot(["daemon-reload"],{ignoreError:!0});let e=$r();J.existsSync(e)&&J.unlinkSync(e),ot(["daemon-reload"],{ignoreError:!0}),F.success(ne.green("Mach agent service uninstalled."))}async function gp(){let e=sp();un(["/Create","/TN",Dt,"/SC","ONLOGON","/TR",`"${e}"`,"/RL","LIMITED","/F"]),un(["/Run","/TN",Dt],{ignoreError:!0}),await Pr(),F.info(ne.dim(`It will start automatically when you log in. Task: ${Dt}`)),F.info(ne.dim(`Logs: ${U.join(Le(),"agent.log")}`))}async function ba(){un(["/End","/TN",Dt],{ignoreError:!0})?F.success(ne.green("Mach agent task stopped.")):F.warn("Mach agent task was not running.")}async function hp(){await ba(),un(["/Delete","/TN",Dt,"/F"],{ignoreError:!0});let e=wr();J.existsSync(e)&&J.unlinkSync(e),F.success(ne.green("Mach agent task uninstalled."))}async function ra(){if(process.platform==="darwin")return cp();if(process.platform==="linux")return pp();if(process.platform==="win32")return gp();throw new Error(`Background agent install is not supported on ${process.platform}.`)}async function oa(){if(process.platform==="darwin")return Sa();if(process.platform==="linux")return fp();if(process.platform==="win32")return ba();F.warn(`Background agent service control is not supported on ${process.platform}.`)}async function Ap(){if(process.platform==="darwin")return up();if(process.platform==="linux")return mp();if(process.platform==="win32")return hp();F.warn(`Background agent uninstall is not supported on ${process.platform}.`)}async function yp(){let e=await Aa(),t=e?!0:await ya();if(e?F.success(ne.green(`Mach agent is online at ${cn}`)):t?F.warn(`Mach agent port is open, but /health did not respond. Run \`${m.nameLower} agent restart\` if the dashboard still shows offline.`):F.warn(`Mach agent is not responding at ${cn}`),process.platform==="darwin"){let n=rt(["print",`${vr()}/${Ct}`],{ignoreError:!0});F.info(ne.dim(`Login service: ${n?"installed/loaded":"not loaded"}`))}else if(process.platform==="linux"){let n=ot(["is-enabled",Tt],{ignoreError:!0}),i=ot(["is-active",Tt],{ignoreError:!0});F.info(ne.dim(`Login service: ${n?"enabled":"not enabled"} / ${i?"active":"inactive"}`))}else if(process.platform==="win32"){let n=un(["/Query","/TN",Dt],{ignoreError:!0});F.info(ne.dim(`Login task: ${n?"installed":"not installed"}`))}}async function Sp(){let e=[];try{(await ri(ga(),["devices","-l"])).split(`
+`).forEach(n=>{if(n.includes("List of devices")||!n.trim())return;let i=n.split(/\s+/);if(i.length<2||i[1]!=="device")return;let r=i[0],o=n.match(/model:([^\s]+)/);e.push({id:r,platform:"android",type:r.startsWith("emulator-")?"emulator":"physical",name:o?o[1].replace(/_/g," "):r,status:"online",details:n.trim()})})}catch{}try{let n=(await ri(ha(),["-list-avds"])).split(`
+`).filter(r=>!!r.trim()),i=e.some(r=>r.platform==="android"&&r.id.startsWith("emulator-"));n.forEach(r=>{i||e.push({id:r,platform:"android",type:"emulator",name:r.replace(/_/g," "),status:"offline",details:`Android Virtual Device: ${r}`})})}catch{}return e}async function Ia(){if(process.platform!=="darwin")return[];try{let e=await ri("/usr/bin/xcrun",["simctl","list","devices","--json"]),t=JSON.parse(e),n=[];return Object.entries(t.devices||{}).forEach(([i,r])=>{r.forEach(o=>{o.isAvailable&&n.push({id:o.udid,platform:"ios",type:"simulator",name:o.name,status:o.state?.toLowerCase()==="booted"?"online":"offline",runtime:i,details:`${o.name} (${i})`})})}),n}catch{return[]}}async function bp(){if(process.platform!=="darwin")return[];try{let e=await ri("/usr/bin/xcrun",["devicectl","list","devices","--json-output","-"]);return(JSON.parse(e).result?.devices||[]).filter(n=>{let i=n.connectionProperties?.transportType;return i==="wired"||i==="localNetwork"}).map(n=>{let i=n.connectionProperties?.transportType,r=n.deviceProperties?.name||"iPhone";return{id:n.identifier,platform:"ios",type:"physical",name:r,status:"online",details:`${r} (${n.model?.name||n.hardwareModel||""}) - ${i}`}})}catch{return[]}}async function Ip(e){let t=await Ia(),n=t.find(r=>r.id===e);if(n)return n;let i=t.filter(r=>r.status==="online");return i.length===1?i[0]:null}async function Ep(){let[e,t,n]=await Promise.all([Sp(),Ia(),bp()]);return[...e,...t,...n]}async function _p(){let e=Date.now();return ei&&e-ei.updatedAt<ip?ei.targets:(ti||(ti=Ep().then(t=>(ei={targets:t,updatedAt:Date.now()},t)).finally(()=>{ti=null})),ti)}async function sa(e){let t=[];for await(let n of e)t.push(Buffer.isBuffer(n)?n:Buffer.from(n));return t.length===0?{}:JSON.parse(Buffer.concat(t).toString("utf-8"))}async function $p(e,t){let n=await tp({method:"GET",url:e,responseType:"stream",timeout:12e4}),i=J.createWriteStream(t);n.data.pipe(i),await new Promise((r,o)=>{i.on("finish",r),i.on("error",o)})}function aa(e,t){let n=e?.stderr?.toString?.().trim();if(n)return n;let i=e?.stdout?.toString?.().trim();return i||e?.message||t}function wp(e,t){return st("/usr/libexec/PlistBuddy",["-c",`Print :${t}`,e],{encoding:"utf-8"}).trim()}function vp(e){let t=U.join(e,"Info.plist");if(!J.existsSync(t))throw new Error(`Could not validate iOS app executable: ${t} not found.`);let n=wp(t,"CFBundleExecutable"),i=U.join(e,n);if(!J.existsSync(i))throw new Error(`Could not validate iOS app executable: ${i} not found.`);return i}function Rp(){return process.arch==="arm64"?"arm64":"x86_64"}function Op(e){return J.existsSync(e)?J.readdirSync(e).map(t=>U.join(e,t)).filter(t=>t.endsWith(".app")&&J.statSync(t).isDirectory()):[]}function la(e,t){let n=Op(e);if(n.length===1)return n[0];if(n.length>1)throw new Error(`Multiple .app bundles found in ${t}: ${n.map(i=>U.basename(i)).join(", ")}. Mach cannot safely choose which app to install.`);return""}function Pp(e){let t=vp(e),n=Rp(),i="",r="";try{i=st("lipo",["-info",t],{encoding:"utf-8"}).trim()}catch(o){throw new Error(`Could not inspect iOS simulator app architecture for ${U.basename(e)}: ${o.message}`)}if(!new RegExp(`\\b${n}\\b`).test(i))throw new Error(`This iOS simulator artifact cannot be installed because ${U.basename(e)} does not include the ${n} simulator architecture. lipo output: ${i}. Rebuild the app with the latest Mach CLI and make sure the profile is a simulator build.`);try{r=st("/usr/bin/xcrun",["vtool","-show-build",t],{encoding:"utf-8"}).trim()}catch(o){throw new Error(`Could not inspect iOS simulator app platform for ${U.basename(e)}: ${o.message}`)}if(!/\bplatform\s+IOSSIMULATOR\b/i.test(r))throw new Error(`This iOS simulator artifact cannot be installed because ${U.basename(e)} was built for the wrong Apple platform. A simulator artifact must contain platform IOSSIMULATOR. vtool output: ${r}. Rebuild the app with the latest Mach CLI.`)}async function Dp(e,t,n){let i=n||(t.toLowerCase().includes(".apk")?"android":"ios"),r=t.toLowerCase().includes(".ipa"),o=J.mkdtempSync(U.join(xe.tmpdir(),`${qe}-install-`)),s=U.join(o,i==="android"?"install.apk":r?"install.ipa":"install.zip");try{if(await $p(t,s),i==="android"){st(ga(),["-s",e,"install","-r",s],{stdio:"pipe"});return}if(process.platform!=="darwin")throw new Error("iOS local install requires macOS.");ni(`unzip -o ${JSON.stringify(s)} -d ${JSON.stringify(o)}`,{stdio:"pipe"});let a=U.join(o,"Payload"),l=J.existsSync(a),d=r||l,c="";if(d?c=la(a,"Payload"):c=la(o,"the simulator artifact"),!c)throw new Error(`No .app bundle found inside the ${r?"IPA":"archive"}.`);let u=d?null:await Ip(e);if(u){try{Pp(c),st("/usr/bin/xcrun",["simctl","install",u.id,c],{stdio:"pipe"})}catch(f){throw new Error(aa(f,"iOS Simulator install failed."))}return}if(!d)throw new Error("Selected iOS Simulator was not found. Refresh Install Hub devices or boot one simulator and try again.");try{ni(`/usr/bin/xcrun devicectl device install app --device ${JSON.stringify(e)} ${JSON.stringify(c)}`,{stdio:"pipe"})}catch(f){throw new Error(aa(f,"iOS device install failed."))}}finally{J.rmSync(o,{recursive:!0,force:!0})}}function Cp(e,t){if(!e)throw new Error("Device id is required.");if(t==="ios"){if(process.platform!=="darwin")throw new Error("iOS Simulator launch requires macOS.");return ni(`/usr/bin/xcrun simctl boot ${JSON.stringify(e)}`,{stdio:"pipe"}),ia("open",["-a","Simulator"],{detached:!0,stdio:"ignore"}).unref(),"Simulator booting..."}if(t==="android")return ia(ha(),["-avd",e],{detached:!0,stdio:"ignore",windowsHide:!0}).unref(),"Emulator booting in background...";throw new Error("Invalid platform.")}async function Tp(){process.platform!=="darwin"&&F.warn("Running on non-macOS \u2014 iOS discovery unavailable, Android only.");let e=oi.createServer((i,r)=>{if(r.setHeader("Access-Control-Allow-Origin","*"),r.setHeader("Access-Control-Allow-Methods","GET, POST, OPTIONS"),r.setHeader("Access-Control-Allow-Headers","Content-Type, Authorization"),i.method==="OPTIONS"){r.writeHead(204),r.end();return}let o=new URL(i.url||"/",`http://localhost:${qe}`);if(i.method==="GET"&&o.pathname==="/local/devices"){_p().then(s=>{r.writeHead(200,{"Content-Type":"application/json"}),r.end(JSON.stringify({status:"success",targets:s}))}).catch(s=>{r.writeHead(500,{"Content-Type":"application/json"}),r.end(JSON.stringify({status:"error",message:s.message}))});return}if(i.method==="GET"&&o.pathname==="/health"){r.writeHead(200,{"Content-Type":"application/json"}),r.end(JSON.stringify({status:"success",service:"mach-agent",port:qe,platform:process.platform}));return}if(i.method==="POST"&&o.pathname==="/install-local"){t(i,r);return}if(i.method==="POST"&&o.pathname==="/local/boot"){n(i,r);return}r.writeHead(404),r.end()}),t=async(i,r)=>{try{let{deviceId:o,artifactUrl:s,platform:a}=await sa(i);if(!o||!s){r.writeHead(400,{"Content-Type":"application/json"}),r.end(JSON.stringify({status:"error",message:"deviceId and artifactUrl are required"}));return}await Dp(o,s,a),r.writeHead(200,{"Content-Type":"application/json"}),r.end(JSON.stringify({status:"success",message:`Installed on ${o}`}))}catch(o){r.writeHead(500,{"Content-Type":"application/json"}),r.end(JSON.stringify({status:"error",message:o.message||"Local install failed"}))}},n=async(i,r)=>{try{let{id:o,platform:s}=await sa(i),a=Cp(o,s);r.writeHead(200,{"Content-Type":"application/json"}),r.end(JSON.stringify({status:"success",message:a}))}catch(o){r.writeHead(500,{"Content-Type":"application/json"}),r.end(JSON.stringify({status:"error",message:o.message||"Local device launch failed"}))}};e.listen(qe,"127.0.0.1",()=>{F.success(ne.green(`Local device agent running on http://localhost:${qe}`)),F.info(ne.dim("Keep this running while using the Install Hub on the dashboard.")),F.info(ne.dim("Press Ctrl+C to stop."))}),e.on("error",i=>{i.code==="EADDRINUSE"?F.error(`Port ${qe} is already in use \u2014 agent may already be running.`):F.error(`Agent error: ${i.message}`),process.exit(1)}),await new Promise(()=>{})}async function Ea(e="start"){let t=String(e||"start").toLowerCase();if(t==="start"||t==="run"){await Tp();return}if(t==="install"){await ra();return}if(t==="status"){await yp();return}if(t==="stop"){await oa();return}if(t==="uninstall"){await Ap();return}if(t==="restart"){await oa(),await ra();return}F.error(`Unknown agent action: ${e}`),F.info(ne.dim(`Use: ${m.nameLower} agent start | install | status | restart | stop | uninstall`)),process.exit(1)}import{text as kp,password as xp,spinner as Lp,isCancel as wa}from"@clack/prompts";import Nr from"chalk";import pn from"fs";import _a from"path";import Np from"os";var Dr=_a.join(Np.homedir(),m.configDir),Cr=_a.join(Dr,"config.json");function Tr(){if(!pn.existsSync(Cr))return{};try{return JSON.parse(pn.readFileSync(Cr,"utf-8"))}catch{return{}}}function $a(e){pn.existsSync(Dr)||pn.mkdirSync(Dr,{recursive:!0});let n={...Tr(),...e};pn.writeFileSync(Cr,JSON.stringify(n,null,2))}async function va(){let e=Tr(),t=await kp({message:"Enter your email:",placeholder:"user@example.com",initialValue:e.lastLoginEmail,validate(r){if(r.length===0)return"Email is required!"}});if(wa(t))return;let n=await xp({message:"Enter your password:",validate(r){if(r.length===0)return"Password is required!"}});if(wa(n))return;let i=Lp();i.start("Authenticating...");try{let o=await(await fetch(`${Qe}/login`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({username:t,password:n})})).json();o.status==="success"&&o.user.token?(co({id:o.user.id,email:t,token:o.user.token,refreshToken:o.user.refreshToken}),$a({lastLoginEmail:t}),i.stop(Nr.green("Login successful!"))):i.stop(Nr.red("Login failed: "+(o.message||"Unknown error")))}catch(r){i.stop(Nr.red("Network error: "+r.message))}}import{log as si,outro as Mp}from"@clack/prompts";import fn from"chalk";async function Ra(){let e=uo(),t=`${m.envPrefix}TOKEN`;e?si.success(fn.green(`Logged out. Removed saved credentials from ~/${m.configDir}/credentials.json.`)):si.warn(fn.yellow(`No saved ${m.name} credentials found.`)),process.env[t]&&(si.warn(fn.yellow(`${t} is still set in this shell. Commands will continue to authenticate with that token until you unset it.`)),si.info(fn.dim(`Run: unset ${t}`))),Mp(fn.blue("---"))}import{outro as Up,select as Fp,spinner as Bp,isCancel as Hp}from"@clack/prompts";import ai from"chalk";import kr from"fs";import jp from"path";var Oa=e=>e==="1234567890"||e==="ABC123DEFG"||e==="XXXXXXXXXX"?"":typeof e=="string"?e:"",Gp=()=>process.versions.node.split(".")[0]||"24";async function Pa(){if(!ye()){console.log(ai.red(`You are not logged in. Run \`${m.nameLower} login\` first.`));return}let t=Bp();t.start("Fetching projects...");try{let{data:n}=await $.get("/projects");if(t.stop("Projects loaded."),n.status!=="success"||!n.projects||n.projects.length===0){console.log(ai.yellow(`No projects found. Run \`${m.nameLower} init\` to create one.`));return}let i=n.projects.map(h=>({value:h.projectId,label:`${h.name} (${h.slug})`})),r=await Fp({message:"Select a project to link:",options:i});if(Hp(r))return;let o=jp.join(process.cwd(),m.configFileName),s={};if(kr.existsSync(o))try{s=JSON.parse(kr.readFileSync(o,"utf-8"))}catch{}let a=n.projects.find(h=>h.projectId===r),l=s.android?.package||_t("android"),d=s.ios?.bundleIdentifier||_t("ios"),c=s.android||{},u=s.submit?.production?.android||{},f=s.submit?.production?.ios||{},p={projectId:r,framework:ve(s.framework)||Bn,...s.appDirectory?{appDirectory:s.appDirectory}:{},name:a?.name,slug:a?.slug,nodeVersion:s.nodeVersion||Gp(),scheme:a?.slug?.toLowerCase()||"app",android:{...c,package:l||"",versionCode:c.versionCode||"auto"},ios:{bundleIdentifier:d||"",buildNumber:s.ios?.buildNumber||"auto"},build:{development:{environment:"development",distribution:"development"},staging:{environment:"staging",distribution:"internal"},production:{environment:"production",distribution:"store"}},submit:{production:{android:{...u,track:u.track||"internal",releaseStatus:u.releaseStatus||"completed"},ios:{ascAppId:Oa(f.ascAppId),appleTeamId:Oa(f.appleTeamId)}}}};kr.writeFileSync(o,JSON.stringify(p,null,2)),Up(ai.green(`Linked to project ${p.name} (${p.slug})`))}catch(n){t.stop(ai.red("Error fetching projects: "+n.message))}}import{outro as Vp,text as mn,select as zp,spinner as Kp,isCancel as Nt}from"@clack/prompts";import gn from"chalk";import Wp from"fs";import Yp from"path";import{randomUUID as qp}from"crypto";var Jp=()=>process.versions.node.split(".")[0]||"24";async function Da(){if(!ye()){console.log(gn.red(`You are not logged in. Run \`${m.nameLower} login\` first.`));return}let t=await mn({message:"Project Name:",placeholder:"My Awesome App",validate(c){if(c.length===0)return"Name is required!"}});if(Nt(t))return;let n=await mn({message:"Project Slug (URL friendly):",placeholder:"my-awesome-app",validate(c){if(c.length===0)return"Slug is required!";if(!/^[a-z0-9-]+$/.test(c))return"Slug must be lowercase alphanumeric with dashes."}});if(Nt(n))return;let i=Ao(process.cwd()),r=await mn({message:"App Directory (relative to this project root):",initialValue:i||void 0,placeholder:".",validate(c){if(c.length===0)return"App directory is required!";try{Kt(process.cwd(),c,{requireAppDirectory:!0})}catch(u){return u.message}}});if(Nt(r))return;let o=yo(process.cwd(),r),s=await zp({message:"Platform:",options:[{value:"android",label:"Android"},{value:"ios",label:"iOS"},{value:"web",label:"Web"},{value:"all",label:"All Platforms"}]});if(Nt(s))return;let a="";if(s==="android"||s==="all"){let c=_t("android",r);if(a=await mn({message:"Android Package Name:",initialValue:c||"",placeholder:"com.example.app",validate(u){if(u.length===0)return"Package name is required for Android!"}}),Nt(a))return}let l="";if(s==="ios"||s==="all"){let c=_t("ios",r);if(l=await mn({message:"iOS Bundle Identifier:",initialValue:c||"",placeholder:"com.example.app",validate(u){if(u.length===0)return"Bundle ID is required for iOS!"}}),Nt(l))return}let d=Kp();d.start("Creating project...");try{let c=qp(),f={projectId:c,name:t,slug:n,storageType:"managed",platforms:s==="all"?["android","ios","web"]:[s]},{data:p}=await $.post("/projects",f);if(p.status==="success"){d.stop(gn.green("Project created successfully!"));let h=Yp.join(process.cwd(),m.configFileName);Wp.writeFileSync(h,JSON.stringify({projectId:c,framework:o,appDirectory:r,name:t,slug:n,nodeVersion:Jp(),...a?{android:{package:a,versionCode:"auto"}}:{},...l?{ios:{bundleIdentifier:l,buildNumber:"auto"}}:{},build:{development:{environment:"development",distribution:"development"},staging:{environment:"staging",distribution:"internal"},production:{environment:"production",distribution:"store"}},submit:{production:{android:{track:"internal",releaseStatus:"completed"},ios:{ascAppId:"",appleTeamId:""}}}},null,2)),Vp(gn.green(`Initialized project ${t} and linked locally!`))}else d.stop(gn.red("creation failed: "+p.message))}catch(c){d.stop(gn.red("Network error: "+c.message))}}import{spinner as xr,log as be}from"@clack/prompts";import hn from"chalk";import li from"fs";import Ca from"path";function Lr(e,t,n,i){let r=e?.response?.status,o=e?.response?.data?.message||e?.response?.data?.error,s=i?` ${i}`:"";return r===401?`Not logged in or token expired while trying to ${n}${s}. Run \`${m.nameLower} login\` and try again.`:r===403?[`Permission denied while trying to ${n}${s}.`,o?`API says: ${o}.`:void 0,`Current Mach account/token does not have access to project ${t}.`,`Run \`${m.nameLower} login\` with the correct account, or ask a project owner to grant access.`].filter(Boolean).join(" "):r===404?[`Project or environment endpoint was not found while trying to ${n}${s}.`,`Project ID: ${t}.`,o?`API says: ${o}.`:void 0].filter(Boolean).join(" "):r?`Failed to ${n}${s}: ${o||`API returned HTTP ${r}`}`:`Network error while trying to ${n}${s}: ${e?.message||"Unknown error"}`}function Xp(e){let t=String(e??"");return t===""?'""':/^[A-Za-z0-9_./:@%+-]+$/.test(t)?t:JSON.stringify(t)}function Zp(e,t){return`${[`# Generated by ${m.nameLower} env pull --environment ${t}`,"# Do not commit this file.","",...Object.keys(e).sort((i,r)=>i.localeCompare(r)).map(i=>`${i}=${Xp(e[i])}`)].join(`
 `)}
-`}async function Ma(e,t,n={}){let i=ye();if(!i){Ee.error(`You are not logged in. Run \`${m.nameLower} login\` first.`);return}let r=La.join(process.cwd(),m.configFileName);if(!li.existsSync(r)){Ee.error(`No ${m.configFileName} found. Run \`${m.nameLower} init\` or \`${m.nameLower} link\` first.`);return}let o;try{o=JSON.parse(li.readFileSync(r,"utf-8"))}catch{Ee.error(`Failed to parse ${m.configFileName}`);return}let{projectId:s}=o;if(!s){Ee.error(`${m.configFileName} is missing projectId.`);return}e==="set"?await uf(s,t,i):e==="list"?await pf(s,i):e==="pull"||e==="download"||e==="export"?await ff(s,n):Ee.error(`Unknown env action: ${e}. Use 'set', 'list', or 'pull'.`)}async function uf(e,t,n){if(t.length===0){Ee.error(`Usage: ${m.nameLower} env set KEY=VALUE [KEY2=VALUE2 ...]`);return}let i=Mr();i.start("Setting environment variables...");let r=0,o=0;for(let s of t){let[a,...l]=s.split("="),d=l.join("=");if(!a||d===void 0){Ee.warn(`Invalid format for argument: ${s}. Expected KEY=VALUE.`),o++;continue}try{let c={key:a.trim(),value:d,type:"env",environment:"global",visibility:"secret"},{data:u}=await $.post(`/projects/${e}/secrets`,c);u.status==="success"?r++:(Ee.error(`Failed to set ${a}: ${u.message}`),o++)}catch(c){Ee.error(Ur(c,e,"set",a)),o++}}i.stop(`Set ${r} variable(s). ${o>0?`${o} failed.`:""}`)}async function pf(e,t){let n=Mr();n.start("Fetching environment variables...");try{let{data:i}=await $.get(`/projects/${e}/secrets`);if(i.status==="success"){n.stop("Fetched variables.");let r=i.secrets||[];r.length===0?Ee.info("No environment variables found for this project."):(Ee.info(mn.bold("Environment Variables (Global & Scoped):")),r.forEach(o=>{let s=o.visibility==="plain"?o.value:"********";console.log(`  ${mn.cyan(o.key)} = ${s}  ${mn.gray(`[${o.environment}]`)}`)}))}else n.stop(mn.red(`Failed to fetch variables: ${i.message}`))}catch(i){n.stop("Failed to fetch variables."),Ee.error(Ur(i,e,"list"))}}async function ff(e,t){let n=(t.environment||"development").trim(),i=t.out||".env.local",r=La.resolve(process.cwd(),i);if(li.existsSync(r)&&!t.overwrite){Ee.error(`${i} already exists. Re-run with \`--overwrite\` to replace it.`);return}let o=Mr();o.start(`Downloading ${n} environment variables...`);try{let{data:s}=await $.get(`/projects/${e}/secrets/export?env=${encodeURIComponent(n)}`);if(s.status!=="success"){o.stop(mn.red(`Failed to download variables: ${s.message||"Unknown API error"}`));return}let a=s.secrets||{},l=cf(a,n);li.writeFileSync(r,l,{encoding:"utf-8",mode:384}),o.stop(`Wrote ${Object.keys(a).length} variable(s) to ${i}.`)}catch(s){o.stop("Failed to download variables."),Ee.error(Ur(s,e,"pull"))}}import{cancel as mf,confirm as qa,isCancel as ui,log as Oe,note as gf,outro as kt,select as hf,spinner as Af,text as yf}from"@clack/prompts";import Me from"chalk";import z from"fs";import te from"path";import{spawnSync as Ja}from"child_process";import Hr from"crypto";import Sf from"axios";import Fa from"crypto";import gn from"fs";import hn from"path";var Ua=e=>String(e||"").replace(/\\/g,"/").replace(/^\/+/,"");function Ba(e,t){let n=hn.join(e,"metadata.json");if(!gn.existsSync(n))throw new Error(`Expo export did not create ${n}.`);let r=JSON.parse(gn.readFileSync(n,"utf-8"))?.fileMetadata?.[t],o=Ua(r?.bundle);if(!o)throw new Error(`Expo export metadata is missing the ${t} launch bundle.`);let s=new Set,a=(Array.isArray(r?.assets)?r.assets:[]).flatMap(l=>{let d=Ua(l?.path);return!d||s.has(d)?[]:(s.add(d),[{path:d,ext:String(l?.ext||"").replace(/^\./,"")||void 0}])});for(let l of[o,...a.map(d=>d.path)])if(!gn.existsSync(hn.join(e,l)))throw new Error(`Expo export metadata references a missing file: ${l}`);return{bundle:o,assets:a}}function Ha(e,t){return[hn.join(e,t.bundle),...t.assets.map(n=>hn.join(e,n.path)),hn.join(e,"metadata.json")]}function Fr(e){return Fa.createHash("md5").update(gn.readFileSync(e)).digest("hex")}function Br(e){return Fa.createHash("sha256").update(gn.readFileSync(e)).digest("base64url")}function ja(e){let t=String(e||"").replace(/^\./,"").trim().toLowerCase();return t?`.${t}`:void 0}function di(e,t=!1){if(t)return"application/javascript";switch(String(e||"").replace(/^\./,"").trim().toLowerCase()){case"js":case"bundle":case"hbc":return"application/javascript";case"json":return"application/json";case"png":return"image/png";case"jpg":case"jpeg":return"image/jpeg";case"gif":return"image/gif";case"webp":return"image/webp";case"svg":return"image/svg+xml";case"ttf":return"font/ttf";case"otf":return"font/otf";case"woff":return"font/woff";case"woff2":return"font/woff2";case"mp3":return"audio/mpeg";case"m4a":return"audio/mp4";case"aac":return"audio/aac";case"wav":return"audio/wav";case"mp4":return"video/mp4";case"mov":return"video/quicktime";case"pdf":return"application/pdf";default:return"application/octet-stream"}}function Ga(e){if(!e||typeof e!="object"||Array.isArray(e))return;let{_internal:t,hooks:n,mods:i,...r}=e;return r}var ue=`${m.npmScope}/mach/expo-plugin`,jr=()=>process.stdin.isTTY&&process.stdout.isTTY,pi=()=>{mf("Operation cancelled."),process.exit(0)},Se=e=>{if(typeof e!="string")return;let t=e.trim();return t.length>0?t:void 0};function Nt(e){if(!z.existsSync(e))return null;try{return JSON.parse(z.readFileSync(e,"utf-8"))}catch{return null}}function Xa(e,t){z.writeFileSync(e,`${JSON.stringify(t,null,2)}
-`)}function An(){let e=ce();return e?.projectId||(Oe.error(`No ${m.configFileName} found or missing projectId. Run \`${m.nameLower} link\` first.`),process.exit(1)),e}function bf(e){Xa(te.join(process.cwd(),m.configFileName),e)}function Gr(e){let t=Re(e.framework);if(t)return t;let n=Nt(te.join(process.cwd(),"package.json"))||{},i={...n.dependencies||{},...n.devDependencies||{}};return i.expo?"expo":(i["react-native"],"react-native")}function Vr(e,t){let n=String(e||"").trim().toLowerCase();return n==="expo"||n==="expo-updates"?"expo-updates":n==="react-native"||n==="mach-react-native"||n==="rn"?"mach-react-native":"expo-updates"}function Za(e){if(e==="mach-react-native")throw new Error("mach-react-native is reserved for a future Mach-native OTA client. Use expo-updates for Expo and bare React Native projects.");return e}function zr(e){let t=String(e||"all").trim().toLowerCase();if(t==="ios")return["ios"];if(t==="android")return["android"];if(t==="all"||t==="both")return["ios","android"];throw new Error("Platform must be ios, android, or all.")}function Ef(e){return z.existsSync(te.join(e,"pnpm-lock.yaml"))?{command:"pnpm",args:["add","-D",`${m.npmScope}/mach@latest`],label:`pnpm add -D ${m.npmScope}/mach@latest`}:z.existsSync(te.join(e,"yarn.lock"))?{command:"yarn",args:["add","-D",`${m.npmScope}/mach@latest`],label:`yarn add -D ${m.npmScope}/mach@latest`}:z.existsSync(te.join(e,"bun.lockb"))||z.existsSync(te.join(e,"bun.lock"))?{command:"bun",args:["add","-d",`${m.npmScope}/mach@latest`],label:`bun add -d ${m.npmScope}/mach@latest`}:{command:"npm",args:["install","--save-dev",`${m.npmScope}/mach@latest`],label:`npm install --save-dev ${m.npmScope}/mach@latest`}}function fi(e){let t=Nt(te.join(e,"package.json"))||{};return!!(t.dependencies?.[`${m.npmScope}/mach`]||t.devDependencies?.[`${m.npmScope}/mach`])}function ci(e){let t=Nt(te.join(e,"node_modules",m.npmScope,"mach","package.json"));return Se(t?.version)}function Qa(e,t){let n=o=>o.replace(/^v/,"").split(/[.-]/).slice(0,3).map(s=>Number.parseInt(s,10)||0),i=n(e),r=n(t);for(let o=0;o<3;o+=1)if(i[o]!==r[o])return i[o]>r[o]?1:-1;return 0}function If(e){let t=ci(e);return!fi(e)||!t||Qa(t,et)<0}function _f(e){let t=Ef(e),n=Ja(t.command,t.args,{cwd:e,stdio:"inherit",env:{...process.env}});if(n.error)return{ok:!1,label:t.label,error:n.error.message};if(n.status!==0)return{ok:!1,label:t.label,error:`${t.command} exited with code ${n.status}`};let i=ci(e),r=!!i&&Qa(i,et)>=0;return{ok:fi(e)&&r,label:t.label,error:r?void 0:`installed ${i||"unknown"}, requires ${et} or newer`}}function Va(e){if(typeof e=="string")return e;if(Array.isArray(e)&&typeof e[0]=="string")return e[0]}function wf(e,t){let n=["app.config.json","app.json"].find(a=>z.existsSync(te.join(e,a)));if(!n)return null;let i=te.join(e,n),r=Nt(i);if(!r)return null;let o=r.expo&&typeof r.expo=="object"?r.expo:r;if(t==="react-native"&&n==="app.json"&&(!r.expo||typeof r.expo!="object")){let a=Nt(te.join(e,"package.json"))||{},l=Se(r.displayName)||Se(r.name)||Se(a.name)||"App",d=(Se(a.name)||l).toLowerCase().replace(/[^a-z0-9-]+/g,"-").replace(/^-+|-+$/g,"")||"app";r.expo={name:l,slug:d,version:Se(a.version)||"1.0.0"},o=r.expo}let s=Array.isArray(o.plugins)?o.plugins:[];return s.some(a=>Va(a)===ue)||(o.plugins=[...s.filter(a=>{let l=Va(a);return l!=="./plugins/withMachDeepLinks"&&l!=="plugins/withMachDeepLinks"}),ue],Xa(i,r)),n}function vf(e){let t=["app.config.ts","app.config.js"].find(p=>z.existsSync(te.join(e,p)));if(!t)return"missing";let n=te.join(e,t),i=z.readFileSync(n,"utf-8");if(i.includes(ue))return"already";let r=/(['"`])(?:\.\/)?plugins\/withMachDeepLinks\1/g;if(r.test(i))return z.writeFileSync(n,i.replace(r,(p,g)=>`${g}${ue}${g}`)),"inserted";let o=/(^[ \t]*)plugins\s*:\s*\[([\s\S]*?)\]/m.exec(i);if(!o||o.index===void 0)return"manual";let s=i.includes(`\r
+`}async function Ta(e,t,n={}){let i=ye();if(!i){be.error(`You are not logged in. Run \`${m.nameLower} login\` first.`);return}let r=Ca.join(process.cwd(),m.configFileName);if(!li.existsSync(r)){be.error(`No ${m.configFileName} found. Run \`${m.nameLower} init\` or \`${m.nameLower} link\` first.`);return}let o;try{o=JSON.parse(li.readFileSync(r,"utf-8"))}catch{be.error(`Failed to parse ${m.configFileName}`);return}let{projectId:s}=o;if(!s){be.error(`${m.configFileName} is missing projectId.`);return}e==="set"?await Qp(s,t,i):e==="list"?await ef(s,i):e==="pull"||e==="download"||e==="export"?await tf(s,n):be.error(`Unknown env action: ${e}. Use 'set', 'list', or 'pull'.`)}async function Qp(e,t,n){if(t.length===0){be.error(`Usage: ${m.nameLower} env set KEY=VALUE [KEY2=VALUE2 ...]`);return}let i=xr();i.start("Setting environment variables...");let r=0,o=0;for(let s of t){let[a,...l]=s.split("="),d=l.join("=");if(!a||d===void 0){be.warn(`Invalid format for argument: ${s}. Expected KEY=VALUE.`),o++;continue}try{let c={key:a.trim(),value:d,type:"env",environment:"global",visibility:"secret"},{data:u}=await $.post(`/projects/${e}/secrets`,c);u.status==="success"?r++:(be.error(`Failed to set ${a}: ${u.message}`),o++)}catch(c){be.error(Lr(c,e,"set",a)),o++}}i.stop(`Set ${r} variable(s). ${o>0?`${o} failed.`:""}`)}async function ef(e,t){let n=xr();n.start("Fetching environment variables...");try{let{data:i}=await $.get(`/projects/${e}/secrets`);if(i.status==="success"){n.stop("Fetched variables.");let r=i.secrets||[];r.length===0?be.info("No environment variables found for this project."):(be.info(hn.bold("Environment Variables (Global & Scoped):")),r.forEach(o=>{let s=o.visibility==="plain"?o.value:"********";console.log(`  ${hn.cyan(o.key)} = ${s}  ${hn.gray(`[${o.environment}]`)}`)}))}else n.stop(hn.red(`Failed to fetch variables: ${i.message}`))}catch(i){n.stop("Failed to fetch variables."),be.error(Lr(i,e,"list"))}}async function tf(e,t){let n=(t.environment||"development").trim(),i=t.out||".env.local",r=Ca.resolve(process.cwd(),i);if(li.existsSync(r)&&!t.overwrite){be.error(`${i} already exists. Re-run with \`--overwrite\` to replace it.`);return}let o=xr();o.start(`Downloading ${n} environment variables...`);try{let{data:s}=await $.get(`/projects/${e}/secrets/export?env=${encodeURIComponent(n)}`);if(s.status!=="success"){o.stop(hn.red(`Failed to download variables: ${s.message||"Unknown API error"}`));return}let a=s.secrets||{},l=Zp(a,n);li.writeFileSync(r,l,{encoding:"utf-8",mode:384}),o.stop(`Wrote ${Object.keys(a).length} variable(s) to ${i}.`)}catch(s){o.stop("Failed to download variables."),be.error(Lr(s,e,"pull"))}}import{cancel as nf,confirm as Va,isCancel as ui,log as Re,note as rf,outro as kt,select as of,spinner as sf,text as af}from"@clack/prompts";import Me from"chalk";import V from"fs";import ee from"path";import{spawnSync as za}from"child_process";import Fr from"crypto";import lf from"axios";import ka from"crypto";import An from"fs";import yn from"path";var Na=e=>String(e||"").replace(/\\/g,"/").replace(/^\/+/,"");function xa(e,t){let n=yn.join(e,"metadata.json");if(!An.existsSync(n))throw new Error(`Expo export did not create ${n}.`);let r=JSON.parse(An.readFileSync(n,"utf-8"))?.fileMetadata?.[t],o=Na(r?.bundle);if(!o)throw new Error(`Expo export metadata is missing the ${t} launch bundle.`);let s=new Set,a=(Array.isArray(r?.assets)?r.assets:[]).flatMap(l=>{let d=Na(l?.path);return!d||s.has(d)?[]:(s.add(d),[{path:d,ext:String(l?.ext||"").replace(/^\./,"")||void 0}])});for(let l of[o,...a.map(d=>d.path)])if(!An.existsSync(yn.join(e,l)))throw new Error(`Expo export metadata references a missing file: ${l}`);return{bundle:o,assets:a}}function La(e,t){return[yn.join(e,t.bundle),...t.assets.map(n=>yn.join(e,n.path)),yn.join(e,"metadata.json")]}function Mr(e){return ka.createHash("md5").update(An.readFileSync(e)).digest("hex")}function Ur(e){return ka.createHash("sha256").update(An.readFileSync(e)).digest("base64url")}function Ma(e){let t=String(e||"").replace(/^\./,"").trim().toLowerCase();return t?`.${t}`:void 0}function di(e,t=!1){if(t)return"application/javascript";switch(String(e||"").replace(/^\./,"").trim().toLowerCase()){case"js":case"bundle":case"hbc":return"application/javascript";case"json":return"application/json";case"png":return"image/png";case"jpg":case"jpeg":return"image/jpeg";case"gif":return"image/gif";case"webp":return"image/webp";case"svg":return"image/svg+xml";case"ttf":return"font/ttf";case"otf":return"font/otf";case"woff":return"font/woff";case"woff2":return"font/woff2";case"mp3":return"audio/mpeg";case"m4a":return"audio/mp4";case"aac":return"audio/aac";case"wav":return"audio/wav";case"mp4":return"video/mp4";case"mov":return"video/quicktime";case"pdf":return"application/pdf";default:return"application/octet-stream"}}function Ua(e){if(!e||typeof e!="object"||Array.isArray(e))return;let{_internal:t,hooks:n,mods:i,...r}=e;return r}var de=`${m.npmScope}/mach/expo-plugin`,Br=()=>process.stdin.isTTY&&process.stdout.isTTY,pi=()=>{nf("Operation cancelled."),process.exit(0)},Se=e=>{if(typeof e!="string")return;let t=e.trim();return t.length>0?t:void 0};function xt(e){if(!V.existsSync(e))return null;try{return JSON.parse(V.readFileSync(e,"utf-8"))}catch{return null}}function Ka(e,t){V.writeFileSync(e,`${JSON.stringify(t,null,2)}
+`)}function Sn(){let e=le();return e?.projectId||(Re.error(`No ${m.configFileName} found or missing projectId. Run \`${m.nameLower} link\` first.`),process.exit(1)),e}function df(e){Ka(ee.join(process.cwd(),m.configFileName),e)}function Hr(e){let t=ve(e.framework);if(t)return t;let n=xt(ee.join(process.cwd(),"package.json"))||{},i={...n.dependencies||{},...n.devDependencies||{}};return i.expo?"expo":(i["react-native"],"react-native")}function jr(e,t){let n=String(e||"").trim().toLowerCase();return n==="expo"||n==="expo-updates"?"expo-updates":n==="react-native"||n==="mach-react-native"||n==="rn"?"mach-react-native":"expo-updates"}function Wa(e){if(e==="mach-react-native")throw new Error("mach-react-native is reserved for a future Mach-native OTA client. Use expo-updates for Expo and bare React Native projects.");return e}function Gr(e){let t=String(e||"all").trim().toLowerCase();if(t==="ios")return["ios"];if(t==="android")return["android"];if(t==="all"||t==="both")return["ios","android"];throw new Error("Platform must be ios, android, or all.")}function cf(e){return V.existsSync(ee.join(e,"pnpm-lock.yaml"))?{command:"pnpm",args:["add","-D",`${m.npmScope}/mach@latest`],label:`pnpm add -D ${m.npmScope}/mach@latest`}:V.existsSync(ee.join(e,"yarn.lock"))?{command:"yarn",args:["add","-D",`${m.npmScope}/mach@latest`],label:`yarn add -D ${m.npmScope}/mach@latest`}:V.existsSync(ee.join(e,"bun.lockb"))||V.existsSync(ee.join(e,"bun.lock"))?{command:"bun",args:["add","-d",`${m.npmScope}/mach@latest`],label:`bun add -d ${m.npmScope}/mach@latest`}:{command:"npm",args:["install","--save-dev",`${m.npmScope}/mach@latest`],label:`npm install --save-dev ${m.npmScope}/mach@latest`}}function fi(e){let t=xt(ee.join(e,"package.json"))||{};return!!(t.dependencies?.[`${m.npmScope}/mach`]||t.devDependencies?.[`${m.npmScope}/mach`])}function ci(e){let t=xt(ee.join(e,"node_modules",m.npmScope,"mach","package.json"));return Se(t?.version)}function Ya(e,t){let n=o=>o.replace(/^v/,"").split(/[.-]/).slice(0,3).map(s=>Number.parseInt(s,10)||0),i=n(e),r=n(t);for(let o=0;o<3;o+=1)if(i[o]!==r[o])return i[o]>r[o]?1:-1;return 0}function uf(e){let t=ci(e);return!fi(e)||!t||Ya(t,et)<0}function pf(e){let t=cf(e),n=za(t.command,t.args,{cwd:e,stdio:"inherit",env:{...process.env}});if(n.error)return{ok:!1,label:t.label,error:n.error.message};if(n.status!==0)return{ok:!1,label:t.label,error:`${t.command} exited with code ${n.status}`};let i=ci(e),r=!!i&&Ya(i,et)>=0;return{ok:fi(e)&&r,label:t.label,error:r?void 0:`installed ${i||"unknown"}, requires ${et} or newer`}}function Fa(e){if(typeof e=="string")return e;if(Array.isArray(e)&&typeof e[0]=="string")return e[0]}function ff(e,t){let n=["app.config.json","app.json"].find(a=>V.existsSync(ee.join(e,a)));if(!n)return null;let i=ee.join(e,n),r=xt(i);if(!r)return null;let o=r.expo&&typeof r.expo=="object"?r.expo:r;if(t==="react-native"&&n==="app.json"&&(!r.expo||typeof r.expo!="object")){let a=xt(ee.join(e,"package.json"))||{},l=Se(r.displayName)||Se(r.name)||Se(a.name)||"App",d=(Se(a.name)||l).toLowerCase().replace(/[^a-z0-9-]+/g,"-").replace(/^-+|-+$/g,"")||"app";r.expo={name:l,slug:d,version:Se(a.version)||"1.0.0"},o=r.expo}let s=Array.isArray(o.plugins)?o.plugins:[];return s.some(a=>Fa(a)===de)||(o.plugins=[...s.filter(a=>{let l=Fa(a);return l!=="./plugins/withMachDeepLinks"&&l!=="plugins/withMachDeepLinks"}),de],Ka(i,r)),n}function mf(e){let t=["app.config.ts","app.config.js"].find(p=>V.existsSync(ee.join(e,p)));if(!t)return"missing";let n=ee.join(e,t),i=V.readFileSync(n,"utf-8");if(i.includes(de))return"already";let r=/(['"`])(?:\.\/)?plugins\/withMachDeepLinks\1/g;if(r.test(i))return V.writeFileSync(n,i.replace(r,(p,h)=>`${h}${de}${h}`)),"inserted";let o=/(^[ \t]*)plugins\s*:\s*\[([\s\S]*?)\]/m.exec(i);if(!o||o.index===void 0)return"manual";let s=i.includes(`\r
 `)?`\r
 `:`
-`,a=o[1]||"",l=o[2]||"",c=l.match(/\r?\n([ \t]+)\S/)?.[1]||`${a}    `,u=l.trim().length===0?`${s}${c}'${ue}',${s}${a}`:l.includes(`
-`)||l.includes("\r")?`${s}${c}'${ue}',${l}`:`${s}${c}'${ue}',${s}${c}${l.trim()}${s}${a}`,f=`${o[0].slice(0,o[0].indexOf("[")+1)}${u}]`;return z.writeFileSync(n,`${i.slice(0,o.index)}${f}${i.slice(o.index+o[0].length)}`),"inserted"}async function $f(e,t,n){let i=[];if(If(e)){let o=ci(e),s=!!(n.installPlugin||n.yes);if(!s&&!n.skipInstall&&jr()){let a=await qa({message:o?`Update the local ${m.npmScope}/mach Expo plugin (${o} \u2192 ${et})?`:`Install ${m.npmScope}/mach locally so Expo can use ${ue}?`,initialValue:!0});ui(a)&&pi(),s=!!a}if(s&&!n.skipInstall){let a=_f(e);a.ok?i.push(`Installed a compatible ${ue} with ${a.label}.`):i.push(`Could not install ${m.npmScope}/mach with ${a.label}: ${a.error||"unknown error"}.`)}else i.push(`Install ${m.npmScope}/mach@${et} or newer in this app so Expo can resolve ${ue}.`)}else i.push(`Local ${ue} is compatible (${ci(e)}).`);let r=vf(e);if(r==="already"&&i.push(`Expo config already includes ${ue}.`),r==="inserted"&&i.push(`Expo config updated to include ${ue}.`),r==="manual"&&i.push(`Add "${ue}" to the plugins array in app.config.ts/app.config.js.`),r==="missing"){let o=wf(e,t);o?i.push(`${o} updated to include ${ue}.`):i.push(`Add "${ue}" to your Expo config plugins array.`)}return i}async function za(e,t){if(t.skipInstall)return!1;if(t.yes)return!0;if(!jr())return!1;let n=await qa({message:e,initialValue:!0});return ui(n)&&pi(),!!n}async function Rf(e,t,n){let i=[];if(t==="react-native"&&!ft(e,"expo"))if(await za("Install Expo Modules required by the Mach OTA runtime? This updates package and native project files.",n)){let o=Ao(e);if(!o.ok||!ft(e,"expo"))throw new Error(`Expo Modules installation failed: ${o.error||o.command}`);i.push("Installed and configured Expo Modules for the existing React Native project.")}else i.push("Expo Modules are required. Run `npx install-expo-modules@latest`, then run `mach ota setup` again.");if(!ft(e,"expo-updates"))if(await za("Install the expo-updates runtime?",n)){let o=yo(e);if(!o.ok||!ft(e,"expo-updates"))throw new Error(`expo-updates installation failed: ${o.error||o.command}`);i.push("Installed the Expo-compatible expo-updates version.")}else i.push("Install expo-updates with `npx expo install expo-updates`, then run `mach ota setup` again.");return i}async function Ka(e,t,n,i,r){if(t)return t;if(r||!jr()){if(i)throw new Error(`${e.replace(/:$/,"")} is required.`);return}let o=await yf({message:e,placeholder:n,validate(s){if(i&&s.trim().length===0)return"Required."}});return ui(o)&&pi(),Se(o)}function Kr(e,t,n){return qt(e,{runtimeVersion:t.runtimeVersion,framework:Re(t.framework)||Re(e.framework),platform:n})}function Of(e){let t=Yt(process.cwd(),e);if(!t)throw new Error(`Resolved Expo OTA configuration does not match this publish: Expo config could not be resolved. Run \`mach ota setup\` to update ${ue}, then create a new native build if its embedded runtime changes.`);let n=[];if(t.runtimeVersion!==e.runtimeVersion&&n.push(`runtime is ${t.runtimeVersion||"missing"} (expected ${e.runtimeVersion})`),t.channel!==e.channel&&n.push(`channel is ${t.channel||"missing"} (expected ${e.channel})`),t.url!==e.url&&n.push(`URL is ${t.url||"missing"} (expected ${e.url})`),n.length>0)throw new Error(`Resolved Expo OTA configuration does not match this publish: ${n.join("; ")}. Run \`mach ota setup\` to update ${ue}, then create a new native build if its embedded runtime changes.`);return t}function Pf(e){return Hr.createHash("sha256").update(z.readFileSync(e)).digest("hex")}function Df(e){let t=te.extname(e).toLowerCase();return t===".json"?"application/json":t===".js"||t===".bundle"||t===".hbc"?"application/javascript":t===".map"?"application/json":t===".png"?"image/png":t===".jpg"||t===".jpeg"?"image/jpeg":t===".webp"?"image/webp":t===".gif"?"image/gif":t===".svg"?"image/svg+xml":t===".ttf"?"font/ttf":t===".otf"?"font/otf":t===".woff"?"font/woff":t===".woff2"?"font/woff2":"application/octet-stream"}function el(e){let t=[];if(!z.existsSync(e))return t;for(let n of z.readdirSync(e)){let i=te.join(e,n),r=z.statSync(i);r.isDirectory()?t.push(...el(i)):r.isFile()&&t.push(i)}return t}function Cf(e,t){let n=e.filter(i=>{let r=i.toLowerCase();return r.endsWith(".map")?!1:r.endsWith(".js")||r.endsWith(".bundle")||r.endsWith(".hbc")});return n.find(i=>i.toLowerCase().includes(t))||n.sort((i,r)=>z.statSync(r).size-z.statSync(i).size)[0]}async function Wa(e){let t=await $.post("/ota/upload-url",{projectId:e.projectId,updateId:e.updateId,platform:e.platform,fileName:e.fileName,contentType:e.contentType});if(t.data.status!=="success")throw new Error(t.data.message||`Could not create upload URL for ${e.fileName}`);let n=z.statSync(e.filePath).size;return await Sf.put(t.data.uploadUrl,z.createReadStream(e.filePath),{headers:{"Content-Type":e.contentType,"Content-Length":n},maxBodyLength:1/0,maxContentLength:1/0}),{key:t.data.key,url:t.data.publicUrl,contentType:e.contentType,hash:Pf(e.filePath),size:n}}function tl(e,t,n,i={}){let r=Ja(e,t,{cwd:n,stdio:"inherit",env:{...process.env,CI:process.env.CI||"1",EXPO_NO_TELEMETRY:"1",...i}});if(r.error)throw new Error(r.error.message);if(r.status!==0)throw new Error(`${e} ${t.join(" ")} exited with code ${r.status}`)}function Tf(e,t,n,i,r){tl("npx",["expo","export","--platform",e,"--output-dir",t],process.cwd(),{MACH_OTA_RUNTIME_VERSION:n,MACH_OTA_CHANNEL:i,MACH_OTA_URL:r})}function kf(e,t){let n=e==="ios"?"main.jsbundle":"index.android.bundle",r=["index.js","index.ts","index.tsx"].find(s=>z.existsSync(te.join(process.cwd(),s)))||"index.js",o=te.join(t,"assets");z.mkdirSync(o,{recursive:!0}),tl("npx",["react-native","bundle","--platform",e,"--dev","false","--entry-file",r,"--bundle-output",te.join(t,n),"--assets-dest",o],process.cwd())}async function Nf(e){let t=e.config.projectId,n=`ota_${Date.now()}_${e.platform}_${Hr.randomUUID().slice(0,8)}`,i=te.join(process.cwd(),".mach","ota",n,e.platform);z.rmSync(i,{recursive:!0,force:!0}),z.mkdirSync(i,{recursive:!0}),e.engine==="expo-updates"?Tf(e.platform,i,e.runtimeVersion,e.channel,e.config.ota?.url||""):kf(e.platform,i);let r=e.engine==="expo-updates"?Ba(i,e.platform):void 0,o=r?Ha(i,r):el(i),s=r?te.join(i,r.bundle):Cf(o,e.platform);if(!s)throw new Error(`Could not find a ${e.platform} JS bundle in ${i}.`);let a=new Map((r?.assets||[]).map(w=>[w.path,w])),l=[];for(let w of o){let M=te.relative(i,w).replace(/\\/g,"/"),v=a.get(M),H=w===s?"application/javascript":v?di(v.ext):Df(w);l.push({filePath:w,relative:M,uploaded:await Wa({projectId:t,updateId:n,platform:e.platform,filePath:w,fileName:M,contentType:H})})}let d=l.find(w=>w.filePath===s),c=e.engine==="expo-updates"?Hr.randomUUID():void 0,u=e.engine==="expo-updates"?Ga(e.expoConfig):void 0;if(e.engine==="expo-updates"&&(!u||Object.keys(u).length===0))throw new Error("Could not resolve the public Expo config required by the OTA manifest. Run `mach ota verify` and try again.");let f=r?r.assets.map(w=>{let M=l.find(v=>v.relative===w.path);if(!M)throw new Error(`Could not find uploaded Expo asset ${w.path}.`);return{key:Fr(M.filePath),url:M.uploaded.url,contentType:di(w.ext),fileExtension:ja(w.ext),hash:Br(M.filePath),size:M.uploaded.size}}):l.filter(w=>w.filePath!==s&&!w.relative.endsWith(".map")).map(w=>({key:w.relative,url:w.uploaded.url,contentType:w.uploaded.contentType,hash:w.uploaded.hash,size:w.uploaded.size})),p=r?{key:Fr(d.filePath),url:d.uploaded.url,contentType:di(void 0,!0),hash:Br(d.filePath),size:d.uploaded.size}:{key:te.basename(d.relative),url:d.uploaded.url,contentType:d.uploaded.contentType,hash:d.uploaded.hash,size:d.uploaded.size},g={id:c||n,createdAt:new Date().toISOString(),runtimeVersion:e.runtimeVersion,launchAsset:p,assets:f,metadata:{projectId:t,channel:e.channel,...e.message?{message:e.message}:{},engine:e.engine},extra:{...u?{expoClient:u}:{},mach:{projectId:t,updateId:n,...c?{expoUpdateId:c}:{},channel:e.channel,platform:e.platform}}},h=te.join(i,"mach-manifest.json");z.writeFileSync(h,JSON.stringify(g,null,2));let A=await Wa({projectId:t,updateId:n,platform:e.platform,filePath:h,fileName:"manifest.json",contentType:"application/json"}),y=await $.post("/ota/publish",{projectId:t,updateId:n,expoUpdateId:c,channelName:e.channel,runtimeVersion:e.runtimeVersion,platform:e.platform,manifestKey:A.key,message:e.message,launchAsset:p,assets:f});if(y.data.status!=="success")throw new Error(y.data.message||`Failed to publish ${e.platform} OTA update.`);return y.data.update}async function xf(e){let t=An(),n=Re(e.framework)||Gr(t),i;try{i=Za(Vr(e.engine,n))}catch(f){Oe.error(f.message),process.exit(1)}let r=!!e.yes,o=await Ka("OTA channel:",Se(e.channel||e.branch||t.ota?.channel)||"production","production",!0,r),s=`${Qe.replace(/\/$/,"")}/api/ota/expo/${t.projectId}`,a=Se(e.url||t.ota?.url),l=a?.includes("/api/ota/react-native/")?void 0:a,d=await Ka("Mach OTA update URL:",l||s,s,!0,r);t.framework=n;let c={...t.ota||{},enabled:!0,engine:i,channel:o,url:d,deploymentUrl:d,runtimeVersionPolicy:t.ota?.runtimeVersionPolicy||"appVersion"};delete c.statsUrl,t.ota=c,delete t.update,bf(t);let u=[`${m.configFileName} updated.`];if(u.push(...await Rf(process.cwd(),n,e)),u.push(...await $f(process.cwd(),n,e)),n==="react-native"&&ft(process.cwd(),"expo")&&ft(process.cwd(),"expo-updates")&&fi(process.cwd())){let f=zr(e.platform||"all"),p=Fi(process.cwd()).filter(g=>f.includes(g));p.length===0&&u.push("No matching committed ios/android project was found for native configuration sync.");for(let g of p){let h=Kr(t,e,g),y=So({cwd:process.cwd(),platforms:[g],runtimeVersion:h,channel:o,url:d}).find(w=>!w.ok);if(y)throw new Error(`Could not synchronize ${g} Expo Updates configuration: ${y.error||y.command}`);u.push(`Synchronized ${g} native Expo Updates configuration for runtime ${h}.`)}}u.push("Create and install one new native build after initial OTA setup. Existing app binaries keep their embedded update URL."),gf(u.map(f=>`- ${f}`).join(`
-`),"OTA setup"),await nl({...e,action:"verify"})}async function Lf(e){Et();let t=An(),n=Re(e.framework)||Gr(t),i;try{i=Za(Vr(e.engine||t.ota?.engine,n))}catch(a){Oe.error(`${a.message} Run \`mach ota setup\` to migrate this project.`),process.exit(1)}let r=Se(e.channel||e.branch||t.ota?.channel)||"production",o=zr(e.platform||"all"),s=Af();s.start(`Publishing OTA update (${o.join("+")}, ${r})`);try{let a=[];for(let l of o){let d=Kr(t,e,l),c=Of({platform:l,runtimeVersion:d,channel:r,url:Se(t.ota?.url)||""});s.message(`Exporting and uploading ${l} OTA bundle for runtime ${d}...`),a.push(await Nf({config:t,engine:i,platform:l,channel:r,runtimeVersion:d,message:e.message,expoConfig:c.expoConfig}))}if(s.stop("OTA update published."),e.json)Oe.info(JSON.stringify({status:"success",updates:a},null,2));else{let l=Array.from(new Set(a.map(d=>d.runtimeVersion).filter(Boolean)));kt(Me.green(`\u2713 OTA update live on "${r}" for runtime ${l.join(", ")||"unknown"}.`));for(let d of a)Oe.info(Me.dim(`${d.platform}: ${d.updateId}`))}}catch(a){s.stop("OTA publish failed."),Oe.error(a.response?.data?.message||a.message),process.exit(1)}}async function nl(e){let t=An(),n=Re(e.framework)||Gr(t),i=Vr(e.engine||t.ota?.engine,n),r=[],o=t.ota;if(r.push(o?.enabled?{level:"pass",message:"mach.config.json has ota.enabled."}:{level:"fail",message:"mach.config.json is missing ota.enabled. Run `mach ota setup`."}),r.push(o?.url?{level:"pass",message:`OTA URL configured: ${o.url}`}:{level:"fail",message:"OTA URL is missing. Run `mach ota setup`."}),r.push(o?.channel?{level:"pass",message:`Default channel: ${o.channel}`}:{level:"warn",message:"No default OTA channel configured; publish will use production."}),r.push(o?.runtimeVersionPolicy||o?.runtimeVersion?{level:"pass",message:"Runtime version policy configured."}:{level:"warn",message:"No explicit runtime policy configured; Mach will use Expo runtimeVersion or package.json version."}),i==="expo-updates"){let a=Nt(te.join(process.cwd(),"package.json"))||{},l={...a.dependencies||{},...a.devDependencies||{}};n==="react-native"&&r.push(l.expo?{level:"pass",message:"Expo Modules are installed for the bare React Native project."}:{level:"fail",message:"Expo Modules are missing. Run `mach ota setup` to install the bare React Native OTA runtime."}),r.push(l["expo-updates"]?{level:"pass",message:"expo-updates is installed."}:{level:"fail",message:"expo-updates is missing. Run `mach ota setup`."}),r.push(fi(process.cwd())?{level:"pass",message:`${m.npmScope}/mach is installed locally for the Expo plugin.`}:{level:"fail",message:`${m.npmScope}/mach is not installed locally; run \`mach ota setup\`.`});let d=zr(e.platform||"all"),c=Se(e.channel||e.branch||o?.channel)||"production",u=Se(o?.url)||"",f=d.map(g=>{let h=Kr(t,e,g);return{platform:g,runtimeVersion:h,delivery:Yt(process.cwd(),{platform:g,runtimeVersion:h,channel:c,url:u})}}),p=f[0]?.delivery;if(p){let g=p.expoConfig.updates?.enabled!==!1,h=Se(p.expoConfig.updates?.checkAutomatically)?.toUpperCase()||"ON_LOAD";r.push(p.url===o?.url?{level:"pass",message:"Expo Updates URL resolves to Mach."}:{level:"warn",message:`Expo Updates URL resolves to ${p.url||"none"} instead of ${o?.url||"the Mach OTA URL"}.`}),r.push(p.channel===c?{level:"pass",message:`Expo update channel header resolves to ${c}.`}:{level:"warn",message:`Expo update channel header is ${p.channel||"not set"}; install the latest ${m.npmScope}/mach package and rebuild.`}),r.push(g?{level:"pass",message:"Expo Updates is enabled."}:{level:"fail",message:"Expo config has updates.enabled=false, so this app cannot receive OTA updates."}),r.push(h!=="NEVER"&&h!=="ON_ERROR_RECOVERY"?{level:"pass",message:`Expo checks for updates automatically (${h}).`}:{level:"fail",message:`Expo checkAutomatically is ${h}; use ON_LOAD to receive Mach updates when the app starts.`})}else r.push({level:"fail",message:`Could not resolve Expo config. Confirm ${ue} is present and run \`mach ota setup\` again.`});for(let{platform:g,runtimeVersion:h,delivery:A}of f)r.push(A?.runtimeVersion===h?{level:"pass",message:`${g} Expo runtime resolves to ${h}.`}:{level:"fail",message:`${g} Expo runtime resolves to ${A?.runtimeVersion||"none"} instead of ${h}. Run \`mach ota setup\`, then rebuild the app.`});if(n==="react-native"){let g=d,h=Fi(process.cwd()).filter(y=>g.includes(y)),A=bo(process.cwd());if(h.includes("android")){let y=!!(A.androidManifest&&A.androidStrings)&&z.readFileSync(A.androidManifest,"utf-8").includes("expo.modules.updates.EXPO_UPDATE_URL")&&z.readFileSync(A.androidStrings,"utf-8").includes("expo_runtime_version");r.push(y?{level:"pass",message:"Android native Expo Updates configuration is synchronized."}:{level:"fail",message:"Android native Expo Updates configuration is missing. Run `mach ota setup --platform android`."})}if(h.includes("ios")){let y=!!A.iosExpoPlist&&z.readFileSync(A.iosExpoPlist,"utf-8").includes("EXUpdatesURL")&&z.readFileSync(A.iosExpoPlist,"utf-8").includes("EXUpdatesRuntimeVersion");r.push(y?{level:"pass",message:"iOS native Expo Updates configuration is synchronized."}:{level:"fail",message:"iOS native Expo Updates configuration is missing. Run `mach ota setup --platform ios`."})}}}else r.push({level:"fail",message:"mach-react-native is not available yet. Run `mach ota setup` to migrate this project to expo-updates."});for(let a of r){let l=a.level==="pass"?Me.green("PASS"):a.level==="warn"?Me.yellow("WARN"):Me.red("FAIL");Oe.info(`${l} ${a.message}`)}let s=r.filter(a=>a.level==="fail").length;s>0&&(kt(Me.red(`OTA verification failed with ${s} issue(s).`)),process.exit(1)),kt(Me.green("OTA verification passed."))}async function Mf(e){Et();let t=An(),n=await $.get(`/ota/${t.projectId}/updates`),i=n.data.updates||[];if(e.json){Oe.info(JSON.stringify(n.data,null,2));return}if(i.length===0){kt("No OTA updates found.");return}for(let r of i){let o=r.stats?.total||{};Oe.info(`${Me.bold(r.updateId)} ${Me.dim(`${r.platform} ${r.channelName} runtime ${r.runtimeVersion}`)} ${r.status||"active"}`),Oe.info(Me.dim(`  downloads ios=${o.iosDownloaded||0} android=${o.androidDownloaded||0} applied ios=${o.iosApplied||0} android=${o.androidApplied||0}`))}kt(`Found ${i.length} OTA update(s).`)}async function Ya(e,t){Et();let n=An(),i=Se(t.updateId);i||(Oe.error(`Missing update id. Use \`${m.nameLower} ota ${e} --update-id <id>\`.`),process.exit(1));let r=await $.post(`/ota/${n.projectId}/updates/${encodeURIComponent(i)}/${e}`);t.json?Oe.info(JSON.stringify(r.data,null,2)):kt(Me.green(`\u2713 OTA update ${e==="rollback"?"rolled back":"promoted"}: ${i}`))}async function at(e,t={}){let n=e||t.action||"publish";if(n==="setup")return xf({...t,action:n});if(n==="publish")return Lf({...t,action:n});if(n==="verify")return nl({...t,action:n});if(n==="list")return Mf({...t,action:n});if(n==="rollback")return Ya("rollback",{...t,action:n});if(n==="promote")return Ya("promote",{...t,action:n});let i=await hf({message:"What do you want to do?",options:[{value:"setup",label:"Setup OTA"},{value:"publish",label:"Publish OTA update"},{value:"verify",label:"Verify OTA setup"},{value:"list",label:"List OTA updates"}]});return ui(i)&&pi(),at(i,t)}import{intro as Uf,outro as il,log as xt}from"@clack/prompts";import Ve from"chalk";async function rl(){Uf(Ve.blue(`${m.name} CLI - User Profile`));let e=ye();if(!e){xt.warn(Ve.yellow("You are not logged in.")),xt.info(`Run \`${m.nameLower} login\` to authenticate.`),il();return}xt.info(`${Ve.bold("Logged in as:")} ${Ve.green(e.email)}`);try{await $.get("/projects");let n=ye().token.split(".");if(n.length===3){let i=JSON.parse(Buffer.from(n[1],"base64").toString());if(i.exp){let r=new Date(i.exp*1e3),o=new Date,s=r.getTime()-o.getTime();if(s>0){let a=Math.round(s/6e4),l=(a/60).toFixed(1);xt.info(`${Ve.bold("Token status:")} Valid (Expires in ~${l}h / ${a}m)`)}else xt.warn(`${Ve.bold("Token status:")} ${Ve.red("Expired")} (Auto-refresh failed)`)}}}catch{xt.warn(`${Ve.bold("Token status:")} ${Ve.red("Unreachable")} (Session might be truly expired)${Qe}`)}il(Ve.blue("---"))}import{spawn as Hf}from"child_process";import{log as lt}from"@clack/prompts";import Pe from"chalk";import jf from"fs";import Ff from"net";async function Bf(e){return new Promise(t=>{let n=Ff.createServer();n.once("error",i=>{i.code==="EADDRINUSE"?t(!0):t(!1)}),n.once("listening",()=>{n.close(),t(!1)}),n.listen(e,"0.0.0.0")})}async function ol(e,t=20){let n=e;for(;n<e+t;){if(!await Bf(n))return n;n++}throw new Error(`Could not find an available port after ${t} attempts starting from ${e}.`)}var sl=async e=>{lt.info(Pe.blue(`Starting ${m.name} Dev Orchestrator...`));let t=ce(),n=e.buildProfile||"development",i=t?we(t,n):null,r={...process.env};if(t?.projectId)try{lt.info(Pe.dim(`Fetching managed secrets for profile: ${n}...`));let u=await $.get(`/projects/${t.projectId}/secrets/export?env=${n}`);u.data?.status==="success"&&u.data.secrets&&(Object.assign(r,u.data.secrets),lt.info(Pe.magenta(`\u2713 Injected secrets from ${m.name} Dashboard.`)))}catch{lt.warn("Could not fetch managed secrets. Running with local env only.")}t&&Object.assign(r,_t(t,m.envPrefix)),i&&(Object.assign(r,_t(i,`${m.envPrefix}PROFILE_`)),i.env&&Object.assign(r,i.env));let o=!1;try{let u=JSON.parse(jf.readFileSync("package.json","utf-8"));o=!!(u.dependencies?.expo||u.devDependencies?.expo)}catch{lt.warn("Could not parse package.json. Defaulting to Bare React Native mode.")}let s=Number(e.port||i?.port||8081),a=await ol(s);a!==s&&lt.info(Pe.yellow(`Port ${s} is busy. ${m.name} is using ${a} instead.`));let l=process.platform==="win32"?"npx.cmd":"npx",d=[];if(o?(d=["expo","start","--port",String(a)],e.clear&&d.push("--clear"),e.tunnel&&d.push("--tunnel"),e.lan&&d.push("--lan"),e.localhost&&d.push("--localhost"),e.ios&&d.push("--ios"),e.android&&d.push("--android"),e.web&&d.push("--web")):(d=["react-native","start","--port",String(a)],e.clear&&d.push("--clear")),o){let u=[`${Pe.cyan("i")}  open iOS simulator`,`${Pe.cyan("a")}  open Android emulator/device`,`${Pe.cyan("w")}  open web`,`${Pe.cyan("r")}  reload app`];lt.info([Pe.bold("Launch controls"),...u.map(f=>`  ${f}`),"",Pe.dim("Direct launch: mach start --ios | --android | --web"),Pe.dim(`Metro URL: http://localhost:${a}`)].join(`
-`))}else lt.info(Pe.dim(`Metro URL: http://localhost:${a}`));let c=Hf(l,d,{stdio:"inherit",env:r});return new Promise((u,f)=>{c.on("exit",p=>{p===0?u():f(new Error(`Dev server exited with code ${p}`))}),c.on("error",p=>{f(p)})})};import{log as Ie}from"@clack/prompts";import De from"chalk";var al=async e=>{let t=ce();t||(Ie.error(De.red(`No ${m.configFileName} found in the current directory.`)),process.exit(1));let n=e.profile||"development",i=we(t,n);if(e.json){console.log(JSON.stringify({project:t,resolved:i},null,2));return}Ie.info(De.bgBlue.white(` Resolved ${m.name} Config [${n}] `)),Ie.info(De.dim("----------------------------------------")),Ie.info(`${De.blue("Project ID:")} ${t.projectId}`),Ie.info(`${De.blue("Name:")} ${t.name}`),Ie.info(`${De.blue("Scheme:")} ${t.scheme}`),Ie.info(`${De.blue("App directory:")} ${t.appDirectory||"."}`),i?(Ie.info(De.dim(`
-Profile Settings:`)),Ie.info(`${De.cyan("Distribution:")} ${i.distribution||"none"}`),Ie.info(`${De.cyan("Development Client:")} ${i.developmentClient||"false"}`),i.env&&Object.keys(i.env).length>0&&(Ie.info(De.dim(`
-Environment Variables:`)),Object.entries(i.env).forEach(([r,o])=>{Ie.info(`  ${r}=${o}`)}))):Ie.warn(`Profile '${n}' not found.`),Ie.info(De.dim("----------------------------------------"))};import{cancel as dm,confirm as vl,isCancel as En,log as _i,note as cm,outro as wi,select as um,text as $l}from"@clack/prompts";import Fe from"chalk";import pm from"fs";import _l from"path";import St from"fs";import Lt from"path";var Mt="./plugins/withMachDeepLinks",Wr="mach.deep-links.json",dl=["/*"],Yr=e=>{if(typeof e!="string")return;let t=e.trim();return t.length>0?t:void 0},gi=e=>{let t=new Set,n=[];for(let i of e){let r=Yr(i);!r||t.has(r)||(t.add(r),n.push(r))}return n},Ue=(...e)=>{for(let t of e){let n=Yr(t);if(n)return n}},ll=(e,t)=>e.length!==t.length?!1:e.every((n,i)=>n===t[i]);function cl(e){if(typeof e!="string")return;let t=e.trim().toLowerCase();if(t==="ios"||t==="android"||t==="all")return t}function yn(e){let t=e.includes("://")?e:`https://${e}`,n=new URL(t),i=n.pathname==="/"?"":n.pathname.replace(/\/+$/,"");return`${n.protocol}//${n.host}${i}`}function mi(e){return new URL(yn(e)).hostname}function hi(e){return e.trim().toLowerCase().replace(/[^a-z0-9+.-]/g,"-").replace(/^-+|-+$/g,"")||"app"}function ul(e=process.cwd()){let t=Lt.join(e,"package.json"),n=["app.json","app.config.json","app.config.js","app.config.ts"].some(r=>St.existsSync(Lt.join(e,r))),i=!1;if(St.existsSync(t))try{let r=JSON.parse(St.readFileSync(t,"utf-8"));i=!!(r.dependencies?.expo||r.devDependencies?.expo)}catch{i=!1}return n&&i?"expo":St.existsSync(Lt.join(e,"ios"))||St.existsSync(Lt.join(e,"android"))?"react-native":Un}function pl(e,t,n){if(t)return t;let i=!!(e.ios?.bundleIdentifier||n?.ios?.bundleIdentifier||e.deepLinks?.ios?.bundleIdentifier),r=!!(e.android?.package||n?.android?.package||n?.android?.applicationId||e.deepLinks?.android?.package);return i&&!r?"ios":r&&!i?"android":"all"}function Ai(e=process.cwd(),t){let n=t?.deepLinks?.web?.outputDir;return n||(St.existsSync(Lt.join(e,"public"))?"public":"deep-links")}function fl(e,t){let n=e.deepLinks,i=yn(t.baseUrl||n?.baseUrl||(t.domain?`https://${t.domain}`:"")),r=Yr(t.domain)||(t.baseUrl?mi(i):n?.domain)||mi(i),o=t.profile||n?.profile||"production",s=we(e,o)||{},a=s.ios||{},l=s.android||{},d=e.submit?.[o]?.ios||{},c=e.submit?.[o]?.android||{},u=hi(t.scheme||n?.scheme||a.scheme||e.scheme||e.slug||e.name||"app"),f=mt(e,o),p=gi([...t.androidFingerprint||[],...n?.android?.sha256CertFingerprints||[],...l.sha256CertFingerprints||[],...e.android?.sha256CertFingerprints||[]]);return{baseUrl:i,domain:r,scheme:u,profile:o!=="production"?o:void 0,paths:n?.paths?.length?n.paths:["/*"],ios:{appStoreId:Ue(t.appStoreId,n?.ios?.appStoreId,a.ascAppId,d.ascAppId,e.ios?.ascAppId),appleTeamId:Ue(t.appleTeamId,n?.ios?.appleTeamId,a.appleTeamId,a.developerTeamId,d.appleTeamId,d.developerTeamId,e.ios?.appleTeamId,e.ios?.developerTeamId,f.teamId),bundleIdentifier:Ue(t.iosBundleId,n?.ios?.bundleIdentifier,a.bundleIdentifier,a.bundleId,e.ios?.bundleIdentifier,e.ios?.bundleId,e.expo?.ios?.bundleIdentifier),webCredentials:!!n?.ios?.webCredentials,activityContinuation:!!n?.ios?.activityContinuation},android:{package:Ue(t.androidPackage,n?.android?.package,l.package,l.applicationId,e.android?.package,e.expo?.android?.package,c.packageName,c.package),sha256CertFingerprints:p},web:{smartAppBanner:n?.web?.smartAppBanner??!0,outputDir:t.output||n?.web?.outputDir||Ai(process.cwd(),e)}}}function yi(e,t={}){let n=e.deepLinks,i=t.profile||n?.profile||"production",r=t.expoHints||null,o=Ue(n?.baseUrl,r?.domain?`https://${r.domain}`:void 0);if(!o)return null;let s=yn(o),a=we(e,i)||{},l=a.ios||{},d=a.android||{},c=e.submit?.[i]?.ios||{},u=e.submit?.[i]?.android||{},f=mt(e,i),p=Ue(n?.domain,r?.domain)||mi(s),g=hi(Ue(n?.scheme,l.scheme,e.scheme,r?.scheme,e.slug,e.name,"app")||"app"),h=n?.paths?.length?n.paths:[...dl];return{baseUrl:s,domain:p,scheme:g,profile:i!=="production"?i:void 0,paths:h,ios:{appStoreId:Ue(n?.ios?.appStoreId,l.ascAppId,c.ascAppId,e.ios?.ascAppId),appleTeamId:Ue(n?.ios?.appleTeamId,l.appleTeamId,l.developerTeamId,c.appleTeamId,c.developerTeamId,e.ios?.appleTeamId,e.ios?.developerTeamId,f.teamId),bundleIdentifier:Ue(n?.ios?.bundleIdentifier,l.bundleIdentifier,l.bundleId,e.ios?.bundleIdentifier,e.ios?.bundleId,e.expo?.ios?.bundleIdentifier,r?.iosBundleIdentifier),webCredentials:!!n?.ios?.webCredentials,activityContinuation:!!n?.ios?.activityContinuation},android:{package:Ue(n?.android?.package,d.package,d.applicationId,e.android?.package,e.expo?.android?.package,u.packageName,u.package,r?.androidPackage),sha256CertFingerprints:gi([...n?.android?.sha256CertFingerprints||[],...d.sha256CertFingerprints||[],...e.android?.sha256CertFingerprints||[]])},web:{smartAppBanner:n?.web?.smartAppBanner??!0,outputDir:n?.web?.outputDir||Ai(t.cwd||process.cwd(),e)}}}function Si(e,t,n="production",i=process.cwd()){return t?.domain?yi({...e,deepLinks:{baseUrl:`https://${t.domain}`,domain:t.domain,scheme:t.scheme}},{profile:n,cwd:i,expoHints:t}):null}function Gf(e,t,n=t.profile||"production"){let i=yi({...e,deepLinks:{baseUrl:t.baseUrl}},{profile:n}),r={baseUrl:t.baseUrl};n!=="production"&&(r.profile=n),t.domain&&t.domain!==mi(t.baseUrl)&&(r.domain=t.domain),t.scheme&&t.scheme!==i?.scheme&&(r.scheme=t.scheme),t.paths?.length&&!ll(t.paths,dl)&&(r.paths=t.paths);let o={};t.ios?.bundleIdentifier&&t.ios.bundleIdentifier!==i?.ios?.bundleIdentifier&&(o.bundleIdentifier=t.ios.bundleIdentifier),t.ios?.appleTeamId&&t.ios.appleTeamId!==i?.ios?.appleTeamId&&(o.appleTeamId=t.ios.appleTeamId),t.ios?.appStoreId&&t.ios.appStoreId!==i?.ios?.appStoreId&&(o.appStoreId=t.ios.appStoreId),t.ios?.webCredentials&&(o.webCredentials=!0),t.ios?.activityContinuation&&(o.activityContinuation=!0),Object.keys(o).length>0&&(r.ios=o);let s={};t.android?.package&&t.android.package!==i?.android?.package&&(s.package=t.android.package);let a=t.android?.sha256CertFingerprints||[],l=i?.android?.sha256CertFingerprints||[];a.length>0&&!ll(a,l)&&(s.sha256CertFingerprints=a),Object.keys(s).length>0&&(r.android=s);let d={outputDir:t.web?.outputDir||"deep-links"};return t.web?.smartAppBanner===!1&&(d.smartAppBanner=!1),r.web=d,r}function ml(e,t,n,i=n.profile||"production"){let r={...e,framework:t,scheme:e.scheme||n.scheme};return{...r,deepLinks:Gf(r,n,i)}}function gl(e,t=process.cwd()){let n=Lt.join(t,"mach.config.json");return St.writeFileSync(n,`${JSON.stringify(e,null,2)}
-`),n}import pe from"fs";import Ae from"path";import{spawnSync as hl}from"child_process";var Sn="@radhya/mach/expo-plugin",Vf=`const fs = require('fs')
+`,a=o[1]||"",l=o[2]||"",c=l.match(/\r?\n([ \t]+)\S/)?.[1]||`${a}    `,u=l.trim().length===0?`${s}${c}'${de}',${s}${a}`:l.includes(`
+`)||l.includes("\r")?`${s}${c}'${de}',${l}`:`${s}${c}'${de}',${s}${c}${l.trim()}${s}${a}`,f=`${o[0].slice(0,o[0].indexOf("[")+1)}${u}]`;return V.writeFileSync(n,`${i.slice(0,o.index)}${f}${i.slice(o.index+o[0].length)}`),"inserted"}async function gf(e,t,n){let i=[];if(uf(e)){let o=ci(e),s=!!(n.installPlugin||n.yes);if(!s&&!n.skipInstall&&Br()){let a=await Va({message:o?`Update the local ${m.npmScope}/mach Expo plugin (${o} \u2192 ${et})?`:`Install ${m.npmScope}/mach locally so Expo can use ${de}?`,initialValue:!0});ui(a)&&pi(),s=!!a}if(s&&!n.skipInstall){let a=pf(e);a.ok?i.push(`Installed a compatible ${de} with ${a.label}.`):i.push(`Could not install ${m.npmScope}/mach with ${a.label}: ${a.error||"unknown error"}.`)}else i.push(`Install ${m.npmScope}/mach@${et} or newer in this app so Expo can resolve ${de}.`)}else i.push(`Local ${de} is compatible (${ci(e)}).`);let r=mf(e);if(r==="already"&&i.push(`Expo config already includes ${de}.`),r==="inserted"&&i.push(`Expo config updated to include ${de}.`),r==="manual"&&i.push(`Add "${de}" to the plugins array in app.config.ts/app.config.js.`),r==="missing"){let o=ff(e,t);o?i.push(`${o} updated to include ${de}.`):i.push(`Add "${de}" to your Expo config plugins array.`)}return i}async function Ba(e,t){if(t.skipInstall)return!1;if(t.yes)return!0;if(!Br())return!1;let n=await Va({message:e,initialValue:!0});return ui(n)&&pi(),!!n}async function hf(e,t,n){let i=[];if(t==="react-native"&&!mt(e,"expo"))if(await Ba("Install Expo Modules required by the Mach OTA runtime? This updates package and native project files.",n)){let o=po(e);if(!o.ok||!mt(e,"expo"))throw new Error(`Expo Modules installation failed: ${o.error||o.command}`);i.push("Installed and configured Expo Modules for the existing React Native project.")}else i.push("Expo Modules are required. Run `npx install-expo-modules@latest`, then run `mach ota setup` again.");if(!mt(e,"expo-updates"))if(await Ba("Install the expo-updates runtime?",n)){let o=fo(e);if(!o.ok||!mt(e,"expo-updates"))throw new Error(`expo-updates installation failed: ${o.error||o.command}`);i.push("Installed the Expo-compatible expo-updates version.")}else i.push("Install expo-updates with `npx expo install expo-updates`, then run `mach ota setup` again.");return i}async function Ha(e,t,n,i,r){if(t)return t;if(r||!Br()){if(i)throw new Error(`${e.replace(/:$/,"")} is required.`);return}let o=await af({message:e,placeholder:n,validate(s){if(i&&s.trim().length===0)return"Required."}});return ui(o)&&pi(),Se(o)}function Vr(e,t,n){return Yt(e,{runtimeVersion:t.runtimeVersion,framework:ve(t.framework)||ve(e.framework),platform:n})}function Af(e){let t=Wt(process.cwd(),e);if(!t)throw new Error(`Resolved Expo OTA configuration does not match this publish: Expo config could not be resolved. Run \`mach ota setup\` to update ${de}, then create a new native build if its embedded runtime changes.`);let n=[];if(t.runtimeVersion!==e.runtimeVersion&&n.push(`runtime is ${t.runtimeVersion||"missing"} (expected ${e.runtimeVersion})`),t.channel!==e.channel&&n.push(`channel is ${t.channel||"missing"} (expected ${e.channel})`),t.url!==e.url&&n.push(`URL is ${t.url||"missing"} (expected ${e.url})`),n.length>0)throw new Error(`Resolved Expo OTA configuration does not match this publish: ${n.join("; ")}. Run \`mach ota setup\` to update ${de}, then create a new native build if its embedded runtime changes.`);return t}function yf(e){return Fr.createHash("sha256").update(V.readFileSync(e)).digest("hex")}function Sf(e){let t=ee.extname(e).toLowerCase();return t===".json"?"application/json":t===".js"||t===".bundle"||t===".hbc"?"application/javascript":t===".map"?"application/json":t===".png"?"image/png":t===".jpg"||t===".jpeg"?"image/jpeg":t===".webp"?"image/webp":t===".gif"?"image/gif":t===".svg"?"image/svg+xml":t===".ttf"?"font/ttf":t===".otf"?"font/otf":t===".woff"?"font/woff":t===".woff2"?"font/woff2":"application/octet-stream"}function qa(e){let t=[];if(!V.existsSync(e))return t;for(let n of V.readdirSync(e)){let i=ee.join(e,n),r=V.statSync(i);r.isDirectory()?t.push(...qa(i)):r.isFile()&&t.push(i)}return t}function bf(e,t){let n=e.filter(i=>{let r=i.toLowerCase();return r.endsWith(".map")?!1:r.endsWith(".js")||r.endsWith(".bundle")||r.endsWith(".hbc")});return n.find(i=>i.toLowerCase().includes(t))||n.sort((i,r)=>V.statSync(r).size-V.statSync(i).size)[0]}async function ja(e){let t=await $.post("/ota/upload-url",{projectId:e.projectId,updateId:e.updateId,platform:e.platform,fileName:e.fileName,contentType:e.contentType});if(t.data.status!=="success")throw new Error(t.data.message||`Could not create upload URL for ${e.fileName}`);let n=V.statSync(e.filePath).size;return await lf.put(t.data.uploadUrl,V.createReadStream(e.filePath),{headers:{"Content-Type":e.contentType,"Content-Length":n},maxBodyLength:1/0,maxContentLength:1/0}),{key:t.data.key,url:t.data.publicUrl,contentType:e.contentType,hash:yf(e.filePath),size:n}}function Ja(e,t,n,i={}){let r=za(e,t,{cwd:n,stdio:"inherit",env:{...process.env,CI:process.env.CI||"1",EXPO_NO_TELEMETRY:"1",...i}});if(r.error)throw new Error(r.error.message);if(r.status!==0)throw new Error(`${e} ${t.join(" ")} exited with code ${r.status}`)}function If(e,t,n,i,r){Ja("npx",["expo","export","--platform",e,"--output-dir",t],process.cwd(),{MACH_OTA_RUNTIME_VERSION:n,MACH_OTA_CHANNEL:i,MACH_OTA_URL:r})}function Ef(e,t){let n=e==="ios"?"main.jsbundle":"index.android.bundle",r=["index.js","index.ts","index.tsx"].find(s=>V.existsSync(ee.join(process.cwd(),s)))||"index.js",o=ee.join(t,"assets");V.mkdirSync(o,{recursive:!0}),Ja("npx",["react-native","bundle","--platform",e,"--dev","false","--entry-file",r,"--bundle-output",ee.join(t,n),"--assets-dest",o],process.cwd())}async function _f(e){let t=e.config.projectId,n=`ota_${Date.now()}_${e.platform}_${Fr.randomUUID().slice(0,8)}`,i=ee.join(process.cwd(),".mach","ota",n,e.platform);V.rmSync(i,{recursive:!0,force:!0}),V.mkdirSync(i,{recursive:!0}),e.engine==="expo-updates"?If(e.platform,i,e.runtimeVersion,e.channel,e.config.ota?.url||""):Ef(e.platform,i);let r=e.engine==="expo-updates"?xa(i,e.platform):void 0,o=r?La(i,r):qa(i),s=r?ee.join(i,r.bundle):bf(o,e.platform);if(!s)throw new Error(`Could not find a ${e.platform} JS bundle in ${i}.`);let a=new Map((r?.assets||[]).map(b=>[b.path,b])),l=[];for(let b of o){let C=ee.relative(i,b).replace(/\\/g,"/"),I=a.get(C),j=b===s?"application/javascript":I?di(I.ext):Sf(b);l.push({filePath:b,relative:C,uploaded:await ja({projectId:t,updateId:n,platform:e.platform,filePath:b,fileName:C,contentType:j})})}let d=l.find(b=>b.filePath===s),c=e.engine==="expo-updates"?Fr.randomUUID():void 0,u=e.engine==="expo-updates"?Ua(e.expoConfig):void 0;if(e.engine==="expo-updates"&&(!u||Object.keys(u).length===0))throw new Error("Could not resolve the public Expo config required by the OTA manifest. Run `mach ota verify` and try again.");let f=r?r.assets.map(b=>{let C=l.find(I=>I.relative===b.path);if(!C)throw new Error(`Could not find uploaded Expo asset ${b.path}.`);return{key:Mr(C.filePath),url:C.uploaded.url,contentType:di(b.ext),fileExtension:Ma(b.ext),hash:Ur(C.filePath),size:C.uploaded.size}}):l.filter(b=>b.filePath!==s&&!b.relative.endsWith(".map")).map(b=>({key:b.relative,url:b.uploaded.url,contentType:b.uploaded.contentType,hash:b.uploaded.hash,size:b.uploaded.size})),p=r?{key:Mr(d.filePath),url:d.uploaded.url,contentType:di(void 0,!0),hash:Ur(d.filePath),size:d.uploaded.size}:{key:ee.basename(d.relative),url:d.uploaded.url,contentType:d.uploaded.contentType,hash:d.uploaded.hash,size:d.uploaded.size},h={id:c||n,createdAt:new Date().toISOString(),runtimeVersion:e.runtimeVersion,launchAsset:p,assets:f,metadata:{projectId:t,channel:e.channel,...e.message?{message:e.message}:{},engine:e.engine},extra:{...u?{expoClient:u}:{},mach:{projectId:t,updateId:n,...c?{expoUpdateId:c}:{},channel:e.channel,platform:e.platform}}},g=ee.join(i,"mach-manifest.json");V.writeFileSync(g,JSON.stringify(h,null,2));let y=await ja({projectId:t,updateId:n,platform:e.platform,filePath:g,fileName:"manifest.json",contentType:"application/json"}),S=await $.post("/ota/publish",{projectId:t,updateId:n,expoUpdateId:c,channelName:e.channel,runtimeVersion:e.runtimeVersion,platform:e.platform,manifestKey:y.key,message:e.message,launchAsset:p,assets:f});if(S.data.status!=="success")throw new Error(S.data.message||`Failed to publish ${e.platform} OTA update.`);return S.data.update}async function $f(e){let t=Sn(),n=ve(e.framework)||Hr(t),i;try{i=Wa(jr(e.engine,n))}catch(f){Re.error(f.message),process.exit(1)}let r=!!e.yes,o=await Ha("OTA channel:",Se(e.channel||e.branch||t.ota?.channel)||"production","production",!0,r),s=`${Qe.replace(/\/$/,"")}/api/ota/expo/${t.projectId}`,a=Se(e.url||t.ota?.url),l=a?.includes("/api/ota/react-native/")?void 0:a,d=await Ha("Mach OTA update URL:",l||s,s,!0,r);t.framework=n;let c={...t.ota||{},enabled:!0,engine:i,channel:o,url:d,deploymentUrl:d,runtimeVersionPolicy:t.ota?.runtimeVersionPolicy||"appVersion"};delete c.statsUrl,t.ota=c,delete t.update,df(t);let u=[`${m.configFileName} updated.`];if(u.push(...await hf(process.cwd(),n,e)),u.push(...await gf(process.cwd(),n,e)),n==="react-native"&&mt(process.cwd(),"expo")&&mt(process.cwd(),"expo-updates")&&fi(process.cwd())){let f=Gr(e.platform||"all"),p=Li(process.cwd()).filter(h=>f.includes(h));p.length===0&&u.push("No matching committed ios/android project was found for native configuration sync.");for(let h of p){let g=Vr(t,e,h),S=mo({cwd:process.cwd(),platforms:[h],runtimeVersion:g,channel:o,url:d}).find(b=>!b.ok);if(S)throw new Error(`Could not synchronize ${h} Expo Updates configuration: ${S.error||S.command}`);u.push(`Synchronized ${h} native Expo Updates configuration for runtime ${g}.`)}}u.push("Create and install one new native build after initial OTA setup. Existing app binaries keep their embedded update URL."),rf(u.map(f=>`- ${f}`).join(`
+`),"OTA setup"),await Xa({...e,action:"verify"})}async function wf(e){Et();let t=Sn(),n=ve(e.framework)||Hr(t),i;try{i=Wa(jr(e.engine||t.ota?.engine,n))}catch(a){Re.error(`${a.message} Run \`mach ota setup\` to migrate this project.`),process.exit(1)}let r=Se(e.channel||e.branch||t.ota?.channel)||"production",o=Gr(e.platform||"all"),s=sf();s.start(`Publishing OTA update (${o.join("+")}, ${r})`);try{let a=[];for(let l of o){let d=Vr(t,e,l),c=Af({platform:l,runtimeVersion:d,channel:r,url:Se(t.ota?.url)||""});s.message(`Exporting and uploading ${l} OTA bundle for runtime ${d}...`),a.push(await _f({config:t,engine:i,platform:l,channel:r,runtimeVersion:d,message:e.message,expoConfig:c.expoConfig}))}if(s.stop("OTA update published."),e.json)Re.info(JSON.stringify({status:"success",updates:a},null,2));else{let l=Array.from(new Set(a.map(d=>d.runtimeVersion).filter(Boolean)));kt(Me.green(`\u2713 OTA update live on "${r}" for runtime ${l.join(", ")||"unknown"}.`));for(let d of a)Re.info(Me.dim(`${d.platform}: ${d.updateId}`))}}catch(a){s.stop("OTA publish failed."),Re.error(a.response?.data?.message||a.message),process.exit(1)}}async function Xa(e){let t=Sn(),n=ve(e.framework)||Hr(t),i=jr(e.engine||t.ota?.engine,n),r=[],o=t.ota;if(r.push(o?.enabled?{level:"pass",message:"mach.config.json has ota.enabled."}:{level:"fail",message:"mach.config.json is missing ota.enabled. Run `mach ota setup`."}),r.push(o?.url?{level:"pass",message:`OTA URL configured: ${o.url}`}:{level:"fail",message:"OTA URL is missing. Run `mach ota setup`."}),r.push(o?.channel?{level:"pass",message:`Default channel: ${o.channel}`}:{level:"warn",message:"No default OTA channel configured; publish will use production."}),r.push(o?.runtimeVersionPolicy||o?.runtimeVersion?{level:"pass",message:"Runtime version policy configured."}:{level:"warn",message:"No explicit runtime policy configured; Mach will use Expo runtimeVersion or package.json version."}),i==="expo-updates"){let a=xt(ee.join(process.cwd(),"package.json"))||{},l={...a.dependencies||{},...a.devDependencies||{}};n==="react-native"&&r.push(l.expo?{level:"pass",message:"Expo Modules are installed for the bare React Native project."}:{level:"fail",message:"Expo Modules are missing. Run `mach ota setup` to install the bare React Native OTA runtime."}),r.push(l["expo-updates"]?{level:"pass",message:"expo-updates is installed."}:{level:"fail",message:"expo-updates is missing. Run `mach ota setup`."}),r.push(fi(process.cwd())?{level:"pass",message:`${m.npmScope}/mach is installed locally for the Expo plugin.`}:{level:"fail",message:`${m.npmScope}/mach is not installed locally; run \`mach ota setup\`.`});let d=Gr(e.platform||"all"),c=Se(e.channel||e.branch||o?.channel)||"production",u=Se(o?.url)||"",f=d.map(h=>{let g=Vr(t,e,h);return{platform:h,runtimeVersion:g,delivery:Wt(process.cwd(),{platform:h,runtimeVersion:g,channel:c,url:u})}}),p=f[0]?.delivery;if(p){let h=p.expoConfig.updates?.enabled!==!1,g=Se(p.expoConfig.updates?.checkAutomatically)?.toUpperCase()||"ON_LOAD";r.push(p.url===o?.url?{level:"pass",message:"Expo Updates URL resolves to Mach."}:{level:"warn",message:`Expo Updates URL resolves to ${p.url||"none"} instead of ${o?.url||"the Mach OTA URL"}.`}),r.push(p.channel===c?{level:"pass",message:`Expo update channel header resolves to ${c}.`}:{level:"warn",message:`Expo update channel header is ${p.channel||"not set"}; install the latest ${m.npmScope}/mach package and rebuild.`}),r.push(h?{level:"pass",message:"Expo Updates is enabled."}:{level:"fail",message:"Expo config has updates.enabled=false, so this app cannot receive OTA updates."}),r.push(g!=="NEVER"&&g!=="ON_ERROR_RECOVERY"?{level:"pass",message:`Expo checks for updates automatically (${g}).`}:{level:"fail",message:`Expo checkAutomatically is ${g}; use ON_LOAD to receive Mach updates when the app starts.`})}else r.push({level:"fail",message:`Could not resolve Expo config. Confirm ${de} is present and run \`mach ota setup\` again.`});for(let{platform:h,runtimeVersion:g,delivery:y}of f)r.push(y?.runtimeVersion===g?{level:"pass",message:`${h} Expo runtime resolves to ${g}.`}:{level:"fail",message:`${h} Expo runtime resolves to ${y?.runtimeVersion||"none"} instead of ${g}. Run \`mach ota setup\`, then rebuild the app.`});if(n==="react-native"){let h=d,g=Li(process.cwd()).filter(S=>h.includes(S)),y=go(process.cwd());if(g.includes("android")){let S=!!(y.androidManifest&&y.androidStrings)&&V.readFileSync(y.androidManifest,"utf-8").includes("expo.modules.updates.EXPO_UPDATE_URL")&&V.readFileSync(y.androidStrings,"utf-8").includes("expo_runtime_version");r.push(S?{level:"pass",message:"Android native Expo Updates configuration is synchronized."}:{level:"fail",message:"Android native Expo Updates configuration is missing. Run `mach ota setup --platform android`."})}if(g.includes("ios")){let S=!!y.iosExpoPlist&&V.readFileSync(y.iosExpoPlist,"utf-8").includes("EXUpdatesURL")&&V.readFileSync(y.iosExpoPlist,"utf-8").includes("EXUpdatesRuntimeVersion");r.push(S?{level:"pass",message:"iOS native Expo Updates configuration is synchronized."}:{level:"fail",message:"iOS native Expo Updates configuration is missing. Run `mach ota setup --platform ios`."})}}}else r.push({level:"fail",message:"mach-react-native is not available yet. Run `mach ota setup` to migrate this project to expo-updates."});for(let a of r){let l=a.level==="pass"?Me.green("PASS"):a.level==="warn"?Me.yellow("WARN"):Me.red("FAIL");Re.info(`${l} ${a.message}`)}let s=r.filter(a=>a.level==="fail").length;s>0&&(kt(Me.red(`OTA verification failed with ${s} issue(s).`)),process.exit(1)),kt(Me.green("OTA verification passed."))}async function vf(e){Et();let t=Sn(),n=await $.get(`/ota/${t.projectId}/updates`),i=n.data.updates||[];if(e.json){Re.info(JSON.stringify(n.data,null,2));return}if(i.length===0){kt("No OTA updates found.");return}for(let r of i){let o=r.stats?.total||{};Re.info(`${Me.bold(r.updateId)} ${Me.dim(`${r.platform} ${r.channelName} runtime ${r.runtimeVersion}`)} ${r.status||"active"}`),Re.info(Me.dim(`  downloads ios=${o.iosDownloaded||0} android=${o.androidDownloaded||0} applied ios=${o.iosApplied||0} android=${o.androidApplied||0}`))}kt(`Found ${i.length} OTA update(s).`)}async function Ga(e,t){Et();let n=Sn(),i=Se(t.updateId);i||(Re.error(`Missing update id. Use \`${m.nameLower} ota ${e} --update-id <id>\`.`),process.exit(1));let r=await $.post(`/ota/${n.projectId}/updates/${encodeURIComponent(i)}/${e}`);t.json?Re.info(JSON.stringify(r.data,null,2)):kt(Me.green(`\u2713 OTA update ${e==="rollback"?"rolled back":"promoted"}: ${i}`))}async function at(e,t={}){let n=e||t.action||"publish";if(n==="setup")return $f({...t,action:n});if(n==="publish")return wf({...t,action:n});if(n==="verify")return Xa({...t,action:n});if(n==="list")return vf({...t,action:n});if(n==="rollback")return Ga("rollback",{...t,action:n});if(n==="promote")return Ga("promote",{...t,action:n});let i=await of({message:"What do you want to do?",options:[{value:"setup",label:"Setup OTA"},{value:"publish",label:"Publish OTA update"},{value:"verify",label:"Verify OTA setup"},{value:"list",label:"List OTA updates"}]});return ui(i)&&pi(),at(i,t)}import{intro as Rf,outro as Za,log as Lt}from"@clack/prompts";import Ve from"chalk";async function Qa(){Rf(Ve.blue(`${m.name} CLI - User Profile`));let e=ye();if(!e){Lt.warn(Ve.yellow("You are not logged in.")),Lt.info(`Run \`${m.nameLower} login\` to authenticate.`),Za();return}Lt.info(`${Ve.bold("Logged in as:")} ${Ve.green(e.email)}`);try{await $.get("/projects");let n=ye().token.split(".");if(n.length===3){let i=JSON.parse(Buffer.from(n[1],"base64").toString());if(i.exp){let r=new Date(i.exp*1e3),o=new Date,s=r.getTime()-o.getTime();if(s>0){let a=Math.round(s/6e4),l=(a/60).toFixed(1);Lt.info(`${Ve.bold("Token status:")} Valid (Expires in ~${l}h / ${a}m)`)}else Lt.warn(`${Ve.bold("Token status:")} ${Ve.red("Expired")} (Auto-refresh failed)`)}}}catch{Lt.warn(`${Ve.bold("Token status:")} ${Ve.red("Unreachable")} (Session might be truly expired)${Qe}`)}Za(Ve.blue("---"))}import{spawn as Df}from"child_process";import{log as lt}from"@clack/prompts";import Oe from"chalk";import Cf from"fs";import Of from"net";async function Pf(e){return new Promise(t=>{let n=Of.createServer();n.once("error",i=>{i.code==="EADDRINUSE"?t(!0):t(!1)}),n.once("listening",()=>{n.close(),t(!1)}),n.listen(e,"0.0.0.0")})}async function el(e,t=20){let n=e;for(;n<e+t;){if(!await Pf(n))return n;n++}throw new Error(`Could not find an available port after ${t} attempts starting from ${e}.`)}var tl=async e=>{lt.info(Oe.blue(`Starting ${m.name} Dev Orchestrator...`));let t=le(),n=e.buildProfile||"development",i=t?_e(t,n):null,r={...process.env};if(t?.projectId)try{lt.info(Oe.dim(`Fetching managed secrets for profile: ${n}...`));let u=await $.get(`/projects/${t.projectId}/secrets/export?env=${n}`);u.data?.status==="success"&&u.data.secrets&&(Object.assign(r,u.data.secrets),lt.info(Oe.magenta(`\u2713 Injected secrets from ${m.name} Dashboard.`)))}catch{lt.warn("Could not fetch managed secrets. Running with local env only.")}t&&Object.assign(r,$t(t,m.envPrefix)),i&&(Object.assign(r,$t(i,`${m.envPrefix}PROFILE_`)),i.env&&Object.assign(r,i.env));let o=!1;try{let u=JSON.parse(Cf.readFileSync("package.json","utf-8"));o=!!(u.dependencies?.expo||u.devDependencies?.expo)}catch{lt.warn("Could not parse package.json. Defaulting to Bare React Native mode.")}let s=Number(e.port||i?.port||8081),a=await el(s);a!==s&&lt.info(Oe.yellow(`Port ${s} is busy. ${m.name} is using ${a} instead.`));let l=process.platform==="win32"?"npx.cmd":"npx",d=[];if(o?(d=["expo","start","--port",String(a)],e.clear&&d.push("--clear"),e.tunnel&&d.push("--tunnel"),e.lan&&d.push("--lan"),e.localhost&&d.push("--localhost"),e.ios&&d.push("--ios"),e.android&&d.push("--android"),e.web&&d.push("--web")):(d=["react-native","start","--port",String(a)],e.clear&&d.push("--clear")),o){let u=[`${Oe.cyan("i")}  open iOS simulator`,`${Oe.cyan("a")}  open Android emulator/device`,`${Oe.cyan("w")}  open web`,`${Oe.cyan("r")}  reload app`];lt.info([Oe.bold("Launch controls"),...u.map(f=>`  ${f}`),"",Oe.dim("Direct launch: mach start --ios | --android | --web"),Oe.dim(`Metro URL: http://localhost:${a}`)].join(`
+`))}else lt.info(Oe.dim(`Metro URL: http://localhost:${a}`));let c=Df(l,d,{stdio:"inherit",env:r});return new Promise((u,f)=>{c.on("exit",p=>{p===0?u():f(new Error(`Dev server exited with code ${p}`))}),c.on("error",p=>{f(p)})})};import{log as Ie}from"@clack/prompts";import Pe from"chalk";var nl=async e=>{let t=le();t||(Ie.error(Pe.red(`No ${m.configFileName} found in the current directory.`)),process.exit(1));let n=e.profile||"development",i=_e(t,n);if(e.json){console.log(JSON.stringify({project:t,resolved:i},null,2));return}Ie.info(Pe.bgBlue.white(` Resolved ${m.name} Config [${n}] `)),Ie.info(Pe.dim("----------------------------------------")),Ie.info(`${Pe.blue("Project ID:")} ${t.projectId}`),Ie.info(`${Pe.blue("Name:")} ${t.name}`),Ie.info(`${Pe.blue("Scheme:")} ${t.scheme}`),Ie.info(`${Pe.blue("App directory:")} ${t.appDirectory||"."}`),i?(Ie.info(Pe.dim(`
+Profile Settings:`)),Ie.info(`${Pe.cyan("Distribution:")} ${i.distribution||"none"}`),Ie.info(`${Pe.cyan("Development Client:")} ${i.developmentClient||"false"}`),i.env&&Object.keys(i.env).length>0&&(Ie.info(Pe.dim(`
+Environment Variables:`)),Object.entries(i.env).forEach(([r,o])=>{Ie.info(`  ${r}=${o}`)}))):Ie.warn(`Profile '${n}' not found.`),Ie.info(Pe.dim("----------------------------------------"))};import{cancel as Zf,confirm as to,isCancel as Ft,log as _i,note as Qf,outro as $i,select as em,text as Il}from"@clack/prompts";import Fe from"chalk";import tm from"fs";import yl from"path";import bt from"fs";import Mt from"path";var Ut="./plugins/withMachDeepLinks",zr="mach.deep-links.json",rl=["/*"],Kr=e=>{if(typeof e!="string")return;let t=e.trim();return t.length>0?t:void 0},gi=e=>{let t=new Set,n=[];for(let i of e){let r=Kr(i);!r||t.has(r)||(t.add(r),n.push(r))}return n},Ue=(...e)=>{for(let t of e){let n=Kr(t);if(n)return n}},il=(e,t)=>e.length!==t.length?!1:e.every((n,i)=>n===t[i]);function ol(e){if(typeof e!="string")return;let t=e.trim().toLowerCase();if(t==="ios"||t==="android"||t==="all")return t}function bn(e){let t=e.includes("://")?e:`https://${e}`,n=new URL(t),i=n.pathname==="/"?"":n.pathname.replace(/\/+$/,"");return`${n.protocol}//${n.host}${i}`}function mi(e){return new URL(bn(e)).hostname}function hi(e){return e.trim().toLowerCase().replace(/[^a-z0-9+.-]/g,"-").replace(/^-+|-+$/g,"")||"app"}function sl(e=process.cwd()){let t=Mt.join(e,"package.json"),n=["app.json","app.config.json","app.config.js","app.config.ts"].some(r=>bt.existsSync(Mt.join(e,r))),i=!1;if(bt.existsSync(t))try{let r=JSON.parse(bt.readFileSync(t,"utf-8"));i=!!(r.dependencies?.expo||r.devDependencies?.expo)}catch{i=!1}return n&&i?"expo":bt.existsSync(Mt.join(e,"ios"))||bt.existsSync(Mt.join(e,"android"))?"react-native":Bn}function al(e,t,n){if(t)return t;let i=!!(e.ios?.bundleIdentifier||n?.ios?.bundleIdentifier||e.deepLinks?.ios?.bundleIdentifier),r=!!(e.android?.package||n?.android?.package||n?.android?.applicationId||e.deepLinks?.android?.package);return i&&!r?"ios":r&&!i?"android":"all"}function Ai(e=process.cwd(),t){let n=t?.deepLinks?.web?.outputDir;return n||(bt.existsSync(Mt.join(e,"public"))?"public":"deep-links")}function ll(e,t){let n=e.deepLinks,i=bn(t.baseUrl||n?.baseUrl||(t.domain?`https://${t.domain}`:"")),r=Kr(t.domain)||(t.baseUrl?mi(i):n?.domain)||mi(i),o=t.profile||n?.profile||"production",s=_e(e,o)||{},a=s.ios||{},l=s.android||{},d=e.submit?.[o]?.ios||{},c=e.submit?.[o]?.android||{},u=hi(t.scheme||n?.scheme||a.scheme||e.scheme||e.slug||e.name||"app"),f=gt(e,o),p=gi([...t.androidFingerprint||[],...n?.android?.sha256CertFingerprints||[],...l.sha256CertFingerprints||[],...e.android?.sha256CertFingerprints||[]]);return{baseUrl:i,domain:r,scheme:u,profile:o!=="production"?o:void 0,paths:n?.paths?.length?n.paths:["/*"],ios:{appStoreId:Ue(t.appStoreId,n?.ios?.appStoreId,a.ascAppId,d.ascAppId,e.ios?.ascAppId),appleTeamId:Ue(t.appleTeamId,n?.ios?.appleTeamId,a.appleTeamId,a.developerTeamId,d.appleTeamId,d.developerTeamId,e.ios?.appleTeamId,e.ios?.developerTeamId,f.teamId),bundleIdentifier:Ue(t.iosBundleId,n?.ios?.bundleIdentifier,a.bundleIdentifier,a.bundleId,e.ios?.bundleIdentifier,e.ios?.bundleId,e.expo?.ios?.bundleIdentifier),webCredentials:!!n?.ios?.webCredentials,activityContinuation:!!n?.ios?.activityContinuation},android:{package:Ue(t.androidPackage,n?.android?.package,l.package,l.applicationId,e.android?.package,e.expo?.android?.package,c.packageName,c.package),sha256CertFingerprints:p,loginCredentials:!!n?.android?.loginCredentials},web:{smartAppBanner:n?.web?.smartAppBanner??!0,outputDir:t.output||n?.web?.outputDir||Ai(process.cwd(),e)}}}function yi(e,t={}){let n=e.deepLinks,i=t.profile||n?.profile||"production",r=t.expoHints||null,o=Ue(n?.baseUrl,r?.domain?`https://${r.domain}`:void 0);if(!o)return null;let s=bn(o),a=_e(e,i)||{},l=a.ios||{},d=a.android||{},c=e.submit?.[i]?.ios||{},u=e.submit?.[i]?.android||{},f=gt(e,i),p=Ue(n?.domain,r?.domain)||mi(s),h=hi(Ue(n?.scheme,l.scheme,e.scheme,r?.scheme,e.slug,e.name,"app")||"app"),g=n?.paths?.length?n.paths:[...rl];return{baseUrl:s,domain:p,scheme:h,profile:i!=="production"?i:void 0,paths:g,ios:{appStoreId:Ue(n?.ios?.appStoreId,l.ascAppId,c.ascAppId,e.ios?.ascAppId),appleTeamId:Ue(n?.ios?.appleTeamId,l.appleTeamId,l.developerTeamId,c.appleTeamId,c.developerTeamId,e.ios?.appleTeamId,e.ios?.developerTeamId,f.teamId),bundleIdentifier:Ue(n?.ios?.bundleIdentifier,l.bundleIdentifier,l.bundleId,e.ios?.bundleIdentifier,e.ios?.bundleId,e.expo?.ios?.bundleIdentifier,r?.iosBundleIdentifier),webCredentials:!!n?.ios?.webCredentials,activityContinuation:!!n?.ios?.activityContinuation},android:{package:Ue(n?.android?.package,d.package,d.applicationId,e.android?.package,e.expo?.android?.package,u.packageName,u.package,r?.androidPackage),sha256CertFingerprints:gi([...n?.android?.sha256CertFingerprints||[],...d.sha256CertFingerprints||[],...e.android?.sha256CertFingerprints||[]]),loginCredentials:!!n?.android?.loginCredentials},web:{smartAppBanner:n?.web?.smartAppBanner??!0,outputDir:n?.web?.outputDir||Ai(t.cwd||process.cwd(),e)}}}function Si(e,t,n="production",i=process.cwd()){return t?.domain?yi({...e,deepLinks:{baseUrl:`https://${t.domain}`,domain:t.domain,scheme:t.scheme}},{profile:n,cwd:i,expoHints:t}):null}function Tf(e,t,n=t.profile||"production"){let i=yi({...e,deepLinks:{baseUrl:t.baseUrl}},{profile:n}),r={baseUrl:t.baseUrl};n!=="production"&&(r.profile=n),t.domain&&t.domain!==mi(t.baseUrl)&&(r.domain=t.domain),t.scheme&&t.scheme!==i?.scheme&&(r.scheme=t.scheme),t.paths?.length&&!il(t.paths,rl)&&(r.paths=t.paths);let o={};t.ios?.bundleIdentifier&&t.ios.bundleIdentifier!==i?.ios?.bundleIdentifier&&(o.bundleIdentifier=t.ios.bundleIdentifier),t.ios?.appleTeamId&&t.ios.appleTeamId!==i?.ios?.appleTeamId&&(o.appleTeamId=t.ios.appleTeamId),t.ios?.appStoreId&&t.ios.appStoreId!==i?.ios?.appStoreId&&(o.appStoreId=t.ios.appStoreId),t.ios?.webCredentials&&(o.webCredentials=!0),t.ios?.activityContinuation&&(o.activityContinuation=!0),Object.keys(o).length>0&&(r.ios=o);let s={};t.android?.package&&t.android.package!==i?.android?.package&&(s.package=t.android.package);let a=t.android?.sha256CertFingerprints||[],l=i?.android?.sha256CertFingerprints||[];a.length>0&&!il(a,l)&&(s.sha256CertFingerprints=a),t.android?.loginCredentials&&(s.loginCredentials=!0),Object.keys(s).length>0&&(r.android=s);let d={outputDir:t.web?.outputDir||"deep-links"};return t.web?.smartAppBanner===!1&&(d.smartAppBanner=!1),r.web=d,r}function dl(e,t,n,i=n.profile||"production"){let r={...e,framework:t,scheme:e.scheme||n.scheme};return{...r,deepLinks:Tf(r,n,i)}}function cl(e,t=process.cwd()){let n=Mt.join(t,"mach.config.json");return bt.writeFileSync(n,`${JSON.stringify(e,null,2)}
+`),n}import ce from"fs";import he from"path";import{spawnSync as ul}from"child_process";var In="@radhya/mach/expo-plugin",Nf=`const fs = require('fs')
 const path = require('path')
 
 const unique = values => Array.from(new Set(values.filter(Boolean)))
@@ -1816,24 +2039,24 @@ module.exports = function withMachDeepLinks(config) {
   config.android.intentFilters = intentFilters
   return config
 }
-`,bn=e=>{if(typeof e=="string"){if(e===Sn)return Sn;if(e===Mt||e===Mt.replace(/^\.\//,""))return Mt}},Jr=e=>Array.isArray(e)?Jr(e[0]):bn(e),Al=e=>!!Jr(e),zf=(e,t)=>{let n=bn(t)||t;return Jr(e)===n},Kf=(e,t)=>Array.isArray(e)?[t,...e.slice(1)]:t,Wf=(e,t)=>{let n=Array.isArray(e.plugins)?e.plugins:[];if(n.findIndex(o=>zf(o,t))>=0)return e.plugins=n,"already";let r=n.findIndex(Al);return r>=0?(n[r]=Kf(n[r],t),e.plugins=n,"updated"):(n.push(t),e.plugins=n,"inserted")},qr=/(['"`])((?:\.\/)?plugins\/withMachDeepLinks|@radhya\/mach\/expo-plugin)\1/g;function bi(e){let t=Ae.join(e,"package.json");if(!pe.existsSync(t))return!1;try{let n=JSON.parse(pe.readFileSync(t,"utf-8"));return!!(n.dependencies?.["@radhya/mach"]||n.devDependencies?.["@radhya/mach"])}catch{return!1}}function Yf(e){return pe.existsSync(Ae.join(e,"pnpm-lock.yaml"))?{command:"pnpm",args:["add","-D","@radhya/mach@latest"],label:"pnpm add -D @radhya/mach@latest"}:pe.existsSync(Ae.join(e,"yarn.lock"))?{command:"yarn",args:["add","-D","@radhya/mach@latest"],label:"yarn add -D @radhya/mach@latest"}:pe.existsSync(Ae.join(e,"bun.lockb"))||pe.existsSync(Ae.join(e,"bun.lock"))?{command:"bun",args:["add","-d","@radhya/mach@latest"],label:"bun add -d @radhya/mach@latest"}:{command:"npm",args:["install","--save-dev","@radhya/mach@latest"],label:"npm install --save-dev @radhya/mach@latest"}}function qf(e){let t=Yf(e),n=hl(t.command,t.args,{cwd:e,stdio:"inherit",env:{...process.env}});return n.error?{ok:!1,label:t.label,error:n.error.message}:n.status!==0?{ok:!1,label:t.label,error:`${t.command} exited with code ${n.status}`}:{ok:bi(e),label:t.label}}function Jf(e,t){let n=pe.readFileSync(e,"utf-8"),i=Array.from(n.matchAll(qr));if(i.length>0){let f=bn(t)||t,p=i.some(A=>bn(A[2])===f),g=i.some(A=>bn(A[2])!==f);if(p&&!g)return"already";let h=n.replace(qr,(A,y)=>`${y}${t}${y}`);return pe.writeFileSync(e,h),"updated"}let r=/(^[ \t]*)plugins\s*:\s*\[([\s\S]*?)\]/m.exec(n);if(!r||r.index===void 0)return"unsupported";let o=n.includes(`\r
+`,En=e=>{if(typeof e=="string"){if(e===In)return In;if(e===Ut||e===Ut.replace(/^\.\//,""))return Ut}},Yr=e=>Array.isArray(e)?Yr(e[0]):En(e),pl=e=>!!Yr(e),kf=(e,t)=>{let n=En(t)||t;return Yr(e)===n},xf=(e,t)=>Array.isArray(e)?[t,...e.slice(1)]:t,Lf=(e,t)=>{let n=Array.isArray(e.plugins)?e.plugins:[];if(n.findIndex(o=>kf(o,t))>=0)return e.plugins=n,"already";let r=n.findIndex(pl);return r>=0?(n[r]=xf(n[r],t),e.plugins=n,"updated"):(n.push(t),e.plugins=n,"inserted")},Wr=/(['"`])((?:\.\/)?plugins\/withMachDeepLinks|@radhya\/mach\/expo-plugin)\1/g;function bi(e){let t=he.join(e,"package.json");if(!ce.existsSync(t))return!1;try{let n=JSON.parse(ce.readFileSync(t,"utf-8"));return!!(n.dependencies?.["@radhya/mach"]||n.devDependencies?.["@radhya/mach"])}catch{return!1}}function Mf(e){return ce.existsSync(he.join(e,"pnpm-lock.yaml"))?{command:"pnpm",args:["add","-D","@radhya/mach@latest"],label:"pnpm add -D @radhya/mach@latest"}:ce.existsSync(he.join(e,"yarn.lock"))?{command:"yarn",args:["add","-D","@radhya/mach@latest"],label:"yarn add -D @radhya/mach@latest"}:ce.existsSync(he.join(e,"bun.lockb"))||ce.existsSync(he.join(e,"bun.lock"))?{command:"bun",args:["add","-d","@radhya/mach@latest"],label:"bun add -d @radhya/mach@latest"}:{command:"npm",args:["install","--save-dev","@radhya/mach@latest"],label:"npm install --save-dev @radhya/mach@latest"}}function Uf(e){let t=Mf(e),n=ul(t.command,t.args,{cwd:e,stdio:"inherit",env:{...process.env}});return n.error?{ok:!1,label:t.label,error:n.error.message}:n.status!==0?{ok:!1,label:t.label,error:`${t.command} exited with code ${n.status}`}:{ok:bi(e),label:t.label}}function Ff(e,t){let n=ce.readFileSync(e,"utf-8"),i=Array.from(n.matchAll(Wr));if(i.length>0){let f=En(t)||t,p=i.some(y=>En(y[2])===f),h=i.some(y=>En(y[2])!==f);if(p&&!h)return"already";let g=n.replace(Wr,(y,S)=>`${S}${t}${S}`);return ce.writeFileSync(e,g),"updated"}let r=/(^[ \t]*)plugins\s*:\s*\[([\s\S]*?)\]/m.exec(n);if(!r||r.index===void 0)return"unsupported";let o=n.includes(`\r
 `)?`\r
 `:`
 `,s=r[1]||"",a=r[2]||"",d=a.match(/\r?\n([ \t]+)\S/)?.[1]||`${s}    `,c=a.trim().length===0?`${o}${d}'${t}',${o}${s}`:a.includes(`
-`)||a.includes("\r")?`${o}${d}'${t}',${a}`:`${o}${d}'${t}',${o}${d}${a.trim()}${o}${s}`,u=`${r[0].slice(0,r[0].indexOf("[")+1)}${c}]`;return pe.writeFileSync(e,`${n.slice(0,r.index)}${u}${n.slice(r.index+r[0].length)}`),"inserted"}function yl(e,t,n={}){let i=[],r=[],o=[],s=bi(e);if(!s&&n.installPackage){o.push("Installing @radhya/mach locally so Expo can use @radhya/mach/expo-plugin.");let u=qf(e);u.ok?(s=!0,o.push(`Installed @radhya/mach with ${u.label}.`)):o.push(`Could not install @radhya/mach with ${u.label}: ${u.error||"unknown error"}. Falling back to local plugin.`)}let a=s?Sn:Mt;if(s)o.push(`Using packaged Expo plugin ${Sn}.`);else{let u=Ae.join(e,"plugins/withMachDeepLinks.js");pe.mkdirSync(Ae.dirname(u),{recursive:!0}),pe.writeFileSync(u,Vf),i.push(Ae.relative(e,u)),o.push(`Using local Expo plugin fallback ${Mt}. Install @radhya/mach in this app to use ${Sn}.`)}let l=["app.config.ts","app.config.js"].find(u=>pe.existsSync(Ae.join(e,u)));if(l){let u=Ae.join(e,l),f=Jf(u,a);return f==="inserted"?i.push(l):f==="updated"?(i.push(l),o.push(`${l} updated to use ${a}.`)):f==="already"?o.push(`${l} already includes the Mach Expo plugin.`):o.push(`Add "${a}" to the plugins array in ${l}. Mach could not safely auto-edit this dynamic config.`),{written:i,skipped:r,notes:o}}let d=["app.config.json","app.json"].find(u=>pe.existsSync(Ae.join(e,u)));if(!d)return r.push("Expo config plugin insertion: no app.json or app.config.json found."),{written:i,skipped:r,notes:o};let c=Ae.join(e,d);try{let u=JSON.parse(pe.readFileSync(c,"utf-8")),f=u.expo&&typeof u.expo=="object"?u.expo:u,p=Wf(f,a);pe.writeFileSync(c,`${JSON.stringify(u,null,2)}
-`),i.push(d),p==="updated"&&o.push(`${d} updated to use ${a}.`)}catch(u){r.push(`Expo config plugin insertion failed: ${u.message}`)}return{written:i,skipped:r,notes:o}}function Sl(e){let t=["app.config.ts","app.config.js"].find(i=>pe.existsSync(Ae.join(e,i)));if(t){let i=pe.readFileSync(Ae.join(e,t),"utf-8");return qr.test(i)?"manual":"missing"}let n=["app.config.json","app.json"].find(i=>pe.existsSync(Ae.join(e,i)));if(!n)return"missing";try{let i=JSON.parse(pe.readFileSync(Ae.join(e,n),"utf-8")),r=i.expo&&typeof i.expo=="object"?i.expo:i;return Array.isArray(r.plugins)&&r.plugins.some(Al)?"wired":"missing"}catch{return"missing"}}function Xr(e){let t=hl("npx",["--no-install","expo","config","--type","public","--json"],{cwd:e,encoding:"utf-8",timeout:8e3,env:{...process.env,CI:"1",EXPO_NO_TELEMETRY:"1"}});if(t.error||t.status!==0||!t.stdout)return null;let n=t.stdout.trim(),i=n.indexOf("{");if(i<0)return null;try{return JSON.parse(n.slice(i))}catch{return null}}function Xf(e){if(!e||typeof e!="object")return null;let n=(Array.isArray(e.ios?.associatedDomains)?e.ios.associatedDomains:[]).map(s=>typeof s=="string"?s.match(/^applinks:(.+)$/)?.[1]:void 0).find(Boolean),r=(Array.isArray(e.android?.intentFilters)?e.android.intentFilters:[]).flatMap(s=>Array.isArray(s?.data)?s.data:[]).find(s=>s?.scheme==="https"&&typeof s.host=="string")?.host,o=n||r;return!o&&!e.scheme&&!e.ios?.bundleIdentifier&&!e.android?.package?null:{domain:o,scheme:typeof e.scheme=="string"?e.scheme:void 0,iosBundleIdentifier:typeof e.ios?.bundleIdentifier=="string"?e.ios.bundleIdentifier:void 0,androidPackage:typeof e.android?.package=="string"?e.android.package:void 0}}function Ei(e){return Xf(Xr(e))}import ze from"fs";import ve from"path";var Zf=e=>{ze.mkdirSync(ve.dirname(e),{recursive:!0})},bl=(e,t)=>{Zf(e),ze.writeFileSync(e,`${JSON.stringify(t,null,2)}
-`)};var Qf=e=>{let t=e.ios?.appleTeamId,n=e.ios?.bundleIdentifier;return!t||!n?null:`${t}.${n}`};function Zr(e){let t=Qf(e);if(!t)return null;let n=e.paths?.length?e.paths:["/*"],i=n.map(s=>s==="/*"?"*":s),r=n.map(s=>({"/":s,comment:s==="/*"?"Matches all URLs":`Matches ${s}`})),o={applinks:{apps:[],details:[{appIDs:[t],components:r,appID:t,paths:i}]}};return e.ios?.webCredentials&&(o.webcredentials={apps:[t]}),e.ios?.activityContinuation&&(o.activitycontinuation={apps:[t]}),o}function em(e){let t=e.android?.package;return t?[{relation:["delegate_permission/common.handle_all_urls"],target:{namespace:"android_app",package_name:t,sha256_cert_fingerprints:e.android?.sha256CertFingerprints||[]}}]:null}function tm(e,t){let n=t.ios?.appStoreId;if(!n||!ze.existsSync(e))return!1;let i=`<meta name="apple-itunes-app" content="app-id=${n}, app-argument=${t.baseUrl}" />`,r=ze.readFileSync(e,"utf-8");if(/name=["']apple-itunes-app["']/i.test(r)){let o=r.replace(/<meta[^>]+name=["']apple-itunes-app["'][^>]*>/i,i);return ze.writeFileSync(e,o),!0}return/<head[^>]*>/i.test(r)?(ze.writeFileSync(e,r.replace(/<head([^>]*)>/i,`<head$1>
-    ${i}`)),!0):!1}function El(e,t){let n=[],i=[],r=[],o=t.web?.outputDir||"deep-links",s=ve.join(e,o),a=Zr(t);if(a){let u=gi([ve.join(s,".well-known/apple-app-site-association"),ve.join(s,".well-known/apple-app-site-association.json"),ve.join(s,"apple-app-site-association"),ve.join(s,"apple-app-site-association.json")]);for(let f of u)bl(f,a),n.push(ve.relative(e,f))}else i.push("Apple AASA files: missing ios.appleTeamId or ios.bundleIdentifier");let l=em(t);if(l){let u=ve.join(s,".well-known/assetlinks.json");bl(u,l),n.push(ve.relative(e,u)),t.android?.sha256CertFingerprints?.length||r.push("assetlinks.json was generated without SHA256 fingerprints. Add them before Android App Links can verify.")}else i.push("Android assetlinks.json: missing android.package");let d=ve.join(e,Wr);ze.existsSync(d)&&(ze.unlinkSync(d),r.push(`Removed legacy ${Wr}; mach.config.json is now the source of truth.`));let c=ve.join(s,"index.html");return t.web?.smartAppBanner&&tm(c,t)?n.push(ve.relative(e,c)):t.web?.smartAppBanner&&t.ios?.appStoreId?r.push(`Smart App Banner skipped because ${ve.relative(e,c)} was not found.`):t.web?.smartAppBanner&&r.push("Smart App Banner skipped because ios.appStoreId is not configured."),o!=="public"&&r.push(`Host ${o}/.well-known files at https://${t.domain}/.well-known/.`),{written:n,skipped:i,notes:r}}function Qr(e){if(!ze.existsSync(e))return null;try{return JSON.parse(ze.readFileSync(e,"utf-8"))}catch{return null}}import dt from"fs";import ct from"path";import{spawnSync as nm}from"child_process";var T=(e,t)=>({level:e,message:t}),Il=(e,t)=>ct.join(e,t.web?.outputDir||"deep-links");function im(e,t,n="fail"){let i=[],r=Il(e,t),o=ct.join(r,".well-known/apple-app-site-association");if(!Zr(t))return i.push(T("warn","Skipping AASA verification because ios.appleTeamId or ios.bundleIdentifier is missing.")),i;if(!dt.existsSync(o))return i.push(T(n,`${ct.relative(e,o)} is missing.`)),i;dt.statSync(o).size>128*1024?i.push(T("fail","Apple AASA file is larger than 128 KB.")):i.push(T("pass","Apple AASA file is under 128 KB."));let l=Qr(o);if(!l)return i.push(T("fail","Apple AASA file is not valid JSON.")),i;let d=`${t.ios?.appleTeamId}.${t.ios?.bundleIdentifier}`,c=l.applinks?.details||[],u=Array.isArray(c)&&c.some(f=>f.appID===d||f.appIDs?.includes(d));return i.push(u?T("pass",`AASA contains ${d}.`):T("fail",`AASA does not contain ${d}.`)),i}function rm(e,t,n="fail"){let i=[],r=Il(e,t),o=ct.join(r,".well-known/assetlinks.json");if(!t.android?.package)return i.push(T("warn","Skipping Android Asset Links verification because android.package is missing.")),i;if(!dt.existsSync(o))return i.push(T(n,`${ct.relative(e,o)} is missing.`)),i;let s=Qr(o);if(!s||!Array.isArray(s))return i.push(T("fail","assetlinks.json is not a valid JSON array.")),i;let a=s.find(d=>d?.target?.package_name===t.android?.package);i.push(a?T("pass",`assetlinks.json contains ${t.android.package}.`):T("fail",`assetlinks.json does not contain ${t.android.package}.`));let l=a?.target?.sha256_cert_fingerprints;return i.push(Array.isArray(l)&&l.length>0?T("pass","assetlinks.json has at least one SHA256 fingerprint."):T("warn","assetlinks.json has no SHA256 fingerprints.")),i}function om(e,t,n,i){if(t.framework!=="expo")return[];let r=[],o=Xr(e),a=(Array.isArray(o?.ios?.associatedDomains)?o.ios.associatedDomains:[]).includes(`applinks:${n.domain}`);r.push(a?T("pass",`Expo iOS config contains applinks:${n.domain}.`):T(i?"warn":"fail",`Expo iOS config does not contain applinks:${n.domain}.`));let d=(Array.isArray(o?.android?.intentFilters)?o.android.intentFilters:[]).flatMap(u=>Array.isArray(u?.data)?u.data:[]).some(u=>u?.scheme==="https"&&u.host===n.domain);if(r.push(d?T("pass",`Expo Android config contains App Link host ${n.domain}.`):T(i?"warn":"fail",`Expo Android config does not contain App Link host ${n.domain}.`)),i)return r.push(T("warn","mach.config.json is missing deepLinks; values were inferred from Expo config. Run `mach deeplink setup` to persist Mach metadata and generate hosted files.")),r;let c=Sl(e);return c==="wired"?r.push(T("pass","Expo deep link plugin is wired into Expo config and derives values from mach.config.json.")):c==="manual"&&a&&d?r.push(T("pass","Expo resolved config contains the deep-link settings from the dynamic config.")):c==="manual"?r.push(T("warn","Expo deep link plugin exists, but dynamic or missing Expo config means manual plugin insertion must be confirmed.")):a&&d?r.push(T("warn","Expo plugin is not wired, but resolved Expo config already contains the deep-link settings.")):r.push(T("fail","Expo deep link plugin is missing or not wired into Expo config.")),r}function sm(e,t,n){if(t.framework!=="react-native")return[];let i=[],r=ct.join(e,"android/app/src/main/AndroidManifest.xml");if(dt.existsSync(r)){let s=dt.readFileSync(r,"utf-8");i.push(s.includes(`android:host="${n.domain}"`)?T("pass","AndroidManifest.xml contains the App Links host."):T("warn","AndroidManifest.xml does not contain the App Links host. Native patching is planned for a later phase."))}let o=ct.join(e,"ios");if(dt.existsSync(o)){let a=dt.readdirSync(o,{recursive:!0}).filter(l=>typeof l=="string"&&l.endsWith(".entitlements")).some(l=>dt.readFileSync(ct.join(o,l),"utf-8").includes(`applinks:${n.domain}`));i.push(a?T("pass","iOS entitlements contain the associated domain."):T("warn","iOS entitlements do not contain the associated domain. Native patching is planned for a later phase."))}return i}async function eo(e,t){let n=[];try{let i=await fetch(e,{redirect:"manual"});if(i.status>=300&&i.status<400&&!t)return n.push(T("fail",`${e} redirects. Apple AASA endpoints must not redirect.`)),n;n.push(i.status===200?T("pass",`${e} returned HTTP 200.`):T("fail",`${e} returned HTTP ${i.status}.`));let r=i.headers.get("content-type")||"";!r.includes("application/json")&&!r.includes("text/json")&&n.push(T("warn",`${e} content-type is "${r||"missing"}"; application/json is recommended.`)),JSON.parse(await i.text()),n.push(T("pass",`${e} contains valid JSON.`))}catch(i){n.push(T("fail",`${e} check failed: ${i.message}`))}return n}async function am(e){let t=e.domain;return(await Promise.all([eo(`https://${t}/.well-known/apple-app-site-association`,!1),eo(`https://${t}/apple-app-site-association`,!1),eo(`https://${t}/.well-known/assetlinks.json`,!0)])).flat()}function lm(e){let t=e.android?.package;if(!t)return[T("warn","Cannot print Android device verification commands because android.package is missing.")];let i=nm("adb",["version"],{encoding:"utf-8"}).status===0?"Run":"Install Android platform-tools, then run";return[T("info",`${i}: adb shell pm set-app-links --package ${t} 0 all`),T("info",`${i}: adb shell pm verify-app-links --re-verify ${t}`),T("info",`${i}: adb shell pm get-app-links ${t}`)]}async function to(e,t,n){let i=n.profile||t.deepLinks?.profile||"production",r=t.framework==="expo"?Ei(e):null,o=t.framework==="expo"?Si(t,r,i,e):null,s=!t.deepLinks&&!!o,a=t.deepLinks?yi(t,{profile:i,cwd:e,expoHints:r}):o,l=[];if(!a)return[T("fail","mach.config.json is missing deepLinks and Mach could not infer existing deep-link settings. Run `mach deeplink setup`.")];l.push(a.baseUrl?T("pass","deepLinks.baseUrl is configured."):T("fail","deepLinks.baseUrl is missing.")),l.push(a.domain?T("pass","deepLinks.domain is configured."):T("fail","deepLinks.domain is missing.")),l.push(a.scheme?T("pass","deepLinks.scheme is configured."):T("fail","deepLinks.scheme is missing."));let d=s?"warn":"fail";return l.push(...im(e,a,d)),l.push(...rm(e,a,d)),l.push(...om(e,t,a,s)),l.push(...sm(e,t,a)),n.live&&l.push(...await am(a)),n.androidDevice&&l.push(...lm(a)),l}var In=()=>process.stdin.isTTY&&process.stdout.isTTY,wl=`${m.npmScope}/mach`,_n=()=>{dm("Operation cancelled."),process.exit(0)},ro=e=>{if(typeof e!="string")return;let t=e.trim();return t.length>0?t:void 0},Je=(...e)=>{for(let t of e){let n=ro(t);if(n)return n}},bt=async(e,t,n,i,r)=>{if(t)return t;if(r||!In()){if(i)throw new Error(`${e.replace(/:$/,"")} is required. Pass it as an option or run interactively.`);return}let o=await $l({message:e,initialValue:t||"",placeholder:n,validate(s){if(i&&s.trim().length===0)return"Required."}});return En(o)&&_n(),ro(o)};async function fm(e,t,n){let i=Re(e.framework),r=Re(t);if(r)return r;if(i)return i;let o=ul();if(n||!In())return o;let s=await um({message:`Which framework should ${m.name} configure?`,initialValue:o,options:[{value:"expo",label:"Expo"},{value:"react-native",label:"React Native"},{value:"flutter",label:"Flutter (not supported yet)"}]});return En(s)&&_n(),s}var Ii=e=>e==="ios"||e==="all",no=e=>e==="android"||e==="all";async function mm(e,t,n){if(t!=="expo"||bi(e)||n.installPlugin===!1)return!1;if(n.installPlugin===!0||n.yes)return!0;if(!In())return!1;let i=await vl({message:`Install ${wl} locally so Expo can use ${wl}/expo-plugin?`,initialValue:!0});return En(i)&&_n(),!!i}async function gm(e,t){let n=!!t.yes,i=t.profile||e.deepLinks?.profile||"production",r=we(e,i)||{},o=r.ios||{},s=r.android||{},a=e.submit?.[i]?.ios||{},l=e.submit?.[i]?.android||{},d=mt(e,i),c=await fm(e,t.framework,n);if(c==="flutter")throw new Error("Flutter deep-link automation is planned but not supported yet.");let u=pl(e,cl(t.platform),r),f=e.deepLinks,g=c==="expo"&&(!Je(t.baseUrl,f?.baseUrl,t.domain?`https://${t.domain}`:void 0)||!Je(t.scheme,f?.scheme,o.scheme,e.scheme,e.slug,e.name)||Ii(u)&&!Je(t.iosBundleId,f?.ios?.bundleIdentifier,o.bundleIdentifier,o.bundleId,e.ios?.bundleIdentifier)||no(u)&&!Je(t.androidPackage,f?.android?.package,s.package,s.applicationId,e.android?.package,l.packageName,l.package))?Si(e,Ei(process.cwd()),i,process.cwd()):null,h=t.output||f?.web?.outputDir||Ai(process.cwd(),e),A=await bt("Deep link base URL:",t.baseUrl||f?.baseUrl||(t.domain?`https://${t.domain}`:void 0)||g?.baseUrl,"https://app.example.com",!0,n),y=yn(A),w=t.baseUrl?new URL(y).hostname:void 0,M=await bt("Associated domain:",t.domain||w||f?.domain||g?.domain||new URL(y).hostname,"app.example.com",!0,n),v=hi(await bt("URI scheme:",Je(t.scheme,f?.scheme,o.scheme,e.scheme,g?.scheme,e.slug,e.name,"app"),"myapp",!0,n)||"app"),H=Ii(u)?await bt("iOS bundle identifier:",Je(t.iosBundleId,f?.ios?.bundleIdentifier,o.bundleIdentifier,o.bundleId,e.ios?.bundleIdentifier,g?.ios?.bundleIdentifier),"com.example.app",!0,n):f?.ios?.bundleIdentifier||e.ios?.bundleIdentifier,W=Ii(u)?await bt("Apple Team ID:",Je(t.appleTeamId,f?.ios?.appleTeamId,o.appleTeamId,o.developerTeamId,a.appleTeamId,a.developerTeamId,e.ios?.appleTeamId,e.ios?.developerTeamId,d.teamId),"ABCDE12345",!0,n):f?.ios?.appleTeamId||e.ios?.appleTeamId,Z=Ii(u)?await bt("App Store ID (optional, for Smart App Banner):",Je(t.appStoreId,f?.ios?.appStoreId,o.ascAppId,a.ascAppId,e.ios?.ascAppId),"1234567890",!1,n):f?.ios?.appStoreId,_e=no(u)?await bt("Android package name:",Je(t.androidPackage,f?.android?.package,s.package,s.applicationId,e.android?.package,l.packageName,l.package,g?.android?.package),"com.example.app",!0,n):f?.android?.package||e.android?.package,oe=f?.android?.sha256CertFingerprints||[],R=t.androidFingerprint||[],L=e.android?.sha256CertFingerprints||[],E=s.sha256CertFingerprints||[],_=[...R,...oe,...E,...L].filter(Boolean);if(no(u)&&_.length===0&&!n&&In()){let b=await $l({message:"Android SHA256 fingerprint (optional now, required for verified App Links):",placeholder:"AA:BB:CC:..."});En(b)&&_n(),ro(b)&&_.push(b)}let P=fl(e,{...t,baseUrl:y,domain:M,scheme:v,output:h,appleTeamId:W,appStoreId:Z,androidFingerprint:_});return P.ios={...P.ios||{},bundleIdentifier:H,appleTeamId:W,appStoreId:Z},P.android={...P.android||{},package:_e,sha256CertFingerprints:Array.from(new Set(_))},{framework:c,platform:u,deepLinks:P}}var io=(e,t)=>{t.length!==0&&cm(t.map(n=>`- ${n}`).join(`
-`),e)},Rl=e=>e.filter(t=>t.level==="fail").length;function Ol(e){for(let t of e){let n=t.level==="pass"?Fe.green("PASS"):t.level==="warn"?Fe.yellow("WARN"):t.level==="info"?Fe.cyan("INFO"):Fe.red("FAIL");_i.info(`${n} ${t.message}`)}}async function Pl(e){try{let t=process.cwd(),n=_l.join(t,m.configFileName),i=ce()||{};if(!pm.existsSync(n)){let y=e.yes||!In()?!0:await vl({message:`${m.configFileName} was not found. Create one with deep link settings?`,initialValue:!0});if(En(y)&&_n(),!y)return}let{framework:r,deepLinks:o}=await gm(i,e),s=e.profile||i.deepLinks?.profile||"production",a=ml(i,r,o,s),l=gl(a,t),d=El(t,o),c=await mm(t,r,e),u=r==="expo"?yl(t,o,{installPackage:c}):{written:[],skipped:[],notes:r==="react-native"?["React Native native patching is planned for a later phase. Hosted files were generated now."]:[]},f=[_l.relative(t,l),...d.written,...u.written],p=[...d.skipped,...u.skipped],g=[...d.notes,...u.notes];io("Written",f),io("Skipped",p),io("Notes",g);let h=await to(t,a,{});Ol(h);let A=Rl(h);if(A>0){wi(Fe.yellow(`Deep link setup finished with ${A} verification issue(s).`));return}wi(Fe.green("Deep link setup complete."))}catch(t){_i.error(Fe.red(t.message||"Deep link setup failed.")),process.exit(1)}}async function Dl(e){try{let t=ce();t||(_i.error(Fe.red(`No ${m.configFileName} found in the current directory.`)),process.exit(1));let n=await to(process.cwd(),t,e);Ol(n);let i=Rl(n);i>0&&(wi(Fe.red(`Deep link verification failed with ${i} issue(s).`)),process.exit(1)),wi(Fe.green("Deep link verification passed."))}catch(t){_i.error(Fe.red(t.message||"Deep link verification failed.")),process.exit(1)}}import{log as Xe,spinner as Cl}from"@clack/prompts";import ut from"chalk";var hm=e=>{let t=String(e||"").trim().toLowerCase();if(t==="ios"||t==="android")return t;throw new Error("Pass --platform ios or --platform android.")},Am=e=>{let t=Number(e);if(!Number.isFinite(t))throw new Error("Counter value must be a non-negative integer.");let n=Math.floor(t);if(n<0)throw new Error("Counter value must be a non-negative integer.");return n},ym=(e,t,n)=>{let i=String(n.scope||"").trim();if(i)return i;let r=n.profile||"production",o=e==="android"?n.package||n.androidPackage:n.bundleId||n.iosBundleIdentifier;if(o)return String(o).trim();let s=e==="android"?Fn(t,r):Bn(t,r);if(s)return s;throw new Error(e==="android"?`Could not resolve Android package. Set android.package in ${m.configFileName}, or pass --package/--scope.`:`Could not resolve iOS bundle identifier. Set ios.bundleIdentifier in ${m.configFileName}, or pass --bundle-id/--scope.`)},Sm=()=>{let e=ce();if(!e)throw new Error(`No ${m.configFileName} found in the current directory. Run \`${m.nameLower} init\` or \`${m.nameLower} link\` first.`);if(!e.projectId)throw new Error(`${m.configFileName} is missing projectId.`);return e},oo=e=>{Xe.info(ut.bgBlue.white(" Native Version Counter ")),Xe.info(`${ut.blue("Platform:")} ${e.platform}`),Xe.info(`${ut.blue("Scope:")} ${e.scope}`),Xe.info(`${ut.blue("Current DB value:")} ${e.current}`),Xe.info(`${ut.blue("Next build will use:")} ${e.next}`),e.seeded||Xe.warn(ut.yellow("This counter has not been seeded yet. Existing store apps should run `mach version seed` once before auto-version builds."))};async function so(e,t={}){if(!ye()){Xe.error(`You are not logged in. Run \`${m.nameLower} login\` first.`);return}try{let i=Sm(),r=hm(t.platform),o=ym(r,i,t),s=String(i.projectId);if(e==="show"){let c=Cl();t.json||c.start("Fetching native version counter...");let{data:u}=await $.get(`/projects/${s}/version-counters`,{params:{platform:r,scope:o}});if(u.status!=="success")throw new Error(u.message||"Failed to fetch version counter.");t.json?console.log(JSON.stringify(u.counter,null,2)):(c.stop("Fetched native version counter."),oo(u.counter));return}let a=Am(t.value),l=Cl();t.json||l.start("Seeding native version counter...");let{data:d}=await $.post(`/projects/${s}/version-counters/seed`,{platform:r,scope:o,value:a,force:!!t.force});if(d.status!=="success")throw new Error(d.message||"Failed to seed version counter.");t.json?console.log(JSON.stringify(d.counter,null,2)):(l.stop(`Seeded ${r} counter for ${o}.`),oo(d.counter))}catch(i){let r=i?.response?.data?.message||i?.message||"Version command failed.";if(i?.response?.data?.counter&&!t.json){Xe.error(ut.red(r)),oo(i.response.data.counter);return}t.json?console.log(JSON.stringify({status:"error",message:r},null,2)):Xe.error(ut.red(r))}}import{log as Ce,spinner as $n,text as Tl,select as kl,confirm as bm,isCancel as wn,cancel as vn,outro as Rn,note as Em}from"@clack/prompts";import K from"chalk";import{execSync as Im}from"child_process";async function _m(){try{let e=Im("xcrun devicectl list devices --json-output -",{stdio:["pipe","pipe","pipe"]}).toString();return(JSON.parse(e).result?.devices||[]).filter(i=>i.connectionProperties?.transportType==="wired"||i.connectionProperties?.transportType==="localNetwork").map(i=>({udid:i.identifier,name:i.deviceProperties?.name||"Unknown Device",model:i.hardwareProperties?.marketingName||"iPhone"}))}catch{return[]}}var Nl=e=>e?.trim().toUpperCase()||void 0;function xl(e){let t=ce(),n=t?mt(t):{},i=Nl(e.teamId),r=i||n.teamId;return{...n,teamId:r,developerTeamId:i||n.developerTeamId||r}}async function wm(e){let t=e.udid,n=e.name,i=xl(e),r=i.teamId;if(!t){let s=$n();s.start("Scanning for connected iOS devices...");let a=await _m();if(s.stop(a.length>0?`Found ${a.length} device(s)`:"No devices detected"),a.length===1)t=a[0].udid,n=n||a[0].name,Ce.info(`Detected: ${K.bold(n)} (${K.dim(t.substring(0,12)+"...")})`);else if(a.length>1){let l=await kl({message:"Select a device to register:",options:a.map(c=>({value:c.udid,label:`${c.name} (${c.model})`,hint:c.udid.substring(0,12)+"..."}))});if(wn(l)){vn("Cancelled");return}t=l;let d=a.find(c=>c.udid===t);n=n||d.name}else{Ce.info(K.dim("No connected devices found. Enter UDID manually."));let l=await Tl({message:"Device UDID:",placeholder:"00008101-XXXXXXXXXXXX",validate(d){if(d.length<10)return"UDID seems too short"}});if(wn(l)){vn("Cancelled");return}t=l}}if(!n){let s=await Tl({message:"Device name:",placeholder:"Nitesh's iPhone",validate(a){if(a.length===0)return"Name is required"}});if(wn(s)){vn("Cancelled");return}n=s}let o=$n();o.start("Registering device...");try{await $.post("/devices",{udid:t,name:n,platform:"ios",addedVia:"cli",teamId:r,teamName:i.teamName,developerTeamId:i.developerTeamId,appStoreConnectTeamId:i.appStoreConnectTeamId,providerId:i.providerId,providerName:i.providerName}),o.stop(K.green("Device registered!")),Ce.info(`  ${K.bold("Name:")} ${n}`),Ce.info(`  ${K.bold("UDID:")} ${K.dim(t)}`),r&&Ce.info(`  ${K.bold("Team:")} ${K.dim(r)}`)}catch(s){o.stop(K.red("Failed to register device")),Ce.error(s.response?.data?.message||s.message)}Rn(K.blue("---"))}async function vm(e={}){let t=Nl(e.teamId),n=$n();n.start("Fetching registered devices...");try{let r=(await $.get("/devices",t?{params:{teamId:t}}:void 0)).data.devices||[];if(n.stop(`${r.length} device(s) registered${t?` for team ${t}`:""}`),r.length===0){Ce.info(K.dim(`No devices registered yet. Run \`${m.nameLower} device register\` to add one.`)),Rn(K.blue("---"));return}let o=r.map(s=>{let a=new Date(s.createdAt).toLocaleDateString();return`  ${K.bold(s.name.padEnd(24))} ${K.dim(s.udid.padEnd(28))} ${K.dim((s.teamId||"-").padEnd(12))} ${K.cyan((s.addedVia||"-").padEnd(10))} ${K.dim(a)}`});Em(`  ${K.bold("Name".padEnd(24))} ${"UDID".padEnd(28)} ${"Team".padEnd(12)} ${"Via".padEnd(10)} Date
+`)||a.includes("\r")?`${o}${d}'${t}',${a}`:`${o}${d}'${t}',${o}${d}${a.trim()}${o}${s}`,u=`${r[0].slice(0,r[0].indexOf("[")+1)}${c}]`;return ce.writeFileSync(e,`${n.slice(0,r.index)}${u}${n.slice(r.index+r[0].length)}`),"inserted"}function fl(e,t,n={}){let i=[],r=[],o=[],s=bi(e);if(!s&&n.installPackage){o.push("Installing @radhya/mach locally so Expo can use @radhya/mach/expo-plugin.");let u=Uf(e);u.ok?(s=!0,o.push(`Installed @radhya/mach with ${u.label}.`)):o.push(`Could not install @radhya/mach with ${u.label}: ${u.error||"unknown error"}. Falling back to local plugin.`)}let a=s?In:Ut;if(s)o.push(`Using packaged Expo plugin ${In}.`);else{let u=he.join(e,"plugins/withMachDeepLinks.js");ce.mkdirSync(he.dirname(u),{recursive:!0}),ce.writeFileSync(u,Nf),i.push(he.relative(e,u)),o.push(`Using local Expo plugin fallback ${Ut}. Install @radhya/mach in this app to use ${In}.`)}let l=["app.config.ts","app.config.js"].find(u=>ce.existsSync(he.join(e,u)));if(l){let u=he.join(e,l),f=Ff(u,a);return f==="inserted"?i.push(l):f==="updated"?(i.push(l),o.push(`${l} updated to use ${a}.`)):f==="already"?o.push(`${l} already includes the Mach Expo plugin.`):o.push(`Add "${a}" to the plugins array in ${l}. Mach could not safely auto-edit this dynamic config.`),{written:i,skipped:r,notes:o}}let d=["app.config.json","app.json"].find(u=>ce.existsSync(he.join(e,u)));if(!d)return r.push("Expo config plugin insertion: no app.json or app.config.json found."),{written:i,skipped:r,notes:o};let c=he.join(e,d);try{let u=JSON.parse(ce.readFileSync(c,"utf-8")),f=u.expo&&typeof u.expo=="object"?u.expo:u,p=Lf(f,a);ce.writeFileSync(c,`${JSON.stringify(u,null,2)}
+`),i.push(d),p==="updated"&&o.push(`${d} updated to use ${a}.`)}catch(u){r.push(`Expo config plugin insertion failed: ${u.message}`)}return{written:i,skipped:r,notes:o}}function ml(e){let t=["app.config.ts","app.config.js"].find(i=>ce.existsSync(he.join(e,i)));if(t){let i=ce.readFileSync(he.join(e,t),"utf-8");return Wr.test(i)?"manual":"missing"}let n=["app.config.json","app.json"].find(i=>ce.existsSync(he.join(e,i)));if(!n)return"missing";try{let i=JSON.parse(ce.readFileSync(he.join(e,n),"utf-8")),r=i.expo&&typeof i.expo=="object"?i.expo:i;return Array.isArray(r.plugins)&&r.plugins.some(pl)?"wired":"missing"}catch{return"missing"}}function qr(e){let t=ul("npx",["--no-install","expo","config","--type","public","--json"],{cwd:e,encoding:"utf-8",timeout:8e3,env:{...process.env,CI:"1",EXPO_NO_TELEMETRY:"1"}});if(t.error||t.status!==0||!t.stdout)return null;let n=t.stdout.trim(),i=n.indexOf("{");if(i<0)return null;try{return JSON.parse(n.slice(i))}catch{return null}}function Bf(e){if(!e||typeof e!="object")return null;let n=(Array.isArray(e.ios?.associatedDomains)?e.ios.associatedDomains:[]).map(s=>typeof s=="string"?s.match(/^applinks:(.+)$/)?.[1]:void 0).find(Boolean),r=(Array.isArray(e.android?.intentFilters)?e.android.intentFilters:[]).flatMap(s=>Array.isArray(s?.data)?s.data:[]).find(s=>s?.scheme==="https"&&typeof s.host=="string")?.host,o=n||r;return!o&&!e.scheme&&!e.ios?.bundleIdentifier&&!e.android?.package?null:{domain:o,scheme:typeof e.scheme=="string"?e.scheme:void 0,iosBundleIdentifier:typeof e.ios?.bundleIdentifier=="string"?e.ios.bundleIdentifier:void 0,androidPackage:typeof e.android?.package=="string"?e.android.package:void 0}}function Ii(e){return Bf(qr(e))}import ze from"fs";import $e from"path";var Hf=e=>{ze.mkdirSync($e.dirname(e),{recursive:!0})},gl=(e,t)=>{Hf(e),ze.writeFileSync(e,`${JSON.stringify(t,null,2)}
+`)};var jf=e=>{let t=e.ios?.appleTeamId,n=e.ios?.bundleIdentifier;return!t||!n?null:`${t}.${n}`};function Jr(e){let t=jf(e);if(!t)return null;let n=e.paths?.length?e.paths:["/*"],i=n.map(s=>s==="/*"?"*":s),r=n.map(s=>({"/":s,comment:s==="/*"?"Matches all URLs":`Matches ${s}`})),o={applinks:{apps:[],details:[{appIDs:[t],components:r,appID:t,paths:i}]}};return e.ios?.webCredentials&&(o.webcredentials={apps:[t]}),e.ios?.activityContinuation&&(o.activitycontinuation={apps:[t]}),o}function Gf(e){let t=e.android?.package;return t?[{relation:["delegate_permission/common.handle_all_urls",...e.android?.loginCredentials?["delegate_permission/common.get_login_creds"]:[]],target:{namespace:"android_app",package_name:t,sha256_cert_fingerprints:e.android?.sha256CertFingerprints||[]}}]:null}function Vf(e,t){let n=t.ios?.appStoreId;if(!n||!ze.existsSync(e))return!1;let i=`<meta name="apple-itunes-app" content="app-id=${n}, app-argument=${t.baseUrl}" />`,r=ze.readFileSync(e,"utf-8");if(/name=["']apple-itunes-app["']/i.test(r)){let o=r.replace(/<meta[^>]+name=["']apple-itunes-app["'][^>]*>/i,i);return ze.writeFileSync(e,o),!0}return/<head[^>]*>/i.test(r)?(ze.writeFileSync(e,r.replace(/<head([^>]*)>/i,`<head$1>
+    ${i}`)),!0):!1}function hl(e,t){let n=[],i=[],r=[],o=t.web?.outputDir||"deep-links",s=$e.join(e,o),a=Jr(t);if(a){let u=gi([$e.join(s,".well-known/apple-app-site-association"),$e.join(s,".well-known/apple-app-site-association.json"),$e.join(s,"apple-app-site-association"),$e.join(s,"apple-app-site-association.json")]);for(let f of u)gl(f,a),n.push($e.relative(e,f))}else i.push("Apple AASA files: missing ios.appleTeamId or ios.bundleIdentifier");let l=Gf(t);if(l){let u=$e.join(s,".well-known/assetlinks.json");gl(u,l),n.push($e.relative(e,u)),t.android?.sha256CertFingerprints?.length||r.push("assetlinks.json was generated without SHA256 fingerprints. Add them before Android App Links can verify.")}else i.push("Android assetlinks.json: missing android.package");let d=$e.join(e,zr);ze.existsSync(d)&&(ze.unlinkSync(d),r.push(`Removed legacy ${zr}; mach.config.json is now the source of truth.`));let c=$e.join(s,"index.html");return t.web?.smartAppBanner&&Vf(c,t)?n.push($e.relative(e,c)):t.web?.smartAppBanner&&t.ios?.appStoreId?r.push(`Smart App Banner skipped because ${$e.relative(e,c)} was not found.`):t.web?.smartAppBanner&&r.push("Smart App Banner skipped because ios.appStoreId is not configured."),o!=="public"&&r.push(`Host ${o}/.well-known files at https://${t.domain}/.well-known/.`),{written:n,skipped:i,notes:r}}function Xr(e){if(!ze.existsSync(e))return null;try{return JSON.parse(ze.readFileSync(e,"utf-8"))}catch{return null}}import dt from"fs";import ct from"path";import{spawnSync as zf}from"child_process";var N=(e,t)=>({level:e,message:t}),Al=(e,t)=>ct.join(e,t.web?.outputDir||"deep-links");function Kf(e,t,n="fail"){let i=[],r=Al(e,t),o=ct.join(r,".well-known/apple-app-site-association");if(!Jr(t))return i.push(N("warn","Skipping AASA verification because ios.appleTeamId or ios.bundleIdentifier is missing.")),i;if(!dt.existsSync(o))return i.push(N(n,`${ct.relative(e,o)} is missing.`)),i;dt.statSync(o).size>128*1024?i.push(N("fail","Apple AASA file is larger than 128 KB.")):i.push(N("pass","Apple AASA file is under 128 KB."));let l=Xr(o);if(!l)return i.push(N("fail","Apple AASA file is not valid JSON.")),i;let d=`${t.ios?.appleTeamId}.${t.ios?.bundleIdentifier}`,c=l.applinks?.details||[],u=Array.isArray(c)&&c.some(f=>f.appID===d||f.appIDs?.includes(d));if(i.push(u?N("pass",`AASA contains ${d}.`):N("fail",`AASA does not contain ${d}.`)),t.ios?.webCredentials){let f=l.webcredentials?.apps,p=Array.isArray(f)&&f.includes(d);i.push(p?N("pass",`AASA enables iOS Web Credentials for ${d}.`):N("fail",`AASA is missing iOS Web Credentials for ${d}.`))}return i}function Wf(e,t,n="fail"){let i=[],r=Al(e,t),o=ct.join(r,".well-known/assetlinks.json");if(!t.android?.package)return i.push(N("warn","Skipping Android Asset Links verification because android.package is missing.")),i;if(!dt.existsSync(o))return i.push(N(n,`${ct.relative(e,o)} is missing.`)),i;let s=Xr(o);if(!s||!Array.isArray(s))return i.push(N("fail","assetlinks.json is not a valid JSON array.")),i;let a=s.find(d=>d?.target?.package_name===t.android?.package);i.push(a?N("pass",`assetlinks.json contains ${t.android.package}.`):N("fail",`assetlinks.json does not contain ${t.android.package}.`));let l=a?.target?.sha256_cert_fingerprints;if(i.push(Array.isArray(l)&&l.length>0?N("pass","assetlinks.json has at least one SHA256 fingerprint."):N("warn","assetlinks.json has no SHA256 fingerprints.")),t.android?.loginCredentials){let d=a?.relation,c=Array.isArray(d)&&d.includes("delegate_permission/common.get_login_creds");i.push(c?N("pass","assetlinks.json enables Android Login Credentials."):N("fail","assetlinks.json is missing Android Login Credentials."))}return i}function Yf(e,t,n,i){if(t.framework!=="expo")return[];let r=[],o=qr(e),a=(Array.isArray(o?.ios?.associatedDomains)?o.ios.associatedDomains:[]).includes(`applinks:${n.domain}`);r.push(a?N("pass",`Expo iOS config contains applinks:${n.domain}.`):N(i?"warn":"fail",`Expo iOS config does not contain applinks:${n.domain}.`));let d=(Array.isArray(o?.android?.intentFilters)?o.android.intentFilters:[]).flatMap(u=>Array.isArray(u?.data)?u.data:[]).some(u=>u?.scheme==="https"&&u.host===n.domain);if(r.push(d?N("pass",`Expo Android config contains App Link host ${n.domain}.`):N(i?"warn":"fail",`Expo Android config does not contain App Link host ${n.domain}.`)),i)return r.push(N("warn","mach.config.json is missing deepLinks; values were inferred from Expo config. Run `mach deeplink setup` to persist Mach metadata and generate hosted files.")),r;let c=ml(e);return c==="wired"?r.push(N("pass","Expo deep link plugin is wired into Expo config and derives values from mach.config.json.")):c==="manual"&&a&&d?r.push(N("pass","Expo resolved config contains the deep-link settings from the dynamic config.")):c==="manual"?r.push(N("warn","Expo deep link plugin exists, but dynamic or missing Expo config means manual plugin insertion must be confirmed.")):a&&d?r.push(N("warn","Expo plugin is not wired, but resolved Expo config already contains the deep-link settings.")):r.push(N("fail","Expo deep link plugin is missing or not wired into Expo config.")),r}function qf(e,t,n){if(t.framework!=="react-native")return[];let i=[],r=ct.join(e,"android/app/src/main/AndroidManifest.xml");if(dt.existsSync(r)){let s=dt.readFileSync(r,"utf-8");i.push(s.includes(`android:host="${n.domain}"`)?N("pass","AndroidManifest.xml contains the App Links host."):N("warn","AndroidManifest.xml does not contain the App Links host. Native patching is planned for a later phase."))}let o=ct.join(e,"ios");if(dt.existsSync(o)){let a=dt.readdirSync(o,{recursive:!0}).filter(l=>typeof l=="string"&&l.endsWith(".entitlements")).some(l=>dt.readFileSync(ct.join(o,l),"utf-8").includes(`applinks:${n.domain}`));i.push(a?N("pass","iOS entitlements contain the associated domain."):N("warn","iOS entitlements do not contain the associated domain. Native patching is planned for a later phase."))}return i}async function Zr(e,t){let n=[];try{let i=await fetch(e,{redirect:"manual"});if(i.status>=300&&i.status<400&&!t)return n.push(N("fail",`${e} redirects. Apple AASA endpoints must not redirect.`)),n;n.push(i.status===200?N("pass",`${e} returned HTTP 200.`):N("fail",`${e} returned HTTP ${i.status}.`));let r=i.headers.get("content-type")||"";!r.includes("application/json")&&!r.includes("text/json")&&n.push(N("warn",`${e} content-type is "${r||"missing"}"; application/json is recommended.`)),JSON.parse(await i.text()),n.push(N("pass",`${e} contains valid JSON.`))}catch(i){n.push(N("fail",`${e} check failed: ${i.message}`))}return n}async function Jf(e){let t=e.domain;return(await Promise.all([Zr(`https://${t}/.well-known/apple-app-site-association`,!1),Zr(`https://${t}/apple-app-site-association`,!1),Zr(`https://${t}/.well-known/assetlinks.json`,!0)])).flat()}function Xf(e){let t=e.android?.package;if(!t)return[N("warn","Cannot print Android device verification commands because android.package is missing.")];let i=zf("adb",["version"],{encoding:"utf-8"}).status===0?"Run":"Install Android platform-tools, then run";return[N("info",`${i}: adb shell pm set-app-links --package ${t} 0 all`),N("info",`${i}: adb shell pm verify-app-links --re-verify ${t}`),N("info",`${i}: adb shell pm get-app-links ${t}`)]}async function Qr(e,t,n){let i=n.profile||t.deepLinks?.profile||"production",r=t.framework==="expo"?Ii(e):null,o=t.framework==="expo"?Si(t,r,i,e):null,s=!t.deepLinks&&!!o,a=t.deepLinks?yi(t,{profile:i,cwd:e,expoHints:r}):o,l=[];if(!a)return[N("fail","mach.config.json is missing deepLinks and Mach could not infer existing deep-link settings. Run `mach deeplink setup`.")];l.push(a.baseUrl?N("pass","deepLinks.baseUrl is configured."):N("fail","deepLinks.baseUrl is missing.")),l.push(a.domain?N("pass","deepLinks.domain is configured."):N("fail","deepLinks.domain is missing.")),l.push(a.scheme?N("pass","deepLinks.scheme is configured."):N("fail","deepLinks.scheme is missing."));let d=s?"warn":"fail";return l.push(...Kf(e,a,d)),l.push(...Wf(e,a,d)),l.push(...Yf(e,t,a,s)),l.push(...qf(e,t,a)),n.live&&l.push(...await Jf(a)),n.androidDevice&&l.push(...Xf(a)),l}var Bt=()=>process.stdin.isTTY&&process.stdout.isTTY,Sl=`${m.npmScope}/mach`,Ht=()=>{Zf("Operation cancelled."),process.exit(0)},no=e=>{if(typeof e!="string")return;let t=e.trim();return t.length>0?t:void 0},Je=(...e)=>{for(let t of e){let n=no(t);if(n)return n}},It=async(e,t,n,i,r)=>{if(t)return t;if(r||!Bt()){if(i)throw new Error(`${e.replace(/:$/,"")} is required. Pass it as an option or run interactively.`);return}let o=await Il({message:e,initialValue:t||"",placeholder:n,validate(s){if(i&&s.trim().length===0)return"Required."}});return Ft(o)&&Ht(),no(o)},bl=async(e,t,n)=>{if(n||!Bt())return t;let i=await to({message:e,initialValue:t});return Ft(i)&&Ht(),!!i};async function nm(e,t,n){let i=ve(e.framework),r=ve(t);if(r)return r;if(i)return i;let o=sl();if(n||!Bt())return o;let s=await em({message:`Which framework should ${m.name} configure?`,initialValue:o,options:[{value:"expo",label:"Expo"},{value:"react-native",label:"React Native"},{value:"flutter",label:"Flutter (not supported yet)"}]});return Ft(s)&&Ht(),s}var _n=e=>e==="ios"||e==="all",Ei=e=>e==="android"||e==="all";async function im(e,t,n){if(t!=="expo"||bi(e)||n.installPlugin===!1)return!1;if(n.installPlugin===!0||n.yes)return!0;if(!Bt())return!1;let i=await to({message:`Install ${Sl} locally so Expo can use ${Sl}/expo-plugin?`,initialValue:!0});return Ft(i)&&Ht(),!!i}async function rm(e,t){let n=!!t.yes,i=t.profile||e.deepLinks?.profile||"production",r=_e(e,i)||{},o=r.ios||{},s=r.android||{},a=e.submit?.[i]?.ios||{},l=e.submit?.[i]?.android||{},d=gt(e,i),c=await nm(e,t.framework,n);if(c==="flutter")throw new Error("Flutter deep-link automation is planned but not supported yet.");let u=al(e,ol(t.platform),r),f=e.deepLinks,h=c==="expo"&&(!Je(t.baseUrl,f?.baseUrl,t.domain?`https://${t.domain}`:void 0)||!Je(t.scheme,f?.scheme,o.scheme,e.scheme,e.slug,e.name)||_n(u)&&!Je(t.iosBundleId,f?.ios?.bundleIdentifier,o.bundleIdentifier,o.bundleId,e.ios?.bundleIdentifier)||Ei(u)&&!Je(t.androidPackage,f?.android?.package,s.package,s.applicationId,e.android?.package,l.packageName,l.package))?Si(e,Ii(process.cwd()),i,process.cwd()):null,g=t.output||f?.web?.outputDir||Ai(process.cwd(),e),y=await It("Deep link base URL:",t.baseUrl||f?.baseUrl||(t.domain?`https://${t.domain}`:void 0)||h?.baseUrl,"https://app.example.com",!0,n),S=bn(y),b=t.baseUrl?new URL(S).hostname:void 0,C=await It("Associated domain:",t.domain||b||f?.domain||h?.domain||new URL(S).hostname,"app.example.com",!0,n),I=hi(await It("URI scheme:",Je(t.scheme,f?.scheme,o.scheme,e.scheme,h?.scheme,e.slug,e.name,"app"),"myapp",!0,n)||"app"),j=_n(u)?await It("iOS bundle identifier:",Je(t.iosBundleId,f?.ios?.bundleIdentifier,o.bundleIdentifier,o.bundleId,e.ios?.bundleIdentifier,h?.ios?.bundleIdentifier),"com.example.app",!0,n):f?.ios?.bundleIdentifier||e.ios?.bundleIdentifier,Z=_n(u)?await It("Apple Team ID:",Je(t.appleTeamId,f?.ios?.appleTeamId,o.appleTeamId,o.developerTeamId,a.appleTeamId,a.developerTeamId,e.ios?.appleTeamId,e.ios?.developerTeamId,d.teamId),"ABCDE12345",!0,n):f?.ios?.appleTeamId||e.ios?.appleTeamId,z=_n(u)?await It("App Store ID (optional, for Smart App Banner):",Je(t.appStoreId,f?.ios?.appStoreId,o.ascAppId,a.ascAppId,e.ios?.ascAppId),"1234567890",!1,n):f?.ios?.appStoreId,fe=_n(u)?await bl("Enable iOS Web Credentials for HTTPS OAuth callbacks?",!!f?.ios?.webCredentials,n):!!f?.ios?.webCredentials,re=Ei(u)?await It("Android package name:",Je(t.androidPackage,f?.android?.package,s.package,s.applicationId,e.android?.package,l.packageName,l.package,h?.android?.package),"com.example.app",!0,n):f?.android?.package||e.android?.package,ke=f?.android?.sha256CertFingerprints||[],Ae=t.androidFingerprint||[],A=e.android?.sha256CertFingerprints||[],O=s.sha256CertFingerprints||[],w=[...Ae,...ke,...O,...A].filter(Boolean);if(Ei(u)&&w.length===0&&!n&&Bt()){let R=await Il({message:"Android SHA256 fingerprint (optional now, required for verified App Links):",placeholder:"AA:BB:CC:..."});Ft(R)&&Ht(),no(R)&&w.push(R)}let v=Ei(u)?await bl("Enable Android Login Credentials for website password and passkey sharing?",!!f?.android?.loginCredentials,n):!!f?.android?.loginCredentials,x=ll(e,{...t,baseUrl:S,domain:C,scheme:I,output:g,appleTeamId:Z,appStoreId:z,androidFingerprint:w});return x.ios={...x.ios||{},bundleIdentifier:j,appleTeamId:Z,appStoreId:z,webCredentials:fe},x.android={...x.android||{},package:re,sha256CertFingerprints:Array.from(new Set(w)),loginCredentials:v},{framework:c,platform:u,deepLinks:x}}var eo=(e,t)=>{t.length!==0&&Qf(t.map(n=>`- ${n}`).join(`
+`),e)},El=e=>e.filter(t=>t.level==="fail").length;function _l(e){for(let t of e){let n=t.level==="pass"?Fe.green("PASS"):t.level==="warn"?Fe.yellow("WARN"):t.level==="info"?Fe.cyan("INFO"):Fe.red("FAIL");_i.info(`${n} ${t.message}`)}}async function $l(e){try{let t=process.cwd(),n=yl.join(t,m.configFileName),i=le()||{};if(!tm.existsSync(n)){let S=e.yes||!Bt()?!0:await to({message:`${m.configFileName} was not found. Create one with deep link settings?`,initialValue:!0});if(Ft(S)&&Ht(),!S)return}let{framework:r,deepLinks:o}=await rm(i,e),s=e.profile||i.deepLinks?.profile||"production",a=dl(i,r,o,s),l=cl(a,t),d=hl(t,o),c=await im(t,r,e),u=r==="expo"?fl(t,o,{installPackage:c}):{written:[],skipped:[],notes:r==="react-native"?["React Native native patching is planned for a later phase. Hosted files were generated now."]:[]},f=[yl.relative(t,l),...d.written,...u.written],p=[...d.skipped,...u.skipped],h=[...d.notes,...u.notes];eo("Written",f),eo("Skipped",p),eo("Notes",h);let g=await Qr(t,a,{});_l(g);let y=El(g);if(y>0){$i(Fe.yellow(`Deep link setup finished with ${y} verification issue(s).`));return}$i(Fe.green("Deep link setup complete."))}catch(t){_i.error(Fe.red(t.message||"Deep link setup failed.")),process.exit(1)}}async function wl(e){try{let t=le();t||(_i.error(Fe.red(`No ${m.configFileName} found in the current directory.`)),process.exit(1));let n=await Qr(process.cwd(),t,e);_l(n);let i=El(n);i>0&&($i(Fe.red(`Deep link verification failed with ${i} issue(s).`)),process.exit(1)),$i(Fe.green("Deep link verification passed."))}catch(t){_i.error(Fe.red(t.message||"Deep link verification failed.")),process.exit(1)}}import{log as Xe,spinner as vl}from"@clack/prompts";import ut from"chalk";var om=e=>{let t=String(e||"").trim().toLowerCase();if(t==="ios"||t==="android")return t;throw new Error("Pass --platform ios or --platform android.")},sm=e=>{let t=Number(e);if(!Number.isFinite(t))throw new Error("Counter value must be a non-negative integer.");let n=Math.floor(t);if(n<0)throw new Error("Counter value must be a non-negative integer.");return n},am=(e,t,n)=>{let i=String(n.scope||"").trim();if(i)return i;let r=n.profile||"production",o=e==="android"?n.package||n.androidPackage:n.bundleId||n.iosBundleIdentifier;if(o)return String(o).trim();let s=e==="android"?Hn(t,r):jn(t,r);if(s)return s;throw new Error(e==="android"?`Could not resolve Android package. Set android.package in ${m.configFileName}, or pass --package/--scope.`:`Could not resolve iOS bundle identifier. Set ios.bundleIdentifier in ${m.configFileName}, or pass --bundle-id/--scope.`)},lm=()=>{let e=le();if(!e)throw new Error(`No ${m.configFileName} found in the current directory. Run \`${m.nameLower} init\` or \`${m.nameLower} link\` first.`);if(!e.projectId)throw new Error(`${m.configFileName} is missing projectId.`);return e},io=e=>{Xe.info(ut.bgBlue.white(" Native Version Counter ")),Xe.info(`${ut.blue("Platform:")} ${e.platform}`),Xe.info(`${ut.blue("Scope:")} ${e.scope}`),Xe.info(`${ut.blue("Current DB value:")} ${e.current}`),Xe.info(`${ut.blue("Next build will use:")} ${e.next}`),e.seeded||Xe.warn(ut.yellow("This counter has not been seeded yet. Existing store apps should run `mach version seed` once before auto-version builds."))};async function ro(e,t={}){if(!ye()){Xe.error(`You are not logged in. Run \`${m.nameLower} login\` first.`);return}try{let i=lm(),r=om(t.platform),o=am(r,i,t),s=String(i.projectId);if(e==="show"){let c=vl();t.json||c.start("Fetching native version counter...");let{data:u}=await $.get(`/projects/${s}/version-counters`,{params:{platform:r,scope:o}});if(u.status!=="success")throw new Error(u.message||"Failed to fetch version counter.");t.json?console.log(JSON.stringify(u.counter,null,2)):(c.stop("Fetched native version counter."),io(u.counter));return}let a=sm(t.value),l=vl();t.json||l.start("Seeding native version counter...");let{data:d}=await $.post(`/projects/${s}/version-counters/seed`,{platform:r,scope:o,value:a,force:!!t.force});if(d.status!=="success")throw new Error(d.message||"Failed to seed version counter.");t.json?console.log(JSON.stringify(d.counter,null,2)):(l.stop(`Seeded ${r} counter for ${o}.`),io(d.counter))}catch(i){let r=i?.response?.data?.message||i?.message||"Version command failed.";if(i?.response?.data?.counter&&!t.json){Xe.error(ut.red(r)),io(i.response.data.counter);return}t.json?console.log(JSON.stringify({status:"error",message:r},null,2)):Xe.error(ut.red(r))}}import{log as De,spinner as vn,text as Rl,select as Ol,confirm as dm,isCancel as $n,cancel as wn,outro as Rn,note as cm}from"@clack/prompts";import K from"chalk";import{execSync as um}from"child_process";async function pm(){try{let e=um("xcrun devicectl list devices --json-output -",{stdio:["pipe","pipe","pipe"]}).toString();return(JSON.parse(e).result?.devices||[]).filter(i=>i.connectionProperties?.transportType==="wired"||i.connectionProperties?.transportType==="localNetwork").map(i=>({udid:i.identifier,name:i.deviceProperties?.name||"Unknown Device",model:i.hardwareProperties?.marketingName||"iPhone"}))}catch{return[]}}var Pl=e=>e?.trim().toUpperCase()||void 0;function Dl(e){let t=le(),n=t?gt(t):{},i=Pl(e.teamId),r=i||n.teamId;return{...n,teamId:r,developerTeamId:i||n.developerTeamId||r}}async function fm(e){let t=e.udid,n=e.name,i=Dl(e),r=i.teamId;if(!t){let s=vn();s.start("Scanning for connected iOS devices...");let a=await pm();if(s.stop(a.length>0?`Found ${a.length} device(s)`:"No devices detected"),a.length===1)t=a[0].udid,n=n||a[0].name,De.info(`Detected: ${K.bold(n)} (${K.dim(t.substring(0,12)+"...")})`);else if(a.length>1){let l=await Ol({message:"Select a device to register:",options:a.map(c=>({value:c.udid,label:`${c.name} (${c.model})`,hint:c.udid.substring(0,12)+"..."}))});if($n(l)){wn("Cancelled");return}t=l;let d=a.find(c=>c.udid===t);n=n||d.name}else{De.info(K.dim("No connected devices found. Enter UDID manually."));let l=await Rl({message:"Device UDID:",placeholder:"00008101-XXXXXXXXXXXX",validate(d){if(d.length<10)return"UDID seems too short"}});if($n(l)){wn("Cancelled");return}t=l}}if(!n){let s=await Rl({message:"Device name:",placeholder:"Nitesh's iPhone",validate(a){if(a.length===0)return"Name is required"}});if($n(s)){wn("Cancelled");return}n=s}let o=vn();o.start("Registering device...");try{await $.post("/devices",{udid:t,name:n,platform:"ios",addedVia:"cli",teamId:r,teamName:i.teamName,developerTeamId:i.developerTeamId,appStoreConnectTeamId:i.appStoreConnectTeamId,providerId:i.providerId,providerName:i.providerName}),o.stop(K.green("Device registered!")),De.info(`  ${K.bold("Name:")} ${n}`),De.info(`  ${K.bold("UDID:")} ${K.dim(t)}`),r&&De.info(`  ${K.bold("Team:")} ${K.dim(r)}`)}catch(s){o.stop(K.red("Failed to register device")),De.error(s.response?.data?.message||s.message)}Rn(K.blue("---"))}async function mm(e={}){let t=Pl(e.teamId),n=vn();n.start("Fetching registered devices...");try{let r=(await $.get("/devices",t?{params:{teamId:t}}:void 0)).data.devices||[];if(n.stop(`${r.length} device(s) registered${t?` for team ${t}`:""}`),r.length===0){De.info(K.dim(`No devices registered yet. Run \`${m.nameLower} device register\` to add one.`)),Rn(K.blue("---"));return}let o=r.map(s=>{let a=new Date(s.createdAt).toLocaleDateString();return`  ${K.bold(s.name.padEnd(24))} ${K.dim(s.udid.padEnd(28))} ${K.dim((s.teamId||"-").padEnd(12))} ${K.cyan((s.addedVia||"-").padEnd(10))} ${K.dim(a)}`});cm(`  ${K.bold("Name".padEnd(24))} ${"UDID".padEnd(28)} ${"Team".padEnd(12)} ${"Via".padEnd(10)} Date
 `+o.join(`
-`),"Registered Devices")}catch(i){n.stop(K.red("Failed to fetch devices")),Ce.error(i.response?.data?.message||i.message)}Rn(K.blue("---"))}async function $m(e){let t=e.udid,n=xl(e).teamId;if(!t){let o=$n();o.start("Fetching registered devices...");try{let a=(await $.get("/devices",n?{params:{teamId:n}}:void 0)).data.devices||[];if(o.stop(`${a.length} device(s) found`),a.length===0){Ce.info(K.dim("No devices to remove.")),Rn(K.blue("---"));return}let l=await kl({message:"Select device to remove:",options:a.map(c=>({value:c.deviceKey||c.udid,label:c.name,hint:`${c.udid.substring(0,12)}...${c.teamId?` \xB7 ${c.teamId}`:""}`}))});if(wn(l)){vn("Cancelled");return}let d=a.find(c=>(c.deviceKey||c.udid)===l);t=d?.udid||l,n=d?.teamId||n}catch(s){o.stop(K.red("Failed to fetch devices")),Ce.error(s.response?.data?.message||s.message);return}}let i=await bm({message:`Remove device ${K.dim(t.substring(0,12)+"...")}?`});if(wn(i)||!i){vn("Cancelled");return}let r=$n();r.start("Removing device...");try{await $.delete(`/devices/${encodeURIComponent(t)}`,n?{params:{teamId:n}}:void 0),r.stop(K.green("Device removed"))}catch(o){r.stop(K.red("Failed to remove device")),Ce.error(o.response?.data?.message||o.message)}Rn(K.blue("---"))}async function vi(e,t){switch(e){case"register":await wm(t);break;case"list":await vm(t);break;case"remove":await $m(t);break;default:Ce.error(`Unknown action: ${e}`)}}import{log as ke,spinner as cd}from"@clack/prompts";import He from"chalk";import xi from"path";import Dn from"fs";import sg from"os";import ag from"axios";var Te=(o=>(o.CRITICAL="critical",o.HIGH="high",o.MEDIUM="medium",o.LOW="low",o.INFO="info",o))(Te||{}),Be=(l=>(l.PERMISSIONS="permissions",l.SECRETS="secrets",l.DEPENDENCIES="dependencies",l.STORAGE="storage",l.NETWORK="network",l.DEBUG="debug",l.MANIFEST="manifest",l.ATS="ats",l))(Be||{});import{spinner as ed,log as Pn}from"@clack/prompts";import $e from"chalk";import{execSync as Jm}from"child_process";import td from"fs";import nd from"path";import pt from"fs";import On from"path";import{execSync as Rm}from"child_process";var Ll={"android.permission.READ_PHONE_STATE":{severity:"high",description:"Can read phone number, IMEI, carrier info"},"android.permission.CALL_PHONE":{severity:"high",description:"Can make calls without user interaction"},"android.permission.SEND_SMS":{severity:"high",description:"Can send SMS without user interaction"},"android.permission.READ_SMS":{severity:"high",description:"Can read user SMS messages"},"android.permission.READ_CONTACTS":{severity:"medium",description:"Can read user contacts"},"android.permission.WRITE_CONTACTS":{severity:"medium",description:"Can modify user contacts"},"android.permission.READ_CALL_LOG":{severity:"high",description:"Can read call history"},"android.permission.CAMERA":{severity:"medium",description:"Camera access"},"android.permission.RECORD_AUDIO":{severity:"medium",description:"Microphone access"},"android.permission.ACCESS_FINE_LOCATION":{severity:"medium",description:"Precise GPS location"},"android.permission.ACCESS_COARSE_LOCATION":{severity:"medium",description:"Approximate location"},"android.permission.ACCESS_BACKGROUND_LOCATION":{severity:"high",description:"Background location tracking"},"android.permission.READ_EXTERNAL_STORAGE":{severity:"medium",description:"Read files on device"},"android.permission.WRITE_EXTERNAL_STORAGE":{severity:"medium",description:"Write files on device"},"android.permission.READ_MEDIA_IMAGES":{severity:"low",description:"Read photos"},"android.permission.READ_MEDIA_VIDEO":{severity:"low",description:"Read videos"},"android.permission.SYSTEM_ALERT_WINDOW":{severity:"high",description:"Draw overlays on other apps"},"android.permission.REQUEST_INSTALL_PACKAGES":{severity:"high",description:"Can install APKs"}},Om={NSCameraUsageDescription:{severity:"medium",description:"Camera access declared"},NSMicrophoneUsageDescription:{severity:"medium",description:"Microphone access declared"},NSLocationWhenInUseUsageDescription:{severity:"medium",description:"Location (in-use) declared"},NSLocationAlwaysUsageDescription:{severity:"high",description:"Background location declared"},NSContactsUsageDescription:{severity:"medium",description:"Contacts access declared"},NSCalendarsUsageDescription:{severity:"low",description:"Calendar access declared"},NSPhotoLibraryUsageDescription:{severity:"low",description:"Photo library access declared"}};function Pm(e){try{let n=Rm("npx expo config --type introspect --json 2>/dev/null",{cwd:e,encoding:"utf-8",timeout:3e4});return JSON.parse(n)}catch{}let t=On.join(e,"app.json");if(pt.existsSync(t))try{let n=JSON.parse(pt.readFileSync(t,"utf-8"));return n.expo||n}catch{}return null}function Dm(e){let t=[],n=On.join(e,"node_modules");if(!pt.existsSync(n))return t;let i=/<uses-permission\s+android:name="([^"]+)"/g;function r(o,s){let a=On.join(o,"android","src","main","AndroidManifest.xml");if(!pt.existsSync(a))return;let l=pt.readFileSync(a,"utf-8"),d;for(;(d=i.exec(l))!==null;)t.push({pkg:s,permission:d[1]});i.lastIndex=0}for(let o of pt.readdirSync(n)){if(o.startsWith("."))continue;let s=On.join(n,o);if(o.startsWith("@")){if(!pt.statSync(s).isDirectory())continue;for(let a of pt.readdirSync(s))r(On.join(s,a),`${o}/${a}`)}else r(s,o)}return t}async function Ml(e,t){let n=[],i=1,r=Pm(e),o=r?.android?.permissions||[],s=r?.android?.blockedPermissions||[];for(let d of o){let c=Ll[d];c&&n.push({id:`PERM-${String(i++).padStart(3,"0")}`,title:`${d.split(".").pop()} declared`,description:c.description,severity:c.severity,category:"permissions",file:"app.config.ts",recommendation:"Remove from permissions if not needed, or add justification."})}let a=Dm(e);for(let{pkg:d,permission:c}of a){let u=Ll[c];u&&(s.includes(c)||o.includes(c)||n.push({id:`PERM-${String(i++).padStart(3,"0")}`,title:`${c.split(".").pop()} injected by ${d}`,description:`${u.description}. Auto-injected via ${d} AndroidManifest.xml`,severity:u.severity,category:"permissions",file:`node_modules/${d}/android/src/main/AndroidManifest.xml`,recommendation:`Add "${c}" to blockedPermissions if not needed.`,autoFixable:!0}))}let l=r?.ios?.infoPlist||{};for(let[d,c]of Object.entries(Om))d in l&&n.push({id:`PERM-${String(i++).padStart(3,"0")}`,title:`iOS: ${d} declared`,description:c.description,severity:c.severity,category:"permissions",file:"app.config.ts",recommendation:`Remove ${d} from infoPlist if the app does not use this capability.`});return{category:"permissions",label:"Permission Audit",findings:n,durationMs:0}}import ao from"fs";import $i from"path";var Cm=[{id:"SEC-001",pattern:/(['"`])(?:sk|pk)_(?:live|test)_[a-zA-Z0-9]{20,}\1/g,severity:"critical",label:"Stripe API Key"},{id:"SEC-002",pattern:/(['"`])AIza[0-9A-Za-z\-_]{35}\1/g,severity:"high",label:"Google API Key"},{id:"SEC-003",pattern:/(['"`])AKIA[0-9A-Z]{16}\1/g,severity:"critical",label:"AWS Access Key ID"},{id:"SEC-004",pattern:/-----BEGIN (?:RSA |EC )?PRIVATE KEY-----/g,severity:"critical",label:"Private key in source"},{id:"SEC-005",pattern:/(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{36,}/g,severity:"high",label:"GitHub Token"},{id:"SEC-006",pattern:/xox[bpors]-[a-zA-Z0-9-]{10,}/g,severity:"high",label:"Slack Token"},{id:"SEC-007",pattern:/(?:password|secret|apikey|api_key)\s*[:=]\s*['"`][^'"`\n]{8,}['"`]/gi,severity:"high",label:"Hardcoded credential"}],Tm=new Set([".ts",".tsx",".js",".jsx"]),km=new Set(["node_modules",".expo",".git","android","ios","dist","build","__tests__","__mocks__"]);function Ul(e){let t=[],n=ao.readdirSync(e,{withFileTypes:!0});for(let i of n){if(km.has(i.name))continue;let r=$i.join(e,i.name);i.isDirectory()?t.push(...Ul(r)):Tm.has($i.extname(i.name))&&t.push(r)}return t}function Nm(e){let t=e.trim();return t.startsWith("//")||t.startsWith("*")||t.startsWith("/*")}function xm(e){return/process\.env\./i.test(e)||/import\.meta\.env/i.test(e)}async function Fl(e,t){let n=[],i=$i.join(e,"src"),r=ao.existsSync(i)?i:e,o=Ul(r);for(let s of o){let l=ao.readFileSync(s,"utf-8").split(`
-`),d=$i.relative(e,s);for(let c=0;c<l.length;c++){let u=l[c];if(!Nm(u)&&!xm(u))for(let{id:f,pattern:p,severity:g,label:h}of Cm)p.lastIndex=0,p.test(u)&&n.push({id:f,title:h,description:`Potential ${h.toLowerCase()} found in source code`,severity:g,category:"secrets",file:d,line:c+1,recommendation:`Move to environment variables or a secrets manager. Use \`${m.nameLower} env set\` for managed secrets.`})}}return{category:"secrets",label:"Secrets Detection",findings:n,durationMs:0}}import{execSync as Lm}from"child_process";var Mm={critical:"critical",high:"high",moderate:"medium",low:"low",info:"info"};async function Bl(e,t){let n=[],i=1,r;try{r=Lm("npm audit --json 2>/dev/null",{cwd:e,encoding:"utf-8",timeout:6e4})}catch(a){if(r=a.stdout||"",!r)return{category:"dependencies",label:"Dependency CVEs",findings:[],durationMs:0,error:"Failed to run npm audit. Ensure npm is available and dependencies are installed."}}let o;try{o=JSON.parse(r)}catch{return{category:"dependencies",label:"Dependency CVEs",findings:[],durationMs:0,error:"Failed to parse npm audit output."}}let s=o.vulnerabilities||{};for(let[a,l]of Object.entries(s)){let d=Mm[l.severity]||"info",c=Array.isArray(l.via)?l.via.map(u=>typeof u=="string"?u:u.title||u.name).join(", "):String(l.via);n.push({id:`DEP-${String(i++).padStart(3,"0")}`,title:`${a} \u2014 ${l.severity}`,description:`Via: ${c}. Range: ${l.range||"unknown"}`,severity:d,category:"dependencies",recommendation:l.fixAvailable?`Run \`npm audit fix\` or update ${a} to a patched version.`:"No fix available yet. Monitor for updates or evaluate alternatives.",autoFixable:!!l.fixAvailable})}return{category:"dependencies",label:"Dependency CVEs",findings:n,durationMs:0}}import Ri from"fs";import Oi from"path";var Um=/(?:token|password|credential|secret|apiKey|api_key|session|auth|jwt|refresh_token|access_token|private_key|pin|otp)/i,Hl=/AsyncStorage\s*\.\s*(?:setItem|mergeItem)\s*\(\s*['"`]([^'"`]+)['"`]/g,Fm=/from\s+['"]@react-native-async-storage\/async-storage['"]|from\s+['"]react-native['"].*AsyncStorage/,Bm=new Set([".ts",".tsx",".js",".jsx"]),Hm=new Set(["node_modules",".expo",".git","android","ios","dist","build"]);function jl(e){let t=[];if(!Ri.existsSync(e))return t;let n=Ri.readdirSync(e,{withFileTypes:!0});for(let i of n){if(Hm.has(i.name))continue;let r=Oi.join(e,i.name);i.isDirectory()?t.push(...jl(r)):Bm.has(Oi.extname(i.name))&&t.push(r)}return t}async function Gl(e,t){let n=[],i=1,r=Oi.join(e,"src"),o=Ri.existsSync(r)?r:e,s=jl(o);for(let a of s){let l=Ri.readFileSync(a,"utf-8");if(!Fm.test(l))continue;let d=l.split(`
-`),c=Oi.relative(e,a);for(let u=0;u<d.length;u++){let f=d[u];Hl.lastIndex=0;let p;for(;(p=Hl.exec(f))!==null;){let g=p[1];Um.test(g)&&n.push({id:`STOR-${String(i++).padStart(3,"0")}`,title:`AsyncStorage used for "${g}"`,description:`Sensitive data key "${g}" stored in AsyncStorage (unencrypted).`,severity:"high",category:"storage",file:c,line:u+1,recommendation:"Use expo-secure-store (SecureStore) for sensitive data instead of AsyncStorage."})}}}return{category:"storage",label:"Insecure Storage",findings:n,durationMs:0}}import Pi from"fs";import Di from"path";var Vl=/['"`](http:\/\/(?!localhost|127\.0\.0\.1|10\.|192\.168\.|0\.0\.0\.0|172\.(?:1[6-9]|2\d|3[01])\.)[^'"`\s]+)['"`]/g,jm=/\/api\/|\/v[0-9]+\/|\/graphql|\/rest\//i,Gm=new Set([".ts",".tsx",".js",".jsx"]),Vm=new Set(["node_modules",".expo",".git","android","ios","dist","build","__tests__","__mocks__"]);function zl(e){let t=[];if(!Pi.existsSync(e))return t;let n=Pi.readdirSync(e,{withFileTypes:!0});for(let i of n){if(Vm.has(i.name))continue;let r=Di.join(e,i.name);i.isDirectory()?t.push(...zl(r)):Gm.has(Di.extname(i.name))&&t.push(r)}return t}async function Kl(e,t){let n=[],i=1,r=Di.join(e,"src"),o=Pi.existsSync(r)?r:e,s=zl(o);for(let a of s){let d=Pi.readFileSync(a,"utf-8").split(`
-`),c=Di.relative(e,a);for(let u=0;u<d.length;u++){let f=d[u],p=f.trim();if(p.startsWith("//")||p.startsWith("*"))continue;Vl.lastIndex=0;let g;for(;(g=Vl.exec(f))!==null;){let h=g[1],A=jm.test(h);n.push({id:`NET-${String(i++).padStart(3,"0")}`,title:`Insecure HTTP URL${A?" (API endpoint)":""}`,description:`Plain HTTP URL found: ${h}`,severity:A?"high":"medium",category:"network",file:c,line:u+1,recommendation:"Use HTTPS instead of HTTP for all network requests."})}}}return{category:"network",label:"HTTP URLs",findings:n,durationMs:0}}import Ci from"fs";import Ti from"path";var Wl=/(?:debug|debugMode|devMode|enableDebug)\s*[:=]\s*true/gi,Yl=/console\.(?:log|warn|info|debug)\s*\([^)]*(?:token|password|secret|credential|key|auth)/gi,zm=new Set([".ts",".tsx",".js",".jsx"]),Km=new Set(["node_modules",".expo",".git","android","ios","dist","build","__tests__","__mocks__"]);function ql(e){let t=[];if(!Ci.existsSync(e))return t;let n=Ci.readdirSync(e,{withFileTypes:!0});for(let i of n){if(Km.has(i.name))continue;let r=Ti.join(e,i.name);i.isDirectory()?t.push(...ql(r)):zm.has(Ti.extname(i.name))&&t.push(r)}return t}async function Jl(e,t){let n=[],i=1,r=Ti.join(e,"src"),o=Ci.existsSync(r)?r:e,s=ql(o);for(let a of s){let d=Ci.readFileSync(a,"utf-8").split(`
-`),c=Ti.relative(e,a);for(let u=0;u<d.length;u++){let f=d[u],p=f.trim();if(!(p.startsWith("//")||p.startsWith("*"))&&(Wl.lastIndex=0,Wl.test(f)&&n.push({id:`DBG-${String(i++).padStart(3,"0")}`,title:"Hardcoded debug flag",description:"Debug/dev mode enabled in source code",severity:"medium",category:"debug",file:c,line:u+1,recommendation:"Use __DEV__ or environment variables instead of hardcoded debug flags."}),Yl.lastIndex=0,Yl.test(f))){let g=d.slice(Math.max(0,u-3),u).join(`
-`);/__DEV__/.test(g)||n.push({id:`DBG-${String(i++).padStart(3,"0")}`,title:"Sensitive data in console log",description:"Console log may expose sensitive data (token, password, etc.) in production",severity:"medium",category:"debug",file:c,line:u+1,recommendation:"Wrap in __DEV__ check or remove sensitive data from console output."})}}}return{category:"debug",label:"Debug/Dev Flags",findings:n,durationMs:0}}import Xl from"fs";import lo from"path";var Wm=new Set(["androidx.work.impl.background.systemjob.SystemJobService","androidx.work.impl.diagnostics.DiagnosticsReceiver","com.google.firebase.iid.FirebaseInstanceIdReceiver","com.google.android.gms.auth.api.signin.RevocationBoundService","androidx.profileinstaller.ProfileInstallReceiver","com.google.firebase.messaging.FirebaseMessagingService","com.google.android.gms.measurement.AppMeasurementService","com.google.android.gms.measurement.AppMeasurementJobService"]);function Ym(e){let t=[lo.join(e,"android","app","src","main","AndroidManifest.xml"),lo.join(e,"android","AndroidManifest.xml")];for(let n of t)if(Xl.existsSync(n))return n;return null}async function Zl(e,t){let n=[],i=1,r=Ym(e);if(!r)return{category:"manifest",label:"Android Manifest",findings:[],durationMs:0,error:"No AndroidManifest.xml found. Run with --prebuild or run `expo prebuild` first."};let o=Xl.readFileSync(r,"utf-8"),s=lo.relative(e,r),a=/<(activity|service|receiver|provider)\s+([^>]*?)(?:\/>|>)/gs,l;for(;(l=a.exec(o))!==null;){let d=l[1],c=l[2],f=c.match(/android:name="([^"]+)"/)?.[1]||"unknown";if(Wm.has(f))continue;let p=/android:exported="true"/.test(c),g=/android:permission="/.test(c);p&&!g&&n.push({id:`MAN-${String(i++).padStart(3,"0")}`,title:`Exported ${d}: ${f.split(".").pop()}`,description:`${f} is exported=true without android:permission protection`,severity:"medium",category:"manifest",file:s,recommendation:'Set android:exported="false" or add an android:permission attribute.'})}return/android:allowBackup="true"/.test(o)&&n.push({id:`MAN-${String(i++).padStart(3,"0")}`,title:"allowBackup is enabled",description:'android:allowBackup="true" allows data extraction via ADB backup',severity:"medium",category:"manifest",file:s,recommendation:'Set android:allowBackup="false" via expo-build-properties plugin.',autoFixable:!0}),/android:debuggable="true"/.test(o)&&n.push({id:`MAN-${String(i++).padStart(3,"0")}`,title:"App is debuggable",description:'android:debuggable="true" allows attaching a debugger in production',severity:"critical",category:"manifest",file:s,recommendation:"Ensure debuggable is false for production builds. This is usually set automatically for release builds."}),{category:"manifest",label:"Android Manifest",findings:n,durationMs:0}}import ki from"fs";import co from"path";function qm(e){let t=co.join(e,"ios");if(!ki.existsSync(t))return null;let n=ki.readdirSync(t,{withFileTypes:!0});for(let i of n){if(!i.isDirectory()||i.name==="Pods"||i.name.startsWith("."))continue;let r=co.join(t,i.name,"Info.plist");if(ki.existsSync(r))return r}return null}async function Ql(e,t){let n=[],i=1,r=qm(e);if(!r)return{category:"ats",label:"iOS ATS Config",findings:[],durationMs:0,error:"No Info.plist found. Run with --prebuild or run `expo prebuild` first."};let o=ki.readFileSync(r,"utf-8"),s=co.relative(e,r),a=o.match(/<key>NSAppTransportSecurity<\/key>\s*<dict>([\s\S]*?)<\/dict>/);if(a){let l=a[1];/<key>NSAllowsArbitraryLoads<\/key>\s*<true\s*\/>/.test(l)&&n.push({id:`ATS-${String(i++).padStart(3,"0")}`,title:"ATS disabled \u2014 NSAllowsArbitraryLoads",description:"App Transport Security is completely disabled. All HTTP connections are allowed.",severity:"critical",category:"ats",file:s,recommendation:"Remove NSAllowsArbitraryLoads or set to false. Use domain-specific exceptions only if absolutely necessary."});let d=l.match(/<key>NSExceptionDomains<\/key>\s*<dict>([\s\S]*?)<\/dict>/);if(d){let c=d[1].match(/<key>([^<]+)<\/key>/g);if(c)for(let u of c){let f=u.replace(/<\/?key>/g,"");f!=="NSExceptionDomains"&&n.push({id:`ATS-${String(i++).padStart(3,"0")}`,title:`ATS exception: ${f}`,description:`ATS exception configured for ${f}`,severity:"low",category:"ats",file:s,recommendation:`Verify that the ATS exception for ${f} is necessary. Use HTTPS where possible.`})}}}return{category:"ats",label:"iOS ATS Config",findings:n,durationMs:0}}var Xm=[{category:"permissions",label:"Permission Audit",fn:Ml,requiresPrebuild:!1},{category:"secrets",label:"Secrets Detection",fn:Fl,requiresPrebuild:!1},{category:"dependencies",label:"Dependency CVEs",fn:Bl,requiresPrebuild:!1},{category:"storage",label:"Insecure Storage",fn:Gl,requiresPrebuild:!1},{category:"network",label:"HTTP URLs",fn:Kl,requiresPrebuild:!1},{category:"debug",label:"Debug/Dev Flags",fn:Jl,requiresPrebuild:!1},{category:"manifest",label:"Android Manifest",fn:Zl,requiresPrebuild:!0},{category:"ats",label:"iOS ATS Config",fn:Ql,requiresPrebuild:!0}];async function id(e,t){let n=Xm;t.category&&(n=n.filter(s=>s.category===t.category),n.length===0&&(Pn.error($e.red(`Unknown category: ${t.category}`)),Pn.info($e.dim(`Available: ${Object.values(Be).join(", ")}`)),process.exit(1)));let i=n.filter(s=>!s.requiresPrebuild),r=n.filter(s=>s.requiresPrebuild),o=[];for(let s of i){let a=ed();a.start($e.dim(`Running ${s.label}...`));try{let l=Date.now(),d=await s.fn(e,t);d.durationMs=Date.now()-l,o.push(d);let c=d.findings.length;a.stop(c>0?$e.yellow(`${s.label} \u2014 ${c} finding(s)`):$e.green(`${s.label} \u2014 clean`))}catch(l){a.stop($e.red(`${s.label} \u2014 error`)),o.push({category:s.category,label:s.label,findings:[],durationMs:0,error:l.message})}}if(r.length>0){let s=nd.join(e,"android"),a=nd.join(e,"ios"),l=td.existsSync(s)||td.existsSync(a);if(!l&&t.prebuild){t.json||Pn.info($e.dim(`
-Running expo prebuild for deeper analysis...`));try{Jm("npx expo prebuild --no-install",{cwd:e,stdio:"pipe"})}catch{return Pn.warn($e.yellow("Prebuild failed \u2014 skipping manifest/plist checks.")),o}}else if(!l)return t.json||Pn.info($e.dim(`
-Skipping manifest/plist checks \u2014 no android/ios dirs. Use --prebuild to generate them.`)),o;for(let d of r){let c=ed();c.start($e.dim(`Running ${d.label}...`));try{let u=Date.now(),f=await d.fn(e,t);f.durationMs=Date.now()-u,o.push(f);let p=f.findings.length;c.stop(p>0?$e.yellow(`${d.label} \u2014 ${p} finding(s)`):$e.green(`${d.label} \u2014 clean`))}catch(u){c.stop($e.red(`${d.label} \u2014 error`)),o.push({category:d.category,label:d.label,findings:[],durationMs:0,error:u.message})}}}return o}import fe from"chalk";import{log as le}from"@clack/prompts";var Ut={critical:fe.bgRed.white.bold,high:fe.red.bold,medium:fe.yellow.bold,low:fe.blue,info:fe.dim},Ni={critical:0,high:1,medium:2,low:3,info:4};function Zm(e,t){if(!t)return!0;let n=Ni[t];return n===void 0?!0:Ni[e]<=n}function rd(e,t){let n=0,i={critical:0,high:0,medium:0,low:0,info:0};for(let s of e){let a=s.findings.filter(d=>Zm(d.severity,t));if(a.length===0&&!s.error)continue;if(le.info(""),le.info(fe.bold(`  ${s.label}`)+fe.dim(`  ${a.length} finding(s)`)),le.info(fe.dim("  "+"\u2500".repeat(60))),s.error){le.error(fe.red(`  Error: ${s.error}`));continue}let l=[...a].sort((d,c)=>Ni[d.severity]-Ni[c.severity]);for(let d of l){let c=Ut[d.severity](` ${d.severity.toUpperCase()} `);le.info(`  ${c}  ${fe.bold(d.id)}  ${d.title}`),le.info(fe.dim(`          ${d.description}`)),d.file&&le.info(fe.dim(`          File: ${d.file}${d.line?`:${d.line}`:""}`)),le.info(fe.cyan(`          Fix: ${d.recommendation}`)),le.info(""),i[d.severity]++,n++}}le.info(""),le.info(fe.bold("  Summary")),le.info(fe.dim("  "+"\u2500".repeat(60))),le.info(`  Total: ${fe.bold(String(n))} finding(s)`),le.info(`  ${Ut.critical(` ${i.critical} Critical `)}  ${Ut.high(` ${i.high} High `)}  ${Ut.medium(` ${i.medium} Medium `)}  ${Ut.low(` ${i.low} Low `)}  ${Ut.info(` ${i.info} Info `)}`);let r=i.critical>0,o=i.high>0;r||o?(le.info(""),le.error(fe.red.bold(`  FAIL \u2014 ${i.critical} critical, ${i.high} high issue(s) found`))):n>0?(le.info(""),le.warn(fe.yellow("  PASS (with warnings) \u2014 no critical or high issues"))):(le.info(""),le.success(fe.green.bold("  PASS \u2014 no issues found")))}function od(e,t){let n=e.flatMap(r=>r.findings),i={};for(let r of Object.values(Te))i[r]=n.filter(o=>o.severity===r).length;return{version:"1.0.0",timestamp:new Date().toISOString(),project:t.name||"unknown",projectVersion:t.version||"0.0.0",summary:{total:n.length,...i},passed:i.critical===0&&i.high===0,checks:e.map(r=>({category:r.category,label:r.label,findingCount:r.findings.length,durationMs:r.durationMs,error:r.error||null})),findings:n}}import{log as de,spinner as Qm}from"@clack/prompts";import ie from"chalk";import Ze from"fs";import eg from"os";import Ft from"path";import{execSync as tg}from"child_process";var sd=16384,ng=1,ig=Buffer.from([127,69,76,70]);async function ad(e){de.info(ie.bold.underline("16KB Page Alignment Check")),console.log("");let t=Ft.resolve(e);if(!Ze.existsSync(t))return de.error(ie.red(`APK file not found: ${t}`)),!1;if(!t.endsWith(".apk"))return de.error(ie.red("The provided file is not an APK file.")),!1;let n=Qm();n.start("Extracting and analyzing native libraries...");let i=Ze.mkdtempSync(Ft.join(eg.tmpdir(),"mach-16kb-"));try{try{tg(`unzip -o -q "${t}" "lib/arm64-v8a/*.so" "lib/x86_64/*.so" -d "${i}" 2>/dev/null`,{encoding:"utf-8",maxBuffer:50*1024*1024})}catch{}let r=ld(Ft.join(i,"lib"));if(r.length===0)return n.stop("Analysis complete."),de.info(ie.yellow("No arm64-v8a or x86_64 native libraries found in the APK.")),de.info(ie.dim("16KB alignment check only applies to arm64-v8a and x86_64 architectures.")),!0;let o=[];for(let l of r){let d=Ft.relative(i,l),c=og(d),u=Ft.basename(l),f=rg(l);f!==null&&o.push({name:u,filePath:d,arch:c,align:f,compatible:f>=sd})}if(n.stop("Analysis complete."),o.length===0)return de.info(ie.yellow("No valid ELF shared libraries found.")),!0;let s=o.filter(l=>!l.compatible),a=o.filter(l=>l.compatible);if(de.info(ie.dim(`Checked ${o.length} native librar${o.length===1?"y":"ies"}
-`)),s.length>0){de.info(ie.red.bold(`Incompatible libraries:
-`));for(let l of s)de.error(ie.red(`${ie.bold(l.name)} ${ie.dim(`(${l.arch})`)}`)),de.info(ie.dim(`  PT_LOAD alignment: 2**${Math.log2(l.align)} (${l.align} bytes, needs 2**14 = ${sd})`))}return a.length>0&&(console.log(""),de.success(ie.green(`${a.length} librar${a.length===1?"y":"ies"} correctly aligned (2**14 or higher).`))),console.log(""),s.length===0?(de.success(ie.green.bold("ELF Verification Successful. APK is 16KB compatible.")),!0):(de.error(ie.red.bold(`Found ${s.length} unaligned lib${s.length===1?"":"s"} (arm64-v8a/x86_64 libs need to be aligned).`)),console.log(""),de.info(ie.yellow("To fix this:")),de.info(ie.dim("  1. Rebuild with NDK r28+ which defaults to 16KB page alignment")),de.info(ie.dim("  2. Or set -DANDROID_SUPPORT_FLEXIBLE_PAGE_SIZES=ON in CMake")),de.info(ie.dim("  3. Update third-party libraries that ship prebuilt .so files")),de.info(ie.dim("  4. After rebuilding: zipalign -p -f -v 16 input.apk output.apk")),console.log(""),de.info(ie.dim("Reference: https://developer.android.com/guide/practices/page-sizes")),!1)}catch(r){return n.stop("Analysis failed."),de.error(ie.red(`Failed to analyze APK: ${r.message}`)),!1}finally{try{Ze.rmSync(i,{recursive:!0,force:!0})}catch{}}}function rg(e){let t=Ze.openSync(e,"r");try{let n=Buffer.alloc(64);if(Ze.readSync(t,n,0,64,0),!n.subarray(0,4).equals(ig))return null;let i=n[4]===2,r=n[5]===1,o=(f,p)=>r?f.readUInt16LE(p):f.readUInt16BE(p),s=(f,p)=>r?f.readUInt32LE(p):f.readUInt32BE(p),a=(f,p)=>Number(r?f.readBigUInt64LE(p):f.readBigUInt64BE(p)),l,d,c;i?(l=a(n,32),d=o(n,54),c=o(n,56)):(l=s(n,28),d=o(n,42),c=o(n,44));let u=null;for(let f=0;f<c;f++){let p=Buffer.alloc(d);if(Ze.readSync(t,p,0,d,l+f*d),s(p,0)!==ng)continue;let h;i?h=a(p,48):h=s(p,28),h>0&&(u===null||h<u)&&(u=h)}return u??0}catch{return null}finally{Ze.closeSync(t)}}function ld(e){let t=[];if(!Ze.existsSync(e))return t;let n=Ze.readdirSync(e,{withFileTypes:!0});for(let i of n){let r=Ft.join(e,i.name);i.isDirectory()?t.push(...ld(r)):i.name.endsWith(".so")&&t.push(r)}return t}function og(e){return e.includes("arm64-v8a")?"arm64-v8a":e.includes("x86_64")?"x86_64":"unknown"}var ud=async e=>{if(ye()||(ke.error(He.red(`You are not logged in. Run \`${m.nameLower} login\` first.`)),process.exit(1)),e.apk){await lg(e);return}let n=process.cwd(),i=xi.join(n,"package.json");Dn.existsSync(i)||(ke.error(He.red("No package.json found. Run this command from a project root.")),process.exit(1));let r=JSON.parse(Dn.readFileSync(i,"utf-8")),o=!!(r.dependencies?.expo||r.devDependencies?.expo);e.json||(ke.info(He.dim(`Project: ${r.name||"unknown"} v${r.version||"0.0.0"}`)),ke.info(He.dim(`Type: ${o?"Expo":"Bare React Native"}`)),ke.info(""));let s={json:e.json,fix:e.fix,category:e.category,severity:e.severity,prebuild:e.prebuild},a=await id(n,s);e.json?console.log(JSON.stringify(od(a,r),null,2)):rd(a,e.severity);let l=a.some(c=>c.findings.some(u=>u.severity==="critical")),d=a.some(c=>c.findings.some(u=>u.severity==="high"));(l||d)&&process.exit(1)},dd=["16kb"];async function lg(e){let t=e.category?.toLowerCase();t&&!dd.includes(t)&&(ke.error(He.red(`Unknown APK check category: "${t}"`)),ke.info(He.dim(`Available APK checks: ${dd.join(", ")}`)),process.exit(1));let n=await dg(e.apk);n||process.exit(1);let i=!t,r=!1;(i||t==="16kb")&&(await ad(n)||(r=!0)),r&&process.exit(1)}async function dg(e){if(e.startsWith("build:")){let n=e.slice(6);return await cg(n)}if(e.startsWith("http://")||e.startsWith("https://"))return await pd(e);let t=xi.resolve(e);return Dn.existsSync(t)?t:(ke.error(He.red(`APK file not found: ${t}`)),null)}async function cg(e){let t=cd();t.start(`Fetching APK from build ${e}...`);try{let n=await $.get(`/build/${e}`);if(n.data.status!=="success")throw new Error(n.data.message);let i=n.data.build;if(!i)throw new Error("Build not found");let r=i.artifacts?.find(o=>o.type?o.type==="apk":o.name?.endsWith(".apk")||o.url?.includes(".apk"));return!r||!r.url?(t.stop("No APK artifact found"),ke.error(He.red("This build does not have an APK artifact.")),ke.info(He.dim("Make sure the build produced an APK (not just an AAB).")),null):(t.stop(`Found build: ${i.buildId||e}`),await pd(r.url))}catch(n){return t.stop("Failed to fetch build"),ke.error(He.red(n.message)),null}}async function pd(e){let t=cd();t.start("Downloading APK...");try{let n=Dn.mkdtempSync(xi.join(sg.tmpdir(),`${m.nameLower}-audit-`)),i=xi.join(n,"app.apk"),r=await ag.get(e,{responseType:"arraybuffer"});Dn.writeFileSync(i,r.data);let o=(r.data.length/(1024*1024)).toFixed(1);return t.stop(`Downloaded APK (${o} MB)`),i}catch(n){return t.stop("Download failed"),ke.error(He.red(`Failed to download APK: ${n.message}`)),null}}var fg=console.log;console.log=()=>{};pg();console.log=fg;X(q.bgCyan.black(m.cliTag("Production Build Orchestrator")));var Cn=(e,t=[])=>t.concat(e),U=new ug;U.name(m.nameLower).description(`${m.name} CLI: Powerful Cloud Infrastructure Tools`).version(et).option("-y, --yes","Automatically answer yes to all prompts",!1).option("--quiet","Suppress non-essential output",!1);U.command("agent").description("Manage local device discovery agent for the Install Hub (port 7070)").argument("[action]","start, run, install, status, restart, stop, or uninstall","start").action(async e=>{await Ra(e)});U.command("host").description("Setup AWS S3 static hosting and CloudFront").action(async()=>{X(q.bgCyan.black(m.cliTag("Hosting"))),await To()});U.command("sitemap").description("Generate sitemap.xml from Expo Router app structure").option("-o, --output <path>","Output path for sitemap.xml","./public/sitemap.xml").action(async e=>{X(q.bgCyan.black(m.cliTag("Sitemap Generator"))),await Lo(e)});U.command("build").description("Run a build on a cloud provider (AWS Spot Instances)").argument("[platform]","Target platform (android, ios)").option("--platform <os>","Target platform alias (android, ios) [Optional]").option("--repo <url>","Git Repository URL").option("--branch <name>","Git Branch").option("--ami <id>","AMI ID").option("--bucket <name>","S3 Bucket for artifacts").option("--region <region>","AWS Region").option("--aws-profile <name>","AWS Credentials Profile").option("-p, --build-profile <name>","Build Profile (e.g. production, staging)").option("--profile <name>","Build Profile (alias for --build-profile)").option("--dry-run","Generate User Data script without launching").option("--keep-instance","Do not terminate the instance after build").option("--subnet <id>","VPC Subnet ID to launch the instance in").option("--security-group <id>","VPC Security Group ID to use").option("--ssh-host <host>","Remote host for iOS build (SSH)").option("--ssh-user <user>","SSH username for remote host").option("--ssh-key <path>","Path to private SSH key for remote host").option("--ios-scheme <scheme>","iOS Scheme to build").option("--ios-team-id <id>","Apple Development Team ID").option("--ios-configuration <config>","Xcode configuration (Release/Debug)").option("--ios-export-method <method>","Export method (ad-hoc, app-store, development, enterprise)").option("--ios-api-key-id <id>","App Store Connect API Key ID").option("--ios-api-key-issuer <id>","App Store Connect API Key Issuer ID").option("--ios-api-key-path <path>","Path to App Store Connect API Key (.p8) file").option("--simulator","Build for iOS Simulator (no signing required)").addOption(new Ne("--build-id <id>","Internal build ID").hideHelp()).addOption(new Ne("--project-id <id>","Internal project ID").hideHelp()).addOption(new Ne("--fail-only","Internal: mark an existing build failed").hideHelp()).addOption(new Ne("--error <message>","Internal failure message").hideHelp()).option("--local","Run build on local machine").option("--auto-version","Assign the next Android versionCode or iOS buildNumber from Mach").option("--auto-submit","Submit this build after it completes successfully").option("--submit-track <track>","Google Play track to use with --auto-submit").option("--submit-release-status <status>","Google Play release status to use with --auto-submit").option("--submit-rollout <fraction>","Google Play staged rollout fraction to use with --auto-submit").option("--submit-changes-not-sent-for-review","Commit Google Play changes without automatically sending them for review when using --auto-submit").option("--submit-credential-id <id>","Service credential ID to use with --auto-submit").option("--submit-json-output <path>","Write auto-submit metadata JSON to a file for CI/CD").option("--verbose","Enable verbose logging").option("--json-output <path>","Write build metadata JSON to a file for CI/CD").option("--maestro","Queue a managed Maestro test run after a successful build").option("--maestro-flows <path>","Maestro flow file or directory (default: .maestro)").option("--maestro-device <device>","iOS simulator model or identifier (default: iPhone 17 Pro; managed Android uses Pixel 6)").option("--maestro-retries <n>","Retries for the Maestro run","1").option("--maestro-record","Enable screen recording where supported").option("--maestro-use-build-source","Use Maestro flows from the build source snapshot instead of uploading local flows").option("--maestro-env <name>","Forward an environment variable to the managed Maestro runner; repeat or comma-separate names",Cn,[]).option("-y, --yes","Automatically answer yes to all prompts",!1).option("--quiet","Suppress non-essential output",!1).action(async(e,t)=>{let n=U.opts();t.yes=t.yes||n.yes,t.quiet=t.quiet||n.quiet,t.platform=e||t.platform,t.buildProfile=t.profile||t.buildProfile,t.quiet||X(q.bgCyan.black(m.cliTag("Cloud Build"))),await Qn(t)});U.command("maestro").description("Run Maestro tests locally or with the managed Mach runner").option("--platform <os>","Target platform (android/ios)").option("-p, --profile <name>","Build profile to resolve when using --latest","production").option("--latest","Use the latest successful build for the platform/profile").option("--build-id <id>","Use a specific Mach build ID").option("--build-url <url>","Use a Mach build URL").option("--artifact-url <url>","Use a direct APK or iOS simulator app artifact URL").option("--local","Run Maestro on a connected local emulator/device instead of the managed runner").option("--maestro-flows <path>","Maestro flow file or directory (default: .maestro)").option("--maestro-device <device>","iOS simulator model or identifier (default: iPhone 17 Pro; managed Android uses Pixel 6)").option("--maestro-retries <n>","Retries for the Maestro run","1").option("--maestro-record","Enable screen recording where supported").option("--maestro-use-build-source","Use Maestro flows from the build source snapshot instead of uploading local flows").option("--maestro-env <name>","Forward an environment variable to the managed Maestro runner; repeat or comma-separate names",Cn,[]).option("--wait","Wait for managed Maestro completion and exit non-zero on failure").option("--wait-timeout <minutes>","Maximum minutes to wait for managed Maestro completion","60").option("--wait-interval <seconds>","Polling interval while waiting for managed Maestro completion","15").option("--json-output <path>","Write test run metadata JSON to a file for CI/CD").addOption(new Ne("--local-runner","Internal: execute a managed Maestro run on this machine").hideHelp()).addOption(new Ne("--test-run-id <id>","Internal test run ID").hideHelp()).addOption(new Ne("--project-id <id>","Internal project ID").hideHelp()).addOption(new Ne("--runner-token <token>","Internal runner token").hideHelp()).action(async e=>{X(q.bgCyan.black(m.cliTag("Maestro Testing"))),await ss(e)});var Bt=e=>e.option("--platform <os>","Target platform: ios, android, or all","all").option("--channel <name>","OTA channel (for example: production, staging)").option("--branch <name>","Alias for --channel").option("--runtime-version <version>","Runtime version override").option("--message <text>","Release note/message for this OTA update").option("--framework <name>","Framework override: expo or react-native").option("--engine <name>","OTA engine override (currently expo-updates)").option("--url <url>","Mach OTA update URL override").option("--install-plugin","Install @radhya/mach locally for the Expo config plugin").option("--skip-install","Do not install local Expo plugin dependency").option("--update-id <id>","OTA update id for rollback/promote").option("--json","Print JSON output"),Ht=U.command("ota").description("Setup, publish, verify, and manage Mach OTA updates");Bt(Ht.command("setup").description("Configure OTA for this project")).action(async e=>{let t=U.opts();X(q.bgCyan.black(m.cliTag("OTA Setup"))),await at("setup",{...e,yes:e.yes||t.yes})});Bt(Ht.command("publish").description("Publish an OTA update")).action(async e=>{let t=U.opts();X(q.bgCyan.black(m.cliTag("OTA Publish"))),await at("publish",{...e,yes:e.yes||t.yes})});Bt(Ht.command("verify").description("Verify OTA configuration")).action(async e=>{let t=U.opts();X(q.bgCyan.black(m.cliTag("OTA Verify"))),await at("verify",{...e,yes:e.yes||t.yes})});Bt(Ht.command("list").description("List OTA updates for the linked project")).action(async e=>{let t=U.opts();X(q.bgCyan.black(m.cliTag("OTA Updates"))),await at("list",{...e,yes:e.yes||t.yes})});Bt(Ht.command("rollback").description("Roll back an OTA update")).action(async e=>{let t=U.opts();X(q.bgCyan.black(m.cliTag("OTA Rollback"))),await at("rollback",{...e,yes:e.yes||t.yes})});Bt(Ht.command("promote").description("Promote an OTA update")).action(async e=>{let t=U.opts();X(q.bgCyan.black(m.cliTag("OTA Promote"))),await at("promote",{...e,yes:e.yes||t.yes})});U.command("submit").description("Automated Store Submission (App Store / Google Play)").option("--platform <os>","Target platform (ios/android)").option("-p, --profile <name>","Build/submission profile to submit from (e.g. production, preprod)").option("--track <track>","Google Play Track (internal, alpha, beta, production)").option("--release-status <status>","Google Play release status (completed, draft, halted, inProgress)").option("--rollout <fraction>","Google Play staged rollout fraction for inProgress releases (example: 0.1)").option("--changes-not-sent-for-review","Commit Google Play changes without automatically sending them for review").option("--ssh-host <host>","Remote macOS host for iOS submission").option("--ssh-user <user>","SSH username for remote iOS submission").option("--ssh-key <path>","Path to private SSH key for remote iOS submission").option("--credential-id <id>","Service credential ID to use when multiple submission credentials exist").option("--local","Run submission on this machine (internal runner mode for iOS)").addOption(new Ne("--submit-id <id>","Internal submission ID").hideHelp()).addOption(new Ne("--project-id <id>","Internal project ID").hideHelp()).addOption(new Ne("--package-name <name>","Internal Android package name").hideHelp()).addOption(new Ne("--bundle-id <id>","Internal iOS bundle identifier").hideHelp()).option("--json-output <path>","Write submission metadata JSON to a file for CI/CD").option("--latest","Use the latest successful build for submission").option("--build-id <id>","Use a specific build ID for submission").action(async e=>{let t=U.opts();e.quiet=e.quiet||t.quiet,e.yes=e.yes||t.yes,X(q.bgCyan.black(m.cliTag("Store Submission"))),await Yn(e)});U.command("login").description(`Login to ${m.name} Dashboard`).action(async()=>{X(q.bgCyan.black(m.cliTag("Login"))),await Ca()});U.command("logout").description(`Logout from ${m.name} on this machine`).action(async()=>{X(q.bgCyan.black(m.cliTag("Logout"))),await Ta()});U.command("link").description(`Link local directory to a ${m.name} Project`).action(async()=>{X(q.bgCyan.black(m.cliTag("Link Project"))),await Na()});U.command("me").description("Display currently logged in user details").action(async()=>{await rl()});U.command("init").description(`Create a new ${m.name} Project`).action(async()=>{X(q.bgCyan.black(m.cliTag("Init Project"))),await xa()});U.command("env").description("Manage Environment Variables").argument("<action>","Action to perform: set, list, pull, download, or export").argument("[args...]","Key=Value pairs for set action").option("-e, --environment <name>","Environment to pull/download","development").option("-o, --out <file>","Output file for pull/download",".env.local").option("--overwrite","Overwrite output file if it already exists").action(async(e,t,n)=>{X(q.bgCyan.black(m.cliTag("Env Manager"))),await Ma(e,t,n)});U.command("start").description("Start the development server (Metro)").option("-p, --build-profile <name>","Build profile (e.g. development, staging)","development").option("--tunnel","Use ngrok tunnel").option("--lan","Use LAN IP").option("--localhost","Use localhost").option("-c, --clear","Clear Metro cache").option("--port <number>","Port to listen on").option("--ios","Start on iOS").option("--android","Start on Android").option("--web","Start on Web").action(async e=>{X(q.bgCyan.black(m.cliTag("Dev Server"))),await sl(e)});var Tn=U.command("push").description("Configure and send provider-direct APNs/FCM notifications");Tn.command("setup").description("Install and wire a working default push experience").option("--name <name>","Push app display name").option("--ios-bundle <id>","iOS bundle identifier").option("--android-package <name>","Android package name").option("-e, --environment <name>","development, preview, or production").option("--google-services-file <path>","Android google-services.json path").option("--skip-install","Generate setup without installing SDK dependencies").action(Oo);Tn.command("init").description("Create only the server-side push app (advanced)").option("--name <name>","Push app display name").option("--ios-bundle <id>","iOS bundle identifier").option("--android-package <name>","Android package name").option("-e, --environment <name>","development, preview, or production","production").option("--google-services-file <path>","Expo Android google-services.json path").action(Ro);var md=Tn.command("credentials").description("Configure provider credentials");md.command("apns").description("Configure an Apple APNs .p8 authentication key").requiredOption("--file <path>","APNs .p8 file").requiredOption("--team-id <id>","Apple Developer team ID").requiredOption("--key-id <id>","APNs key ID").option("--bundle-id <id>","iOS bundle identifier").option("--app <id>","MACH Push app ID").option("-e, --environment <name>","development, preview, or production").action(e=>Vi("apns",e));md.command("fcm").description("Configure a Firebase service-account JSON file").requiredOption("--file <path>","Firebase service-account JSON").option("--app <id>","MACH Push app ID").option("-e, --environment <name>","Deprecated; accepted for compatibility because FCM credentials are package-wide").action(e=>Vi("fcm",e));Tn.command("send").description("Queue one transient push notification").requiredOption("--title <text>","Notification title").requiredOption("--body <text>","Notification body").option("--app <id>","MACH Push app ID").option("-e, --environment <name>","development, preview, or production").option("--token <token>","MACH push token; repeatable",Cn,[]).option("--user <id>","Application user ID; repeatable",Cn,[]).option("--all","Send to all active devices").option("--platform <platform>","Limit --all to ios or android").option("--data <json>","String-to-string custom data JSON").option("--sound <name>","Provider sound name").option("--badge <number>","iOS badge count").option("--ttl <seconds>","Provider time-to-live").option("--collapse-key <key>","Provider collapse key").option("--android-channel-id <id>","Android notification channel").action(Po);Tn.command("status").description("Show aggregate push delivery counters").option("--days <number>","Statistics range, 1-90","30").action(Do);U.command("config").description("Show resolved configuration for a profile").option("-p, --profile <name>","Build profile to resolve","development").option("--json","Output as JSON").action(async e=>{await al(e)});var gd=U.command("version").description("Show or seed DB-owned native version counters"),hd=e=>e.requiredOption("--platform <os>","Target platform: ios or android").option("-p, --profile <name>","Build profile used to resolve package/bundle scope","production").option("--scope <value>","Counter scope override, usually package name or bundle identifier").option("--package <name>","Android package override").option("--bundle-id <id>","iOS bundle identifier override").option("--json","Print JSON output");hd(gd.command("show").description("Show the current native version counter")).action(async e=>{X(q.bgCyan.black(m.cliTag("Version Counter"))),await so("show",e)});hd(gd.command("seed").description("Seed the native version counter for an existing app").argument("[value]","Latest already-used value; the next build uses value + 1").option("--value <number>","Latest already-used value; the next build uses value + 1").option("--force","Allow lowering an existing counter")).action(async(e,t)=>{X(q.bgCyan.black(m.cliTag("Version Counter"))),await so("seed",{...t,value:t.value??e})});var Ad=U.command("deeplink").description("Configure and verify app links, universal links, and URI schemes");Ad.command("setup").description("Generate deep link config, hosted association files, and Expo plugin support").option("--domain <domain>","Associated domain, e.g. app.example.com").option("--base-url <url>","Base URL, e.g. https://app.example.com").option("-p, --profile <name>","Profile used for build/submit overrides").option("--platform <platform>","ios, android, or all").option("--framework <framework>","expo or react-native").option("--scheme <scheme>","URI scheme, e.g. myapp").option("--ios-bundle-id <id>","iOS bundle identifier").option("--android-package <name>","Android package name").option("--apple-team-id <id>","Apple Developer Team ID").option("--app-store-id <id>","App Store app ID for Smart App Banner").option("--android-fingerprint <sha256>","Android SHA256 signing certificate fingerprint; repeatable",Cn,[]).option("--output <dir>","Directory for hosted files, e.g. public or deep-links").option("--install-plugin","Install @radhya/mach locally so Expo can use the packaged config plugin").option("--no-install-plugin","Do not install @radhya/mach for Expo projects; use the local plugin fallback if the package is missing").option("-y, --yes","Automatically answer yes to prompts",!1).action(async e=>{let t=U.opts();e.yes=e.yes||t.yes,X(q.bgCyan.black(m.cliTag("Deep Links"))),await Pl(e)});Ad.command("verify").description("Verify local and optionally live deep link configuration").option("-p, --profile <name>","Profile used for build/submit overrides").option("--live","Check hosted files over HTTPS").option("--android-device","Print Android device verification commands").action(async e=>{X(q.bgCyan.black(m.cliTag("Deep Link Verify"))),await Dl(e)});U.command("credentials").description("Unified, interactive credential management (iOS/Android)").option("-p, --profile <name>","Build profile (production, staging, development)").option("--credential-type <type>","iOS signing type override: development, adhoc, or store").option("--force","Force recreate certificates (nuke existing on Apple Portal)",!1).action(async e=>{let{credentialsMainCommand:t}=await import("./credentials-DORIKJS3.js");await t(e)});U.command("credentials:setup").description("Automated credential provisioning (iOS/Android) [Legacy]").requiredOption("--platform <os>","Platform: ios or android").option("--profile <name>","Build profile (production, staging, development)").option("--credential-type <type>","iOS signing type override: development, adhoc, or store").option("--bundle-id <id>","Bundle ID / Package Name (optional, auto-detected)").option("--team-id <id>","Apple Team ID (iOS only)").option("--key-alias <alias>","Android keystore alias (optional, auto-generated)").option("--aws-profile <name>","AWS Credentials Profile (for S3 storage)").option("--force","Force recreate certificates (nuke existing on Apple Portal)",!1).action(async e=>{X(q.bgCyan.black(m.cliTag("Credentials Setup"))),await Vt(e),fd(q.green("Done!"))});U.command("credentials:service").description("Upload Service Credentials (ASC API Key / Google Service JSON) [Legacy]").requiredOption("--platform <os>","Platform: ios or android").option("--file <path>","Path to credential file (.p8 or .json)").option("--issuer-id <id>","ASC API Key Issuer ID (iOS only)").option("--key-id <id>","ASC API Key ID (iOS only)").option("--bundle-id <id>","Bundle identifier / Android package name to attach this service credential to").option("--package-name <name>","Android package name to attach this service credential to").option("-p, --profile <name>","Build profile to resolve package/bundle identifier from config").action(async e=>{X(q.bgCyan.black(m.cliTag("Service Credentials"))),await $o(e),fd(q.green("Done!"))});var uo=U.command("device").description("Manage registered iOS test devices");uo.command("register").description("Register a connected iOS device or enter UDID manually").option("--udid <udid>","Device UDID (skip auto-detection)").option("--name <name>","Device name").option("--team-id <id>","Apple Developer Team ID for this device").action(async e=>{await vi("register",e)});uo.command("list").description("List all registered devices").option("--team-id <id>","Filter by Apple Developer Team ID").action(async e=>{await vi("list",e)});uo.command("remove").description("Remove a registered device").option("--udid <udid>","Device UDID to remove").option("--team-id <id>","Apple Developer Team ID for this device").action(async e=>{await vi("remove",e)});U.command("audit").description("Run automated security audit on the project or APK").option("--apk <path>","Path to APK file (runs APK diagnostics like 16KB alignment)").option("--json","Output results as JSON (for CI/CD)").option("--fix","Auto-apply fixes where possible").option("--category <name>","Run only a specific check category (e.g. 16kb, permissions, secrets)").option("--severity <level>","Minimum severity to display (critical, high, medium, low, info)").option("--prebuild","Run expo prebuild for deeper manifest/plist analysis").action(async e=>{X(q.bgCyan.black(m.cliTag(e.apk?"APK Audit":"Security Audit"))),await ud(e)});var mg=new Set(["login","logout","agent"]);U.hook("preAction",(e,t)=>{let n=t.name(),i=t.opts?.()||{};n==="maestro"&&(i.local||i.localRunner)||t.parent?.name()!=="deeplink"&&(mg.has(n)||Et())});U.on("command:*",()=>{console.error(`Invalid command: %s
-See --help for a list of available commands.`,U.args.join(" ")),process.exit(1)});process.argv.slice(2).length||U.help();U.parse(process.argv);
+`),"Registered Devices")}catch(i){n.stop(K.red("Failed to fetch devices")),De.error(i.response?.data?.message||i.message)}Rn(K.blue("---"))}async function gm(e){let t=e.udid,n=Dl(e).teamId;if(!t){let o=vn();o.start("Fetching registered devices...");try{let a=(await $.get("/devices",n?{params:{teamId:n}}:void 0)).data.devices||[];if(o.stop(`${a.length} device(s) found`),a.length===0){De.info(K.dim("No devices to remove.")),Rn(K.blue("---"));return}let l=await Ol({message:"Select device to remove:",options:a.map(c=>({value:c.deviceKey||c.udid,label:c.name,hint:`${c.udid.substring(0,12)}...${c.teamId?` \xB7 ${c.teamId}`:""}`}))});if($n(l)){wn("Cancelled");return}let d=a.find(c=>(c.deviceKey||c.udid)===l);t=d?.udid||l,n=d?.teamId||n}catch(s){o.stop(K.red("Failed to fetch devices")),De.error(s.response?.data?.message||s.message);return}}let i=await dm({message:`Remove device ${K.dim(t.substring(0,12)+"...")}?`});if($n(i)||!i){wn("Cancelled");return}let r=vn();r.start("Removing device...");try{await $.delete(`/devices/${encodeURIComponent(t)}`,n?{params:{teamId:n}}:void 0),r.stop(K.green("Device removed"))}catch(o){r.stop(K.red("Failed to remove device")),De.error(o.response?.data?.message||o.message)}Rn(K.blue("---"))}async function wi(e,t){switch(e){case"register":await fm(t);break;case"list":await mm(t);break;case"remove":await gm(t);break;default:De.error(`Unknown action: ${e}`)}}import{log as Te,spinner as od}from"@clack/prompts";import He from"chalk";import xi from"path";import Dn from"fs";import qm from"os";import Jm from"axios";var Ce=(o=>(o.CRITICAL="critical",o.HIGH="high",o.MEDIUM="medium",o.LOW="low",o.INFO="info",o))(Ce||{}),Be=(l=>(l.PERMISSIONS="permissions",l.SECRETS="secrets",l.DEPENDENCIES="dependencies",l.STORAGE="storage",l.NETWORK="network",l.DEBUG="debug",l.MANIFEST="manifest",l.ATS="ats",l))(Be||{});import{spinner as ql,log as Pn}from"@clack/prompts";import we from"chalk";import{execSync as Fm}from"child_process";import Jl from"fs";import Xl from"path";import pt from"fs";import On from"path";import{execSync as hm}from"child_process";var Cl={"android.permission.READ_PHONE_STATE":{severity:"high",description:"Can read phone number, IMEI, carrier info"},"android.permission.CALL_PHONE":{severity:"high",description:"Can make calls without user interaction"},"android.permission.SEND_SMS":{severity:"high",description:"Can send SMS without user interaction"},"android.permission.READ_SMS":{severity:"high",description:"Can read user SMS messages"},"android.permission.READ_CONTACTS":{severity:"medium",description:"Can read user contacts"},"android.permission.WRITE_CONTACTS":{severity:"medium",description:"Can modify user contacts"},"android.permission.READ_CALL_LOG":{severity:"high",description:"Can read call history"},"android.permission.CAMERA":{severity:"medium",description:"Camera access"},"android.permission.RECORD_AUDIO":{severity:"medium",description:"Microphone access"},"android.permission.ACCESS_FINE_LOCATION":{severity:"medium",description:"Precise GPS location"},"android.permission.ACCESS_COARSE_LOCATION":{severity:"medium",description:"Approximate location"},"android.permission.ACCESS_BACKGROUND_LOCATION":{severity:"high",description:"Background location tracking"},"android.permission.READ_EXTERNAL_STORAGE":{severity:"medium",description:"Read files on device"},"android.permission.WRITE_EXTERNAL_STORAGE":{severity:"medium",description:"Write files on device"},"android.permission.READ_MEDIA_IMAGES":{severity:"low",description:"Read photos"},"android.permission.READ_MEDIA_VIDEO":{severity:"low",description:"Read videos"},"android.permission.SYSTEM_ALERT_WINDOW":{severity:"high",description:"Draw overlays on other apps"},"android.permission.REQUEST_INSTALL_PACKAGES":{severity:"high",description:"Can install APKs"}},Am={NSCameraUsageDescription:{severity:"medium",description:"Camera access declared"},NSMicrophoneUsageDescription:{severity:"medium",description:"Microphone access declared"},NSLocationWhenInUseUsageDescription:{severity:"medium",description:"Location (in-use) declared"},NSLocationAlwaysUsageDescription:{severity:"high",description:"Background location declared"},NSContactsUsageDescription:{severity:"medium",description:"Contacts access declared"},NSCalendarsUsageDescription:{severity:"low",description:"Calendar access declared"},NSPhotoLibraryUsageDescription:{severity:"low",description:"Photo library access declared"}};function ym(e){try{let n=hm("npx expo config --type introspect --json 2>/dev/null",{cwd:e,encoding:"utf-8",timeout:3e4});return JSON.parse(n)}catch{}let t=On.join(e,"app.json");if(pt.existsSync(t))try{let n=JSON.parse(pt.readFileSync(t,"utf-8"));return n.expo||n}catch{}return null}function Sm(e){let t=[],n=On.join(e,"node_modules");if(!pt.existsSync(n))return t;let i=/<uses-permission\s+android:name="([^"]+)"/g;function r(o,s){let a=On.join(o,"android","src","main","AndroidManifest.xml");if(!pt.existsSync(a))return;let l=pt.readFileSync(a,"utf-8"),d;for(;(d=i.exec(l))!==null;)t.push({pkg:s,permission:d[1]});i.lastIndex=0}for(let o of pt.readdirSync(n)){if(o.startsWith("."))continue;let s=On.join(n,o);if(o.startsWith("@")){if(!pt.statSync(s).isDirectory())continue;for(let a of pt.readdirSync(s))r(On.join(s,a),`${o}/${a}`)}else r(s,o)}return t}async function Tl(e,t){let n=[],i=1,r=ym(e),o=r?.android?.permissions||[],s=r?.android?.blockedPermissions||[];for(let d of o){let c=Cl[d];c&&n.push({id:`PERM-${String(i++).padStart(3,"0")}`,title:`${d.split(".").pop()} declared`,description:c.description,severity:c.severity,category:"permissions",file:"app.config.ts",recommendation:"Remove from permissions if not needed, or add justification."})}let a=Sm(e);for(let{pkg:d,permission:c}of a){let u=Cl[c];u&&(s.includes(c)||o.includes(c)||n.push({id:`PERM-${String(i++).padStart(3,"0")}`,title:`${c.split(".").pop()} injected by ${d}`,description:`${u.description}. Auto-injected via ${d} AndroidManifest.xml`,severity:u.severity,category:"permissions",file:`node_modules/${d}/android/src/main/AndroidManifest.xml`,recommendation:`Add "${c}" to blockedPermissions if not needed.`,autoFixable:!0}))}let l=r?.ios?.infoPlist||{};for(let[d,c]of Object.entries(Am))d in l&&n.push({id:`PERM-${String(i++).padStart(3,"0")}`,title:`iOS: ${d} declared`,description:c.description,severity:c.severity,category:"permissions",file:"app.config.ts",recommendation:`Remove ${d} from infoPlist if the app does not use this capability.`});return{category:"permissions",label:"Permission Audit",findings:n,durationMs:0}}import oo from"fs";import vi from"path";var bm=[{id:"SEC-001",pattern:/(['"`])(?:sk|pk)_(?:live|test)_[a-zA-Z0-9]{20,}\1/g,severity:"critical",label:"Stripe API Key"},{id:"SEC-002",pattern:/(['"`])AIza[0-9A-Za-z\-_]{35}\1/g,severity:"high",label:"Google API Key"},{id:"SEC-003",pattern:/(['"`])AKIA[0-9A-Z]{16}\1/g,severity:"critical",label:"AWS Access Key ID"},{id:"SEC-004",pattern:/-----BEGIN (?:RSA |EC )?PRIVATE KEY-----/g,severity:"critical",label:"Private key in source"},{id:"SEC-005",pattern:/(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{36,}/g,severity:"high",label:"GitHub Token"},{id:"SEC-006",pattern:/xox[bpors]-[a-zA-Z0-9-]{10,}/g,severity:"high",label:"Slack Token"},{id:"SEC-007",pattern:/(?:password|secret|apikey|api_key)\s*[:=]\s*['"`][^'"`\n]{8,}['"`]/gi,severity:"high",label:"Hardcoded credential"}],Im=new Set([".ts",".tsx",".js",".jsx"]),Em=new Set(["node_modules",".expo",".git","android","ios","dist","build","__tests__","__mocks__"]);function Nl(e){let t=[],n=oo.readdirSync(e,{withFileTypes:!0});for(let i of n){if(Em.has(i.name))continue;let r=vi.join(e,i.name);i.isDirectory()?t.push(...Nl(r)):Im.has(vi.extname(i.name))&&t.push(r)}return t}function _m(e){let t=e.trim();return t.startsWith("//")||t.startsWith("*")||t.startsWith("/*")}function $m(e){return/process\.env\./i.test(e)||/import\.meta\.env/i.test(e)}async function kl(e,t){let n=[],i=vi.join(e,"src"),r=oo.existsSync(i)?i:e,o=Nl(r);for(let s of o){let l=oo.readFileSync(s,"utf-8").split(`
+`),d=vi.relative(e,s);for(let c=0;c<l.length;c++){let u=l[c];if(!_m(u)&&!$m(u))for(let{id:f,pattern:p,severity:h,label:g}of bm)p.lastIndex=0,p.test(u)&&n.push({id:f,title:g,description:`Potential ${g.toLowerCase()} found in source code`,severity:h,category:"secrets",file:d,line:c+1,recommendation:`Move to environment variables or a secrets manager. Use \`${m.nameLower} env set\` for managed secrets.`})}}return{category:"secrets",label:"Secrets Detection",findings:n,durationMs:0}}import{execSync as wm}from"child_process";var vm={critical:"critical",high:"high",moderate:"medium",low:"low",info:"info"};async function xl(e,t){let n=[],i=1,r;try{r=wm("npm audit --json 2>/dev/null",{cwd:e,encoding:"utf-8",timeout:6e4})}catch(a){if(r=a.stdout||"",!r)return{category:"dependencies",label:"Dependency CVEs",findings:[],durationMs:0,error:"Failed to run npm audit. Ensure npm is available and dependencies are installed."}}let o;try{o=JSON.parse(r)}catch{return{category:"dependencies",label:"Dependency CVEs",findings:[],durationMs:0,error:"Failed to parse npm audit output."}}let s=o.vulnerabilities||{};for(let[a,l]of Object.entries(s)){let d=vm[l.severity]||"info",c=Array.isArray(l.via)?l.via.map(u=>typeof u=="string"?u:u.title||u.name).join(", "):String(l.via);n.push({id:`DEP-${String(i++).padStart(3,"0")}`,title:`${a} \u2014 ${l.severity}`,description:`Via: ${c}. Range: ${l.range||"unknown"}`,severity:d,category:"dependencies",recommendation:l.fixAvailable?`Run \`npm audit fix\` or update ${a} to a patched version.`:"No fix available yet. Monitor for updates or evaluate alternatives.",autoFixable:!!l.fixAvailable})}return{category:"dependencies",label:"Dependency CVEs",findings:n,durationMs:0}}import Ri from"fs";import Oi from"path";var Rm=/(?:token|password|credential|secret|apiKey|api_key|session|auth|jwt|refresh_token|access_token|private_key|pin|otp)/i,Ll=/AsyncStorage\s*\.\s*(?:setItem|mergeItem)\s*\(\s*['"`]([^'"`]+)['"`]/g,Om=/from\s+['"]@react-native-async-storage\/async-storage['"]|from\s+['"]react-native['"].*AsyncStorage/,Pm=new Set([".ts",".tsx",".js",".jsx"]),Dm=new Set(["node_modules",".expo",".git","android","ios","dist","build"]);function Ml(e){let t=[];if(!Ri.existsSync(e))return t;let n=Ri.readdirSync(e,{withFileTypes:!0});for(let i of n){if(Dm.has(i.name))continue;let r=Oi.join(e,i.name);i.isDirectory()?t.push(...Ml(r)):Pm.has(Oi.extname(i.name))&&t.push(r)}return t}async function Ul(e,t){let n=[],i=1,r=Oi.join(e,"src"),o=Ri.existsSync(r)?r:e,s=Ml(o);for(let a of s){let l=Ri.readFileSync(a,"utf-8");if(!Om.test(l))continue;let d=l.split(`
+`),c=Oi.relative(e,a);for(let u=0;u<d.length;u++){let f=d[u];Ll.lastIndex=0;let p;for(;(p=Ll.exec(f))!==null;){let h=p[1];Rm.test(h)&&n.push({id:`STOR-${String(i++).padStart(3,"0")}`,title:`AsyncStorage used for "${h}"`,description:`Sensitive data key "${h}" stored in AsyncStorage (unencrypted).`,severity:"high",category:"storage",file:c,line:u+1,recommendation:"Use expo-secure-store (SecureStore) for sensitive data instead of AsyncStorage."})}}}return{category:"storage",label:"Insecure Storage",findings:n,durationMs:0}}import Pi from"fs";import Di from"path";var Fl=/['"`](http:\/\/(?!localhost|127\.0\.0\.1|10\.|192\.168\.|0\.0\.0\.0|172\.(?:1[6-9]|2\d|3[01])\.)[^'"`\s]+)['"`]/g,Cm=/\/api\/|\/v[0-9]+\/|\/graphql|\/rest\//i,Tm=new Set([".ts",".tsx",".js",".jsx"]),Nm=new Set(["node_modules",".expo",".git","android","ios","dist","build","__tests__","__mocks__"]);function Bl(e){let t=[];if(!Pi.existsSync(e))return t;let n=Pi.readdirSync(e,{withFileTypes:!0});for(let i of n){if(Nm.has(i.name))continue;let r=Di.join(e,i.name);i.isDirectory()?t.push(...Bl(r)):Tm.has(Di.extname(i.name))&&t.push(r)}return t}async function Hl(e,t){let n=[],i=1,r=Di.join(e,"src"),o=Pi.existsSync(r)?r:e,s=Bl(o);for(let a of s){let d=Pi.readFileSync(a,"utf-8").split(`
+`),c=Di.relative(e,a);for(let u=0;u<d.length;u++){let f=d[u],p=f.trim();if(p.startsWith("//")||p.startsWith("*"))continue;Fl.lastIndex=0;let h;for(;(h=Fl.exec(f))!==null;){let g=h[1],y=Cm.test(g);n.push({id:`NET-${String(i++).padStart(3,"0")}`,title:`Insecure HTTP URL${y?" (API endpoint)":""}`,description:`Plain HTTP URL found: ${g}`,severity:y?"high":"medium",category:"network",file:c,line:u+1,recommendation:"Use HTTPS instead of HTTP for all network requests."})}}}return{category:"network",label:"HTTP URLs",findings:n,durationMs:0}}import Ci from"fs";import Ti from"path";var jl=/(?:debug|debugMode|devMode|enableDebug)\s*[:=]\s*true/gi,Gl=/console\.(?:log|warn|info|debug)\s*\([^)]*(?:token|password|secret|credential|key|auth)/gi,km=new Set([".ts",".tsx",".js",".jsx"]),xm=new Set(["node_modules",".expo",".git","android","ios","dist","build","__tests__","__mocks__"]);function Vl(e){let t=[];if(!Ci.existsSync(e))return t;let n=Ci.readdirSync(e,{withFileTypes:!0});for(let i of n){if(xm.has(i.name))continue;let r=Ti.join(e,i.name);i.isDirectory()?t.push(...Vl(r)):km.has(Ti.extname(i.name))&&t.push(r)}return t}async function zl(e,t){let n=[],i=1,r=Ti.join(e,"src"),o=Ci.existsSync(r)?r:e,s=Vl(o);for(let a of s){let d=Ci.readFileSync(a,"utf-8").split(`
+`),c=Ti.relative(e,a);for(let u=0;u<d.length;u++){let f=d[u],p=f.trim();if(!(p.startsWith("//")||p.startsWith("*"))&&(jl.lastIndex=0,jl.test(f)&&n.push({id:`DBG-${String(i++).padStart(3,"0")}`,title:"Hardcoded debug flag",description:"Debug/dev mode enabled in source code",severity:"medium",category:"debug",file:c,line:u+1,recommendation:"Use __DEV__ or environment variables instead of hardcoded debug flags."}),Gl.lastIndex=0,Gl.test(f))){let h=d.slice(Math.max(0,u-3),u).join(`
+`);/__DEV__/.test(h)||n.push({id:`DBG-${String(i++).padStart(3,"0")}`,title:"Sensitive data in console log",description:"Console log may expose sensitive data (token, password, etc.) in production",severity:"medium",category:"debug",file:c,line:u+1,recommendation:"Wrap in __DEV__ check or remove sensitive data from console output."})}}}return{category:"debug",label:"Debug/Dev Flags",findings:n,durationMs:0}}import Kl from"fs";import so from"path";var Lm=new Set(["androidx.work.impl.background.systemjob.SystemJobService","androidx.work.impl.diagnostics.DiagnosticsReceiver","com.google.firebase.iid.FirebaseInstanceIdReceiver","com.google.android.gms.auth.api.signin.RevocationBoundService","androidx.profileinstaller.ProfileInstallReceiver","com.google.firebase.messaging.FirebaseMessagingService","com.google.android.gms.measurement.AppMeasurementService","com.google.android.gms.measurement.AppMeasurementJobService"]);function Mm(e){let t=[so.join(e,"android","app","src","main","AndroidManifest.xml"),so.join(e,"android","AndroidManifest.xml")];for(let n of t)if(Kl.existsSync(n))return n;return null}async function Wl(e,t){let n=[],i=1,r=Mm(e);if(!r)return{category:"manifest",label:"Android Manifest",findings:[],durationMs:0,error:"No AndroidManifest.xml found. Run with --prebuild or run `expo prebuild` first."};let o=Kl.readFileSync(r,"utf-8"),s=so.relative(e,r),a=/<(activity|service|receiver|provider)\s+([^>]*?)(?:\/>|>)/gs,l;for(;(l=a.exec(o))!==null;){let d=l[1],c=l[2],f=c.match(/android:name="([^"]+)"/)?.[1]||"unknown";if(Lm.has(f))continue;let p=/android:exported="true"/.test(c),h=/android:permission="/.test(c);p&&!h&&n.push({id:`MAN-${String(i++).padStart(3,"0")}`,title:`Exported ${d}: ${f.split(".").pop()}`,description:`${f} is exported=true without android:permission protection`,severity:"medium",category:"manifest",file:s,recommendation:'Set android:exported="false" or add an android:permission attribute.'})}return/android:allowBackup="true"/.test(o)&&n.push({id:`MAN-${String(i++).padStart(3,"0")}`,title:"allowBackup is enabled",description:'android:allowBackup="true" allows data extraction via ADB backup',severity:"medium",category:"manifest",file:s,recommendation:'Set android:allowBackup="false" via expo-build-properties plugin.',autoFixable:!0}),/android:debuggable="true"/.test(o)&&n.push({id:`MAN-${String(i++).padStart(3,"0")}`,title:"App is debuggable",description:'android:debuggable="true" allows attaching a debugger in production',severity:"critical",category:"manifest",file:s,recommendation:"Ensure debuggable is false for production builds. This is usually set automatically for release builds."}),{category:"manifest",label:"Android Manifest",findings:n,durationMs:0}}import Ni from"fs";import ao from"path";function Um(e){let t=ao.join(e,"ios");if(!Ni.existsSync(t))return null;let n=Ni.readdirSync(t,{withFileTypes:!0});for(let i of n){if(!i.isDirectory()||i.name==="Pods"||i.name.startsWith("."))continue;let r=ao.join(t,i.name,"Info.plist");if(Ni.existsSync(r))return r}return null}async function Yl(e,t){let n=[],i=1,r=Um(e);if(!r)return{category:"ats",label:"iOS ATS Config",findings:[],durationMs:0,error:"No Info.plist found. Run with --prebuild or run `expo prebuild` first."};let o=Ni.readFileSync(r,"utf-8"),s=ao.relative(e,r),a=o.match(/<key>NSAppTransportSecurity<\/key>\s*<dict>([\s\S]*?)<\/dict>/);if(a){let l=a[1];/<key>NSAllowsArbitraryLoads<\/key>\s*<true\s*\/>/.test(l)&&n.push({id:`ATS-${String(i++).padStart(3,"0")}`,title:"ATS disabled \u2014 NSAllowsArbitraryLoads",description:"App Transport Security is completely disabled. All HTTP connections are allowed.",severity:"critical",category:"ats",file:s,recommendation:"Remove NSAllowsArbitraryLoads or set to false. Use domain-specific exceptions only if absolutely necessary."});let d=l.match(/<key>NSExceptionDomains<\/key>\s*<dict>([\s\S]*?)<\/dict>/);if(d){let c=d[1].match(/<key>([^<]+)<\/key>/g);if(c)for(let u of c){let f=u.replace(/<\/?key>/g,"");f!=="NSExceptionDomains"&&n.push({id:`ATS-${String(i++).padStart(3,"0")}`,title:`ATS exception: ${f}`,description:`ATS exception configured for ${f}`,severity:"low",category:"ats",file:s,recommendation:`Verify that the ATS exception for ${f} is necessary. Use HTTPS where possible.`})}}}return{category:"ats",label:"iOS ATS Config",findings:n,durationMs:0}}var Bm=[{category:"permissions",label:"Permission Audit",fn:Tl,requiresPrebuild:!1},{category:"secrets",label:"Secrets Detection",fn:kl,requiresPrebuild:!1},{category:"dependencies",label:"Dependency CVEs",fn:xl,requiresPrebuild:!1},{category:"storage",label:"Insecure Storage",fn:Ul,requiresPrebuild:!1},{category:"network",label:"HTTP URLs",fn:Hl,requiresPrebuild:!1},{category:"debug",label:"Debug/Dev Flags",fn:zl,requiresPrebuild:!1},{category:"manifest",label:"Android Manifest",fn:Wl,requiresPrebuild:!0},{category:"ats",label:"iOS ATS Config",fn:Yl,requiresPrebuild:!0}];async function Zl(e,t){let n=Bm;t.category&&(n=n.filter(s=>s.category===t.category),n.length===0&&(Pn.error(we.red(`Unknown category: ${t.category}`)),Pn.info(we.dim(`Available: ${Object.values(Be).join(", ")}`)),process.exit(1)));let i=n.filter(s=>!s.requiresPrebuild),r=n.filter(s=>s.requiresPrebuild),o=[];for(let s of i){let a=ql();a.start(we.dim(`Running ${s.label}...`));try{let l=Date.now(),d=await s.fn(e,t);d.durationMs=Date.now()-l,o.push(d);let c=d.findings.length;a.stop(c>0?we.yellow(`${s.label} \u2014 ${c} finding(s)`):we.green(`${s.label} \u2014 clean`))}catch(l){a.stop(we.red(`${s.label} \u2014 error`)),o.push({category:s.category,label:s.label,findings:[],durationMs:0,error:l.message})}}if(r.length>0){let s=Xl.join(e,"android"),a=Xl.join(e,"ios"),l=Jl.existsSync(s)||Jl.existsSync(a);if(!l&&t.prebuild){t.json||Pn.info(we.dim(`
+Running expo prebuild for deeper analysis...`));try{Fm("npx expo prebuild --no-install",{cwd:e,stdio:"pipe"})}catch{return Pn.warn(we.yellow("Prebuild failed \u2014 skipping manifest/plist checks.")),o}}else if(!l)return t.json||Pn.info(we.dim(`
+Skipping manifest/plist checks \u2014 no android/ios dirs. Use --prebuild to generate them.`)),o;for(let d of r){let c=ql();c.start(we.dim(`Running ${d.label}...`));try{let u=Date.now(),f=await d.fn(e,t);f.durationMs=Date.now()-u,o.push(f);let p=f.findings.length;c.stop(p>0?we.yellow(`${d.label} \u2014 ${p} finding(s)`):we.green(`${d.label} \u2014 clean`))}catch(u){c.stop(we.red(`${d.label} \u2014 error`)),o.push({category:d.category,label:d.label,findings:[],durationMs:0,error:u.message})}}}return o}import ue from"chalk";import{log as se}from"@clack/prompts";var jt={critical:ue.bgRed.white.bold,high:ue.red.bold,medium:ue.yellow.bold,low:ue.blue,info:ue.dim},ki={critical:0,high:1,medium:2,low:3,info:4};function Hm(e,t){if(!t)return!0;let n=ki[t];return n===void 0?!0:ki[e]<=n}function Ql(e,t){let n=0,i={critical:0,high:0,medium:0,low:0,info:0};for(let s of e){let a=s.findings.filter(d=>Hm(d.severity,t));if(a.length===0&&!s.error)continue;if(se.info(""),se.info(ue.bold(`  ${s.label}`)+ue.dim(`  ${a.length} finding(s)`)),se.info(ue.dim("  "+"\u2500".repeat(60))),s.error){se.error(ue.red(`  Error: ${s.error}`));continue}let l=[...a].sort((d,c)=>ki[d.severity]-ki[c.severity]);for(let d of l){let c=jt[d.severity](` ${d.severity.toUpperCase()} `);se.info(`  ${c}  ${ue.bold(d.id)}  ${d.title}`),se.info(ue.dim(`          ${d.description}`)),d.file&&se.info(ue.dim(`          File: ${d.file}${d.line?`:${d.line}`:""}`)),se.info(ue.cyan(`          Fix: ${d.recommendation}`)),se.info(""),i[d.severity]++,n++}}se.info(""),se.info(ue.bold("  Summary")),se.info(ue.dim("  "+"\u2500".repeat(60))),se.info(`  Total: ${ue.bold(String(n))} finding(s)`),se.info(`  ${jt.critical(` ${i.critical} Critical `)}  ${jt.high(` ${i.high} High `)}  ${jt.medium(` ${i.medium} Medium `)}  ${jt.low(` ${i.low} Low `)}  ${jt.info(` ${i.info} Info `)}`);let r=i.critical>0,o=i.high>0;r||o?(se.info(""),se.error(ue.red.bold(`  FAIL \u2014 ${i.critical} critical, ${i.high} high issue(s) found`))):n>0?(se.info(""),se.warn(ue.yellow("  PASS (with warnings) \u2014 no critical or high issues"))):(se.info(""),se.success(ue.green.bold("  PASS \u2014 no issues found")))}function ed(e,t){let n=e.flatMap(r=>r.findings),i={};for(let r of Object.values(Ce))i[r]=n.filter(o=>o.severity===r).length;return{version:"1.0.0",timestamp:new Date().toISOString(),project:t.name||"unknown",projectVersion:t.version||"0.0.0",summary:{total:n.length,...i},passed:i.critical===0&&i.high===0,checks:e.map(r=>({category:r.category,label:r.label,findingCount:r.findings.length,durationMs:r.durationMs,error:r.error||null})),findings:n}}import{log as ae,spinner as jm}from"@clack/prompts";import ie from"chalk";import Ze from"fs";import Gm from"os";import Gt from"path";import{execSync as Vm}from"child_process";var td=16384,zm=1,Km=Buffer.from([127,69,76,70]);async function nd(e){ae.info(ie.bold.underline("16KB Page Alignment Check")),console.log("");let t=Gt.resolve(e);if(!Ze.existsSync(t))return ae.error(ie.red(`APK file not found: ${t}`)),!1;if(!t.endsWith(".apk"))return ae.error(ie.red("The provided file is not an APK file.")),!1;let n=jm();n.start("Extracting and analyzing native libraries...");let i=Ze.mkdtempSync(Gt.join(Gm.tmpdir(),"mach-16kb-"));try{try{Vm(`unzip -o -q "${t}" "lib/arm64-v8a/*.so" "lib/x86_64/*.so" -d "${i}" 2>/dev/null`,{encoding:"utf-8",maxBuffer:50*1024*1024})}catch{}let r=id(Gt.join(i,"lib"));if(r.length===0)return n.stop("Analysis complete."),ae.info(ie.yellow("No arm64-v8a or x86_64 native libraries found in the APK.")),ae.info(ie.dim("16KB alignment check only applies to arm64-v8a and x86_64 architectures.")),!0;let o=[];for(let l of r){let d=Gt.relative(i,l),c=Ym(d),u=Gt.basename(l),f=Wm(l);f!==null&&o.push({name:u,filePath:d,arch:c,align:f,compatible:f>=td})}if(n.stop("Analysis complete."),o.length===0)return ae.info(ie.yellow("No valid ELF shared libraries found.")),!0;let s=o.filter(l=>!l.compatible),a=o.filter(l=>l.compatible);if(ae.info(ie.dim(`Checked ${o.length} native librar${o.length===1?"y":"ies"}
+`)),s.length>0){ae.info(ie.red.bold(`Incompatible libraries:
+`));for(let l of s)ae.error(ie.red(`${ie.bold(l.name)} ${ie.dim(`(${l.arch})`)}`)),ae.info(ie.dim(`  PT_LOAD alignment: 2**${Math.log2(l.align)} (${l.align} bytes, needs 2**14 = ${td})`))}return a.length>0&&(console.log(""),ae.success(ie.green(`${a.length} librar${a.length===1?"y":"ies"} correctly aligned (2**14 or higher).`))),console.log(""),s.length===0?(ae.success(ie.green.bold("ELF Verification Successful. APK is 16KB compatible.")),!0):(ae.error(ie.red.bold(`Found ${s.length} unaligned lib${s.length===1?"":"s"} (arm64-v8a/x86_64 libs need to be aligned).`)),console.log(""),ae.info(ie.yellow("To fix this:")),ae.info(ie.dim("  1. Rebuild with NDK r28+ which defaults to 16KB page alignment")),ae.info(ie.dim("  2. Or set -DANDROID_SUPPORT_FLEXIBLE_PAGE_SIZES=ON in CMake")),ae.info(ie.dim("  3. Update third-party libraries that ship prebuilt .so files")),ae.info(ie.dim("  4. After rebuilding: zipalign -p -f -v 16 input.apk output.apk")),console.log(""),ae.info(ie.dim("Reference: https://developer.android.com/guide/practices/page-sizes")),!1)}catch(r){return n.stop("Analysis failed."),ae.error(ie.red(`Failed to analyze APK: ${r.message}`)),!1}finally{try{Ze.rmSync(i,{recursive:!0,force:!0})}catch{}}}function Wm(e){let t=Ze.openSync(e,"r");try{let n=Buffer.alloc(64);if(Ze.readSync(t,n,0,64,0),!n.subarray(0,4).equals(Km))return null;let i=n[4]===2,r=n[5]===1,o=(f,p)=>r?f.readUInt16LE(p):f.readUInt16BE(p),s=(f,p)=>r?f.readUInt32LE(p):f.readUInt32BE(p),a=(f,p)=>Number(r?f.readBigUInt64LE(p):f.readBigUInt64BE(p)),l,d,c;i?(l=a(n,32),d=o(n,54),c=o(n,56)):(l=s(n,28),d=o(n,42),c=o(n,44));let u=null;for(let f=0;f<c;f++){let p=Buffer.alloc(d);if(Ze.readSync(t,p,0,d,l+f*d),s(p,0)!==zm)continue;let g;i?g=a(p,48):g=s(p,28),g>0&&(u===null||g<u)&&(u=g)}return u??0}catch{return null}finally{Ze.closeSync(t)}}function id(e){let t=[];if(!Ze.existsSync(e))return t;let n=Ze.readdirSync(e,{withFileTypes:!0});for(let i of n){let r=Gt.join(e,i.name);i.isDirectory()?t.push(...id(r)):i.name.endsWith(".so")&&t.push(r)}return t}function Ym(e){return e.includes("arm64-v8a")?"arm64-v8a":e.includes("x86_64")?"x86_64":"unknown"}var sd=async e=>{if(ye()||(Te.error(He.red(`You are not logged in. Run \`${m.nameLower} login\` first.`)),process.exit(1)),e.apk){await Xm(e);return}let n=process.cwd(),i=xi.join(n,"package.json");Dn.existsSync(i)||(Te.error(He.red("No package.json found. Run this command from a project root.")),process.exit(1));let r=JSON.parse(Dn.readFileSync(i,"utf-8")),o=!!(r.dependencies?.expo||r.devDependencies?.expo);e.json||(Te.info(He.dim(`Project: ${r.name||"unknown"} v${r.version||"0.0.0"}`)),Te.info(He.dim(`Type: ${o?"Expo":"Bare React Native"}`)),Te.info(""));let s={json:e.json,fix:e.fix,category:e.category,severity:e.severity,prebuild:e.prebuild},a=await Zl(n,s);e.json?console.log(JSON.stringify(ed(a,r),null,2)):Ql(a,e.severity);let l=a.some(c=>c.findings.some(u=>u.severity==="critical")),d=a.some(c=>c.findings.some(u=>u.severity==="high"));(l||d)&&process.exit(1)},rd=["16kb"];async function Xm(e){let t=e.category?.toLowerCase();t&&!rd.includes(t)&&(Te.error(He.red(`Unknown APK check category: "${t}"`)),Te.info(He.dim(`Available APK checks: ${rd.join(", ")}`)),process.exit(1));let n=await Zm(e.apk);n||process.exit(1);let i=!t,r=!1;(i||t==="16kb")&&(await nd(n)||(r=!0)),r&&process.exit(1)}async function Zm(e){if(e.startsWith("build:")){let n=e.slice(6);return await Qm(n)}if(e.startsWith("http://")||e.startsWith("https://"))return await ad(e);let t=xi.resolve(e);return Dn.existsSync(t)?t:(Te.error(He.red(`APK file not found: ${t}`)),null)}async function Qm(e){let t=od();t.start(`Fetching APK from build ${e}...`);try{let n=await $.get(`/build/${e}`);if(n.data.status!=="success")throw new Error(n.data.message);let i=n.data.build;if(!i)throw new Error("Build not found");let r=i.artifacts?.find(o=>o.type?o.type==="apk":o.name?.endsWith(".apk")||o.url?.includes(".apk"));return!r||!r.url?(t.stop("No APK artifact found"),Te.error(He.red("This build does not have an APK artifact.")),Te.info(He.dim("Make sure the build produced an APK (not just an AAB).")),null):(t.stop(`Found build: ${i.buildId||e}`),await ad(r.url))}catch(n){return t.stop("Failed to fetch build"),Te.error(He.red(n.message)),null}}async function ad(e){let t=od();t.start("Downloading APK...");try{let n=Dn.mkdtempSync(xi.join(qm.tmpdir(),`${m.nameLower}-audit-`)),i=xi.join(n,"app.apk"),r=await Jm.get(e,{responseType:"arraybuffer"});Dn.writeFileSync(i,r.data);let o=(r.data.length/(1024*1024)).toFixed(1);return t.stop(`Downloaded APK (${o} MB)`),i}catch(n){return t.stop("Download failed"),Te.error(He.red(`Failed to download APK: ${n.message}`)),null}}var ng=console.log;console.log=()=>{};tg();console.log=ng;X(Y.bgCyan.black(m.cliTag("Production Build Orchestrator")));var Cn=(e,t=[])=>t.concat(e),M=new eg;M.name(m.nameLower).description(`${m.name} CLI: Powerful Cloud Infrastructure Tools`).version(et).option("-y, --yes","Automatically answer yes to all prompts",!1).option("--quiet","Suppress non-essential output",!1);M.command("agent").description("Manage local device discovery agent for the Install Hub (port 7070)").argument("[action]","start, run, install, status, restart, stop, or uninstall","start").action(async e=>{await Ea(e)});M.command("host").description("Setup AWS S3 static hosting and CloudFront").action(async()=>{X(Y.bgCyan.black(m.cliTag("Hosting"))),await Co()});M.command("sitemap").description("Generate sitemap.xml from Expo Router app structure").option("-o, --output <path>","Output path for sitemap.xml","./public/sitemap.xml").action(async e=>{X(Y.bgCyan.black(m.cliTag("Sitemap Generator"))),await xo(e)});M.command("build").description("Run a build on a cloud provider (AWS Spot Instances)").argument("[platform]","Target platform (android, ios)").option("--platform <os>","Target platform alias (android, ios) [Optional]").option("--repo <url>","Git Repository URL").option("--branch <name>","Git Branch").option("--ami <id>","AMI ID").option("--bucket <name>","S3 Bucket for artifacts").option("--region <region>","AWS Region").option("--aws-profile <name>","AWS Credentials Profile").option("-p, --build-profile <name>","Build Profile (e.g. production, staging)").option("--profile <name>","Build Profile (alias for --build-profile)").option("--dry-run","Generate User Data script without launching").option("--keep-instance","Do not terminate the instance after build").option("--subnet <id>","VPC Subnet ID to launch the instance in").option("--security-group <id>","VPC Security Group ID to use").option("--ssh-host <host>","Remote host for iOS build (SSH)").option("--ssh-user <user>","SSH username for remote host").option("--ssh-key <path>","Path to private SSH key for remote host").option("--ios-scheme <scheme>","iOS Scheme to build").option("--ios-team-id <id>","Apple Development Team ID").option("--ios-configuration <config>","Xcode configuration (Release/Debug)").option("--ios-export-method <method>","Export method (ad-hoc, app-store, development, enterprise)").option("--ios-api-key-id <id>","App Store Connect API Key ID").option("--ios-api-key-issuer <id>","App Store Connect API Key Issuer ID").option("--ios-api-key-path <path>","Path to App Store Connect API Key (.p8) file").option("--simulator","Build for iOS Simulator (no signing required)").addOption(new Ne("--build-id <id>","Internal build ID").hideHelp()).addOption(new Ne("--project-id <id>","Internal project ID").hideHelp()).addOption(new Ne("--fail-only","Internal: mark an existing build failed").hideHelp()).addOption(new Ne("--error <message>","Internal failure message").hideHelp()).option("--local","Run build on local machine").option("--auto-version","Assign the next Android versionCode or iOS buildNumber from Mach").option("--auto-submit","Submit this build after it completes successfully").option("--submit-track <track>","Google Play track to use with --auto-submit").option("--submit-release-status <status>","Google Play release status to use with --auto-submit").option("--submit-rollout <fraction>","Google Play staged rollout fraction to use with --auto-submit").option("--submit-changes-not-sent-for-review","Commit Google Play changes without automatically sending them for review when using --auto-submit").option("--submit-credential-id <id>","Service credential ID to use with --auto-submit").option("--submit-json-output <path>","Write auto-submit metadata JSON to a file for CI/CD").option("--verbose","Enable verbose logging").option("--json-output <path>","Write build metadata JSON to a file for CI/CD").option("--maestro","Queue a managed Maestro test run after a successful build").option("--maestro-flows <path>","Maestro flow file or directory (default: .maestro)").option("--maestro-device <device>","Managed device profile id (run `mach maestro devices` to list)").option("--maestro-retries <n>","Retries for the Maestro run","1").option("--maestro-record","Enable screen recording where supported").option("--maestro-use-build-source","Use Maestro flows from the build source snapshot instead of uploading local flows").option("--maestro-env <name>","Forward an environment variable to the managed Maestro runner; repeat or comma-separate names",Cn,[]).option("-y, --yes","Automatically answer yes to all prompts",!1).option("--quiet","Suppress non-essential output",!1).action(async(e,t)=>{let n=M.opts();t.yes=t.yes||n.yes,t.quiet=t.quiet||n.quiet,t.platform=e||t.platform,t.buildProfile=t.profile||t.buildProfile,t.quiet||X(Y.bgCyan.black(m.cliTag("Cloud Build"))),await Qn(t)});var ig=M.command("maestro").description("Run Maestro tests locally or with the managed Mach runner").option("--platform <os>","Target platform (android/ios)").option("-p, --profile <name>","Build profile to resolve when using --latest","production").option("--latest","Use the latest successful build for the platform/profile").option("--build-id <id>","Use a specific Mach build ID").option("--build-url <url>","Use a Mach build URL").option("--artifact-url <url>","Use a direct APK or iOS simulator app artifact URL").option("--local","Run Maestro on a connected local emulator/device instead of the managed runner").option("--maestro-flows <path>","Maestro flow file or directory (default: .maestro)").option("--maestro-device <device>","Managed device profile id (run `mach maestro devices` to list); local runs accept a device identifier").option("--maestro-retries <n>","Retries for the Maestro run","1").option("--maestro-record","Enable screen recording where supported").option("--maestro-use-build-source","Use Maestro flows from the build source snapshot instead of uploading local flows").option("--maestro-env <name>","Forward an environment variable to the managed Maestro runner; repeat or comma-separate names",Cn,[]).option("--wait","Wait for managed Maestro completion and exit non-zero on failure").option("--wait-timeout <minutes>","Maximum minutes to wait for managed Maestro completion","60").option("--wait-interval <seconds>","Polling interval while waiting for managed Maestro completion","15").option("--json-output <path>","Write test run metadata JSON to a file for CI/CD").addOption(new Ne("--local-runner","Internal: execute a managed Maestro run on this machine").hideHelp()).addOption(new Ne("--test-run-id <id>","Internal test run ID").hideHelp()).addOption(new Ne("--project-id <id>","Internal project ID").hideHelp()).addOption(new Ne("--runner-token <token>","Internal runner token").hideHelp()).action(async e=>{X(Y.bgCyan.black(m.cliTag("Maestro Testing"))),await ts(e)});ig.command("devices").description("List device profiles available on the managed Maestro runner fleet").option("--platform <os>","Filter to android or ios").option("--json","Print machine-readable JSON").action(async e=>{await ns(e)});var Vt=e=>e.option("--platform <os>","Target platform: ios, android, or all","all").option("--channel <name>","OTA channel (for example: production, staging)").option("--branch <name>","Alias for --channel").option("--runtime-version <version>","Runtime version override").option("--message <text>","Release note/message for this OTA update").option("--framework <name>","Framework override: expo or react-native").option("--engine <name>","OTA engine override (currently expo-updates)").option("--url <url>","Mach OTA update URL override").option("--install-plugin","Install @radhya/mach locally for the Expo config plugin").option("--skip-install","Do not install local Expo plugin dependency").option("--update-id <id>","OTA update id for rollback/promote").option("--json","Print JSON output"),zt=M.command("ota").description("Setup, publish, verify, and manage Mach OTA updates");Vt(zt.command("setup").description("Configure OTA for this project")).action(async e=>{let t=M.opts();X(Y.bgCyan.black(m.cliTag("OTA Setup"))),await at("setup",{...e,yes:e.yes||t.yes})});Vt(zt.command("publish").description("Publish an OTA update")).action(async e=>{let t=M.opts();X(Y.bgCyan.black(m.cliTag("OTA Publish"))),await at("publish",{...e,yes:e.yes||t.yes})});Vt(zt.command("verify").description("Verify OTA configuration")).action(async e=>{let t=M.opts();X(Y.bgCyan.black(m.cliTag("OTA Verify"))),await at("verify",{...e,yes:e.yes||t.yes})});Vt(zt.command("list").description("List OTA updates for the linked project")).action(async e=>{let t=M.opts();X(Y.bgCyan.black(m.cliTag("OTA Updates"))),await at("list",{...e,yes:e.yes||t.yes})});Vt(zt.command("rollback").description("Roll back an OTA update")).action(async e=>{let t=M.opts();X(Y.bgCyan.black(m.cliTag("OTA Rollback"))),await at("rollback",{...e,yes:e.yes||t.yes})});Vt(zt.command("promote").description("Promote an OTA update")).action(async e=>{let t=M.opts();X(Y.bgCyan.black(m.cliTag("OTA Promote"))),await at("promote",{...e,yes:e.yes||t.yes})});M.command("submit").description("Automated Store Submission (App Store / Google Play)").option("--platform <os>","Target platform (ios/android)").option("-p, --profile <name>","Build/submission profile to submit from (e.g. production, preprod)").option("--track <track>","Google Play Track (internal, alpha, beta, production)").option("--release-status <status>","Google Play release status (completed, draft, halted, inProgress)").option("--rollout <fraction>","Google Play staged rollout fraction for inProgress releases (example: 0.1)").option("--changes-not-sent-for-review","Commit Google Play changes without automatically sending them for review").option("--ssh-host <host>","Remote macOS host for iOS submission").option("--ssh-user <user>","SSH username for remote iOS submission").option("--ssh-key <path>","Path to private SSH key for remote iOS submission").option("--credential-id <id>","Service credential ID to use when multiple submission credentials exist").option("--local","Run submission on this machine (internal runner mode for iOS)").addOption(new Ne("--submit-id <id>","Internal submission ID").hideHelp()).addOption(new Ne("--project-id <id>","Internal project ID").hideHelp()).addOption(new Ne("--package-name <name>","Internal Android package name").hideHelp()).addOption(new Ne("--bundle-id <id>","Internal iOS bundle identifier").hideHelp()).option("--json-output <path>","Write submission metadata JSON to a file for CI/CD").option("--latest","Use the latest successful build for submission").option("--build-id <id>","Use a specific build ID for submission").action(async e=>{let t=M.opts();e.quiet=e.quiet||t.quiet,e.yes=e.yes||t.yes,X(Y.bgCyan.black(m.cliTag("Store Submission"))),await Yn(e)});M.command("login").description(`Login to ${m.name} Dashboard`).action(async()=>{X(Y.bgCyan.black(m.cliTag("Login"))),await va()});M.command("logout").description(`Logout from ${m.name} on this machine`).action(async()=>{X(Y.bgCyan.black(m.cliTag("Logout"))),await Ra()});M.command("link").description(`Link local directory to a ${m.name} Project`).action(async()=>{X(Y.bgCyan.black(m.cliTag("Link Project"))),await Pa()});M.command("me").description("Display currently logged in user details").action(async()=>{await Qa()});M.command("init").description(`Create a new ${m.name} Project`).action(async()=>{X(Y.bgCyan.black(m.cliTag("Init Project"))),await Da()});M.command("env").description("Manage Environment Variables").argument("<action>","Action to perform: set, list, pull, download, or export").argument("[args...]","Key=Value pairs for set action").option("-e, --environment <name>","Environment to pull/download","development").option("-o, --out <file>","Output file for pull/download",".env.local").option("--overwrite","Overwrite output file if it already exists").action(async(e,t,n)=>{X(Y.bgCyan.black(m.cliTag("Env Manager"))),await Ta(e,t,n)});M.command("start").description("Start the development server (Metro)").option("-p, --build-profile <name>","Build profile (e.g. development, staging)","development").option("--tunnel","Use ngrok tunnel").option("--lan","Use LAN IP").option("--localhost","Use localhost").option("-c, --clear","Clear Metro cache").option("--port <number>","Port to listen on").option("--ios","Start on iOS").option("--android","Start on Android").option("--web","Start on Web").action(async e=>{X(Y.bgCyan.black(m.cliTag("Dev Server"))),await tl(e)});var Tn=M.command("push").description("Configure and send provider-direct APNs/FCM notifications");Tn.command("setup").description("Install and wire a working default push experience").option("--name <name>","Push app display name").option("--ios-bundle <id>","iOS bundle identifier").option("--android-package <name>","Android package name").option("-e, --environment <name>","development, preview, or production").option("--google-services-file <path>","Android google-services.json path").option("--skip-install","Generate setup without installing SDK dependencies").action(Ro);Tn.command("init").description("Create only the server-side push app (advanced)").option("--name <name>","Push app display name").option("--ios-bundle <id>","iOS bundle identifier").option("--android-package <name>","Android package name").option("-e, --environment <name>","development, preview, or production","production").option("--google-services-file <path>","Expo Android google-services.json path").action(vo);var dd=Tn.command("credentials").description("Configure provider credentials");dd.command("apns").description("Configure an Apple APNs .p8 authentication key").requiredOption("--file <path>","APNs .p8 file").requiredOption("--team-id <id>","Apple Developer team ID").requiredOption("--key-id <id>","APNs key ID").option("--bundle-id <id>","iOS bundle identifier").option("--app <id>","MACH Push app ID").option("-e, --environment <name>","development, preview, or production").action(e=>Hi("apns",e));dd.command("fcm").description("Configure a Firebase service-account JSON file").requiredOption("--file <path>","Firebase service-account JSON").option("--app <id>","MACH Push app ID").option("-e, --environment <name>","Deprecated; accepted for compatibility because FCM credentials are package-wide").action(e=>Hi("fcm",e));Tn.command("send").description("Queue one transient push notification").requiredOption("--title <text>","Notification title").requiredOption("--body <text>","Notification body").option("--app <id>","MACH Push app ID").option("-e, --environment <name>","development, preview, or production").option("--token <token>","MACH push token; repeatable",Cn,[]).option("--user <id>","Application user ID; repeatable",Cn,[]).option("--all","Send to all active devices").option("--platform <platform>","Limit --all to ios or android").option("--data <json>","String-to-string custom data JSON").option("--sound <name>","Provider sound name").option("--badge <number>","iOS badge count").option("--ttl <seconds>","Provider time-to-live").option("--collapse-key <key>","Provider collapse key").option("--android-channel-id <id>","Android notification channel").action(Oo);Tn.command("status").description("Show aggregate push delivery counters").option("--days <number>","Statistics range, 1-90","30").action(Po);M.command("config").description("Show resolved configuration for a profile").option("-p, --profile <name>","Build profile to resolve","development").option("--json","Output as JSON").action(async e=>{await nl(e)});var cd=M.command("version").description("Show or seed DB-owned native version counters"),ud=e=>e.requiredOption("--platform <os>","Target platform: ios or android").option("-p, --profile <name>","Build profile used to resolve package/bundle scope","production").option("--scope <value>","Counter scope override, usually package name or bundle identifier").option("--package <name>","Android package override").option("--bundle-id <id>","iOS bundle identifier override").option("--json","Print JSON output");ud(cd.command("show").description("Show the current native version counter")).action(async e=>{X(Y.bgCyan.black(m.cliTag("Version Counter"))),await ro("show",e)});ud(cd.command("seed").description("Seed the native version counter for an existing app").argument("[value]","Latest already-used value; the next build uses value + 1").option("--value <number>","Latest already-used value; the next build uses value + 1").option("--force","Allow lowering an existing counter")).action(async(e,t)=>{X(Y.bgCyan.black(m.cliTag("Version Counter"))),await ro("seed",{...t,value:t.value??e})});var pd=M.command("deeplink").description("Configure and verify app links, universal links, and URI schemes");pd.command("setup").description("Generate deep link config, hosted association files, and Expo plugin support").option("--domain <domain>","Associated domain, e.g. app.example.com").option("--base-url <url>","Base URL, e.g. https://app.example.com").option("-p, --profile <name>","Profile used for build/submit overrides").option("--platform <platform>","ios, android, or all").option("--framework <framework>","expo or react-native").option("--scheme <scheme>","URI scheme, e.g. myapp").option("--ios-bundle-id <id>","iOS bundle identifier").option("--android-package <name>","Android package name").option("--apple-team-id <id>","Apple Developer Team ID").option("--app-store-id <id>","App Store app ID for Smart App Banner").option("--android-fingerprint <sha256>","Android SHA256 signing certificate fingerprint; repeatable",Cn,[]).option("--output <dir>","Directory for hosted files, e.g. public or deep-links").option("--install-plugin","Install @radhya/mach locally so Expo can use the packaged config plugin").option("--no-install-plugin","Do not install @radhya/mach for Expo projects; use the local plugin fallback if the package is missing").option("-y, --yes","Automatically answer yes to prompts",!1).action(async e=>{let t=M.opts();e.yes=e.yes||t.yes,X(Y.bgCyan.black(m.cliTag("Deep Links"))),await $l(e)});pd.command("verify").description("Verify local and optionally live deep link configuration").option("-p, --profile <name>","Profile used for build/submit overrides").option("--live","Check hosted files over HTTPS").option("--android-device","Print Android device verification commands").action(async e=>{X(Y.bgCyan.black(m.cliTag("Deep Link Verify"))),await wl(e)});M.command("credentials").description("Unified, interactive credential management (iOS/Android)").option("-p, --profile <name>","Build profile (production, staging, development)").option("--credential-type <type>","iOS signing type override: development, adhoc, or store").option("--force","Force recreate certificates (nuke existing on Apple Portal)",!1).action(async e=>{let{credentialsMainCommand:t}=await import("./credentials-EPQ6NGOF.js");await t(e)});M.command("credentials:setup").description("Automated credential provisioning (iOS/Android) [Legacy]").requiredOption("--platform <os>","Platform: ios or android").option("--profile <name>","Build profile (production, staging, development)").option("--credential-type <type>","iOS signing type override: development, adhoc, or store").option("--bundle-id <id>","Bundle ID / Package Name (optional, auto-detected)").option("--team-id <id>","Apple Team ID (iOS only)").option("--key-alias <alias>","Android keystore alias (optional, auto-generated)").option("--aws-profile <name>","AWS Credentials Profile (for S3 storage)").option("--force","Force recreate certificates (nuke existing on Apple Portal)",!1).action(async e=>{X(Y.bgCyan.black(m.cliTag("Credentials Setup"))),await qt(e),ld(Y.green("Done!"))});M.command("credentials:service").description("Upload Service Credentials (ASC API Key / Google Service JSON) [Legacy]").requiredOption("--platform <os>","Platform: ios or android").option("--file <path>","Path to credential file (.p8 or .json)").option("--issuer-id <id>","ASC API Key Issuer ID (iOS only)").option("--key-id <id>","ASC API Key ID (iOS only)").option("--bundle-id <id>","Bundle identifier / Android package name to attach this service credential to").option("--package-name <name>","Android package name to attach this service credential to").option("-p, --profile <name>","Build profile to resolve package/bundle identifier from config").action(async e=>{X(Y.bgCyan.black(m.cliTag("Service Credentials"))),await wo(e),ld(Y.green("Done!"))});var lo=M.command("device").description("Manage registered iOS test devices");lo.command("register").description("Register a connected iOS device or enter UDID manually").option("--udid <udid>","Device UDID (skip auto-detection)").option("--name <name>","Device name").option("--team-id <id>","Apple Developer Team ID for this device").action(async e=>{await wi("register",e)});lo.command("list").description("List all registered devices").option("--team-id <id>","Filter by Apple Developer Team ID").action(async e=>{await wi("list",e)});lo.command("remove").description("Remove a registered device").option("--udid <udid>","Device UDID to remove").option("--team-id <id>","Apple Developer Team ID for this device").action(async e=>{await wi("remove",e)});M.command("audit").description("Run automated security audit on the project or APK").option("--apk <path>","Path to APK file (runs APK diagnostics like 16KB alignment)").option("--json","Output results as JSON (for CI/CD)").option("--fix","Auto-apply fixes where possible").option("--category <name>","Run only a specific check category (e.g. 16kb, permissions, secrets)").option("--severity <level>","Minimum severity to display (critical, high, medium, low, info)").option("--prebuild","Run expo prebuild for deeper manifest/plist analysis").action(async e=>{X(Y.bgCyan.black(m.cliTag(e.apk?"APK Audit":"Security Audit"))),await sd(e)});var rg=new Set(["login","logout","agent"]);M.hook("preAction",(e,t)=>{let n=t.name(),i=t.opts?.()||{};n==="maestro"&&(i.local||i.localRunner)||t.parent?.name()!=="deeplink"&&(rg.has(n)||Et())});M.on("command:*",()=>{console.error(`Invalid command: %s
+See --help for a list of available commands.`,M.args.join(" ")),process.exit(1)});process.argv.slice(2).length||M.help();M.parse(process.argv);