@radhya/mach 2.5.0 → 2.6.1

package/README.md

@@ -2,7 +2,7 @@
 
 **Cloud Build & Delivery for React Native, Expo, and Flutter**
 
-Mach is a CLI that lets you build, sign, and submit React Native and Expo apps from the cloud. Flutter support is modeled in configuration and documentation so it can be added without changing the command surface.
+Mach is a CLI that builds, signs, audits, versions, and submits Flutter, React Native, and Expo apps locally or in the cloud.
 
 ## Installation
 
@@ -21,7 +21,7 @@ mach push send --user user_123 --title "Hello" --body "Your update is ready."
 mach push status --days 30
 ```
 
-MACH Push supports Expo development builds and bare React Native. It
+MACH Push supports Flutter, Expo development builds, and bare React Native. It
 adds a working default permission, registration, receive, and tap flow while
 leaving an editable callback file in the application. The app config only marks
 push as enabled; MACH stores encrypted
@@ -41,6 +41,7 @@ mach link
 # Run a cloud build
 mach build --platform ios
 mach build --platform android
+mach build --platform web # Flutter projects
 ```
 
 ## Commands
@@ -61,7 +62,7 @@ mach build --platform android
 | `mach env`                 | Manage, list, and download environment variables and secrets        |
 | `mach version`             | Show and seed DB-owned native version counters                     |
 | `mach config`              | Show resolved configuration for a build profile                    |
-| `mach start`               | Start the Metro development server                                 |
+| `mach start`               | Start Flutter or the React Native/Expo development server          |
 | `mach device`              | Register test devices for ad-hoc distribution                      |
 | `mach audit`               | Check project health, delivery impact, and security locally         |
 | `mach agent`               | Manage the local device discovery agent for Install Hub            |
@@ -109,7 +110,8 @@ Useful options:
 
 ## Cloud Builds
 
-Trigger a build in the cloud — Mach handles zipping, uploading, compiling, and returning your IPA or APK.
+Trigger a build in the cloud — Mach handles source upload, framework-specific
+compilation, signing, and delivery of IPA, APK, or AAB artifacts.
 
 ```bash
 # iOS build (production)
@@ -140,9 +142,9 @@ Supported values:
 | ---------------- | ------------ | ------------------------------------------------------------------------------ |
 | `react-native`   | Supported    | Uses committed `ios/` and `android/` native projects. No Expo prebuild runs.   |
 | `expo`           | Supported    | Runs Expo prebuild before native compilation and applies Expo-specific guards. |
-| `flutter`        | Planned      | Reserved in config/docs. Builds fail clearly until Flutter builders are added. |
+| `flutter`        | Supported    | Uses Flutter/Dart with managed Android/iOS signing, web artifacts, caches, symbols, and submissions. |
 
-`mach init` and `mach link` create `framework: "react-native"` by default. Change it to `"expo"` for Expo projects before running builds. This explicit config prevents a React Native change from affecting Expo projects, and avoids fragile package scanning in CI.
+`mach init` and `mach link` detect the selected app and save its framework. The saved value remains explicit, preventing one framework's build behavior from affecting another in CI.
 
 Use the framework guide that matches your app. The command surface stays the same; only `framework` changes the build pipeline:
 
@@ -153,7 +155,7 @@ Use the framework guide that matches your app. The command surface stays the sam
 
 ## OTA Updates
 
-Mach OTA lets you publish JavaScript and asset updates through Mach without using EAS Update. Mach hosts the update artifacts and serves the right update by channel, platform, and runtime version. Your app never needs storage credentials.
+Mach OTA uses a framework-specific provider: Mach-hosted `expo-updates` for Expo and bare React Native, and customer-owned Shorebird for Flutter. Mach never stores `SHOREBIRD_TOKEN`.
 
 ```bash
 mach ota setup
@@ -164,6 +166,15 @@ mach ota rollback --update-id <updateId>
 mach ota promote --update-id <updateId>
 ```
 
+For Flutter, the equivalent workflow is:
+
+```bash
+mach ota setup --profile staging
+mach ota release --platform all --profile staging
+mach ota publish --platform all --profile staging --track staging --release-version latest
+mach ota promote --release-version 1.2.0+42 --patch-number 1
+```
+
 `mach ota setup` uses the open-source `expo-updates` runtime for both Expo and bare React Native apps while keeping publishing, manifests, assets, channels, metrics, and rollback on Mach. It writes the `ota` config, installs or refreshes the compatible project-local plugin when approved, and wires `@radhya/mach/expo-plugin`. Updates are served from Mach instead of EAS Update.
 
 For bare React Native, setup first installs Expo Modules when needed, then uses the installed `expo-updates configuration:syncnative` tool to update the committed Android and iOS projects. It does not run Expo prebuild or replace the native folders. Run setup from a clean branch so you can review the package and native integration changes.
@@ -178,6 +189,8 @@ Runtime precedence is `--runtime-version`, `ota.runtimeVersion`, `ota.runtimeVer
 
 Bare React Native uses the same Expo Updates protocol and the same Mach endpoint as Expo. `mach-react-native` remains reserved for a future Mach-owned native runtime and cannot currently be selected for publishing.
 
+Flutter setup initializes Shorebird, records only `engine: "shorebird"` and the default track, and delegates release/patch storage and delivery directly to the customer's Shorebird account. CI reads `SHOREBIRD_TOKEN` only from its environment. Native or asset changes still require a new base release; Dart-only compatible fixes can be patched.
+
 See [OTA Updates](docs/ota.md) for setup behavior, bare React Native requirements, runtime matching, and validation.
 
 ## Deep Links
@@ -216,7 +229,7 @@ mach deeplink setup \
   --output public
 ```
 
-`setup` writes compact `deepLinks` settings into `mach.config.json`, generates Apple AASA and Android `assetlinks.json` files, and wires an Expo config plugin for Expo projects. The interactive flow can also enable iOS Web Credentials for HTTPS OAuth callbacks and Android Login Credentials for website password and passkey sharing; both remain disabled by default. For Expo apps, Mach prefers `@radhya/mach/expo-plugin`; interactive setup offers to install `@radhya/mach` locally, and `--yes` or `--install-plugin` installs it automatically. Use `--no-install-plugin` to skip package installation; if the package is missing, Mach generates a local `./plugins/withMachDeepLinks` fallback. See [Deep Links](docs/deep-links.md).
+`setup` writes compact `deepLinks` settings into `mach.config.json`, generates Apple AASA and Android `assetlinks.json` files, wires an Expo config plugin for Expo projects, and safely patches Flutter's Android manifest plus iOS entitlements/URL scheme. Re-running it is idempotent. The interactive flow can also enable iOS Web Credentials for HTTPS OAuth callbacks and Android Login Credentials for website password and passkey sharing; both remain disabled by default. For Expo apps, Mach prefers `@radhya/mach/expo-plugin`; interactive setup offers to install `@radhya/mach` locally, and `--yes` or `--install-plugin` installs it automatically. Use `--no-install-plugin` to skip package installation; if the package is missing, Mach generates a local `./plugins/withMachDeepLinks` fallback. See [Deep Links](docs/deep-links.md).
 
 ## Local Device Agent
 
@@ -457,13 +470,15 @@ Create a `mach.config.json` in your project root:
 | `framework`    | Required build framework: `react-native`, `expo`, or `flutter`. Builds never infer this from `package.json`                     |
 | `appDirectory` | Optional mobile app path relative to the repository root, for example `apps/mobile`. Defaults to `"."` for existing projects. |
 | `name`         | App display name                                                                                                                |
-| `nodeVersion`  | Node.js version to use on the build machine (e.g. `"24"`, `"20.11.0"`). Switches via nvm before installing deps                 |
+| `nodeVersion`  | React Native/Expo Node.js version (e.g. `"24"`, `"20.11.0"`). Flutter builds do not use this field                              |
+| `flutter.sdkVersion` | Exact Flutter stable SDK for managed builds. `mach init` and `mach link` pin the installed SDK automatically              |
 
 ### Monorepo Layout
 
-Keep `mach.config.json`, the package-manager lockfile, and workspace
-configuration at the repository root. Set `appDirectory` only when the Expo or
-bare React Native app lives below that root:
+Keep `mach.config.json` and the workspace configuration at the repository root.
+For JavaScript workspaces, keep the package-manager lockfile there too. Set
+`appDirectory` when an Expo, bare React Native, or Flutter application lives
+below the root:
 
 ```json
 {
@@ -472,9 +487,10 @@ bare React Native app lives below that root:
 }
 ```
 
-Mach uploads and installs from the repository root, then runs Expo, Gradle,
-CocoaPods, and Xcode from `appDirectory`. Root-level projects need no config
-change and continue to use `"."`.
+Mach uploads from the repository root, resolves npm/Yarn/pnpm or Dart pub
+workspace dependencies as appropriate, and runs the selected framework's
+native toolchain from `appDirectory`. Root-level projects need no config change
+and continue to use `"."`.
 
 ### Platform Properties
 
@@ -497,6 +513,12 @@ change and continue to use `"."`.
 | `distribution`           | `development` for iOS development signing, `internal` for ad-hoc/internal testing builds, or `store` for App Store / Play Store release builds |
 | `android.emulator`       | `true` to include Android emulator ABI support (`x86_64`) for Maestro/e2e APK builds                                                           |
 | `android.architectures`  | Override Android release ABIs, for example `armeabi-v7a,arm64-v8a,x86_64`                                                                      |
+| `flutter.flavor`         | Flutter Android product flavor and shared iOS scheme. Omit for unflavored apps                                                                |
+| `flutter.target`         | Dart entrypoint relative to `appDirectory`; defaults to `lib/main.dart`                                                                        |
+| `flutter.mode`           | Flutter compilation mode: `debug`, `profile`, or `release`                                                                                     |
+| `flutter.dartDefinesFromEnv` | Environment-key names passed with `--dart-define`. Values are compiled into the app and must not be secrets                              |
+| `flutter.obfuscate`      | Obfuscate Dart code for Android/iOS release builds and retain downloadable split debug symbols                                                |
+| `flutter.splitDebugInfo` | Retain downloadable split debug symbols without otherwise changing app behavior                                                               |
 | `preBuild` / `postBuild` | Shell command or script reference to run around the build                                                                                      |
 | `envGroups`              | Array of environment group names to merge into this profile                                                                                    |
 
@@ -648,9 +670,9 @@ press `i` for iOS, `a` for Android, `w` for web, and `r` to reload. Use the flag
 
 `mach audit` combines doctor-style environment checks, delivery-impact advice,
 and security scanning in one offline-friendly command. It validates Mach config,
-framework and profile consistency, app identifiers, Node/lockfile health, Expo
-dependency alignment, permissions, secrets, dependencies, storage, networking,
-and native manifests when available.
+framework and profile consistency, app identifiers, Node or Flutter/Dart
+toolchains, lockfiles, dependency alignment, permissions, secrets, storage,
+networking, and native manifests when available.
 
 ```bash
 mach audit
@@ -706,6 +728,7 @@ mach submit --latest --platform android --profile production
 ## Requirements
 
 - Node.js 18+
+- For local Flutter builds: the Flutter SDK version pinned in `mach.config.json`
 - For iOS builds: Xcode (local builds) or cloud build subscription
 - For Android builds: Android SDK (local builds) or cloud build subscription
 

package/dist/chunk-QFXPWC5D.js

@@ -0,0 +1,4 @@
+var o={name:"Mach",nameLower:"mach",nameUpper:"MACH",company:"Radhya Softlabs",npmScope:"@radhya",configFileName:"mach.config.json",configDir:".mach",workspacesDir:".mach-workspaces",remoteWorkspacesDir:"mach_workspaces",envPrefix:"MACH_",bucketPrefix:"skye-builds-385229479322",buildPrefix:"mach-build",credentialsKeychain:"mach-credentials.keychain",keychainPassword:"mach",cliTag:e=>` Mach CLI - ${e} `,fastlanePrefix:"mach",jsonStartMarker:"___MACH_JSON_START___",jsonEndMarker:"___MACH_JSON_END___",prewarmedMarker:"/opt/mach-prewarmed"};import s from"fs";import f from"path";import y from"os";import v from"axios";var m=f.join(y.homedir(),o.configDir),d=f.join(m,"credentials.json");function h(){return process.env[`${o.envPrefix}TOKEN`]?.trim()||void 0}function T(e){s.existsSync(m)||s.mkdirSync(m,{recursive:!0}),s.writeFileSync(d,JSON.stringify(e,null,2))}function l(){let e=h();if(e)return{token:e,email:"token-auth"};if(!s.existsSync(d))return null;try{return JSON.parse(s.readFileSync(d,"utf-8"))}catch{return null}}function I(){return s.existsSync(d)?(s.unlinkSync(d),!0):!1}function $(){let e=h();if(e)return{token:e,email:"token-auth"};let r=l();if(r?.token)return r;console.error(`\x1B[31mAuthentication required.\x1B[0m Either:
+  1. Run \x1B[33m${o.nameLower} login\x1B[0m for interactive login
+  2. Set \x1B[33m${o.envPrefix}TOKEN\x1B[0m environment variable for CI/CD`),process.exit(1)}async function k(e){let r=l();if(!r||!r.refreshToken)return null;try{let t=await v.post(`${e}/refresh-token`,{username:r.email,refreshToken:r.refreshToken});if(t.data.status==="success"&&t.data.user){let n={...r,id:t.data.user.id||r.id,token:t.data.user.token,refreshToken:t.data.user.refreshToken||r.refreshToken};return T(n),n.token}}catch{}return null}import A from"axios";import g from"dotenv";import x from"path";import{fileURLToPath as C}from"url";var b=x.dirname(C(import.meta.url));g.config({path:x.join(b,"../.env"),quiet:!0});var c=process.env[`${o.envPrefix}API_URL`]||"https://mach-api.securejs.in",_="https://getmach.dev",D=c.includes("localhost:3001")||c.includes("127.0.0.1:3001")?c.replace("3001","8081"):_,B=process.env[`${o.envPrefix}DASHBOARD_URL`]||D;var u=A.create({baseURL:c,headers:{Connection:"close"}});u.interceptors.request.use(e=>{let t=l()?.token||process.env[`${o.envPrefix}TOKEN`];return t&&(e.headers.Authorization=`Bearer ${t}`),e},e=>Promise.reject(e));u.interceptors.response.use(e=>e,async e=>{let{config:r}=e;if((!e.response||e.code==="ECONNRESET"||e.code==="ETIMEDOUT")&&(!r._retryCount||r._retryCount<3)){r._retryCount=(r._retryCount||0)+1;let n=Math.pow(2,r._retryCount-1)*1e3;return console.warn(`\x1B[33m[NETWORK] Transient error (${e.code||"UNKNOWN"}). Retrying in ${n/1e3}s... (Attempt ${r._retryCount}/3)\x1B[0m`),await new Promise(a=>setTimeout(a,n)),u(r)}return Promise.reject(e)});u.interceptors.response.use(e=>e,async e=>{let r=e.config;if(e.response?.status===401&&!r._retry){if(r._retry=!0,process.env[`${o.envPrefix}TOKEN`])return console.error(`\x1B[31mAuthentication failed.\x1B[0m Your ${o.envPrefix}TOKEN may be invalid or expired.
+Generate a new token at the ${o.name} Dashboard \u2192 Settings \u2192 Access Tokens.`),Promise.reject(e);try{let n=await k(c);if(n)return r.headers.Authorization=`Bearer ${n}`,u(r)}catch(n){return Promise.reject(n)}}return Promise.reject(e)});var p=e=>String(e||"").trim().toLowerCase().replace(/_/g,"-");function S(e){let r=p(e);if(["development","dev"].includes(r))return"development";if(["adhoc","ad-hoc","internal","staging","stage","preview"].includes(r))return"adhoc";if(["store","app-store","appstore","production","prod"].includes(r))return"store"}function X(e){if(e.storedDistributionType!==e.requestedDistributionType)throw new Error(`Dashboard stored ${e.credentialType} as ${String(e.storedDistributionType||"unknown")} instead of ${e.requestedDistributionType}.`)}function Z(e){let r=S(e.requestedCredentialType);if(r)return r;let t=e.profile||{};if(t.developmentClient||t.simulator||t.ios?.simulator)return"development";let n=p(t.distribution),a=p(t.iosExportMethod||t.ios?.exportMethod),i=p(t.environment);return a==="app-store"||n==="store"?"store":a==="development"||n==="development"?"development":a==="ad-hoc"||a==="adhoc"||n==="ad-hoc"||n==="adhoc"||n==="internal"?"adhoc":i==="production"||i==="store"?"store":i==="development"||i==="dev"?"development":"adhoc"}export{o as a,T as b,l as c,I as d,$ as e,c as f,B as g,u as h,S as i,X as j,Z as k};