@ship-et/buildatlas-cli 0.0.0-stage → 0.12.0

package/dist/commands/credentials-wizard.js

@@ -0,0 +1,274 @@
+import { execFile } from 'node:child_process';
+import { access, readFile } from 'node:fs/promises';
+import { basename, isAbsolute, resolve } from 'node:path';
+import { promisify } from 'node:util';
+import pc from 'picocolors';
+import { looksLikeZip, readEasCertificateZip } from '../eas-credentials-zip.js';
+const exec = promisify(execFile);
+/**
+ * Interactive `credentials add`.
+ *
+ * Running the command bare used to fail with "required option '-k, --kind' not
+ * specified", which tells you a flag is missing but not which of six values it
+ * takes, nor which extra flags each one then needs. The flags still work and are
+ * still what CI uses; this is for the person doing it once by hand.
+ *
+ * For Android it also offers to *create* the keystore. That is the part most worth
+ * automating: keytool's defaults are wrong for this job in three separate ways —
+ * it writes to ~/.keystore rather than the project, issues a 90-day certificate
+ * that is useless for Play, and names the key `mykey`. Getting any of those wrong
+ * is only discovered later.
+ */
+export async function runCredentialsWizard(p, defaults) {
+    const kind = await p.select('What are you adding?', [
+        {
+            value: 'android_keystore',
+            label: 'Android keystore',
+            hint: 'signs every Android build',
+        },
+        {
+            value: 'ios_dist_cert',
+            label: 'iOS distribution certificate',
+            hint: '.p12, for device and App Store builds',
+        },
+        {
+            value: 'ios_provisioning_profile',
+            label: 'iOS provisioning profile',
+            hint: '.mobileprovision',
+        },
+        {
+            value: 'asc_api_key',
+            label: 'App Store Connect API key',
+            hint: '.p8, for store submission',
+        },
+        {
+            value: 'play_service_account',
+            label: 'Google Play service account',
+            hint: '.json, for store submission',
+        },
+    ]);
+    switch (kind) {
+        case 'android_keystore':
+            return androidKeystore(p, defaults.dir);
+        case 'ios_dist_cert':
+            return iosDistCert(p, defaults.dir);
+        case 'ios_provisioning_profile':
+            return iosProfile(p, defaults.dir);
+        case 'asc_api_key':
+            return ascApiKey(p, defaults.dir);
+        case 'play_service_account':
+            return playServiceAccount(p, defaults.dir);
+    }
+}
+/** Asks for a path until it points at something readable. */
+async function askForFile(p, question, dir, suggestion) {
+    for (let attempt = 0; attempt < 5; attempt++) {
+        const answer = await p.ask(question, suggestion ? { default: suggestion } : {});
+        if (!answer) {
+            console.log(pc.red('  A file is required.'));
+            continue;
+        }
+        // Relative to the project directory, which is where people keep these and
+        // therefore what they type.
+        const path = isAbsolute(answer) ? answer : resolve(dir, answer.replace(/^~/, homeDir()));
+        try {
+            await access(path);
+            return path;
+        }
+        catch {
+            console.log(pc.red(`  Not found: ${path}`));
+        }
+    }
+    throw new Error('Could not find that file.');
+}
+function homeDir() {
+    return process.env.HOME ?? '';
+}
+async function base64(path) {
+    return (await readFile(path)).toString('base64');
+}
+async function androidKeystore(p, dir) {
+    const have = await p.select('Do you have a keystore already?', [
+        { value: 'generate', label: 'No — create one now', hint: 'recommended' },
+        { value: 'existing', label: 'Yes — I have a .jks or .keystore file' },
+    ]);
+    let path;
+    let alias;
+    let password;
+    let keyPassword;
+    if (have === 'generate') {
+        path = resolve(dir, await p.ask('Save the keystore as', { default: 'upload.jks' }));
+        alias = await p.ask('Key alias', { default: 'upload' });
+        password = await askNewPassword(p);
+        const dname = await askDname(p);
+        await generateKeystore({ path, alias, password, dname });
+        console.log(`${pc.green('✔')} created ${pc.bold(basename(path))} ${pc.dim('(valid 10000 days)')}`);
+        console.log(pc.yellow('!'), 'Back this file and its password up somewhere durable now.', '\n  Lose them and the app can never be updated on Play — only republished under a new package name.');
+    }
+    else {
+        path = await askForFile(p, 'Path to the keystore', dir, 'upload.jks');
+        alias = await p.ask('Key alias', { default: await guessAlias(path) });
+        password = await p.askHidden('Keystore password');
+        // Only asked for an existing keystore, and only because old JKS files really
+        // do have two different passwords. One we generate never does: keytool has
+        // defaulted to PKCS12 since JDK 9, which has no separate key password and
+        // silently ignores a different one.
+        keyPassword = (await p.askHidden('Key password (blank if same as above)')) || undefined;
+    }
+    const label = await p.ask('Label', { default: `${basename(path)} (${alias})` });
+    return {
+        kind: 'android_keystore',
+        label,
+        payload: {
+            keystoreBase64: await base64(path),
+            keystorePassword: password,
+            keyAlias: alias,
+            keyPassword: keyPassword ?? password,
+        },
+    };
+}
+/**
+ * Reads the alias out of the keystore so it does not have to be typed.
+ *
+ * Needs the store password, which we have not asked for yet, so this only works
+ * for keystores that list without one. Falls back to the conventional name.
+ */
+async function guessAlias(path) {
+    try {
+        const { stdout } = await exec('keytool', ['-list', '-keystore', path, '-storepass', '']);
+        const match = stdout.match(/^(\S+),.*PrivateKeyEntry/m);
+        if (match?.[1])
+            return match[1];
+    }
+    catch {
+        // Password-protected, which is normal. The default below is the convention.
+    }
+    return 'upload';
+}
+async function askNewPassword(p) {
+    for (let attempt = 0; attempt < 5; attempt++) {
+        const first = await p.askHidden('Keystore password (min 6 characters)');
+        if (first.length < 6) {
+            console.log(pc.red('  keytool requires at least 6 characters.'));
+            continue;
+        }
+        const second = await p.askHidden('Confirm password');
+        if (first !== second) {
+            console.log(pc.red('  Passwords do not match.'));
+            continue;
+        }
+        return first;
+    }
+    throw new Error('Could not read a password.');
+}
+async function askDname(p) {
+    console.log(pc.dim('\nThese go into the certificate. They are not verified by anyone — use your real'));
+    console.log(pc.dim('organisation so the certificate is identifiable later.'));
+    const cn = await p.ask('Name (CN)', { default: 'Mobile' });
+    const org = await p.ask('Organisation (O)');
+    const city = await p.ask('City (L)');
+    const country = await p.ask('Two-letter country code (C)', { default: 'ET' });
+    const parts = [`CN=${cn}`, org && `O=${org}`, city && `L=${city}`, `C=${country}`].filter(Boolean);
+    return parts.join(', ');
+}
+async function generateKeystore(opts) {
+    try {
+        await exec('keytool', ['-help']);
+    }
+    catch {
+        throw new Error('keytool not found. It ships with the JDK — install one (`brew install --cask temurin`) and try again.');
+    }
+    try {
+        await exec('keytool', [
+            '-genkeypair',
+            '-storetype',
+            'PKCS12',
+            '-keystore',
+            opts.path,
+            '-alias',
+            opts.alias,
+            '-keyalg',
+            'RSA',
+            '-keysize',
+            '2048',
+            // ~27 years. keytool's default is 90 days, which Google Play rejects and
+            // which would strand even internal builds.
+            '-validity',
+            '10000',
+            '-storepass',
+            opts.password,
+            // Same as the store password on purpose: see keyPassword above.
+            '-keypass',
+            opts.password,
+            '-dname',
+            opts.dname,
+        ]);
+    }
+    catch (err) {
+        const message = err.stderr?.trim();
+        throw new Error(`keytool failed: ${message || err.message}`);
+    }
+}
+async function iosDistCert(p, dir) {
+    console.log(pc.dim('\nEither a .p12 exported from Keychain Access (My Certificates → right-click the' +
+        '\nprivate key → Export), or the zip that `eas credentials` downloads — that one' +
+        '\nalso carries its own password, which will be read for you.'));
+    const path = await askForFile(p, 'Path to the .p12 or DistCert_*.zip', dir, 'dist.p12');
+    if (looksLikeZip(path)) {
+        const bundle = await readEasCertificateZip(path);
+        if (!bundle) {
+            throw new Error(`${path} is a zip but holds no .p12 — point at the certificate itself.`);
+        }
+        console.log(`${pc.green('✔')} found ${bundle.p12Name} in the archive`);
+        // Asked for only when the archive does not carry it, which an EAS download does.
+        const zipPassword = bundle.password ?? (await p.askHidden('.p12 password'));
+        if (bundle.password)
+            console.log(pc.dim('  password read from the archive'));
+        const zipLabel = await p.ask('Label', { default: basename(path, '.zip') });
+        return {
+            kind: 'ios_dist_cert',
+            label: zipLabel,
+            payload: { p12Base64: bundle.p12.toString('base64'), password: zipPassword },
+        };
+    }
+    const password = await p.askHidden('Password you set when exporting it');
+    const label = await p.ask('Label', { default: 'Distribution certificate' });
+    return {
+        kind: 'ios_dist_cert',
+        label,
+        payload: { p12Base64: await base64(path), password },
+    };
+}
+async function iosProfile(p, dir) {
+    console.log(pc.dim('\nDownload this from developer.apple.com → Certificates, IDs & Profiles → Profiles.'));
+    const path = await askForFile(p, 'Path to the .mobileprovision', dir);
+    const label = await p.ask('Label', { default: basename(path) });
+    return {
+        kind: 'ios_provisioning_profile',
+        label,
+        payload: { profileBase64: await base64(path) },
+    };
+}
+async function ascApiKey(p, dir) {
+    console.log(pc.dim('\nFrom App Store Connect → Users and Access → Integrations → App Store Connect API.'));
+    const path = await askForFile(p, 'Path to the .p8 key file', dir);
+    const keyId = await p.ask('Key ID');
+    const issuerId = await p.ask('Issuer ID');
+    const label = await p.ask('Label', { default: `ASC key ${keyId}` });
+    return {
+        kind: 'asc_api_key',
+        label,
+        payload: { p8Base64: await base64(path), keyId, issuerId },
+    };
+}
+async function playServiceAccount(p, dir) {
+    console.log(pc.dim('\nFrom Google Cloud console → IAM → Service Accounts → Keys → Add key (JSON).'));
+    const path = await askForFile(p, 'Path to the service account .json', dir);
+    const label = await p.ask('Label', { default: basename(path) });
+    return {
+        kind: 'play_service_account',
+        label,
+        payload: { serviceAccountJson: await readFile(path, 'utf8') },
+    };
+}
+//# sourceMappingURL=credentials-wizard.js.map

package/dist/commands/credentials-wizard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials-wizard.js","sourceRoot":"","sources":["../../src/commands/credentials-wizard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAGhF,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAejC;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,CAAW,EACX,QAAyB;IAEzB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,MAAM,CAAa,sBAAsB,EAAE;QAC9D;YACE,KAAK,EAAE,kBAAkB;YACzB,KAAK,EAAE,kBAAkB;YACzB,IAAI,EAAE,2BAA2B;SAClC;QACD;YACE,KAAK,EAAE,eAAe;YACtB,KAAK,EAAE,8BAA8B;YACrC,IAAI,EAAE,uCAAuC;SAC9C;QACD;YACE,KAAK,EAAE,0BAA0B;YACjC,KAAK,EAAE,0BAA0B;YACjC,IAAI,EAAE,kBAAkB;SACzB;QACD;YACE,KAAK,EAAE,aAAa;YACpB,KAAK,EAAE,2BAA2B;YAClC,IAAI,EAAE,2BAA2B;SAClC;QACD;YACE,KAAK,EAAE,sBAAsB;YAC7B,KAAK,EAAE,6BAA6B;YACpC,IAAI,EAAE,6BAA6B;SACpC;KACF,CAAC,CAAC;IAEH,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,kBAAkB;YACrB,OAAO,eAAe,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC1C,KAAK,eAAe;YAClB,OAAO,WAAW,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;QACtC,KAAK,0BAA0B;YAC7B,OAAO,UAAU,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;QACrC,KAAK,aAAa;YAChB,OAAO,SAAS,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;QACpC,KAAK,sBAAsB;YACzB,OAAO,kBAAkB,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC;AAED,6DAA6D;AAC7D,KAAK,UAAU,UAAU,CACvB,CAAW,EACX,QAAgB,EAChB,GAAW,EACX,UAAmB;IAEnB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAChF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC;YAC7C,SAAS;QACX,CAAC;QACD,0EAA0E;QAC1E,4BAA4B;QAC5B,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QACzF,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,OAAO;IACd,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;AAChC,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,IAAY;IAChC,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACnD,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,CAAW,EAAE,GAAW;IACrD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,iCAAiC,EAAE;QAC7D,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,qBAAqB,EAAE,IAAI,EAAE,aAAa,EAAE;QACxE,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,uCAAuC,EAAE;KACtE,CAAC,CAAC;IAEH,IAAI,IAAY,CAAC;IACjB,IAAI,KAAa,CAAC;IAClB,IAAI,QAAgB,CAAC;IACrB,IAAI,WAA+B,CAAC;IAEpC,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACxB,IAAI,GAAG,OAAO,CACZ,GAAG,EACH,MAAM,CAAC,CAAC,GAAG,CAAC,sBAAsB,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAC/D,CAAC;QACF,KAAK,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;QACxD,QAAQ,GAAG,MAAM,cAAc,CAAC,CAAC,CAAC,CAAC;QACnC,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,gBAAgB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;QACnG,OAAO,CAAC,GAAG,CACT,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EACd,2DAA2D,EAC3D,qGAAqG,CACtG,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,MAAM,UAAU,CAAC,CAAC,EAAE,sBAAsB,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;QACtE,KAAK,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACtE,QAAQ,GAAG,MAAM,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QAClD,6EAA6E;QAC7E,2EAA2E;QAC3E,0EAA0E;QAC1E,oCAAoC;QACpC,WAAW,GAAG,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,uCAAuC,CAAC,CAAC,IAAI,SAAS,CAAC;IAC1F,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,KAAK,GAAG,EAAE,CAAC,CAAC;IAEhF,OAAO;QACL,IAAI,EAAE,kBAAkB;QACxB,KAAK;QACL,OAAO,EAAE;YACP,cAAc,EAAE,MAAM,MAAM,CAAC,IAAI,CAAC;YAClC,gBAAgB,EAAE,QAAQ;YAC1B,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,WAAW,IAAI,QAAQ;SACrC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,UAAU,CAAC,IAAY;IACpC,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC;QACzF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACxD,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,4EAA4E;IAC9E,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,CAAW;IACvC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,SAAS,CAAC,sCAAsC,CAAC,CAAC;QACxE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC,CAAC;YACjE,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QACrD,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC,CAAC;YACjD,SAAS;QACX,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;AAChD,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,CAAW;IACjC,OAAO,CAAC,GAAG,CACT,EAAE,CAAC,GAAG,CAAC,kFAAkF,CAAC,CAC3F,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC,CAAC;IAC9E,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC3D,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,6BAA6B,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9E,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,KAAK,GAAG,EAAE,EAAE,IAAI,IAAI,KAAK,IAAI,EAAE,EAAE,KAAK,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACnG,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,IAK/B;IACC,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,uGAAuG,CACxG,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,SAAS,EAAE;YACpB,aAAa;YACb,YAAY;YACZ,QAAQ;YACR,WAAW;YACX,IAAI,CAAC,IAAI;YACT,QAAQ;YACR,IAAI,CAAC,KAAK;YACV,SAAS;YACT,KAAK;YACL,UAAU;YACV,MAAM;YACN,yEAAyE;YACzE,2CAA2C;YAC3C,WAAW;YACX,OAAO;YACP,YAAY;YACZ,IAAI,CAAC,QAAQ;YACb,gEAAgE;YAChE,UAAU;YACV,IAAI,CAAC,QAAQ;YACb,QAAQ;YACR,IAAI,CAAC,KAAK;SACX,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAI,GAA4C,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;QAC7E,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,IAAK,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,CAAW,EAAE,GAAW;IACjD,OAAO,CAAC,GAAG,CACT,EAAE,CAAC,GAAG,CACJ,kFAAkF;QAChF,iFAAiF;QACjF,8DAA8D,CACjE,CACF,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,CAAC,EAAE,oCAAoC,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;IAExF,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,gEAAgE,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,MAAM,CAAC,OAAO,iBAAiB,CAAC,CAAC;QACvE,iFAAiF;QACjF,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC,CAAC;QAC5E,IAAI,MAAM,CAAC,QAAQ;YAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC,CAAC;QAC7E,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAC3E,OAAO;YACL,IAAI,EAAE,eAAe;YACrB,KAAK,EAAE,QAAQ;YACf,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE;SAC7E,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,SAAS,CAAC,oCAAoC,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC,CAAC;IAC5E,OAAO;QACL,IAAI,EAAE,eAAe;QACrB,KAAK;QACL,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE;KACrD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,CAAW,EAAE,GAAW;IAChD,OAAO,CAAC,GAAG,CACT,EAAE,CAAC,GAAG,CAAC,qFAAqF,CAAC,CAC9F,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,CAAC,EAAE,8BAA8B,EAAE,GAAG,CAAC,CAAC;IACtE,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChE,OAAO;QACL,IAAI,EAAE,0BAA0B;QAChC,KAAK;QACL,OAAO,EAAE,EAAE,aAAa,EAAE,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE;KAC/C,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,CAAW,EAAE,GAAW;IAC/C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,qFAAqF,CAAC,CAAC,CAAC;IAC3G,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,CAAC,EAAE,0BAA0B,EAAE,GAAG,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,WAAW,KAAK,EAAE,EAAE,CAAC,CAAC;IACpE,OAAO;QACL,IAAI,EAAE,aAAa;QACnB,KAAK;QACL,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE;KAC3D,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,CAAW,EAAE,GAAW;IACxD,OAAO,CAAC,GAAG,CACT,EAAE,CAAC,GAAG,CAAC,+EAA+E,CAAC,CACxF,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,CAAC,EAAE,mCAAmC,EAAE,GAAG,CAAC,CAAC;IAC3E,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChE,OAAO;QACL,IAAI,EAAE,sBAAsB;QAC5B,KAAK;QACL,OAAO,EAAE,EAAE,kBAAkB,EAAE,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE;KAC9D,CAAC;AACJ,CAAC"}

package/dist/commands/credentials.d.ts

@@ -0,0 +1,3 @@
+import type { Command } from 'commander';
+export declare function registerCredentialCommands(program: Command): void;
+//# sourceMappingURL=credentials.d.ts.map

package/dist/commands/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/commands/credentials.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAgIzC,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAkMjE"}

package/dist/commands/credentials.js

@@ -0,0 +1,249 @@
+import { readFile } from 'node:fs/promises';
+import { looksLikeZip, readEasCertificateZip } from '../eas-credentials-zip.js';
+import pc from 'picocolors';
+import { AtlasApiError, apiRequest } from '../client.js';
+import { reportProject } from '../project-hint.js';
+import { runCredentialsWizard } from './credentials-wizard.js';
+import { loadConfig, resolveProject } from '../config.js';
+import { withPrompter } from '../prompt.js';
+const b64 = async (path) => (await readFile(path)).toString('base64');
+async function requireAuth() {
+    const config = await loadConfig();
+    if (!config.token)
+        throw new Error('Not logged in. Run `buildatlas login` first.');
+    return config;
+}
+function fail(err) {
+    const message = err instanceof AtlasApiError ? `${err.message} (${err.code})` : err.message;
+    console.error(pc.red('✖'), message);
+    process.exitCode = 1;
+}
+/**
+ * Builds the payload for each credential kind.
+ *
+ * Passwords are prompted for rather than taken as flags, so they never land in
+ * shell history. File contents are base64-encoded client-side; the API encrypts
+ * them into the vault and no endpoint ever returns them again.
+ */
+async function buildPayload(kind, opts, ask) {
+    switch (kind) {
+        case 'ios_dist_cert': {
+            if (!opts.file)
+                throw new Error('--file <dist.p12 or DistCert_*.zip> is required');
+            // `eas credentials` downloads a zip holding the .p12 and its generated
+            // password. Reading both beats asking someone to transcribe 24 characters,
+            // which fails as a keychain error mid-build rather than as "wrong password".
+            if (looksLikeZip(opts.file)) {
+                const bundle = await readEasCertificateZip(opts.file);
+                if (bundle) {
+                    console.log(pc.dim(`  found ${bundle.p12Name} in the archive`));
+                    const password = bundle.password ?? (await ask('.p12 password: '));
+                    if (bundle.password)
+                        console.log(pc.dim('  using the password from the archive'));
+                    return { p12Base64: bundle.p12.toString('base64'), password };
+                }
+                throw new Error(`${opts.file} is a zip but holds no .p12. Point --file at the certificate itself.`);
+            }
+            return { p12Base64: await b64(opts.file), password: await ask('.p12 password: ') };
+        }
+        case 'ios_provisioning_profile': {
+            if (!opts.file)
+                throw new Error('--file <profile.mobileprovision> is required');
+            return { profileBase64: await b64(opts.file) };
+        }
+        case 'android_keystore': {
+            if (!opts.file)
+                throw new Error('--file <release.jks> is required for android_keystore');
+            const keyAlias = opts.alias ?? (await ask('key alias: '));
+            const keystorePassword = await ask('keystore password: ');
+            const keyPassword = (await ask('key password (blank = same as keystore): ')) || keystorePassword;
+            return { keystoreBase64: await b64(opts.file), keystorePassword, keyAlias, keyPassword };
+        }
+        case 'asc_api_key': {
+            if (!opts.file)
+                throw new Error('--file <AuthKey_XXX.p8> is required for asc_api_key');
+            return {
+                p8Base64: await b64(opts.file),
+                keyId: opts.keyId ?? (await ask('App Store Connect key id: ')),
+                issuerId: opts.issuerId ?? (await ask('issuer id: ')),
+            };
+        }
+        case 'play_service_account': {
+            if (!opts.file)
+                throw new Error('--file <service-account.json> is required');
+            return { serviceAccountJson: await readFile(opts.file, 'utf8') };
+        }
+        case 'expo_token':
+            throw new Error('Expo tokens moved to `buildatlas expo-tokens add` — they are usually shared by every project, which a per-project credential cannot express.');
+        default:
+            throw new Error(`Unknown credential kind "${kind}"`);
+    }
+}
+/**
+ * Renders a credential list. Shared rows are labelled, because "which certificate
+ * will sign this" is the question the list exists to answer.
+ */
+function printCredentials(rows) {
+    if (!rows.length) {
+        console.log(pc.dim('No credentials stored.'));
+        return;
+    }
+    for (const row of rows) {
+        const expiry = row.expired
+            ? pc.red('EXPIRED')
+            : row.expiresInDays === null
+                ? pc.dim('no expiry')
+                : row.expiresInDays < 30
+                    ? pc.yellow(`expires in ${row.expiresInDays}d`)
+                    : pc.dim(`expires in ${row.expiresInDays}d`);
+        const state = row.revokedAt ? pc.dim(' [revoked]') : '';
+        const scope = row.projectId === null ? pc.cyan(' [shared]') : '';
+        console.log(`${row.kind.padEnd(26)} ${row.label.padEnd(24)} ${expiry}${state}${scope}`);
+        if (row.meta && Object.keys(row.meta).length) {
+            console.log(pc.dim(`  ${JSON.stringify(row.meta)}`));
+        }
+    }
+}
+export function registerCredentialCommands(program) {
+    const credentials = program
+        .command('credentials')
+        .description('Manage signing credentials stored in the BuildAtlas vault');
+    credentials
+        .command('list')
+        .description('List stored credentials (metadata only — values are never returned)')
+        .option('--project <slug>', 'Project slug (default: $BUILDATLAS_PROJECT, else app.json)')
+        .option('--account', 'Only the credentials shared by every project')
+        .action(async (opts) => {
+        try {
+            const config = await requireAuth();
+            if (opts.account) {
+                const { credentials: rows } = await apiRequest(config, '/credentials', { token: config.token });
+                printCredentials(rows);
+                return;
+            }
+            const resolved = await resolveProject(opts.project);
+            reportProject(resolved);
+            const slug = resolved.slug;
+            const { credentials: rows } = await apiRequest(config, `/projects/${slug}/credentials`, { token: config.token });
+            printCredentials(rows);
+        }
+        catch (err) {
+            fail(err);
+        }
+    });
+    credentials
+        .command('add')
+        .description('Upload a credential into the vault')
+        // Not required: omitting it starts the interactive wizard. The flags remain
+        // the path CI uses, where prompting would hang.
+        .option('-k, --kind <kind>', 'ios_dist_cert | ios_provisioning_profile | android_keystore | asc_api_key | play_service_account. Omit to be asked.')
+        .option('-f, --file <path>', 'Path to the credential file')
+        .option('-l, --label <label>', 'Human-readable label')
+        .option('--alias <alias>', 'Keystore key alias')
+        .option('--key-id <id>', 'App Store Connect key id')
+        .option('--issuer-id <id>', 'App Store Connect issuer id')
+        .option('--project <slug>', 'Project slug (default: $BUILDATLAS_PROJECT, else app.json)')
+        .option('--account', 'Share with every project. Only for a distribution certificate, ASC key or Play service account.')
+        .action(async (opts) => {
+        try {
+            const config = await requireAuth();
+            // An account-level credential belongs to no project, so do not resolve
+            // one — inferring a slug we then ignore would only be confusing.
+            const slug = opts.account ? undefined : await (async () => {
+                const resolved = await resolveProject(opts.project);
+                reportProject(resolved);
+                return resolved.slug;
+            })();
+            // Confirm the project exists before doing any work. Otherwise the wizard
+            // generates a keystore, asks for passwords twice, prints "created", and only
+            // then fails with "Project not found" — leaving a real signing key on disk
+            // that was never stored anywhere.
+            if (slug) {
+                await apiRequest(config, `/projects/${slug}`, { token: config.token });
+            }
+            const entry = await withPrompter(async (prompter) => {
+                if (!opts.kind) {
+                    return runCredentialsWizard(prompter, { dir: process.cwd() });
+                }
+                return {
+                    kind: opts.kind,
+                    label: opts.label ?? opts.kind,
+                    payload: await buildPayload(opts.kind, opts, (q) => prompter.ask(q)),
+                };
+            });
+            const { credential } = await apiRequest(config, slug ? `/projects/${slug}/credentials` : '/credentials', {
+                method: 'POST',
+                token: config.token,
+                body: JSON.stringify({
+                    kind: entry.kind,
+                    label: opts.label ?? entry.label,
+                    payload: entry.payload,
+                }),
+            });
+            console.log(pc.green('✔'), `stored ${credential.kind} (${credential.id.slice(0, 8)})${slug ? '' : pc.cyan(' · shared by every project')}`);
+            if (credential.expiresAt) {
+                console.log(pc.dim(`  expires ${new Date(credential.expiresAt).toDateString()}`));
+            }
+            if (credential.meta && Object.keys(credential.meta).length) {
+                console.log(pc.dim(`  ${JSON.stringify(credential.meta)}`));
+            }
+        }
+        catch (err) {
+            fail(err);
+        }
+    });
+    credentials
+        .command('revoke <credentialId>')
+        .description('Revoke a credential (kept for audit, no longer used by builds)')
+        .option('--project <slug>', 'Project slug (default: $BUILDATLAS_PROJECT, else app.json)')
+        .action(async (credentialId, opts) => {
+        try {
+            const config = await requireAuth();
+            const resolved = await resolveProject(opts.project);
+            reportProject(resolved);
+            const slug = resolved.slug;
+            await apiRequest(config, `/projects/${slug}/credentials/${credentialId}`, {
+                method: 'DELETE',
+                token: config.token,
+            });
+            console.log(pc.green('✔'), 'revoked');
+        }
+        catch (err) {
+            fail(err);
+        }
+    });
+    credentials
+        .command('set-env <key>')
+        .description('Store an encrypted environment variable for builds')
+        .option('--value <value>', 'Value (avoid: prefer the prompt so it stays out of shell history)')
+        // Repeatable, because one value usually belongs to several profiles and the
+        // server models it as a list. Omit for "every profile".
+        .option('--profile <profile>', 'Build profile this applies to; repeat for several (default: all profiles)', (value, previous = []) => [...previous, value])
+        .option('--plaintext', 'Store readable, for values that are not secret (e.g. an API base URL)')
+        .option('--project <slug>', 'Project slug (default: $BUILDATLAS_PROJECT, else app.json)')
+        .action(async (key, opts) => {
+        try {
+            const config = await requireAuth();
+            const resolved = await resolveProject(opts.project);
+            reportProject(resolved);
+            const slug = resolved.slug;
+            const value = opts.value ?? (await withPrompter((prompter) => prompter.ask(`value for ${key}: `)));
+            const profiles = opts.profile ?? [];
+            await apiRequest(config, `/projects/${slug}/env`, {
+                method: 'PUT',
+                token: config.token,
+                body: JSON.stringify({
+                    key,
+                    value,
+                    profiles,
+                    visibility: opts.plaintext ? 'plaintext' : 'secret',
+                }),
+            });
+            console.log(pc.green('✔'), `${key} stored for ${profiles.length ? profiles.join(', ') : 'all profiles'}`);
+        }
+        catch (err) {
+            fail(err);
+        }
+    });
+}
+//# sourceMappingURL=credentials.js.map

package/dist/commands/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/commands/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAEhF,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAiB,MAAM,cAAc,CAAC;AAe3D,MAAM,GAAG,GAAG,KAAK,EAAE,IAAY,EAAE,EAAE,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAE9E,KAAK,UAAU,WAAW;IACxB,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;IAClC,IAAI,CAAC,MAAM,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IACnF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,IAAI,CAAC,GAAY;IACxB,MAAM,OAAO,GACX,GAAG,YAAY,aAAa,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,OAAO,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAE,GAAa,CAAC,OAAO,CAAC;IACzF,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;IACpC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,YAAY,CACzB,IAAY,EACZ,IAA0F,EAC1F,GAA0C;IAE1C,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,eAAe,EAAE,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;YAEnF,uEAAuE;YACvE,2EAA2E;YAC3E,6EAA6E;YAC7E,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5B,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACtD,IAAI,MAAM,EAAE,CAAC;oBACX,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,WAAW,MAAM,CAAC,OAAO,iBAAiB,CAAC,CAAC,CAAC;oBAChE,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;oBACnE,IAAI,MAAM,CAAC,QAAQ;wBAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC,CAAC;oBAClF,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,CAAC;gBAChE,CAAC;gBACD,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,CAAC,IAAI,sEAAsE,CACnF,CAAC;YACJ,CAAC;YAED,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,GAAG,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACrF,CAAC;QACD,KAAK,0BAA0B,EAAE,CAAC;YAChC,IAAI,CAAC,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;YAChF,OAAO,EAAE,aAAa,EAAE,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACjD,CAAC;QACD,KAAK,kBAAkB,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;YACzF,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;YAC1D,MAAM,gBAAgB,GAAG,MAAM,GAAG,CAAC,qBAAqB,CAAC,CAAC;YAC1D,MAAM,WAAW,GAAG,CAAC,MAAM,GAAG,CAAC,2CAA2C,CAAC,CAAC,IAAI,gBAAgB,CAAC;YACjG,OAAO,EAAE,cAAc,EAAE,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,gBAAgB,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;QAC3F,CAAC;QACD,KAAK,aAAa,EAAE,CAAC;YACnB,IAAI,CAAC,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;YACvF,OAAO;gBACL,QAAQ,EAAE,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC9B,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC,4BAA4B,CAAC,CAAC;gBAC9D,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,GAAG,CAAC,aAAa,CAAC,CAAC;aACtD,CAAC;QACJ,CAAC;QACD,KAAK,sBAAsB,EAAE,CAAC;YAC5B,IAAI,CAAC,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;YAC7E,OAAO,EAAE,kBAAkB,EAAE,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;QACnE,CAAC;QACD,KAAK,YAAY;YACf,MAAM,IAAI,KAAK,CACb,8IAA8I,CAC/I,CAAC;QACJ;YACE,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,GAAG,CAAC,CAAC;IACzD,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,IAAqB;IAC7C,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC,CAAC;QAC9C,OAAO;IACT,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO;YACxB,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC;YACnB,CAAC,CAAC,GAAG,CAAC,aAAa,KAAK,IAAI;gBAC1B,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC;gBACrB,CAAC,CAAC,GAAG,CAAC,aAAa,GAAG,EAAE;oBACtB,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,cAAc,GAAG,CAAC,aAAa,GAAG,CAAC;oBAC/C,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,cAAc,GAAG,CAAC,aAAa,GAAG,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,MAAM,KAAK,GAAG,GAAG,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,MAAM,GAAG,KAAK,GAAG,KAAK,EAAE,CAAC,CAAC;QACxF,IAAI,GAAG,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,OAAgB;IACzD,MAAM,WAAW,GAAG,OAAO;SACxB,OAAO,CAAC,aAAa,CAAC;SACtB,WAAW,CAAC,2DAA2D,CAAC,CAAC;IAE5E,WAAW;SACR,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,qEAAqE,CAAC;SAClF,MAAM,CAAC,kBAAkB,EAAE,4DAA4D,CAAC;SACxF,MAAM,CAAC,WAAW,EAAE,8CAA8C,CAAC;SACnE,MAAM,CAAC,KAAK,EAAE,IAA6C,EAAE,EAAE;QAC9D,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,WAAW,EAAE,CAAC;YACnC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACjB,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,MAAM,UAAU,CAC5C,MAAM,EACN,cAAc,EACd,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CACxB,CAAC;gBACF,gBAAgB,CAAC,IAAI,CAAC,CAAC;gBACvB,OAAO;YACT,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACpD,aAAa,CAAC,QAAQ,CAAC,CAAC;YACxB,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;YAE3B,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,MAAM,UAAU,CAC5C,MAAM,EACN,aAAa,IAAI,cAAc,EAC/B,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CACxB,CAAC;YAEF,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,WAAW;SACR,OAAO,CAAC,KAAK,CAAC;SACd,WAAW,CAAC,oCAAoC,CAAC;QAClD,4EAA4E;QAC5E,gDAAgD;SAC/C,MAAM,CACL,mBAAmB,EACnB,qHAAqH,CACtH;SACA,MAAM,CAAC,mBAAmB,EAAE,6BAA6B,CAAC;SAC1D,MAAM,CAAC,qBAAqB,EAAE,sBAAsB,CAAC;SACrD,MAAM,CAAC,iBAAiB,EAAE,oBAAoB,CAAC;SAC/C,MAAM,CAAC,eAAe,EAAE,0BAA0B,CAAC;SACnD,MAAM,CAAC,kBAAkB,EAAE,6BAA6B,CAAC;SACzD,MAAM,CAAC,kBAAkB,EAAE,4DAA4D,CAAC;SACxF,MAAM,CACL,WAAW,EACX,iGAAiG,CAClG;SACA,MAAM,CACL,KAAK,EAAE,IAUN,EAAE,EAAE;QACH,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,WAAW,EAAE,CAAC;YACnC,uEAAuE;YACvE,iEAAiE;YACjE,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;gBACxD,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACpD,aAAa,CAAC,QAAQ,CAAC,CAAC;gBACxB,OAAO,QAAQ,CAAC,IAAI,CAAC;YACvB,CAAC,CAAC,EAAE,CAAC;YAEL,yEAAyE;YACzE,6EAA6E;YAC7E,2EAA2E;YAC3E,kCAAkC;YAClC,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,UAAU,CAAC,MAAM,EAAE,aAAa,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;YACzE,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,QAAkB,EAAE,EAAE;gBAC5D,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;oBACf,OAAO,oBAAoB,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBAChE,CAAC;gBACD,OAAO;oBACL,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI;oBAC9B,OAAO,EAAE,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;iBACrE,CAAC;YACJ,CAAC,CAAC,CAAC;YAEH,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,UAAU,CACrC,MAAM,EACN,IAAI,CAAC,CAAC,CAAC,aAAa,IAAI,cAAc,CAAC,CAAC,CAAC,cAAc,EACvD;gBACE,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK;oBAChC,OAAO,EAAE,KAAK,CAAC,OAAO;iBACvB,CAAC;aACH,CACF,CAAC;YAEF,OAAO,CAAC,GAAG,CACT,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,EACb,UAAU,UAAU,CAAC,IAAI,KAAK,UAAU,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,4BAA4B,CAAC,EAAE,CAC/G,CAAC;YACF,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;gBACzB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,aAAa,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC;YACpF,CAAC;YACD,IAAI,UAAU,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;gBAC3D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC;IACH,CAAC,CACF,CAAC;IAEJ,WAAW;SACR,OAAO,CAAC,uBAAuB,CAAC;SAChC,WAAW,CAAC,gEAAgE,CAAC;SAC7E,MAAM,CAAC,kBAAkB,EAAE,4DAA4D,CAAC;SACxF,MAAM,CAAC,KAAK,EAAE,YAAoB,EAAE,IAA0B,EAAE,EAAE;QACjE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,WAAW,EAAE,CAAC;YACnC,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACpD,aAAa,CAAC,QAAQ,CAAC,CAAC;YACxB,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;YAC3B,MAAM,UAAU,CAAC,MAAM,EAAE,aAAa,IAAI,gBAAgB,YAAY,EAAE,EAAE;gBACxE,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,MAAM,CAAC,KAAK;aACpB,CAAC,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,WAAW;SACR,OAAO,CAAC,eAAe,CAAC;SACxB,WAAW,CAAC,oDAAoD,CAAC;SACjE,MAAM,CAAC,iBAAiB,EAAE,mEAAmE,CAAC;QAC/F,4EAA4E;QAC5E,wDAAwD;SACvD,MAAM,CACL,qBAAqB,EACrB,2EAA2E,EAC3E,CAAC,KAAa,EAAE,QAAQ,GAAa,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,QAAQ,EAAE,KAAK,CAAC,CACjE;SACA,MAAM,CAAC,aAAa,EAAE,uEAAuE,CAAC;SAC9F,MAAM,CAAC,kBAAkB,EAAE,4DAA4D,CAAC;SACxF,MAAM,CACL,KAAK,EACH,GAAW,EACX,IAAmF,EACnF,EAAE;QACF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,WAAW,EAAE,CAAC;YACnC,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACpD,aAAa,CAAC,QAAQ,CAAC,CAAC;YACxB,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;YAE3B,MAAM,KAAK,GACT,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,YAAY,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACvF,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;YACpC,MAAM,UAAU,CAAC,MAAM,EAAE,aAAa,IAAI,MAAM,EAAE;gBAChD,MAAM,EAAE,KAAK;gBACb,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,GAAG;oBACH,KAAK;oBACL,QAAQ;oBACR,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ;iBACpD,CAAC;aACH,CAAC,CAAC;YACH,OAAO,CAAC,GAAG,CACT,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,EACb,GAAG,GAAG,eAAe,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAC9E,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC;IACH,CAAC,CACF,CAAC;AACN,CAAC"}

package/dist/commands/env.d.ts

@@ -0,0 +1,37 @@
+import type { Command } from 'commander';
+import { type AtlasConfig } from '../config.ts';
+/**
+ * Copies a profile's `eas.json` env block into the project's BuildAtlas env
+ * store. Add-only by default: a value someone already set (or edited) in the
+ * dashboard is never silently replaced by whatever a committed eas.json says.
+ *
+ * Non-fatal by design at the call sites that treat this as a side effect (e.g.
+ * `buildatlas build --local`) — the build's own env still comes correctly from
+ * the worker merging eas.json directly (see the worker's `inject_env` phase),
+ * so a failure here (e.g. a non-admin token, since setting env requires admin)
+ * should never block a build.
+ */
+export declare function seedEnvFromEasJson(params: {
+    config: Pick<AtlasConfig, 'apiUrl' | 'token'>;
+    slug: string;
+    projectDir: string;
+    profile: string;
+    overwrite: boolean;
+}): Promise<{
+    added: string[];
+    skipped: string[];
+}>;
+/**
+ * Parses a `.env` file.
+ *
+ * Deliberately small: `KEY=value`, `#` comments, blank lines, and quotes stripped
+ * from a fully quoted value. No interpolation, no `export` prefixes, no multiline —
+ * a file that needs those is doing something this importer should not silently
+ * half-understand.
+ *
+ * Values are taken verbatim otherwise, including `=` inside them, because URLs and
+ * base64 both contain it.
+ */
+export declare function parseDotEnv(text: string): Record<string, string>;
+export declare function registerEnvCommand(program: Command): void;
+//# sourceMappingURL=env.d.ts.map

package/dist/commands/env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/commands/env.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGzC,OAAO,EAAE,KAAK,WAAW,EAA8B,MAAM,cAAc,CAAC;AAQ5E;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CAAC,MAAM,EAAE;IAC/C,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,GAAG,OAAO,CAAC,CAAC;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;CACpB,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAiClD;AAGD;;;;;;;;;;GAUG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAsBhE;AAyDD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAqGzD"}