@ship-et/buildatlas-cli 0.14.0 → 0.14.2-beta

package/dist/commands/migrate/build-numbers.d.ts

@@ -1,5 +1,6 @@
 import type { AuthedConfig } from './auth.ts';
 import { type ExpoAuth } from './eas-client.ts';
+import type { ProjectReport } from './report.ts';
 /**
  * Points BuildAtlas's build counters past whatever the stores have already
  * accepted from Expo, so the first BuildAtlas build doesn't collide with a
@@ -8,5 +9,5 @@ import { type ExpoAuth } from './eas-client.ts';
 export declare function continueBuildNumbers(config: AuthedConfig, slug: string, auth: ExpoAuth, appId: string, local: {
     bundleIdentifier?: string;
     androidPackage?: string;
-} | undefined): Promise<void>;
+} | undefined, report: ProjectReport): Promise<void>;
 //# sourceMappingURL=build-numbers.d.ts.map

package/dist/commands/migrate/build-numbers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build-numbers.d.ts","sourceRoot":"","sources":["../../../src/commands/migrate/build-numbers.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,KAAK,QAAQ,EAAyB,MAAM,iBAAiB,CAAC;AAGvE;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,YAAY,EACpB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,QAAQ,EACd,KAAK,EAAE,MAAM,EACb,KAAK,EAAE;IAAE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,GACxE,OAAO,CAAC,IAAI,CAAC,CA6Bf"}
+{"version":3,"file":"build-numbers.d.ts","sourceRoot":"","sources":["../../../src/commands/migrate/build-numbers.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,KAAK,QAAQ,EAAyB,MAAM,iBAAiB,CAAC;AACvE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAGjD;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,YAAY,EACpB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,QAAQ,EACd,KAAK,EAAE,MAAM,EACb,KAAK,EAAE;IAAE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,EACzE,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,IAAI,CAAC,CAoDf"}

package/dist/commands/migrate/build-numbers.js

@@ -1,4 +1,3 @@
-import pc from 'picocolors';
 import { apiRequest } from '../../client.js';
 import { getLatestBuildVersion } from './eas-client.js';
 import { withRetry } from './retry.js';
@@ -7,28 +6,49 @@ import { withRetry } from './retry.js';
  * accepted from Expo, so the first BuildAtlas build doesn't collide with a
  * version number Apple/Google have already seen.
  */
-export async function continueBuildNumbers(config, slug, auth, appId, local) {
+export async function continueBuildNumbers(config, slug, auth, appId, local, report) {
     const platforms = [
         { platform: 'ios', applicationIdentifier: local?.bundleIdentifier },
         { platform: 'android', applicationIdentifier: local?.androidPackage },
     ];
+    // What BuildAtlas will hand out next. Read first because the API only ever
+    // raises a counter: on a rerun after BuildAtlas has built past Expo, writing
+    // Expo's number would be refused, and that is not a failure — it is done.
+    const current = await withRetry('reading BuildAtlas build numbers', () => apiRequest(config, `/projects/${slug}/build-numbers`, {
+        token: config.token,
+    }));
     for (const { platform, applicationIdentifier } of platforms) {
         if (!applicationIdentifier)
             continue;
-        const latest = await withRetry(`checking Expo's ${platform} build number`, () => getLatestBuildVersion(auth, appId, platform, applicationIdentifier));
-        if (latest === undefined)
+        const stepLabel = `${platform} build number`;
+        // Wrapped so "Expo has no build" and "the check failed" stay distinguishable.
+        const checked = await withRetry(`checking Expo's ${platform} build number`, async () => ({
+            latest: await getLatestBuildVersion(auth, appId, platform, applicationIdentifier),
+        }));
+        if (!checked) {
+            report.failed(stepLabel, "could not read Expo's build number");
+            continue;
+        }
+        const { latest } = checked;
+        if (latest === undefined) {
+            report.skipped(stepLabel, 'no build on Expo yet');
             continue;
+        }
         const nextBuildNumber = latest + 1;
+        if (current && current[platform] >= nextBuildNumber) {
+            report.skipped(stepLabel, `already continues from ${current[platform]} (Expo was at ${latest})`);
+            continue;
+        }
         const synced = await withRetry(`syncing ${platform} build number`, () => apiRequest(config, `/projects/${slug}/build-number`, {
             method: 'PATCH',
             token: config.token,
             body: JSON.stringify({ platform, nextBuildNumber }),
         }));
         if (synced === undefined) {
-            console.log(pc.dim(`  skipped — the ${platform} build number was not updated.`));
+            report.failed(stepLabel, `not updated — set it with \`buildatlas projects set-build-number ${nextBuildNumber}\``);
             continue;
         }
-        console.log(pc.dim(`  ${platform} build number will continue from ${nextBuildNumber} (Expo was at ${latest})`));
+        report.done(stepLabel, `continues from ${nextBuildNumber} (Expo was at ${latest})`);
     }
 }
 //# sourceMappingURL=build-numbers.js.map

package/dist/commands/migrate/build-numbers.js.map

@@ -1 +1 @@
-{"version":3,"file":"build-numbers.js","sourceRoot":"","sources":["../../../src/commands/migrate/build-numbers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE7C,OAAO,EAAiB,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACvE,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAoB,EACpB,IAAY,EACZ,IAAc,EACd,KAAa,EACb,KAAyE;IAEzE,MAAM,SAAS,GAAsE;QACnF,EAAE,QAAQ,EAAE,KAAK,EAAE,qBAAqB,EAAE,KAAK,EAAE,gBAAgB,EAAE;QACnE,EAAE,QAAQ,EAAE,SAAS,EAAE,qBAAqB,EAAE,KAAK,EAAE,cAAc,EAAE;KACtE,CAAC;IAEF,KAAK,MAAM,EAAE,QAAQ,EAAE,qBAAqB,EAAE,IAAI,SAAS,EAAE,CAAC;QAC5D,IAAI,CAAC,qBAAqB;YAAE,SAAS;QAErC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,mBAAmB,QAAQ,eAAe,EAAE,GAAG,EAAE,CAC9E,qBAAqB,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,qBAAqB,CAAC,CACpE,CAAC;QACF,IAAI,MAAM,KAAK,SAAS;YAAE,SAAS;QAEnC,MAAM,eAAe,GAAG,MAAM,GAAG,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,WAAW,QAAQ,eAAe,EAAE,GAAG,EAAE,CACtE,UAAU,CAAC,MAAM,EAAE,aAAa,IAAI,eAAe,EAAE;YACnD,MAAM,EAAE,OAAO;YACf,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;SACpD,CAAC,CACH,CAAC;QACF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,mBAAmB,QAAQ,gCAAgC,CAAC,CAAC,CAAC;YACjF,SAAS;QACX,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,QAAQ,oCAAoC,eAAe,iBAAiB,MAAM,GAAG,CAAC,CAAC,CAAC;IAClH,CAAC;AACH,CAAC"}
+{"version":3,"file":"build-numbers.js","sourceRoot":"","sources":["../../../src/commands/migrate/build-numbers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE7C,OAAO,EAAiB,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAEvE,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAoB,EACpB,IAAY,EACZ,IAAc,EACd,KAAa,EACb,KAAyE,EACzE,MAAqB;IAErB,MAAM,SAAS,GAAsE;QACnF,EAAE,QAAQ,EAAE,KAAK,EAAE,qBAAqB,EAAE,KAAK,EAAE,gBAAgB,EAAE;QACnE,EAAE,QAAQ,EAAE,SAAS,EAAE,qBAAqB,EAAE,KAAK,EAAE,cAAc,EAAE;KACtE,CAAC;IAEF,2EAA2E;IAC3E,6EAA6E;IAC7E,0EAA0E;IAC1E,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,kCAAkC,EAAE,GAAG,EAAE,CACvE,UAAU,CAAmC,MAAM,EAAE,aAAa,IAAI,gBAAgB,EAAE;QACtF,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC,CACH,CAAC;IAEF,KAAK,MAAM,EAAE,QAAQ,EAAE,qBAAqB,EAAE,IAAI,SAAS,EAAE,CAAC;QAC5D,IAAI,CAAC,qBAAqB;YAAE,SAAS;QACrC,MAAM,SAAS,GAAG,GAAG,QAAQ,eAAe,CAAC;QAE7C,8EAA8E;QAC9E,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,mBAAmB,QAAQ,eAAe,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;YACvF,MAAM,EAAE,MAAM,qBAAqB,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,qBAAqB,CAAC;SAClF,CAAC,CAAC,CAAC;QACJ,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,oCAAoC,CAAC,CAAC;YAC/D,SAAS;QACX,CAAC;QACD,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QAC3B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;YAClD,SAAS;QACX,CAAC;QAED,MAAM,eAAe,GAAG,MAAM,GAAG,CAAC,CAAC;QACnC,IAAI,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,eAAe,EAAE,CAAC;YACpD,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,0BAA0B,OAAO,CAAC,QAAQ,CAAC,iBAAiB,MAAM,GAAG,CAAC,CAAC;YACjG,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,WAAW,QAAQ,eAAe,EAAE,GAAG,EAAE,CACtE,UAAU,CAAC,MAAM,EAAE,aAAa,IAAI,eAAe,EAAE;YACnD,MAAM,EAAE,OAAO;YACf,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;SACpD,CAAC,CACH,CAAC;QACF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,oEAAoE,eAAe,IAAI,CAAC,CAAC;YAClH,SAAS;QACX,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,kBAAkB,eAAe,iBAAiB,MAAM,GAAG,CAAC,CAAC;IACtF,CAAC;AACH,CAAC"}

package/dist/commands/migrate/credentials.d.ts

@@ -1,24 +1,26 @@
 import type { AuthedConfig } from './auth.ts';
 import { type ExpoAuth } from './eas-client.ts';
+import type { ProjectReport } from './report.ts';
 /**
- * Pulls the distribution cert + provisioning profile (iOS), keystore
- * (Android), and APNs push key EAS already has for this app and stores them in
- * BuildAtlas's vault, so a migrated project can build immediately instead of
- * needing someone to run `eas credentials` by hand and re-upload the files
- * themselves.
+ * Pulls everything EAS holds for this app into BuildAtlas's vault, so a
+ * migrated project can build and submit immediately instead of needing someone
+ * to run `eas credentials` by hand and re-upload the files themselves:
+ *
+ * - iOS: distribution cert, and a provisioning profile for *every* target —
+ *   the app plus extensions such as OneSignal's notification service extension
+ * - iOS: APNs push key (what OneSignal and every other sender deliver through)
+ * - iOS: App Store Connect API key used for submissions
+ * - Android: upload keystore, and the Play service account used for submissions
  *
  * Runs the same way whether the BuildAtlas project was just created or already
  * existed — `migrate` on a project that is already linked is how someone picks
- * up credentials generated on EAS after the fact, not just a one-time step at
- * creation. What is already in the vault (this project's own row, or a shared
- * one) is left alone rather than re-uploaded, so running this repeatedly does
- * not pile up duplicate rows for the same kind.
+ * up credentials generated on EAS after the fact. What is already in the vault
+ * (this project's own row, or a shared one) is left alone rather than
+ * re-uploaded, so running this repeatedly does not pile up duplicate rows.
  *
- * The push key only covers what EAS itself holds. OneSignal does not read from
- * EAS — if push is delivered through OneSignal, the same .p8 (or the one
- * `buildatlas credentials add` stores after this) still has to be uploaded to
- * OneSignal's own dashboard separately; that step has no EAS equivalent to
- * migrate from.
+ * Not migrated, and reported as such: the FCM V1 key (only Expo's own push
+ * service reads it) and anything OneSignal keeps on its own dashboard, which
+ * EAS has no copy of.
  */
-export declare function migrateCredentials(config: AuthedConfig, slug: string, auth: ExpoAuth, appId: string, appFullName: string): Promise<void>;
+export declare function migrateCredentials(config: AuthedConfig, slug: string, auth: ExpoAuth, appId: string, report: ProjectReport): Promise<void>;
 //# sourceMappingURL=credentials.d.ts.map

package/dist/commands/migrate/credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../../src/commands/migrate/credentials.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,KAAK,QAAQ,EAAqB,MAAM,iBAAiB,CAAC;AAQnE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,YAAY,EACpB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,QAAQ,EACd,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC,CAmEf"}
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../../src/commands/migrate/credentials.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,KAAK,QAAQ,EAA8D,MAAM,iBAAiB,CAAC;AAC5G,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAUjD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,YAAY,EACpB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,QAAQ,EACd,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,IAAI,CAAC,CA4Hf"}

package/dist/commands/migrate/credentials.js

@@ -1,63 +1,102 @@
-import pc from 'picocolors';
 import { apiRequest } from '../../client.js';
-import { getEasCredentials } from './eas-client.js';
+import { getEasCredentials, getEasServiceKeys, mainBundleIdentifier } from './eas-client.js';
 import { withRetry } from './retry.js';
 /**
- * Pulls the distribution cert + provisioning profile (iOS), keystore
- * (Android), and APNs push key EAS already has for this app and stores them in
- * BuildAtlas's vault, so a migrated project can build immediately instead of
- * needing someone to run `eas credentials` by hand and re-upload the files
- * themselves.
+ * Pulls everything EAS holds for this app into BuildAtlas's vault, so a
+ * migrated project can build and submit immediately instead of needing someone
+ * to run `eas credentials` by hand and re-upload the files themselves:
+ *
+ * - iOS: distribution cert, and a provisioning profile for *every* target —
+ *   the app plus extensions such as OneSignal's notification service extension
+ * - iOS: APNs push key (what OneSignal and every other sender deliver through)
+ * - iOS: App Store Connect API key used for submissions
+ * - Android: upload keystore, and the Play service account used for submissions
  *
  * Runs the same way whether the BuildAtlas project was just created or already
  * existed — `migrate` on a project that is already linked is how someone picks
- * up credentials generated on EAS after the fact, not just a one-time step at
- * creation. What is already in the vault (this project's own row, or a shared
- * one) is left alone rather than re-uploaded, so running this repeatedly does
- * not pile up duplicate rows for the same kind.
+ * up credentials generated on EAS after the fact. What is already in the vault
+ * (this project's own row, or a shared one) is left alone rather than
+ * re-uploaded, so running this repeatedly does not pile up duplicate rows.
  *
- * The push key only covers what EAS itself holds. OneSignal does not read from
- * EAS — if push is delivered through OneSignal, the same .p8 (or the one
- * `buildatlas credentials add` stores after this) still has to be uploaded to
- * OneSignal's own dashboard separately; that step has no EAS equivalent to
- * migrate from.
+ * Not migrated, and reported as such: the FCM V1 key (only Expo's own push
+ * service reads it) and anything OneSignal keeps on its own dashboard, which
+ * EAS has no copy of.
  */
-export async function migrateCredentials(config, slug, auth, appId, appFullName) {
+export async function migrateCredentials(config, slug, auth, appId, report) {
     const creds = await withRetry('fetching signing credentials from EAS', () => getEasCredentials(auth, appId));
-    if (!creds?.ios && !creds?.android && !creds?.iosPushKey) {
-        console.log(pc.dim(`  No signing credentials found on EAS for ${appFullName}. If the app has ` +
-            'shipped before, generate them with `eas credentials`, then run ' +
-            `\`buildatlas credentials add --project ${slug}\`.`));
+    if (!creds) {
+        report.failed('signing credentials', 'could not read them from EAS — rerun migrate to try again');
         return;
     }
-    // Already-vaulted kinds — this project's own rows plus whatever it inherits
-    // shared — so a rerun tops up what is missing instead of duplicating what a
-    // build would already find. A failed check (declined retry, no TTY) falls
-    // back to attempting every upload, same as before this existed.
+    // Already-vaulted rows — this project's own plus whatever it inherits shared —
+    // so a rerun tops up what is missing instead of duplicating what a build would
+    // already find. A failed check falls back to attempting every upload.
     const existingList = await withRetry('checking what is already stored', () => apiRequest(config, `/projects/${slug}/credentials`, {
         token: config.token,
     }));
-    const alreadyHave = new Set((existingList?.credentials ?? []).map((row) => row.kind));
-    const label = `migrated from ${appFullName}`;
-    const upload = async (kind, payload) => {
-        if (alreadyHave.has(kind)) {
-            console.log(`  ${pc.dim(`${kind} already in the vault — skipped`)}`);
-            return;
-        }
-        const result = await withRetry(`uploading ${kind}`, () => apiRequest(config, `/projects/${slug}/credentials`, {
+    const existing = (existingList?.credentials ?? []).filter((row) => !row.revokedAt);
+    const haveKind = (kind) => existing.some((row) => row.kind === kind);
+    const haveProfileFor = (bundleId) => existing.some((row) => row.kind === 'ios_provisioning_profile' && row.meta?.appId === bundleId);
+    const label = `migrated from ${report.name}`;
+    const upload = async (kind, payload, stepLabel = kind) => {
+        const result = await withRetry(`uploading ${stepLabel}`, () => apiRequest(config, `/projects/${slug}/credentials`, {
             method: 'POST',
             token: config.token,
             body: JSON.stringify({ kind, label, payload }),
         }));
-        console.log(result !== undefined ? `  ${pc.green('✔')} ${kind}` : `  ${pc.dim(`skipped ${kind}`)}`);
+        if (result === undefined)
+            report.failed(stepLabel, 'upload failed');
+        else
+            report.done(stepLabel);
     };
-    if (creds.ios) {
-        await upload('ios_dist_cert', { p12Base64: creds.ios.p12Base64, password: creds.ios.password ?? '' });
-        if (creds.ios.profileBase64) {
-            await upload('ios_provisioning_profile', { profileBase64: creds.ios.profileBase64 });
+    // iOS --------------------------------------------------------------------
+    if (creds.ios.length === 0) {
+        report.skipped('iOS signing', 'none on EAS');
+    }
+    else {
+        const main = mainBundleIdentifier(creds.ios.map((t) => t.bundleIdentifier));
+        const mainTarget = creds.ios.find((t) => t.bundleIdentifier === main) ?? creds.ios[0];
+        if (haveKind('ios_dist_cert')) {
+            report.skipped('ios_dist_cert', 'already in the vault');
         }
+        else {
+            await upload('ios_dist_cert', { p12Base64: mainTarget.p12Base64, password: mainTarget.password ?? '' });
+        }
+        // Extensions first, the app itself last: the vault hands out the newest
+        // profile when a build can only take one, and that should be the app's.
+        const ordered = [...creds.ios.filter((t) => t !== mainTarget), mainTarget];
+        for (const target of ordered) {
+            const stepLabel = `ios_provisioning_profile (${target.bundleIdentifier})`;
+            if (!target.profileBase64) {
+                report.warn(stepLabel, 'EAS has no App Store profile for this target — add one with `buildatlas credentials add`');
+            }
+            else if (haveProfileFor(target.bundleIdentifier)) {
+                report.skipped(stepLabel, 'already in the vault');
+            }
+            else {
+                await upload('ios_provisioning_profile', { profileBase64: target.profileBase64 }, stepLabel);
+            }
+        }
+    }
+    if (creds.iosPushKey) {
+        if (haveKind('ios_push_key')) {
+            report.skipped('ios_push_key', 'already in the vault');
+        }
+        else {
+            await upload('ios_push_key', { keyId: creds.iosPushKey.keyId, p8Base64: creds.iosPushKey.p8Base64 });
+        }
+    }
+    else if (creds.ios.length) {
+        report.warn('ios_push_key', 'none on EAS — if the app sends push (OneSignal included), add the .p8 with `buildatlas credentials add`');
+    }
+    // Android ----------------------------------------------------------------
+    if (!creds.android) {
+        report.skipped('android_keystore', 'none on EAS');
     }
-    if (creds.android) {
+    else if (haveKind('android_keystore')) {
+        report.skipped('android_keystore', 'already in the vault');
+    }
+    else {
         await upload('android_keystore', {
             keystoreBase64: creds.android.keystoreBase64,
             keystorePassword: creds.android.keystorePassword,
@@ -66,13 +105,39 @@ export async function migrateCredentials(config, slug, auth, appId, appFullName)
             keyPassword: creds.android.keyPassword ?? creds.android.keystorePassword,
         });
     }
-    if (creds.iosPushKey) {
-        await upload('ios_push_key', { keyId: creds.iosPushKey.keyId, p8Base64: creds.iosPushKey.p8Base64 });
+    // Submission and push keys ------------------------------------------------
+    const keys = await withRetry('fetching submission and push keys from EAS', () => getEasServiceKeys(auth, appId));
+    if (!keys) {
+        report.warn('submission keys', 'could not read them from EAS (needs an Admin role on the Expo account)');
+        return;
+    }
+    if (!keys.ascApiKey) {
+        report.skipped('asc_api_key', 'none on EAS');
+    }
+    else if (!keys.ascApiKey.issuerId) {
+        report.warn('asc_api_key', 'EAS has an individual key, which has no issuer id — add a team key with `buildatlas credentials add`');
+    }
+    else if (haveKind('asc_api_key')) {
+        report.skipped('asc_api_key', 'already in the vault');
+    }
+    else {
+        await upload('asc_api_key', {
+            keyId: keys.ascApiKey.keyId,
+            issuerId: keys.ascApiKey.issuerId,
+            p8Base64: keys.ascApiKey.p8Base64,
+        });
+    }
+    if (!keys.playServiceAccountJson) {
+        report.skipped('play_service_account', 'none on EAS');
+    }
+    else if (haveKind('play_service_account')) {
+        report.skipped('play_service_account', 'already in the vault');
+    }
+    else {
+        await upload('play_service_account', { serviceAccountJson: keys.playServiceAccountJson });
     }
-    else if (creds.ios) {
-        console.log(pc.dim('  No APNs push key found on EAS. If this app sends push notifications (including ' +
-            'through OneSignal), generate one with `eas credentials` or add it directly: ' +
-            `\`buildatlas credentials add\` → iOS push notification key.`));
+    if (keys.fcmV1) {
+        report.skipped('FCM V1 key', `${keys.fcmV1.clientEmail} stays on EAS — only Expo's push service reads it; builds and OneSignal do not`);
     }
 }
 //# sourceMappingURL=credentials.js.map

package/dist/commands/migrate/credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../../src/commands/migrate/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE7C,OAAO,EAAiB,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAOvC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAoB,EACpB,IAAY,EACZ,IAAc,EACd,KAAa,EACb,WAAmB;IAEnB,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,uCAAuC,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IAE7G,IAAI,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,OAAO,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC;QACzD,OAAO,CAAC,GAAG,CACT,EAAE,CAAC,GAAG,CACJ,6CAA6C,WAAW,mBAAmB;YACzE,iEAAiE;YACjE,0CAA0C,IAAI,KAAK,CACtD,CACF,CAAC;QACF,OAAO;IACT,CAAC;IAED,4EAA4E;IAC5E,4EAA4E;IAC5E,0EAA0E;IAC1E,gEAAgE;IAChE,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,iCAAiC,EAAE,GAAG,EAAE,CAC3E,UAAU,CAAmC,MAAM,EAAE,aAAa,IAAI,cAAc,EAAE;QACpF,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC,CACH,CAAC;IACF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAkB,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAErG,MAAM,KAAK,GAAG,iBAAiB,WAAW,EAAE,CAAC;IAC7C,MAAM,MAAM,GAAG,KAAK,EAAE,IAAY,EAAE,OAAgC,EAAE,EAAE;QACtE,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,IAAI,iCAAiC,CAAC,EAAE,CAAC,CAAC;YACrE,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,aAAa,IAAI,EAAE,EAAE,GAAG,EAAE,CACvD,UAAU,CAAC,MAAM,EAAE,aAAa,IAAI,cAAc,EAAE;YAClD,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;SAC/C,CAAC,CACH,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;IACtG,CAAC,CAAC;IAEF,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,MAAM,MAAM,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC,CAAC;QACtG,IAAI,KAAK,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;YAC5B,MAAM,MAAM,CAAC,0BAA0B,EAAE,EAAE,aAAa,EAAE,KAAK,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,MAAM,CAAC,kBAAkB,EAAE;YAC/B,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,cAAc;YAC5C,gBAAgB,EAAE,KAAK,CAAC,OAAO,CAAC,gBAAgB;YAChD,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ;YAChC,yEAAyE;YACzE,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,WAAW,IAAI,KAAK,CAAC,OAAO,CAAC,gBAAgB;SACzE,CAAC,CAAC;IACL,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACrB,MAAM,MAAM,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;IACvG,CAAC;SAAM,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;QACrB,OAAO,CAAC,GAAG,CACT,EAAE,CAAC,GAAG,CACJ,mFAAmF;YACjF,8EAA8E;YAC9E,6DAA6D,CAChE,CACF,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../../src/commands/migrate/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE7C,OAAO,EAAiB,iBAAiB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAE5G,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AASvC;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAoB,EACpB,IAAY,EACZ,IAAc,EACd,KAAa,EACb,MAAqB;IAErB,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,uCAAuC,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IAC7G,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,CAAC,MAAM,CAAC,qBAAqB,EAAE,2DAA2D,CAAC,CAAC;QAClG,OAAO;IACT,CAAC;IAED,+EAA+E;IAC/E,+EAA+E;IAC/E,sEAAsE;IACtE,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,iCAAiC,EAAE,GAAG,EAAE,CAC3E,UAAU,CAAmC,MAAM,EAAE,aAAa,IAAI,cAAc,EAAE;QACpF,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC,CACH,CAAC;IACF,MAAM,QAAQ,GAAG,CAAC,YAAY,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACnF,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAC7E,MAAM,cAAc,GAAG,CAAC,QAAgB,EAAE,EAAE,CAC1C,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,0BAA0B,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC;IAElG,MAAM,KAAK,GAAG,iBAAiB,MAAM,CAAC,IAAI,EAAE,CAAC;IAC7C,MAAM,MAAM,GAAG,KAAK,EAAE,IAAY,EAAE,OAAgC,EAAE,SAAS,GAAG,IAAI,EAAE,EAAE;QACxF,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,aAAa,SAAS,EAAE,EAAE,GAAG,EAAE,CAC5D,UAAU,CAAC,MAAM,EAAE,aAAa,IAAI,cAAc,EAAE;YAClD,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;SAC/C,CAAC,CACH,CAAC;QACF,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;;YAC/D,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9B,CAAC,CAAC;IAEF,2EAA2E;IAC3E,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;IAC/C,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAC5E,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,KAAK,IAAI,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC;QAEvF,IAAI,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YAC9B,MAAM,CAAC,OAAO,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAC;QAC1D,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC,CAAC;QAC1G,CAAC;QAED,wEAAwE;QACxE,wEAAwE;QACxE,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,UAAU,CAAC,EAAE,UAAU,CAAC,CAAC;QAC3E,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,SAAS,GAAG,6BAA6B,MAAM,CAAC,gBAAgB,GAAG,CAAC;YAC1E,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;gBAC1B,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,0FAA0F,CAAC,CAAC;YACrH,CAAC;iBAAM,IAAI,cAAc,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACnD,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;YACpD,CAAC;iBAAM,CAAC;gBACN,MAAM,MAAM,CAAC,0BAA0B,EAAE,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,EAAE,SAAS,CAAC,CAAC;YAC/F,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACrB,IAAI,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YAC7B,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,sBAAsB,CAAC,CAAC;QACzD,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;QACvG,CAAC;IACH,CAAC;SAAM,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;QAC5B,MAAM,CAAC,IAAI,CACT,cAAc,EACd,yGAAyG,CAC1G,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACnB,MAAM,CAAC,OAAO,CAAC,kBAAkB,EAAE,aAAa,CAAC,CAAC;IACpD,CAAC;SAAM,IAAI,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACxC,MAAM,CAAC,OAAO,CAAC,kBAAkB,EAAE,sBAAsB,CAAC,CAAC;IAC7D,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,CAAC,kBAAkB,EAAE;YAC/B,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,cAAc;YAC5C,gBAAgB,EAAE,KAAK,CAAC,OAAO,CAAC,gBAAgB;YAChD,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ;YAChC,yEAAyE;YACzE,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,WAAW,IAAI,KAAK,CAAC,OAAO,CAAC,gBAAgB;SACzE,CAAC,CAAC;IACL,CAAC;IAED,4EAA4E;IAC5E,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,4CAA4C,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IACjH,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,wEAAwE,CAAC,CAAC;QACzG,OAAO;IACT,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;IAC/C,CAAC;SAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,sGAAsG,CAAC,CAAC;IACrI,CAAC;SAAM,IAAI,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QACnC,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,sBAAsB,CAAC,CAAC;IACxD,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,CAAC,aAAa,EAAE;YAC1B,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK;YAC3B,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ;YACjC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ;SAClC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC;QACjC,MAAM,CAAC,OAAO,CAAC,sBAAsB,EAAE,aAAa,CAAC,CAAC;IACxD,CAAC;SAAM,IAAI,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAC5C,MAAM,CAAC,OAAO,CAAC,sBAAsB,EAAE,sBAAsB,CAAC,CAAC;IACjE,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,CAAC,sBAAsB,EAAE,EAAE,kBAAkB,EAAE,IAAI,CAAC,sBAAsB,EAAE,CAAC,CAAC;IAC5F,CAAC;IAED,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,OAAO,CACZ,YAAY,EACZ,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,gFAAgF,CAC1G,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/commands/migrate/eas-client.d.ts

@@ -45,7 +45,9 @@ export declare function getAppIdentifiers(auth: ExpoAuth, appId: string): Promis
     bundleIdentifier?: string;
     androidPackage?: string;
 }>;
-export interface EasIosCredentials {
+/** Signing material for one iOS target — the app itself, or one of its extensions. */
+export interface EasIosTarget {
+    bundleIdentifier: string;
     p12Base64: string;
     password?: string;
     profileBase64?: string;
@@ -61,14 +63,24 @@ export interface EasAndroidCredentials {
     keyPassword?: string;
 }
 /**
- * The actual signing material EAS holds for this app — a distribution cert
- * (+ its provisioning profile) for iOS, a keystore for Android, and an APNs
+ * The main app's bundle id out of a set that may include extensions — the one
+ * every other id extends (`com.app` for `com.app.OneSignalNotificationServiceExtension`).
+ * Falls back to the first when nothing nests, which is the single-target case.
+ */
+export declare function mainBundleIdentifier(ids: string[]): string | undefined;
+/**
+ * The actual signing material EAS holds for this app — a distribution cert and
+ * provisioning profile per iOS target, a keystore for Android, and an APNs
  * push key if one was ever generated for push notifications — in the same
  * base64 shape `buildatlas credentials add` already expects (`ios_dist_cert`,
  * `ios_provisioning_profile`, `android_keystore`, `ios_push_key`), so it can be
  * forwarded as-is.
  *
- * Picks the App Store build credentials for iOS (ad-hoc/enterprise/development
+ * Every iOS target, not just the first: an app with a notification service
+ * extension (OneSignal's, for one) has its own bundle id and its own profile on
+ * EAS, and an archive with a target missing its profile fails to export.
+ *
+ * Picks the App Store build credentials per target (ad-hoc/enterprise/development
  * profiles are for internal testing, not what a migrated app should ship with)
  * and whichever Android keystore is marked default. Omits a platform, or the
  * push key, entirely rather than guessing when EAS has never generated one.
@@ -79,10 +91,50 @@ export interface EasAndroidCredentials {
  * worker to warn about when a project looks push-capable but has none stored.
  */
 export declare function getEasCredentials(auth: ExpoAuth, appId: string): Promise<{
-    ios?: EasIosCredentials;
+    ios: EasIosTarget[];
     android?: EasAndroidCredentials;
     iosPushKey?: EasIosPushKey;
 }>;
+export interface EasServiceKeys {
+    /** App Store Connect API key EAS Submit uses. Null issuer = an individual key, which BuildAtlas cannot use. */
+    ascApiKey?: {
+        keyId: string;
+        issuerId: string | null;
+        p8Base64: string;
+    };
+    /** Google service account EAS Submit uses for Play uploads. */
+    playServiceAccountJson?: string;
+    /**
+     * Firebase Cloud Messaging V1 service account, which only Expo's own push
+     * service reads. Reported, not stored: nothing in a build uses it, and
+     * OneSignal or a self-run sender keep their own copy.
+     */
+    fcmV1?: {
+        projectId: string;
+        clientEmail: string;
+    };
+}
+/**
+ * The keys EAS keeps for submitting and push, separate from the signing query
+ * above: reading raw key material needs a higher role on the Expo account, and
+ * a permission error here should not cost the signing credentials too.
+ */
+export declare function getEasServiceKeys(auth: ExpoAuth, appId: string): Promise<EasServiceKeys>;
+export interface EasEnvVar {
+    name: string;
+    /** Null for `SECRET` visibility — EAS never hands those back, to anyone. */
+    value: string | null;
+    environments: string[];
+    visibility: 'PUBLIC' | 'SENSITIVE' | 'SECRET';
+    type: 'STRING' | 'FILE_BASE64';
+    fileName: string | null;
+}
+/**
+ * The app's EAS environment variables across every environment, with
+ * `SENSITIVE` values included (what `eas env:pull` reads). One variable may
+ * appear several times with different values — one record per environment.
+ */
+export declare function getEasEnvVars(auth: ExpoAuth, appId: string): Promise<EasEnvVar[]>;
 /** Every app in every account this token or session can see. */
 export declare function listExpoApps(auth: ExpoAuth): Promise<ExpoApp[]>;
 //# sourceMappingURL=eas-client.d.ts.map

package/dist/commands/migrate/eas-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"eas-client.d.ts","sourceRoot":"","sources":["../../../src/commands/migrate/eas-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,sFAAsF;IACtF,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,MAAM,MAAM,QAAQ,GAAG;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC;AAsCrG;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,QAAQ,EACd,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,KAAK,GAAG,SAAS,EAC3B,qBAAqB,EAAE,MAAM,GAC5B,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CA8B7B;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,QAAQ,EACd,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC;IAAE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA0BjE;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,QAAQ,EACd,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC;IAAE,GAAG,CAAC,EAAE,iBAAiB,CAAC;IAAC,OAAO,CAAC,EAAE,qBAAqB,CAAC;IAAC,UAAU,CAAC,EAAE,aAAa,CAAA;CAAE,CAAC,CAmFnG;AAED,gEAAgE;AAChE,wBAAsB,YAAY,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAqCrE"}
+{"version":3,"file":"eas-client.d.ts","sourceRoot":"","sources":["../../../src/commands/migrate/eas-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,sFAAsF;IACtF,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,MAAM,MAAM,QAAQ,GAAG;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC;AAyCrG;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,QAAQ,EACd,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,KAAK,GAAG,SAAS,EAC3B,qBAAqB,EAAE,MAAM,GAC5B,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CA8B7B;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,QAAQ,EACd,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC;IAAE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA6BjE;AAED,sFAAsF;AACtF,MAAM,WAAW,YAAY;IAC3B,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAWD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAEtE;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,QAAQ,EACd,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC;IAAE,GAAG,EAAE,YAAY,EAAE,CAAC;IAAC,OAAO,CAAC,EAAE,qBAAqB,CAAC;IAAC,UAAU,CAAC,EAAE,aAAa,CAAA;CAAE,CAAC,CAyF/F;AAED,MAAM,WAAW,cAAc;IAC7B,+GAA+G;IAC/G,SAAS,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACzE,+DAA+D;IAC/D,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;;;;OAIG;IACH,KAAK,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;CACpD;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAsD9F;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,EAAE,QAAQ,GAAG,WAAW,GAAG,QAAQ,CAAC;IAC9C,IAAI,EAAE,QAAQ,GAAG,aAAa,CAAC;IAC/B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAwCvF;AAED,gEAAgE;AAChE,wBAAsB,YAAY,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAqCrE"}